2e3e0f4a3674c43a247dc9e1bc45d28682109b291a74535b7e1bce6fd3537b72

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/11/2026, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mod-Menu-v31-10-14.html
Size 7KB
Sample261104-xv42qaee39
SHA256 2e3e0f4a3674c43a247dc9e1bc45d28682109b291a74535b7e1bce6fd3537b72
MD5 bf4e412ce0442de5acea57713b9f1711
SHA1 02b8be57879e45074f17189fde4db513697f822e
SHA512 5bb6cfb4c98ff82f0916bd1216ab950c1d0ec11bbaacab22424c544451d810f3cf023743aa13602db948073ad3f201a715df6ceab0d836bdb45d599393cc2ee7
SSDEEP 96:NsuWz77NBe773gfjmZ/1gptLdPJjeIJumKF95RZjieojwXZkPdqP3GME:ot7m5QpJjeeu1hkrPyQ
TLSH
T15EF152B744F49F33236201D22AE3F706BEE0D24BD2956901B1EC86D81FD9DC18667566
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3716	Loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3308	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1805035633-626948184-3225555471-1000\{601549DB-A2CD-40F3-810B-F9B7A1E5159C}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Mod Menu v3.1.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3716	Loader.exe
3716	Loader.exe
5392	msedge.exe
5392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5736	7zG.exe
Token: 35	5736	7zG.exe
Token: SeSecurityPrivilege	5736	7zG.exe
Token: SeSecurityPrivilege	5736	7zG.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
5736	7zG.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 2120	4848	msedge.exe	80
PID 4848 wrote to memory of 3308	4848	msedge.exe	81
PID 4848 wrote to memory of 3228	4848	msedge.exe	82
PID 4848 wrote to memory of 3228	4848	msedge.exe	82
PID 4848 wrote to memory of 3228	4848	msedge.exe	82
PID 4848 wrote to memory of 3468	4848	msedge.exe	83
PID 4848 wrote to memory of 3468	4848	msedge.exe	83
PID 4848 wrote to memory of 4032	4848	msedge.exe	84
PID 4848 wrote to memory of 5028	4848	msedge.exe	85
PID 4848 wrote to memory of 4032	4848	msedge.exe	84
PID 4848 wrote to memory of 4032	4848	msedge.exe	84
PID 4848 wrote to memory of 5028	4848	msedge.exe	85
PID 4848 wrote to memory of 5028	4848	msedge.exe	85
PID 4848 wrote to memory of 3320	4848	msedge.exe	88
PID 4848 wrote to memory of 4556	4848	msedge.exe	89
PID 4848 wrote to memory of 3600	4848	msedge.exe	90
PID 4848 wrote to memory of 3200	4848	msedge.exe	91
PID 4848 wrote to memory of 3320	4848	msedge.exe	88
PID 4848 wrote to memory of 3320	4848	msedge.exe	88
PID 4848 wrote to memory of 4556	4848	msedge.exe	89
PID 4848 wrote to memory of 4556	4848	msedge.exe	89
PID 4848 wrote to memory of 3600	4848	msedge.exe	90
PID 4848 wrote to memory of 3600	4848	msedge.exe	90
PID 4848 wrote to memory of 3200	4848	msedge.exe	91
PID 4848 wrote to memory of 3200	4848	msedge.exe	91
PID 4848 wrote to memory of 1676	4848	msedge.exe	93
PID 4848 wrote to memory of 4596	4848	msedge.exe	94
PID 4848 wrote to memory of 1676	4848	msedge.exe	93
PID 4848 wrote to memory of 4596	4848	msedge.exe	94
PID 4848 wrote to memory of 4924	4848	msedge.exe	95
PID 4848 wrote to memory of 2232	4848	msedge.exe	97
PID 4924 wrote to memory of 1852	4924	msedge.exe	98
PID 4848 wrote to memory of 2900	4848	msedge.exe	99
PID 4848 wrote to memory of 2900	4848	msedge.exe	99
PID 4848 wrote to memory of 2900	4848	msedge.exe	99
PID 4848 wrote to memory of 3304	4848	msedge.exe	100
PID 4848 wrote to memory of 3304	4848	msedge.exe	100
PID 4848 wrote to memory of 3304	4848	msedge.exe	100
PID 4848 wrote to memory of 4524	4848	msedge.exe	101
PID 4848 wrote to memory of 4524	4848	msedge.exe	101
PID 4848 wrote to memory of 4524	4848	msedge.exe	101
PID 4848 wrote to memory of 1132	4848	msedge.exe	102
PID 4848 wrote to memory of 1132	4848	msedge.exe	102
PID 4848 wrote to memory of 1132	4848	msedge.exe	102
PID 4848 wrote to memory of 2028	4848	msedge.exe	103
PID 4848 wrote to memory of 2028	4848	msedge.exe	103
PID 4848 wrote to memory of 2028	4848	msedge.exe	103
PID 4848 wrote to memory of 4004	4848	msedge.exe	104
PID 4848 wrote to memory of 4004	4848	msedge.exe	104
PID 4848 wrote to memory of 4004	4848	msedge.exe	104
PID 4848 wrote to memory of 2132	4848	msedge.exe	105
PID 4848 wrote to memory of 2132	4848	msedge.exe	105
PID 4848 wrote to memory of 2132	4848	msedge.exe	105
PID 4848 wrote to memory of 2928	4848	msedge.exe	106
PID 4848 wrote to memory of 2928	4848	msedge.exe	106
PID 4848 wrote to memory of 2928	4848	msedge.exe	106
PID 4848 wrote to memory of 1632	4848	msedge.exe	107
PID 4848 wrote to memory of 2740	4848	msedge.exe	108
PID 4848 wrote to memory of 1632	4848	msedge.exe	107
PID 4848 wrote to memory of 1632	4848	msedge.exe	107
PID 4848 wrote to memory of 2740	4848	msedge.exe	108
PID 4848 wrote to memory of 2740	4848	msedge.exe	108
PID 4848 wrote to memory of 5452	4848	msedge.exe	109
PID 4848 wrote to memory of 5452	4848	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Mod-Menu-v31-10-14.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2c0,0x7fffea4ac188,0x7fffea4ac194,0x7fffea4ac1a0
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,6226474746026665140,10559338201908661970,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1516,i,10018969422941996097,7240881957771810551,262144 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,17183676806033580089,15360754506189566451,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,5768855445908446014,10126346019812180026,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,16970920422610683478,2671687254983935263,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,4632011001662658990,16118991185962021941,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4300,i,6872500801051065405,2860251423815098111,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,9823712532788747209,8514699411362871561,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4288,i,6992497355132327799,4387598143350628336,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,9445351217350169997,1465999108372911927,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,6052027266384003359,5871306452436443817,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,10445379840951581490,2926697574017352661,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,2548476890073860349,3136936633313433022,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,2548476890073860349,3136936633313433022,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6496,i,6078343158404882967,3267154457395315347,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6668,i,1576864530230354547,18334648509824622660,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6816,i,6208995636435559008,9610221480672319100,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6972,i,3024822258952602631,17259257077490774712,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7320,i,17490525239230211986,5964530739141169281,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7304,i,13939436291157713728,4115509550946838379,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7480,i,946297890291373870,10390084938037166927,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7792,i,3694915466372451343,8364644843434271591,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7960,i,13996336606483264866,14180561505034322866,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7948,i,15035362114699657638,12623123376503408696,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6960,i,4837391623311883320,14710985802235966577,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,18426438408038368608,12924063314017970914,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:14
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6544,i,6794441515686321697,12444876632527838632,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8732,i,508101673537881665,11396324949251250435,2097152 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=8752 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8924,i,1764652916351542074,7828373156108450839,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=8900 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,11540411785432060190,7220042490687905425,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,6970338959571514801,2341022922101511856,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,12173436569346276427,13771853530317412984,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,1813918566819287860,8883971450718678584,524288 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,6952286708636816075,7843395799283922854,262144 --field-trial-handle=2416,i,15750091241963088504,3028410416298495079,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5612

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Mod Menu v3.1\" -spe -an -ai#7zMap10602:88:7zEvent24607
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5736

C:\Users\Admin\Downloads\Mod Menu v3.1\Loader.exe
"C:\Users\Admin\Downloads\Mod Menu v3.1\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

15ec7914-890a-4c91-aea8-0e46090674cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\15ec7914-890a-4c91-aea8-0e46090674cc.tmp
Size 8KB
SHA256 f5d43dfc92feca630091f351b961eb9b24d5f874d46bae1f5f1b93d13466f4a5
MD5 bc567954ff0e66f43c6dd4e674869fd0
SHA1 c209aafd0ff050c60d5cb269457bfec6dfc3b9c2
SHA512 08d4c43c36e8ff70b78bd0264cf87d7bf3ca5ab986f9c2f18ccfae8179e70e7319280edb322de75f3a36bab913eb3cc42a535b8c01b86d3cd11739ce52020615
SSDEEP 192:YGNa6f154QmiUyvu5LzFEVp+FdYe+NPaKXOqaU6:YGNa6tWb5/jdYVHmU6
TLSH
T1F5120A31ACB8A82B5E93A941F4873507AEE55127DAC97F95E2EC5F1C01EA66C2306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

645342d5-4ef6-44ab-9f63-f31d201a015f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\645342d5-4ef6-44ab-9f63-f31d201a015f.tmp
Size 18KB
SHA256 fa44dbfe539ecc0e11751241281463bfd1440c30f77c395a780dea4cd27bf362
MD5 388997f2ac378bbcfd0198fc9f0786f7
SHA1 a3dcc13faf31bb3209f71711fdad623eb38ea948
SHA512 893cbf2b723bd80d00c47720571631cdcbc8d6a0ab8d033c35240d6f7c5bfeb47ec27daf24341b3ad119d905a2a849aff724a06afd1de317396cbe944bebc8b4
SSDEEP 384:2QkUSvB8NP7bgjafUmP+CjdYVXmH7vBE5AIIlO:WBCecJjitmH75EWLw
TLSH
T18B827D329CB86D3B4AE3EA01F04E3907EEB49167D9C82B94E5DD9B1C01DA69C3347C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4eebdc04ff118e9cd3cbb614d205d2b777bd24419c5ba2ae742de33b0ae98212
MD5 40ad9518d5c77a0ba122e8109cc3c934
SHA1 3770983945ea6e6a8d5f74005f43d42a473cda6f
SHA512 c5dd104df7f9dfc246af8034f366c71afff1236b796e9a095503e2d67aa832edd20512ecc75a53cbdb4618c87af263d88078adcaaf2e02b99f0651281f9fa7e9
TLSH
T1D5D002D5FB40B684D271197B2E6D871DCB0CC7795253F204B25C099A1D8415EA593895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6bf18510fc5524b37686ebea24fc002479a4d9bac5b3e6fb1f83b409dc1bbe32
MD5 a15c725bc0977e8d3c93761de7c248f4
SHA1 ca9f2fd6f48956c2420c451281ff29cffaf05ff0
SHA512 99e87b07e75caf574dd3bd5a3d2527dabef8abb0ef492d87b84b220cedda256858e0c890887b63c2987a29757295c8862472646a78f2c2596d36f1a77bda7170
TLSH
T1B4D08051F9157EDCD27E15791D5885448504CB7352535104270E0D194D5414768D2DDC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0f7109cda4c37ea8424815fbdafb9fdf6fd2dde3bfb80550af9aa9cd228e5614
MD5 049733b79dad8b3c04cda8e3de2fff84
SHA1 138bf7729c209250db88dc6948282a167b2150c0
SHA512 e290bdb1d65fe193f6c46be8569a3dd378244098ea052c50df571014e92de0077da2211400015a5a91cca1a31a6e26adb39d7077e7279008ff71e2c0fe040023
TLSH
T15ED022C0FB80BA80C230083B2E2C830CCB0CC3380203F300B20C088A0C8008EA083880
MD5 SHA1 SHA512 TLSH

Submit Download

03918baa-35eb-4e05-a6c2-229c99aabf2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\03918baa-35eb-4e05-a6c2-229c99aabf2d.tmp
Size 10KB
SHA256 13277c216843fddaf113cf68b0ce6a18b239259ae25c9c586d34c18cdc549278
MD5 1da3d29b45a43643d9211785d9dca2bf
SHA1 c1bae7ec28da8d3a15bd5104c40459c00d7a3279
SHA512 b88fcb00753556169e09d0e2ef8ea686fb976dc1db3f850070a7a996e92de9bb5bb8fc2a8b353b620df37333a72bf2b180f977808af8494d9b92470c09387a83
SSDEEP 192:sxZvRaKR/f2szqIdpspwzD3yP/W6+WN1E6Y0n4o87kIg5YJ:sxZvRR/f2szjm/b265u8i
TLSH
T1EB32B4526A74697B8CCBD219FA15BF13D6F9543291911E48BAFC8A1C04E67DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cb0bfbc-d9ab-4ee0-82f7-d1e8a858bbaf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5cb0bfbc-d9ab-4ee0-82f7-d1e8a858bbaf.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6364c6a2-b45a-463d-b5f5-d1567cae50f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6364c6a2-b45a-463d-b5f5-d1567cae50f7.tmp
Size 11KB
SHA256 350862491c13348edcde0eaf68188f154fd71f3c2f91e13cfc09e17f2423e535
MD5 c4001808b6ed7d4b1a077b4c412f995d
SHA1 44565f275ffd7b863c63dfcfafff037083100a6b
SHA512 f7f74af59ad8eeb243a0996a7d99f02089ca8f672e64b47129e06eccf6422cb1a7b89560f08df518442679796bd51df36f73428ffd9932312b2e243e0220dc09
SSDEEP 192:sxZvRaGR/f2serIdpspwzD3yP/W6+WN1EBf6Y0nD3A87kIg56J:sxZvZR/f2se0m/b2I5x8g
TLSH
T1DC32C452AA74697B8CCBD209FA14BF13E6F9543291D11E48AAFCCA1C05E77DD230380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 23KB
SHA256 89c8e0669dd411b4f91f79771522f9686bba1aca7f1c870cad8901c021296728
MD5 64120364123eb8e6647ae8b7700c3ba8
SHA1 849f45544b09d35ba1e1dea123a736f24faf3891
SHA512 7ef9ecda7e67b2f16667f2e31048add89e105631274e53343f249c02ee06fec0a85d8a244f587e3bd8e0fd61ba7eaabfd2a5de69702c57f2b7ebbdf0fa44587f
SSDEEP 384:SAQliXhseKZE83ijBVojv3WGwFWBaSodQ1N2LHOkYdY1vwSupm6nIgkxv1ObK3oj:SBEXhsxZE83ijBVoj31odQ1N2Lut4vQF
TLSH
T1A8B2E1FD0FEFD811080B538BD117A18B683696EF7B0309A4A8A5238C96C69BDD733551
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 1a7310df5469442d3afb086e1bbc9a4d38d4e91704b849b41be91f03de99649b
MD5 3e6bc24b2145ff31e706d0bb55dd2a55
SHA1 e2c377f8ebc4bf63b9680fc9bb0ec8e73ba5049a
SHA512 5198d63e4c1b3344c8baeca9c140a551f59c1b5b3f8839e229dcf7a282d65e690da6936f87bfdcba377a2b4d944dba8627874430f5409b8751f3097375b0b2ca
SSDEEP 96:zjbbTGwlB2KhE3dNEgtbHo+g5V3NKTCRqG9Ctv7j8:zjfTGdsgtU+QV9KTCRqmCZj8
TLSH
T10A9141B0969F20CACB0D513175DA296B753784A0B7E2DF520B58F278D41F3F8490E392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8103fc22559366fc99e150acbf44639925e96bb484f190264cf58bd80086935a
MD5 9c563484648145e59a4923ba2a8a2a3d
SHA1 a44d688d0053f46ec7f26942e34436ed352b83fe
SHA512 e99b9b58fc47a99849b7ead36e03abbcced7eb3d542e56c15e227f81f4bc02f58e4f32ce5bb809304b071fcb22e62814802711182275711586e235f6ca7ef061
TLSH
T16451F98186A340DDD75CA1B1B1DE128B36378990B783EF621AA8D3B9D85E7FC5D0C052
MD5 SHA1 SHA512 TLSH

Submit Download

5cba0493-720b-4782-b108-c5939dea92d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5cba0493-720b-4782-b108-c5939dea92d1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

24b2731a-926d-4c8f-8860-18c4e2a7e0d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\24b2731a-926d-4c8f-8860-18c4e2a7e0d8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

5dde1dba-932f-4af4-a810-9c759546c238.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5dde1dba-932f-4af4-a810-9c759546c238.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

9d949e1e-d17c-47af-a192-42d271c067c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9d949e1e-d17c-47af-a192-42d271c067c8.tmp
Size 26KB
SHA256 bcea7b1ca0d52f99b0361342c7666230b421c875aca01cd051115990554bbb94
MD5 def0f8737a9b769bf6b8c86438b5b883
SHA1 4fa9beccfd2c4fcb9dd33eb6fc74d53683c1912d
SHA512 2736ec02039a91c4c56c18f29d2f131725b1ec41e37234aefabf3ec5e71656296a0316834bf1346394f4da6add80609a7dc1dd5b185442a74795f3ae188efc6a
SSDEEP 384:D+xPUET4qA/ye1ebefLEgJoeuSnU8Te2xBeAeaPzgJu0FJfvfxXZy4IB7kYA/4/g:/P8fv+FBbgjAwyuWQnifIvR
TLSH
T108C2BCF3C3E5C52E89115BF45614AE1BCF1D1629832C3C1688D5EE8BE3E2432D16A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 ed401e2e47a25b9b79e3fc19903b9a698ed19e0832b5c082322708c5f2467738
MD5 47f0839d6788db3e87b40b41650e1949
SHA1 b9dc117eb6363a38a5faee2dfcee7b6684e19859
SHA512 0cd9a9cffb162a3c035c38410f787d5078bbe743123d0d901943e58b9ae8bee04433dcfb9ab665a98a6fe63455e6f5a3708eb2104f9f2972b0d4c4c8e74207ed
TLSH
T19BA0022051806015D04446B01AA549412365CE6283812B4599DC518D8CB8187D701645
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 705bb1ad6d111d886657d5890f2d6e36dfda537f9b744024d4e7290d3caff508
MD5 99de82e46876c98fbc18cc3092933c40
SHA1 7233df253afad7f74d13be9fddbc3f108675004e
SHA512 fff6e1b3063fd15c0a5e9699a7e503a0ca5e21b927b11532b9b09a16ab6c9bb8cf46bbce1320a9747c0966d248c5a514a1592cfc4a81ec0634cd992572dcf5a1
SSDEEP 48:KYXIBKwAE/yZMIbKR60wyheyDMgaEEdJYdQIOIdKvcX6dzE:KYXWKwA+qMwKR6Fi+r6KUUo
TLSH
T1F3913241326A02C479BE254981B89B1F128231F33029E66B7FBC94E59E67E141FFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8fbfb21-41b4-4fdb-844b-544f223e88bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8fbfb21-41b4-4fdb-844b-544f223e88bc.tmp
Size 9KB
SHA256 3c1a7b68c749a918e705155d7f2e6da9381854ba2028fc0f084a10992dc9b99b
MD5 5f4128cd1ec002189d8e67e0784d5d10
SHA1 e4acdb35ee96226f2094449ac683f7e7c8b350ca
SHA512 648b6b3bd1563826b54106540a87381f25050ead968327b1223c56cb72a0b1696c77b2982bfd39364b91146812fdef4ba13d8f09d3594e59227b95a9010b2e3f
SSDEEP 192:sxZvRaduR/f2siWIdpy6K/W6+WNGY0n4o87kIgrJ:sxZvquR/f2siXE/bG5u89
TLSH
T16022C6126E68A97B8CCBE209FA29BF13D5F9543291911E48EAFCC61C05E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be9498b5-a198-49eb-8d3b-310900945e1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be9498b5-a198-49eb-8d3b-310900945e1e.tmp
Size 28KB
SHA256 0c895094aa8c8ee56c2537c1d25780a9ac738083688cf9b6b8a3b007f5c58894
MD5 f7b5e6ae61b34607d9542c8dec57000d
SHA1 27b368b029126a1d530025fd406196dfddcf68c8
SHA512 f10fcfd76b9c3a0f031dc32f9220003d94682db88a329357b534d4a7c03ca891e7ea532836130b55278828f19536938f8c24777b21ec6555525dd2fbbaedf2b8
SSDEEP 768:3/nwK8sN2IsWRmkUQfz8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fYLl/Yi0E00royn:3/nwK8sN2IsWRmkUQfzu1jaKfYLpY7EZ
TLSH
T164D2FA3F640CCB7E8FC01AA9DD166F9B6DE802C7A6688D4047FA994C02C77EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66add24c-1f7e-4ba3-98bd-f5120e69c5d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\66add24c-1f7e-4ba3-98bd-f5120e69c5d1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4462e01d22861e824ddbe65036bf154da71b441c6138fb14a60e721239a8a30b
MD5 f57f08144c66c0a4459f672cc2bd3c32
SHA1 dc6b3c4d3d0f6089a142d9ed53b747eb27f23a3d
SHA512 29ba6e250ceaa3a43454f8e7430fe36ca2e28cf430dac532e1bdef4bbfbcd7ce0c34f2a583a2bcbc28b54bada18b3897d5a6c149e36b598c0cb8ff1ada2fdd8c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ca2f0249112c4c2fd4bb5808fe1ddb26ae0d232b9b4fb0deb6b5f097caabddf0
MD5 b9e7aa6e225bc7a6373955750cb53927
SHA1 5ef445cf7f9e93dda7b44a5e6575751afaf1fd59
SHA512 79c62667649f949feb22fa9203dc9d79786c8dfaee45daa563f919480f39487148a179aec5377048efa1960e20880c8dde5ed99cdae593ce651ebbde3b494472
MD5 SHA1 SHA512

Submit Download

a90e5673-62b0-4bbe-b584-8b2d0760e776.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a90e5673-62b0-4bbe-b584-8b2d0760e776.tmp
Size 18KB
SHA256 75e2b81a0ece2918a5f7b26c28fb7b1d7d30fec4bbb44d67b95355330e31e5af
MD5 0a657da384f7abbd45852656643e731b
SHA1 14b75c53db4d1a16aca01936ab2485aece7b5314
SHA512 cdf6b624f14c9c23f3ab144d3eacf8507f897ad2d1d86e58896fda80410cbfa0c106f62b753451031298f57f0ee082f2f020104f1b931fa0b16176eb47552003
SSDEEP 384:GQkUSvd8NPcbgjaLsmP+CjdYVNmH7vBE5AIIlO:mdLmcJjinmH75EWLw
TLSH
T1AD827C329CA86D2B4AF3EA41F04A3917EEB4916BD9C81F94E5DD9B1C00DA69C2347816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8402f93-4f38-42d7-99bc-e6c2bf6260f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d8402f93-4f38-42d7-99bc-e6c2bf6260f2.tmp
Size 26KB
SHA256 9af47263bcd149b946f2eac853e71244b2091be6e09bf0a66088c9f52f76068d
MD5 ec5bbaac83c289b08540f5945857bacc
SHA1 33882687fc88899f16078461a53dba7b1bf884d2
SHA512 490697d09616c3e3c323dad3b1e73bf79508f1d9b2eb4b7d95b09b6bd758a00a9d8bfd06bcad2b7b8f03897bf3d342752ec81ad132d834c8f2d59d6ee0a24097
SSDEEP 384:4iFCQkUSvV8Nx8TUNTUlIlcbgjaLN++UmP+CjdYVQmH7vBE5AIIlO:DF6V8wgmz++UcJjiKmH75EWLw
TLSH
T17DC218F248D7993AD9AE9B43E37D3D079EBCC057B8845A50B3889A1CCC961BFD346811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6408ca4-79c8-430f-bb66-67563162a554.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e6408ca4-79c8-430f-bb66-67563162a554.tmp
Size 8KB
SHA256 29b650424f1c55854eb6acf05e166be348cb7264342ce32d354c210465454895
MD5 e197a634226e26d9f360cfb37b280245
SHA1 d4ef6a6ed020fa601dc9a7cb81f67ca0bc61431a
SHA512 dfe18edf48044169bdd1e390c229914d48fd285ecc7f3b29f4b7d86d1e2d476bbd70e4e2a1d8f2c3d36c7ab395f1598e4db74819d2ebb39c7c924d515a7fac15
SSDEEP 192:ZGNH96f15sQmiUyaEIuuLzFEVp+FdYJG8yPU6:ZGNH96tGF0u/jdYtwU6
TLSH
T11B02E835ACB87C6B9AF3AE45F0873617AFE4102BA9D52F94D6E85E1C00D765C2302823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

414c0bc9-3552-4e11-b222-8de807a08746.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\414c0bc9-3552-4e11-b222-8de807a08746.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Mod Menu v3.1.zip

Path C:\Users\Admin\Downloads\Mod Menu v3.1.zip
Size 29.2MB
SHA256 cca0cd03388b3eba1a0fce5513c8843c6ac5fc7004e5c127dfccea6b5a8be443
MD5 c8703236a21fd70995428e29935f8f02
SHA1 c84d2c2bd898b7d7b0c8dd6f9d2f4ee420e25354
SHA512 ed7a5246af021875c9ce668303b6531878f1a23e18d3e907b4bac868eef8df190c4dcfd8baff2daf0b6bbf23753ecd9e04b11b744e5cd42628946dc284f9e226
SSDEEP 786432:BAnlizWN9hdf46rHjJytZS+kWj+ngK6/x7Z9s+5:GlPVu+DJgZHxj+gfp7z
TLSH
T17D673330D5FECC8A865BD6B2841E6E5F9CC96ACF0B43C9A066B541EADF1C8CF4705A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mod Menu v3.1.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Mod Menu v3.1.zip:Zone.Identifier
Size 319B
SHA256 2423445aa88d6a9ad17818b65d87de3aecf562b10409196da1dfb08ad71148bd
MD5 73123099dfe7d76a156feed25edad0ba
SHA1 5f2fe2944e44f0f298877d89b8c6836d25ce04df
SHA512 679ea265384636ae77cd16d6030c42adb4fc47716fa9581ecb8f2ced8ec4262aea10384a1a2d1812fa36d0c9b756fc093539f6f89160ed9edab582d4f7d5be7d
TLSH
T184E07D5B4C8088003B29269442FFC8BD705BF9C90C86D0889D61C04FAD0426B42D6D17
MD5 SHA1 SHA512 TLSH

Submit Download

x32.dll

Path C:\Users\Admin\Downloads\Mod Menu v3.1\Bin\x32.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\Downloads\Mod Menu v3.1\Loader.exe
Size 23.8MB
SHA256 814b1720f2c68526e52d6391745d6313fb35b10f643fe74ada3abd8fe3d3eaa2
MD5 65c2fed78dd043e09674d47c924d09c3
SHA1 ca00a5117178f63cbf42cd2b9e6d09470495d6ad
SHA512 fc8d22baba2a1456bf3fb72a29351c378c536d333e1ce4b86989238a3a15a57d7bee3b92f6e9620294ec872b41b9248958aefc5eaf2bb2495bf657a37ac61f52
SSDEEP 393216:9MqduYAC1o5Xzav3rQNV8/yoaBmtOPQDd2lsbATPqJHk+JE0H/Xio:5du5C1o5XOvrQw638tOaSsUQE+Pfio
TLSH
T1964723C795C857F8D7938608A15B23CBD3C06167AF96881C368A6C037521D978B8BF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3716-615-0x00007FFFF9B70000-0x00007FFFF9B72000-memory.dmp

Download

memory/3716-616-0x0000000140000000-0x00000001426BA000-memory.dmp

Download