redline | hxxps://www[.]mediafire[.]com/file_premium/sfvpgkabyohtkvv/mod_menu_gta_5[.]rar/file

Analysis

max time kernel
75s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file_premium/sfvpgkabyohtkvv/mod_menu_gta_5.rar/file

Score

10^/10

redline @mass1vexdd infostealer

Malware Config

Extracted

Family

redline

Botnet

@mass1vexdd

45.15.156.167:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/memory/4844-143-0x0000000000530000-0x0000000000584000-memory.dmp	family_redline
behavioral1/memory/5044-207-0x0000000000460000-0x00000000004B4000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
4844	modest-menu.exe
5044	modest-menu.exe

Loads dropped DLL 2 IoCs

pid	Process
4844	modest-menu.exe
4844	modest-menu.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3116	4844	WerFault.exe	114

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	7zFM.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
3376	msedge.exe
3376	msedge.exe
2860	identity_helper.exe
2860	identity_helper.exe
2972	msedge.exe
2972	msedge.exe
4072	7zFM.exe
4072	7zFM.exe
4072	7zFM.exe
4072	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4072	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	4072	7zFM.exe
Token: 35	4072	7zFM.exe
Token: SeSecurityPrivilege	4072	7zFM.exe
Token: SeSecurityPrivilege	4072	7zFM.exe
Token: SeSecurityPrivilege	4072	7zFM.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
4072	7zFM.exe
4072	7zFM.exe
4072	7zFM.exe
4072	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 1424	3376	msedge.exe	85
PID 3376 wrote to memory of 1424	3376	msedge.exe	85
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 4576	3376	msedge.exe	88
PID 3376 wrote to memory of 2100	3376	msedge.exe	87
PID 3376 wrote to memory of 2100	3376	msedge.exe	87
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86
PID 3376 wrote to memory of 3156	3376	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file_premium/sfvpgkabyohtkvv/mod_menu_gta_5.rar/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffcf0146f8,0x7fffcf014708,0x7fffcf014718
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12693221319137346394,1178507652770828945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\mоd menu gta 5.rar"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4072
- - C:\Users\Admin\AppData\Local\Temp\7zO8EF68928\modest-menu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO8EF68928\modest-menu.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 780
      4⤵
      Program crash
      PID:3116
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO8EF32E68\Read before installing.txt
    3⤵
    PID:4440
- - C:\Users\Admin\AppData\Local\Temp\7zO8EF67548\modest-menu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO8EF67548\modest-menu.exe"
    3⤵
    - Executes dropped EXE
    PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4844 -ip 4844
1⤵
PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bcaf436ee5fed204f08c14d7517436eb

SHA1
637817252f1e2ab00275cd5b5a285a22980295ff

SHA256
de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120

SHA512
7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
2788d251eaae797cbbf30da446fcc49e

SHA1
148e46e27b576d1250f83e0d956089d3a6a99916

SHA256
e112921b938aa5cb12ee3393c20389563b71332db71f489d4a3d4b4ccf4f49b7

SHA512
58548410bdd133f6ea5ea3c7534b3583e65502b2024fe8635c6041149ebc89b8cb13b53b0fd17fef9ad3e15898a2ef6df48d67dbdc27dccaec51b965332aeddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
77adcf0e49a6507b690984750ec6d205

SHA1
e684ec77750897ddf2af6c1cf1baae8699e07de5

SHA256
d3b16539f11339c3d33582c192c995e4de4bf97349738b3944730e030342b7be

SHA512
57f17a3ae30cfbc2fd6b90ead51ec9dad361e862ce5f9711aa37dda8b978d3d12f5aac4c172de8d37d9803f86902d68d744a9bed638fdf4ba1702c704ad8d7c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e80a9db0c554417526d76aaa899e3f93

SHA1
85a08404765cf286aa96eef15b8d2c5577ce0e41

SHA256
335f702865ba943f57ea232cb8b249a43aae18c7aaa3ddcd1b92fd4abb9fdbd6

SHA512
3946446cf12fadbfab756d6aa2bd3867855a39c5ac3f031bc3d76579bad8d0a2545599e50da7f912b6f835aebe7fe360f1e96baa83f4513a1073bf04020f6620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
900fe18d17dbcbfed429930801a5ae46

SHA1
211ac99adf8ef175524a6a8fb0dd0acb483858e7

SHA256
301d69cb84820e74c3b52b7ed25059ad6de53d62fabef18faf7c37dcf884b8ff

SHA512
eeefb3c289dda97a534de345f92463dc5389106c88067095d9cbe97e52bc8a1cf33b236e407fc193ef3b5580650f43cd6156dd1c8db4e8529cb87dd89caad8e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b0ba6f0eee8f998b4d78bc4934f5fd17

SHA1
589653d624de363d3e8869c169441b143c1f39ad

SHA256
4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f

SHA512
e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
57be0bc1cd5df804f6d6fb8a327c3c77

SHA1
c6384758683209efbdbc55b4b68360b59cdec7dc

SHA256
829f40d476593c353f91b7d8983232dc83e57db2b6b97bcd86d82f66b4a3a49e

SHA512
50ee20630eb0cf47c10d9a9562b9526d8e462eba24da689c9528a7862700840519c265b4e3fc9183b5164017582b2e1b7cd3804cbfb1b2d007d45ac954875d8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5be576f87e255988933f0dd3e9fde623

SHA1
084be09a157546dc542fb9b5b47d5fb01266df4c

SHA256
0a075d8fe1dc640a3c9905d311e9178cebc04af028345d6896904367e2376abf

SHA512
124c54e05b650b0cfd3654118721d31d23d92ffb0ce78747a398aed1671547b95c51b01a078912ca3988cf49ca7ed20e40d9997e12d2d3c6e202a90b9b902d56

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO8EF32E68\Read before installing.txt

Filesize
729B

MD5
ff08a294ca76882eef4602fdf09e4899

SHA1
acc0f504c6f15a175c1a113588b1850978d34d07

SHA256
4d1100e6ba8ef8955ec713946caaa60dda8ec85c9f5e80de782d39d2ae7282ea

SHA512
2fc8b96404d1ea429afde50688726e0cdf3076c8279ec13177e097942af185c1bb4271649b28246e95839688cd4e4d9de5d5d197d7a07504c130e3e7c1a0c4ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO8EF68928\modest-menu.exe

Filesize
382KB

MD5
6241b2487a1612ff6c97e16f43ccf600

SHA1
9fb4738767f86ab51edbecc40de72b92700b5695

SHA256
345a0254bba40885cd4b407bcc35c4780b4f0027794fbacf3f96698471c73cc3

SHA512
7ebdec016c2c59eba0e4b329acc3c48489464f15d40f46e89ed4d3cca3d6186cae7ef86f54c0626bd0d87b13ce0d7c27e4e9dc6b6f56bf3fad3e744e3bb8689b

Download Submit
C:\Users\Admin\Downloads\mоd menu gta 5.rar

Filesize
149KB

MD5
d25f50f265427fe845ef2b947f0c2397

SHA1
68ea8bfdd9d2de79c2f61d3d7d4c351612856e81

SHA256
d8b09bbe1f6e550ee84335cabf863f50178b0b2f3a132fd295adde65ebcb83b0

SHA512
7f7903e5a04914087d09cfa1f12ba8e4b500f2df4a5c6a1102ebaadce8daad05da9577f7fa88cb46722114ac0f25d25a2b5ac78ba9f78dd2384886266c7935bd

Download Submit
memory/4844-151-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4844-153-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/4844-149-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/4844-143-0x0000000000530000-0x0000000000584000-memory.dmp

Filesize
336KB

Download
memory/5044-213-0x0000000004A20000-0x0000000004AB2000-memory.dmp

Filesize
584KB

Download
memory/5044-212-0x0000000004AD0000-0x0000000005074000-memory.dmp

Filesize
5.6MB

Download
memory/5044-211-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/5044-207-0x0000000000460000-0x00000000004B4000-memory.dmp

Filesize
336KB

Download
memory/5044-214-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/5044-215-0x0000000005110000-0x000000000511A000-memory.dmp

Filesize
40KB

Download
memory/5044-216-0x00000000059D0000-0x0000000005FE8000-memory.dmp

Filesize
6.1MB

Download
memory/5044-217-0x0000000007960000-0x0000000007A6A000-memory.dmp

Filesize
1.0MB

Download
memory/5044-218-0x0000000007A80000-0x0000000007A92000-memory.dmp

Filesize
72KB

Download
memory/5044-219-0x0000000007AA0000-0x0000000007ADC000-memory.dmp

Filesize
240KB

Download
memory/5044-220-0x0000000007B50000-0x0000000007B9C000-memory.dmp

Filesize
304KB

Download