General Info

File name

CheatEngine683.exe

Full analysis
https://app.any.run/tasks/d5f527a0-c737-4eb0-a1ba-26e8b13cc83e
Verdict
Malicious activity
Analysis date
2/11/2019, 11:22:42
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:

trojan

adware

installcore

pup

Indicators:

MIME:
application/x-dosexec
File info:
PE32 executable (GUI) Intel 80386, for MS Windows
MD5

f1c2281af4f1112f613c7cb51f3ae6b0

SHA1

56f10b2009f224b891d979af525051d3e842a687

SHA256

bbe0a00833e54a6ce70fefa15f0f09c637ce894047d4ce534b2654508cba8bfb

SSDEEP

393216:vMgXCrRV64yZJc6BPCpZtM8DTJXTwys6q0:kgXCrRA4yZxartMIm56q0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
300 seconds
Additional time used
240 seconds
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (68.0.3440.106)
  • Google Update Helper (1.3.33.17)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Application was dropped or rewritten from another process
  • Tutorial-i386.exe (PID: 4068)
  • ceregreset.exe (PID: 3968)
  • Kernelmoduleunloader.exe (PID: 3648)
  • Cheat Engine.exe (PID: 2672)
  • cheatengine-i386.exe (PID: 2356)
  • windowsrepair.exe (PID: 2536)
Loads dropped or rewritten executable
  • cheatengine-i386.exe (PID: 2356)
Connects to CnC server
  • CheatEngine683.tmp (PID: 2524)
INSTALLCORE was detected
  • CheatEngine683.tmp (PID: 2524)
Creates files in the program directory
  • cheatengine-i386.exe (PID: 2356)
Creates files in the user directory
  • cheatengine-i386.exe (PID: 2356)
Reads Internet Cache Settings
  • cheatengine-i386.exe (PID: 2356)
Uses ICACLS.EXE to modify access control list
  • CheatEngine683.tmp (PID: 2524)
Starts Internet Explorer
  • CheatEngine683.tmp (PID: 2524)
Reads internet explorer settings
  • CheatEngine683.tmp (PID: 2524)
Reads the date of Windows installation
  • CheatEngine683.tmp (PID: 2524)
Modifies the open verb of a shell class
  • CheatEngine683.tmp (PID: 2524)
Reads Windows Product ID
  • CheatEngine683.tmp (PID: 2524)
Reads the machine GUID from the registry
  • CheatEngine683.tmp (PID: 2524)
Reads CPU info
  • CheatEngine683.tmp (PID: 2524)
Reads Environment values
  • CheatEngine683.tmp (PID: 2524)
Reads the Windows organization settings
  • CheatEngine683.tmp (PID: 2524)
Executable content was dropped or overwritten
  • CheatEngine683.exe (PID: 3924)
  • CheatEngine683.tmp (PID: 2524)
  • CheatEngine683.exe (PID: 3464)
Reads Windows owner or organization settings
  • CheatEngine683.tmp (PID: 2524)
Adds / modifies Windows certificates
  • iexplore.exe (PID: 2396)
Changes settings of System certificates
  • iexplore.exe (PID: 2396)
Creates files in the user directory
  • iexplore.exe (PID: 2396)
Reads settings of System Certificates
  • cheatengine-i386.exe (PID: 2356)
Application launched itself
  • iexplore.exe (PID: 3396)
Reads internet explorer settings
  • iexplore.exe (PID: 2396)
Changes internet zones settings
  • iexplore.exe (PID: 3396)
Reads Internet Cache Settings
  • iexplore.exe (PID: 2396)
Creates a software uninstall entry
  • CheatEngine683.tmp (PID: 2524)
Application was dropped or rewritten from another process
  • CheatEngine683.tmp (PID: 2324)
  • CheatEngine683.tmp (PID: 2524)
Loads dropped or rewritten executable
  • CheatEngine683.tmp (PID: 2524)
Creates files in the program directory
  • CheatEngine683.tmp (PID: 2524)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.exe
|   Win32 Executable Delphi generic (45.2%)
.dll
|   Win32 Dynamic Link Library (generic) (20.9%)
.exe
|   Win32 Executable (generic) (14.3%)
.exe
|   Win16/32 Executable Delphi generic (6.6%)
.exe
|   Generic Win/DOS Executable (6.3%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
2016:04:06 16:39:04+02:00
PEType:
PE32
LinkerVersion:
2.25
CodeSize:
66560
InitializedDataSize:
53760
UninitializedDataSize:
null
EntryPoint:
0x117dc
OSVersion:
5
ImageVersion:
6
SubsystemVersion:
5
Subsystem:
Windows GUI
FileVersionNumber:
6.8.3.2
ProductVersionNumber:
6.8.3.2
FileFlagsMask:
0x003f
FileFlags:
(none)
FileOS:
Win32
ObjectFileType:
Executable application
FileSubtype:
null
LanguageCode:
Neutral
CharacterSet:
Unicode
Comments:
This installation was built with Inno Setup.
CompanyName:
Cheat Engine
FileDescription:
Cheat Engine 6.8.3 Setup
FileVersion:
6.8.3.2
LegalCopyright:
Cheat Engine
ProductName:
Cheat Engine 6.8.3
ProductVersion:
6.8.3.2
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
06-Apr-2016 14:39:04
Detected languages
Dutch - Netherlands
English - United States
Comments:
This installation was built with Inno Setup.
CompanyName:
Cheat Engine
FileDescription:
Cheat Engine 6.8.3 Setup
FileVersion:
6.8.3.2
LegalCopyright:
Cheat Engine
ProductName:
Cheat Engine 6.8.3
ProductVersion:
6.8.3.2
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0050
Pages in file:
0x0002
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x000F
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x001A
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x00000100
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
8
Time date stamp:
06-Apr-2016 14:39:04
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
Sections
Name Virtual Address Virtual Size Raw Size Charateristics Entropy
.text 0x00001000 0x0000F244 0x0000F400 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 6.37521
.itext 0x00011000 0x00000F64 0x00001000 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 5.7322
.data 0x00012000 0x00000C88 0x00000E00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 2.29672
.bss 0x00013000 0x000056BC 0x00000000 IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 0
.idata 0x00019000 0x00000E04 0x00001000 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 4.59781
.tls 0x0001A000 0x00000008 0x00000000 IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 0
.rdata 0x0001B000 0x00000018 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 0.204488
.rsrc 0x0001C000 0x0000B200 0x0000B200 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 4.14507
Resources
1

2

3

4

4091

4092

4093

4094

4095

4096

11111

CHARTABLE

DVCLAL

PACKAGEINFO

MAINICON

Imports
    oleaut32.dll

    advapi32.dll

    user32.dll

    kernel32.dll

    comctl32.dll

Exports

    No exports.

Screenshots

Processes

Total processes
48
Monitored processes
13
Malicious processes
6
Suspicious processes
1

Behavior graph

+
drop and start start drop and start drop and start drop and start drop and start drop and start cheatengine683.exe cheatengine683.tmp no specs cheatengine683.exe #INSTALLCORE cheatengine683.tmp kernelmoduleunloader.exe windowsrepair.exe no specs icacls.exe no specs ceregreset.exe no specs cheat engine.exe no specs cheatengine-i386.exe iexplore.exe iexplore.exe tutorial-i386.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
3464
CMD
"C:\Users\admin\AppData\Local\Temp\CheatEngine683.exe"
Path
C:\Users\admin\AppData\Local\Temp\CheatEngine683.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Cheat Engine
Description
Cheat Engine 6.8.3 Setup
Version
6.8.3.2
Modules
Image
c:\users\admin\appdata\local\temp\cheatengine683.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\propsys.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\version.dll
c:\windows\system32\comres.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\shell32.dll
c:\users\admin\appdata\local\temp\is-q36dn.tmp\cheatengine683.tmp

PID
2324
CMD
"C:\Users\admin\AppData\Local\Temp\is-Q36DN.tmp\CheatEngine683.tmp" /SL5="$30190,14336707,121344,C:\Users\admin\AppData\Local\Temp\CheatEngine683.exe"
Path
C:\Users\admin\AppData\Local\Temp\is-Q36DN.tmp\CheatEngine683.tmp
Indicators
No indicators
Parent process
CheatEngine683.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Setup/Uninstall
Version
51.1052.0.0
Modules
Image
c:\users\admin\appdata\local\temp\is-q36dn.tmp\cheatengine683.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\version.dll
c:\windows\system32\mpr.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\propsys.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\comres.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shdocvw.dll

PID
3924
CMD
"C:\Users\admin\AppData\Local\Temp\CheatEngine683.exe" /SPAWNWND=$3019A /NOTIFYWND=$30190
Path
C:\Users\admin\AppData\Local\Temp\CheatEngine683.exe
Indicators
Parent process
CheatEngine683.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Cheat Engine
Description
Cheat Engine 6.8.3 Setup
Version
6.8.3.2
Modules
Image
c:\users\admin\appdata\local\temp\cheatengine683.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\propsys.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\version.dll
c:\windows\system32\comres.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\shell32.dll
c:\users\admin\appdata\local\temp\is-r5g4a.tmp\cheatengine683.tmp

PID
2524
CMD
"C:\Users\admin\AppData\Local\Temp\is-R5G4A.tmp\CheatEngine683.tmp" /SL5="$40194,14336707,121344,C:\Users\admin\AppData\Local\Temp\CheatEngine683.exe" /SPAWNWND=$3019A /NOTIFYWND=$30190
Path
C:\Users\admin\AppData\Local\Temp\is-R5G4A.tmp\CheatEngine683.tmp
Indicators
Parent process
CheatEngine683.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Setup/Uninstall
Version
51.1052.0.0
Modules
Image
c:\users\admin\appdata\local\temp\is-r5g4a.tmp\cheatengine683.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\version.dll
c:\windows\system32\mpr.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\propsys.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\comres.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\rstrtmgr.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\imageres.dll
c:\program files\common files\microsoft shared\ink\tiptsf.dll
c:\windows\system32\msftedit.dll
c:\users\admin\appdata\local\temp\is-denqh.tmp\apljypj.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\olepro32.dll
c:\windows\system32\dhcpcsvc.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\wintrust.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\psapi.dll
c:\windows\system32\sxs.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\winsta.dll
c:\windows\system32\mlang.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\msimtf.dll
c:\windows\system32\jscript.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\dxtrans.dll
c:\windows\system32\atl.dll
c:\windows\system32\ddrawex.dll
c:\windows\system32\ddraw.dll
c:\windows\system32\dciman32.dll
c:\windows\system32\dxtmsft.dll
c:\windows\system32\imgutil.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\pngfilt.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\devrtl.dll
c:\program files\cheat engine 6.8.3\kernelmoduleunloader.exe
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\program files\cheat engine 6.8.3\cheat engine.exe
c:\program files\cheat engine 6.8.3\cheatengine-i386.exe
c:\program files\cheat engine 6.8.3\tutorial-i386.exe
c:\program files\cheat engine 6.8.3\ceregreset.exe
c:\windows\system32\notepad.exe
c:\program files\cheat engine 6.8.3\unins000.exe
c:\program files\cheat engine 6.8.3\windowsrepair.exe
c:\windows\system32\icacls.exe
c:\windows\system32\netutils.dll

PID
3648
CMD
"C:\Program Files\Cheat Engine 6.8.3\Kernelmoduleunloader.exe" /SETUP
Path
C:\Program Files\Cheat Engine 6.8.3\Kernelmoduleunloader.exe
Indicators
Parent process
CheatEngine683.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\cheat engine 6.8.3\kernelmoduleunloader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll

PID
2536
CMD
"C:\Program Files\Cheat Engine 6.8.3\windowsrepair.exe" /s
Path
C:\Program Files\Cheat Engine 6.8.3\windowsrepair.exe
Indicators
No indicators
Parent process
CheatEngine683.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\cheat engine 6.8.3\windowsrepair.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
3824
CMD
"icacls" "C:\Program Files\Cheat Engine 6.8.3" /grant *S-1-15-2-1:(OI)(CI)(RX) /T
Path
C:\Windows\system32\icacls.exe
Indicators
No indicators
Parent process
CheatEngine683.tmp
User
admin
Integrity Level
HIGH
Exit code
1332
Version:
Company
Microsoft Corporation
Description
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\icacls.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

PID
3968
CMD
"C:\Program Files\Cheat Engine 6.8.3\ceregreset.exe" -silent -dontdeletecustomtypes -dontdeleteversioncheck
Path
C:\Program Files\Cheat Engine 6.8.3\ceregreset.exe
Indicators
No indicators
Parent process
CheatEngine683.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\cheat engine 6.8.3\ceregreset.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
2672
CMD
"C:\Program Files\Cheat Engine 6.8.3\Cheat Engine.exe"
Path
C:\Program Files\Cheat Engine 6.8.3\Cheat Engine.exe
Indicators
No indicators
Parent process
CheatEngine683.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
6.3.0.0
Modules
Image
c:\program files\cheat engine 6.8.3\cheat engine.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\propsys.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\program files\cheat engine 6.8.3\cheatengine-i386.exe

PID
2356
CMD
"C:\Program Files\Cheat Engine 6.8.3\cheatengine-i386.exe"
Path
C:\Program Files\Cheat Engine 6.8.3\cheatengine-i386.exe
Indicators
Parent process
Cheat Engine.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Cheat Engine
Description
Cheat Engine
Version
6.8.3.5803
Modules
Image
c:\program files\cheat engine 6.8.3\cheatengine-i386.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\opengl32.dll
c:\windows\system32\glu32.dll
c:\windows\system32\ddraw.dll
c:\windows\system32\dciman32.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\devobj.dll
c:\windows\system32\dwmapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\imagehlp.dll
c:\program files\cheat engine 6.8.3\lua53-32.dll
c:\windows\system32\hhctrl.ocx
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\profapi.dll
c:\windows\system32\psapi.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\program files\cheat engine 6.8.3\win32\dbghelp.dll
c:\program files\cheat engine 6.8.3\win32\symsrv.dll
c:\windows\system32\xinput9_1_0.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\xmllite.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\userenv.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\schannel.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\credssp.dll
c:\program files\cheat engine 6.8.3\win32\sqlite3.dll
c:\windows\system32\secur32.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\apphelp.dll
c:\program files\cheat engine 6.8.3\tutorial-i386.exe

PID
3396
CMD
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
Path
C:\Program Files\Internet Explorer\iexplore.exe
Indicators
Parent process
CheatEngine683.tmp
User
admin
Integrity Level
HIGH
Exit code
1
Version:
Company
Microsoft Corporation
Description
Internet Explorer
Version
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\cryptbase.dll
c:\program files\internet explorer\sqmapi.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\ieui.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\clbcatq.dll
c:\program files\internet explorer\ieproxy.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\url.dll
c:\windows\system32\version.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\xmllite.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\msfeeds.dll
c:\windows\system32\sxs.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\mlang.dll
c:\windows\system32\mssprxy.dll
c:\windows\system32\userenv.dll
c:\windows\system32\linkinfo.dll

PID
2396
CMD
"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3396 CREDAT:79873
Path
C:\Program Files\Internet Explorer\iexplore.exe
Indicators
Parent process
iexplore.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Internet Explorer
Version
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\comdlg32.dll
c:\program files\internet explorer\ieshims.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\rpcrtremote.dll
c:\program files\internet explorer\sqmapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rsaenh.dll
c:\program files\internet explorer\ieproxy.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\mlang.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\apphelp.dll
c:\program files\java\jre1.8.0_92\bin\ssv.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\version.dll
c:\progra~1\micros~1\office14\urlredir.dll
c:\windows\system32\secur32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\progra~1\micros~1\office14\msohev.dll
c:\program files\java\jre1.8.0_92\bin\jp2ssv.dll
c:\program files\java\jre1.8.0_92\bin\msvcr100.dll
c:\program files\java\jre1.8.0_92\bin\deploy.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\sxs.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\userenv.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\schannel.dll
c:\windows\system32\credssp.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\iepeers.dll
c:\windows\system32\winspool.drv
c:\windows\system32\msimtf.dll
c:\windows\system32\jscript.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll

PID
4068
CMD
"C:\Program Files\Cheat Engine 6.8.3\Tutorial-i386.exe"
Path
C:\Program Files\Cheat Engine 6.8.3\Tutorial-i386.exe
Indicators
No indicators
Parent process
cheatengine-i386.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\cheat engine 6.8.3\tutorial-i386.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\duser.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\xmllite.dll

Registry activity

Total events
1267
Read events
1085
Write events
178
Delete events
4

Modification events

PID
Process
Operation
Key
Name
Value
2524
CheatEngine683.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Owner
DC0900009CDE03C8F3C1D401
2524
CheatEngine683.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
SessionHash
DA0538F359401E25276E3E7CBA7BAB49C80D9B4628361A8C678B5300B502FB74
2524
CheatEngine683.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Sequence
1
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheatEngine683_RASAPI32
EnableFileTracing
0
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheatEngine683_RASAPI32
EnableConsoleTracing
0
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheatEngine683_RASAPI32
FileTracingMask
4294901760
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheatEngine683_RASAPI32
ConsoleTracingMask
4294901760
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheatEngine683_RASAPI32
MaxFileSize
1048576
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheatEngine683_RASAPI32
FileDirectory
%windir%\tracing
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheatEngine683_RASMANCS
EnableFileTracing
0
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheatEngine683_RASMANCS
EnableConsoleTracing
0
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheatEngine683_RASMANCS
FileTracingMask
4294901760
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheatEngine683_RASMANCS
ConsoleTracingMask
4294901760
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheatEngine683_RASMANCS
MaxFileSize
1048576
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheatEngine683_RASMANCS
FileDirectory
%windir%\tracing
2524
CheatEngine683.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
2524
CheatEngine683.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
2524
CheatEngine683.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2524
CheatEngine683.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2524
CheatEngine683.tmp
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
Name
CheatEngine683.tmp
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
ID
1459953545
2524
CheatEngine683.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFiles0000
C:\Program Files\Cheat Engine 6.8.3\windowsrepair.exe
2524
CheatEngine683.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFilesHash
9BD3007271EC0322934234FA7E7C273EFB52528D594F2E5FD184CF3838D52FBE
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.CETRAINER
CheatEngine
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.CT
CheatEngine
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CheatEngine
Cheat Engine
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CheatEngine\DefaultIcon
C:\Program Files\Cheat Engine 6.8.3\Cheat Engine.exe,0
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CheatEngine\shell\open\command
"C:\Program Files\Cheat Engine 6.8.3\Cheat Engine.exe" "%1"
2524
CheatEngine683.tmp
write
HKEY_CURRENT_USER\Software\Cheat Engine\VersionCheck
CheckOnLaunch
1
2524
CheatEngine683.tmp
write
HKEY_CURRENT_USER\Software\Cheat Engine\VersionCheck
CheckInterval
1
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
Inno Setup: Setup Version
5.5.9 (u)
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
Inno Setup: App Path
C:\Program Files\Cheat Engine 6.8.3
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
InstallLocation
C:\Program Files\Cheat Engine 6.8.3\
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
Inno Setup: Icon Group
Cheat Engine 6.8.3
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
Inno Setup: User
admin
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
Inno Setup: Selected Tasks
desktopicon,checkforupdates
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
Inno Setup: Deselected Tasks
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
Inno Setup: Language
default
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
DisplayName
Cheat Engine 6.8.3
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
UninstallString
"C:\Program Files\Cheat Engine 6.8.3\unins000.exe"
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
QuietUninstallString
"C:\Program Files\Cheat Engine 6.8.3\unins000.exe" /SILENT
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
Publisher
Cheat Engine
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
URLInfoAbout
http://www.cheatengine.org/
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
HelpLink
http://www.cheatengine.org/
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
URLUpdateInfo
http://www.cheatengine.org/
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
NoModify
1
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
NoRepair
1
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
InstallDate
20190211
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine 6.8.3_is1
EstimatedSize
48588
2524
CheatEngine683.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
GlobalAssocChangedCounter
52
2524
CheatEngine683.tmp
delete key
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
3968
ceregreset.exe
delete key
HKEY_CURRENT_USER\Software\Cheat Engine
2672
Cheat Engine.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2672
Cheat Engine.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2356
cheatengine-i386.exe
write
HKEY_CURRENT_USER\Software\Cheat Engine
First Time User
0
2356
cheatengine-i386.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\cheatengine-i386_RASAPI32
EnableFileTracing
0
2356
cheatengine-i386.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\cheatengine-i386_RASAPI32
EnableConsoleTracing
0
2356
cheatengine-i386.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\cheatengine-i386_RASAPI32
FileTracingMask
4294901760
2356
cheatengine-i386.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\cheatengine-i386_RASAPI32
ConsoleTracingMask
4294901760
2356
cheatengine-i386.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\cheatengine-i386_RASAPI32
MaxFileSize
1048576
2356
cheatengine-i386.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\cheatengine-i386_RASAPI32
FileDirectory
%windir%\tracing
2356
cheatengine-i386.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\cheatengine-i386_RASMANCS
EnableFileTracing
0
2356
cheatengine-i386.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\cheatengine-i386_RASMANCS
EnableConsoleTracing
0
2356
cheatengine-i386.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\cheatengine-i386_RASMANCS
FileTracingMask
4294901760
2356
cheatengine-i386.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\cheatengine-i386_RASMANCS
ConsoleTracingMask
4294901760
2356
cheatengine-i386.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\cheatengine-i386_RASMANCS
MaxFileSize
1048576
2356
cheatengine-i386.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\cheatengine-i386_RASMANCS
FileDirectory
%windir%\tracing
2356
cheatengine-i386.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
2356
cheatengine-i386.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
460000006A000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
2356
cheatengine-i386.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2356
cheatengine-i386.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2356
cheatengine-i386.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
2356
cheatengine-i386.exe
write
HKEY_CURRENT_USER\Software\Cheat Engine\VersionCheck
LastCheck
1549880635
2356
cheatengine-i386.exe
write
HKEY_CURRENT_USER\Software\Cheat Engine\Window Positions 96
Comments Position
D5000000020400004F01000001010000
2356
cheatengine-i386.exe
write
HKEY_CURRENT_USER\Software\Cheat Engine\Window Positions 96
AdvancedOptions Position
C0000000000100003B0200002F010000
2356
cheatengine-i386.exe
write
HKEY_CURRENT_USER\Software\Cheat Engine\Window Positions 96
MemoryBrowser Position
D8000000ED0200006E020000CC010000500000008C000000C8000000640000002C010000D700000001000000010000000000000000000000
2356
cheatengine-i386.exe
write
HKEY_CURRENT_USER\Software\Cheat Engine\Window Positions 96
MainForm Position
3A000000490100006E0200005C02000028000000A0000000660000004100000010270000780100005B000000
2356
cheatengine-i386.exe
write
HKEY_CURRENT_USER\Software\Cheat Engine
Debug
0
2356
cheatengine-i386.exe
write
HKEY_CURRENT_USER\Software\Cheat Engine\Window Positions 96
frmAutoInject Position
AE010000E5020000AF0100004B010000
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
CompatibilityFlags
0
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
SecuritySafe
1
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
460000006B000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\AdminActive
{2186BF4B-2DE7-11E9-91D7-5254004A04AF}
0
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Type
4
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Count
3
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Time
E307020001000B000A00170036003B03
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\iexplore
Type
4
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\iexplore
Count
3
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\iexplore
Time
E307020001000B000A00170036003B03
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
FullScreen
no
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Window_Placement
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF20000000200000004003000078020000
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links
Order
08000000020000000C01000001000000020000007E0000000000000070003200EC000000464B245120005355474745537E312E55524C0000540008000400EFBE454B974D464B24512A000000F94300000000020000000000000000000000000000005300750067006700650073007400650064002000530069007400650073002E00750072006C0000001C00000000000000820000000100000074003200E2000000464B24512000574542534C497E312E55524C0000580008000400EFBE454B864A464B24512A000000743E0000000003000000000000000000000000000000570065006200200053006C006900630065002000470061006C006C006500720079002E00750072006C0000001C00000000000000
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\WindowsSearch
UpgradeTime
C2FEFAE9F3C1D401
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\WindowsSearch
UpgradeTime
1C61FDE9F3C1D401
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0
Path
C:\Users\admin\Favorites\Links\Suggested Sites.url
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0
Handler
{B0FA7D7C-7195-4F03-B03E-9DC1C9EBC394}
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0
FeedUrl
https://ieonline.microsoft.com/#ieslice
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0
DisplayName
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0
ErrorState
0
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0
DisplayMask
0
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1
Path
C:\Users\admin\Favorites\Links\Web Slice Gallery.url
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1
Handler
{B0FA7D7C-7195-4F03-B03E-9DC1C9EBC394}
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1
FeedUrl
http://go.microsoft.com/fwlink/?LinkId=121315
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1
DisplayName
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1
ErrorState
0
3396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1
DisplayMask
0
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
Type
3
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
Count
3
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
Time
E307020001000B000A0017003600A903
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
LoadTime
10
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore
Type
3
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore
Count
3
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore
Time
E307020001000B000A0017003600C803
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore
LoadTime
22
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
Type
3
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
Count
3
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
Time
E307020001000B000A00170037002E00
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
LoadTime
20
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
460000006C000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
2396
iexplore.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
2396
iexplore.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13
Blob
040000000100000010000000410352DC0FF7501B16F0028EBA6F45C50F00000001000000140000005BCAA1C2780F0BCB5A90770451D96F38963F012D090000000100000042000000304006082B0601050507030406082B0601050507030106082B0601050507030206082B06010505070308060A2B0601040182370A0304060A2B0601040182370A030C6200000001000000200000000687260331A72403D909F105E69BCF0D32E1BD2493FFC6D9206D11BCD67707390B000000010000001E000000440053005400200052006F006F0074002000430041002000580033000000140000000100000014000000C4A7B1A47B2C71FADBE14B9075FFC415608589101D00000001000000100000004558D512EECB27464920897DE7B66053030000000100000014000000DAC9024F54D8F6DF94935FB1732638CA6AD77C131900000001000000100000006CF252FEC3E8F20996DE5D4DD9AEF42420000000010000004E0300003082034A30820232A003020102021044AFB080D6A327BA893039862EF8406B300D06092A864886F70D0101050500303F31243022060355040A131B4469676974616C205369676E617475726520547275737420436F2E311730150603550403130E44535420526F6F74204341205833301E170D3030303933303231313231395A170D3231303933303134303131355A303F31243022060355040A131B4469676974616C205369676E617475726520547275737420436F2E311730150603550403130E44535420526F6F7420434120583330820122300D06092A864886F70D01010105000382010F003082010A0282010100DFAFE99750088357B4CC6265F69082ECC7D32C6B30CA5BECD9C37DC740C118148BE0E83376492AE33F214993AC4E0EAF3E48CB65EEFCD3210F65D22AD9328F8CE5F777B0127BB595C089A3A9BAED732E7A0C063283A27E8A1430CD11A0E12A38B9790A31FD50BD8065DFB7516383C8E28861EA4B6181EC526BB9A2E24B1A289F48A39E0CDA098E3E172E1EDD20DF5BC62A8AAB2EBD70ADC50B1A25907472C57B6AAB34D63089FFE568137B540BC8D6AEEC5A9C921E3D64B38CC6DFBFC94170EC1672D526EC38553943D0FCFD185C40F197EBD59A9B8D1DBADA25B9C6D8DFC115023AABDA6EF13E2EF55C089C3CD68369E4109B192AB62957E3E53D9B9FF0025D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E04160414C4A7B1A47B2C71FADBE14B9075FFC41560858910300D06092A864886F70D01010505000382010100A31A2C9B17005CA91EEE2866373ABF83C73F4BC309A095205DE3D95944D23E0D3EBD8A4BA0741FCE10829C741A1D7E981ADDCB134BB32044E491E9CCFC7DA5DB6AE5FEE6FDE04EDDB7003AB57049AFF2E5EB02F1D1028B19CB943A5E48C4181E58195F1E025AF00CF1B1ADA9DC59868B6EE991F586CAFAB96633AA595BCEE2A7167347CB2BCC99B03748CFE3564BF5CF0F0C723287C6F044BB53726D43F526489A5267B758ABFE67767178DB0DA256141339243185A2A8025A3047E1DD5007BC02099000EB6463609B16BC88C912E6D27D918BF93D328D65B4E97CB15776EAC5B62839BF15651CC8F677966A0A8D770BD8910B048E07DB29B60AEE9D82353510
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012019021120190212
CachePath
%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019021120190212
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012019021120190212
CachePrefix
:2019021120190212:
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012019021120190212
CacheLimit
8192
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012019021120190212
CacheOptions
11
2396
iexplore.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012019021120190212
CacheRepair
0
2396
iexplore.exe
delete key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012018082720180903
2396
iexplore.exe
delete key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012018090920180910

Files activity

Executable files
55
Suspicious files
7
Text files
161
Unknown types
19

Dropped files

PID
Process
Filename
Type
3464
CheatEngine683.exe
C:\Users\admin\AppData\Local\Temp\is-Q36DN.tmp\CheatEngine683.tmp
executable
MD5: c2d0ae931b7651b0d332dfa384afee22
SHA256: c5e4ab9cf706c908d9a2388182a57b1b8df7e8ac7d210bf046cb6b8eb1745dcc
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\speedhack-x86_64.dll
executable
MD5: 156249ce92b9a15d71c39160dc05b4a1
SHA256: 3bd69d00774b40132bd621c09c11093f188f06d634db64a19a78c46a27388c8f
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\libmikmod32.dll
executable
MD5: dacd337030c240f324a3d655ecd876e2
SHA256: 041427d5ae979b938fc2771bf3ae6e2b0cf6a669fc881b44be1586e46225532b
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\speedhack-i386.dll
executable
MD5: 4acc9d3311fff9d1ac7697010b43f90b
SHA256: 2f77a5e845ee6838bfdc73005e748084a79e18ae0e2de4702224041cde78e0ba
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\standalonephase2.dat
executable
MD5: a65c29111a4cf5a7fdd5a9d79f77bcab
SHA256: dab3003436b6861ae220cc5fdcb97970fc05afdf114c2f91e46eed627ce3d6af
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\win64\symsrv.dll
executable
MD5: 896ab17393ec4956d4dfded6a769bbbc
SHA256: 62e6e7efba96592e2e13af4c7f3ec7aaa0750f10e63984c26c7f26e11a0e528e
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\Kernelmoduleunloader.exe
executable
MD5: 96f5312281777e9cc912d5b2d09e6132
SHA256: 42e52111b758582a0d7929816e0711e6957d11681097e0d9fe880206a9c220d5
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\win32\symsrv.dll
executable
MD5: 451a9590682f075f647ebab54a713dc6
SHA256: 664b5bbd2186151d0d76544a182333eb8bc4e3f54509b15d9e9f93c6fc66d482
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\ceregreset.exe
executable
MD5: f84e7feacb187b5cd4850de965453e9c
SHA256: 4bec650801ee02577662f45d0bfc1afd5e083810a1268fb44136df050bf0d3e2
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\win64\sqlite3.dll
executable
MD5: c11138204609ea63a3e88b4c8c09b035
SHA256: 60c16c2fab14b344b8343778dcd6bbfdee3dfe5f83d1ac8d2e50c6877419eee4
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\vehdebug-i386.dll
executable
MD5: 54e31f0e0a470ce56f406497fb7e5da1
SHA256: d0a05fdaa40b285cd924577d233a7960ada28aa2edd02890982d8bfd63c4a652
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\dbk64.sys
executable
MD5: 1c294146fc77565030603878fd0106f9
SHA256: 18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\tiny.dat
executable
MD5: 419bfebb2f430bc8a246515bd55e024e
SHA256: d1a3add2a0fa8e8c8e18c2831342746f3059d9e886e6c44d3074967b1217d9c5
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\win32\sqlite3.dll
executable
MD5: aef51484c41c348e6eca26eaf36b5e00
SHA256: f3e9e0df553d9df6650981a0758ede142a33a889786bbeb586fe7edc7f9e27eb
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\vehdebug-x86_64.dll
executable
MD5: ea6d40243dd7c37ba4c46982c96e6780
SHA256: 4e93dc0bb234e45d96febad6a646a54aa39fc4586f926319f20bb188aa43bdc8
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\dbk32.sys
executable
MD5: 035b96932a17d979eb5678d311fa3599
SHA256: f9e8b47afb311feea19de10271c38d742ac79f3de49dc01433eff1d19f76041f
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\standalonephase1.dat
executable
MD5: eb339eecec8aa8c0fd3b08d39799d4d8
SHA256: 88bb94c3ce727db13b77abdbdb75a4c878e91d651692f3618178dec5bbb7080c
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\win64\dbghelp.dll
executable
MD5: 893ec728b6fa9d7277963847bd408f4f
SHA256: 21c398a2292f04652795c7d4ee7890bb62ac7039e58ac04ece91ff05ee0801ee
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\allochook-i386.dll
executable
MD5: 6e808a8b417331ea7645b6a9ffa4b8fe
SHA256: b8df41c3153c2a3212523099c71bc81ac97304dc886d8b4670a4f9a7ae6c3568
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\MonoDataCollector32.dll
executable
MD5: e75a6e414c8b84c47c47506f02aff1a2
SHA256: cb8d4f78ffcdd1cf587632bd2a1620667dbb169185fc11348a4232f3358d4fcb
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\ced3d11hook64.dll
executable
MD5: 09c15392d0add203ed51fcf311597998
SHA256: 0c2d2a46f34c11ea0a02f5617e7e214bf85bfa1adcf65e19b2580c660e5c23ca
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\win32\dbghelp.dll
executable
MD5: 9139604740814e53298a5e8428ba29d7
SHA256: 150782fca5e188762a41603e2d5c7aad6b6419926bcadf350ebf84328e50948f
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\allochook-x86_64.dll
executable
MD5: ba991541c10506a7bd4a9dc6a7382e2e
SHA256: 060f98f88f6280234578b06894c35136887ddd4c635c84a98e0297f5ef381870
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\MonoDataCollector64.dll
executable
MD5: 392491a05bf30e356573b3cd26f22c4a
SHA256: 638cba85e97dc2974daf50f02100442a16c72a37f2346929a57a8b7d01716d00
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\ced3d10hook64.dll
executable
MD5: 7379422820aaab3f14d136b1e9472ff5
SHA256: 2dd3471f91ae45989e9d1dc5008ec5c01b57f4804c7358172f0ec230d9fdd26f
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\cheatengine-x86_64.exe
executable
MD5: ec9bdbe6039af382f43107709e37ef79
SHA256: 7c2430238edde4bca3cfefff0b330568ba948efbd35156ad19c6045ddc123dec
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\lua53-32.dll
executable
MD5: 9b8d650ffc6fff2cfe67a7e5c020ccfb
SHA256: 59b9f3fa57c1b7fdd3312f864c20eaee76ba9fcb7bb8d2542060d3533ced12c2
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\32\CEJVMTI.dll
executable
MD5: b02fa5c8eefbcd010aaac97a94ff62bb
SHA256: 7bd0d77fd790215bb67337f9f210b05aaab0193d105b8ff86ec422e9875eb033
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\d3dhook64.dll
executable
MD5: 7a94fe59e34494d0f25b1fb28302e4a2
SHA256: a50b866f5da341fd62587d576078f7314cea6818ea921fd3ee78f272f0dc7d56
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\cheatengine-i386.exe
executable
MD5: dd59353c7d7d692d2d9f66e9be3439c2
SHA256: 602be0bf0c01f0f544ccc11cb0c2b16ecfae95e263d1289ba8fec2af4fdb976a
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\luaclient-i386.dll
executable
MD5: bc07c7a4b44473183759be6f44f37678
SHA256: ef7328f5276b8d704327c41dcb9c5ce3713949222ba105a8a2cb4d21331cf7e6
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\64\CEJVMTI.dll
executable
MD5: cefc5c56720ca850ccb20faf47733bd2
SHA256: f107dd69b4115864d289f364fafc0e045fd3e9fc4bde5586ce8c1bcf59cc65a7
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\ced3d9hook64.dll
executable
MD5: fe19b141911c7b06655011d293f1c5f4
SHA256: 54c5dbc81668aff2703cbc34e9f65969f4ad83e6a23e3e9378810ff114284c4a
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\Cheat Engine.exe
executable
MD5: c4ef55773278a688ae60e7eaa3570b3b
SHA256: 1b519a00b18d0639bad0274ac577032bba45ec7475e5701ca9d756d152ff1456
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\lua53-64.dll
executable
MD5: b19ca65cd5c6f20c77dbc60bce20e826
SHA256: 522fd7cac73f55f249b82fbaee587db6e527c76eac9837cf54622ee476be8fab
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\Tutorial-i386.exe
executable
MD5: 6943a79697ec62fa7912c16a86d933dd
SHA256: 5776f0e660a42fa0e9a52d93d1acefd817f621107e6a1fdba22593d452c09116
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\ced3d11hook.dll
executable
MD5: abab33efaef4fc64666ed3618e39931d
SHA256: 7e8025fdc9ef229d6a706589d69de3091f40fc904d2396b590d1d960d3c228c3
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\windowsrepair.exe
executable
MD5: e8bfb6451181bbd5ee5e981469b79228
SHA256: 23308e6bbe3008ddf638c0352331d5adaf5fed5559b7bd4dfd10bc70ad573150
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\luaclient-x86_64.dll
executable
MD5: e83a7c84c7120245fa540e6739fea9c4
SHA256: e37a3f6f69feb43c7d68c8e4149cbc69507f329fcb9e2ff67bb465db80d09746
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\Tutorial-x86_64.exe
executable
MD5: 7fc1b5b025bb4bce49819dca455676eb
SHA256: 6a64a0231de348154df130432932ac90a610b237aea1b34460f24304f438f008
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\winhook-i386.dll
executable
MD5: 3235f1f4837ab1210667475f0a8f70a2
SHA256: 402319ae8162e4429a53dad2dbd62040d9ad1ec32c98872531a2cf79ecae6b18
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\unins000.exe
executable
MD5: c2d0ae931b7651b0d332dfa384afee22
SHA256: c5e4ab9cf706c908d9a2388182a57b1b8df7e8ac7d210bf046cb6b8eb1745dcc
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\winhook-x86_64.dll
executable
MD5: c20cf129c3455c5e1e00179ff31a7660
SHA256: 9e36eab7afac8c74eaa108b266189e248f2018f72a1b9fbe73365f56c1350ddd
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\gtutorial-i386.exe
executable
MD5: 7fad83dd27b7b0fe7441a923510499d3
SHA256: 68bfcc5b11685c96348c1b2413f5b9820e5c55677c0a88b333ab05353f0de5db
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\libipt-32.dll
executable
MD5: 00b8f0cba176db6fd6edbef448e2fb03
SHA256: 457046d9ae69be14e4a062bd15f74b584c999a596d6ff39e4f7868c3a243ccf2
2524
CheatEngine683.tmp
C:\Users\admin\AppData\Local\Temp\is-DENQH.tmp\ApLjypj.dll
executable
MD5: 48bc80695d6c292cf144248ffd11a2e5
SHA256: f4d13a9d3e12c4c1524e87d369ff8e1e9a1c4f82c72211bd05fa0283640702d1
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\DotNetDataCollector32.exe
executable
MD5: 667c6978388f40406438a0aca762b3bf
SHA256: e40ef87edad9321657b7770c926534481031726cc37c20c898a4c1f15f94058e
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\gtutorial-x86_64.exe
executable
MD5: ff3c5dc8166ddde828200e70a0b4dcf0
SHA256: 739cbeabb6381949f5f1defc86fbc12714262de6366aecf13a52dc471920e934
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\ced3d9hook.dll
executable
MD5: 62b6c7cda6ba981dd644d223485a4c32
SHA256: 6f7984f2cd23c24291f1b1babd60aaea29ca07354f7432b4a0ba8405cd12018c
3924
CheatEngine683.exe
C:\Users\admin\AppData\Local\Temp\is-R5G4A.tmp\CheatEngine683.tmp
executable
MD5: c2d0ae931b7651b0d332dfa384afee22
SHA256: c5e4ab9cf706c908d9a2388182a57b1b8df7e8ac7d210bf046cb6b8eb1745dcc
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\DotNetDataCollector64.exe
executable
MD5: 8d59b498eb8311edd5c29f3930f4789b
SHA256: d26ea9b41f172c146633d2e4fac8c50a4b0c6bb343a37cf5fb3c17598bb49971
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\libipt-64.dll
executable
MD5: e92d96e0a263cfda16bcde00ec668fb2
SHA256: 89d063997fec2d7f118a4d36fee507293bc8ad009eb114e853c1e02fcd2c65ed
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\d3dhook.dll
executable
MD5: 63583d11986b1a904564ea5992ff5783
SHA256: dd8b5d4c69a485e75100ff5814b0873e8d734a21e8e32e261288bab32ea3cd7c
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\ced3d10hook.dll
executable
MD5: efd3885a90d292bb02317f032e6ee83d
SHA256: 597fe1f1d86293defd9a5bc88af8760e8441c847b7e676cd595bf054b4ecb69c
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\libmikmod64.dll
executable
MD5: cff044ee3143c7b48ab90e8d1ce52aaa
SHA256: 777c84aeea61d35c4e8d714658a105e03eb46c23259022bdef63411f0c6fa6e5
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\badassets\is-E1KNG.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\badassets\is-673H6.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\badassets\is-425BT.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\badassets\bullet.png
image
MD5: 8bcc2e16763817795e4e81ec86457038
SHA256: cdfc96fba6efd3f26c779b4a892afffc292d451cc94104c3272b258e17204d07
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\badassets\infobutton.png
image
MD5: 45e0091b87215f768f524dbbededd74e
SHA256: 576467863491faede8053f95bd0c66cf3c273f6b27a05984f81f51aa289191be
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\badassets\lock.png
image
MD5: 8f1af33632beb4885863ab973cd781e6
SHA256: 01698b5f5990658505beb654446b367d5ccba0fca1d893d1c17e79489c379b29
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\badassets\door.png
image
MD5: 036394e78b67c1f5c2e1773b74d148e9
SHA256: 96200dbe8bd64bdf2a85e1fe45ff2169fa08b080425a0f32e4f08a65d83cab5b
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\badassets\is-LDBRG.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\badassets\is-03M73.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\badassets\is-20GFC.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\badassets\is-OT0J4.tmp
––
MD5:  ––
SHA256:  ––
2356
cheatengine-i386.exe
C:\Users\admin\AppData\Local\Temp\Cheat Engine\{ED1643F2-9FEC-4A8C-A1A8-E42B317CF2DB}\ADDRESSES.TMP.FILETEST
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\is-DH91O.tmp
––
MD5:  ––
SHA256:  ––
3396
iexplore.exe
C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2186BF4B-2DE7-11E9-91D7-5254004A04AF}.dat
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\is-IT3UL.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\example-c.vcproj
xml
MD5: eb57af6cc5be00be4cca68c11a9dd167
SHA256: 58c62a39812f64d90a6b8a480e6bdca9c42d285e77a6271f0e5f2f3e80dd668e
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\bla.h
text
MD5: a5d7fbe6a1c5ee5c9b8cc1dd85195a4b
SHA256: 49848186572123d3e61b289bd7651dbab6f130b71c820b3472a2f896b39bb15f
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\example-c.def
text
MD5: 16e7bc7fc630ebc06c84fc437cc784af
SHA256: d8882065b6ef9e9a4b544ab301d7c1305b989c2e6da72769f547781b5642a367
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\example-c.sln
text
MD5: 0dc38e698fca8775ddfc53eb9e2777ce
SHA256: 4589682cfe7932386bb7e079c63a1303ce16204faa26a1ad754c743273a30646
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\is-SDALG.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\is-SRQ1A.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\is-0V254.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\bla.cpp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\is-ALU2B.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\is-O0QGE.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\example-c.vcxproj.filters
xml
MD5: 9740e73e7cdbd769a46179a035f59fdb
SHA256: ddaf1810f761922ebcc88d654ae05149c26a9a72cc6fff0876a8badbfa59f2b8
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\lua53-64.lib
obj
MD5: 7ddee4accf147165315ed4d9510fa8c7
SHA256: 9b49a072c63ec6ce50df45ec7f22a5d64aad51fd5e7fa27e2a390857b74f3a58
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\lua53-32.lib
obj
MD5: fd47fbcb1809083a7f9273328dab50e4
SHA256: 0d6b0cb3f9fcd76217d3eec3dcb26211757f2a84cb1a1a89815b0efcfdff2507
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\example-c.vcxproj
xml
MD5: 42a100284981a2c72c702f34cf7ae4a2
SHA256: c50d160a18d50329cd127a4ccacc6fe60f5c1da348a9f91d2eceb63875ca929e
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\example-c.c
text
MD5: 99986a99c1c725f77098965dd99bfe28
SHA256: 33d67c6d25f998fafc94e31d92db516cacf9f3a0ac916d57ed201b9cfc6d403f
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\lualib.h
text
MD5: 5dec6da1f036248bd8f28725a8263fca
SHA256: c547fa424bdc7096e058542f4be9b2ac0ee531dad59cd05086fa2d567f2af07a
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\is-C8NKT.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\is-1MREE.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\example-c\is-7UVAD.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\is-61EFE.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\is-JFCCG.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\luaconf.h
text
MD5: df693f0d5661863612720dba027c715c
SHA256: a03f2b81c82e59463482f69ae8345092dd3a09153a72e40535e3188ea8644561
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\is-SEB73.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\is-VVEEV.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\lua.h
text
MD5: 9e41d99af589b062c30baaea6c099889
SHA256: 50fcd05b5c5358410c81851763aac24b74aab101016cd38418c5c30c25396291
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\lua.hpp
text
MD5: 9fac7d7bf2a86babec4b57d3904495c8
SHA256: fd83f7e823cfbb03ac2da937ec83f01b4a6ddaac220a4fa1ffd6c6c3842c5890
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\is-BU5LP.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\is-F5G2C.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\cepluginsdk.pas
text
MD5: 97654599f2e06974dc79728c0016d3cb
SHA256: 5ed8460fad11d9a944eeeb4ca61b10a19649813abc7a1400cd396903a08afa41
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\lauxlib.h
text
MD5: c870e43cb0fb26e08429c3bb5132351b
SHA256: 2f1b06cd5d360c6f622862a7281ad34281eb5f43c3e8e61c5a0f4d928197f6b8
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\is-F0UBU.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\is-LCQCM.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\cepluginsdk.h
text
MD5: 4e2eb89b490da0810570649e8df07ee3
SHA256: bb05b396d84035067dda2dc78b180fa75371fdca1a0752041b74966bd7e4e2c2
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\plugins\is-KV9QM.tmp
––
MD5:  ––
SHA256:  ––
2396
iexplore.exe
C:\Users\admin\AppData\Local\Temp\JavaDeployReg.log
text
MD5: 9e01b17478e3b1489a52959976b187b9
SHA256: 3426d3b49c07d29e39e0908af3c8315d0a95adc41c82ceee35b2c0b4d001fd78
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\is-LHSKO.tmp
––
MD5:  ––
SHA256:  ––
3396
iexplore.exe
C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2186BF4C-2DE7-11E9-91D7-5254004A04AF}.dat
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\is-5M1UK.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\CheatEngine.chm
chm
MD5: bb80fec3b6e843b61859914480706cd9
SHA256: 2d52f9d59211f8906ace16525721b1400343bdf720f062cf111d84089f129009
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\is-EISJE.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Common\Pipe.h
text
MD5: 86ac093e951a8cfa7fe1e020e8a61026
SHA256: b7758c2f97ab776b02fcaab9d253277a96dcb318c66dd72d294a417290aad761
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Mono\MonoDataCollector\stdafx.cpp
text
MD5: 520defe1897c77fce677be903979dca0
SHA256: 71e91d8847e8a4e4a757e441b7d785eddda95d55ff674e5054d0fdf781773361
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Mono\MonoDataCollector\targetver.h
text
MD5: 33f3a8e602ac6644af839acb3ca10709
SHA256: 0ce7bd4b75fcf8800faffd3b0a315cbfe7b89271b8705e9216404af4d737d0bb
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Mono\MonoDataCollector\PipeServer.h
text
MD5: c8ba5325f507cf9a6fe7595334a5523c
SHA256: b901452c3c56ac3e027d8a085863acb0e175a8288dd3ac371a9d0b24e5ba35e3
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Common\Pipe.cpp
text
MD5: 9d38dbd8b60552bc2cb8585ad660b0dd
SHA256: 6ee4e10d1fd3fc75bf105727cbb84550fd2ded37dcb5c0ff053b18d2302e5117
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Mono\MonoDataCollector\is-EUQNI.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Mono\MonoDataCollector\is-0MH19.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Common\is-AC99E.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Mono\MonoDataCollector\is-FQDK8.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Common\is-NK05T.tmp
––
MD5:  ––
SHA256:  ––
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Mono\MonoDataCollector\PipeServer.cpp
text
MD5: ca30d726c3b965932cf82889c4659763
SHA256: 5a16daaadeeba73c9b8882aa87a83d093463ee7dece11cd8ad177e3b5e3e820c
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.cpp
text
MD5: ed039fd898a0c851638f063c286f80db
SHA256: a45246e126d7ef7feda89d2441e2bcd37509253d8b3143721b6311621951fb14
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Mono\MonoDataCollector\dllmain.cpp
text
MD5: 31eb3ab4f13cc2ca3442d46c77cefa7e
SHA256: 88afc32acdc447318b5bf0424ffb096d4685895552bae9818294254bbaf64ba5
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.vcproj
xml
MD5: 005a2f50ab3176d92010be6ddf941655
SHA256: a73ae1cbf54a722ce9433da14d0600afd504b09f5f681ed4be9c9f5ef0e16a38
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.h
text
MD5: a955bb9b652603bbeb0de4a061011894
SHA256: 6a4a0c290ffd2aa411d63ab6ca8f468007ad0d208ebf1903595c4eb51e5b796e
2524
CheatEngine683.tmp
C:\Program Files\Cheat Engine 6.8.3\autorun\dlls\src\Mono\MonoDataCollector\Metadata.h