Overview

overview

7

Static

static

3

Saints Row...un.exe

windows10-2004-x64

7

Saints Row...un.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    66s
  • max time network
    60s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/08/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Saints Row Gat out of Hell V1.00 Trainer +9 MrAntiFun.exe
  • Size 4.1MB
  • Sample260807-sdxtvsxgjg
  • SHA256 d734db08ce49a61db65e0478b05aba19871864d937561c75523d747e1fc6cbc5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 44 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Saints Row Gat out of Hell V1.00 Trainer +9 MrAntiFun.exe
    "C:\Users\Admin\AppData\Local\Temp\Saints Row Gat out of Hell V1.00 Trainer +9 MrAntiFun.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:700
    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET142F.tmp\Saints Row Gat out of Hell V1.00 Trainer +9 MrAntiFun.exe
      "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET142F.tmp\Saints Row Gat out of Hell V1.00 Trainer +9 MrAntiFun.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET142F.tmp\extracted\Saints Row Gat out of Hell V1.00 Trainer +9 MrAntiFun.exe
        "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET142F.tmp\extracted\Saints Row Gat out of Hell V1.00 Trainer +9 MrAntiFun.exe" "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET142F.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:872
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c start http://mrantifun.net
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3276
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mrantifun.net/
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4232
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://mrantifun.net/
              6⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3504
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ffe71f3c188,0x7ffe71f3c194,0x7ffe71f3c1a0
                7⤵
                  PID:4472
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,16994917586620217201,9570537621744051879,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:3
                  7⤵
                  • System Time Discovery
                  PID:3964
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,17342059207344008815,17958944961753974134,262144 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
                  7⤵
                    PID:3312
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,14264351811337489519,16503023681761709801,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:8
                    7⤵
                      PID:1596
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,3873848908036101764,2078196750369171318,2097152 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
                      7⤵
                        PID:2060
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,1767111009321384798,11464094407368762364,2097152 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
                        7⤵
                          PID:4800
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,201811703488321160,8857885498008641344,2097152 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
                          7⤵
                            PID:3516
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,16738931073274660890,14291138269780511078,2097152 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
                            7⤵
                              PID:2696
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,11611863361177743609,7679642226555981372,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
                              7⤵
                                PID:2008
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5268,i,2426573726031559316,16647660493797477925,2097152 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
                                7⤵
                                  PID:3820
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,6598131898846363239,9906815601092629075,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
                                  7⤵
                                    PID:1636
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,5900348965831399371,5092741987335147237,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
                                    7⤵
                                      PID:4040
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,10063770165831781790,129931192038453659,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
                                      7⤵
                                        PID:440
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,9633884345652547026,1981733306749844971,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
                                        7⤵
                                          PID:2728
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,9633884345652547026,1981733306749844971,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
                                          7⤵
                                            PID:4908
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,3788156867241746456,15974876779333822875,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
                                            7⤵
                                              PID:4416
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,10652091618978186606,84951091959865144,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
                                              7⤵
                                                PID:2672
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,15254305991616701466,7814565797729901889,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
                                                7⤵
                                                  PID:4328
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,17603211114798382103,13495020618842551727,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
                                                  7⤵
                                                    PID:1636
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,16070293407430263173,16086485687217697323,524288 --field-trial-handle=2348,i,10864468111387358920,9193831967646699995,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
                                                    7⤵
                                                      PID:4076
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                          1⤵
                                            PID:1464
                                          • C:\Windows\System32\rundll32.exe
                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                            1⤵
                                              PID:4784

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  590346fa-f30e-487b-a534-226711809fdb.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\590346fa-f30e-487b-a534-226711809fdb.tmp
                                                  • Size 8KB
                                                  • SHA256 7bc9a845cc0d752aae0a972078ea3f4f5a1ce0a60a6e35c1acf3290463cc55a2
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  settings.dat
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                  • Size 280B
                                                  • SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  settings.dat
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                  • Size 280B
                                                  • SHA256 c756e7f0173c2e46dad26d72efbfb0a42b35deefa8d8ed2308e4410b46b600ee
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  settings.dat
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                  • Size 280B
                                                  • SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                  • Size 3KB
                                                  • SHA256 4ec1f6c28a0a23f7c538cda4e5d8aae700001540b60f08385c3c30bc963adebe
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index~RFe5849d5.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5849d5.TMP
                                                  • Size 3KB
                                                  • SHA256 c8b0b669553e2c9606632145d58046c01e19f6922411645f36b71564c6c0d028
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Edge Profile.ico
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                  • Size 70KB
                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Network Persistent State
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                  • Size 3KB
                                                  • SHA256 f2c5f216cee54e7ab08c5b587f58b2fc11a08cc11005f539e1b493b38112fbea
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  SCT Auditing Pending Reports
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                  • Size 2B
                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                  • Size 12KB
                                                  • SHA256 66f31914c521a8b60dcb62f29d4be08ae6969cab3fb1d17df6b2aec13596ec54
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Secure Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                  • Size 32KB
                                                  • SHA256 da4912c5f6829edb6b37404ca48231092f7ec08e6096f0841a33f25171e11798
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  the-real-index
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a3d7833f108992ee05ac47ddc9f1b240200bcf4a\9c7eeb11-7cfc-47f4-b1e4-b36a0aab4b53\index-dir\the-real-index
                                                  • Size 72B
                                                  • SHA256 ab50fbb25a8ccbb2105aa24d0ce2ce6fee0185488dd299275d39a8d27d109858
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index~RFe5849f5.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a3d7833f108992ee05ac47ddc9f1b240200bcf4a\9c7eeb11-7cfc-47f4-b1e4-b36a0aab4b53\index-dir\the-real-index~RFe5849f5.TMP
                                                  • Size 48B
                                                  • SHA256 25d0662186c777141323475f278aeef27ef80e1ff77f3984fa7f148021986b82
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  index.txt
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a3d7833f108992ee05ac47ddc9f1b240200bcf4a\index.txt
                                                  • Size 133B
                                                  • SHA256 78c36478b08753f6b87c8644fbf7a4fb00691170b38a25f0a13ab1302f6ba02f
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  index.txt~RFe5849e5.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a3d7833f108992ee05ac47ddc9f1b240200bcf4a\index.txt~RFe5849e5.TMP
                                                  • Size 139B
                                                  • SHA256 31f0e14021df4030caf26dd39040a4f8e6add9eeb8af514eb52fd178e0d98162
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                  • Size 72B
                                                  • SHA256 92c8d0ba655558e516f1f802bcc0e7dff8976e308360c0bf229a92895a7888e4
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index~RFe5849d5.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5849d5.TMP
                                                  • Size 48B
                                                  • SHA256 c96eacfd026a7b17c113b272c67675964fc9fac42a440cbcc6921d3751abe1ce
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                  • Size 8KB
                                                  • SHA256 5d5bdbb5c0cc04aef63ff0e967ccbc1855799a2998957e586acb30b6c1eec227
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                  • Size 24KB
                                                  • SHA256 c7383ed9f06e0137ee41ee51f051ae8ea9ee2fffde4e3e938689acfe87bc6804
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  data_1
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                  • Size 264KB
                                                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  c46aa62e-4557-4954-aae1-ae796ddde4db.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c46aa62e-4557-4954-aae1-ae796ddde4db.tmp
                                                  • Size 13B
                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                  • Size 2KB
                                                  • SHA256 806d91218b157cb19c54280045b4ee622219f03ee415d61a6864dd085c4c3efc
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  6766a63e-0706-4886-8767-1c5009e14e5d.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\6766a63e-0706-4886-8767-1c5009e14e5d.tmp
                                                  • Size 10KB
                                                  • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  CET_Archive.dat
                                                  • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET142F.tmp\CET_Archive.dat
                                                  • Size 3.7MB
                                                  • SHA256 971604f29ed081c571b5eb9cf46ac22a0611ac041c7913583b1d39582c1c137b
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Saints Row Gat out of Hell V1.00 Trainer +9 MrAntiFun.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET142F.tmp\Saints Row Gat out of Hell V1.00 Trainer +9 MrAntiFun.exe
                                                  • Size 196KB
                                                  • SHA256 65cbed2e8db313b8966638e40eb27f94156c294eb060b28a02c130d146518c39
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  CET_TRAINER.CETRAINER
                                                  • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET142F.tmp\extracted\CET_TRAINER.CETRAINER
                                                  • Size 177KB
                                                  • SHA256 bd40589e487b69a2d1c826af15170a1d71d240cdedc09472911ff81d82426139
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Saints Row Gat out of Hell V1.00 Trainer +9 MrAntiFun.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET142F.tmp\extracted\Saints Row Gat out of Hell V1.00 Trainer +9 MrAntiFun.exe
                                                  • Size 7.4MB
                                                  • SHA256 c53cd508cdf0c218876e6ff23ffa496d51bd7a231e5a64f86ca3af46b0402fbb
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  defines.lua
                                                  • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET142F.tmp\extracted\defines.lua
                                                  • Size 5KB
                                                  • SHA256 d4347332b232622283e7dd3781f64966bd1097d06cca7052b467cf99e62898f2
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  lua5.1-32.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET142F.tmp\extracted\lua5.1-32.dll
                                                  • Size 329KB
                                                  • SHA256 faf0850051ba175347e40481da9e2cc3a122a09d428925042932be555db06e6b
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  dbghelp.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET142F.tmp\extracted\win32\dbghelp.dll
                                                  • Size 1.2MB
                                                  • SHA256 150782fca5e188762a41603e2d5c7aad6b6419926bcadf350ebf84328e50948f
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  e181ea3d-c3ec-4dd1-a9f2-6f8e407beecf.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\e181ea3d-c3ec-4dd1-a9f2-6f8e407beecf.tmp
                                                  • Size 1B
                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  70d59fd4-0bea-4aee-857f-c3b1b7c95a41.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3504_1910720471\70d59fd4-0bea-4aee-857f-c3b1b7c95a41.tmp
                                                  • Size 153KB
                                                  • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  content_new.js
                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3504_228396012\CRX_INSTALL\content_new.js
                                                  • Size 10KB
                                                  • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  memory/872-491-0x0000000000400000-0x0000000000B89000-memory.dmp
                                                  Download

                                                  memory/872-23-0x0000000000400000-0x0000000000B89000-memory.dmp
                                                  Download

                                                  memory/872-21-0x0000000006860000-0x0000000006861000-memory.dmp
                                                  Download

                                                  memory/872-16-0x0000000000B35000-0x0000000000B37000-memory.dmp
                                                  Download

                                                  memory/872-638-0x0000000000400000-0x0000000000B89000-memory.dmp
                                                  Download