EchoTrail

LM Studio 0.4.28+2 0.4.28

by LM Studioinstaller signed by Element Labs Inc.Valid

Sources: observed in the EchoTrail lab on Windows 11 on November 13, 2026.

The install

Installer
lm-studio-0.4.28-2-x64.exe
Installer type
nsis
Installed through
a type-detected silent switch
Install directory
C:\Users\lab\AppData\Local\Programs
Launched
LM Studio.exe
Windows
Windows 11
Date
November 13, 2026
Executables dropped
90

installer sha256 442aa5cdb5b7d0a6693ba6d11e1663838afb2cdd8f5bfcc538cad23f00f0cf68

The lab used LM Studio 0.4.28+2 for 3 minutes, changed a setting, ran its update check, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to LM Studio 0.4.28+2's own windows.

LM Studio 0.4.28+2 0.4.28: First window
First window. The LM Studio window is open but its content is blank light gray, probably still loading.
LM Studio 0.4.28+2 0.4.28: Main window
Main window. LM Studio main window shows Chat view with an 'Introducing: LM Link' tooltip popup next to the sidebar.
LM Studio 0.4.28+2 0.4.28: Settings
Settings. LM Studio Settings dialog is open on the General page, showing App Update with a Check for updates button and a few toggles.
LM Studio 0.4.28+2 0.4.28: First window
First window. LM Studio onboarding shows a 'Your first model' step offering a 3.34 GB gemma-3-4b download, with a 'Skip for now' link.

What it dropped

Executables

  • installer.exesigned by CN=Element Labs Inc., O=Element Labs Inc., L=Brooklyn, S=New York, C=US, SERIALNUMBER=6659187, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=USValid
    C:\Users\lab\AppData\Local\lm-studio-updater\installer.exe
    sha256 442aa5cdb5b7d0a6693ba6d11e1663838afb2cdd8f5bfcc538cad23f00f0cf68
  • ggml-cuda.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-2.67.0\ggml-cuda.dll
    sha256 9fb0c47917b3fc47abf4087b0b5e758a8c954b82a0eb7f56205af5d91a148eae
  • cublaslt64_11.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\win-llama-cuda-vendor-v2\cublasLt64_11.dll
    sha256 78bdad6485861b5259c9d50e53f014b0669d1b9c02218cdbeb53763232cbce53
  • lm studio.exesigned by CN=Element Labs Inc., O=Element Labs Inc., L=Brooklyn, S=New York, C=US, SERIALNUMBER=6659187, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=USValidran during the lab session
    C:\Users\lab\AppData\Local\Programs\LM Studio\LM Studio.exe
    sha256 5718c192282b3af8f22147e22451d71cc6d3a510e49e14215d25e8ad1ddea8aa
  • cublas64_11.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\win-llama-cuda-vendor-v2\cublas64_11.dll
    sha256 2c1a28a27d8f83f8970a684e1bbeb2ddef1762cc6b3cd96bb22f13f35de08fe6
  • lms.exe
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\lms.exe
    sha256 3f77bc05a01bd16dc779f3f6efb3036db6ec602ce3ea0f9b11f0433e1355780e
  • deno.exe
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\deno.exe
    sha256 906a1ed48c754ceb91dd2192baaec0e2226b64291b99b630fe0a0a080537def8
  • node.exe
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\node.exe
    sha256 d7f55cbc1b1ca9cc2815d7b8c58f94e4822a68cdf5ca55b4f2c9625581b92839
  • ggml-vulkan.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-2.67.0\ggml-vulkan.dll
    sha256 a907e72ec219ab339e55ef1fd34afb0c264dbf7344955521481693950c92a144
  • lmlink-connector.exe
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\frameworks\lmlink-connector-win-x86_64-avx2-0.1.3\lmlink-connector.exe
    sha256 7a9caff491d23ca56a8ec23eb450376f0d964b2ddae1e9dcd127357b4c82660a
  • dxcompiler.dllsigned by CN=Element Labs Inc., O=Element Labs Inc., L=Brooklyn, S=New York, C=US, SERIALNUMBER=6659187, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=USValid
    C:\Users\lab\AppData\Local\Programs\LM Studio\dxcompiler.dll
    sha256 0040c22bc277f001885239c5704e96a48c90c1b52aa989bdc90047097383ba0e
  • libvips-42.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\lib\libvips-42.dll
    sha256 07acec1b02f747d7a32c93e8fca5d1a9bfe6e34d2f24e3d64caa3649bffe1744
  • esbuild.exe
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\esbuild.exe
    sha256 72ac6ff14e8cb7e564380e7bfdb4387353c8f721d31536219658a094c3f599dc
  • libglesv2.dllsigned by CN=Element Labs Inc., O=Element Labs Inc., L=Brooklyn, S=New York, C=US, SERIALNUMBER=6659187, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=USValid
    C:\Users\lab\AppData\Local\Programs\LM Studio\libGLESv2.dll
    sha256 6b6034222521ac121902ca9464d6708805851ec78b22d752fc30c431c097c604
  • libcrypto-3-x64.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@6\DLLs\libcrypto-3-x64.dll
    sha256 f6b47b6cd867415e9f424cf393a7b29d0bd811c9cf42e38f68c816651d97a2b3
  • llm_engine.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-2.67.0\llm_engine.dll
    sha256 39a71f87121a125c1852ac58cfdbe16402cf881bc398fc746fbb43676c7bc9a1
  • python311.dllfile_changed
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@6\python311.dll
    sha256 078706b9b5954d345f06e333a54d882361146926c90355de554e077c77f46a22
  • llama-common.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-2.67.0\llama-common.dll
    sha256 fc3b0e398668777cb322abb807fcb1aca585a8b8e89ee080e3b3fab724898796
  • vk_swiftshader.dllsigned by CN=Element Labs Inc., O=Element Labs Inc., L=Brooklyn, S=New York, C=US, SERIALNUMBER=6659187, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=USValid
    C:\Users\lab\AppData\Local\Programs\LM Studio\vk_swiftshader.dll
    sha256 50dbdff9e8a97cab4874c7de222c05f3c888f92b55da4c8660ce92222912d699
  • d3dcompiler_47.dllsigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\Programs\LM Studio\d3dcompiler_47.dll
    sha256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
  • llama-common.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-2.67.0\llama-common.dll
    sha256 787a75af1bd84eecc9751e3b418f8e65a541faf53b2e5c384ea9ca14cd260d05
  • llama-common.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-2.67.0\llama-common.dll
    sha256 18ad31c4aecb084a638bb4ce3cfadc5b9b26ad2a7ba362dbf8ccff50aefea680
  • llama-server-impl.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-2.67.0\llama-server-impl.dll
    sha256 48ee324a119f522dd0f117e4c28308a9b8a6a0191a41f70936480f9020a98089
  • llama.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-2.67.0\llama.dll
    sha256 2d06a52e015b8f09b00f1bf11d3f106f5472d944b395b6d43c6d5319c2c819f7
  • llm_engine.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-2.67.0\llm_engine.dll
    sha256 6361858908373a7f01c0bc41bc320f02399d41eb1eca4d4ff5eabf1a007973e8
  • llm_engine.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-2.67.0\llm_engine.dll
    sha256 7b87c8bbf8cd17f98cdefa846614e70047e65f6c990efb3c3a1f037a3038ba5e
  • llama.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-2.67.0\llama.dll
    sha256 b19cf6e00b2245912829f728ddd4ab0e342b92150c4c6c91607e99cafdc812d5
  • llama.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-2.67.0\llama.dll
    sha256 8092d84883b009d9b1316ef9f76b5ac24e7a43919b971e6d8829e027de076c7c
  • ffmpeg.dllsigned by CN=Element Labs Inc., O=Element Labs Inc., L=Brooklyn, S=New York, C=US, SERIALNUMBER=6659187, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=USValid
    C:\Users\lab\AppData\Local\Programs\LM Studio\ffmpeg.dll
    sha256 59f1de76a8ad264e9528239b98f50be68d4e44050fe030a99843f9f07e3005aa
  • llama-server-impl.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-2.67.0\llama-server-impl.dll
    sha256 6f6444f0fc4284b7622312b034c0e53f3667d99fd7067e5fab2d0c4827bb479f
  • llama-server-impl.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-2.67.0\llama-server-impl.dll
    sha256 2a8e3a6c2c6dacc9332518a1b238fa4e337efdcadb1d8087e12146e3888172b8
  • mtmd.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-2.67.0\mtmd.dll
    sha256 dd156943725bab860daa460d6520cee1c5284d75c0d8aa97dfd853db69016f00
  • tcl86t.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@6\DLLs\tcl86t.dll
    sha256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
  • vulkan-1.dllsigned by CN="LunarG, Inc.", O="LunarG, Inc.", L=Fort Collins, S=Colorado, C=US, SERIALNUMBER=20091538863, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Colorado, OID.1.3.6.1.4.1.311.60.2.1.3=USValid
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\liblmstudio\vulkan\vulkan-1.dll
    sha256 cd862090370454630b31b174e3d4eb474fda38ea034998d1fe1767b0c99a8696
  • mtmd.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-2.67.0\mtmd.dll
    sha256 32ac68073fab0902ece46b553011f00d6ce42bd6cd37db2af983380070569154
  • mtmd.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-2.67.0\mtmd.dll
    sha256 cc65183e390c20e2d796cb70cfd01015c42041135c02978ce43782ed38a3ce85
  • sqlite3.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@6\DLLs\sqlite3.dll
    sha256 8e1b5e8dcfae3c5bb2999280f13434e0babe68b1d23f934beaf804a13c4b8172
  • tk86t.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@6\DLLs\tk86t.dll
    sha256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
  • dxil.dllsigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\Programs\LM Studio\dxil.dll
    sha256 473f5e853120a5b6ca583ac51f453664abae15c0db1d307f29c8bf7a7b89f96c
  • vulkan-1.dll
    C:\Users\lab\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\win-llama-vulkan-vendor-v3\vulkan-1.dll
    sha256 b1ca65b9321ad4e76256fd72f9cb5610ffda1cf2a9a957f07da7be77c8b12272

After the reboot

Autostart entries

  • run key: electron.app.LM StudioC:\Users\lab\AppData\Local\Programs\LM Studio\LM Studio.exe --run-as-service

What it talked to

Destinations

  • 104.26.6.153:443asked by lm studio.exe10 connections
  • 104.26.7.153:443asked by lm studio.exe4 connections
  • 172.67.69.92:443asked by lm studio.exe3 connections

DNS

  • extensions.lmstudio.aiasked by lm studio.exe
  • lmstudio.aiasked by lm studio.exe
  • versions-prod.lmstudio.aiasked by lm studio.exe
  • search.lmstudio.aiasked by lm studio.exe