hxxps://cheatengine[.]org

Analysis

max time kernel
696s
max time network
697s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cheatengine.org

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
170	3312	msedge.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 10 IoCs

pid	Process
4800	CheatEngine75.exe
2852	CheatEngine75.tmp
5140	CheatEngine76.exe
2816	CheatEngine76.tmp
1560	_setup64.tmp
3456	Kernelmoduleunloader.exe
4876	windowsrepair.exe
5620	Cheat Engine.exe
4436	cheatengine-x86_64-SSE4-AVX2.exe
5336	Tutorial-x86_64.exe

Loads dropped DLL 4 IoCs

pid	Process
2852	CheatEngine75.tmp
4436	cheatengine-x86_64-SSE4-AVX2.exe
4436	cheatengine-x86_64-SSE4-AVX2.exe
4436	cheatengine-x86_64-SSE4-AVX2.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2052	icacls.exe
1456	icacls.exe

Checks for any installed AV software in registry 1 TTPs 6 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	CheatEngine75.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\SOFTWARE\AVAST Software\Avast	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	CheatEngine75.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\SOFTWARE\AVG\AV\Dir	CheatEngine75.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\KERNELBASE.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\dwmapi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wintypes.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\combase.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\win32u.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\uxtheme.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\advapi32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ole32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\shell32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\winmm.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\psapi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\GDI32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\imm32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\SHLWAPI.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\user32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\shcore.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\dxcore.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\sechost.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	cheatengine-x86_64-SSE4-AVX2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Cheat Engine\plugins\example-c\is-P867O.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\plugins\c# template\CEPluginLibrary\bin\Release\is-NLQ6V.tmp	CheatEngine76.tmp
File opened for modification	C:\Program Files\Cheat Engine\tableobfuscator\encoder.dll	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\is-F66FH.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\is-J3O71.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\is-JV562.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\java\is-VR12B.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\is-G9BRR.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\images\is-F0B4C.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\forms\is-BLO6K.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\is-P4BC6.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\is-FS16P.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-VVKK5.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-U2O58.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\plugins\is-D0IMH.tmp	CheatEngine76.tmp
File opened for modification	C:\Program Files\Cheat Engine\autorun\dlls\MonoDataCollector32.dll	CheatEngine76.tmp
File opened for modification	C:\Program Files\Cheat Engine\ced3d10hook.dll	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\is-7E142.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\win64\is-9AIS0.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\is-B7ALS.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\is-UQTCQ.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\is-TAL5K.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-K4UGC.tmp	CheatEngine76.tmp
File opened for modification	C:\Program Files\Cheat Engine\DotNetDataCollector32.exe	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\is-8BN08.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\is-023CM.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\ceshare\forms\is-G9M07.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\plugins\is-G96CA.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\plugins\example-c\is-6LQ5U.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\plugins\example-c\is-OH1B8.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\plugins\c# template\CEPluginLibrary\SDK\is-L1IPK.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\sys\is-118K8.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\ceshare\is-5M4SN.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\is-2MBSL.tmp	CheatEngine76.tmp
File opened for modification	C:\Program Files\Cheat Engine\allochook-x86_64.dll	CheatEngine76.tmp
File opened for modification	C:\Program Files\Cheat Engine\autorun\dlls\MonoDataCollector64.dll	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\is-LAJSC.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\is-RAIQK.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\is-RD4N5.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\is-MSRJL.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\sys\is-714ES.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\tableobfuscator\is-32KI3.tmp	CheatEngine76.tmp
File opened for modification	C:\Program Files\Cheat Engine\luaclient-x86_64.dll	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\is-OPNU5.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\is-90KLK.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\sys\is-7FF47.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\is-0KN9D.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\is-90LNC.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\zip\is-FQ8DI.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-PNN2F.tmp	CheatEngine76.tmp
File opened for modification	C:\Program Files\Cheat Engine\tcc32-arm64-linux.dll	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\is-A34FS.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\is-8M0VQ.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\is-7MNPR.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\include\winapi\is-RKMFM.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\is-TDEL3.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\ceshare\forms\is-5OGVF.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\is-BUN7G.tmp	CheatEngine76.tmp
File opened for modification	C:\Program Files\Cheat Engine\libmikmod32.dll	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\win64\is-NBEG4.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\is-74HQP.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\tableobfuscator\is-DCMVU.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-H3TE8.tmp	CheatEngine76.tmp
File created	C:\Program Files\Cheat Engine\autorun\dlls\src\Mono\MonoDataCollector\is-JIH23.tmp	CheatEngine76.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-shared-components\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\wallet-webui-708.de49febeeb0e9c77883f.chunk.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_78591954\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-hub\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\wallet\wallet-checkout\merchant-site-info.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-tokenized-card\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\runtime.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_339605661\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\wallet\wallet-pre-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_733393546\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-notification-shared\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_719655586\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-mobile-hub\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\wallet\wallet-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_517108434\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-ec\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-hub\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-notification\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-ec\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-notification-shared\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-ec\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-mobile-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\bnpl\bnpl.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-notification\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\Notification\notification.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_305233851\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_78591954\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-mobile-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-notification-shared\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-tokenized-card\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_838928678\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-hub\ja\strings.json	msedge.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
992	sc.exe
2156	sc.exe
6004	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CheatEngine75.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheatEngine75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheatEngine76.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheatEngine76.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kernelmoduleunloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat Engine.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CheatEngine75.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	CheatEngine75.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876260776519081"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\.CT	CheatEngine76.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\CheatEngine\DefaultIcon	CheatEngine76.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine	CheatEngine76.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\shell\open\command\ = "\"C:\\Program Files\\Cheat Engine\\Cheat Engine.exe\" \"%1\""	CheatEngine76.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\CheatEngine\shell\open\command	CheatEngine76.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{9F25A1F2-773D-41B3-A9F4-DE4AA694F1B6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.CT\ = "CheatEngine"	CheatEngine76.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\CheatEngine	CheatEngine76.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\DefaultIcon\ = "C:\\Program Files\\Cheat Engine\\Cheat Engine.exe,0"	CheatEngine76.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\ = "Cheat Engine"	CheatEngine76.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\shell	CheatEngine76.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\shell\open	CheatEngine76.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\shell\open\command	CheatEngine76.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\.CETRAINER	CheatEngine76.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.CETRAINER\ = "CheatEngine"	CheatEngine76.tmp

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CheatEngine75.exe:Zone.Identifier	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2852	CheatEngine75.tmp
2816	CheatEngine76.tmp
2816	CheatEngine76.tmp
3604	msedge.exe
3604	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4436	cheatengine-x86_64-SSE4-AVX2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeTcbPrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeTcbPrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeLoadDriverPrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeCreateGlobalPrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeLockMemoryPrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: 33	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeSecurityPrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeTakeOwnershipPrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeManageVolumePrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeBackupPrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeCreatePagefilePrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeShutdownPrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeRestorePrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: 33	4436	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeIncBasePriorityPrivilege	4436	cheatengine-x86_64-SSE4-AVX2.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2852	CheatEngine75.tmp
2816	CheatEngine76.tmp
4436	cheatengine-x86_64-SSE4-AVX2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 5836	2040	msedge.exe	78
PID 2040 wrote to memory of 5836	2040	msedge.exe	78
PID 2040 wrote to memory of 3312	2040	msedge.exe	79
PID 2040 wrote to memory of 3312	2040	msedge.exe	79
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 3868	2040	msedge.exe	80
PID 2040 wrote to memory of 6024	2040	msedge.exe	81
PID 2040 wrote to memory of 6024	2040	msedge.exe	81
PID 2040 wrote to memory of 6024	2040	msedge.exe	81
PID 2040 wrote to memory of 6024	2040	msedge.exe	81
PID 2040 wrote to memory of 6024	2040	msedge.exe	81
PID 2040 wrote to memory of 6024	2040	msedge.exe	81
PID 2040 wrote to memory of 6024	2040	msedge.exe	81
PID 2040 wrote to memory of 6024	2040	msedge.exe	81
PID 2040 wrote to memory of 6024	2040	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheatengine.org
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x300,0x7ffa1891f208,0x7ffa1891f214,0x7ffa1891f220
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1696,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2100,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2412,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3440,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4928,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4932,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4136,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5524,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5968,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5992,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5992,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6256,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6392,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4216,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4224,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6492,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6748,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=3520,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6084,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7132,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=7140,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7356,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7640,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:14
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4892,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:14
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7652,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6688,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6744,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4528,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5264,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7124,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5580,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7216,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7560,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:14
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=2452,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=7152,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=3320,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7856,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7100,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:14
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7936,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=8012 /prefetch:14
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7208,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4888,i,16184058947344117620,11098828259131474553,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:2808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3336

C:\Users\Admin\Downloads\CheatEngine75.exe
"C:\Users\Admin\Downloads\CheatEngine75.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4800
- C:\Users\Admin\AppData\Local\Temp\is-TK5VU.tmp\CheatEngine75.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TK5VU.tmp\CheatEngine75.tmp" /SL5="$F02BE,2341115,845824,C:\Users\Admin\Downloads\CheatEngine75.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\is-GRCE8.tmp\CheatEngine76.exe
    "C:\Users\Admin\AppData\Local\Temp\is-GRCE8.tmp\CheatEngine76.exe" /VERYSILENT /ZBDIST
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\is-451AU.tmp\CheatEngine76.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-451AU.tmp\CheatEngine76.tmp" /SL5="$10326,28695682,869888,C:\Users\Admin\AppData\Local\Temp\is-GRCE8.tmp\CheatEngine76.exe" /VERYSILENT /ZBDIST
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:2816
    - - C:\Windows\SYSTEM32\net.exe
        
        "net" stop BadlionAntic
        5⤵
        
        PID:464
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop BadlionAntic
        6⤵
        
        PID:4092
    - - C:\Windows\SYSTEM32\net.exe
        
        "net" stop BadlionAnticheat
        5⤵
        
        PID:3604
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop BadlionAnticheat
        6⤵
        
        PID:896
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" delete BadlionAntic
        5⤵
        Launches sc.exe
        
        PID:992
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" delete BadlionAnticheat
        5⤵
        Launches sc.exe
        
        PID:2156
    - - C:\Windows\SYSTEM32\net.exe
        
        "net" stop vgk
        5⤵
        
        PID:3740
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop vgk
        6⤵
        
        PID:352
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" delete vgk
        5⤵
        Launches sc.exe
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\is-I30VP.tmp\_isetup\_setup64.tmp
        
        helper 105 0x3A0
        5⤵
        Executes dropped EXE
        
        PID:1560
    - - C:\Windows\system32\icacls.exe
        
        "icacls" "C:\Program Files\Cheat Engine" /grant *S-1-15-2-1:(OI)(CI)(RX)
        5⤵
        Modifies file permissions
        
        PID:2052
    - - C:\Program Files\Cheat Engine\Kernelmoduleunloader.exe
        
        "C:\Program Files\Cheat Engine\Kernelmoduleunloader.exe" /SETUP
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3456
    - - C:\Program Files\Cheat Engine\windowsrepair.exe
        
        "C:\Program Files\Cheat Engine\windowsrepair.exe" /s
        5⤵
        Executes dropped EXE
        
        PID:4876
    - - C:\Windows\system32\icacls.exe
        
        "icacls" "C:\Program Files\Cheat Engine" /grant *S-1-15-2-1:(OI)(CI)(RX)
        5⤵
        Modifies file permissions
        
        PID:1456
- - C:\Program Files\Cheat Engine\Cheat Engine.exe
    "C:\Program Files\Cheat Engine\Cheat Engine.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5620
  - - C:\Program Files\Cheat Engine\cheatengine-x86_64-SSE4-AVX2.exe
      "C:\Program Files\Cheat Engine\cheatengine-x86_64-SSE4-AVX2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:4436
    - - C:\Program Files\Cheat Engine\Tutorial-x86_64.exe
        
        "C:\Program Files\Cheat Engine\Tutorial-x86_64.exe"
        5⤵
        Executes dropped EXE
        
        PID:5336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Cheat Engine\Cheat Engine.exe

Filesize
397KB

MD5
0c84c800533ae5dee5923d5351da9923

SHA1
b454dec7e2091712fa9ca8909dbc176d1f104c17

SHA256
5313618d93640bb29b66baadf2339de85e593a51715290dadece6d58e039a75e

SHA512
93974a559392c1ac37095d0b60239e16c2caefeb893c10ee726060a8f6a42c41fb7b72ee032e01c0d47ab350072e80d4bd1f9c892112418e2992f32154a6c4d9

Download Submit
C:\Program Files\Cheat Engine\Kernelmoduleunloader.exe

Filesize
236KB

MD5
9af96706762298cf72df2a74213494c9

SHA1
4b5fd2f168380919524ecce77aa1be330fdef57a

SHA256
65fa2ccb3ac5400dd92dda5f640445a6e195da7c827107260f67624d3eb95e7d

SHA512
29a0619093c4c0ecf602c861ec819ef16550c0607df93067eaef4259a84fd7d40eb88cd5548c0b3b265f3ce5237b585f508fdd543fa281737be17c0551163bd4

Download Submit
C:\Program Files\Cheat Engine\allochook-i386.dll

Filesize
328KB

MD5
19d52868c3e0b609dbeb68ef81f381a9

SHA1
ce365bd4cf627a3849d7277bafbf2f5f56f496dc

SHA256
b96469b310ba59d1db320a337b3a8104db232a4344a47a8e5ae72f16cc7b1ff4

SHA512
5fbd53d761695de1dd6f0afd0964b33863764c89692345cab013c0b1b6332c24dcf766028f305cc87d864d17229d7a52bf19a299ca136a799053c368f21c8926

Download Submit
C:\Program Files\Cheat Engine\allochook-x86_64.dll

Filesize
468KB

MD5
daa81711ad1f1b1f8d96dc926d502484

SHA1
7130b241e23bede2b1f812d95fdb4ed5eecadbfd

SHA256
8422be70e0ec59c962b35acf8ad80671bcc8330c9256e6e1ec5c07691388cd66

SHA512
9eaa8e04ad7359a30d5e2f9256f94c1643d4c3f3c0dff24d6cd9e31a6f88cb3b470dd98f01f8b0f57bb947adc3d45c35749ed4877c7cbbbcc181145f0c361065

Download Submit
C:\Program Files\Cheat Engine\autorun\addtonewgroup.lua

Filesize
1KB

MD5
3e20f1013fb48a67fe59bede7b8e341b

SHA1
8c8a4cb49c3b29db2c47f84aafd0416101722bfe

SHA256
96e4429192f9ab26f8bf9f9429f36b388aa69c3624781c61ea6df7e1bca9b49b

SHA512
99cf3f88c8b06da0dbe8085dee796bec7a9533990a55fbce7524a4f941b5ecf0e8ec975a4b032eb2aaabd116c0804995a75036c98a5e4058f25d78d08a11f3f2

Download Submit
C:\Program Files\Cheat Engine\autorun\android.lua

Filesize
2KB

MD5
39035e57c4e96189929a7a8d00b047a4

SHA1
f0510d6d42506bc3775e9e94661aa8828b4a9b8b

SHA256
2a03bea4f0d207b8707f950ebe1b1cd48a0e85db7a8e7df64e66c1b1bff47776

SHA512
7352b129e6dc97074731e9a6e60e72f1d08a7c074ffa980c71fd779667b9a88b8a659ee5793cc112d578161eb1fb8dacbdb5a61f6e4537f46ea7becef71d5bb4

Download Submit
C:\Program Files\Cheat Engine\autorun\autosave.lua

Filesize
9KB

MD5
40d6bfe593194cf938e19622a3c13a5e

SHA1
761257e8ef492431cf0e04dbca396fabb25fe1ae

SHA256
c4cef60489b067c8e7abcdd5594643a27d0720b21523753dd462d53024287116

SHA512
1d1aaa9de74b0bb08cc4ceced5dbfa4c589347eac098d7ae013d5a1beaae0eeaca4d314e2591560c6df14a93dd4e9316ca317d21efadcca57d11eee72f4c6e16

Download Submit
C:\Program Files\Cheat Engine\autorun\bigendian.lua

Filesize
7KB

MD5
c1aab0e1f8d290a14d3268c72679537f

SHA1
e4ed2e6bccb8ee293422919a935dc8c9d5032279

SHA256
4541b3e07a2d5e275a8ad09ee152fee2adc2ff870ab9bcc27aa10704cff1115d

SHA512
bbfb4f17f16201bf1d3f9421df17c20bbea31aec78ccd16fd60d0f6d70fc9e56d4d0811d8a713aa44499e7c501f43719922c57c53536f044fb9a8462f60e9719

Download Submit
C:\Program Files\Cheat Engine\badassets\scoreboard.png

Filesize
5KB

MD5
5cff22e5655d267b559261c37a423871

SHA1
b60ae22dfd7843dd1522663a3f46b3e505744b0f

SHA256
a8d8227b8e97a713e0f1f5db5286b3db786b7148c1c8eb3d4bbfe683dc940db9

SHA512
e00f5b4a7fa1989382df800d168871530917fcd99efcfe4418ef1b7e8473caea015f0b252cac6a982be93b5d873f4e9acdb460c8e03ae1c6eea9c37f84105e50

Download Submit
C:\Program Files\Cheat Engine\ced3d10hook.dll

Filesize
128KB

MD5
43dac1f3ca6b48263029b348111e3255

SHA1
9e399fddc2a256292a07b5c3a16b1c8bdd8da5c1

SHA256
148f12445f11a50efbd23509139bf06a47d453e8514733b5a15868d10cc6e066

SHA512
6e77a429923b503fc08895995eb8817e36145169c2937dacc2da92b846f45101846e98191aeb4f0f2f13fff05d0836aa658f505a04208188278718166c5e3032

Download Submit
C:\Program Files\Cheat Engine\ced3d10hook64.dll

Filesize
140KB

MD5
0daf9f07847cceb0f0760bf5d770b8c1

SHA1
992cc461f67acea58a866a78b6eefb0cbcc3aaa1

SHA256
a2ac2ba27b0ed9acc3f0ea1bef9909a59169bc2eb16c979ef8e736a784bf2fa4

SHA512
b4dda28721de88a372af39d4dfba6e612ce06cc443d6a6d636334865a9f8ca555591fb36d9829b54bc0fb27f486d4f216d50f68e1c2df067439fe8ebbf203b6a

Download Submit
C:\Program Files\Cheat Engine\ced3d11hook.dll

Filesize
137KB

MD5
42e2bf4210f8126e3d655218bd2af2e4

SHA1
78efcb9138eb0c800451cf2bcc10e92a3adf5b72

SHA256
1e30126badfffb231a605c6764dd98895208779ef440ea20015ab560263dd288

SHA512
c985988d0832ce26337f774b160ac369f2957c306a1d82fbbffe87d9062ae5f3af3c1209768cd574182669cd4495dba26b6f1388814c0724a7812218b0b8dc74

Download Submit
C:\Program Files\Cheat Engine\ced3d11hook64.dll

Filesize
146KB

MD5
0eaac872aadc457c87ee995bbf45a9c1

SHA1
5e9e9b98f40424ad5397fc73c13b882d75499d27

SHA256
6f505cc5973687bbda1c2d9ac8a635d333f57c12067c54da7453d9448ab40b8f

SHA512
164d1e6ef537d44ac4c0fd90d3c708843a74ac2e08fa2b3f0fdd4a180401210847e0f7bb8ec3056f5dc1d5a54d3239c59fb37914ce7742a4c0eb81578657d24b

Download Submit
C:\Program Files\Cheat Engine\ced3d9hook.dll

Filesize
124KB

MD5
5f1a333671bf167730ed5f70c2c18008

SHA1
c8233bbc6178ba646252c6566789b82a3296cab5

SHA256
fd2a2b4fe4504c56347c35f24d566cc0510e81706175395d0a2ba26a013c4daf

SHA512
6986d93e680b3776eb5700143fc35d60ca9dbbdf83498f8731c673f9fd77c8699a24a4849db2a273aa991b8289e4d6c3142bbde77e11f2faf603df43e8fea105

Download Submit
C:\Program Files\Cheat Engine\ced3d9hook64.dll

Filesize
136KB

MD5
61ba5199c4e601fa6340e46bef0dff2d

SHA1
7c1a51d6d75b001ba1acde2acb0919b939b392c3

SHA256
8783f06f7b123e16042bb0af91ff196b698d3cd2aa930e3ea97cfc553d9fc0f4

SHA512
8ce180a622a5788bb66c5f3a4abfde62c858e86962f29091e9c157753088ddc826c67c51ff26567bfe2b75737897f14e6bb17ec89f52b525f6577097f1647d31

Download Submit
C:\Program Files\Cheat Engine\d3dhook.dll

Filesize
119KB

MD5
2a2ebe526ace7eea5d58e416783d9087

SHA1
5dabe0f7586f351addc8afc5585ee9f70c99e6c4

SHA256
e2a7df4c380667431f4443d5e5fc43964b76c8fcb9cf4c7db921c4140b225b42

SHA512
94ed0038068abddd108f880df23422e21f9808ce04a0d14299aacc5d573521f52626c0c2752b314cda976f64de52c4d5bcac0158b37d43afb9bc345f31fdbbc0

Download Submit
C:\Program Files\Cheat Engine\d3dhook64.dll

Filesize
131KB

MD5
2af7afe35ab4825e58f43434f5ae9a0f

SHA1
b67c51cad09b236ae859a77d0807669283d6342f

SHA256
7d82694094c1bbc586e554fa87a4b1ed6ebc9eb14902fd429824dcd501339722

SHA512
23b7c6db0cb9c918ad9f28fa0e4e683c7e2495e89a136b75b7e1be6380591da61b6fb4f7248191f28fd3d80c4a391744a96434b4ab96b9531b5ebb0ec970b9d0

Download Submit
C:\Program Files\Cheat Engine\is-M1DDG.tmp

Filesize
12.5MB

MD5
e2fcceca918b749cccf97152ede47fd8

SHA1
437c1720a16cc614b0e4ca7e6ac1aafa2e114a7b

SHA256
3c2f1aa8574580902255072a8d3302468cc18f4e1e46c630fb3de517f0ac8f32

SHA512
e7eeeec837dc8c3d21d60a5176310cabce2a6507a72903a426f93fc2f25f7e46cea70cd43882cff563f37db3065488d4ec2ef2f110073a24ae23c4ea1663b746

Download Submit
C:\Program Files\Cheat Engine\languages\language.ini

Filesize
283B

MD5
af5ed8f4fe5370516403ae39200f5a4f

SHA1
9299e9998a0605182683a58a5a6ab01a9b9bc037

SHA256
4aa4f0b75548d45c81d8e876e2db1c74bddfd64091f102706d729b50a7af53a5

SHA512
f070049a2fae3223861424e7fe79cbae6601c9bee6a56fadde4485ad3c597dc1f3687e720177ab28564a1faab52b6679e9315f74327d02aa1fb31e7b8233a80f

Download Submit
C:\Program Files\Cheat Engine\libipt-32.dll

Filesize
157KB

MD5
df443813546abcef7f33dd9fc0c6070a

SHA1
635d2d453d48382824e44dd1e59d5c54d735ee2c

SHA256
d14911c838620251f7f64c190b04bb8f4e762318cc763d993c9179376228d8ca

SHA512
9f9bea9112d9db9bcecfc8e4800b7e8032efb240cbbddaf26c133b4ce12d27b47dc4e90bc339c561714bc972f6e809b2ec9c9e1facc6c223fbac66b089a14c25

Download Submit
C:\Program Files\Cheat Engine\libipt-64.dll

Filesize
182KB

MD5
4a3b7c52ef32d936e3167efc1e920ae6

SHA1
d5d8daa7a272547419132ddb6e666f7559dbac04

SHA256
26ede848dba071eb76c0c0ef8e9d8ad1c53dfab47ca9137abc9d683032f06ebb

SHA512
36d7f8a0a749de049a830cc8c8f0d3962d8dce57b445f5f3c771a86dd11aaa10da5f36f95e55d3dc90900e4dbddd0dcc21052c53aa11f939db691362c42e5312

Download Submit
C:\Program Files\Cheat Engine\luaclient-i386.dll

Filesize
197KB

MD5
9f50134c8be9af59f371f607a6daa0b6

SHA1
6584b98172cbc4916a7e5ca8d5788493f85f24a7

SHA256
dd07117ed80546f23d37f8023e992de560a1f55a76d1eb6dfd9d55baa5e3dad6

SHA512
5ccafa2b0e2d20034168ee9a79e8efff64f12f5247f6772815ef4cb9ee56f245a06b088247222c5a3789ae2dcefadbc2c15df4ff5196028857f92b9992b094e0

Download Submit
C:\Program Files\Cheat Engine\luaclient-x86_64.dll

Filesize
260KB

MD5
dd71848b5bbd150e22e84238cf985af0

SHA1
35c7aa128d47710cfdb15bb6809a20dbd0f916d8

SHA256
253d18d0d835f482e6abbaf716855580eb8fe789292c937301e4d60ead29531d

SHA512
0cbf35c9d7b09fb57d8a9079eab726a3891393f12aee8b43e01d1d979509e755b74c0fb677f8f2dfab6b2e34a141f65d0cfbfe57bda0bf7482841ad31ace7790

Download Submit
C:\Program Files\Cheat Engine\overlay.fx

Filesize
2KB

MD5
650c02fc9f949d14d62e32dd7a894f5e

SHA1
fa5399b01aadd9f1a4a5632f8632711c186ec0de

SHA256
c4d23db8effb359b4aa4d1e1e480486fe3a4586ce8243397a94250627ba4f8cc

SHA512
f2caaf604c271283fc7af3aa9674b9d647c4ac53dffca031dbf1220d3ed2e867943f5409a95f41c61d716879bed7c888735f43a068f1cc1452b4196d611cb76d

Download Submit
C:\Program Files\Cheat Engine\vehdebug-i386.dll

Filesize
324KB

MD5
e9b5905d495a88adbc12c811785e72ec

SHA1
ca0546646986aab770c7cf2e723c736777802880

SHA256
3eb9cd27035d4193e32e271778643f3acb2ba73341d87fd8bb18d99af3dffdea

SHA512
4124180b118149c25f8ea8dbbb2912b4bd56b43f695bf0ff9c6ccc95ade388f1be7d440a791d49e4d5c9c350ea113cf65f839a3c47d705533716acc53dd038f8

Download Submit
C:\Program Files\Cheat Engine\vehdebug-x86_64.dll

Filesize
413KB

MD5
8d487547f1664995e8c47ec2ca6d71fe

SHA1
d29255653ae831f298a54c6fa142fb64e984e802

SHA256
f50baf9dc3cd6b925758077ec85708db2712999b9027cc632f57d1e6c588df21

SHA512
79c230cfe8907df9da92607a2c1ace0523a36c3a13296cb0265329208edc453e293d7fbedbd5410decf81d20a7fe361fdebddadbc1dc63c96130b0bedf5b1d8a

Download Submit
C:\Program Files\Cheat Engine\windowsrepair.exe

Filesize
262KB

MD5
9a4d1b5154194ea0c42efebeb73f318f

SHA1
220f8af8b91d3c7b64140cbb5d9337d7ed277edb

SHA256
2f3214f799b0f0a2f3955dbdc64c7e7c0e216f1a09d2c1ad5d0a99921782e363

SHA512
6eef3254fc24079751fc8c38dda9a8e44840e5a4df1ff5adf076e4be87127075a7fea59ba7ef9b901aaf10eb64f881fc8fb306c2625140169665dd3991e5c25b

Download Submit
C:\Program Files\Cheat Engine\winhook-i386.dll

Filesize
201KB

MD5
de625af5cf4822db08035cc897f0b9f2

SHA1
4440b060c1fa070eb5d61ea9aadda11e4120d325

SHA256
3cdb85ee83ef12802efdfc9314e863d4696be70530b31e7958c185fc4d6a9b38

SHA512
19b22f43441e8bc72507be850a8154321c20b7351669d15af726145c0d34805c7df58f9dc64a29272a4811268308e503e9840f06e51ccdcb33afd61258339099

Download Submit
C:\Program Files\Cheat Engine\winhook-x86_64.dll

Filesize
264KB

MD5
f9c562b838a3c0620fb6ee46b20b554c

SHA1
5095f54be57622730698b5c92c61b124dfb3b944

SHA256
e08b035d0a894d8bea64e67b1ed0bce27567d417eaaa133e8b231f8a939e581d

SHA512
a20bc9a442c698c264fef82aa743d9f3873227d7d55cb908e282fa1f5dcff6b40c5b9ca7802576ef2f5a753fd1c534e9be69464b29af8efec8b019814b875296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
509e630f2aea0919b6158790ecedff06

SHA1
ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

SHA256
067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

SHA512
1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000007.log

Filesize
21KB

MD5
82ba5339ce8a20c35cf48fe2b142f84b

SHA1
744768b70bf24064070263508974b78300bb2664

SHA256
59f4d3881515ab04b423cc70f35d65a2575862c8c39c88475a36a7337bc072f7

SHA512
46bdd37859f9a58427b57e4d85760f5c7e23dcc347c125c8afde096e6f69793632df45e7cc271eba29906a17ebb669587dccea74d152b645077f7d536785f73b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
334B

MD5
f12f0ab5f6859e2f9f4139ecef91c52c

SHA1
39c2785d6523c0388d0536257904c42a6cd3b806

SHA256
3a56a1ffe020a731da5e19840a190e7e622f2e379f1d3aebeec3f9cbb02d365e

SHA512
d652738974d250959192fa53bfc526cdc1f7bed8f58d99a484f8694d9f3db6bd9db4481cdb9a41577143257641449d8163ed78e8468d066f1bffd7be6b78c66b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
331B

MD5
af4c25a6f6a160f4069590db109a8510

SHA1
1ae200f48029985246166b0ee68f3852fd171ad6

SHA256
07137e515ac1e098b3ad5595b577c487bfc70379c27b103c3c5e1f5ce2396222

SHA512
08f3dbd086228637b5d49ce905a10884e0c2ff3264958b254fbf396c2f815528bba5452b5739678ce90ee3ef11687b0bea08eb881eda4e9b3b81f2c5bf94d1b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
15320b096412a7ba03f74b1689618ee8

SHA1
e89d6fe2c036fa22ff1e2993b5802227e7a9ea6b

SHA256
8f3cfa9b80b191f81d30a3be7653302bb9b2e14019ffde090719f2128d291319

SHA512
5353852e86f9ce12517ba52de1d7bca3743873d2e5b795f1b8510bd6d171237b272954c676b94d985df3369dfd7ac4df977bd3b2621b302cb9320073cd697144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
2d53f68c58d4dd3815e72e3084d965d6

SHA1
4c949e0834397000860f140946f1af6cd03e3636

SHA256
a338947953753ba9c1c9447e85b01a751119a0974a6ae0d34626ee511a6eee0f

SHA512
1de62181b38a63b01001ae2862148de6b5edd5ca0025d002104285981be5bb449e0a0f524816f5a98450812c8fa866c05138cd831255a8e335c6b9894f0f5a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57fdc9.TMP

Filesize
3KB

MD5
26a8e4a129e3185bed360adaa9e62525

SHA1
fe31599b3d3a22118b08afa7e46ac38bba70ecdf

SHA256
1c9a92c966b55e7b98f42a4519f81becceff5505f2877c09dfa57da504069fd6

SHA512
2aac285182842f9617f1428ef1dd7d1151f8f907606f8d16e9052ab696e8851500c45559126b013fc019563a11a9530b2626ef11feffaac40e0ff2bb4a59712d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
faf35396a62701093a906c33c69c20bb

SHA1
129b461658d56894d9cea21bda396367ffd6a9a2

SHA256
92a843e5fdba2cd5bf86bb77ce7c198c84a5413d5ce31c506c5d57aea6f392ed

SHA512
da1d5cf6ba99f43aa06c202c1ae6a62e3302d0c79b1b7c67bac6fa70feec62c57cdd16cc21130a9f036abe57d0893a56128cf77fb0a80fb80a56eeea573ce838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
cb72cba85c78d54ba64f231a78c63b29

SHA1
d875ac7917cb6dd619febbcaf3d301f3aaa3ce3a

SHA256
77e859422f4d3d96700195d5bf51da576cd5b927fd668bb9da28a0be146b1345

SHA512
2ad3d6cabb3182a1dc45ef5540b3d04d76fa85e3247b13ded5f7a177a44079d67aac2a6da69092152fa5d2a7cb2b8820da7d3547a2688f91d8f9088e37906687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
429d9fdceca1ef62fc56f8428407f10e

SHA1
6ea72c443a8e589e8cf6269cf80d9497b169a2b5

SHA256
5c75ce023014776434125e181d54ab81bb43e5c401b0e2bdd4d77d3a2dc5e7a9

SHA512
9ab091f3cef5adfac9f94b0bed79c7f43dacb27fbd233d4b749eb3298acb731f6a27cfece017440acfa3e9e70c37411c3985a51fe7a6ce8b251e3ca28b258901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
414KB

MD5
baff623be22b06a8e6185c20e3d8e235

SHA1
80d41bcd02b6773de36d746eb33d88e766387bda

SHA256
55e66a27c5395879650ba4cf9a71217d3b1b08a50c5bbce313dbafff02700074

SHA512
d18ade1eb010636d55982b61ad0d9e29b75fa395fd0948dd654008593b2256bee44ac506dc49f408accd998180bb1f20f9dec06b645e59c022d6884bb855688c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
412KB

MD5
b9106d9556853c5dc0faa1fde1fc80dd

SHA1
20e631d04a31aebe210ab869b1a13858f6cfe396

SHA256
0f7f2815d081787d1cbc07b45f6df44262b177a6a9789a7dff07477c5f4ceade

SHA512
0191dd2f3e8b353e34c20acef7507c9dffb351fa2d72ca8152fdbad81936f5b635a4aa2043c3f4481a57d1dc346c92b0618ab80658ff7f2d91f60156205af41c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
412KB

MD5
3c2e6796e08c3d857755c1ae9ea19611

SHA1
197125ec93a28d28f8140e28722debdca64669c7

SHA256
a40802ccbb068c0b72b27dbcd5b5fda3887ada8de786aae519975446478af1af

SHA512
b819c01da7ceaadc284bd22f9e22d3ce2d407f03b053b9ec6568158ba3cfe9af75b82dc40c6d0b4fc0c33d61507816a1dbed66b043c12956233e63025ebb2ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
413KB

MD5
f59783604aa33d0889c131056128b33b

SHA1
8315f541ed50bb4eb079aef8853d1393e6aebdfc

SHA256
87bb83c50531122604e3a764f8f434bcdc6b6d4430a7f013117c0fdd46ffe7b8

SHA512
629e09da59d12280294bf2eb1284fc5d4d128b3a58c750d35d97048ac831af858f330078fbb09eca3f787ac16cfc27793303659f43089ff14c52d5a11cb283d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
9da610fadc515e262dd530641555248a

SHA1
6ecf177f0bf4a91b5a94fca564e714b42e2e823d

SHA256
7fdb1118d29610d79d5b290d637d8bfad87ccf7103d6e1dbfb98d22db7b746f3

SHA512
6d246341afb79a64d745ff62b73d7d4140fedd9f83252fbc1ea9b125aadaf282385831af8b3c0e56c48ad385a39c5544ad99e1057c3c31dfdf6d7c2fd67a2d90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index

Filesize
2KB

MD5
967754bb9ceb15ff4b7bb917fad63c2f

SHA1
ff3553f46d3f7ebb088b8e593d954d92bda60d12

SHA256
76e9feaa2111ee562e2e6af9dd404452a9e9bfdb882c91b45909ec35efa469f4

SHA512
9d84cb79f1d76fcf39d3d3583d60523c4d8508b27e1bb84d6f9519bf8daba7de4882202cbc4dab39ff19d7e3449cf00f7ccd04e53026e1c0292e4ff9fbf7c211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index

Filesize
2KB

MD5
2d7db8dcbc2a022e3f14ba8ebf16968a

SHA1
27bb18e55fb0de4af9a7bfdf7da894fe8d37cf6a

SHA256
51563aa8e538a61475397f51ed4866c82ceb2dbf3cc813189420dd11b78b8d0b

SHA512
dee0449e3fe328e72afac8e0075fab4437f22563c3c48859fb7e9147b1d91c148d69c9a400a08416e6b063351502205de9e61770bce7dd859c29c3c58676c7a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index~RFe5b97c8.TMP

Filesize
2KB

MD5
49086cd7b2efd4ed2fda919d0ec27e3b

SHA1
f5ac25a7ab86841bea87ec11746ad83e2e244031

SHA256
243a6bd6f1550e9f438ba05aa708bb5b50a904e5e72dc2f5a0c12a7aeb75bb38

SHA512
5c7a82e1592333db83a1d462e466fa2e27d05642e81a70f64a42622685c5275581c5102f8a3bbad038fda297ccca09a7e51fada3af5031493756c7dea57d263d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
72a917a703d840e42fb39e169a2944c3

SHA1
bd3729dd7ec5b7e54f3049625069082eb1f55cc0

SHA256
7762c2c9e9ff615779d2cf2b54f4bc48aec6778c0831a7ae139b067068d88e1e

SHA512
5d73209b929299679dc80b965425addf57f4327afdef6ac99aa8147d79bf09bf1ad94aef7c9b2b62d8955c173e469583c6ece31f87ed9a3fc52a2240721def27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
587699d357ba319f606505e40a9ed527

SHA1
f7b785908c34a40034eb78084b522ba673dbf60e

SHA256
58dafa01f101f9fd848b28975ef23cc3bdcdb2c1f688f4f4ed034194721632af

SHA512
dcf78be6967a414da99e36849f8045773301f20aaa0191ab3b9a566efd390a39d44dfccff0918f1a447950d55df033a118e95f7a32fa0ef4681e8ee828c8cb01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5bf3a3.TMP

Filesize
48B

MD5
da36f821885ae7a6fd02d9a00c1e79f1

SHA1
84a365513c5abaf09ad14775504c1261046d33ee

SHA256
6a96c611cd47348f8d7d40c64ee771623c86554812b99ce13320f218452b757a

SHA512
07eeff6b5af1655883a50bde704b45b833b2beaec1a3f491360ee6a77eb12e92c2b856d705e4f9a6024690f01dedeb7889c18106d81d810166490e367604beba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
57b0694593c0308c3524a3343f5ad023

SHA1
9b0b0c22fb71feed81037d030eb2e303c81b4a36

SHA256
12a9a8440471b23960c0609893f79823318ff8ce0f70e6ca3cfb80b8ecb3ede4

SHA512
dae5e022b173f37ffa4229498015c4fb6f2ac5a68fd69acb822e8ecaa9fba2f583b9893c7ee7b0cc208060f6fc8d15b3819ee698bcac97577259a7727360c714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
2KB

MD5
222be3ce0f47c6a0e9742a924d6a3521

SHA1
e234bee807ea3884c45bb5e53680040e568a8f4b

SHA256
eb1aee6f9348fa0582678c5229993bfb4014ed4dea7bc9fdc2f7c91a4caa83a7

SHA512
b8ed84045cd55aecc84306d9ee0d0939b75e5e471ef5a476b65fe74fac9693a2ae7c2a3c358be35e1ecc859b2727e81fa5bead67adbadd3a6a3e1fe5e471039f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
ad34078214c5a979809b8797070d2366

SHA1
d63493de4ca55953377ba01792fe257083913d09

SHA256
c79a68ffdc2ba8f762199b5fd0761c7d8c59d50296fafa39d1a84d6584c1f84d

SHA512
1fbab80d777ed83c4252d281c692d7f647f53def5f62032f112ead3606499c080c2064a7758097639b16a9a24f88eb7148ca7d906ecd34715f8733bed7e5be33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
795e5a7e4a2a729251acec0198dc5956

SHA1
278348169b22c02165fb28a579872725d9018ffb

SHA256
386dd2a64d9ca0b743f4fbf2b672b042581bfaf19e58384de70e9949593473d5

SHA512
575fefe237daaa2b0b03108c0cf52b47a8246ef2818f1d9fe2e459fd9d411d45134db681c164dff4d673008541566472c8132fe765ea8d30874cf7560ba63760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
788f39ad03c2cea6ed41ebf88917085e

SHA1
c1bb5cbc0bff03dfe7248e0f6244518520324c55

SHA256
0b003033ee8a5ba5522af6b496907dcc0b87228cf102b4e7b27284ce54c82e2e

SHA512
1f34990c296af9f1ab859b8db83838a7122f7ffacf1c2b615501567b0dd6db789a7190e7e773e185159b7bf9d082b6b9e0b264eb5eb23e9bce54bd33de744db6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.31.0\edge_checkout_page_validator.js

Filesize
1.1MB

MD5
0e3ea2aa2bc4484c8aebb7e348d8e680

SHA1
55f802e1a00a6988236882ae02f455648ab54114

SHA256
25ffb085e470aa7214bf40777794de05bf2bb53254244a4c3a3025f40ce4cef7

SHA512
45b31d42be032766f5c275568723a170bb6bbf522f123a5fdc47e0c6f76933d2d3e14487668e772488847096c5e6a1f33920f1ee97bc586319a9005bacd65428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18346.18345.1\json\wallet\wallet-checkout-eligible-sites.json

Filesize
23KB

MD5
16d41ebc643fd34addf3704a3be1acdd

SHA1
b7fadc8afa56fbf4026b8c176112632c63be58a0

SHA256
b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c

SHA512
8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18346.18345.1\json\wallet\wallet-notification-config.json

Filesize
804B

MD5
4cdefd9eb040c2755db20aa8ea5ee8f7

SHA1
f649fcd1c12c26fb90906c4c2ec0a9127af275f4

SHA256
bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd

SHA512
7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18346.18345.1\json\wallet\wallet-stable.json

Filesize
81KB

MD5
2e7d07dadfdac9adcabe5600fe21e3be

SHA1
d4601f65c6aa995132f4fce7b3854add5e7996a7

SHA256
56090563e8867339f38c025eafb152ffe40b9cfa53f2560c6f8d455511a2346a

SHA512
5cd1c818253e75cc02fccec46aeb34aeff95ea202aa48d4de527f4558c00e69e4cfd74d5cacfcf1bcd705fe6ff5287a74612ee69b5cc75f9428acfbdb4010593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18346.18345.1\json\wallet\wallet-tokenization-config.json

Filesize
34KB

MD5
ae3bd0f89f8a8cdeb1ea6eea1636cbdd

SHA1
1801bc211e260ba8f8099727ea820ecf636c684a

SHA256
0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d

SHA512
69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
af7419e44e130c7bc38040b8610e4d09

SHA1
3e317243b6f1648de47dbe3abcafc6f1af0a4890

SHA256
cb2cad0ba199f8ab259fd68ec6b10fa1b12655d3f37031d02b423401128cfbc9

SHA512
ec7cf3b8cfb3a726940d0860f6d90afd44b71822f870d178016b698ffb281229dec21c387e6963f6b39609f3fa83e46761ff66a0018018c48314cf5399844e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
79f8dab1e1a522f503f10ab50041a254

SHA1
3ac0d7ed59f4a827e28d2538102dc0d7a561f255

SHA256
690919c52f75bf1b873dab7de7f3710e1420dbb1d13ccda93c2ca24899c7a672

SHA512
2cc3592f4d7686cdcfde7be61a987ee0c1cee8eec8e98d0c8aa2b06776e0a0bd79477ee6d4b183fd3e2b59dd1aef3c84da0d248ec6308b3183b3573c0b79430b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
c88f953864e920a02044cf67b1d57fdb

SHA1
537344d277fa3cb45cd8b3fb4353808f0ab8262a

SHA256
75d764290c0a2533510024f5f680f3e128305600e0d8372ee77b2aa044504ac6

SHA512
e08dbe6cb2a5cc70122810cde13f4abfe3cce49faf92358d79f5cf9b8f123e8734f4fc0610a89ff0d12bda0f8246f6b5c0e6c299502aab413342390108f344a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
1e5eaa03aba4c692f5c1f08b42b64628

SHA1
3be50fa344d0661095ee72bba0bb15db18d3ffdf

SHA256
51f4bd44217ddd10fb389a9e55ec310242d073b5448b0e6809f3c46835af6403

SHA512
ce86dcc969eec5266f8780ef0aa3349a887dcd2add944307cb620814384c0895aedf5f6bff3d9a6ae3481fb18644d00bc957a8cf6c12d19e99a72cea7b7a3987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
82d6c117174f8deef173bc9a2c882038

SHA1
e75a6747c27a0ec54478fc6fc56365348b5c6ebe

SHA256
af08ec9386d5fb9434825755c0af7128c80afc37ebc7e7160bd28e43510f9bd2

SHA512
c5957d0993d60ddc68488707ef61bb075fcb572f5d2cab8dbd3439e301330de011ecb37158942a8a5537d244e9b389445d8142fd4e1caa9f5327a55e55d9000e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
dbb8b2779a5bf069a8f908ce5597d72a

SHA1
098a81b73656f635a6656a8035e4d5a53523bcc6

SHA256
a39959cb338ce5b27216d81f6e940c46be42804dce94b484af98abe9275f8889

SHA512
a0a46235432fa21f19417440daa0eaed23d246aa04041944c82abe7cf420ae6d221fecc9f7bd5fe672e569fc04c6eda75b8aa8bffda11e630aa573dfe11e4568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
1110bed89124adf67e74206f7eaa625c

SHA1
af9dedecf6d52912e3e01225ae0fe2fc87d36230

SHA256
04a92afe1c8bd4880b35ce693835cd2bc5927939eabf628fcccae16b6c23a3d3

SHA512
8fc87fb52004d86fe903b6fccaa0b405c2f19e24f5f2ddf87ebb695e0bc83b3f72e5dd3981b8e3bd4407052cbea8646dd43f2758b5612ea7d90a2516578098e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b9893.TMP

Filesize
392B

MD5
51332dba4871348565f458b3a01abcd7

SHA1
2c9833ffb7566e067eaef2d95bf689d0c42bcb91

SHA256
c3b83e42a06b4c527e88b7495de91732fb03862f7eec97d5257b8b9bd6454822

SHA512
2adad1188acfd3281a9445dc795aba69bd9e9757037703e14c51529a154107b119fa8f4d9424a7942dd981981806824f95cca1ed9682b5dbd6d0f872a3119b0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.28.1\typosquatting_list.pb

Filesize
628KB

MD5
bd5eeb9c4b00955e5a0f6a332d78cdef

SHA1
cf9e85ae41cf1ef2385a73ef36ebeb3c3378ea3a

SHA256
dbbea874b4b73aeb3ad17355c90f692767a947516481f158b7319f7c43f0e657

SHA512
2cfa521120dd1ab9c2cc90b74cd8d3f6f8991a086bd2dc1b9d225b08aeca8420f565e047f551ddf6d2149cfb02e4ce69b641e328a774dde7017ad374fd58eb96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-451AU.tmp\CheatEngine76.tmp

Filesize
3.5MB

MD5
2dd329d3ba2220f137afb66ecc98585c

SHA1
267c69e3a52a193bcd3108ad3be92d924c5d3438

SHA256
dc533e0ef05d4c140e03f50ddcc43bd882953edf9247d79bac5a30fe2f78ea70

SHA512
9aa4ac18fb33e1138cbc84f1f65f343af3e87e54d37d4ef4a573159b022e4f208f43a45bb7831189aa7459358b07bd2b8bbb63802cb7cf945daddca37662e6fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GRCE8.tmp\AVAST.png

Filesize
48KB

MD5
378f74a0cbdd582d8b434b7b978ff375

SHA1
56817b18feeace3481a427a6ad8bf4e09b6663e4

SHA256
1225afda135b0bf3b5633595af4096f8c6620ebb34aa5df7c64253f03668b33d

SHA512
1d1c5394bb8fce88a26827af821abb187e9a9f09082310038bc66b7e4c133f27d101dd8c0f3291231efcf68876380d6c62b1653832d7732de2fea65a6ae2c88f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GRCE8.tmp\CheatEngine76.exe

Filesize
29.5MB

MD5
707c3a94a3b3ecf9f83707cf51706d55

SHA1
ccd590614030db7612695b3a013c215c7db92fa8

SHA256
4b9130295aa7686619dbe8f163b880b2c418b56c4596b5119b67718161ab2d57

SHA512
b9adebb0c1d9fa7f3341af2ce26223bb994d3312978263528165e953f277631a6ad471c7ffaeb027f2b5a846a8ef7759dda4519eb17d9fd325576f28cae72306

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GRCE8.tmp\WeatherZero.png

Filesize
29KB

MD5
9ac6287111cb2b272561781786c46cdd

SHA1
6b02f2307ec17d9325523af1d27a6cb386c8f543

SHA256
ab99cdb7d798cb7b7d8517584d546aa4ed54eca1b808de6d076710c8a400c8c4

SHA512
f998a4e0ce14b3898a72e0b8a3f7154fc87d2070badcfa98582e3b570ca83a562d5a0c95f999a4b396619db42ab6269a2bac47702597c5a2c37177441723d837

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GRCE8.tmp\WebAdvisor.png

Filesize
47KB

MD5
4cfff8dc30d353cd3d215fd3a5dbac24

SHA1
0f4f73f0dddc75f3506e026ef53c45c6fafbc87e

SHA256
0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856

SHA512
9d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GRCE8.tmp\finish.png

Filesize
248KB

MD5
b24e872bd8f92295273197602aac8352

SHA1
2a9b0ebe62e21e9993aa5bfaaade14d2dda3b291

SHA256
41031efc4f7e322dc5ffacc94b9296fb28b9b922b1ce3b3da13bf659a5fd2985

SHA512
f08ac681abc4e0f6d7a1d1f2303169004e67c880f9353c0ed11dfab3eb511ddf841fa056f4090da8201c822c66ae55419c48cd87f11b9866feb46a3fe2c2af99

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GRCE8.tmp\logo.png

Filesize
248KB

MD5
9cc8a637a7de5c9c101a3047c7fbbb33

SHA1
5e7b92e7ed3ca15d31a48ebe0297539368fff15c

SHA256
8c5c80bbc6b0fdb367eab1253517d8b156c85545a2d37d1ee4b78f3041d9b5db

SHA512
cf60556817dba2d7a39b72018f619b0dbea36fb227526943046b67d1ae501a96c838d6d5e3da64618592ac1e2fa14d4440baa91618aa66256f99ea2100a427b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GRCE8.tmp\zbShieldUtils.dll

Filesize
2.0MB

MD5
3037e3d5409fb6a697f12addb01ba99b

SHA1
5d80d1c9811bdf8a6ce8751061e21f4af532f036

SHA256
a860bd74595430802f4e2e7ad8fd1d31d3da3b0c9faf17ad4641035181a5ce9e

SHA512
80a78a5d18afc83ba96264638820d9eed3dae9c7fc596312ac56f7e0ba97976647f27bd86ea586524b16176280bd26daed64a3d126c3454a191b0adc2bc4e35d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-I30VP.tmp\_isetup\_setup64.tmp

Filesize
6KB

MD5
e4211d6d009757c078a9fac7ff4f03d4

SHA1
019cd56ba687d39d12d4b13991c9a42ea6ba03da

SHA256
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

SHA512
17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TK5VU.tmp\CheatEngine75.tmp

Filesize
3.2MB

MD5
24f7ae63b369d26136574781735a2f6c

SHA1
4c619b8954d0cb3e292ddb86c3284cde0f3a1460

SHA256
cc34ec320b9c5df608e9f7eeffad8c4885fced83f9f41e66f4cb90eb3d9143b3

SHA512
ecf2ce810dcc8c6a4129467a9f860dee0a0270086fef57e310cf41320ac8e94da36e2b6b393cd9f8f3db271c74e95a4a247289c918d50247b0feceab3beefc30

Download Submit
C:\Users\Admin\Downloads\CheatEngine75.exe.crdownload

Filesize
3.2MB

MD5
81f487f8a51713ded70994f3bdb01892

SHA1
e9f7cedf0cb6d04d337dd0befb450712f6d3f1af

SHA256
7f57ab6697f2d27604be2d63d03768612e6022a1c3b708507af8fb23d461428a

SHA512
6566cfb57007122f8e4b89b54e1adfdd19f22f17d3c4727888d9cfd2cadd3b875b5453f9b02992af1dde54f8b4e1ef1778cc1ce652bb050b597fcf01ea3057dd

Download Submit
C:\Users\Admin\Downloads\CheatEngine75.exe:Zone.Identifier

Filesize
64B

MD5
41c194d8ff60bd15797495450a0912fc

SHA1
be85535fd84316eb1c43ac1a2d36915bbc090a42

SHA256
324a8f36a98ed271830fa840f47fbe5364daa544db93a2225a9d9ac3743f3dd8

SHA512
1dbc3d3029f9e16bb2f4fb6f0636e97c95205fab5cb2c1f4c79fece2b5787820184c1ccf5ecbe8aa4c92ff670de1ccc980c66c0e5527816798154b99b8493c38

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_1529418292\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_1529418292\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_339605661\manifest.json

Filesize
1003B

MD5
578c9dbc62724b9d481ec9484a347b37

SHA1
a6f5a3884fd37b7f04f93147f9498c11ed5c2c2d

SHA256
005a2386e5da2e6a5975f1180fe9b325da57c61c0b4f1b853b8bcf66ec98f0a0

SHA512
2060eb35fb0015926915f603c8e1742b448a21c5a794f9ec2bebd04e170184c60a31cee0682f4fd48b65cff6ade70befd77ba0446cc42d6fe1de68d93b8ea640

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\Notification\notification_fast.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\json\i18n-tokenized-card\fr-CA\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_47682575\manifest.json

Filesize
121B

MD5
16f004af39a3675a73f5c15f6182a293

SHA1
e7027edbadfd881e03d8a592ae661a985fd89cd7

SHA256
4e5ef1851bc910ceeb59a63bb53725cf5d8149feff9483e960b54cc26fdc419b

SHA512
8ef0d80259b5a38424676918f07238a76c527b643267008999dc3b2cff5c93e29ae85cbf0605f0d0b4f880fd6ae96254ebd30e5b80097eea95f5d27b5d461ff6

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_517108434\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_719655586\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_719655586\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_733393546\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_78591954\manifest.json

Filesize
145B

MD5
465cc76a28cc5543a0d845a8e8dd58fa

SHA1
adbe272f254fd8b218fcc7c8da716072ea29d8ba

SHA256
e75fb1fa1692e9720166872afe6d015e4f99d4e8725463e950889a55c4c35bb9

SHA512
a00286cd50d908883a48f675d6291881ad8809dcae5aca55d5d581e6d93a66058e1fe9e626852bf16e5bb0c693a088a69d9876ccac288181b1f74254bf1da1a2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_838928678\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2040_936327276\manifest.json

Filesize
118B

MD5
3e4993f878e658507d78f52011519527

SHA1
2fce50683531c5c985967a71f90d62ab141707df

SHA256
a2fb35b03e24f5ba14cbe0e3c3d8cb43588e93f048878b066fd1d640ef8e59cb

SHA512
9d24ef876ac989e50e9d4d06732a4c4f61e12df366b3d4e5ff93d6a60badac36c3e55e7f13c2539ecb525017490a887fc56580ef8e83483019041ad9b13358d5

Download Submit
memory/2816-1464-0x0000000000B00000-0x0000000000E88000-memory.dmp

Filesize
3.5MB

Download
memory/2852-685-0x0000000000920000-0x0000000000C63000-memory.dmp

Filesize
3.3MB

Download
memory/2852-657-0x0000000004960000-0x0000000004AA0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-671-0x0000000004960000-0x0000000004AA0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-703-0x0000000004960000-0x0000000004AA0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-708-0x0000000004960000-0x0000000004AA0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-1483-0x0000000000920000-0x0000000000C63000-memory.dmp

Filesize
3.3MB

Download
memory/2852-1473-0x0000000004960000-0x0000000004AA0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-720-0x0000000000920000-0x0000000000C63000-memory.dmp

Filesize
3.3MB

Download
memory/4436-1539-0x00007FF9F2C00000-0x00007FF9F2D92000-memory.dmp

Filesize
1.6MB

Download
memory/4436-1486-0x00007FF9F2C00000-0x00007FF9F2D92000-memory.dmp

Filesize
1.6MB

Download
memory/4800-1485-0x0000000000120000-0x00000000001FC000-memory.dmp

Filesize
880KB

Download
memory/4800-684-0x0000000000120000-0x00000000001FC000-memory.dmp

Filesize
880KB

Download
memory/4800-633-0x0000000000120000-0x00000000001FC000-memory.dmp

Filesize
880KB

Download
memory/5140-1465-0x0000000000CA0000-0x0000000000D84000-memory.dmp

Filesize
912KB

Download
memory/5140-726-0x0000000000CA0000-0x0000000000D84000-memory.dmp

Filesize
912KB

Download