Overview

overview

8

Static

static

3

WeMod-Setup (1).exe

windows11-ltsc_2024-x64

8

Resubmissions

11/07/2026, 11:40

260711-ns6cbsbt218

11/07/2026, 11:31

260711-nmtfksbs5x8

Analysis

  • user interaction
    yes
  • max time kernel
    420s
  • max time network
    436s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 11:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WeMod-Setup (1).exe
  • Size 155KB
  • Sample260711-ns6cbsbt21
  • SHA256 0f00945297a82b52f17629b3377665bf9194e9fed37bccbc42a1f196205d9c62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 3 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks for any installed AV software in registry 1 TTPs 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 8 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\WeMod-Setup (1).exe
    "C:\Users\Admin\AppData\Local\Temp\WeMod-Setup (1).exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:5156
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5932
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8495cc728,0x7ff8495cc734,0x7ff8495cc740
      2⤵
        PID:3864
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1708,i,2293172686159569546,18244917387715130770,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:2728
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,17639093369872135743,6128795073240536968,262144 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
        2⤵
          PID:2676
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,12796648645948883397,5601901583442655713,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
          2⤵
            PID:5164
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,17902507754117810759,9447318033091950892,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
            2⤵
              PID:4632
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,1136421999141581399,16454496056313890738,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
              2⤵
                PID:1752
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4740,i,8597440626137849353,16600994994903482409,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
                2⤵
                  PID:3012
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,7132828780964329422,9327964772758530039,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
                  2⤵
                    PID:2748
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5072,i,11742519371152870439,9697587969918200858,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
                    2⤵
                      PID:4020
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,10524108295218284097,5082258734692642432,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
                      2⤵
                        PID:1904
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,6268650421227642204,12241695577217628407,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
                        2⤵
                          PID:2788
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5672,i,12097133108570267142,9961419833606574797,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
                          2⤵
                            PID:2876
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5684,i,316465159899069293,7152517381205724814,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
                            2⤵
                              PID:4648
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5860,i,17813595183780738058,2445539505057121485,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
                              2⤵
                                PID:3988
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5828,i,17510921994148931560,6065519815052628247,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
                                2⤵
                                  PID:3416
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5964,i,2877333040946142120,5101064632141505940,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
                                  2⤵
                                    PID:3384
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6220,i,17086594977539583329,4486688384030704433,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
                                    2⤵
                                      PID:1864
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6196,i,15930065675987563321,14942903260151906562,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
                                      2⤵
                                        PID:2996
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6468,i,17053809807553344087,180599886750702738,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
                                        2⤵
                                          PID:2060
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,8474597580270468132,1314260165371166614,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
                                          2⤵
                                            PID:1628
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6620,i,6094002285994247946,6026525816217682178,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
                                            2⤵
                                              PID:5532
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6864,i,15543654934638904999,6913396007099581945,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
                                              2⤵
                                                PID:4748
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6324,i,15976310844994381318,6632496572075577673,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
                                                2⤵
                                                  PID:4936
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6236,i,5554081436995884856,692923700464575949,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:9
                                                  2⤵
                                                    PID:1888
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6280,i,10197549938469474695,6977049368292881033,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
                                                    2⤵
                                                      PID:5388
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4904,i,18322240293655331735,9432785782823907018,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
                                                      2⤵
                                                        PID:3528
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3672,i,317522251809221374,11234159134248890838,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
                                                        2⤵
                                                          PID:4280
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6856,i,14543341175173149020,8265233833490762886,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
                                                          2⤵
                                                            PID:4100
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,4959265881850755516,14648811046743876360,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
                                                            2⤵
                                                              PID:1076
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,2961089691424908137,5764170881157076532,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
                                                              2⤵
                                                                PID:4812
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,1677743304482552715,7390202735311785367,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
                                                                2⤵
                                                                  PID:5340
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6336,i,1553197200006817613,988539797766237838,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
                                                                  2⤵
                                                                    PID:4524
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6044,i,11356248297169058000,758180098814661746,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
                                                                    2⤵
                                                                      PID:2848
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5712,i,4055895671397757845,17373381408076344867,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
                                                                      2⤵
                                                                        PID:988
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6008,i,3304877925288416827,8980606879015734387,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
                                                                        2⤵
                                                                          PID:3996
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=4944,i,3192537882775611186,2639637740700193002,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
                                                                          2⤵
                                                                            PID:4272
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=3620,i,16560365084507592039,4860292032480402463,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
                                                                            2⤵
                                                                              PID:2068
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6092,i,3885544217655028164,3245306601670325732,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
                                                                              2⤵
                                                                                PID:1344
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7104,i,17018409094217257193,13779164283649487448,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
                                                                                2⤵
                                                                                  PID:5340
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7204,i,2787111999990929288,1011876111958464190,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:1
                                                                                  2⤵
                                                                                    PID:1524
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7372,i,15117461522714334755,6187485720260033060,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:14
                                                                                    2⤵
                                                                                      PID:4024
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7416,i,8114530680700231001,416312489735841269,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:1
                                                                                      2⤵
                                                                                        PID:1516
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,6762617913875020189,1599906289226450384,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
                                                                                        2⤵
                                                                                          PID:4804
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7488,i,9489405564376769931,12672449933769110369,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
                                                                                          2⤵
                                                                                            PID:5368
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7660,i,1110900994154003447,5489357956113466619,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
                                                                                            2⤵
                                                                                              PID:5148
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7728,i,13167505396733763830,8417029619035104131,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:14
                                                                                              2⤵
                                                                                                PID:3252
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7740,i,4559069327537063999,6215228269006857815,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:12
                                                                                                2⤵
                                                                                                  PID:5980
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7380,i,17508603413147907818,11046730828910275246,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5580
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7912,i,14349393069436196813,12793895250668364293,262144 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:10
                                                                                                    2⤵
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:2688
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7912,i,9875617363313871418,4600103917198999753,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:3492
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=8060,i,4853833602019536971,15262850616980319578,2097152 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:1136
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8164,i,14885238190272922452,10073756508640578208,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:14
                                                                                                        2⤵
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:1948
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7716,i,5802291952610262733,9769830438922715962,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:14
                                                                                                        2⤵
                                                                                                          PID:700
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7732,i,10717126339217747065,11103035159507765611,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:14
                                                                                                          2⤵
                                                                                                            PID:3088
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7584,i,1937957068605782996,16114997185896861240,524288 --field-trial-handle=2012,i,17721831291611512072,11261491355045807135,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
                                                                                                            2⤵
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:4404
                                                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                          1⤵
                                                                                                            PID:4292
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                            1⤵
                                                                                                              PID:788
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                              1⤵
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              PID:1596
                                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                              1⤵
                                                                                                                PID:3308
                                                                                                              • C:\Users\Admin\Downloads\CheatEngine77.exe
                                                                                                                "C:\Users\Admin\Downloads\CheatEngine77.exe"
                                                                                                                1⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2784
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-D8YYCMLSRW.tmp\CheatEngine77.tmp
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-D8YYCMLSRW.tmp\CheatEngine77.tmp" /SL5="$502BC,5592098,893952,C:\Users\Admin\Downloads\CheatEngine77.exe"
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Loads dropped DLL
                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Checks processor information in registry
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  PID:4492
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-HVU5CYT5DU.tmp\CheatEngine77.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-HVU5CYT5DU.tmp\CheatEngine77.exe" /VERYSILENT /ZBDIST
                                                                                                                    3⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4496
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-EE73O.tmp\CheatEngine77.tmp
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-EE73O.tmp\CheatEngine77.tmp" /SL5="$C02B0,32420729,869888,C:\Users\Admin\AppData\Local\Temp\is-HVU5CYT5DU.tmp\CheatEngine77.exe" /VERYSILENT /ZBDIST
                                                                                                                      4⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                      PID:2988
                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                        "net" stop BadlionAntic
                                                                                                                        5⤵
                                                                                                                          PID:3324
                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                            C:\Windows\system32\net1 stop BadlionAntic
                                                                                                                            6⤵
                                                                                                                              PID:3148
                                                                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                                                                            "net" stop BadlionAnticheat
                                                                                                                            5⤵
                                                                                                                              PID:2580
                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                C:\Windows\system32\net1 stop BadlionAnticheat
                                                                                                                                6⤵
                                                                                                                                  PID:3828
                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                "sc" delete BadlionAntic
                                                                                                                                5⤵
                                                                                                                                • Launches sc.exe
                                                                                                                                PID:900
                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                "sc" delete BadlionAnticheat
                                                                                                                                5⤵
                                                                                                                                • Launches sc.exe
                                                                                                                                PID:5040
                                                                                                                              • C:\Windows\SYSTEM32\net.exe
                                                                                                                                "net" stop vgk
                                                                                                                                5⤵
                                                                                                                                  PID:4504
                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                    C:\Windows\system32\net1 stop vgk
                                                                                                                                    6⤵
                                                                                                                                      PID:4080
                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                    "sc" delete vgk
                                                                                                                                    5⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:1276
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-UEVEF.tmp\_isetup\_setup64.tmp
                                                                                                                                    helper 105 0x3B8
                                                                                                                                    5⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:5616
                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                    "icacls" "C:\Program Files\Cheat Engine" /grant *S-1-15-2-1:(OI)(CI)(RX)
                                                                                                                                    5⤵
                                                                                                                                    • Modifies file permissions
                                                                                                                                    PID:5396
                                                                                                                                  • C:\Program Files\Cheat Engine\Kernelmoduleunloader.exe
                                                                                                                                    "C:\Program Files\Cheat Engine\Kernelmoduleunloader.exe" /SETUP
                                                                                                                                    5⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:3260
                                                                                                                                  • C:\Program Files\Cheat Engine\windowsrepair.exe
                                                                                                                                    "C:\Program Files\Cheat Engine\windowsrepair.exe" /s
                                                                                                                                    5⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:5868
                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                    "icacls" "C:\Program Files\Cheat Engine" /grant *S-1-15-2-1:(OI)(CI)(RX)
                                                                                                                                    5⤵
                                                                                                                                    • Modifies file permissions
                                                                                                                                    PID:3524
                                                                                                                              • C:\Program Files\Cheat Engine\Cheat Engine.exe
                                                                                                                                "C:\Program Files\Cheat Engine\Cheat Engine.exe"
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2392
                                                                                                                                • C:\Program Files\Cheat Engine\cheatengine-x86_64-SSE4-AVX2.exe
                                                                                                                                  "C:\Program Files\Cheat Engine\cheatengine-x86_64-SSE4-AVX2.exe"
                                                                                                                                  4⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                  PID:4588
                                                                                                                                  • C:\Program Files\Cheat Engine\Tutorial-x86_64.exe
                                                                                                                                    "C:\Program Files\Cheat Engine\Tutorial-x86_64.exe"
                                                                                                                                    5⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:6084
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                            1⤵
                                                                                                                              PID:4016
                                                                                                                            • C:\Windows\system32\sihost.exe
                                                                                                                              sihost.exe
                                                                                                                              1⤵
                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                              PID:6696
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                2⤵
                                                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                • Enumerates connected drives
                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                PID:6860
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                              1⤵
                                                                                                                                PID:1648
                                                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                1⤵
                                                                                                                                  PID:752

                                                                                                                                Network

                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                      Reconnaissance

                                                                                                                                      Resource Development

                                                                                                                                      Initial Access

                                                                                                                                      Execution

                                                                                                                                      System Services

                                                                                                                                      1
                                                                                                                                      T1569

                                                                                                                                      Service Execution

                                                                                                                                      1
                                                                                                                                      T1569.002

                                                                                                                                      Persistence

                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                      1
                                                                                                                                      T1547

                                                                                                                                      Active Setup

                                                                                                                                      1
                                                                                                                                      T1547.014

                                                                                                                                      Create or Modify System Process

                                                                                                                                      1
                                                                                                                                      T1543

                                                                                                                                      Windows Service

                                                                                                                                      1
                                                                                                                                      T1543.003

                                                                                                                                      Privilege Escalation

                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                      1
                                                                                                                                      T1547

                                                                                                                                      Active Setup

                                                                                                                                      1
                                                                                                                                      T1547.014

                                                                                                                                      Create or Modify System Process

                                                                                                                                      1
                                                                                                                                      T1543

                                                                                                                                      Windows Service

                                                                                                                                      1
                                                                                                                                      T1543.003

                                                                                                                                      Defense Evasion

                                                                                                                                      File and Directory Permissions Modification

                                                                                                                                      1
                                                                                                                                      T1222

                                                                                                                                      Impair Defenses

                                                                                                                                      1
                                                                                                                                      T1562

                                                                                                                                      Modify Registry

                                                                                                                                      2
                                                                                                                                      T1112

                                                                                                                                      Credential Access

                                                                                                                                      Discovery

                                                                                                                                      Browser Information Discovery

                                                                                                                                      1
                                                                                                                                      T1217

                                                                                                                                      Peripheral Device Discovery

                                                                                                                                      2
                                                                                                                                      T1120

                                                                                                                                      Query Registry

                                                                                                                                      6
                                                                                                                                      T1012

                                                                                                                                      Software Discovery

                                                                                                                                      1
                                                                                                                                      T1518

                                                                                                                                      Security Software Discovery

                                                                                                                                      1
                                                                                                                                      T1518.001

                                                                                                                                      System Information Discovery

                                                                                                                                      5
                                                                                                                                      T1082

                                                                                                                                      System Location Discovery

                                                                                                                                      1
                                                                                                                                      T1614

                                                                                                                                      System Language Discovery

                                                                                                                                      1
                                                                                                                                      T1614.001

                                                                                                                                      System Time Discovery

                                                                                                                                      1
                                                                                                                                      T1124

                                                                                                                                      Lateral Movement

                                                                                                                                      Collection

                                                                                                                                      Command and Control

                                                                                                                                      Exfiltration

                                                                                                                                      Impact

                                                                                                                                      Service Stop

                                                                                                                                      1
                                                                                                                                      T1489

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      Cheat Engine.exe
                                                                                                                                      • Path C:\Program Files\Cheat Engine\Cheat Engine.exe
                                                                                                                                      • Size 397KB
                                                                                                                                      • SHA256 5313618d93640bb29b66baadf2339de85e593a51715290dadece6d58e039a75e
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Kernelmoduleunloader.exe
                                                                                                                                      • Path C:\Program Files\Cheat Engine\Kernelmoduleunloader.exe
                                                                                                                                      • Size 236KB
                                                                                                                                      • SHA256 65fa2ccb3ac5400dd92dda5f640445a6e195da7c827107260f67624d3eb95e7d
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      allochook-i386.dll
                                                                                                                                      • Path C:\Program Files\Cheat Engine\allochook-i386.dll
                                                                                                                                      • Size 328KB
                                                                                                                                      • SHA256 b96469b310ba59d1db320a337b3a8104db232a4344a47a8e5ae72f16cc7b1ff4
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      allochook-x86_64.dll
                                                                                                                                      • Path C:\Program Files\Cheat Engine\allochook-x86_64.dll
                                                                                                                                      • Size 468KB
                                                                                                                                      • SHA256 8422be70e0ec59c962b35acf8ad80671bcc8330c9256e6e1ec5c07691388cd66
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      is-62R4F.tmp
                                                                                                                                      • Path C:\Program Files\Cheat Engine\badassets\is-62R4F.tmp
                                                                                                                                      • Size 5KB
                                                                                                                                      • SHA256 a8d8227b8e97a713e0f1f5db5286b3db786b7148c1c8eb3d4bbfe683dc940db9
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _mingw.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\_mingw.h
                                                                                                                                      • Size 3KB
                                                                                                                                      • SHA256 478ca3b81e7442b00b29ad67ed6ff30656aaf1e83402f5d47c803b6641a88a81
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      assert.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\assert.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 3ab7edec5e55840c35be252bad52236955c3b4f9143810cdb1f09c34510eb8c4
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      celib.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\celib.h
                                                                                                                                      • Size 264B
                                                                                                                                      • SHA256 0d37951ce5445917bdb6fe062cf18bafe458a9f361abf8ec11382ef7f6653e1f
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      celog.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\celog.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 9373d6ce49de335c64d591e6b8e8f362a2768f474ae761b5fa4ec6a893e635e8
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      cepipelib.c
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\cepipelib.c
                                                                                                                                      • Size 15KB
                                                                                                                                      • SHA256 63b57b15239c54c2ff7a0c64097e9d69dd0c1bfd65611f3ac14b1d6249cf4203
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      cesocket.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\cesocket.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 6184170fe0d4f8c8ada1299caf0e34d435962c288686578436b2251c3909f050
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      conio.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\conio.h
                                                                                                                                      • Size 10KB
                                                                                                                                      • SHA256 de7161f85835d98b38fe6a19ef8973dcaf58ec237b1c91cf05ac535b2ff3845f
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      ctype.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\ctype.h
                                                                                                                                      • Size 9KB
                                                                                                                                      • SHA256 4cfaaa43b3f7414984126e8b1cdf65f9dac0ef68d9a3396be0b8828376a74a6b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      dir.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\dir.h
                                                                                                                                      • Size 952B
                                                                                                                                      • SHA256 84064b17e501d691c43d47e45b112c2884db467417910b5fa1482b72342badfb
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      direct.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\direct.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 179c3204312d7cf8032102773629bcb3e5fff792d1d808931cb6619a431d2435
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      dirent.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\dirent.h
                                                                                                                                      • Size 3KB
                                                                                                                                      • SHA256 88c1f767fdcd6d51b991ee3234792da48c8576f5f8816f17a42344f9c8bbb1c1
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      dos.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\dos.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 3afea4ae85c68987fe59f40592ac5ea3ef1049b4fb72612bb185358d628e2dec
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      errno.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\errno.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 7c8494fe57d944773861c4c1cc1f2b46b3111144a24bf505b3d47b32f0ac1e8a
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      excpt.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\excpt.h
                                                                                                                                      • Size 3KB
                                                                                                                                      • SHA256 0098e51602c94f8a9702f4b776d3630f56eec27ed67b9fc36d9204933b58ac4d
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      fcntl.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\fcntl.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 fbd94f945a57165ac897bdbacd2a861b1351e7850fa76752703c0a622e0646fa
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      fenv.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\fenv.h
                                                                                                                                      • Size 3KB
                                                                                                                                      • SHA256 67a827acf4e09653afb5d18f2ecaa5fcdfb7471d8a5b8197c2f33d06e8462f84
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      float.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\float.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 7b8c84c49d28439ed7415e88c5131551b3c3f68305c51d3d81b8ec42e6b25013
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      inttypes.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\inttypes.h
                                                                                                                                      • Size 5KB
                                                                                                                                      • SHA256 4194c0408cdba330b7cfa1d2091d72a0cfbf2077ff1feb19f436f3f3aa2adf18
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      io.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\io.h
                                                                                                                                      • Size 12KB
                                                                                                                                      • SHA256 5da97c850e8e2ab608c42947a33411f556f6d75b8264e1e5cf29ca7ba7b96256
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      jni.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\jni.h
                                                                                                                                      • Size 52KB
                                                                                                                                      • SHA256 bbfdf8435eb3bf257808755066eb267f77f2677af1333c32d8d42476f3cde845
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      limits.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\limits.h
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 39c0761f0e43d7b936b9b81c85673dd82896ebfa66e9f1b9a19b45f34e4cd52a
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      linux-x86_64-ExceptionHandler.c
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\linux-x86_64-ExceptionHandler.c
                                                                                                                                      • Size 6KB
                                                                                                                                      • SHA256 6ee47c69e8af14257387e4ea025b5c8df832ee751745ea21e91e90c79e4352a6
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      locale.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\locale.h
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 882626fa25dbc1b5903e6fd98cc8516f1e54c4e06945026653f05b38125dff2c
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      lauxlib.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\lua\lauxlib.h
                                                                                                                                      • Size 8KB
                                                                                                                                      • SHA256 1a47911ab8c28536b35b83e9887729b06b00e10ded9c1bdb417ece7657a6c73a
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      lua.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\lua\lua.h
                                                                                                                                      • Size 14KB
                                                                                                                                      • SHA256 8aef3fa9669bdc5e7659389e276f31ec779ca4bdf96e2c9ada07dd9458a47416
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      lua.hpp
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\lua\lua.hpp
                                                                                                                                      • Size 200B
                                                                                                                                      • SHA256 a7a47ce4cd19f703b8025696f0631c09a664d54cfa831be4538d10441aebb48d
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      luaconf.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\lua\luaconf.h
                                                                                                                                      • Size 20KB
                                                                                                                                      • SHA256 0c5d09a7908f99b80377b3157a0bd37c6322cdc0af437e99501ae746037408ec
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      lualib.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\lua\lualib.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 3890f6ce73f70f6eb67ec42a74f7c8cef40fa184659934906648c8acadb53fbf
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      luaclient.c
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\luaclient.c
                                                                                                                                      • Size 6KB
                                                                                                                                      • SHA256 a18a985a32b8627847278c41012d200c0db1b4368e6204fd6157f6e29281d9e3
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      macspeedhack.c
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\macspeedhack.c
                                                                                                                                      • Size 5KB
                                                                                                                                      • SHA256 3385883dfeeda6d10867ad5e942a90e3a86e1a51ae4621ac19d14f8ef92dc000
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      malloc.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\malloc.h
                                                                                                                                      • Size 5KB
                                                                                                                                      • SHA256 7307ff330b8d7954d548e19e45887ed64de36da5bee1fda2cc021f0c1c1892bd
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      math.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\math.h
                                                                                                                                      • Size 22KB
                                                                                                                                      • SHA256 0bc33882bd2af1e7d33c38c0160e2a0ae737836815360765750cdc7e98e5dfc5
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      mem.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\mem.h
                                                                                                                                      • Size 345B
                                                                                                                                      • SHA256 43956946aefee50e01fdd4d54a6c597418abcb02251f9d7695ed7039fd7a5ff6
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      memory.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\memory.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 b4341e188913a819fa3bf101078a95ca077780219373f424c39ad86c94e04b6f
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      process.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\process.h
                                                                                                                                      • Size 8KB
                                                                                                                                      • SHA256 6947c954f2af676e66cc38d64b1a165428734000e2e272f883c2d74a85b82020
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      conio_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\conio_s.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 f7375e816739491fbab39531c1d60a77b78ff9a162aba17f817c773bf75f6508
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      crtdbg_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\crtdbg_s.h
                                                                                                                                      • Size 461B
                                                                                                                                      • SHA256 03630ee83e7c921446a0790853fcadeb5a308553dd3c4ecddd568cda3167c0f1
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      io_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\io_s.h
                                                                                                                                      • Size 881B
                                                                                                                                      • SHA256 6e02f4ae50d30629af7df34785b6c32642b12d94addd56606f6fc4ab668250ff
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      mbstring_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\mbstring_s.h
                                                                                                                                      • Size 3KB
                                                                                                                                      • SHA256 d962ab8070958953f48b24c9ea068b345b158237826fb71b9a76d36cf2e8a32b
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      search_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\search_s.h
                                                                                                                                      • Size 796B
                                                                                                                                      • SHA256 96174e09f1c573c7faea85a6d568225a1b946e133c6c04a7bd6aa865c58896a2
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stdio_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\stdio_s.h
                                                                                                                                      • Size 11KB
                                                                                                                                      • SHA256 5107bed740c6274ffc767ad42ded6ce5a8f51cb0c73239d04d5a647d62edf2f1
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stdlib_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\stdlib_s.h
                                                                                                                                      • Size 4KB
                                                                                                                                      • SHA256 8650e34be241c7d837433126878eb6a30ee71c0b759c23671fd8f0715c7cde65
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stralign_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\stralign_s.h
                                                                                                                                      • Size 824B
                                                                                                                                      • SHA256 b23f0cf79d5455e232d92792e2b2be38125a02808bc005049367bab68da1300b
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      string_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\string_s.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 eef32fb505b98a3610923e8ddb3de724c55b44389d25cef7cf50ee3cd14f5d68
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      timeb_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\sys\timeb_s.h
                                                                                                                                      • Size 653B
                                                                                                                                      • SHA256 d153417ec64eb7b1504749bca6477efd51b4b22de670518f4fdc2701080145c0
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      tchar_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\tchar_s.h
                                                                                                                                      • Size 8KB
                                                                                                                                      • SHA256 a5318cceb241962769169c32a3ce5bfb9a075a52edbac31aad33b0d7b897b544
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      time_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\time_s.h
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 9ae9cb7a3164ad0093e3887b0ca09bb67498da51bb44e9be500b60e72a385dc0
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      wchar_s.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sec_api\wchar_s.h
                                                                                                                                      • Size 7KB
                                                                                                                                      • SHA256 5a470ac358b2d951202182f9ec1f945331c23a8d79629ad4edb08b7d73cfaee4
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      setjmp.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\setjmp.h
                                                                                                                                      • Size 3KB
                                                                                                                                      • SHA256 b6164eb7fae4a12163251492f7f4e56cc50d146ec7a2f5640d86eca4d095046f
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      share.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\share.h
                                                                                                                                      • Size 639B
                                                                                                                                      • SHA256 6de922c1bd7eedc33308304785c212945064d763eedfb373c09cbbb5cb933dde
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      signal.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\signal.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 045a031b376733ed7a685bc01709f5281403729ff7c601b913b2aca2fe1493bb
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stdalign.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\stdalign.h
                                                                                                                                      • Size 354B
                                                                                                                                      • SHA256 7612d46571099ccaa7616a510f78f180cb1e91671e6e5e9223a2e297b84b789d
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stdarg.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\stdarg.h
                                                                                                                                      • Size 335B
                                                                                                                                      • SHA256 a38f8d34f5e09658cc3a8892b3a7e80ff566eaeedc194e5a85ece0b675993137
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stdatomic.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\stdatomic.h
                                                                                                                                      • Size 7KB
                                                                                                                                      • SHA256 5bc89ea6aff1edabaf7f5830ad589cf8d9d8245211ac4f9e1440cf53c0eb8d18
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stdbool.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\stdbool.h
                                                                                                                                      • Size 176B
                                                                                                                                      • SHA256 5252824225ddc486b0460677f765e4157af5d3ed7acd65b310a4045eafb56af7
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stddef.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\stddef.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 a2eeaa997ab8f1d3b3ff35612aa61f8d53e61bdabffcd5bbd21c68bc41ab0db5
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stdint.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\stdint.h
                                                                                                                                      • Size 6KB
                                                                                                                                      • SHA256 33c6c8da7d564b5702af8c6ff45c00a16842ba3ffe3f95f7f6232752f63c5afd
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stdio.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\stdio.h
                                                                                                                                      • Size 14KB
                                                                                                                                      • SHA256 749059834143bcd5bdcea13fc863c8b6587a89d6dfc84cd5017a98df190defbd
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stdlib.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\stdlib.h
                                                                                                                                      • Size 19KB
                                                                                                                                      • SHA256 5bba095a2d22a6bc0670f73bfebba63cfec65f8b7c248e84e36b3d7ede0a4f3c
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stdnoreturn.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\stdnoreturn.h
                                                                                                                                      • Size 125B
                                                                                                                                      • SHA256 ec64d8fbf7fb2e800df9784b2efca0a99fc25a3eb5e8da56e4df098937f787f2
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      string.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\string.h
                                                                                                                                      • Size 8KB
                                                                                                                                      • SHA256 d5c02c22653784792eeff04cc453467ba22c214d9ace876127eab5fcccbca762
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      fcntl.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sys\fcntl.h
                                                                                                                                      • Size 359B
                                                                                                                                      • SHA256 2b4f660ffd8994afa0387407051e3ca7ecc8fe44beb2add2d431cd52ce8ad9c4
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      file.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sys\file.h
                                                                                                                                      • Size 367B
                                                                                                                                      • SHA256 b6e779c53140c117bc36bd335c64bfcb13ae4c2c486b94783b32149a6eb2d320
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      locking.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sys\locking.h
                                                                                                                                      • Size 648B
                                                                                                                                      • SHA256 29786145e9af34a1f96e7368855b19e8879fc80d35a172d9ba97d3c7fc2f6311
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      stat.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sys\stat.h
                                                                                                                                      • Size 6KB
                                                                                                                                      • SHA256 4dc126ab4b3177da85e40ed56a7d4516105e436a4624272992816b23e03915b5
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      time.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sys\time.h
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 518741f286545434df676572e53bf8553b0496a7138942dc6b20ff252b4293e4
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      timeb.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sys\timeb.h
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 ef43f9f51660ab8282707f7169cc3d977878e623743d23ec565663fe2b4e9782
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      types.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sys\types.h
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 f1c3f9e5c811a63bebae5229042c09cb5e057f4117fd31b45aacbb4c3a626df8
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      unistd.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sys\unistd.h
                                                                                                                                      • Size 351B
                                                                                                                                      • SHA256 1f595a85caeeef7385a0bda94af51896b214ee26056484af50353e9393de1929
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      utime.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\sys\utime.h
                                                                                                                                      • Size 3KB
                                                                                                                                      • SHA256 524312e3e8a325f7d5afc21ddb8fcbceb85d451175e07ef1beadb7f82fa368b3
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      tcc_libm.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\tcc\tcc_libm.h
                                                                                                                                      • Size 5KB
                                                                                                                                      • SHA256 758e0585edfbce44bf27e0bb44d9b22af53b86c9c265e4303df9b270194ed4ff
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      tccdefs.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\tccdefs.h
                                                                                                                                      • Size 12KB
                                                                                                                                      • SHA256 0d59ca4ed0be71f3b2d494612ca26fa7e901af30b2b37f0b4c5adf33df8f19cd
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      tchar.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\tchar.h
                                                                                                                                      • Size 30KB
                                                                                                                                      • SHA256 7fe5fde028ff8f69d2bda910664e2c169e7b92c6e7f2cf7915eb72054a9746ff
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      tgmath.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\tgmath.h
                                                                                                                                      • Size 3KB
                                                                                                                                      • SHA256 e60c66ff9017f13ab18ee38824792ca771b9235bcb4df57688fec582739524a5
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      time.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\time.h
                                                                                                                                      • Size 8KB
                                                                                                                                      • SHA256 453793a2d6c6fc772d1cdd60e701fb3d393d752937c1d6b2ca64d5f1cec9fd36
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      vadefs.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\vadefs.h
                                                                                                                                      • Size 304B
                                                                                                                                      • SHA256 2e6ab359559319a11a80f8f52aa0472cd0b141137f3a1eaa18c40d8827dc51d4
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      values.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\values.h
                                                                                                                                      • Size 126B
                                                                                                                                      • SHA256 fa3758847b33f59abe99b023be00d8a027c391ecd0580a1fe755497c11e0c723
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      varargs.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\varargs.h
                                                                                                                                      • Size 355B
                                                                                                                                      • SHA256 07858857f4eed0a61df94beb1a9d678b53fc3d67a0b0e8936155f85ddbcd1dcc
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      wchar.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\wchar.h
                                                                                                                                      • Size 33KB
                                                                                                                                      • SHA256 c9bf12e02a2ab0783ed1c66dfe43de43c402b33906cada9b1157502a82c7c3e4
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      wctype.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\wctype.h
                                                                                                                                      • Size 4KB
                                                                                                                                      • SHA256 e12d9c5bcbe4dfb96ea6c75410ea287917b3c24bff9cd2e716d35e00c1d4906c
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      basetsd.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\basetsd.h
                                                                                                                                      • Size 5KB
                                                                                                                                      • SHA256 5c9cbaa16abf57400ed31b49aab7ee015788dbe7d3b58f3d53c86db3807dd6f0
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      basetyps.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\basetyps.h
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 34842ee3389cb13a72a2b87ec930aadbffce8906eb31480180cff541c7f44134
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      guiddef.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\guiddef.h
                                                                                                                                      • Size 4KB
                                                                                                                                      • SHA256 7db1b1fe46513f578a3c777c3ce300d8403d31fbfb6d00eacff93286d2ed1293
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      poppack.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\poppack.h
                                                                                                                                      • Size 282B
                                                                                                                                      • SHA256 81c951e1fb87aa8f6e8871a073277f1cd1ccb9b66f6efa92aff35bcd00a60726
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      pshpack1.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\pshpack1.h
                                                                                                                                      • Size 285B
                                                                                                                                      • SHA256 8eb67dd233d5a387d6dc1814cb6eb6c6de9a123438faefca7b442691caf23049
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      pshpack2.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\pshpack2.h
                                                                                                                                      • Size 285B
                                                                                                                                      • SHA256 d459cbd546929fd44980d32c1680a8f176d717ce9df162f5c5c443dfdccc9e42
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      pshpack4.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\pshpack4.h
                                                                                                                                      • Size 285B
                                                                                                                                      • SHA256 cd3ba1258a5dd9c714879d3e499b021c85ee9827c06bac2fc2c1e677b5909531
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      pshpack8.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\pshpack8.h
                                                                                                                                      • Size 285B
                                                                                                                                      • SHA256 32fe7b5ff2387c916ad134ef5b5b0ac67447da0e0dccf405c31562aac718d6d8
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      winbase.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\winbase.h
                                                                                                                                      • Size 155KB
                                                                                                                                      • SHA256 47effba4d4bb7dfbe373f1156285a170042fe1a3552bcbbee460e5db68e1ff2d
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      wincon.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\wincon.h
                                                                                                                                      • Size 14KB
                                                                                                                                      • SHA256 c965b8839e100e9aacad333b373218f962a15840583231f968076441e781538b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      windef.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\windef.h
                                                                                                                                      • Size 5KB
                                                                                                                                      • SHA256 137e9a43a136e4ae19b3a4c844023c6a1611b23685000364f6be3143db1a4c75
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      windows.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\windows.h
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 3b0d80e4b27e099c8af543d6d9cca295c68e115a0fba7cd79cc0e76d1c3a5c11
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      winerror.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\winerror.h
                                                                                                                                      • Size 146KB
                                                                                                                                      • SHA256 590134000b1b5c4fb7afbcc54a445a42228d74164a9e8b24434d1a993f76852e
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      wingdi.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\wingdi.h
                                                                                                                                      • Size 118KB
                                                                                                                                      • SHA256 df5937ac1805b27abba03277d2c34caee8cb4387edb894adcd73e6172a9fbd94
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      winnt.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\winnt.h
                                                                                                                                      • Size 189KB
                                                                                                                                      • SHA256 f43cca894862a7311f5f4fd4789efdecd86563113b374e4f04f23ceb524472a3
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      winreg.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\winreg.h
                                                                                                                                      • Size 13KB
                                                                                                                                      • SHA256 6dbb969dc21e90d9044dabcd190268c1bb33e445862ce2a4a536e9a7134fa4eb
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      winuser.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\winuser.h
                                                                                                                                      • Size 175KB
                                                                                                                                      • SHA256 4356bfcdf5209c4ec58de486e2173ce4b17e0ce75a422b226fdddd18597c9905
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      winver.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\winapi\winver.h
                                                                                                                                      • Size 5KB
                                                                                                                                      • SHA256 7d846678ec2a8c70f86308cf6be585d760924c620dfcfb4b048f60d88577b69d
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      windowslite.h
                                                                                                                                      • Path C:\Program Files\Cheat Engine\include\windowslite.h
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 4510fe31e609755c5e27a0e04474f1a6a0fed6bf1ee5aeb227b7d7c2f422368d
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      is-I80HF.tmp
                                                                                                                                      • Path C:\Program Files\Cheat Engine\is-I80HF.tmp
                                                                                                                                      • Size 3.5MB
                                                                                                                                      • SHA256 b858e0445816ab3c34be195c3dac22fffa45a170349ba3a8bd02e06d65312de4
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      files here are in the lua searchpath.txt
                                                                                                                                      • Path C:\Program Files\Cheat Engine\lua\files here are in the lua searchpath.txt
                                                                                                                                      • Size 142B
                                                                                                                                      • SHA256 3a21d77f86dc718e449c9690035362ea971d55e6ce1bb31f5ec032cb42d02940
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      forEachForm.lua
                                                                                                                                      • Path C:\Program Files\Cheat Engine\lua\forEachForm.lua
                                                                                                                                      • Size 364B
                                                                                                                                      • SHA256 218b459887d23819336482890c2b6a0ad3f2f4ad3359423297f5e46c18ffe071
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      json.lua
                                                                                                                                      • Path C:\Program Files\Cheat Engine\lua\json.lua
                                                                                                                                      • Size 10KB
                                                                                                                                      • SHA256 d937f80c47d79b1a4eccca3bdd8b260ce56bd42dee592e69771fd2c078b19d8b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      luaclient-i386.dll
                                                                                                                                      • Path C:\Program Files\Cheat Engine\luaclient-i386.dll
                                                                                                                                      • Size 197KB
                                                                                                                                      • SHA256 dd07117ed80546f23d37f8023e992de560a1f55a76d1eb6dfd9d55baa5e3dad6
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      luaclient-x86_64.dll
                                                                                                                                      • Path C:\Program Files\Cheat Engine\luaclient-x86_64.dll
                                                                                                                                      • Size 260KB
                                                                                                                                      • SHA256 253d18d0d835f482e6abbaf716855580eb8fe789292c937301e4d60ead29531d
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      vehdebug-i386.dll
                                                                                                                                      • Path C:\Program Files\Cheat Engine\vehdebug-i386.dll
                                                                                                                                      • Size 326KB
                                                                                                                                      • SHA256 cb716753fe77bc54cd42477be9bf4b5bd8120b4255756855f33e4684bdaff6c0
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      vehdebug-x86_64.dll
                                                                                                                                      • Path C:\Program Files\Cheat Engine\vehdebug-x86_64.dll
                                                                                                                                      • Size 415KB
                                                                                                                                      • SHA256 8dfae450e6de868c3b2b5db4483b979216db5d3af46fe57e1d432c198c2c5414
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      winhook-i386.dll
                                                                                                                                      • Path C:\Program Files\Cheat Engine\winhook-i386.dll
                                                                                                                                      • Size 201KB
                                                                                                                                      • SHA256 3cdb85ee83ef12802efdfc9314e863d4696be70530b31e7958c185fc4d6a9b38
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      BookmarkMergedSurfaceOrdering
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                      • Size 6B
                                                                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      f_000010
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
                                                                                                                                      • Size 21KB
                                                                                                                                      • SHA256 ef5987a65de60c15084f58eb14943fe3d9ff412f5f67134dad7b0903ad02503a
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      f_000045
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000045
                                                                                                                                      • Size 373KB
                                                                                                                                      • SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      f_000046
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000046
                                                                                                                                      • Size 39KB
                                                                                                                                      • SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      f_000047
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000047
                                                                                                                                      • Size 51KB
                                                                                                                                      • SHA256 f77f9d2e6f7a8079e3d33cc955ca6cede253ffc840f15c6b63ae47b169ab829e
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      temp-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                      • Size 3KB
                                                                                                                                      • SHA256 fbfa223270e466ea861e6d3ad7f020057d557bafc1d696f11cdaa32aca29f434
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 0251b7834ea4bc742c5cf1b1e7f2b5f449db38edd82a3e62a8cbfea4147951ea
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                      • Size 3KB
                                                                                                                                      • SHA256 8be7101c09cce6df4d2811d7685c11cbc6e98e66f43a205036965f3acca425d3
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                      • Size 4KB
                                                                                                                                      • SHA256 601c4d5b810834692cd2cba5c81041b8c6e251573e31f0dda1f0d7f016d29ea9
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 799d709f508c20e1499a01ab6b689e48c54b6e6c933eae69e6704216f2c16ef0
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      messages.json
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                                                                                      • Size 593B
                                                                                                                                      • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      craw_background.js
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                                                                                      • Size 531KB
                                                                                                                                      • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      CURRENT
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                                                                                                                      • Size 16B
                                                                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      1f605168-d652-430d-b185-2b129912de17.tmp
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1f605168-d652-430d-b185-2b129912de17.tmp
                                                                                                                                      • Size 15KB
                                                                                                                                      • SHA256 92930452dedc28769627d71819102572ed9c9b384e1f452eb5828f0333cc5eee
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Network Persistent State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                      • Size 22KB
                                                                                                                                      • SHA256 55f7a65fd49baa680d06aa3006fa24adf8a280bccb4789634f1f2666435ecc13
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Network Persistent State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                      • Size 25KB
                                                                                                                                      • SHA256 b41182f31813486dce502e9826b5b2825f088daddac09277560228a1b7c0b772
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      SCT Auditing Pending Reports
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                      • Size 2B
                                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 12KB
                                                                                                                                      • SHA256 561bb31affc57aa82e7e7386a1cd778de9f7c7e14a847bc65447724d10a90fc1
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 11KB
                                                                                                                                      • SHA256 7c1d9401c10b649510dd418bd86635277385295fa05ee4c03320e1a874751c22
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 13KB
                                                                                                                                      • SHA256 9da3f14792005b9fd92003380b187907d8a6a5d164420f5f8b0c131aaedca653
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 13KB
                                                                                                                                      • SHA256 f4b6678d04d710215b5a79050f197ed427373917867580d303f5aa1cb7237c70
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 13KB
                                                                                                                                      • SHA256 9d0af5c71f16264679702c1d97f020dfe13131eb190d11485f43b7b964f3284b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 11KB
                                                                                                                                      • SHA256 e6b14d3183b370f4a56f470aaf4bb999327d98e9968af46971cfdb0a43e10da5
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 12KB
                                                                                                                                      • SHA256 25f1c17afe1bee580b66789144abca0afd0c3719999926669417f8ef3d7483d8
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      • Size 12KB
                                                                                                                                      • SHA256 d741f2cce3e917679d4ac3b619b51d197e84a299225b772fe718d7aea9cd776b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Secure Preferences
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                      • Size 13KB
                                                                                                                                      • SHA256 df108bd79c804f9b494c56c551433fc3c78c42e4e5fe8bdced6539e82f7cce1d
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      f1cdccba37924bda_0
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
                                                                                                                                      • Size 166KB
                                                                                                                                      • SHA256 a8b248b140c867234a4c3d59503e2839a391a5e72f3ad39f733a77b9eb491cf4
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                      • Size 120B
                                                                                                                                      • SHA256 17f42e6b61828758e73d4da9362d08bd1ba3ad39933e2a6bcf11b9be45e40c3e
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                      • Size 72B
                                                                                                                                      • SHA256 d2067ce072d4436d0fc8e35842e0ccf50603f101b22ab85834302ebca39f5ef6
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                                                                      • Size 72B
                                                                                                                                      • SHA256 5b30723d766525587adea2aff2e7a394db0e5e87afb2d0811bebcc02bbdf9f18
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      the-real-index~RFe59b5f8.TMP
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59b5f8.TMP
                                                                                                                                      • Size 48B
                                                                                                                                      • SHA256 96ee50bb6a462ce961a0e4290eb5b7fac5cd8dd97a10475bc48ab8bca0211cc0
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      data_0
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
                                                                                                                                      • Size 8KB
                                                                                                                                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                      Submit Download

                                                                                                                                      data_1
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
                                                                                                                                      • Size 264KB
                                                                                                                                      • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                      Submit Download

                                                                                                                                      data_2
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
                                                                                                                                      • Size 8KB
                                                                                                                                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                      Submit Download

                                                                                                                                      data_3
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
                                                                                                                                      • Size 8KB
                                                                                                                                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                      Submit Download

                                                                                                                                      MANIFEST-000001
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                                                                                                                      • Size 41B
                                                                                                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      index.txt
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
                                                                                                                                      • Size 150B
                                                                                                                                      • SHA256 ebdbfe93c35fe53611ab95df6fdb68c50da5f0bcd0cc09865d02e4a755f8f1c1
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      index.txt~RFe5ae253.TMP
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5ae253.TMP
                                                                                                                                      • Size 157B
                                                                                                                                      • SHA256 b5562cffc83a70c121168404d180a51b87497a346290a3ca8e625c77202e5910
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 122KB
                                                                                                                                      • SHA256 0fb5e78ff836f061661ff0e8b884864737de7eda1bbebf0b368de990c4f864f7
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 122KB
                                                                                                                                      • SHA256 62f64f67be7784aec485768a28d780c43399d857ed70f3b92bfc2b6356becad8
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 157KB
                                                                                                                                      • SHA256 00538ebf379826051676c033f516c180ce12ccd675b24300eadcb8fba7a71f65
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 122KB
                                                                                                                                      • SHA256 58fb0ffbc24cd782684c1f09faa6f9328938e8b1f6ea452342d4aa24f45cdcc5
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 4KB
                                                                                                                                      • SHA256 7600d414eb771e7d23ab77b23932325b56e62fd59b9c6cf8b543f074e7232b18
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 121KB
                                                                                                                                      • SHA256 c860a22e326a0594d79b5b76bb9ece4a78dc10978e648b0067ca28bd7dc0b069
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Local State
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                      • Size 121KB
                                                                                                                                      • SHA256 8faaeee4443b6699d72e38ee79e5ccaa4d8a7fa6a2deed42e4d4a48418f9a42c
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      prep_Activatable Class_Hermes_perf.cache
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                      • Size 599B
                                                                                                                                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      CheatEngine77.tmp
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-D8YYCMLSRW.tmp\CheatEngine77.tmp
                                                                                                                                      • Size 4.2MB
                                                                                                                                      • SHA256 07eea42af4d565d09ce6c8723211e96a835400060dc90e53a6bac21b2fd3da42
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      CheatEngine77.tmp
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-EE73O.tmp\CheatEngine77.tmp
                                                                                                                                      • Size 3.5MB
                                                                                                                                      • SHA256 ce70cab18db2e2038dcec0edceb1038a37d3851bc3d77dee3dd7e583ac37792b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Avast_One.png
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-HVU5CYT5DU.tmp\Avast_One.png
                                                                                                                                      • Size 42KB
                                                                                                                                      • SHA256 2ddd50ca3bb30387c309b0a627cc14f2820352679caa1d59f0dd35aed9540453
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      CheatEngine77.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-HVU5CYT5DU.tmp\CheatEngine77.exe
                                                                                                                                      • Size 33.1MB
                                                                                                                                      • SHA256 cf0f4b6002555677984233c95856683959be83a5def3dc12175a8296eb22676b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Opera_new.png
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-HVU5CYT5DU.tmp\Opera_new.png
                                                                                                                                      • Size 51KB
                                                                                                                                      • SHA256 3f63f320e919830fb21fff8dbd82509ecc8330c89513163daedb1b7687a0a529
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      WebAdvisor.png
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-HVU5CYT5DU.tmp\WebAdvisor.png
                                                                                                                                      • Size 47KB
                                                                                                                                      • SHA256 0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      finish.png
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-HVU5CYT5DU.tmp\finish.png
                                                                                                                                      • Size 248KB
                                                                                                                                      • SHA256 41031efc4f7e322dc5ffacc94b9296fb28b9b922b1ce3b3da13bf659a5fd2985
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      logo.png
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-HVU5CYT5DU.tmp\logo.png
                                                                                                                                      • Size 248KB
                                                                                                                                      • SHA256 8c5c80bbc6b0fdb367eab1253517d8b156c85545a2d37d1ee4b78f3041d9b5db
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      zbShieldUtils.dll
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-HVU5CYT5DU.tmp\zbShieldUtils.dll
                                                                                                                                      • Size 2.0MB
                                                                                                                                      • SHA256 976d070339c1ecd80d0d2ded8f2c3fd1c6ec03f408053470f696066c2bb2b738
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _setup64.tmp
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-UEVEF.tmp\_isetup\_setup64.tmp
                                                                                                                                      • Size 6KB
                                                                                                                                      • SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      messages.json
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5932_1890121075\CRX_INSTALL\_locales\en\messages.json
                                                                                                                                      • Size 450B
                                                                                                                                      • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Unconfirmed 43244.crdownload
                                                                                                                                      • Path C:\Users\Admin\Downloads\Unconfirmed 43244.crdownload
                                                                                                                                      • Size 6.6MB
                                                                                                                                      • SHA256 b44726bbbe83c21042a4d70d591128e8dc00c7641cc22fcfb6ed7b75e7e1cc16
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      memory/752-2557-0x000002330B950000-0x000002330BA50000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/752-2569-0x000002330BDB0000-0x000002330BDD0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/752-2597-0x000002330BD10000-0x000002330BD30000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/752-2556-0x000002330B790000-0x000002330B7B0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/752-2532-0x0000022B001E0000-0x0000022B002E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2784-2350-0x0000000000680000-0x0000000000769000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2784-903-0x0000000000680000-0x0000000000769000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2784-877-0x0000000000680000-0x0000000000769000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2988-2157-0x0000000000CC0000-0x0000000001048000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2988-2137-0x0000000000CC0000-0x0000000001048000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4492-2186-0x0000000000410000-0x000000000085B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4492-918-0x0000000006050000-0x0000000006190000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4492-901-0x0000000006050000-0x0000000006190000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4492-2162-0x0000000006050000-0x0000000006190000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4492-2349-0x0000000000410000-0x000000000085B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4492-934-0x0000000000410000-0x000000000085B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4492-947-0x0000000000410000-0x000000000085B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4492-975-0x0000000006050000-0x0000000006190000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4492-970-0x0000000006050000-0x0000000006190000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4492-987-0x0000000000410000-0x000000000085B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4496-2158-0x0000000000430000-0x0000000000514000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4496-1017-0x0000000000430000-0x0000000000514000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4496-983-0x0000000000430000-0x0000000000514000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-6-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-18-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-4-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-0-0x00007FF845DBF000-0x00007FF845DC0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-5-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-3-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-17-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-1-0x000001764FF30000-0x000001764FF5A000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-2-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-25-0x0000017E6EC50000-0x0000017E6F3F6000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-38-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-39-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-40-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-41-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5156-43-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
                                                                                                                                      Download