URL:

https://modmenuz.com/download-modest-menu/

Full analysis: https://app.any.run/tasks/740d442a-8052-44c0-8c8c-dbcd6e22c8aa
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 22:17:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
delphi
opera
tool
stealer
Indicators:
MD5:

6025E09C91535E15CE2F0BE8312FDCDB

SHA1:

69B563EFDF09716E60161F72EC3820DDF6FB71C6

SHA256:

2977A0B8B0554A2141411DF296DF0EFC928CF06827B0892CE299E76EC4429349

SSDEEP:

3:N8jIJxKJIb+K:20WGb1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Kiddion's Modest Menu.exe (PID: 3960)
      • opera.exe (PID: 7640)

    • Actions looks like stealing of personal data

      • opera.exe (PID: 7640)

    • Steals credentials from Web Browsers

      • opera.exe (PID: 7640)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • Kiddion's Modest Menu.exe (PID: 3960)

    • Process drops legitimate windows executable

      • Kiddion's Modest Menu.exe (PID: 3960)

    • Executable content was dropped or overwritten

      • Kiddion's Modest Menu.exe (PID: 3960)
      • setup.exe (PID: 3588)
      • setup.exe (PID: 6420)
      • OperaGXSetup.exe (PID: 7284)
      • setup.exe (PID: 3880)
      • setup.exe (PID: 6540)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4036)
      • setup.exe (PID: 5808)
      • installer.exe (PID: 6312)
      • installer.exe (PID: 7040)
      • installer.exe (PID: 9160)
      • installer.exe (PID: 8828)
      • opera_autoupdate.exe (PID: 7296)

    • Application launched itself

      • Kiddions Modest Menu.exe (PID: 3480)
      • setup.exe (PID: 3588)
      • setup.exe (PID: 5808)
      • assistant_installer.exe (PID: 2128)
      • installer.exe (PID: 7040)
      • opera.exe (PID: 7640)
      • opera_autoupdate.exe (PID: 4084)
      • installer.exe (PID: 9160)
      • opera_autoupdate.exe (PID: 7296)

    • Reads security settings of Internet Explorer

      • Kiddion's Modest Menu.exe (PID: 3960)
      • Kiddions Modest Menu.exe (PID: 3480)
      • setup.exe (PID: 3588)
      • installer.exe (PID: 7040)
      • opera.exe (PID: 10152)

    • Starts itself from another location

      • setup.exe (PID: 3588)

    • Searches for installed software

      • installer.exe (PID: 7040)

    • Creates a software uninstall entry

      • installer.exe (PID: 7040)

    • Reads the date of Windows installation

      • installer.exe (PID: 7040)
      • opera.exe (PID: 7640)

    • The process executes via Task Scheduler

      • opera_autoupdate.exe (PID: 7296)

    • The process checks if it is being run in the virtual environment

      • opera.exe (PID: 7640)

    • Reads Mozilla Firefox installation path

      • opera.exe (PID: 7640)

  • INFO

    • Reads the computer name

      • identity_helper.exe (PID: 7828)
      • identity_helper.exe (PID: 2320)
      • Kiddion's Modest Menu.exe (PID: 3960)
      • Kiddions Modest Menu.exe (PID: 3480)
      • Kiddions Modest Menu.exe (PID: 7792)
      • Kiddions Modest Menu.exe (PID: 7736)
      • identity_helper.exe (PID: 7928)
      • setup.exe (PID: 3588)
      • identity_helper.exe (PID: 4708)
      • identity_helper.exe (PID: 7856)
      • setup.exe (PID: 5808)
      • installer.exe (PID: 7040)
      • assistant_installer.exe (PID: 2128)
      • opera.exe (PID: 7640)
      • opera.exe (PID: 5480)
      • opera.exe (PID: 3388)
      • opera_gx_splash.exe (PID: 4684)
      • opera.exe (PID: 8332)
      • opera_autoupdate.exe (PID: 4084)
      • installer.exe (PID: 9160)
      • opera_autoupdate.exe (PID: 7296)
      • opera.exe (PID: 10152)

    • Checks supported languages

      • identity_helper.exe (PID: 7828)
      • Kiddion's Modest Menu.exe (PID: 3960)
      • identity_helper.exe (PID: 2320)
      • Kiddions Modest Menu.exe (PID: 3480)
      • Kiddions Modest Menu.exe (PID: 7792)
      • Kiddions Modest Menu.exe (PID: 7736)
      • Kiddions Modest Menu.exe (PID: 1380)
      • Kiddions Modest Menu.exe (PID: 7524)
      • identity_helper.exe (PID: 7928)
      • identity_helper.exe (PID: 4708)
      • OperaGXSetup.exe (PID: 7284)
      • setup.exe (PID: 3588)
      • setup.exe (PID: 6420)
      • identity_helper.exe (PID: 7856)
      • setup.exe (PID: 3880)
      • setup.exe (PID: 6540)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4036)
      • setup.exe (PID: 5808)
      • assistant_installer.exe (PID: 2128)
      • assistant_installer.exe (PID: 1232)
      • installer.exe (PID: 7040)
      • installer.exe (PID: 6312)
      • opera_crashreporter.exe (PID: 1336)
      • opera.exe (PID: 3388)
      • opera.exe (PID: 5480)
      • opera.exe (PID: 7640)
      • opera.exe (PID: 6748)
      • opera.exe (PID: 6732)
      • opera.exe (PID: 7080)
      • opera.exe (PID: 8072)
      • opera.exe (PID: 7916)
      • opera.exe (PID: 5460)
      • opera.exe (PID: 8184)
      • opera_gx_splash.exe (PID: 4684)
      • opera.exe (PID: 2512)
      • opera.exe (PID: 7184)
      • opera.exe (PID: 1576)
      • opera.exe (PID: 7152)
      • opera.exe (PID: 2524)
      • opera.exe (PID: 7724)
      • opera.exe (PID: 420)
      • opera.exe (PID: 1180)
      • opera.exe (PID: 6796)
      • opera.exe (PID: 7840)
      • opera.exe (PID: 4864)
      • opera.exe (PID: 5532)
      • opera.exe (PID: 4512)
      • opera.exe (PID: 4500)
      • opera.exe (PID: 8160)
      • opera.exe (PID: 2468)
      • opera.exe (PID: 7100)
      • opera.exe (PID: 4088)
      • opera.exe (PID: 6344)
      • opera.exe (PID: 7464)
      • opera.exe (PID: 4192)
      • opera.exe (PID: 8076)
      • opera.exe (PID: 3748)
      • opera.exe (PID: 8136)
      • opera.exe (PID: 9024)
      • opera.exe (PID: 8756)
      • opera.exe (PID: 9204)
      • opera.exe (PID: 9036)
      • opera.exe (PID: 9176)
      • installer.exe (PID: 9160)
      • opera_autoupdate.exe (PID: 4084)
      • opera.exe (PID: 8332)
      • opera_autoupdate.exe (PID: 8664)
      • installer.exe (PID: 8828)
      • opera_autoupdate.exe (PID: 7296)
      • opera_autoupdate.exe (PID: 9044)
      • opera.exe (PID: 9092)
      • opera.exe (PID: 9700)
      • opera.exe (PID: 8720)
      • opera.exe (PID: 8708)
      • opera.exe (PID: 10024)
      • opera.exe (PID: 8280)
      • opera.exe (PID: 10228)
      • opera.exe (PID: 9540)
      • opera.exe (PID: 8780)
      • opera.exe (PID: 620)
      • opera.exe (PID: 10152)
      • opera.exe (PID: 9052)
      • opera.exe (PID: 6216)
      • opera.exe (PID: 8320)
      • opera.exe (PID: 9872)
      • opera.exe (PID: 8348)
      • opera.exe (PID: 4324)
      • opera.exe (PID: 9108)
      • opera.exe (PID: 3788)
      • opera.exe (PID: 7528)
      • opera.exe (PID: 9088)
      • opera.exe (PID: 9728)
      • opera.exe (PID: 9748)
      • opera.exe (PID: 9764)
      • opera.exe (PID: 3748)
      • opera.exe (PID: 9084)
      • opera.exe (PID: 5764)
      • opera.exe (PID: 7364)
      • opera.exe (PID: 8696)
      • opera.exe (PID: 8076)
      • opera.exe (PID: 3568)

    • Application launched itself

      • msedge.exe (PID: 6652)
      • msedge.exe (PID: 8148)
      • msedge.exe (PID: 7424)
      • msedge.exe (PID: 7660)
      • msedge.exe (PID: 6264)
      • msedge.exe (PID: 1800)
      • msedge.exe (PID: 7204)
      • msedge.exe (PID: 8008)

    • Manual execution by a user

      • WinRAR.exe (PID: 8124)
      • Kiddion's Modest Menu.exe (PID: 3960)
      • OperaGXSetup.exe (PID: 7284)

    • Reads Environment values

      • identity_helper.exe (PID: 2320)
      • identity_helper.exe (PID: 7828)
      • Kiddions Modest Menu.exe (PID: 3480)
      • identity_helper.exe (PID: 7928)
      • identity_helper.exe (PID: 4708)
      • identity_helper.exe (PID: 7856)

    • Create files in a temporary directory

      • Kiddion's Modest Menu.exe (PID: 3960)
      • Kiddions Modest Menu.exe (PID: 3480)
      • OperaGXSetup.exe (PID: 7284)
      • setup.exe (PID: 3588)
      • setup.exe (PID: 6420)
      • setup.exe (PID: 3880)
      • setup.exe (PID: 5808)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4036)
      • setup.exe (PID: 6540)
      • installer.exe (PID: 7040)
      • installer.exe (PID: 6312)
      • opera.exe (PID: 7640)
      • installer.exe (PID: 9160)
      • installer.exe (PID: 8828)

    • Compiled with Borland Delphi (YARA)

      • Kiddion's Modest Menu.exe (PID: 3960)

    • Creates files or folders in the user directory

      • Kiddion's Modest Menu.exe (PID: 3960)
      • Kiddions Modest Menu.exe (PID: 3480)
      • Kiddions Modest Menu.exe (PID: 7736)
      • setup.exe (PID: 6420)
      • setup.exe (PID: 3588)
      • setup.exe (PID: 5808)
      • opera.exe (PID: 7640)
      • installer.exe (PID: 7040)
      • opera.exe (PID: 5480)
      • opera.exe (PID: 10152)

    • The sample compiled with english language support

      • Kiddion's Modest Menu.exe (PID: 3960)
      • OperaGXSetup.exe (PID: 7284)
      • setup.exe (PID: 6420)
      • setup.exe (PID: 3588)
      • setup.exe (PID: 3880)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4036)
      • setup.exe (PID: 5808)
      • setup.exe (PID: 6540)
      • installer.exe (PID: 6312)
      • installer.exe (PID: 7040)
      • installer.exe (PID: 9160)
      • installer.exe (PID: 8828)
      • opera_autoupdate.exe (PID: 7296)

    • Reads product name

      • Kiddions Modest Menu.exe (PID: 3480)

    • Checks proxy server information

      • Kiddions Modest Menu.exe (PID: 3480)
      • setup.exe (PID: 3588)
      • opera.exe (PID: 7640)
      • slui.exe (PID: 7484)
      • opera_autoupdate.exe (PID: 4084)
      • opera.exe (PID: 10152)

    • Process checks computer location settings

      • Kiddions Modest Menu.exe (PID: 3480)
      • Kiddion's Modest Menu.exe (PID: 3960)
      • Kiddions Modest Menu.exe (PID: 7524)
      • Kiddions Modest Menu.exe (PID: 1380)
      • opera.exe (PID: 7640)
      • opera.exe (PID: 8184)
      • opera.exe (PID: 2512)
      • opera.exe (PID: 1576)
      • opera.exe (PID: 7724)
      • opera.exe (PID: 1180)
      • opera.exe (PID: 7184)
      • opera.exe (PID: 3748)
      • opera.exe (PID: 4864)
      • opera.exe (PID: 7840)
      • opera.exe (PID: 5532)
      • opera.exe (PID: 8136)
      • opera.exe (PID: 8756)
      • opera.exe (PID: 9092)
      • opera.exe (PID: 8708)
      • opera.exe (PID: 8720)
      • opera.exe (PID: 10024)
      • opera.exe (PID: 620)
      • opera.exe (PID: 9084)
      • opera.exe (PID: 8076)

    • Launching a file from a Registry key

      • Kiddion's Modest Menu.exe (PID: 3960)
      • opera.exe (PID: 7640)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 8148)

    • Launching a file from the Downloads directory

      • msedge.exe (PID: 8148)

    • Reads the software policy settings

      • Kiddions Modest Menu.exe (PID: 3480)
      • setup.exe (PID: 3588)
      • slui.exe (PID: 7484)

    • Reads the machine GUID from the registry

      • Kiddions Modest Menu.exe (PID: 3480)
      • setup.exe (PID: 3588)
      • opera.exe (PID: 7640)
      • opera_autoupdate.exe (PID: 4084)
      • opera_autoupdate.exe (PID: 7296)
      • opera_autoupdate.exe (PID: 9044)
      • opera_autoupdate.exe (PID: 8664)

    • OPERA mutex has been found

      • opera.exe (PID: 7640)
      • opera_autoupdate.exe (PID: 4084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
336
Monitored processes
195
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs winrar.exe no specs kiddion's modest menu.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs kiddions modest menu.exe no specs kiddions modest menu.exe no specs kiddions modest menu.exe kiddions modest menu.exe no specs slui.exe kiddions modest menu.exe no specs kiddions modest menu.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs kiddions modest menu.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs kiddions modest menu.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs operagxsetup.exe setup.exe setup.exe setup.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs setup.exe setup.exe opera_gx_assistant_73.0.3856.382_setup.exe_sfx.exe assistant_installer.exe assistant_installer.exe no specs installer.exe installer.exe opera.exe opera_crashreporter.exe no specs opera.exe no specs opera.exe opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera_gx_splash.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs comppkgsrv.exe no specs opera.exe no specs opera.exe no specs installer.exe opera.exe no specs opera.exe no specs opera_autoupdate.exe opera_autoupdate.exe opera_autoupdate.exe no specs installer.exe opera_autoupdate.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
420"C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --with-feature:address-bar-dropdown-autocompleted-domains=on --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:aria-in-tab-view=on --with-feature:cashback-assistant=off --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-amazon-us-associates=off --with-feature:continue-shopping-explore=off --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-servers=off --with-feature:gx-april1st=off --with-feature:gx-post-mortem=on --with-feature:gx-reactinator=on --with-feature:gx-spotlight=on --with-feature:gx-video-to-phone=on --with-feature:panic-button=on --with-feature:play-again=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:side-profiles=on --with-feature:sitecheck-age=on --with-feature:suggestion-redirect-handler=on --with-feature:tiktok-panel=on --with-feature:ui-compositor-multithreaded=on --with-feature:vpn-pro-v4-support=on --with-feature:installer-experiment-test=off --field-trial-handle=1932,i,9228267793589064938,12026237400353867442,262144 --enable-features=CertificateTransparencyAskBeforeEnabling --disable-features=PlatformSoftwareH264EncoderInGpu,UpdatableKeyPins --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe—opera.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera GX Internet Browser
Exit code:
0
Version:
119.0.5497.108
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\programs\opera gx\119.0.5497.108\opera_elf.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shcore.dll
472"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=6096,i,6943523557434655058,8928795683684697068,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
620"C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 OPR/119.0.0.0 (Edition std-2)" --no-pre-read-main-dll --start-stack-profiler --with-feature:address-bar-dropdown-autocompleted-domains=on --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:aria-in-tab-view=on --with-feature:cashback-assistant=off --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-amazon-us-associates=off --with-feature:continue-shopping-explore=off --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-servers=off --with-feature:gx-april1st=off --with-feature:gx-post-mortem=on --with-feature:gx-reactinator=on --with-feature:gx-spotlight=on --with-feature:gx-video-to-phone=on --with-feature:panic-button=on --with-feature:play-again=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:side-profiles=on --with-feature:sitecheck-age=on --with-feature:suggestion-redirect-handler=on --with-feature:tiktok-panel=on --with-feature:ui-compositor-multithreaded=on --with-feature:vpn-pro-v4-support=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=1932,i,9228267793589064938,12026237400353867442,262144 --enable-features=CertificateTransparencyAskBeforeEnabling --disable-features=PlatformSoftwareH264EncoderInGpu,UpdatableKeyPins --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe—opera.exe
User:
admin
Company:
Opera Software
Integrity Level:
LOW
Description:
Opera GX Internet Browser
Exit code:
0
Version:
119.0.5497.108
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\programs\opera gx\119.0.5497.108\opera_elf.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
1068"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3256,i,3898471927218355082,13178233589920908895,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1180"C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 OPR/119.0.0.0 (Edition std-2)" --no-pre-read-main-dll --with-feature:address-bar-dropdown-autocompleted-domains=on --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:aria-in-tab-view=on --with-feature:cashback-assistant=off --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-amazon-us-associates=off --with-feature:continue-shopping-explore=off --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-servers=off --with-feature:gx-april1st=off --with-feature:gx-post-mortem=on --with-feature:gx-reactinator=on --with-feature:gx-spotlight=on --with-feature:gx-video-to-phone=on --with-feature:panic-button=on --with-feature:play-again=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:side-profiles=on --with-feature:sitecheck-age=on --with-feature:suggestion-redirect-handler=on --with-feature:tiktok-panel=on --with-feature:ui-compositor-multithreaded=on --with-feature:vpn-pro-v4-support=on --with-feature:installer-experiment-test=off --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1932,i,9228267793589064938,12026237400353867442,262144 --enable-features=CertificateTransparencyAskBeforeEnabling --disable-features=PlatformSoftwareH264EncoderInGpu,UpdatableKeyPins --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe—opera.exe
User:
admin
Company:
Opera Software
Integrity Level:
LOW
Description:
Opera GX Internet Browser
Exit code:
0
Version:
119.0.5497.108
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\programs\opera gx\119.0.5497.108\opera_elf.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
1216"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5256,i,3898471927218355082,13178233589920908895,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1232"C:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202506212218531\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x2b8,0x2bc,0x2c0,0x288,0x2c4,0xa14f48,0xa14f58,0xa14f64C:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202506212218531\assistant\assistant_installer.exe—assistant_installer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera GX Browser Assistant Installer
Exit code:
0
Version:
73.0.3856.382
Modules
Images
c:\users\admin\appdata\local\temp\.opera\opera gx installer temp\opera_package_202506212218531\assistant\assistant_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1336"C:\Users\admin\AppData\Local\Programs\Opera GX\119.0.5497.108\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=119.0.5497.108 --initial-client-data=0x220,0x224,0x228,0x21c,0x22c,0x7ffc14735cb0,0x7ffc14735cc0,0x7ffc14735cd0C:\Users\admin\AppData\Local\Programs\Opera GX\119.0.5497.108\opera_crashreporter.exe—opera.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera GX crash-reporter
Version:
119.0.5497.108
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\119.0.5497.108\opera_crashreporter.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1380"C:\Users\admin\AppData\Roaming\Kiddion's Modest Menu\Kiddions Modest Menu.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\kiddions-modest-menu-nativefier-db65e4" --app-user-model-id=kiddions-modest-menu-nativefier-db65e4 --app-path="C:\Users\admin\AppData\Roaming\Kiddion's Modest Menu\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2420 --field-trial-handle=1684,i,4940198085123131724,9721858585297745778,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Users\admin\AppData\Roaming\Kiddion's Modest Menu\Kiddions Modest Menu.exe—Kiddions Modest Menu.exe
User:
admin
Company:
Jia Hao
Integrity Level:
MEDIUM
Description:
Kiddions Modest Menu
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\roaming\kiddion's modest menu\kiddions modest menu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1480"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --disable-quic --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5616,i,3898471927218355082,13178233589920908895,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
47 660
Read events
47 402
Write events
233
Delete events
25

Modification events

(PID) Process:(6652) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6652) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6652) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6652) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6652) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\394036
Operation:writeName:WindowTabManagerFileMappingId
Value:
{7DAB9BFE-C73E-4C25-B309-C066BD6971B1}
(PID) Process:(6652) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\394036
Operation:writeName:WindowTabManagerFileMappingId
Value:
{BFCDBA24-B4EF-44B2-AC1D-FDA31AABF421}
(PID) Process:(6652) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
FC73EEA0B2962F00
(PID) Process:(6652) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\394036
Operation:writeName:WindowTabManagerFileMappingId
Value:
{ABFFF3B3-5444-438F-881B-1D07A5895C73}
(PID) Process:(6652) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\394036
Operation:writeName:WindowTabManagerFileMappingId
Value:
{A487DB55-2321-4C63-B9DB-B70ABB19BF3A}
(PID) Process:(6652) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MicrosoftEdgeAutoLaunch_29EBC4579851B72EE312C449CF839B1A
Value:
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
Executable files
61
Suspicious files
1 230
Text files
792
Unknown types
3

Dropped files

PID
Process
Filename
Type
6652msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF176bc9.TMP —
MD5:—
SHA256:—
6652msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
6652msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF176bc9.TMP —
MD5:—
SHA256:—
6652msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6652msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF176c08.TMP —
MD5:—
SHA256:—
6652msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6652msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF176c18.TMP —
MD5:—
SHA256:—
6652msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF176c18.TMP —
MD5:—
SHA256:—
6652msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
6652msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
290
DNS requests
332
Threats
34

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4456
msedge.exe
GET
200
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:95UHuXdsIJEyrrI07WK1hkuScvjG3RnvrySK7nFSVhM&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
7164
svchost.exe
GET
200
23.196.145.221:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.154.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7372
SIHClient.exe
GET
200
104.121.237.231:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7372
SIHClient.exe
GET
200
104.121.237.231:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8148
msedge.exe
GET
200
23.196.145.221:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
8148
msedge.exe
GET
200
23.196.145.221:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
8148
msedge.exe
GET
200
23.196.145.221:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEA3ri9giEg1QVRsEGETa5zg%3D
unknown
—
—
whitelisted
3980
backgroundTaskHost.exe
GET
200
23.196.145.221:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
3588
setup.exe
GET
200
23.196.145.221:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2792
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4456
msedge.exe
150.171.27.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4456
msedge.exe
188.114.96.3:443
modmenuz.com
CLOUDFLARENET
NL
shared
4456
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4456
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4456
msedge.exe
23.216.155.171:443
copilot.microsoft.com
Akamai International B.V.
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.206
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
modmenuz.com
  • 188.114.96.3
  • 188.114.97.3
unknown
copilot.microsoft.com
  • 23.216.155.171
  • 23.216.155.137
whitelisted
www.bing.com
  • 2.19.176.99
  • 23.216.155.162
  • 23.216.155.155
  • 23.216.155.161
  • 2.19.176.88
  • 2.19.176.104
  • 23.216.155.137
  • 2.19.176.91
  • 2.19.176.89
  • 23.216.155.136
  • 2.19.176.90
  • 23.216.155.170
  • 23.216.155.146
  • 2.16.241.201
  • 2.16.241.218
whitelisted
github.com
  • 140.82.121.3
whitelisted
objects.githubusercontent.com
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.111.133
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Misc activity
ET INFO DNS Query to Cloudflare Page Developer Domain (pages .dev)
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
7736
Kiddions Modest Menu.exe
Misc activity
ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
7500
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7500
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7500
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7500
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
Process
Message
assistant_installer.exe
[0621/221904.250:INFO:assistant_installer_main.cc(169)] Running assistant installer with command line "C:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202506212218531\assistant\assistant_installer.exe" --version
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://modmenuz.com/download-modest-menu/