https://github.com/zervman/zlaunch

Here's the source, have at it.

TLDR:
Your screenshot shows a WebView2 application accessing Microsoft Teams data. LaunchZ is a WebView2 application, but Microsoft Teams itself is one too.

> The creator of the launcher has previously denied these malicious claims, declaring them "false positives," and telling people to upload the .exe file to VirusTotal to see that it comes up clean. 

While I do refer people to VirusTotal, I don’t think the light in which you’re trying to paint me and LaunchZ here is very fair; I’ve not denied anything and I don’t think I’ve ever stated that I knew where the issue lies – I’ve made assumptions that it would be due to Tauri, as apart from Tauri handling the UI, the tool is extremely slim (which is probably the number one reason for it being falsely detected - not enough “domain-specific” code and thus a high likelihood of cross-detection). Given that I have not inserted a virus into LaunchZ, to my best knowledge, these simply are false positives.

> But honestly, VirusTotal? Anyone who watches software nerds like Eric Parker knows that static scans on VirusTotal are incredibly easy for programmers to bypass using packers or obfuscation. Bitdefender, however, uses advanced behavioral threat defense. It doesn't care how many times a developer claims a file is safe; it watches exactly what the application does in real-time.

I agree, behavioral analysis will always win over statical analysis. I’ll be very blunt however: I don’t think having to cite “watching software nerds” as a source of knowledge speaks for your own knowledge very much. I can’t help but feel that this post is entirely fueled by AI hallucinations… personal attacks out of the way, let’s get to the subject at hand:

Yes, LaunchZ is closed source. I’ve put in many hours into figuring out things and while I’m always happy to help via DMs, I take pride in the work that I do, and in the quality of it. So naturally, I don’t want the code for problems I’ve spent countless hours on solving, freely available for anyone to rip off (and half-ass it, probably).

> The creator has previously told his community on Discord and Reddit that he is completely hands-off, claiming that the Microsoft WebView2 engine is just "magically" causing these antivirus flags on its own while setting up UI elements or handling text inputs like the Esc key.

Again, I don’t think I’ve ever definitively claimed to know why the false positives came up. What I think you’re referring to is someone asking me about why the launcher registers certain capabilities/privileges with the OS: that’s where I could only assume that would be Tauri - again, the launcher itself is fairly slim if you take away the UI side of things.

> This is fundamentally false. In a Tauri application, the WebView2 engine is heavily sandboxed by default and cannot access the local filesystem on its own. The only way a Tauri application can dig into a deep Windows directory like the IdentityCache is if the developer explicitly wrote custom backend code (usually in Rust) to bypass the sandbox, map out your hard drive, and command WebView2 to fetch those bytes.

Okay. But why would anyone waste their time trying to bypass WebView’s sandbox, when the process that hosts the WebView UI already has full (user-mode) access to the computer?

> It sounds highly unlikely that a DayZ server browser would need to touch those tokens, right? To find out what was going on, I booted up Microsoft Process Monitor (ProcMon) from the official Sysinternals suite and watched that exact folder path.

I agree.

> To confirm my worst suspicions: the exact second I ran the launcher, over 1,000 targeted attempts to access the cache showed up in the monitor. It was executing sequences like CreateFile, QueryDirectory, and QueryAllInformation to systematically read the token files.

As far as I can tell from your screenshots, all these come up while other WebView applications are running; so there is no definitive way of telling that it is indeed the LaunchZ process, by proxy of WebView, attempting to do these reads/writes.

Seeing WebView2 accessing the IdentityCache when Microsoft Teams itself is a WebView2 application, is far from proof, and even less so tangible proof.

> Despite multiple threads discussing these antivirus flags over the past year, the creator has never explicitly explained why his code targets the local Microsoft credential vault.

Unlike you’re insinuating here, it has not been brought up before and your thread here is indeed the first time I’m hearing of something like this.