6554960b5f5295deb917cae80835becbff29df6468574f9d898ed35c1fa9065a

Analysis

max time kernel
63s
max time network
57s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Size 4.2MB
Sample260721-shpdaaydrd
SHA256 6554960b5f5295deb917cae80835becbff29df6468574f9d898ed35c1fa9065a
MD5 a91512da09e0b62f9a3765a17636def6
SHA1 2cbf7ecf447c8da93acefa788265f7bcfe9a3775
SHA512 baf0d489088ef631d9182f3bd7aace25bc50e05c2eae3d345b8853b7ee4e7cc8db3330c31280242d0a4727c8ae3b875ebd5803c50064d1fce1638648424dbbe8
SSDEEP 98304:BxBWRsTTGC6aiOFCzfLs/y4gJUDpzJByw4TeIAScE:BxBWR4GCp8TrUDpDyw4
TLSH
T17B163355FE40863FE91209B15A64C12347B5FA323931E857B3E90BAE4FB3BD01A79316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3308	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe

Loads dropped DLL 1 IoCs

pid	Process
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe

Drops file in System32 directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\imm32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\system32\shfolder.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\TextShaping.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\shcore.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\profapi.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\CFGMGR32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\imagehlp.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\shell32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\SHLWAPI.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\system32\uxtheme.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\Dbghelp.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\KERNELBASE.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\advapi32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\apphelp.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\GDI32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\combase.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\ole32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\dxcore.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\psapi.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\win32u.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\SYSTEM32\winmm.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\user32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
File opened for modification	C:\Windows\System32\sechost.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\comctl32.dll	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2824	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2768	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291200813330992"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{A01ECF87-F5E9-49D0-ACD1-3ACE70655F5F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: SeLoadDriverPrivilege	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: SeCreateGlobalPrivilege	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: SeLockMemoryPrivilege	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: 33	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: SeSecurityPrivilege	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: SeTakeOwnershipPrivilege	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: SeManageVolumePrivilege	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: SeBackupPrivilege	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: SeCreatePagefilePrivilege	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: SeShutdownPrivilege	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: SeRestorePrivilege	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: 33	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Token: SeIncBasePriorityPrivilege	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
3444	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 3308	2260	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe	88
PID 3308 wrote to memory of 1412	3308	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe	90
PID 1412 wrote to memory of 2824	1412	Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe	91
PID 2824 wrote to memory of 3444	2824	cmd.exe	93
PID 3444 wrote to memory of 5096	3444	msedge.exe	94
PID 3444 wrote to memory of 2608	3444	msedge.exe	96
PID 3444 wrote to memory of 2768	3444	msedge.exe	95
PID 3444 wrote to memory of 2608	3444	msedge.exe	96
PID 3444 wrote to memory of 2608	3444	msedge.exe	96
PID 3444 wrote to memory of 4312	3444	msedge.exe	97
PID 3444 wrote to memory of 4312	3444	msedge.exe	97
PID 3444 wrote to memory of 4348	3444	msedge.exe	99
PID 3444 wrote to memory of 4348	3444	msedge.exe	99
PID 3444 wrote to memory of 4348	3444	msedge.exe	99
PID 3444 wrote to memory of 5716	3444	msedge.exe	100
PID 3444 wrote to memory of 5716	3444	msedge.exe	100
PID 3444 wrote to memory of 5716	3444	msedge.exe	100
PID 3444 wrote to memory of 4284	3444	msedge.exe	101
PID 3444 wrote to memory of 5500	3444	msedge.exe	102
PID 3444 wrote to memory of 4284	3444	msedge.exe	101
PID 3444 wrote to memory of 4284	3444	msedge.exe	101
PID 3444 wrote to memory of 5500	3444	msedge.exe	102
PID 3444 wrote to memory of 5500	3444	msedge.exe	102
PID 3444 wrote to memory of 3424	3444	msedge.exe	104
PID 3444 wrote to memory of 3424	3444	msedge.exe	104
PID 3444 wrote to memory of 3424	3444	msedge.exe	104
PID 3444 wrote to memory of 2348	3444	msedge.exe	105
PID 3444 wrote to memory of 2348	3444	msedge.exe	105
PID 3444 wrote to memory of 3340	3444	msedge.exe	106
PID 3444 wrote to memory of 3340	3444	msedge.exe	106
PID 3444 wrote to memory of 4444	3444	msedge.exe	107
PID 3444 wrote to memory of 4444	3444	msedge.exe	107
PID 3444 wrote to memory of 4676	3444	msedge.exe	109
PID 3444 wrote to memory of 3168	3444	msedge.exe	110
PID 3444 wrote to memory of 3168	3444	msedge.exe	110
PID 3444 wrote to memory of 6108	3444	msedge.exe	112
PID 3444 wrote to memory of 6108	3444	msedge.exe	112
PID 3444 wrote to memory of 4724	3444	msedge.exe	115
PID 3444 wrote to memory of 256	3444	msedge.exe	116
PID 3444 wrote to memory of 5884	3444	msedge.exe	117

C:\Users\Admin\AppData\Local\Temp\Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
"C:\Users\Admin\AppData\Local\Temp\Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3908.tmp\Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
  "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3908.tmp\Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3908.tmp\extracted\Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
    "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3908.tmp\extracted\Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe" "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3908.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start http://mrantifun.net/
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mrantifun.net/
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe609ec188,0x7ffe609ec194,0x7ffe609ec1a0
        6⤵
        
        PID:5096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,276076311215244171,15971285178126207470,524288 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:2768
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,8857001437781234626,220202919321039203,262144 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
        6⤵
        
        PID:2608
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,1752033446212650572,5579800307716571061,524288 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
        6⤵
        
        PID:4312
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,7207807744771342958,7594795416031028798,2097152 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        6⤵
        
        PID:4348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,1826069118372135390,5353593913988301962,2097152 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        6⤵
        
        PID:5716
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,8337355642929375695,3439699858117550538,2097152 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
        6⤵
        
        PID:4284
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,14429995097656539336,646910510630269244,2097152 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:9
        6⤵
        
        PID:5500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5284,i,9111946721259243698,11245180720477018943,2097152 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
        6⤵
        
        PID:3424
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,6224614669058382994,16436567462423177329,524288 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
        6⤵
        
        PID:2348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,17675237333058274906,2734739652296733972,524288 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
        6⤵
        
        PID:3340
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,1977023649561346836,8964692235196463616,524288 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
        6⤵
        
        PID:4444
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,17237774784061575256,3396876844453268494,524288 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
        6⤵
        
        PID:3388
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,17237774784061575256,3396876844453268494,524288 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
        6⤵
        
        PID:4676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,18327128069929566219,13356293234167445065,524288 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
        6⤵
        
        PID:3168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,9234771351913538626,1301688142824844234,524288 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
        6⤵
        
        PID:6108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,6712545722547995765,5818105115583767165,524288 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
        6⤵
        
        PID:4724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,3996483382524957773,842573018377626712,524288 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
        6⤵
        
        PID:256
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,4691973691944450009,4132420089532532460,524288 --field-trial-handle=2220,i,13851883284893077601,13912305162479828146,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
        6⤵
        
        PID:5884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

1002c7d5-9bb0-42c9-9b8c-97a58d3ab878.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1002c7d5-9bb0-42c9-9b8c-97a58d3ab878.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 456be3a9b2b8998c8a5748b258b0856e4cdcdc305d6187367d93946b07e87c27
MD5 8c9fd2b2731c2a0b61562873ac387314
SHA1 5d12a8c0286a3000757a69b9c36b2794481b1e66
SHA512 e008f0e58163265ac5f9831a9dcb1adbc960cda77db0422f442eedf1a4750588db90ee066fb14d319939d187b0fcf03aaccb625fa322612b35c52d13c5997a0b
TLSH
T19C41647823AC29CAE3569DF320F74598B2F0AA1A650F7F02CAA82DB9CC96F5401D0013
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b740.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b740.TMP
Size 1KB
SHA256 62492dba87106c631b42b2d25e9879f355e305382d28d0a8065b51b65b8be6f8
MD5 a6ee97ab86964f12bf82ef8ddf6486a5
SHA1 ed4fdfce817313ffc671044fa1c37239cf19cbdd
SHA512 f9a5e478e8e695ceaee60af86f5f9b2f5b561e95f515ab1ed555d17cf94b4387e63ab9f192b982d80fb216652f2cbd1b619859f0f328f06b36fa4d1b4e16af8f
TLSH
T1C84131BC23AD28CAD766ACF324F74598B2F1A64A650F7F42C9692DB9CDD5F1410C0153
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4369144b-5a21-406e-a933-1c0a42443980.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4369144b-5a21-406e-a933-1c0a42443980.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1c9056f93d7739f53ceb517759b430f8b5fb13fd51e31ad9f2498f500f6e01b5
MD5 26ef2303245ae166000961cdd1b81bf6
SHA1 d54b9089e4fea5ab140c08b382cf645aca893fa1
SHA512 7f195fe0012bc027e0876adcfe8de9043013a7bee01bff6118f0828a89625b5aeba7549816f46207e06ae5f96bd33921a21b69f3e3597866e0043cff78b5b48c
SSDEEP 192:sxR2RRCC/feskx0ZgTDzoD8pjV/g6+WNzLn4/hjJCnuOc+GCIgtJ:sxR2eC/feskxKo5/5v4/ucs3
TLSH
T18742C716AE68A93B5CCBE20DBA65BF53D2F95032E1D41E54A6FC860C14EA6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e1c2089f8745cd18b570e5425d901150a488d82a71fc22f57cd6b8347e909a0b
MD5 93e40508ef7ef6e4682c2e10c0ef0c3e
SHA1 8ae3c819de9bcf4a19e2a9701310e57961e8470b
SHA512 49675a78fc58994626c60e35ac4ebd18ef95a0ac5503cd5a4b92f33d68765cfaa79c888cf8765254f6c808156c12d848385f2beecece0702deec92b2e4749129
SSDEEP 192:sxRpRRCC/fesT60ZgTDzoD8pjV/g6+WNzLn4/hjJCEuOc+GCIgDKJ:sxRpeC/fesT6Ko5/5v4/lcsS
TLSH
T1C142B616A968A93B6CCBE20DBA55BF53D2F95032E1941E54A7FC870C18EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 95e3090f037b1d5e55bf2f2ad4a6d3941db90cce663a9506d009cf75ae64c6ea
MD5 39924337402158c527937711a291b80c
SHA1 e44ef1c133b3dce22bcb3213dc84a742e066efeb
SHA512 601843b8c53b52e4fa0514019201671eef2f654b478fa046696c617396d8919599a2bed120ca320c21e46f276fdb62bb7101022e4c063d9209f5f253546a5554
SSDEEP 192:sxRpRRCC/fesTx0ZgTDzoD8pjV/g6+WNzLn4/hjJCnuOc+GCIgDkJ:sxRpeC/fesTxKo5/5v4/ucs0
TLSH
T1B542C616AE68A93B5CCBE20DBA55BF53D2F95032E1D41E54A7FC870C18EA6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 1217b344260d6b02407909fda0e91100e28cd74b2d69dbf8b439082e4f9bb8f3
MD5 48f8cac50c648a089e238d2dfa1d0a47
SHA1 332fa63aecc35df3c95b752aa8bfefcc22cb74e5
SHA512 f3a19bd9870cc5c6d181ad15f252ed3ad38cc23ad62ebd5c2e4669fabf64e9dbc475d20e679c87fc5c08b01300cf7b46f2f87c7df349d708a3526e2458151a9d
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUtDQqc5roZb:jC+vf7E7JQWgQ+f4+u1jartDVcy1
TLSH
T126D2EA7B640DCB7F4F804ADDEC197E9A6DA802CB9698CD5047FE841C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a3d7833f108992ee05ac47ddc9f1b240200bcf4a\679b6031-85ed-46bc-b287-09eada9b6481\index-dir\the-real-index
Size 72B
SHA256 c722bd1d74985c59bd532d476cc59bd931ea679917c911df93f207a381003d16
MD5 b7bfeef3cd8028b75572c0e9bfc53fba
SHA1 f7cbf68a613f61fc45ab5250db93cb61f2ed6e72
SHA512 9d2fa7951bbe5e57b082f9589a008af3cc3f75c611110933f85a914b496c8150f535536a63c29792c7e61f4dae6954022f5d98c1a936e51e40840d0a7de6eb92
TLSH
T107A002599F466406C830A3B1D04B25403715C8511722524250D204599C741914503083
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a32c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a3d7833f108992ee05ac47ddc9f1b240200bcf4a\679b6031-85ed-46bc-b287-09eada9b6481\index-dir\the-real-index~RFe59a32c.TMP
Size 48B
SHA256 839360df7bf6945f19d153bd4299f46cd08e7730038cd2aa615f919cee002dd3
MD5 4e23f93fe35350fc8f2080aac688b070
SHA1 c419075fb6834107b4e08b0b804a98ee78cedec3
SHA512 8f1694a516d732b3a94a5e4327af465e79015d9bc734b54314bf35b2b8029cdd04e197f6dade55b7e6d4353ff3669130e10ae1f5d86e8f5718bdb693a78afb95
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a3d7833f108992ee05ac47ddc9f1b240200bcf4a\index.txt
Size 133B
SHA256 e18a324e8ff68777205716317b0d112725133aea549281b4ac7b38c03405539a
MD5 10b27d6b4d188e62d98abd7ac2ef75d7
SHA1 9c1e12049ec3dc908d32b444a1cb7f58989b1f70
SHA512 7992c13790c2159e445e6a50233a9d7276a15222d846fde92d530949f9f2b10c5eb0b01954ac9ef855ea6fd903ac0905a63729fc52619a2a02ed0e92ff5443d3
TLSH
T189C02B6B001216CC0F00AB614C40201CC623E1D08048CB0CCCD00C18E89F024AE8BF44
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59a35a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a3d7833f108992ee05ac47ddc9f1b240200bcf4a\index.txt~RFe59a35a.TMP
Size 139B
SHA256 146231c5b3cc6d7e9bf9f284a5fe88c28e6254d239d3d141af81b0457ba91a2b
MD5 565778c8a2f7feaf7753f32dbf623ef3
SHA1 4275c301f3d5fc8e4dbcbb272757a498b5ddaa25
SHA512 446ae6a6263872a50838578c2d99c5f83e9e3ea917f8b7717461fbd5f3d6fed67d0a1085c9d6e45f5ab4ce9251d38985eb77a035948b6d2c8dc0cae92154a22c
TLSH
T18EC08C6700221A880B005B518C54205DC633EDA08408CB0CCC902818A87F0249B89F44
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b49e67710f1b8ea530566789f6478a56349073b62ac28d0601b4b7b67e211b4b
MD5 0e4f5029e564b21c690f953cef8e29e5
SHA1 49790216fa8117679414b5efd4e514d1eaf1f85e
SHA512 34a2c1f27e8c0ce97523fced59601cc5249e43a488151fd72eb8408073021f62d215a021821f5d16139d493d9e7e8d6990c174e9b33149de87b38150296698df
TLSH
T1FBA002D441435CD7C05047F3218501457250CF308591A6A2C1AC004DEC721906105000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a109.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a109.TMP
Size 48B
SHA256 38f57022f646e23e149ae08abf1ac8e9599faaa997d2380bb64bcd5a031a027e
MD5 2e4439c417940ea590da68beed1ba0d9
SHA1 e5cf3dadd9fd677f88dcdd4874af4bb35db8d1b7
SHA512 4d17391edddb0c05462af60ebc2410a92bdc2cd3a973bf39997d26ec925bf2e1a880b9da028dbc90fd2ee620ee5c72f5f587d8b80b940ad1a6f9475d1b239909
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d87160e8d0a8f0d94e3aa7a4626a06b68daed45f99ced09e054bc5c736bb3900
MD5 5f9276c37b782604cd160e28694cb916
SHA1 8f2f1e4f628e8b40d3143570338ebe7e27d46e1a
SHA512 249ce56be6f3a23e41fc96e51948132e96d3c2c15b154fc95761d13463ca09ec97d68520ee61234c35a09aed9e91df5f62620a520ca3c052ccc2df4aa5cd2955
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHLURlTp5FWtC4gNFK40gjFcrz8fnAHRu/q:CbEBVj5JAdSp9/EgTK7j6dJOHLURlTpg
TLSH
T1C0912340313A1241383DB60C81B98C2E96C57472746EA56F3FA942B61F2BE43ADFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8bc85a730051c4d7b772bae233e87cbb67de358ca4a319b3aa9efcf9654a4e53
MD5 1a29984022df218c12483f941fe20eef
SHA1 1467d3140136f09ff6c24f2b22f3a42c5c6bd864
SHA512 dfdeac8d9b1944cb7b73a35e5978ef6b847f5f6c803474fd8cb120ddf4eed2ca8931f68415232e53e41d9dccbcd83d5ee2ccd8219d20fa8f34c631a624c4b96b
SSDEEP 768:mj+9B3FXzskDNp8+p3bd66j+4BRv86aLIW87MVcLCO7w/C:19B3HL8+p3Z6n4yK7HCt/C
TLSH
T11DF2AE75E8AADD339CE9D748B25337876FF454A389C00D94E8DD6F0D108B29E1B0782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5a5f263a7406b985a7a3dd3ac756c503618ea9a36c4777b271a8514c00fc9abe
MD5 e58ad6422f38bacd089450ac10814725
SHA1 dc56973f6f77652565768539b0bf89609b032f3a
SHA512 82baeaf8e4cc8f4b4826bf7033f48660dae00c68be5ceea0feb6b3f8bdeac515c21e0d50323a918d5588eaef5378f2e749688783b992426ff0be0c35e98a214c
SSDEEP 768:Mj+9B3gXzskDNp8+p3bd66j+4BRv86aLIW87MVcLCO7w/C:L9B3uL8+p3Z6n4yK7HCt/C
TLSH
T112F2AE75E8AADD339CE9D748B25337876FF454A389C00D94E8DD6F0D108B29E1B0782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 21dfb840f0ff3b44cb9b34336fb0373ef7c23c617fb0e2233aef1526cd931afb
MD5 c6a0ed34a832c8955fe20d1335d58185
SHA1 7f25aaef920e7b8cc4019f1272e2891a9398f1d7
SHA512 14475675f75ad707a4b40ab784df826746361c62399a6f48888e6c5a028577faceb28507310a7afbb43aeb0c49bff1bbdfa2f82114f415be02e0798993d81bcd
SSDEEP 768:vrv+4UNbdP3gXXskDNp8+p3bd66j+4BRv86aLIW87MVcLCO7w/+:vbsbF3eL8+p3Z6n4yK7HCt/+
TLSH
T1C213BF72F4A9DD339CFAE644B14337837FF854A389C00E94E4D96B4D118A19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7c591ca69ae28f6a12daf031f8b5c4743bc396515c2363ffad2ebe766f632e8a
MD5 934ffd271b8da97347a1dfee214c9049
SHA1 0599e718a58549ef6dc26f3a6e9f12aead6f11c9
SHA512 fea19e5fd2997b83e545e1d69cdd6e982e3f61759d9d22e7e514c31167b8971047e9d7ec67b736bdd969e38c014c40e7ca2d82793dd95c3fc508e5f55106f503
SSDEEP 768:Irv+4UNbdD3CcnNp8+p3bd66j+4BRv86aLIiI2bwCl1:Ibsbp3FL8+p3Z6n4y60ww
TLSH
T17303CE73F9A899339CF6C644B2467B437FF851A396C10AC4D4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

667148bc-03c9-4efb-abd2-a1f73d92a7e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\667148bc-03c9-4efb-abd2-a1f73d92a7e4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CET_Archive.dat

Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3908.tmp\CET_Archive.dat
Size 3.9MB
SHA256 7501d33c12595cc26eb02c8d94c315d038cb57e7ec329e94cf509edf48749864
MD5 023a03ea07a42d4c7eb0d17221a9fd62
SHA1 24f912c50c2a90839686f3e6a565d27458c13e1a
SHA512 b8f5d31c386d63bee9f4de2aa6caee69cd6143e37a86fe24502e7aad94d158d53262ed01632389f60a4f097a533fdfbd729dce52d7d20e1c0ea241fec2175c30
SSDEEP 98304:jxBWRsTTGC6aiOFCzfLs/y4gJUDpzJByw4TeIAScEX:jxBWR4GCp8TrUDpDyw4x
TLSH
T1FB16338CD8546E2EB47A4D77A730841381E1ECD762B3AC6243FA15E10F93FBC06E955A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe

Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3908.tmp\Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Size 196KB
SHA256 65cbed2e8db313b8966638e40eb27f94156c294eb060b28a02c130d146518c39
MD5 808de473370ef6b5d98ab752f245a3ca
SHA1 800bd4ad10c17471829693fac3cee4502b14f029
SHA512 fafaff03ad502523b3627e59e1026b8af4217a80215782a90667bc4f4c330871d8c3d890f2601b68ec9a42c0171d12b9e5b87067c95dcad1132b0a8979c56a4c
SSDEEP 3072:WkHnWPw0GnbgoCxI+HRoEp51jdnRNuCQJYgl/Ftgpu5ivZ2in:x240Gnbgog37uCQJYgNPgV2E
TLSH
T174145B62BF40823BDA424AF14AC985A71775B3353C30D09776E90F6EABB36826F35351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CET_TRAINER.CETRAINER

Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3908.tmp\extracted\CET_TRAINER.CETRAINER
Size 295KB
SHA256 bd6492caa0a4e98d97f6083bfb6bae0ef158e6e9e07eb426fad1632cd9c9327d
MD5 e2e71d6b3c2917a63db82950d769e1ac
SHA1 73c8ac13edb90f9bfa64f434822fa26e7e52cb33
SHA512 fe42f9c444f2fee5c78805983fdd7660ff564c9e6153df6a647119580c98bdc07bc6c8d6d84fb4828d21d955a92368bc9b37190c7066059aec78994176d5e0bf
SSDEEP 6144:LeUC5c3Qe4CXniXVNY5/LEljqLrDpw3Z9HcKLKLEfs1apgjfq0:LeZgQe4CXnilNYNElQrQ9rL+E01Drq0
TLSH
T1385423732A61FF2F91B889A13A47C0331D724B867D64BB378BB408F904823415F72E96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe

Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3908.tmp\extracted\Call of Duty Black Ops 3 V1.00 Trainer +3 MrAntiFun.exe
Size 10.1MB
SHA256 0514a3663ddb100b275926305cbc6db6ebf2ffef8a28b9541a67734832d30ecc
MD5 cdb6a647dcfe6c832ae3778ecb2ac7e5
SHA1 bdfca616a53175ccc9d2adc554e3cae89a3e4cee
SHA512 c66bbe4f30d66e7a142b1b012f50b06896973842e294522e530b381f99c8ed4379c4c6c6d8734f991e7ef392361f800012e3f6d17d50f47a175a4ccff937d92c
SSDEEP 98304:kfgo/Nw1oSPJeTEGLzgsqPDb1/8bO1jBqRbykEHgEnoSE5:Sgo/NWfP4TEGLzgsqPDZ/X1N4bQ
TLSH
T145B61ABB7152CAD9C0CAC67658C7CAF15A31BD1448B5124733D5371FAFBA8801E9A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defines.lua

Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3908.tmp\extracted\defines.lua
Size 5KB
SHA256 d4347332b232622283e7dd3781f64966bd1097d06cca7052b467cf99e62898f2
MD5 d8f9b4a10a48ebd8936255f6215c8a43
SHA1 7d8ff0012fa9d9dcf189c6df963f1c627f2ccb76
SHA512 67db5dc65fef66fe3a1920c5f406091d17eeae27266039af392a166d63686b8fc61b94684f2b97762995aefa42d2d15148213ecef64cc0df04de19320abba97a
SSDEEP 96:0egFBuderGTd44i4B9yHSKkuK8u2wiM28nXDxfbLmjWrpcSC6OvuLCkYQLRLb+/:0egHuderGTd4G9mSKk/8fdtINfbLmiFk
TLSH
T134B1B55B1D07521F027227A79AC655808BC8CE3D84A42973B75B5C3E7C4B46DABE23EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.1-64.dll

Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET3908.tmp\extracted\lua5.1-64.dll
Size 340KB
SHA256 1cb952ca2bcd5646164ae0d1415de6b6bd1841de4609481716fcc67bbb6d872e
MD5 32718a4ec812b81fd70d4246a94c8731
SHA1 5f5fc4855240a3971bb1dee238793334b16dec51
SHA512 a593a5906e4eb75197a01414a1e0bcaaf3309022d76139525507725ae4404836d262ce6ab4100a7ce0d8f9cb282eafc555041f83a60bd8aabf54a35a82a73941
SSDEEP 6144:RUzKhiK8Xl94sj2SekxJ9scTQsdgKA55j/cwIPUwEnBhGS:Rrijl9fK4gKsKtEBhG
TLSH
T193747E59B36108B8C4B7D079C9A25657E7F1781907B087EF16E44B926F33BE16A3B302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3444_611290982\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1412-231-0x0000000009BC0000-0x0000000009BC1000-memory.dmp

Download

memory/1412-20-0x0000000009BC0000-0x0000000009BC1000-memory.dmp

Download