c05efd64ed73f6b609903d0dd171b873cbe42c0456fc022ca752b8648fe4f0ef

Analysis

user interaction
yes
max time kernel
146s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Modrinth App_0.18.2_x64-setup.exe
Size 21.9MB
Sample260821-t4mx1stdqd
SHA256 c05efd64ed73f6b609903d0dd171b873cbe42c0456fc022ca752b8648fe4f0ef
MD5 0bb9f423a606acff5e542c0121975b58
SHA1 47d8969ac78bc23d727821054ce2bf7178747dbc
SHA512 dd940a044e33254c9af59ec4181b4c1d1a2e28b966ef49dae757d67cd2936556d5f7e45be614d5e3d1a15b19c20c2a5349c5316a5c29279e1d59628044272582
SSDEEP 393216:1+I/+t17h2kEmG+lwqBCZyRJSdgzPMh391g/SP2sCyM6hkA:1BAt2kZG+PoAvjMR9FP1XhkA
TLSH
T11E3733DC409C8BC3DFF95139FA2D1C0AFE6EA121476F560492A09AC7EEBC949B670711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4196 created 1264	4196	Modrinth App_0.18.2_x64-setup.exe	80

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
4784	Modrinth App.exe

Loads dropped DLL 4 IoCs

pid	Process
4196	Modrinth App_0.18.2_x64-setup.exe
4196	Modrinth App_0.18.2_x64-setup.exe
4196	Modrinth App_0.18.2_x64-setup.exe
4196	Modrinth App_0.18.2_x64-setup.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Modrinth App.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Modrinth App_0.18.2_x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\modrinth\shell\open	Modrinth App_0.18.2_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.mrpack	Modrinth App_0.18.2_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mrpack\ = "MRPACK File"	Modrinth App_0.18.2_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\modrinth\shell\open\command	Modrinth App_0.18.2_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\modrinth\shell	Modrinth App_0.18.2_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\modrinth\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Modrinth App\\Modrinth App.exe\" \"%1\""	Modrinth App_0.18.2_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mrpack\shell\open\ = "Open with Modrinth App"	Modrinth App_0.18.2_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mrpack\shell\open\command	Modrinth App_0.18.2_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.mrpack\mrpack_backup	Modrinth App_0.18.2_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mrpack	Modrinth App_0.18.2_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mrpack\shell	Modrinth App_0.18.2_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mrpack\shell\ = "open"	Modrinth App_0.18.2_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\modrinth\DefaultIcon	Modrinth App_0.18.2_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mrpack\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Modrinth App\\Modrinth App.exe \"%1\""	Modrinth App_0.18.2_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\modrinth\URL Protocol	Modrinth App_0.18.2_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\modrinth\ = "URL:ModrinthApp protocol"	Modrinth App_0.18.2_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\modrinth	Modrinth App_0.18.2_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.mrpack\ = "mrpack"	Modrinth App_0.18.2_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mrpack\DefaultIcon	Modrinth App_0.18.2_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mrpack\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Modrinth App\\Modrinth App.exe,0"	Modrinth App_0.18.2_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\mrpack\shell\open	Modrinth App_0.18.2_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\modrinth\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Modrinth App\\Modrinth App.exe\",0"	Modrinth App_0.18.2_x64-setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4196	Modrinth App_0.18.2_x64-setup.exe
4196	Modrinth App_0.18.2_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6036	msedgewebview2.exe
6036	msedgewebview2.exe
6036	msedgewebview2.exe
6036	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4784	Modrinth App.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4784	4196	Modrinth App_0.18.2_x64-setup.exe	91
PID 4784 wrote to memory of 6036	4784	Modrinth App.exe	92
PID 6036 wrote to memory of 3196	6036	msedgewebview2.exe	93
PID 6036 wrote to memory of 3100	6036	msedgewebview2.exe	95
PID 6036 wrote to memory of 3100	6036	msedgewebview2.exe	95
PID 6036 wrote to memory of 3100	6036	msedgewebview2.exe	95
PID 6036 wrote to memory of 3100	6036	msedgewebview2.exe	95
PID 6036 wrote to memory of 2956	6036	msedgewebview2.exe	96
PID 6036 wrote to memory of 824	6036	msedgewebview2.exe	97
PID 6036 wrote to memory of 824	6036	msedgewebview2.exe	97
PID 6036 wrote to memory of 824	6036	msedgewebview2.exe	97
PID 6036 wrote to memory of 4688	6036	msedgewebview2.exe	98
PID 6036 wrote to memory of 4688	6036	msedgewebview2.exe	98
PID 6036 wrote to memory of 4688	6036	msedgewebview2.exe	98
PID 6036 wrote to memory of 4688	6036	msedgewebview2.exe	98
PID 6036 wrote to memory of 4688	6036	msedgewebview2.exe	98
PID 6036 wrote to memory of 4456	6036	msedgewebview2.exe	99
PID 6036 wrote to memory of 4456	6036	msedgewebview2.exe	99
PID 6036 wrote to memory of 4456	6036	msedgewebview2.exe	99
PID 6036 wrote to memory of 4456	6036	msedgewebview2.exe	99
PID 6036 wrote to memory of 4456	6036	msedgewebview2.exe	99
PID 6036 wrote to memory of 3244	6036	msedgewebview2.exe	100
PID 6036 wrote to memory of 3244	6036	msedgewebview2.exe	100
PID 6036 wrote to memory of 3244	6036	msedgewebview2.exe	100
PID 6036 wrote to memory of 3244	6036	msedgewebview2.exe	100
PID 6036 wrote to memory of 3244	6036	msedgewebview2.exe	100
PID 6036 wrote to memory of 3860	6036	msedgewebview2.exe	101
PID 6036 wrote to memory of 3860	6036	msedgewebview2.exe	101
PID 6036 wrote to memory of 3860	6036	msedgewebview2.exe	101
PID 6036 wrote to memory of 3860	6036	msedgewebview2.exe	101
PID 6036 wrote to memory of 3860	6036	msedgewebview2.exe	101

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1264
- C:\Users\Admin\AppData\Local\Temp\Modrinth App_0.18.2_x64-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Modrinth App_0.18.2_x64-setup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4196
- C:\Users\Admin\AppData\Local\Modrinth App\Modrinth App.exe
  "C:\Users\Admin\AppData\Local\Modrinth App\Modrinth App.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.18.2 --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4784.5024.4503081772570354986 /pfhostedapp:7b1de0f62987752130ffe3cd07aa6c7411e18551
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView /prefetch:4 /pfhostedapp:7b1de0f62987752130ffe3cd07aa6c7411e18551 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffd41095fd8,0x7ffd41095fe4,0x7ffd41095ff0
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.18.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,17383497438082541860,3891416725525956525,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7b1de0f62987752130ffe3cd07aa6c7411e18551
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.18.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2140 --field-trial-handle=1768,i,17383497438082541860,3891416725525956525,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7b1de0f62987752130ffe3cd07aa6c7411e18551
      4⤵
      PID:2956
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.18.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2460 --field-trial-handle=1768,i,17383497438082541860,3891416725525956525,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7b1de0f62987752130ffe3cd07aa6c7411e18551
      4⤵
      PID:824
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.18.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3508 --field-trial-handle=1768,i,17383497438082541860,3891416725525956525,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7b1de0f62987752130ffe3cd07aa6c7411e18551 /prefetch:1
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.18.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4008 --field-trial-handle=1768,i,17383497438082541860,3891416725525956525,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7b1de0f62987752130ffe3cd07aa6c7411e18551 /prefetch:1
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.18.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4168 --field-trial-handle=1768,i,17383497438082541860,3891416725525956525,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7b1de0f62987752130ffe3cd07aa6c7411e18551 /prefetch:1
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.18.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4480 --field-trial-handle=1768,i,17383497438082541860,3891416725525956525,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7b1de0f62987752130ffe3cd07aa6c7411e18551 /prefetch:1
      4⤵
      PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Modrinth App.exe

Path C:\Users\Admin\AppData\Local\Modrinth App\Modrinth App.exe
Size 37.6MB
SHA256 5ad65afcc1c3900feea554da5b71ec9b5d87c7300cdeb91c8225ec34f8817d1f
MD5 166952b1800dcd816abef5b1bae15882
SHA1 be855d515d726f3ba05750c1f8d11291ffddb5f3
SHA512 98965ecef393cca4940b8d0fe341e3d5b3827dba69ae618a7e50846f5d8e2871efb469a7d2141556e489c2f101ae97451e2b55eb5ccbd3a66d792599babf2f65
SSDEEP 393216:28Tv2qRh0F3uJC5rUXuGCA/hgWYxc7PaodYwFQ2pILZV2BAOwd2AbITegtF7e0:xTeQh0Fj6YehAzOwd2MDqy0
TLSH
T1D587AF03F6A280E8D0AEC4B9835AD633EB767C89453472BF5BE44B212F19F506B1D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 07f1a85883fc7a909d4a8eb10ca321bf8a33efad6e400e48bc9ac9c4c2a859aa
MD5 1e0d2bcb5b75d67c08e921509364b9a2
SHA1 5680b5b1bb8ed08cd6fd60e2b6d0518030749fe6
SHA512 b09a0c60da447c2397e3f15b74ec2952209a752e7e0fee162cf18320aeb711c0699b65e444bf1be10aae68b117cb1cb6ec967f283bf5c9b30129038e74f715c8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 72d3e81793cc91c5737f6bd99f875779853b53b3e1dd5bc2781d427d60d04076
MD5 2f5b11931456354bf0b52fd5e0b963c6
SHA1 3d1c8fc17d70d78e7eeeee6fedae672aeda8e4bb
SHA512 8128e4af7c5ce6263cce22759f4373824a7e0bcfcd1fb16da4bc401932804dec317cfeac3ac453f1ab454841330725e6855e3b175ad1625b73da1c6381437938
TLSH
T155D01213BE12017CF1102573140275090900C51B404D40045438896D1A540A4090A461
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 72d39d9111e596b25af899ae3ca5d0d48fb8b9b867a25d6244941f7b313c27a8
MD5 4da955af7bc3fe51e824c39e54ba6631
SHA1 25b70ab0e554c82f3afa7044cb2de4511c1771cc
SHA512 b8b5dcedaf4b4a8731d72f4363718e72473a719114850ee6ff5cb0091faffbeace02c25efd75f1ac971a46c96d8569901a69b64c68e716bec0c1cddbace3d2d0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 683ff72b2d7df97de089b30cdd48e0a2a17e4d3a754d2b6abca06c0e1243db14
MD5 dc41c40790aeb91b479b4cfa929458c3
SHA1 fcb79c2f4650a746ea30672d229108ad188a539a
SHA512 66dc1068f8a266cd8f5ab728b09d624236f069fe161e98afd1c473fb7e5e9d0539876ff5e8d699ee39fcff7d3b2ce8882bead9c46dfc7b068c042a0b3becc806
TLSH
T162F0856352EC8176CBA13D3AB0DE0820F27C05864ACB4E7F473338B6CC2ABC58C11420
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Local State
Size 15KB
SHA256 29ec25f62f43bd1035a477e105f4739fb105bfe28a18880c4fc8983b4bd49670
MD5 ccc7d3919d0b6485bc163ef4cae5e8af
SHA1 b5a3d7f7f5e7d4aa2b6d1e83006c4968c587c739
SHA512 f43f0ae32ca582950ba88274e015895c14953e69ddf3490e36e22feb939825096bdf3a1e3d23e033d5929f2d0aad7efa361cc686b914991a7c18d59b23b92335
SSDEEP 384:e+aQikB+z/xvxjg/qhE6NBSDFMAzPAVdpzq09zq:p/UxvxjgC+7fPUzq0Fq
TLSH
T198729E2B55797E37A5F7FA097959078BDBB984B290C12EA44AED5F0E02C72E81302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Local State
Size 2KB
SHA256 42d940591c9135072faaa54dfefaa6da0fd2be814d1af2379820021944534a86
MD5 bfd13a6ff25aeed18eb25d0d38bc67c4
SHA1 93987cfcec711b077f1f5d8f1ca323a1de00c2b3
SHA512 478d3e03ac63f05e713c4599047b7da7e1c418b76469e6cd50109c159b469470279d1b828482a231200f85e783ad766b4e3db6c6cd71e1f863c4cea58f42f515
TLSH
T131518333B914AB3BA9E2964879977B239F3A50B5D9911F10EADD0B1C01D35AC1701C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Local State
Size 3KB
SHA256 e79865df657c5da797de587176dc86286fffdc7b1634b1f8804f49da7d0351ef
MD5 dd1f3c434b2b2e5c2ad1fd32a7e2d2a0
SHA1 1b235de0dfa409c0b1e1538305398222fdd5f18b
SHA512 7797282930f1802e90c9ce481fae8570a7b77b70928b3c56509553255f83424583907ac2f53cae4b82bd0cd7b504aae149e14d5fae4eadbc1ee2cdadebbf66d9
TLSH
T12861863BA964AA3B9DF3DA08B9862716AB665077D4D13F54DAEC0F0C01D72DC1341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5acd83.TMP

Path C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Local State~RFe5acd83.TMP
Size 1KB
SHA256 cd22dcb14f69a1a723f08049d338193fe5eccc9aca69fc1fd64148a6edc52148
MD5 8c6a62afc8c487f51b6bde9cb16e6084
SHA1 813bd2cf75171f773ec680739de7d1844c06a6e7
SHA512 9c5ef4853deae5cb7ce27ca32f5ef0395f46bd898f7d17d01a4912296967a5e45b9cc88ac0ce834a549df52b36d26e6d289232d41d0ef8d7dcee5e0360556194
TLSH
T17C2142B7E9545F36FC92A2493153A6676E3250BAC0900F00B4CE0A1D02A25ED5626D37
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx16EB.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsx16EB.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx16EB.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx16EB.tmp\nsis_tauri_utils.dll
Size 30KB
SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
MD5 fc4691e51cdfac476b2fc63bbe951e82
SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
TLSH
T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3100-73-0x00007FFD62D00000-0x00007FFD62D01000-memory.dmp

Download

memory/4688-149-0x00007FFD62D00000-0x00007FFD62D01000-memory.dmp

Download