hxxps://www[.]kiddionsmodmenu[.]com/

Analysis

max time kernel
487s
max time network
438s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.kiddionsmodmenu.com/

Score

9^/10

discovery evasion themida

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	modest-menu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	modest-menu.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	modest-menu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	modest-menu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	modest-menu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	modest-menu.exe

Themida packer 18 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4320-856-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/4320-859-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/4320-857-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/4320-858-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/4320-862-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/4320-861-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/4320-860-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/4320-863-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/4320-864-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/920-865-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/920-866-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/920-867-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/920-868-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/920-869-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/920-870-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/920-871-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/920-872-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida
behavioral1/memory/920-874-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4320	modest-menu.exe
920	modest-menu.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
4672	msedge.exe
4672	msedge.exe
4864	identity_helper.exe
4864	identity_helper.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
4424	msedge.exe
4424	msedge.exe
4320	modest-menu.exe
4320	modest-menu.exe
920	modest-menu.exe
920	modest-menu.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4188	4672	msedge.exe	85
PID 4672 wrote to memory of 4188	4672	msedge.exe	85
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 3156	4672	msedge.exe	86
PID 4672 wrote to memory of 1376	4672	msedge.exe	87
PID 4672 wrote to memory of 1376	4672	msedge.exe	87
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88
PID 4672 wrote to memory of 3784	4672	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.kiddionsmodmenu.com/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffa865346f8,0x7ffa86534708,0x7ffa86534718
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,7301994634574215728,13335844238233772430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2332

C:\Users\Admin\Desktop\New folder\modest-menu.exe
"C:\Users\Admin\Desktop\New folder\modest-menu.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4320

C:\Users\Admin\Desktop\New folder\modest-menu.exe
"C:\Users\Admin\Desktop\New folder\modest-menu.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
26KB

MD5
0dcc1649f48b951c181a7acde5a73a50

SHA1
d5e92ce3cb37c9463599ed8b27af6864e960613e

SHA256
92f261381af2790a9faf72700d3d12deb7f944353b9631620b8a8b3f14fab48d

SHA512
f23e83d759ed45d3f8c5dcc455618c1481c132f1e7198ef5947abab7fc37d4238a585c8eb3523e3c62b1f984effc8ab870dd1dcc7349207cdda2f0cb71e83332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
101KB

MD5
2345e3c9dbfe86cea64382286f511372

SHA1
06b515d941104d51f52c71745e07ee103a54fa91

SHA256
9c0f5217bd6d2704733471ba0ba090e9a9599c96467ad5e8c4a8a8417c22119c

SHA512
32f092a5bfab3a5d55916fc460fe2a9a5172d2b9b8708b6a8f02da6050107e1787819de4135757a3270901a28f5dbfce905f0e0104559d2a73937a2a21043e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
78KB

MD5
50799b4e91e2834a776f882c4d7ca5a2

SHA1
d0ef48d7b864e48f58689d38ecb3d8705abce150

SHA256
0fe31cb6882d0a2eb3b6da1df8904d053411e5c1e17ed72b1f8861983939a362

SHA512
3cb5f1cc2ae226360c622034253aebf94c28616dfb5cbc820e2e38f959ae8963525830755b899d02d69bdeef4dc2d105ecdd2ad3fd85534f5881360c3aeb5f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
44KB

MD5
14bcbe819643ffb1f297a2f3e49ccffc

SHA1
de9432098d3e2c81537b6f4adec5f35a4a2f4545

SHA256
5a5fc4882f51cf821ce62d210a259c0622289f21f46027aca44e996d94057cb2

SHA512
33c54347310507b6e377f6afb4c4efa0ae397c29fc609ceccec6d298739d0d015f6abc00ff6fed2449952d2f896824ecc8b81ac604ddacc33a49c75b35e2cf5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c1244f5f1934a8a0365ace3336cecfdf

SHA1
b85367d1408a6d4fa3e9094efe663445bf890faf

SHA256
e6b92159506649104f5710170eaef2eccaef57481be304c06ff4ed5796e99069

SHA512
5e2d5ff20a5fb5216c6b86681f0307ee25f86ccb9ec06de5fc621b64608a7b5fd1923b0702628d929c107f62d62359d48c8ec832472131da683491c737738a3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
11669882ac127f8113f20c904b84bfdd

SHA1
d19dc1667b168d7bac2cd4824dd00a2216a9fe76

SHA256
8c4b73e092d6e7d32b23faed119833fde21ab796b517d5bfc7ff7eeae4c20f81

SHA512
a8deb48fc79a1b02526e5c99316cb48b09d52c9e3cb83497154b401ca537096b1f83d6bdccf37c65a96b4140c8e17f0056cae650cc0a9df2f5f84526d81c32e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
c033dff2c57e9cfb9be1557f88d845a4

SHA1
602a4bf07ea2167d010896375081367b62e3883e

SHA256
0d1d100454cf4cdb2ce2a6ffd88beef6dcbc2c8003fd1ddb903de018b8cab455

SHA512
395f59e1a30940193d39d61f6c61e655a1d1a0a29cd86cc02714dc32d66550eb31502b7942835d9ca463fba595c6dfa4f06a219b48112fac3849620612063f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe0acf407056571a1d6b36fab8a82e41

SHA1
3248666ff33736296b770e6453cefe6176cfe510

SHA256
91900bbc6936fb44d9f30db27509f129224cb7bf146284d2c039cccb78fa57f2

SHA512
b6a24aebd4f160eb9271a21d7132acf7015c9443e4a02eefd16aa721ee25b25ddb64865c376d56ded9088c6f26f9eb75c62564b301e97b36df1d4c3edfe89fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
d83bce3a31a5a8d50b7e81e2a1fb7b7b

SHA1
77ad67b5a950beaf10c6215307d7e88a44653370

SHA256
72e4742a4ce278397b2a65a47a9a92cfb97c716498164e1de84b0e8aa9521a0b

SHA512
84375cf37d41a64b7c3ec56776ed6497342e78741ceb16e9aedd0bdad312f40db990b47b5bdd36cca44f3bb1ceeb5d8396dd49d7bfbadb03f0b26a933e662373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea87c6948840cf7679e6525ce7300b2e

SHA1
a5e777b0ddff6a86e7b6ae6182f9d238f49f55ab

SHA256
96822f8aa01326c0d7e40228c61fa68dc29191b5cd5706042eb7a69dd937362f

SHA512
3038d77a0187aedeb62d504f29688bd9442f76af9431f874a2dd9643556aafda536e5125fc6bd1f814b9960197ea129b4f64babaa42af22c5802acfb9d4e02cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1c09852bc895800873c9372451df0509

SHA1
a7524bddd0b91ea0778a09567870655f8eca7a58

SHA256
6d3dcf1453faae102a22b85f94d521b9efe38825f187e344231aef20778e0f87

SHA512
519a76a8db9591fdf676a687aa7b391b9419bdb4671ffa77651179373df7367d61deed8ff79c9fc90bbcaba8216f0c86525cb632ff308f70dfe951bdde7a08f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
0e5bf3a163f5aba84fd3bf4ceab293eb

SHA1
5f2dc087adc5a57bdf778de102e8b45c256df1f3

SHA256
6ed81598897cfc8aca3e43ffb9f6cfab14a06ee261e7c9b296dc635999a4b843

SHA512
2b87bdfe3b3a00795b676e354f5cf3efb5b41cbbf2b6a6cb45a7c9b8add457b9c45c740d261d1699e000ffc4559836d9707452ea0051a860d1718da294dc1555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3f61f8065cc328ee4fd7462468a003fc

SHA1
e21cb82d72bdf3fac01132d49e0768104a552bca

SHA256
7310099fc50727ab031f11c9b2249cb9e673ea839ad33d4d25dd1641db308f94

SHA512
0b41abd9c3688c499a727e6f20e25e0b8001f16317e344ed4ab6f264ac260155aab6876fa3c09c6238ff8b6b61927fb490a514abe6a566728c884f9bdebb35ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9fc2955f6dad2fca4119301e46b3857a

SHA1
f4eead4fcd91905ba6635326649ba0539bb28982

SHA256
85bac694e73f403aeba2a472a91da60d023f9357bff27a5ca115f18b2006df28

SHA512
25daf3456cc716b730ac8135df25f4c5571bb4fd7cd9b571eefa4e6d38f621378ac2195125ae5e8bdc4bf21505e1006f1b339b7bdcaa7e8780dd99c76bb96457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
6ae6ad96299f835fd56aa0eeec35ced4

SHA1
e73081a3868bc8c61ffbf1ed37b8c45bf680c15b

SHA256
2dcddd8d5510ef987100696149235a588298a94661a8fb6edb58b3025f3310a4

SHA512
f4a3ee84d384b4a07d1ba0ad01ce509869ec5882d7c476ce5d97f1535d675c5fc004e1060c7277991959a4553213e992125e0195076df4d113f31d00de626d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
4f684269434e7f868a96a1355dca7a88

SHA1
f738bbc4f2f014be816c8e5d0bcd9c2a2b6ef7b1

SHA256
3b700e5552e23de03d4dea1f2cd0cbf26bbbd7656b52ac3b7d2d55ad7a42502d

SHA512
74a1a03a05ba127d83140b0a9c27daf7cbea1a48f5802c5f01dd519ca4523bb4c1a66753ca41078f3f1d8f37910f1a1fd9511b6783eabbb2a90c10382b2c8188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
4b13c77916d51dcbd120dd6431b88078

SHA1
0f3d445a8b465eb12ec0e846d8cd8b2a11be6d84

SHA256
87fbf34721520656b22c9262d40256ab0ee7218278ea96940984b1b466dacca4

SHA512
3ae36c9ba05acdeedc1555fccfc898a876344ab08351d93dd269ece8875d96aa4168d94563329409d911193d95766f1ed83c4f4f14390da055cc54c80525a7ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c5501b7cff6588b903e2d1a457df1286

SHA1
0b993e3f8c4616be22de378e0fb4e5439ef02049

SHA256
fc508a141f789bdc0b56e725709fc593b447dc323c3cb402642cd0075ef8c1e7

SHA512
1dd59ebe0a8cf7d4a3202bb5d3a0c0fa015118661ac25c811932b6219e842c3e8f2e45d0837ecc44febc2a58e29f4d0cfb76da605840179ce87763e298b20976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e20409cc8ed5251efe9ad278976953d

SHA1
512d686c832e2a5b0e467b53cd0503ed2ce1cbd4

SHA256
4a0a14286a8705f0d98a16cd918147bcbeba185a36230e017f0beeb7e6b69f03

SHA512
79db70220d4d302203b0ae21cb78f65de123d9eb5902cec2d0fb320329d8929b03099b1649596cdc81aa188b41c150a9f61786e736ab2975ad564243ca9ed898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
233c24c0af02ef8fd5686b13e8bdabb8

SHA1
f0420c74113287bd1e06db8939dd5d62ce0f0b14

SHA256
a8230c4061da9d453eae34f02bb0fb555d602ad73f8a1e6fdbacf0a0eda5b17a

SHA512
0d4a2cb3d37f9605551327d77a9c7ae52185a94d026dfe6ab0ecd75d86e9cb9eb18c51f27ce44165e4202995f070c2bd450daf88bbd81339eaa559540c5857a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
b22dcafc4609c4b1d8a782874fa0ff1a

SHA1
dacf92293eef9b42e6a2928d67fb999d78c04c3f

SHA256
5aed5dcca56f1aa83a0751ff3144c03dd21e47db9db7474ac31f7fbfc2ad9957

SHA512
eee60dfec169801ee0cdeda6cc4474d953c59e9625e2235850b59d68331db5a125dfb2f326c74e0349f9012a2b92e2587237d78e1e306a5cee8f1522a83e2f34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ef13.TMP

Filesize
371B

MD5
865e0a168c8189e54bf5584723c0f2fb

SHA1
b86b5d494b90697590aea1447412474ce49b8745

SHA256
4c7984d34edda3cfd6e64917d6db9db294b6bdc2bc107897b8b3c2fb8a981e93

SHA512
dbad4e80b79cc7824e110821eccfdbf25a8abf5566c47e28fb106d347a9d01d4f5f49941b280928f1dd529cbe27fe04890f77b0ce3d7b70ec02ead56535ef8bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0d6493b5a276b5a4d2666e8b8a061708

SHA1
d6d5ce87e7239c63bdde2944fdb812522ef2c74b

SHA256
0467ba85d1c82bd545553893b56d832fa5ec6103e914cfae54c6fbbbe6f9f46c

SHA512
a242802207c74c5c9483847db017520a9ac2df230654d295b03c26a351496b64ea944ff7dc5b45964b44450e1deba0917113432d441a5e89de6ca114fb4d9f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e2eed320d68bd31faee5771980cead86

SHA1
4d0f88f4914e53dc2fb4aa67193490c341a34827

SHA256
a485ba9924f754d49e32b9b0b421e2026ca9710c25098863de348f02dc7a48a1

SHA512
a20410768a73b6112904fbe71b5c83744ea417d6037fcc00f98a28b41a0395e249b6875955339f955a4029df15ce9a44fe5f3151c0af40220a166be55dca91a6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 188719.crdownload

Filesize
16.8MB

MD5
13b33baf9597ae6ddc68fa9634af16f1

SHA1
57f3a723634ec00b4f09d066bc0607084cc4b6e5

SHA256
75a3295f8c688359fcb7555b80e3f71ee42c5ac1d4525a39b2571107acf06a45

SHA512
ed38d6150cbeae60451b74ae50af1bbbaf035924fdd266cf8a8fc8b84fe403dcb689185d1a9b5db048f1c11106a1a655d14d4833c7593512c5661d4c587a2e1c

Download Submit
memory/920-866-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/920-869-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/920-874-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/920-872-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/920-871-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/920-870-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/920-868-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/920-867-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/920-865-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/4320-864-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/4320-856-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/4320-863-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/4320-860-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/4320-859-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/4320-861-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/4320-862-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/4320-858-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download
memory/4320-857-0x00007FF6B7E80000-0x00007FF6BA88F000-memory.dmp

Filesize
42.1MB

Download