hxxps://laby[.]net/client

Analysis

user interaction
yes
max time kernel
137s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://laby.net/client
Sample260830-3jc2rasblh

Score

8^/10

discovery execution

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
83	4492	msedge.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	LabyModLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	LabyModLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	LabyModLauncher.exe

Executes dropped EXE 13 IoCs

pid	Process
3556	LabyModLauncherSetup-latest.exe
5008	Update.exe
3700	Squirrel.exe
956	LabyModLauncher.exe
1808	LabyModLauncher.exe
2348	LabyModLauncher.exe
2952	Update.exe
4776	LabyModLauncher.exe
1456	LabyModLauncher.exe
908	LabyModLauncher.exe
3272	LabyModLauncher.exe
5164	LabyModLauncher.exe
5712	Update.exe

Loads dropped DLL 24 IoCs

pid	Process
956	LabyModLauncher.exe
956	LabyModLauncher.exe
956	LabyModLauncher.exe
956	LabyModLauncher.exe
1808	LabyModLauncher.exe
2348	LabyModLauncher.exe
2348	LabyModLauncher.exe
2348	LabyModLauncher.exe
2348	LabyModLauncher.exe
2348	LabyModLauncher.exe
2348	LabyModLauncher.exe
4776	LabyModLauncher.exe
4776	LabyModLauncher.exe
4776	LabyModLauncher.exe
4776	LabyModLauncher.exe
1456	LabyModLauncher.exe
908	LabyModLauncher.exe
3272	LabyModLauncher.exe
5164	LabyModLauncher.exe
908	LabyModLauncher.exe
908	LabyModLauncher.exe
908	LabyModLauncher.exe
908	LabyModLauncher.exe
908	LabyModLauncher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5220	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LabyModLauncherSetup-latest.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4492	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 50 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	LabyModLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	LabyModLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	LabyModLauncher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326063548675872"	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\labymod\shell	LabyModLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\labymod\URL Protocol	LabyModLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\labymod\URL Protocol	LabyModLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\labymod\ = "URL:labymod"	LabyModLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\labymod\shell\open	LabyModLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\labymod\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\labymodlauncher\\app-3.0.14\\LabyModLauncher.exe\" \"%1\""	LabyModLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\labymod	LabyModLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{D81057BE-851B-4BF6-87E9-8D4036C305BF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\labymod	LabyModLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\labymod\ = "URL:labymod"	LabyModLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\labymod\shell\open\command	LabyModLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\labymod\shell\open\command	LabyModLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\labymod\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\labymodlauncher\\app-3.0.14\\LabyModLauncher.exe\" \"%1\""	LabyModLauncher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5008	Update.exe
5008	Update.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	956	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	956	LabyModLauncher.exe
Token: SeShutdownPrivilege	956	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	956	LabyModLauncher.exe
Token: SeShutdownPrivilege	956	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	956	LabyModLauncher.exe
Token: SeShutdownPrivilege	956	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	956	LabyModLauncher.exe
Token: SeShutdownPrivilege	956	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	956	LabyModLauncher.exe
Token: SeShutdownPrivilege	956	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	956	LabyModLauncher.exe
Token: SeShutdownPrivilege	956	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	956	LabyModLauncher.exe
Token: SeShutdownPrivilege	956	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	956	LabyModLauncher.exe
Token: SeShutdownPrivilege	956	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	956	LabyModLauncher.exe
Token: SeDebugPrivilege	5008	Update.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeDebugPrivilege	5712	Update.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe
Token: SeShutdownPrivilege	4776	LabyModLauncher.exe
Token: SeCreatePagefilePrivilege	4776	LabyModLauncher.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
5008	Update.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 3320	840	msedge.exe	87
PID 840 wrote to memory of 4492	840	msedge.exe	88
PID 840 wrote to memory of 4276	840	msedge.exe	90
PID 840 wrote to memory of 4276	840	msedge.exe	90
PID 840 wrote to memory of 4276	840	msedge.exe	90
PID 840 wrote to memory of 4092	840	msedge.exe	91
PID 840 wrote to memory of 4092	840	msedge.exe	91
PID 840 wrote to memory of 4416	840	msedge.exe	113
PID 840 wrote to memory of 4416	840	msedge.exe	113
PID 840 wrote to memory of 4416	840	msedge.exe	113
PID 840 wrote to memory of 4324	840	msedge.exe	93
PID 840 wrote to memory of 4324	840	msedge.exe	93
PID 840 wrote to memory of 4324	840	msedge.exe	93
PID 840 wrote to memory of 3816	840	msedge.exe	94
PID 840 wrote to memory of 3816	840	msedge.exe	94
PID 840 wrote to memory of 3816	840	msedge.exe	94
PID 840 wrote to memory of 1796	840	msedge.exe	95
PID 840 wrote to memory of 1796	840	msedge.exe	95
PID 840 wrote to memory of 1796	840	msedge.exe	95
PID 840 wrote to memory of 1876	840	msedge.exe	98
PID 840 wrote to memory of 904	840	msedge.exe	99
PID 840 wrote to memory of 1876	840	msedge.exe	98
PID 840 wrote to memory of 904	840	msedge.exe	99
PID 840 wrote to memory of 988	840	msedge.exe	100
PID 840 wrote to memory of 988	840	msedge.exe	100
PID 840 wrote to memory of 988	840	msedge.exe	100
PID 840 wrote to memory of 1036	840	msedge.exe	101
PID 840 wrote to memory of 3300	840	msedge.exe	102
PID 840 wrote to memory of 1036	840	msedge.exe	101
PID 840 wrote to memory of 3300	840	msedge.exe	102
PID 840 wrote to memory of 3300	840	msedge.exe	102
PID 840 wrote to memory of 4412	840	msedge.exe	104
PID 840 wrote to memory of 1316	840	msedge.exe	109
PID 840 wrote to memory of 2464	840	msedge.exe	121
PID 840 wrote to memory of 732	840	msedge.exe	111
PID 840 wrote to memory of 3920	840	msedge.exe	112
PID 840 wrote to memory of 4592	840	msedge.exe	114
PID 840 wrote to memory of 4592	840	msedge.exe	114
PID 840 wrote to memory of 4592	840	msedge.exe	114
PID 840 wrote to memory of 1324	840	msedge.exe	116
PID 840 wrote to memory of 3556	840	msedge.exe	117
PID 3556 wrote to memory of 5008	3556	LabyModLauncherSetup-latest.exe	120
PID 5008 wrote to memory of 3700	5008	Update.exe	124
PID 5008 wrote to memory of 956	5008	Update.exe	125
PID 956 wrote to memory of 1808	956	LabyModLauncher.exe	126
PID 956 wrote to memory of 2348	956	LabyModLauncher.exe	128
PID 956 wrote to memory of 2348	956	LabyModLauncher.exe	128
PID 956 wrote to memory of 2952	956	LabyModLauncher.exe	129
PID 840 wrote to memory of 1120	840	msedge.exe	131
PID 840 wrote to memory of 1120	840	msedge.exe	131
PID 5008 wrote to memory of 4776	5008	Update.exe	132
PID 4776 wrote to memory of 1456	4776	LabyModLauncher.exe	133
PID 4776 wrote to memory of 908	4776	LabyModLauncher.exe	134
PID 4776 wrote to memory of 908	4776	LabyModLauncher.exe	134
PID 4776 wrote to memory of 3272	4776	LabyModLauncher.exe	135
PID 4776 wrote to memory of 5164	4776	LabyModLauncher.exe	136
PID 4776 wrote to memory of 5164	4776	LabyModLauncher.exe	136
PID 4776 wrote to memory of 5164	4776	LabyModLauncher.exe	136
PID 4776 wrote to memory of 5712	4776	LabyModLauncher.exe	137
PID 4776 wrote to memory of 5220	4776	LabyModLauncher.exe	138
PID 5220 wrote to memory of 5532	5220	cmd.exe	140
PID 840 wrote to memory of 6012	840	msedge.exe	141
PID 840 wrote to memory of 6012	840	msedge.exe	141
PID 840 wrote to memory of 5720	840	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://laby.net/client
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff8ae7c188,0x7fff8ae7c194,0x7fff8ae7c1a0
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,4018473642963343095,7733878595150088916,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,12137955060340860363,12883306897253219396,262144 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,2927401578885691272,1754253002414596903,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,13219988559786978448,11198047271886106286,2097152 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,5863009797366638451,1354772856054327939,2097152 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,1100992876218324422,9606100940840659435,2097152 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,8785894413880998611,2877951098060977935,2097152 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,7556553354995048233,10491778634381623904,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,8768831424891436863,9392316249233975227,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5876,i,1492824191067656916,16992552027664394420,2097152 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,9052754277437423439,15834548479048015027,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6244,i,17268288669638509248,1528406252278704866,2097152 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,9747124735683698863,18436311546374064436,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,9747124735683698863,18436311546374064436,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,2465230486507043667,9849358817251289586,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,11583378096935295193,3730309714009124126,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,1902637774991704764,6488282525586544290,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,2019132437539809625,2877638059763327349,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3012,i,4114406589198122414,10443791936072803112,2097152 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,148525123103878689,14763977652927713868,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,148525123103878689,14763977652927713868,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  PID:1324
- C:\Users\Admin\Downloads\LabyModLauncherSetup-latest.exe
  "C:\Users\Admin\Downloads\LabyModLauncherSetup-latest.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\Squirrel.exe
      "C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      4⤵
      Executes dropped EXE
      PID:3700
  - - C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe
      "C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe" --squirrel-install 3.0.14
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:956
    - - C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe
        
        C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\LabyMod Launcher" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\LabyMod Launcher\crash-dumps" --annotation=_companyName=LabyMod --annotation=_productName=LabyModLauncher --annotation=_version=3.0.14 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=29.4.3 --initial-client-data=0x4b8,0x4c0,0x4fc,0x448,0x520,0x7ff714dbad00,0x7ff714dbad0c,0x7ff714dbad18
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1808
    - - C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe
        
        "C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\LabyMod Launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2036 --field-trial-handle=2120,i,2946860679005853135,17863862518991770255,262144 --enable-features=kWebSQLAccess --disable-features=AudioServiceOutOfProcess,SpareRendererForSitePerProcess,TranslateUI,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\labymodlauncher\Update.exe
        
        C:\Users\Admin\AppData\Local\labymodlauncher\Update.exe --checkForUpdate https://releases-launcher.labymod.net/update/win32_x64/3.0.14/stable
        5⤵
        Executes dropped EXE
        
        PID:2952
  - - C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe
      "C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe" --squirrel-firstrun
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4776
    - - C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe
        
        C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\LabyMod Launcher" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\LabyMod Launcher\crash-dumps" --annotation=_companyName=LabyMod --annotation=_productName=LabyModLauncher --annotation=_version=3.0.14 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=29.4.3 --initial-client-data=0x4f8,0x51c,0x524,0x454,0x528,0x7ff714dbad00,0x7ff714dbad0c,0x7ff714dbad18
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1456
    - - C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe
        
        "C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\LabyMod Launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1976 --field-trial-handle=1980,i,275720671242421731,5494504931479308258,262144 --enable-features=kWebSQLAccess --disable-features=AudioServiceOutOfProcess,SpareRendererForSitePerProcess,TranslateUI,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:908
    - - C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe
        
        "C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\LabyMod Launcher" --standard-schemes=labytex --secure-schemes=labytex --bypasscsp-schemes=labytex --cors-schemes=labytex --fetch-schemes=labytex --streaming-schemes=labytex --mojo-platform-channel-handle=2212 --field-trial-handle=1980,i,275720671242421731,5494504931479308258,262144 --enable-features=kWebSQLAccess --disable-features=AudioServiceOutOfProcess,SpareRendererForSitePerProcess,TranslateUI,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe
        
        "C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\LabyModLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\LabyMod Launcher" --standard-schemes=labytex --secure-schemes=labytex --bypasscsp-schemes=labytex --cors-schemes=labytex --fetch-schemes=labytex --streaming-schemes=labytex --app-user-model-id=com.squirrel.labymodlauncher.LabyModLauncher --app-path="C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\resources\app" --enable-sandbox --enable-blink-features=CSSAnchorPositioning --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2580 --field-trial-handle=1980,i,275720671242421731,5494504931479308258,262144 --enable-features=kWebSQLAccess --disable-features=AudioServiceOutOfProcess,SpareRendererForSitePerProcess,TranslateUI,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --platform-name=windows --linux-compositor=0 --disable-rounded-corners=1 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\labymodlauncher\Update.exe
        
        C:\Users\Admin\AppData\Local\labymodlauncher\Update.exe --checkForUpdate https://releases-launcher.labymod.net/update/win32_x64/3.0.14/stable
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5712
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5220
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        6⤵
        
        PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://login.live.com/oauth20_authorize.srf?client_id=27843883-6e3b-42cb-9e51-4f55a700601e&response_type=code&cobrandid=8058f65d-ce06-4c30-9559-473c9275a65d&redirect_uri=http://localhost:8086&scope=XboxLive.signin%20offline_access&prompt=select_account&response_mode=query
        5⤵
        
        PID:5988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://login.live.com/oauth20_authorize.srf?client_id=27843883-6e3b-42cb-9e51-4f55a700601e&response_type=code&cobrandid=8058f65d-ce06-4c30-9559-473c9275a65d&redirect_uri=http://localhost:8086&scope=XboxLive.signin%20offline_access&prompt=select_account&response_mode=query
        6⤵
        
        PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,12597124126529567859,2495826440896222081,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,182954126416007221,740140602881379196,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,8751231114273036053,14188759390301444324,524288 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5972,i,16354273010577484159,9310153019951041126,2097152 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5668,i,10557727666696074942,7142840338840697240,2097152 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7292,i,10700670266288810094,14681493746387795693,2097152 --field-trial-handle=2452,i,9231945032488685702,13472754585406335314,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3272

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv TOC7OIfAr0icK3hbhGJsUg.0.2
1⤵
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7292b7f256241bc401a4edc6877bff931c1ababf0b845c6d3d2bfbd9a5b311c4
MD5 a0e1cf559d0091554785930a9a29b16f
SHA1 707a2ce00e0865734f0b7d0dd4fe20005423a5ab
SHA512 8ca73508f9d4e3acc2d772abcce89b046ee3da7d7a1a200d4133fe646d1b8c052a5c571f8969c142718350dfb7ac7209748a8bf3cf621a894d697573f6d309aa
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7e:fwUQC5VwBIiElEd2K57P7e
TLSH
T18AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e45b1264a828d0488a8cd76b586dd660a8161539495dfeb0dce5b70e990d3a62
MD5 df631775c8c24bcf52c19606bc4b5de0
SHA1 2a5e6c5aff35fd29795681dbff41c3fcf2825b91
SHA512 767e187b46d8be13dfa5234726f318a6ab8f5f4560d0777b00e435fce61617fdb8174140857b3d15bf9753c57e7955ba3ef09f9f11af436af875f47f35689d62
TLSH
T1DBD0971A92D0ABA0F82334BD322542863B8D55105543822B80A402528E4B01200E84C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 ec720b76d0cc5f37e8caf90a1e75e9534e41a1d3d173e3381842a15a797a6b86
MD5 f160d8840e50a6371906056023f4bad8
SHA1 b650470e848e7714eeb49a2482d1601a67788624
SHA512 cbf756313ac317884b272c656e63611d455cf76ef6054c260031cf2fff6847a681928a146e7d36840b5b0f7767834522ad33e04215bbe0c5a17870ad14a18410
TLSH
T10DE0DF5882DEC2BD8B0CA687A268B2A94014A515A5FED85A3354B8842C404006A793FC
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 dcb1eb57cb9b930fbbd61112726240163af8842afad49ca3f3db20154fe91165
MD5 4a6cc98f90683839d580ab77803ff70b
SHA1 be9dfde19e529f5c30bbf66c6aea6d2a9079b024
SHA512 140730494c1b4491745c42304364fd3bb629f0c3c8f1c453a00c497ee4cef1342645a4623589507f2abe68196330044d48008dbc101c2f1bcb60af0870907701
TLSH
T161C08079794C845DC285187EA736F000177066115417DA130551FCD031409A01F2E124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 78c83c02431ae6035ce351194164be22653b7c12c4cb06780a6d91c244421373
MD5 9f902c322595149aa49ee61ed06e2d90
SHA1 6f79d205f0b6bfcb40bcb5530046aa6c6a7dc306
SHA512 70b61ac30f199020d601e22526d0703785e08536fde5ee34b7c44ca324bb59490caf19caa0f48612347101bba07166a0b525bf64aebdf0bea387833db6e4a14a
SSDEEP 96:J2m/pUUOMjshZJlbZI3vHto8HW9EjSrTl1:SUrjszVUyEZerX
TLSH
T1E3B18547DC88D8D1DB3FAFF0C5E25D8038BC80670D9B4ED6A98490BDF8267E19D5200A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 241c2de29df9271261b9b0ebd4b5155c81aa40aa6c6a80a81150fc21be7d3627
MD5 f71bab9d1708cbc75f608d127b51e352
SHA1 aefce14f0b58999eb53c6d6714a9ef2c2597e9d1
SHA512 a7c9831a3e2be31a4275a0818e47717577b2711b066919cfb9065f64fafeb1a88efaf7cbce8fb94508f264e900d2584203afdaadaaf6e146f3cd205a1927cd57
SSDEEP 96:H02moTpUUOMjshZJlbZI3vHto8HW9EjSrTl1:HVCUrjszVUyEZerX
TLSH
T1D8B18447DD88D8D1DB3FAFB0C5E25D803CBC80670D9B4ED6A98890BDF8267E19D5200A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 f4174c2dbcf08f54dded4cfe7e5397895e112df1bcbec5a8ab23596a6e01815f
MD5 053013e7db0e3820e527b2153f5232d5
SHA1 5e1d56ee53b9a2fdbaa21749a56b98c26a0477bb
SHA512 b0fea63987baeac335f441e7c3ee3c3e93b97d044f59c31e24626d2257a770d9c30af2f6476183164538b00ef392231e6ea7ec7e47d28eef3dd2a388e01a017b
SSDEEP 96:xy2m/pUUOMjshZJlb0KNI3vHto8HWhLjEjSrTlu:xjUrjszTUyEVerE
TLSH
T1C7B19447DC88D8D1DB3FAFF0C5E25D8038BC81670D9B4E96A98490BDF8267E19E5640A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593510.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593510.TMP
Size 3KB
SHA256 3f7a2f8d4f19eb01ba3dc902adb3045f08f4a66090b5298a07512c5cb1cb743d
MD5 85e5594a9c843c71bfbca147df1cb0fd
SHA1 64f61b1a54998419700cdf5154cd1002bc24182c
SHA512 12feb40cc162abc970d06ea82f4e98bddfef74c17b9dd42f08f4da6354b91e27cfaeff676373e7ce6e6a97e2840e28ee256242b5d08be9af71efeba9acb2503c
TLSH
T1A3716E4BC991D892E33FE3F1C5E24E913DBC912B09A30EE5A944A4BD98397F1D55700B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 55ad3841b03bb9e4fadee4ada478e571b16b8f8af267e54adb3e2e2e7f1bd33a
MD5 dd4d293325b0180eff6a5ea95ff71d89
SHA1 1ee13069d4bf5c9f2668e6263759998d9fa50248
SHA512 f3887f381a5eb38d873381ac747c7d0d570b3e4fb77f927a1035b29e72bb7893958f8dc0034b6044d76de0c796b842a6ff646a2f43298f77aeeb3975ce361efd
SSDEEP 3:MsEllllkEthXllkl2zECal:/M/xT02zJal
TLSH
T1BE44041C7FC00C05CD0011304011C7504374D4100D55D74334D10473FCC77C00C05004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 00d86212e201fc857f140af042ece854c110574d184ff2b90ff7a76c43e23f47
MD5 d4e8c6fb9d67d669af5560d8a0eab896
SHA1 8ab1ec9cb31ea85eeb9b5b714e31d3866f825a50
SHA512 dad458098b6957db9195e68b4984d649c1993bc04a4820f1cc8b98a618ad0f7d7af6dc81f5a6a7df068470d5442906412cc83734994984fae1902d09a0e884b4
SSDEEP 96:DWOnn3MSSJX+uuZzBpBBl7KIQFbluZvihxwbMi:D1nn3MSSJO7Z1pBBlGIQ5l+viLmMi
TLSH
T15DB19FF3D2E6826DC85252F2D7146E27DE1D4905926C3C0AC5E4AF9BE3E60B0F142A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 719263d17378817aa10da6c533befa4fde3e8f01419936aefc61ee4c127692ea
MD5 a015806df1378e0329ba7076ee90bb90
SHA1 4312edfd9494f135f9d511b3bb24ef1ea758372a
SHA512 cbbbf3e5dad3e852315224b53cadec45fbc96e7b32060b29ac0025bb2789feb1a4467e6e16ecd1f2f269338a9076aed64ab437a8dc13b7da4ed1d92018bfa3ec
SSDEEP 96:DWOnn3MSSJX+uuZzBpBBl7TQFbluZv1GwBGBqIob1UwKbj3h5:D1nn3MSSJO7Z1pBBlvQ5l+v1GkeqIob+
TLSH
T120C19CF3C3E5826ED85252F1DA146E2BDE190905936C3C0AC5E4AF5BE3E60B0F142A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 674ef4df7ba1401b26ac21248a3305ac36915ddb5215521214d30fb00aaeddc0
MD5 b262cf1b92e7339d3b72f130b5906ab3
SHA1 ecda018ea949c20c0926fff1831445bac7f6d149
SHA512 3e4665a2644d158c1042a8e7d2a188d9cb0db64dea9cb473c38cc0958f2673d338ed96121c050d1dca4fe24614d4fd3ff043df6a54c93091185e7091027910ec
SSDEEP 192:sxZsBR/yM/jK1Ml8Mky/fdsXNrnEdpQNHW6+WNPhG/Y4cpJIgrJ:sxZ8rMy/fdsXRkkHbg/W9
TLSH
T10E42F911AB346977CCCBD309FA51BF53D6F50562A2900E48AAFC8A1C04E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7b9e323d8bfca3019f3c6c861b319b9cc1dc7a1c9881117b75b45abeaf281048
MD5 c4d94dee2490829d18f3b56fee08edee
SHA1 4889a21b729580b9211db5151d64aa96a96af793
SHA512 f198d43236b1f72b9ed4e0aa3c2754c8f596ad7ab7e27aba55e1c25a514d214f590e52a156a88222bc0fe0163aa23dea6ff1fbc3803579e4413cecc886daefb1
SSDEEP 192:sxZsBR/yM/jK1Ml8V9y/fds+WpVgNKiIdpWcuqyHW6+WN/1b4nHpSIf/YQYw3eLH:sxZ8lqy/fds+Wvg4L5yHbd8UM/YD3
TLSH
T18E62E712A9745977CCDBD21DFA55BF63D6F8442292900E44AAFC8A1C05E7BED220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 00f79c4134ccde710bf031e2b94b157ca75a4b2251cea73697ee3ea10dbb1392
MD5 b59f6b7176707e85bf040307e14ebea8
SHA1 99d93459ce81173767b767d9939d59978beeddc0
SHA512 5fff5431a92ad1639080b864886342cdf50b4ca04f79420a58cafccb9ba5b6d8461810fdeaecd652f9ea95318eef9cdc579eafcc8cdcda642e61cd56a2365ca5
SSDEEP 192:sxZsBR/yM/jK1Ml8Mjy/fds8NKnIdpQNHW6+WNPnHXY4uHHJIg5pJ:sxZ8lby/fds84okHbfXEV
TLSH
T14C52E811AA346977CCDBD209FA51BF53D6F54472A2900E44AAFCCA1C05E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 928200e1801f2ab3fb581dec6c97fa3fb59f817eb5abe8e564bf5ab9c6087be6
MD5 45aea354162c3814d39e1b876fdb17d1
SHA1 56610dedbd1f6c0316f8227f901610cf9f260055
SHA512 4df57a190e9b6298a511c2d132015d0aca940842d1d6bfffd46a5b3a752c58424cdab75770fbfef74f0b4669abc908216df0e93ac6feb46b67d90f9a0552e1d3
SSDEEP 192:sxZsBR/yM/jK1Ml8M9y/fds8NrnIdpQNHW6+WNPhG/Y4cHJIg5LJ:sxZ8l1y/fds8RokHbg/2j
TLSH
T1CA52F811AA346977CCCBD309FA51BF53D6F54572A2900E48A9FC9A1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fe984ffd9c93e9a63d1e2ad4f61a72f9ce586d0053ddba7eb4c44c4e6276921b
MD5 72b8f7bb83f0a5b680e7bd12f5789c99
SHA1 a43957a64fdb93c7aaa23583bb8871af224c9ec5
SHA512 37190bd3ebb0701dfdaa89751686c9a50382f2f9561e7dc04ca78ded74c18df1f5cd51f4c30a93274882f2c1e7883e53c00b200503d09831cf6204e0e0718d9a
SSDEEP 768:kC8iJPNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdPro8keUnQ:kC8iJPNWvx78ru1jahALocdc2UQ
TLSH
T113E2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA484C03C76EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d900f1fec3160afb251a8ce7d68ecad4870a7663368c78a492f67e65ec2f7680
MD5 c6e94fb8d13981afdc63fc5fb1193bae
SHA1 8e176d0125ad31117316d4096a03bec03afaebdd
SHA512 5e1343ce88d00bae25ae84187c8a917605f29813c4971f23f39269b74224e23b2b22c2232cc10e9fc9aabbe4d32d14e5592c13f72ad187df492e6d0d2d7faade
SSDEEP 96:KgxmKiAa6GcK3qO+DYMucAHHoleVUHKtGVCHhW+dYQMKOcKTCW:EhPKh/l
TLSH
T137B11D1135FF4A513DBE254CD2A0962A468271737418E82E7BB910B20F6AE250DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02da5db8-28fc-4809-bbc9-ab518abaf911.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\02da5db8-28fc-4809-bbc9-ab518abaf911.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 afc927aaa705fdb44399f15be23f365a21625defc276382fcf5a76c88b29a644
MD5 672811dbe4253d22a9094f2eca9522cf
SHA1 af085626b0b2a68c2ee3f6e3bf74f542e52358b9
SHA512 1e7d54c2829ca01fcf37e72ea2908551d2cd4c3cb32776a68dfebec2a4217ecd9eb335894b5c7554ed25e53f1d6d1e5c650506e8e2690cbb3af5dfc4e56c48ea
SSDEEP 96:ZqONkdQsjpfmUTmDK5ih/cIPURHl8h4otop585DaBhPwivh50xy0SFYKzAxqbsah:gONp6kDfQmiUy+KZ903Y2Qig9U6
TLSH
T1C102E83968BC2CBB8EA3AE09F48737175FE5213BEA952F84D5E81A1C40D765C2307526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 233c57d06af079837a26bd9229fde95f52de2df2bd38ef4c271f0cf487501153
MD5 5cb740937809d8f0003d7b361a2e2a60
SHA1 3d9ea84b3137b81a2db76d33de929b19fbeef0eb
SHA512 741a691a3c6674841bd2328807ae0e95217e530a0698ee8f6312a8cd9e0e38a954ca1795fd3478bc5051254cb3844c9cbfa2af6babcf7d434cafe7230bd85bea
SSDEEP 384:RZcIhsN9+3Ythtskh951A/KuXdptVPLusT7ew:5hV6/1A/NX3rLT
TLSH
T12D826C715CB83CAA5DEB7546F48B36179EB89537E7C86F80C4EC9B0D40EE5A8130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a60aadbad382c8705df5f3ad2b417803cad865a782ca17037d67a8b0c039b7d2
MD5 25a64f94ece5153d6492b8aaa5979286
SHA1 7fc36a65c8651361ee746ba3d4a3fa2af08833ce
SHA512 04259cc1ef8fef45635040738ee56a861ac78b10d1673774effa90e56804b21e4f3deed954f17d44d3eeceb3a62c337318cbe29a01c4440dd4272bdb31356c8e
SSDEEP 384:RZcI4sN9T3YtVtskh951A/KuXdptVPLusT7ew:54EM/1A/NX3rLT
TLSH
T1F6826D715CB83CBA5DEB6545F48B37179EB89427E7C86F84C4EC9B1D00EA6A8130F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bc9b1174a12cbc94c9621fe9afbab175dc1a8c675dc3d5875b3032a094e4721f
MD5 a5be2c73be6908dc769786751fd2cdf3
SHA1 3513edda8571dd8f344d544b64b494084f646e40
SHA512 109505748c0fcab615ba5add7826eb1f4ea16be218fc6807f7aadab11aa6c154c66c648499f13bd6875dba743149bb30bc7c11b47c2ee757cdf5135dae881a1f
SSDEEP 384:tZcI2sN9v3YtUtskh951A/KuXdptVPLusT7ew:12kV/1A/NX3rLT
TLSH
T19A826D715CB83CBA5DEBA545F48B36179EB89527E7C86F80C4EC9B1D00DA6A8130F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f1023e7ab6e6d3f8c8645225692c9a6ddda7729f9cdacb79d9cdc702e3c758f9
MD5 7f755d9d65e0b8e94252d42ca209a0b6
SHA1 8256d240c5185bd332041936da2cd997284a01fd
SHA512 4f268be17b2f1bc182e850ce97fca1a174667efd5fbbd322b5b3424c708a6c6915fdcc7216d5e2855d2812229a6d99d6422e83c5d613503a8bcd412588acd1e0
SSDEEP 192:+LsN9+Q5MYgmJFQmiU1hnDZk03Y951zcIIq5jU5U1G:0sN9+3Ythbtkh951Z/jkUw
TLSH
T1FC422A3168B87C7A9EA7A545F48B37139EB8912BE7C82F94C5EC5B0D40EF5AC130B416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 979dd0c4852c17793d421e6a3455079b380651d1e1aa6b71a50ea15bdb11b0fd
MD5 266f55a88812af08929ef11b3397f5cc
SHA1 de32663a644fe79e0b19e584435ede91b3dcc4ce
SHA512 78896e6bfc00407107e4fafdd7a5103c1dc0162cb9eed0717ed6e5a79330879daf922451ce2f3e78f4c412b05c622dc17b2d7bf6796b3d6f0fdb87e60dee95b9
SSDEEP 384:KiFwZcI5sNH8TUNTUlIlv3YtUtskh951z/KuXdptVPLusT7ew:BFO5+wgNV/1z/NX3rLT
TLSH
T16CA24C724CE8A8BAADBB6A45F84B32179EB88177D7C4AF90D5D89A1D00DB1DC130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 c90c919696ea131f5c1f9e92097b092164f4e58d0bc333a167b8593679830a74
MD5 8887ed7bdf47c560f30e835d35387165
SHA1 64614fad9036ad8ad700c7a76022bbd0f70bc95e
SHA512 797040a87b35d8c80ae6f9922ea2f2ee11ff62aac4bb11e0c24e580f2ba6996185504084c6acb2498209a9af0c6f56b273a8752f62d422844ea3638fd9c13ba2
SSDEEP 384:KiFxZcI5sNn8TUNTUlIlv3Yt2a92kh951DTXvUASBpA/sYfqKkBEKuXdptVPLusT:BFZ5awgNs9J1DLTSJYfqtENX3rLT
TLSH
T13FE25CF188D75CBAC49DA7C7A77DAD0659BCC033B6885948B3E8652CEC5A0BFC306850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e60512e7f8f99cade4600de73831b08ecdb171d3d22a3272caf09213a046a3c3
MD5 4b39907feaa000231292bc76493db6e8
SHA1 0d4f1681fd96a06c76ed6b7740e7ee616732f436
SHA512 cc139d37f9c40150c2b512f3bc9605fc6ce6db7e03afbb1a4266c5950699c08619e540ddcd9c187bfeb1d33950f6cac5a8ee09208afc8dc7752a9a3d9cd16e28
SSDEEP 96:HqONkEQsjpfmUTDK5ih/cIPURHl8h4otop58lDaB6Pwivh50xy0SFYKzAxqbsaA+:KONA6k6QmiUycK8903Y951EcRIq5U6
TLSH
T158120A3168B87CBB5EA3A545F4C736179FA4422BE7C96F80D5DC161C40EF6AC130B526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d73966ed-c53b-46c2-9da8-d7085efa7504.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d73966ed-c53b-46c2-9da8-d7085efa7504.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 960e13a4a4dd76893d8908a135983c372f6530a63c72ec6cda780e478fb1934b
MD5 b81f0ba2e0d868cb4d21f594df4fcd82
SHA1 54fa4106dad9e0067dd804aa0b74d1a81955b13c
SHA512 4ca5b3f168d13cc81d93e322bcc5a8b9c6585fc50cc0008e793b1c50d9423c51cc7073610b415daa16412336d53f912d8c1fa2026a0cd6b83da13d44afe75227
TLSH
T1EE41DB58A6FA1148B3B77F5AABF7686E487B7C371E4A949D00110D4F0A63B41C872737
MD5 SHA1 SHA512 TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 87B
SHA256 d613bc93816ee40a13d90884c9024ab4d56abb08cc8afab3609d0b794674cd3f
MD5 28db1c2aa8b22e47b2b9f17d3b448c98
SHA1 456acdc104ed60b5a84fe47abf2f0bd239b343ba
SHA512 8524b1a86517cd62067ed008a913a703aee33eded3573de33b241923276b5c6ad3e7f0b1054b44e055fbf090d94cac65b460319a9be6b35e5e821aefddc5ea38
TLSH
T1CBB01218D40321A599D5020383154023D4682100158D30640410FF0A248C59F3080000
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 99894e3abb356d400fef1d6195f3afd07c91aaf310a7dbafc46649bb331ed88a
MD5 483671a358d79a0c9db8325fe2c63780
SHA1 901b1f139fd7f2539cfcdec963599a1268200d57
SHA512 262d165d2afcb4cddd5bab8adcbcc6cd8fea4951cf8169a1aee1e11c1f83eff87b6265a5c3e21ee4903000666649375653215c56ae902bcce9d123306430afb0
SSDEEP 24576:GWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2:nt3UCiag6CKM2zCyZuOjJaxSS5qh
TLSH
T151957C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 75KB
SHA256 c3269dc06f80f82a0882df42603f498ac4739e79ece2e0f35c1db21feec851ef
MD5 1161f70cd52f1397a0ff06a3dd7d4009
SHA1 839b9bc59faae57251e64c2b7fa40af1b44f7ccd
SHA512 d06771908b7afd918e48cfab85515a56c8e78c5a89c04fd4341dc7a7e2ecce732a94b658aab9094e5ee9799672acbb3bad184aee05143acf1a5c7071f60048b9
SSDEEP 1536:RL80JwxMxXTLCkCeoBs4upTfhkmiG7qSbq8Z4kO+4Z8OAxJtuz0aeAeonXizb:S+q0Kk8nC3D
TLSH
T1F573BEB4F29DC216FEF8977AD9210E7F432AD23B4C205D498E41CB7956EBB250904E8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 122KB
SHA256 0e684d8f833fd47d4c98d4742ce46abbfdb1f4b130da4a93047df9926f189e46
MD5 4bce15bbb0487f88efc006fd597441b7
SHA1 da5a02653245112aabfd45429c417c39fcb2f67a
SHA512 e128d96cad8d214d41b60a7ab129dbf105866fe895d206c5b77b65af04c5d83ff1be87ece9b862dc30c88faeda69cff185925d7ae7b311c5351ca664db4a3060
SSDEEP 1536:PjsIx3bXjWsVqktoS/Msy55QKmiztz3d7pBpNMcGxWaRL+c:Y+bZ5EsS4izb7pBHhGWpc
TLSH
T1D9C315D6A2509BCDE5328AF46DE699B800F96FD3AFB41E5265987BCF0E316C11803D0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LabyModLauncher.exe

Path C:\Users\Admin\AppData\Local\labymodlauncher\LabyModLauncher.exe
Size 386KB
SHA256 d95415d5f26da7cad46d72e8eee828bf4b93f83f7cda07305eed956685a53169
MD5 94dfff169ea84b1ab49114ab5ac37a37
SHA1 465b7b67e6f97de0dfcab0c387af928387400379
SHA512 5fd29c6d4cb4283fc22692ae42e8d87f86d1a327e299635b08c14cd1a572d7fc62816dc9a779d8254cc48f34b2952f4b2036cb8bb125484a00f131da475a6c57
SSDEEP 6144:qZzvhs2Z4n1E7g34XtVYAOfTdDbbA7vHhGsguUKqS:qJ+2Z4nShVY59XA7vBGsguUKqS
TLSH
T17584E3D1B58287AED07206B01DE496B955F9BFE35FB14E27228837DF1E301C24622D6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\chrome_100_percent.pak
Size 150KB
SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
MD5 b1bccf31fa5710207026d373edd96161
SHA1 ae7bb0c083aea838df1d78d61b54fb76c9a1182e
SHA512 134a13ad86f8bd20a1d2350236269fd39c306389a600556a82025d5e0d5adaab0709d59e9b7ee96e8e2d25b6df49fefea27cdccefe5fba9687abf92a9a941d91
SSDEEP 3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
TLSH
T174E3E1D7B7F4ED3DCA5B56B7A61500B2ECB346780691434B078AD8363A76748D8C8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\chrome_200_percent.pak
Size 229KB
SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
MD5 e02160c24b8077b36ff06dc05a9df057
SHA1 fc722e071ce9caf52ad9a463c90fc2319aa6c790
SHA512 1bf873b89b571974537b685cdb739f8ed148f710f6f24f0f362f8b6bb605996fcfec1501411f2cb2df374d5fdaf6e2daaada8cea68051e3c10a67030ea25929e
SSDEEP 6144:gDQYaSN6svydrI8jDQUgx5GMRejnbdZnVE6YoppO4:NfSN6svydZ6edhVELoXO4
TLSH
T1A734F1D763F89D3DC9674AB3522601F1ECB2013946B6424B03DBED357A96BC988C92C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\d3dcompiler_47.dll
Size 4.7MB
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
TLSH
T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\ffmpeg.dll
Size 2.7MB
SHA256 bbdc881f5de411cc379e2968a48863e16381176cc1d9a7ba66ee261badd03f81
MD5 cd19f1aaf5a2477458a81ab1d2ce2803
SHA1 f93bd677ffb8cbe160483cf002ab4f44630914a8
SHA512 4bcb2d29fd6f5ae664824f716e15950e0599da36a3adfd9a13de10d88ab6f93ebb181ff259c455f37ee3097dceda25370e64c227981217aab902b1e4e7310bc8
SSDEEP 49152:V9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI0:bpKNMo8rBYinp/FFJM0
TLSH
T159D5AE06E6DA40DDD019C1348A9F9223F63139468B24A7DF1B819A253F7BFD46E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\icudtl.dat
Size 10.2MB
SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
MD5 74bded81ce10a426df54da39cfa132ff
SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
TLSH
T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\libEGL.dll
Size 482KB
SHA256 89b3c24aa1c1fbee1676b993b885c9c79d00f548b13d8e496a15b41022fc8c44
MD5 38bb0eb686c73fdccbdd07ee799c85cc
SHA1 f17c868a5a15570dce64f75e829fc863f4baae3f
SHA512 8b552f9bfbdc91f8e70715a3c9a9b65ef32bf2160d822a0a43d10695437709cc84d293058dc30ad37988f14d0f021a35748259a3c3504ac051b0bc47f438047d
SSDEEP 6144:7bTcZ6+lOP9rmD7QMYYtaFy951wj5Hep:oc+lO9rmD7fBHwj50
TLSH
T186B49D1577D444A9E06BD474CA534642EA76B8920F34FBDF02A492392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\libGLESv2.dll
Size 7.4MB
SHA256 07435345e70614ffe4b0709f1d280117997330a06875f9785a64d84954201e95
MD5 4045adc4f15329ff4a2b817635bf9efb
SHA1 2e9270146c573b33181d2c92545cfd701f5b9fff
SHA512 5319a36a042151cb969bf831d9e04fc490cf6cafa63e98bd2aa839f2782ea9858f0260ac2d9a399ed7d4a456ce0b181322b62720027b13403f91a936007f84d8
SSDEEP 98304:QAtO6pdKPGHE4VhfA7T+G5aPia5HXm35:JNAPUVh9PiAC5
TLSH
T10F767C03F29A40D9D45DD2B5974B8123FA31B8895724B6CF266413253F7BBE06B3EB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\locales\en-US.pak
Size 440KB
SHA256 20be1732675fedf380010b09936ed65c71bb761d0a05732215ef0795b5aba606
MD5 8f164155d22029535cd60f47966a89af
SHA1 19733935efe68f7ff3e2a84d28317e0391eb824b
SHA512 4582715817bb9c99d875aa89b1efbd0f70b63dcd37dbfc64e3078d1d4d7ad4ae8fac5a703afe1fc65b9af2f5c0fe8d3e293e2f0530106a6974b38b4cebca9db0
SSDEEP 6144:UVmES/piH64PrXGM0w3jMMP9eD3D9faYLbcNx54SbngP/eoQwB:Umz14XRlMMY3DzA54S+QwB
TLSH
T10CA45C1FF744222A069352627F09A5A2FF36D06CA35112563CBD812C33B7B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\resources.pak
Size 5.0MB
SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
MD5 54790975c932460ffa375cd0f0f8fff0
SHA1 05b72ff82abb8ddac1a92471f765b87b7ff1e9fd
SHA512 d74627207caa35602e68ad6c08a0ebf55fe062e191a1885eb38226755d382dd3407dea883e4337c5cff23c1f724d64e5598edf7a5ce93d4cc1ea6ea10c41aa0e
SSDEEP 98304:UCNks/PeeUfLi93zJ/HbKKSoDr+cgSrwrNl8dtSip6QaVaK2nwuoM10mpmjy+0V4:UAk03dB7KRcRkrNi/SQaVN2wuJ10Le+1
TLSH
T1103633C77AB4443EE905633B401D4B752F29F2C61B612036705CB59DBF3A6ACAE9407E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\resources\app\.webpack\main\index.js
Size 18.8MB
SHA256 70331691e1fb3480522a57036fa1ed9d1e71b81756f4f040dd29d9975e34bb91
MD5 c2f13305090f194a6b107be0b2e8a8b5
SHA1 4c6e14df33247db5b8f555bb60308f337fa55c77
SHA512 7e6d146e84d52b8160a6ca3f87488ad33b792b0dca25097da5f397ad1364281effcf1f8d2ed69d9693c2e730591dbd76d938dd0ad32b60e8be654d46bbd0ff7a
SSDEEP 49152:9yvadYn+puX1RCAEH3eSMoj8hdxMnz57bUqRlsn84WGgTYzAiBkCXi1h8HoYEguq:d9YMXYi+
TLSH
T108172A9EEE1838B4AB117BDACACF41E9119E774655928708FC0CA58413FF21C52F8D6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytar.node

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\resources\app\.webpack\main\native_modules\build\Release\keytar.node
Size 705KB
SHA256 daa1a7bc5b544fd467cbaeeb620412ca845d7650dba1c891614030862af9f2ce
MD5 a205cfb631c948c06419274336ec2f68
SHA1 90039a54655dc7e7861f4e4f6a1e04a607bdc47d
SHA512 06227e964517ea2d460201636595b42215ac3d079acffa8d561d9d3f5f006b2e00fff320d13c6aa3747c555f9573e52b175a4d274959cbdcca3df4772ac2dbaf
SSDEEP 12288:bRInDhSzUpqDDa2XX05VNpk4th460iQlp1Qk5wUFPcvKKR0JQQ8jKOx8I:bOnDHpqnaskrdxz
TLSH
T15BE48E6637E811A6D0BBD13FC5978F99EAB1BC140720A7CB01D442A92E13BE85E3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblzma.dll

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\resources\app\.webpack\main\native_modules\prebuilds\win32-x64\liblzma.dll
Size 161KB
SHA256 c7c6431d9e52297ea730484a49d1b3ee6217e4ab452086509fbbbdd9187763ba
MD5 7573ad61b2f1e1e9ed6539f29bd2bcc9
SHA1 30651ebea124495a4559e290af92e8b5272085f8
SHA512 82242f870747a73eea21f15a9cc080e7b55d443ce1c3feaa53759e882fae59a81ee1ba0cefd54cdf2c3f0f7ad6ab486c630c3445489b0a5f9626e6ba459fca14
SSDEEP 3072:eLkFJu59WjUfFwgJEvCSYuw1flpY9mNoWPwxA8:jFJu5EjUfFxqvCj76YOWPwJ
TLSH
T1CAF30856A291F4D9E767CC30CAA2AF33F4F0785642206E2A529CD73C1A6FFA1161D713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\resources\app\.webpack\main\native_modules\prebuilds\win32-x64\node.napi.node
Size 810KB
SHA256 d2b3a0647ec5a01b988bd35e6d88e1ae40bdd6c4f33ec169e52683479366d201
MD5 faf8219bb70e9d4b50efa407bbee0b67
SHA1 d31cc6fca3d331f6034696277d9921eb7db571b2
SHA512 6b497ee42eb4d0d7fc20dbe161c066960f217803c70cdaf64abc4bd08cb188c0a94d20aa171dbf7d5c71f69dccc3b8596bc7553e0231efbd2976cb503ff10b49
SSDEEP 12288:4vWhpNRexpxqf8qFl9CfrumyKlAsppNDInGPpbn+JY2ef5HDek7hEDi:yKRexefIek7hE
TLSH
T11B057D662BA81292D0B7D13DC9978F56EAB1F8154730A7CB01D0459D2F13BF89A3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sql-wasm.js

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\resources\app\node_modules\sql.js\dist\sql-wasm.js
Size 45KB
SHA256 77d6435bac506af0e3c59636dce9d22b1b14156348bc327f41a1577f3212360f
MD5 bb5308ce4d65bf572e24c96aeb3d8e54
SHA1 61ba5aee6d9c70dc5941239714590209fb8b08bd
SHA512 d88a122490346f696b7ea5b6962e92e0875cd0b2acfe336aec0d4eb3b956f4b38cb11cc35970d272ae8a61c7bc1dd670c52bb568495968175057d74a2647a696
SSDEEP 768:esn1IVU3qPci2APOfCyiY66WaZIRHYsS4Hi/BIjl7TaZeDy7l2:es1IVU3E+SOKY6B62HA/+jVTDDH
TLSH
T120231BC2F6B67026535735D040AF018AF3689C7AF29C81F8F1C8C9E25F7525699BAF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\resources\app\node_modules\sql.js\package.json
Size 1KB
SHA256 4c661e7817ffe4076bcc3f79f3a8085cb0a87685e6c21d50fd203a85b0c80bc2
MD5 122c642a5346950638603e32cb813ea9
SHA1 24315bc466232689e8c88010190d7a73f111fd0b
SHA512 26ac403e9f09956a0acc13bdd0e72657b040ba37a16aeda065fcb19a270797bca84d094351cd6bab70c38392cbb5beaf350cb86d9b6fe96098526c0dd0fd9a80
TLSH
T1FC31010748BFDAF33BC59F5ED05CC3C1E0F9C21B818FDADACE59319146194A5206AA76
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\resources\app\package.json
Size 4KB
SHA256 6beaaa6ff8e27c1d92c33ba1646466fde26dcbd748590bff87aeee2ddd488865
MD5 7a066a0482ac7569ec1444e29f12d5b5
SHA1 cd920d2f78bab2466b22c9139b955928c769546e
SHA512 8ad2ba257cb331e6278e2478d0ce65c186af232d280565f56518c9b2ef48f236b573c9c3a544db10c60564a336567fa9122572000e05c6662d89f66c16d9d968
SSDEEP 96:Nri5v51zHKzHWzH1zH1zHuXeJS27NSokZXKcsEaEY0JgfhpdKBNGFoVsA5E4snLm:Nrit/zqz2zVzVzOuJSGRkgcsEaEY0JgS
TLSH
T1B4A1D960DD07CDB31AA9015995B00B46917D84974DDAFC8C3370976E0FACAAF32B8B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\squirrel.exe
Size 1.9MB
SHA256 4a7c5e2ed5ba54fb13545d30a462ac9f1699a317b53a0fe894aac56a4844c1fc
MD5 585f71e44fe787530930462ba1855212
SHA1 3cf12707d0864b58dae112bbb6af60fabdc445fa
SHA512 e26c8fff7a35dfac4be9918e01f055ae978ff1006c2a372251205e21b5b42db52c478526305c2c90db116bdf8889d2c9cba34fb367722523299e40b66332a8fe
SSDEEP 24576:jWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9mpCBzh:qt3UCiag6CKM2zCyZuOjJaxSS5qh3B
TLSH
T130955B01E7E88F2BE47E16B5A470057813F2EEC76771EB8B264871BA2E937804D05767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\v8_context_snapshot.bin
Size 663KB
SHA256 b7cfe8e823588a3bdb8792cb1c8d679fc998687194b3e906931ff9c7ef5c3461
MD5 cc756c4c369ce2e9994a85a3d2894241
SHA1 544809241dcc8bde21aa6da16f4804f77a6a6300
SHA512 c62b31041a99ede39dc5379d1197531ab76c475b36920e9503dc0789a710ead867188b349ac2f226d09ca083029f369a82deab9c24aab536aeaec04d89acd25d
SSDEEP 6144:U/h8ML2Zu/Bg90Ws9oCM9Otxh6vtDINPb3sTtLAkW/XB2Z0JHkQXEzkO+lr:UyMSZu/Bg90BuCz3L/R2ZGHazYlr
TLSH
T13CE46F53F749EE03C66939B389FAE9517674B8C8AF06471B7798533E3A3A3252E0005D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\vk_swiftshader.dll
Size 5.1MB
SHA256 e935986309977da466fe074c6bc99fac06752acf000a3576f36f8ec7176f8851
MD5 78072d6e1c19cc5f9c7304581abb219d
SHA1 c94891200fd7068370bdb0c98b95bf90aadef7a7
SHA512 99207d83d63ea56ed596cc8ca78c13c89baea65be6fd9eeb1a5526653e87bffb9b3dca1a33e2fedbe7e0f6fe48d1ce3eb02fc90ed2ee079869a4daefdea5773e
SSDEEP 49152:/L1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:j1w7weOqiFIYBgTE
TLSH
T1B6363803B2858199F05ED179475BA632F232F8801B76B6DF52A41F192E77FE02B39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\labymodlauncher\app-3.0.14\vulkan-1.dll
Size 946KB
SHA256 95494c8189cb8c4ecc64d196241a3fbc3be0d040e811ca45459364eb2552350c
MD5 fcfeb48ecc243a5472f61243201b85b6
SHA1 8d99ffe4b61b3437ffc9932ef42d897d0d0c02a8
SHA512 fe6155116ec26f8cb94b9fe0f500e18a323f5b60ee944fc5fe132d23469d7af4ca87027b7e4e4a1c8e41f04bbb1cd0cc54fc7598fe5d497914f48ce4bf6d234a
SSDEEP 24576:PkMYSDIukxvnwhdzY96Z5WiDYsH56g3P0zAk7lEx:Pku0fwhC96Z5WiDYsH56g3P0zAk7l
TLSH
T197255C23AA94466AD476D034C8C28607CAB178912726B9CF03A817187F6FFF4777DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\LabyMod Launcher\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\LabyMod Launcher\Network\Network Persistent State
Size 973B
SHA256 567e635c74ceb66547739a7b2767a774ccbd442cad10c76a93fa19febee5fee6
MD5 bf541ce0d0265214968d143c42ee6455
SHA1 18a3d1678496b5d61955c090eb373054962d0726
SHA512 03401631341de6748c9a74a71f6e98af4e09b97f2463d310266acc99fd0d0f30bb76e71a7ccfce259cf0788c51ef7c9a75b53fde82ab0e9d007a79b5f888c0b9
TLSH
T17C11D0C2C7E8167DC65323F59B303923C4BD490842283D06C8E9EF8EA7F54B5661150F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59f87f.TMP

Path C:\Users\Admin\AppData\Roaming\LabyMod Launcher\Network\Network Persistent State~RFe59f87f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\LabyMod Launcher\Network\TransportSecurity
Size 355B
SHA256 843da7662f43be8915f297fcca8736487a3a1b3879a3bf24f28760df078c9179
MD5 19e0222fd9fdcdf56fbd92c9098b3891
SHA1 8b04230198085b7f8511f1a060a9b9c4400b2516
SHA512 33135b5355377b38fb0fe0501a413f6e4511af90df8b92649b9ba565d015a112fac607735a00e122d5e941f1a1a5ff86612d58870145e41e18ab896921d00648
TLSH
T16DE0DFA3D06BB03B20BA593A5D807A419E3BB1314281A8EDD5AA897EF0510EB271A113
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59f90c.TMP

Path C:\Users\Admin\AppData\Roaming\LabyMod Launcher\Network\TransportSecurity~RFe59f90c.TMP
Size 355B
SHA256 1379471ccccae5e97b0d2665956c4a3b7c5be6ceb92465704e10edcd115e80f7
MD5 94f4f89b3cbac3e106d3e9d504a41b51
SHA1 44612f2b1e061e79c8a178eefee0f240d4c1ff3a
SHA512 b79c9e5f197040be04b170c8884d53ec688a388d332e4bb682cb08f4568856baffe7ce9c9e8213afec3d9fa3a36280da034190acbd8bc6a555ee5a4451eb918f
TLSH
T186E0DFE3C07BB03E20F859361D807A41EE3BB131468198EED5AA856EF0524FB261A013
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\LabyMod Launcher\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\9dc9d7e5-f4d5-447c-877d-681018322e02\index-dir\the-real-index
Size 72B
SHA256 4e4b401a6ed7db8f0253764f7911bdfffb84592bf5c47992dc10fc6be39746b5
MD5 3398c7df3484a539aad74eb65292cc81
SHA1 6781d854d8ad266d61f3d43c03aa4f76e447e975
SHA512 5d5df36f8125f05a522fe88823074bb9c20c67f93901925b0f39d028bcc586ccb57ee76280c4800193fa9fa278ae7cc7427c819430ae1c0183ba748d69e233cc
TLSH
T1EBA0022021C3C435D6094371145262CA23544816A21E425B62A45C74E8DB2405509650
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cfe9.TMP

Path C:\Users\Admin\AppData\Roaming\LabyMod Launcher\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\9dc9d7e5-f4d5-447c-877d-681018322e02\index-dir\the-real-index~RFe59cfe9.TMP
Size 48B
SHA256 1d4820ddcaf3d52f55700ef433a1e94323f5c52fb4c397e5e983a3d1d2061c18
MD5 f112d73e92c26b828adde9a24fbe35d2
SHA1 b2e235b8aa3a0403bef868b3215b841df384bf29
SHA512 07abebc4edcab8ca47d786ef05490df0bac2128b151627b5f35ce57e3357300b2c846666846dd420a6507a967878e3bc15bfb9e7b453ca21853156bb63143af3
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\LabyMod Launcher\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 99B
SHA256 5b905cff9fefd56a6c8a48ce8d122bcfef455b0c35b13d293b413b2f6ae141a7
MD5 7f54d3d0cddcfd441cf28dfc06b0f12a
SHA1 a704d00d007d4dd088c80bd8b6b35d0355321ce7
SHA512 b334a6c1e8a1b9237021d5de79c91f607c9a92c1210c75328340b34508aec3b5579ee15f25997f5dab6721ac12108df903a8f2d1c7f8901b5327f4724d6d86cb
TLSH
T1F6B01241ED157CF90DD12B015D1711562E2E9C542806D300F75F4627279497216F52B1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59d018.TMP

Path C:\Users\Admin\AppData\Roaming\LabyMod Launcher\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt~RFe59d018.TMP
Size 105B
SHA256 b4763400f2ef8d0d1ec0cc21328613154a4129719661483b4e90359e9b4b5dea
MD5 2d842a109ef5fb39a587a8509b177ac6
SHA1 a32b020fa4326bf556d6285adfe917fadbac5a0a
SHA512 bcc706561c304317b85cc6ff1e95147292cfe110df403d35b5d93e61e3933916f0376981fa735a2371ab62a7f9da79278a902f03e315cf00decae6152bf7a5c4
TLSH
T110B01241FD553CFA1AD52B025E170156296E5C402C46D300F75F7247337497217FC1B2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\LabyMod Launcher\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

instances.json

Path C:\Users\Admin\AppData\Roaming\LabyMod\instances.json
Size 454B
SHA256 00a35064c82439f1bcc24144881a343f8acf32dc4892faa78d6b2502e0534c5e
MD5 3512f3042e8427ef80527d7183478098
SHA1 d40940d266a55aafe9f3999ef8e341534274617c
SHA512 b154014cade190aac86ebeb899ff791460d91ab439c6949a4db47ade3190ff28bb6e505c8d21ef22d284364bb81a6dc5346a036560dbbdfb33183fb148f3a36b
TLSH
T13FF02BE8D5B10C6124EA1AB744789343D9608457CDD5BE4C3A1D814CAFAE16F21BD39A
MD5 SHA1 SHA512 TLSH

Submit Download

launcher-config.json

Path C:\Users\Admin\AppData\Roaming\LabyMod\launcher-config.json
Size 302B
SHA256 4f44f7adad8d7681d40b78b1653f88dbaa4ffe6bbb3e6b6cce80c22dc7b0581f
MD5 72be93a4a088325c3e3da94a223c678d
SHA1 9d222b3b5869d9164cee1ce9a32555aed211ffba
SHA512 c89bc380a1d26cdb6c163bbd5f50cf75d38f11a159c12a5bda8ee17e0606ddf5e969526149813429d4181ae97349e9628b57aab816c96675a1129ff4a9619589
TLSH
T1D5E08C56EC3ABEFA159A32D68835929CC245455B0C92A05EB3A92CCD8F0839D35F0429
MD5 SHA1 SHA512 TLSH

Submit Download

install.log

Path C:\Users\Admin\AppData\Roaming\LabyMod\launcher-logs\install.log
Size 2KB
SHA256 43e80454f4d4b4572e7b7124a759bcaed4bd5b1a14c4e361f43fd2fcda947ab2
MD5 ef3484fe852f0cf19ee7d9d8748a24fe
SHA1 750737102a5eb0f5dbc48c3504d9bf0d7396deeb
SHA512 016cafd803fbd69a9d9d85d6c890cd8b1dcde7a713080da28bddc540f8a9fe6276b68eb6f76993400c1e1b80a13c1da8f270c70e56e00e141f2230b95c1eb391
TLSH
T1E6516520E4D1D434B5450C5D331E1DC781D8E82E32E80F58B2447E4CE988D3E5766AB1
MD5 SHA1 SHA512 TLSH

Submit Download

install.log

Path C:\Users\Admin\AppData\Roaming\LabyMod\launcher-logs\install.log
Size 3KB
SHA256 5e231372557d75afb19a4a150f736d58e8609f77b59a30778ea3fab503262b79
MD5 3bd420bee3ace31d090240d5a92081de
SHA1 1c6fccad704950f4637f02faf46813dd4a998fd3
SHA512 c301bdea3729b3c21ce4918144de1f8515f38a2bdde7e143c493d41d8cf030a92910832e12703a5223a2dfab5a6ba786d8f8978ee35a9f821f5f5442127defa8
TLSH
T18871A820E490E834B149486C321E3ECB62D4B53E33FC5B68A15C7E4DD648A3F5776A79
MD5 SHA1 SHA512 TLSH

Submit Download

latest-renderer.log

Path C:\Users\Admin\AppData\Roaming\LabyMod\launcher-logs\latest-renderer.log
Size 1KB
SHA256 4a2a092e4311c6182c5e540679602e10d694330acb29349c529b18d9c5d8a17f
MD5 b5a7588db1fd1cd96941ab273306dbd8
SHA1 a674255da1c4ce780bc3d8e3e3d6cf6275aaec54
SHA512 7f057e97eb375d2e3826a023ae4e61dbb78f001406457d9603932d24f65e2ea121eb92950a30a6d9409bc49c076dc60b78b6587804e93d41bf738c60e8ae756d
TLSH
T18F214DD78C42BCBF123DC327C69266B9824C48A749E4C4E68812A74D12CF944E9BFBD4
MD5 SHA1 SHA512 TLSH

Submit Download

latest.log

Path C:\Users\Admin\AppData\Roaming\LabyMod\launcher-logs\latest.log
Size 5KB
SHA256 037a2b44f00a9fc8b7ae07096d1e5882ada160338a03164c7a91f913df5cd16f
MD5 c703bbd50994ecb7d5537acba758e607
SHA1 6880c0806c0cf120937251d8bb450cb221af9ca5
SHA512 d0f05117da14c5d981ff95a838fa3cf9a04799c26eaf0752bc05b38e110b18e41d111abdb1dbaf34252819099f8d39f94ce908461f7846b953186537deaf9fea
SSDEEP 96:dW15irrwM/4QMvrwDHM5LW7/FMAk8tTcG5543XV+h4Xg:ITirr//awN/F9RfW+hmg
TLSH
T10DC1D730E090F5387E468A0A731A1CC383DC646E32D99B68F15C7E48D78DA696B76A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

6b7fb8715bc30747.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6b7fb8715bc30747.customDestinations-ms
Size 22KB
SHA256 c59aaf2726b543a43585b7294e7675a290469d8fff88acd730e4fc03acbce4bd
MD5 b993a68ff438a8bdd26e56092c4be126
SHA1 9bd7a1d64eeed2dd5a1bf85830c6a4ba3ac8bf36
SHA512 81ff90b32ab81d4f42df048823a6b7acf1137f97a5355681e3a8c4494e08b041d9a142880da7bb15ec150bff6fe26e427d2ab32fe587c06e9ef48598c2dc2537
SSDEEP 384:c5G25Gu5GB5G55GuW5Gv5GC5G25Gl5Go5Ghh:c5j5r5Q5s5bW5a5H5j5M555w
TLSH
T1CDA22D3565E723A1D1BFC27666BB3360A331B84BB6574B5D0140D2485932BC2DF8AF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b7fb8715bc30747.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6b7fb8715bc30747.customDestinations-ms
Size 22KB
SHA256 eeb153709f7f8cf143b92719e31fea8348dbbae0a2b26d70d7da1520965cca4a
MD5 1cab82eef49b03017d3eb14392507d3c
SHA1 fd1b63f4b07f7f4d865f62aee8c29b5bb67940a5
SHA512 27413565579102516e43306b43620cf73d5b8387920f93344cefcf391f35c7a95b2e6edd7be12d977cebecd94e6544d6a2f7d78b24f26a262c22bfdda0eaf4a5
SSDEEP 384:l5cb5GT5GQ5Go5Gu75GC5GX5Gb5GU5GB5Ghh:l585+5p515b75P56525V5o5w
TLSH
T1FFA22E3665E723A1D1BFC27626BB3360A271B84BB6574B5D0140D2485932BC2DF4AF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-1068-0x0000000063CC0000-0x0000000063CEC000-memory.dmp

Download

memory/3700-902-0x0000000000C50000-0x0000000000E44000-memory.dmp

Download

memory/4776-1625-0x0000000063CC0000-0x0000000063CEC000-memory.dmp

Download

memory/5008-568-0x0000000021D60000-0x0000000021D6E000-memory.dmp

Download

memory/5008-567-0x0000000021D90000-0x0000000021DC8000-memory.dmp

Download

memory/5008-1089-0x000000001DB00000-0x000000001DB20000-memory.dmp

Download

memory/5008-462-0x0000000000BF0000-0x0000000000DC6000-memory.dmp

Download

memory/5164-1119-0x00007FFFA6510000-0x00007FFFA6511000-memory.dmp

Download

memory/5164-1118-0x00007FFFA6860000-0x00007FFFA6861000-memory.dmp

Download

memory/5164-1632-0x000002E9079A0000-0x000002E907A4D000-memory.dmp

Download

memory/5712-1207-0x000000001D250000-0x000000001D778000-memory.dmp

Download