Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    89s
  • max time network
    106s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 05:12

General

  • Target

    CheatEngine75.exe

  • Size

    28.5MB

  • MD5

    dd2a4fc0eeac88904580a2c993632b8b

  • SHA1

    7443b346340a0d36bd16813447015f262ab53d2d

  • SHA256

    f4f642dc1f2fce61dbff0b3227c4a27c9b6c2a97017ab067a369956167e20ad7

  • SHA512

    127741b7b929a836bbc393a2ce5f018970616582ec444375ce900391ed3ded94459197a5d17e430e4eb89e78859605834717df7dfff686e9ad2f73ae8e6188c2

  • SSDEEP

    786432:JTCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFH:J2EXFhV0KAcNjxAItj

Score
8/10

Malware Config

Signatures

  • Stops running service(s) 3 TTPs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Checks for any installed AV software in registry 1 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 8 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 12 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • Runs net.exe
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe
    "C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\is-PADV7.tmp\CheatEngine75.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PADV7.tmp\CheatEngine75.tmp" /SL5="$4017C,29019897,780800,C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"
      2⤵
      • Checks for any installed AV software in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Users\Admin\AppData\Local\Temp\is-SSH7T.tmp\CheatEngine75.exe
        "C:\Users\Admin\AppData\Local\Temp\is-SSH7T.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1560
        • C:\Users\Admin\AppData\Local\Temp\is-5VPLT.tmp\CheatEngine75.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-5VPLT.tmp\CheatEngine75.tmp" /SL5="$60150,26511452,832512,C:\Users\Admin\AppData\Local\Temp\is-SSH7T.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1236
          • C:\Windows\system32\net.exe
            "net" stop BadlionAntic
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2452
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop BadlionAntic
              6⤵
                PID:2608
            • C:\Windows\system32\net.exe
              "net" stop BadlionAnticheat
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2036
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop BadlionAnticheat
                6⤵
                  PID:3032
              • C:\Windows\system32\sc.exe
                "sc" delete BadlionAntic
                5⤵
                • Launches sc.exe
                PID:2096
              • C:\Windows\system32\sc.exe
                "sc" delete BadlionAnticheat
                5⤵
                • Launches sc.exe
                PID:2432
              • C:\Users\Admin\AppData\Local\Temp\is-UO7P4.tmp\_isetup\_setup64.tmp
                helper 105 0x208
                5⤵
                • Executes dropped EXE
                PID:1728
              • C:\Windows\system32\icacls.exe
                "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
                5⤵
                • Modifies file permissions
                PID:1856
              • C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe
                "C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP
                5⤵
                • Executes dropped EXE
                PID:2088
              • C:\Program Files\Cheat Engine 7.5\windowsrepair.exe
                "C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s
                5⤵
                • Executes dropped EXE
                PID:2000
              • C:\Windows\system32\icacls.exe
                "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
                5⤵
                • Modifies file permissions
                PID:1968
          • C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe
            "C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2396
            • C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
              "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of FindShellTrayWindow
              PID:1856

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\Cheat Engine 7.5\allochook-i386.dll

        Filesize

        328KB

        MD5

        19d52868c3e0b609dbeb68ef81f381a9

        SHA1

        ce365bd4cf627a3849d7277bafbf2f5f56f496dc

        SHA256

        b96469b310ba59d1db320a337b3a8104db232a4344a47a8e5ae72f16cc7b1ff4

        SHA512

        5fbd53d761695de1dd6f0afd0964b33863764c89692345cab013c0b1b6332c24dcf766028f305cc87d864d17229d7a52bf19a299ca136a799053c368f21c8926

      • C:\Program Files\Cheat Engine 7.5\allochook-x86_64.dll

        Filesize

        468KB

        MD5

        daa81711ad1f1b1f8d96dc926d502484

        SHA1

        7130b241e23bede2b1f812d95fdb4ed5eecadbfd

        SHA256

        8422be70e0ec59c962b35acf8ad80671bcc8330c9256e6e1ec5c07691388cd66

        SHA512

        9eaa8e04ad7359a30d5e2f9256f94c1643d4c3f3c0dff24d6cd9e31a6f88cb3b470dd98f01f8b0f57bb947adc3d45c35749ed4877c7cbbbcc181145f0c361065

      • C:\Program Files\Cheat Engine 7.5\badassets\is-02QS5.tmp

        Filesize

        5KB

        MD5

        5cff22e5655d267b559261c37a423871

        SHA1

        b60ae22dfd7843dd1522663a3f46b3e505744b0f

        SHA256

        a8d8227b8e97a713e0f1f5db5286b3db786b7148c1c8eb3d4bbfe683dc940db9

        SHA512

        e00f5b4a7fa1989382df800d168871530917fcd99efcfe4418ef1b7e8473caea015f0b252cac6a982be93b5d873f4e9acdb460c8e03ae1c6eea9c37f84105e50

      • C:\Program Files\Cheat Engine 7.5\ced3d10hook.dll

        Filesize

        128KB

        MD5

        43dac1f3ca6b48263029b348111e3255

        SHA1

        9e399fddc2a256292a07b5c3a16b1c8bdd8da5c1

        SHA256

        148f12445f11a50efbd23509139bf06a47d453e8514733b5a15868d10cc6e066

        SHA512

        6e77a429923b503fc08895995eb8817e36145169c2937dacc2da92b846f45101846e98191aeb4f0f2f13fff05d0836aa658f505a04208188278718166c5e3032

      • C:\Program Files\Cheat Engine 7.5\ced3d10hook64.dll

        Filesize

        140KB

        MD5

        0daf9f07847cceb0f0760bf5d770b8c1

        SHA1

        992cc461f67acea58a866a78b6eefb0cbcc3aaa1

        SHA256

        a2ac2ba27b0ed9acc3f0ea1bef9909a59169bc2eb16c979ef8e736a784bf2fa4

        SHA512

        b4dda28721de88a372af39d4dfba6e612ce06cc443d6a6d636334865a9f8ca555591fb36d9829b54bc0fb27f486d4f216d50f68e1c2df067439fe8ebbf203b6a

      • C:\Program Files\Cheat Engine 7.5\ced3d11hook.dll

        Filesize

        137KB

        MD5

        42e2bf4210f8126e3d655218bd2af2e4

        SHA1

        78efcb9138eb0c800451cf2bcc10e92a3adf5b72

        SHA256

        1e30126badfffb231a605c6764dd98895208779ef440ea20015ab560263dd288

        SHA512

        c985988d0832ce26337f774b160ac369f2957c306a1d82fbbffe87d9062ae5f3af3c1209768cd574182669cd4495dba26b6f1388814c0724a7812218b0b8dc74

      • C:\Program Files\Cheat Engine 7.5\ced3d11hook64.dll

        Filesize

        146KB

        MD5

        0eaac872aadc457c87ee995bbf45a9c1

        SHA1

        5e9e9b98f40424ad5397fc73c13b882d75499d27

        SHA256

        6f505cc5973687bbda1c2d9ac8a635d333f57c12067c54da7453d9448ab40b8f

        SHA512

        164d1e6ef537d44ac4c0fd90d3c708843a74ac2e08fa2b3f0fdd4a180401210847e0f7bb8ec3056f5dc1d5a54d3239c59fb37914ce7742a4c0eb81578657d24b

      • C:\Program Files\Cheat Engine 7.5\ced3d9hook.dll

        Filesize

        124KB

        MD5

        5f1a333671bf167730ed5f70c2c18008

        SHA1

        c8233bbc6178ba646252c6566789b82a3296cab5

        SHA256

        fd2a2b4fe4504c56347c35f24d566cc0510e81706175395d0a2ba26a013c4daf

        SHA512

        6986d93e680b3776eb5700143fc35d60ca9dbbdf83498f8731c673f9fd77c8699a24a4849db2a273aa991b8289e4d6c3142bbde77e11f2faf603df43e8fea105

      • C:\Program Files\Cheat Engine 7.5\ced3d9hook64.dll

        Filesize

        136KB

        MD5

        61ba5199c4e601fa6340e46bef0dff2d

        SHA1

        7c1a51d6d75b001ba1acde2acb0919b939b392c3

        SHA256

        8783f06f7b123e16042bb0af91ff196b698d3cd2aa930e3ea97cfc553d9fc0f4

        SHA512

        8ce180a622a5788bb66c5f3a4abfde62c858e86962f29091e9c157753088ddc826c67c51ff26567bfe2b75737897f14e6bb17ec89f52b525f6577097f1647d31

      • C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe

        Filesize

        1.9MB

        MD5

        73730d8c854bb992ae8e196647c39fcf

        SHA1

        352924023bc7ccb240a7bf9824806cc8295a286b

        SHA256

        047e5cd62d052f8a7d1c3b07f897e383c327f04eef08b82632f145d1fa3af146

        SHA512

        f6658fdc164bf60f2cccbe80ffede45f28da9907bf03fd68063680402877c78ada1f807232133db22a663d2205058433639dc511a6bf10289261b7216473c95b

      • C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe

        Filesize

        1.6MB

        MD5

        fc0cbbeafadd3a9fffc7d328db46c2f7

        SHA1

        96ec54475bff3e6902e68220f1e8a993a7aeca86

        SHA256

        b4633e58e956d91c93d13ffae898500305349ba94a0532cdbc759440b3af6157

        SHA512

        d2ac666442f9fb21b52166d31eeefb5ba4df9dc7a71d71b0c8d8c3afcb8f228e765a57aef049198821a6425ee88e589d1505ec94094e44654d276564dea93c6d

      • C:\Program Files\Cheat Engine 7.5\d3dhook.dll

        Filesize

        119KB

        MD5

        2a2ebe526ace7eea5d58e416783d9087

        SHA1

        5dabe0f7586f351addc8afc5585ee9f70c99e6c4

        SHA256

        e2a7df4c380667431f4443d5e5fc43964b76c8fcb9cf4c7db921c4140b225b42

        SHA512

        94ed0038068abddd108f880df23422e21f9808ce04a0d14299aacc5d573521f52626c0c2752b314cda976f64de52c4d5bcac0158b37d43afb9bc345f31fdbbc0

      • C:\Program Files\Cheat Engine 7.5\d3dhook64.dll

        Filesize

        131KB

        MD5

        2af7afe35ab4825e58f43434f5ae9a0f

        SHA1

        b67c51cad09b236ae859a77d0807669283d6342f

        SHA256

        7d82694094c1bbc586e554fa87a4b1ed6ebc9eb14902fd429824dcd501339722

        SHA512

        23b7c6db0cb9c918ad9f28fa0e4e683c7e2495e89a136b75b7e1be6380591da61b6fb4f7248191f28fd3d80c4a391744a96434b4ab96b9531b5ebb0ec970b9d0

      • C:\Program Files\Cheat Engine 7.5\languages\language.ini

        Filesize

        283B

        MD5

        af5ed8f4fe5370516403ae39200f5a4f

        SHA1

        9299e9998a0605182683a58a5a6ab01a9b9bc037

        SHA256

        4aa4f0b75548d45c81d8e876e2db1c74bddfd64091f102706d729b50a7af53a5

        SHA512

        f070049a2fae3223861424e7fe79cbae6601c9bee6a56fadde4485ad3c597dc1f3687e720177ab28564a1faab52b6679e9315f74327d02aa1fb31e7b8233a80f

      • C:\Program Files\Cheat Engine 7.5\libipt-32.dll

        Filesize

        157KB

        MD5

        df443813546abcef7f33dd9fc0c6070a

        SHA1

        635d2d453d48382824e44dd1e59d5c54d735ee2c

        SHA256

        d14911c838620251f7f64c190b04bb8f4e762318cc763d993c9179376228d8ca

        SHA512

        9f9bea9112d9db9bcecfc8e4800b7e8032efb240cbbddaf26c133b4ce12d27b47dc4e90bc339c561714bc972f6e809b2ec9c9e1facc6c223fbac66b089a14c25

      • C:\Program Files\Cheat Engine 7.5\libipt-64.dll

        Filesize

        182KB

        MD5

        4a3b7c52ef32d936e3167efc1e920ae6

        SHA1

        d5d8daa7a272547419132ddb6e666f7559dbac04

        SHA256

        26ede848dba071eb76c0c0ef8e9d8ad1c53dfab47ca9137abc9d683032f06ebb

        SHA512

        36d7f8a0a749de049a830cc8c8f0d3962d8dce57b445f5f3c771a86dd11aaa10da5f36f95e55d3dc90900e4dbddd0dcc21052c53aa11f939db691362c42e5312

      • C:\Program Files\Cheat Engine 7.5\luaclient-i386.dll

        Filesize

        197KB

        MD5

        9f50134c8be9af59f371f607a6daa0b6

        SHA1

        6584b98172cbc4916a7e5ca8d5788493f85f24a7

        SHA256

        dd07117ed80546f23d37f8023e992de560a1f55a76d1eb6dfd9d55baa5e3dad6

        SHA512

        5ccafa2b0e2d20034168ee9a79e8efff64f12f5247f6772815ef4cb9ee56f245a06b088247222c5a3789ae2dcefadbc2c15df4ff5196028857f92b9992b094e0

      • C:\Program Files\Cheat Engine 7.5\luaclient-x86_64.dll

        Filesize

        260KB

        MD5

        dd71848b5bbd150e22e84238cf985af0

        SHA1

        35c7aa128d47710cfdb15bb6809a20dbd0f916d8

        SHA256

        253d18d0d835f482e6abbaf716855580eb8fe789292c937301e4d60ead29531d

        SHA512

        0cbf35c9d7b09fb57d8a9079eab726a3891393f12aee8b43e01d1d979509e755b74c0fb677f8f2dfab6b2e34a141f65d0cfbfe57bda0bf7482841ad31ace7790

      • C:\Program Files\Cheat Engine 7.5\overlay.fx

        Filesize

        2KB

        MD5

        650c02fc9f949d14d62e32dd7a894f5e

        SHA1

        fa5399b01aadd9f1a4a5632f8632711c186ec0de

        SHA256

        c4d23db8effb359b4aa4d1e1e480486fe3a4586ce8243397a94250627ba4f8cc

        SHA512

        f2caaf604c271283fc7af3aa9674b9d647c4ac53dffca031dbf1220d3ed2e867943f5409a95f41c61d716879bed7c888735f43a068f1cc1452b4196d611cb76d

      • C:\Program Files\Cheat Engine 7.5\speedhack-i386.dll

        Filesize

        200KB

        MD5

        6e00495955d4efaac2e1602eb47033ee

        SHA1

        95c2998d35adcf2814ec7c056bfbe0a0eb6a100c

        SHA256

        5e24a5fe17ec001cab7118328a4bff0f2577bd057206c6c886c3b7fb98e0d6d9

        SHA512

        2004d1def322b6dd7b129fe4fa7bbe5d42ab280b2e9e81de806f54313a7ed7231f71b62b6138ac767288fee796092f3397e5390e858e06e55a69b0d00f18b866

      • C:\Program Files\Cheat Engine 7.5\speedhack-x86_64.dll

        Filesize

        256KB

        MD5

        19b2050b660a4f9fcb71c93853f2e79c

        SHA1

        5ffa886fa019fcd20008e8820a0939c09a62407a

        SHA256

        5421b570fbc1165d7794c08279e311672dc4f42cb7ae1cbddcd7eea0b1136fff

        SHA512

        a93e47387ab0d327b71c3045b3964c7586d0e03dddb2e692f6671fb99659e829591d5f23ce7a95683d82d239ba7d11fb5a123834629a53de5ce5dba6aa714a9a

      • C:\Program Files\Cheat Engine 7.5\tcc64-32.dll

        Filesize

        192KB

        MD5

        3e270801de77cd3d4eff496aa9ee0aea

        SHA1

        f04083e1d0f09dd937e14960107041ce0e3db202

        SHA256

        0f05872599f1d4769b075c35e25f716691928be908ec154e5563f5b6c37eeaf0

        SHA512

        32f5e2f677003631ac9d7e60014a644543507ccc2482c8c0e0e2bdad75916b695f73074e4fe6284d2e463e3d88bd67353b4ab9657d90692b9b3cfe0b5fc13a52

      • C:\Program Files\Cheat Engine 7.5\vehdebug-i386.dll

        Filesize

        324KB

        MD5

        e9b5905d495a88adbc12c811785e72ec

        SHA1

        ca0546646986aab770c7cf2e723c736777802880

        SHA256

        3eb9cd27035d4193e32e271778643f3acb2ba73341d87fd8bb18d99af3dffdea

        SHA512

        4124180b118149c25f8ea8dbbb2912b4bd56b43f695bf0ff9c6ccc95ade388f1be7d440a791d49e4d5c9c350ea113cf65f839a3c47d705533716acc53dd038f8

      • C:\Program Files\Cheat Engine 7.5\vehdebug-x86_64.dll

        Filesize

        413KB

        MD5

        8d487547f1664995e8c47ec2ca6d71fe

        SHA1

        d29255653ae831f298a54c6fa142fb64e984e802

        SHA256

        f50baf9dc3cd6b925758077ec85708db2712999b9027cc632f57d1e6c588df21

        SHA512

        79c230cfe8907df9da92607a2c1ace0523a36c3a13296cb0265329208edc453e293d7fbedbd5410decf81d20a7fe361fdebddadbc1dc63c96130b0bedf5b1d8a

      • C:\Program Files\Cheat Engine 7.5\win64\dbghelp.dll

        Filesize

        2.0MB

        MD5

        7a7a9cd081ab016f84249ef4f06493ad

        SHA1

        8dc1bebfae34c118fe3810dc9131cbf8ccbd9edc

        SHA256

        009681092f6a13c5c28bb3b08ea14bb03ba959f9ce1a53730d069550da376c48

        SHA512

        d2b3f302f653741298fb62d237bfc61e1555792aad73c14395b4dd4b97fe37f745e916b9f586945042b1eded19c2bc0e9efd4be57e44610d465296bd0c544e84

      • C:\Program Files\Cheat Engine 7.5\winhook-i386.dll

        Filesize

        201KB

        MD5

        de625af5cf4822db08035cc897f0b9f2

        SHA1

        4440b060c1fa070eb5d61ea9aadda11e4120d325

        SHA256

        3cdb85ee83ef12802efdfc9314e863d4696be70530b31e7958c185fc4d6a9b38

        SHA512

        19b22f43441e8bc72507be850a8154321c20b7351669d15af726145c0d34805c7df58f9dc64a29272a4811268308e503e9840f06e51ccdcb33afd61258339099

      • C:\Program Files\Cheat Engine 7.5\winhook-x86_64.dll

        Filesize

        264KB

        MD5

        f9c562b838a3c0620fb6ee46b20b554c

        SHA1

        5095f54be57622730698b5c92c61b124dfb3b944

        SHA256

        e08b035d0a894d8bea64e67b1ed0bce27567d417eaaa133e8b231f8a939e581d

        SHA512

        a20bc9a442c698c264fef82aa743d9f3873227d7d55cb908e282fa1f5dcff6b40c5b9ca7802576ef2f5a753fd1c534e9be69464b29af8efec8b019814b875296

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        8aed50d31cd1f18ed8ccf2da1ec67770

        SHA1

        0ea766250a1fe02862aea357434535de07731c62

        SHA256

        6629e97e6f295f9db4e87aa00fc7cfd9a3732a1b75600d1969de9b4816eec15b

        SHA512

        cb525876caad4db78f16e56ec53cd55b968c864f6b0ff2352b33fa12cc35a72647d2a8cf8a79aebd1f57ace162083c2335d2c47d3684b1b71948f76b568df294

      • C:\Users\Admin\AppData\Local\Temp\Cab179.tmp

        Filesize

        65KB

        MD5

        ac05d27423a85adc1622c714f2cb6184

        SHA1

        b0fe2b1abddb97837ea0195be70ab2ff14d43198

        SHA256

        c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

        SHA512

        6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      • C:\Users\Admin\AppData\Local\Temp\Tar1AB.tmp

        Filesize

        171KB

        MD5

        9c0c641c06238516f27941aa1166d427

        SHA1

        64cd549fb8cf014fcd9312aa7a5b023847b6c977

        SHA256

        4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

        SHA512

        936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

      • C:\Users\Admin\AppData\Local\Temp\is-5VPLT.tmp\CheatEngine75.tmp

        Filesize

        3.1MB

        MD5

        9aa2acd4c96f8ba03bb6c3ea806d806f

        SHA1

        9752f38cc51314bfd6d9acb9fb773e90f8ea0e15

        SHA256

        1b81562fdaeaa1bc22cbaa15c92bab90a12080519916cfa30c843796021153bb

        SHA512

        b0a00082c1e37efbfc2058887db60dabf6e9606713045f53db450f16ebae0296abfd73a025ffa6a8f2dcb730c69dd407f7889037182ce46c68367f54f4b1dc8d

      • C:\Users\Admin\AppData\Local\Temp\is-SSH7T.tmp\CheatEngine75.exe

        Filesize

        10.6MB

        MD5

        3b0ba2932c957abb4705d117aef683f1

        SHA1

        28f40433ab562701abf94d83bb0965955a6c256e

        SHA256

        08fb2325d926e3ae55530979765734c5c14bff983562afeebd92162d11db4619

        SHA512

        e297eb8304b274b211b035ebd2e49a8aeddfbb4cc4b71c5213e7c780f9e7abe8ce041eff5fd3fd3f6d707ccd76cd3f4659009cadb0d5fb90ff2cb51b89785213

      • C:\Users\Admin\AppData\Local\Temp\is-SSH7T.tmp\CheatEngine75.exe

        Filesize

        2.5MB

        MD5

        09737d3b111183f5dfd53196f8bc2627

        SHA1

        ddfa9acf228b138c27ba4f2e2591104f6b71c9e9

        SHA256

        93fe562b3bca7d19be70799b898abaf6b83a34f86ff6012ddcb4b4c15cdfc45b

        SHA512

        4a8bb9cac7f38b0d1fd0d7910066408864553d472904533a9596c6ed6ae6061b5c9bd124f366f640ed8d1efed8d8f4732931c56d91eff01b99b0c90ab9e6b447

      • C:\Users\Admin\AppData\Local\Temp\is-SSH7T.tmp\WebAdvisor.png

        Filesize

        47KB

        MD5

        4cfff8dc30d353cd3d215fd3a5dbac24

        SHA1

        0f4f73f0dddc75f3506e026ef53c45c6fafbc87e

        SHA256

        0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856

        SHA512

        9d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139

      • C:\Users\Admin\AppData\Local\Temp\is-SSH7T.tmp\logo.png

        Filesize

        246KB

        MD5

        1df360d73bf8108041d31d9875888436

        SHA1

        c866e8855d62f56a411641ece0552e54cbd0f2fb

        SHA256

        c1b1d7b4806955fe39a8bc6ce5574ab6ac5b93ad640cecfebe0961360c496d43

        SHA512

        3991b89927d89effca30cc584d5907998c217cf00ca441f2525ef8627ffff2032d104536f8b6ab79b83f4e32a7aab993f45d3930d5943cbfb5e449c5832abe14

      • \Program Files\Cheat Engine 7.5\Cheat Engine.exe

        Filesize

        389KB

        MD5

        f921416197c2ae407d53ba5712c3930a

        SHA1

        6a7daa7372e93c48758b9752c8a5a673b525632b

        SHA256

        e31b233ddf070798cc0381cc6285f6f79ea0c17b99737f7547618dcfd36cdc0e

        SHA512

        0139efb76c2107d0497be9910836d7c19329e4399aa8d46bbe17ae63d56ab73004c51b650ce38d79681c22c2d1b77078a7d7185431882baf3e7bef473ac95dce

      • \Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe

        Filesize

        236KB

        MD5

        9af96706762298cf72df2a74213494c9

        SHA1

        4b5fd2f168380919524ecce77aa1be330fdef57a

        SHA256

        65fa2ccb3ac5400dd92dda5f640445a6e195da7c827107260f67624d3eb95e7d

        SHA512

        29a0619093c4c0ecf602c861ec819ef16550c0607df93067eaef4259a84fd7d40eb88cd5548c0b3b265f3ce5237b585f508fdd543fa281737be17c0551163bd4

      • \Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe

        Filesize

        3.2MB

        MD5

        1c1630b241d5a6be07bfba2b3ea97a25

        SHA1

        7203255d1a6021874d41a48fcd5719fd7034f34c

        SHA256

        526cddd0d843f5984ac6cb98d28f22b090682c3a8704122b644ec8ae2c9a10e5

        SHA512

        bddedb575febf8c8103cfbb1981fd1d5f20d2e0f1d6f4252a98930d587420a69750ddc1be46932cdf979b8633054321f462557d88349459e111be43139beff4a

      • \Program Files\Cheat Engine 7.5\cheatengine-i386.exe

        Filesize

        12.2MB

        MD5

        5be6a65f186cf219fa25bdd261616300

        SHA1

        b5d5ae2477653abd03b56d1c536c9a2a5c5f7487

        SHA256

        274e91a91a7a520f76c8e854dc42f96484af2d69277312d861071bde5a91991c

        SHA512

        69634d85f66127999ea4914a93b3b7c90bc8c8fab1b458cfa6f21ab0216d1dacc50976354f7f010bb31c5873cc2d2c30b4a715397fb0e9e01a5233c2521e7716

      • \Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe

        Filesize

        15.9MB

        MD5

        910de25bd63b5da521fc0b598920c4ec

        SHA1

        94a15930aaf99f12b349be80924857673cdc8566

        SHA256

        8caef5000b57bca014ef33e962df4fca21aead0664892724674619ef732440ad

        SHA512

        6ff910bb4912fea1fa8fd91e47ae6348c8bf2eff4f2f5f9ef646a775ca1ecfef02c23f81baf6fe2d0b0bdda7617d91df52e75dc6063e86ea0444b0538cbd4e6c

      • \Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe

        Filesize

        1.8MB

        MD5

        eb5e581f993996c4169aae61cefe6e92

        SHA1

        7eac57bb36f4d5b1303b9e598d3dc56ed2569599

        SHA256

        6b8ad6bbc64d92bc4c96bd5e54b6af1d5d43f3a2073091a3d7b0979be49d2697

        SHA512

        bc923ce89227013dcac9695b32128c2b2507bfb2281b9eb091d82bc94d714ff8ba4a379bb72e9f8e2674bd27702762e969870831f5a5ed84c9bdf7c237fe6eca

      • \Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe

        Filesize

        15.9MB

        MD5

        edeef697cbf212b5ecfcd9c1d9a8803d

        SHA1

        e90585899ae4b4385a6d0bf43c516c122e7883e2

        SHA256

        ac9bcc7813c0063bdcd36d8e4e79a59b22f6e95c2d74c65a4249c7d5319ae3f6

        SHA512

        1aaa8fc2f9fafecbe88abf07fbc97dc03a7c68cc1d870513e921bf3caeaa97128583293bf5078a69aecbb93bf1e531605b36bd756984db8d703784627d1877d1

      • \Program Files\Cheat Engine 7.5\lua53-64.dll

        Filesize

        528KB

        MD5

        b7c9f1e7e640f1a034be84af86970d45

        SHA1

        f795dc3d781b9578a96c92658b9f95806fc9bdde

        SHA256

        6d0a06b90213f082cb98950890518c0f08b9fc16dbfab34d400267cb6cdadeff

        SHA512

        da63992b68f1112c0d6b33e6004f38e85b3c3e251e0d5457cd63804a49c5aa05aa23249e0614dacad4fec28ca6efdb5ddee06da5bfbfa07e21942976201079f3

      • \Program Files\Cheat Engine 7.5\tcc64-32.dll

        Filesize

        128KB

        MD5

        1fee48eb0c73c855ec4dae0039c19ea5

        SHA1

        287e5435ae8d03cc6a61b4486bfbb136b9174cb0

        SHA256

        daa673c9bdd71dcb2d2a7e350c19c3e826d8c8b2164834a44fc3adaff355887c

        SHA512

        d46069751e9e2352d4bd2c3b0ab33fcbb62bc1077ad52261df264ac8695a67c9ac3a22af706dfbab216661227a8b467c37b377eaf1b0a04c5ac2a1b93eccd618

      • \Program Files\Cheat Engine 7.5\tcc64-64.dll

        Filesize

        444KB

        MD5

        e8dfc0d2d41483c7725e4ebb7e32d324

        SHA1

        b2890c91efba390b68e481cd2ee311136b740ede

        SHA256

        1172f2d7b1fb34408c8ffc248e3e719922843ea07bd5b409be3405d1c300b3f7

        SHA512

        539a1bd18d4753d69756b9b7e6603dd6e7a3f354ca002dece206f7e2f1e2792704f3d80f38b37c0c41f16a1fd9de32cc4dd5873959d762c5aa13388715ee7803

      • \Program Files\Cheat Engine 7.5\windowsrepair.exe

        Filesize

        262KB

        MD5

        9a4d1b5154194ea0c42efebeb73f318f

        SHA1

        220f8af8b91d3c7b64140cbb5d9337d7ed277edb

        SHA256

        2f3214f799b0f0a2f3955dbdc64c7e7c0e216f1a09d2c1ad5d0a99921782e363

        SHA512

        6eef3254fc24079751fc8c38dda9a8e44840e5a4df1ff5adf076e4be87127075a7fea59ba7ef9b901aaf10eb64f881fc8fb306c2625140169665dd3991e5c25b

      • \Users\Admin\AppData\Local\Temp\is-PADV7.tmp\CheatEngine75.tmp

        Filesize

        2.9MB

        MD5

        d9bfd411b133d66741d4bb40609b6ed0

        SHA1

        c5b89ffeabf964658efa335826735f48148561e3

        SHA256

        13ba38cabdcaa761b7449d86443d3cd60f755a00c4cd13d945c88b6c2914100c

        SHA512

        3f4bf6c41585a95c206d8318f5014a9335e1f8fffb021399c303586c787d1c08439578eebc10b6014a8c186cb7fee89594a04a19a3ca650f164012b8928a779e

      • \Users\Admin\AppData\Local\Temp\is-SSH7T.tmp\CheatEngine75.exe

        Filesize

        11.2MB

        MD5

        f6ec01bdd4c38a48d3151df644cc3aa5

        SHA1

        bc487d4c2a1142fa19f599e26ab336fbe1d044f3

        SHA256

        9d7cd6228fea3ee40b4369f268322141ef29682383f401826cfcc6669375d43a

        SHA512

        384edcc7c246e83bd9d3ade17522dfdcef44a7bcfb262e91183af2571af22b766a88da542729c2e45d3b2970066644a61e156844e63e6353fa41136cf2f40b5b

      • \Users\Admin\AppData\Local\Temp\is-SSH7T.tmp\zbShieldUtils.dll

        Filesize

        2.0MB

        MD5

        b83f5833e96c2eb13f14dcca805d51a1

        SHA1

        9976b0a6ef3dabeab064b188d77d870dcdaf086d

        SHA256

        00e667b838a4125c8cf847936168bb77bb54580bc05669330cb32c0377c4a401

        SHA512

        8641b351e28b3c61ed6762adbca165f4a5f2ee26a023fd74dd2102a6258c0f22e91b78f4a3e9fba6094b68096001de21f10d6495f497580847103c428d30f7bb

      • \Users\Admin\AppData\Local\Temp\is-UO7P4.tmp\_isetup\_setup64.tmp

        Filesize

        6KB

        MD5

        e4211d6d009757c078a9fac7ff4f03d4

        SHA1

        019cd56ba687d39d12d4b13991c9a42ea6ba03da

        SHA256

        388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

        SHA512

        17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

      • memory/1236-832-0x0000000000400000-0x000000000071B000-memory.dmp

        Filesize

        3.1MB

      • memory/1236-776-0x0000000000400000-0x000000000071B000-memory.dmp

        Filesize

        3.1MB

      • memory/1236-167-0x0000000000240000-0x0000000000241000-memory.dmp

        Filesize

        4KB

      • memory/1560-775-0x0000000000400000-0x00000000004D8000-memory.dmp

        Filesize

        864KB

      • memory/1560-161-0x0000000000400000-0x00000000004D8000-memory.dmp

        Filesize

        864KB

      • memory/1560-157-0x0000000000400000-0x00000000004D8000-memory.dmp

        Filesize

        864KB

      • memory/1560-833-0x0000000000400000-0x00000000004D8000-memory.dmp

        Filesize

        864KB

      • memory/2192-144-0x0000000003530000-0x0000000003670000-memory.dmp

        Filesize

        1.2MB

      • memory/2192-159-0x0000000000400000-0x00000000006EE000-memory.dmp

        Filesize

        2.9MB

      • memory/2192-12-0x0000000000240000-0x0000000000241000-memory.dmp

        Filesize

        4KB

      • memory/2192-143-0x0000000000400000-0x00000000006EE000-memory.dmp

        Filesize

        2.9MB

      • memory/2192-837-0x0000000003530000-0x0000000003670000-memory.dmp

        Filesize

        1.2MB

      • memory/2192-839-0x0000000000400000-0x00000000006EE000-memory.dmp

        Filesize

        2.9MB

      • memory/2192-9-0x0000000000400000-0x00000000006EE000-memory.dmp

        Filesize

        2.9MB

      • memory/2192-149-0x0000000003530000-0x0000000003670000-memory.dmp

        Filesize

        1.2MB

      • memory/2192-777-0x0000000003530000-0x0000000003670000-memory.dmp

        Filesize

        1.2MB

      • memory/2192-148-0x0000000003530000-0x0000000003670000-memory.dmp

        Filesize

        1.2MB

      • memory/2192-862-0x0000000000400000-0x00000000006EE000-memory.dmp

        Filesize

        2.9MB

      • memory/2192-7-0x0000000000240000-0x0000000000241000-memory.dmp

        Filesize

        4KB

      • memory/2192-855-0x0000000000400000-0x00000000006EE000-memory.dmp

        Filesize

        2.9MB

      • memory/2192-141-0x0000000003530000-0x0000000003670000-memory.dmp

        Filesize

        1.2MB

      • memory/2500-0-0x0000000000400000-0x00000000004CC000-memory.dmp

        Filesize

        816KB

      • memory/2500-8-0x0000000000400000-0x00000000004CC000-memory.dmp

        Filesize

        816KB

      • memory/2500-869-0x0000000000400000-0x00000000004CC000-memory.dmp

        Filesize

        816KB