File name:

CheatEngine75.exe

Full analysis: https://app.any.run/tasks/7a9fff74-9401-459e-ace0-c4b9a8973d31
Verdict: Malicious activity
Analysis date: December 27, 2023, 16:19:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

96D1196BD8E52D9889656B2960A27E5B

SHA1:

75B17106B9AA54CCEA7583C8339B81993F27E69E

SHA256:

75F32AB1A2E666CA53D9D8E3D9D6D7E64EE068AA92AF66BDD1E4F6527E83E1EC

SSDEEP:

98304:p+cD4dn4FEEnnT/6wIIeFEEnnT/6wIIeFEEnnT/6wIIDO7UClKtIu/uuf+EE2nuG:i/U

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 1576)
      • CheatEngine75.tmp (PID: 1496)
      • net.exe (PID: 1824)

    • Starts Visual C# compiler

      • sdiagnhost.exe (PID: 2860)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • CheatEngine75.tmp (PID: 316)
      • CheatEngine75.tmp (PID: 1496)

    • Reads settings of System Certificates

      • CheatEngine75.tmp (PID: 316)
      • msdt.exe (PID: 2528)

    • Reads the Internet Settings

      • CheatEngine75.tmp (PID: 316)
      • saBSI.exe (PID: 1216)
      • Cheat Engine.exe (PID: 148)
      • Cheat Engine.exe (PID: 1992)
      • sdiagnhost.exe (PID: 2860)

    • Uses ICACLS.EXE to modify access control lists

      • CheatEngine75.tmp (PID: 1496)

    • Starts SC.EXE for service management

      • CheatEngine75.tmp (PID: 1496)

    • Checks Windows Trust Settings

      • saBSI.exe (PID: 1216)

    • Reads security settings of Internet Explorer

      • saBSI.exe (PID: 1216)

    • Probably uses Microsoft diagnostics tool to execute malicious payload

      • pcwrun.exe (PID: 2548)

    • Uses .NET C# to load dll

      • sdiagnhost.exe (PID: 2860)

  • INFO

    • Drops the executable file immediately after the start

      • CheatEngine75.exe (PID: 124)
      • CheatEngine75.exe (PID: 532)
      • CheatEngine75.tmp (PID: 316)
      • CheatEngine75.exe (PID: 1236)
      • CheatEngine75.tmp (PID: 1496)
      • msdt.exe (PID: 2528)
      • csc.exe (PID: 1484)
      • csc.exe (PID: 3036)
      • csc.exe (PID: 3048)

    • Create files in a temporary directory

      • CheatEngine75.exe (PID: 124)
      • CheatEngine75.exe (PID: 532)
      • CheatEngine75.tmp (PID: 316)
      • CheatEngine75.exe (PID: 1236)
      • pcwrun.exe (PID: 2548)
      • sdiagnhost.exe (PID: 2860)
      • csc.exe (PID: 1484)
      • cvtres.exe (PID: 948)
      • csc.exe (PID: 3036)
      • msdt.exe (PID: 2528)
      • cvtres.exe (PID: 2972)
      • csc.exe (PID: 3048)
      • cvtres.exe (PID: 3024)

    • Checks supported languages

      • CheatEngine75.exe (PID: 124)
      • CheatEngine75.tmp (PID: 1432)
      • CheatEngine75.exe (PID: 532)
      • CheatEngine75.tmp (PID: 316)
      • saBSI.exe (PID: 1216)
      • CheatEngine75.exe (PID: 1236)
      • CheatEngine75.tmp (PID: 1496)
      • windowsrepair.exe (PID: 1880)
      • Cheat Engine.exe (PID: 148)
      • cheatengine-i386.exe (PID: 1600)
      • Cheat Engine.exe (PID: 1992)
      • cheatengine-i386.exe (PID: 2912)
      • Kernelmoduleunloader.exe (PID: 188)
      • csc.exe (PID: 1484)
      • cvtres.exe (PID: 948)
      • csc.exe (PID: 3036)
      • cvtres.exe (PID: 3024)
      • csc.exe (PID: 3048)
      • cvtres.exe (PID: 2972)

    • Reads the computer name

      • CheatEngine75.tmp (PID: 1432)
      • CheatEngine75.tmp (PID: 316)
      • saBSI.exe (PID: 1216)
      • CheatEngine75.tmp (PID: 1496)
      • Cheat Engine.exe (PID: 148)
      • cheatengine-i386.exe (PID: 1600)
      • Cheat Engine.exe (PID: 1992)
      • cheatengine-i386.exe (PID: 2912)
      • Kernelmoduleunloader.exe (PID: 188)

    • Reads the machine GUID from the registry

      • CheatEngine75.tmp (PID: 316)
      • saBSI.exe (PID: 1216)
      • csc.exe (PID: 1484)
      • cvtres.exe (PID: 948)
      • csc.exe (PID: 3036)
      • cvtres.exe (PID: 2972)
      • csc.exe (PID: 3048)
      • cvtres.exe (PID: 3024)

    • Creates files in the program directory

      • saBSI.exe (PID: 1216)
      • CheatEngine75.tmp (PID: 1496)

    • Process drops SQLite DLL files

      • CheatEngine75.tmp (PID: 1496)

    • Process drops legitimate windows executable

      • CheatEngine75.tmp (PID: 1496)
      • msdt.exe (PID: 2528)

    • Manual execution by a user

      • Cheat Engine.exe (PID: 1992)
      • Cheat Engine.exe (PID: 2292)
      • pcwrun.exe (PID: 2548)

    • Reads security settings of Internet Explorer

      • msdt.exe (PID: 2528)
      • sdiagnhost.exe (PID: 2860)

    • Creates files or folders in the user directory

      • msdt.exe (PID: 2528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:15 15:54:16+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 89600
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 7.5.0.0
ProductVersionNumber: 7.5.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: EngineGame Installer
FileVersion: 7.5.0
LegalCopyright: © EngineGame
OriginalFileName:
ProductName: EngineGame
ProductVersion: 7.5.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
31
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start cheatengine75.exe no specs cheatengine75.tmp no specs cheatengine75.exe cheatengine75.tmp sabsi.exe cheatengine75.exe no specs cheatengine75.tmp no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs icacls.exe no specs kernelmoduleunloader.exe windowsrepair.exe no specs icacls.exe no specs cheat engine.exe no specs cheatengine-i386.exe cheat engine.exe no specs cheat engine.exe cheatengine-i386.exe pcwrun.exe no specs msdt.exe no specs sdiagnhost.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe" C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe—explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
EngineGame Installer
Exit code:
0
Version:
7.5.0
Modules
Images
c:\users\admin\appdata\local\temp\cheatengine75.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
148"C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe—CheatEngine75.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
6.3.0.0
Modules
Images
c:\program files\cheat engine 7.5\cheat engine.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
188"C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUPC:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe
CheatEngine75.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\cheat engine 7.5\kernelmoduleunloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
316"C:\Users\admin\AppData\Local\Temp\is-JI7QT.tmp\CheatEngine75.tmp" /SL5="$501AC,2349502,832512,C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe" /SPAWNWND=$50128 /NOTIFYWND=$301AA C:\Users\admin\AppData\Local\Temp\is-JI7QT.tmp\CheatEngine75.tmp
CheatEngine75.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ji7qt.tmp\cheatengine75.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
532"C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe" /SPAWNWND=$50128 /NOTIFYWND=$301AA C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe
CheatEngine75.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
EngineGame Installer
Exit code:
0
Version:
7.5.0
Modules
Images
c:\users\admin\appdata\local\temp\cheatengine75.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
948C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES1DB1.tmp" "c:\Users\admin\AppData\Local\Temp\CSC1DB0.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
1216"C:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\prod0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=DEC:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\prod0_extract\saBSI.exe
CheatEngine75.tmp
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Exit code:
4294967295
Version:
4,1,1,818
Modules
Images
c:\users\admin\appdata\local\temp\is-6fsbj.tmp\prod0_extract\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1236"C:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\CheatEngine75.exe" /VERYSILENT /ZBDISTC:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\CheatEngine75.exe—CheatEngine75.tmp
User:
admin
Company:
Cheat Engine
Integrity Level:
HIGH
Description:
Cheat Engine Setup
Exit code:
0
Version:
7.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-6fsbj.tmp\cheatengine75.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1432"C:\Users\admin\AppData\Local\Temp\is-NV8JG.tmp\CheatEngine75.tmp" /SL5="$301AA,2349502,832512,C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe" C:\Users\admin\AppData\Local\Temp\is-NV8JG.tmp\CheatEngine75.tmp—CheatEngine75.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-nv8jg.tmp\cheatengine75.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1484"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\xq_wwnsb.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
11 462
Read events
11 390
Write events
62
Delete events
10

Modification events

(PID) Process:(316) CheatEngine75.tmpKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(316) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(316) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(316) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(316) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(316) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E7070C0003001B00100014002200A001010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(1496) CheatEngine75.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
115
(PID) Process:(1496) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete valueName:RegFilesHash
Value:
C7E30D59F3643AD52D9FB9593C8D30C540456FCD236CC4D107CF9B35C65D3C8E
(PID) Process:(1496) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete valueName:RegFiles0000
Value:
C:\Program Files\Cheat Engine 7.5\windowsrepair.exe
(PID) Process:(1496) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete valueName:Sequence
Value:
1
Executable files
130
Suspicious files
62
Text files
454
Unknown types
0

Dropped files

PID
Process
Filename
Type
316CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\zbShieldUtils.dllexecutable
MD5:FAD0877741DA31AB87913EF1F1F2EB1A
SHA256:73FF938887449779E7A9D51100D7BE2195198A5E2C4C7DE5F93CEAC7E98E3E02
532CheatEngine75.exeC:\Users\admin\AppData\Local\Temp\is-JI7QT.tmp\CheatEngine75.tmpexecutable
MD5:2DBB23C62848635C596FA85BA7DEE128
SHA256:296DF81AD382686280652E45750AB5D9C0C35D4B308265FE5FF039017B7345A3
124CheatEngine75.exeC:\Users\admin\AppData\Local\Temp\is-NV8JG.tmp\CheatEngine75.tmpexecutable
MD5:2DBB23C62848635C596FA85BA7DEE128
SHA256:296DF81AD382686280652E45750AB5D9C0C35D4B308265FE5FF039017B7345A3
316CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\CheatEngine75.exeexecutable
MD5:E0F666FE4FF537FB8587CCD215E41E5F
SHA256:F88B0E5A32A395AB9996452D461820679E55C19952EFFE991DEE8FEDEA1968AF
316CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\is-3D8AB.tmpimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
316CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\logo.pngimage
MD5:6B7CB2A5A8B301C788C3792802696FE8
SHA256:3EED2E41BC6CA0AE9A5D5EE6D57CA727E5CBA6AC8E8C5234AC661F9080CEDADF
316CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\finish.pngimage
MD5:6B7CB2A5A8B301C788C3792802696FE8
SHA256:3EED2E41BC6CA0AE9A5D5EE6D57CA727E5CBA6AC8E8C5234AC661F9080CEDADF
316CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\is-JO2EB.tmpexecutable
MD5:E0F666FE4FF537FB8587CCD215E41E5F
SHA256:F88B0E5A32A395AB9996452D461820679E55C19952EFFE991DEE8FEDEA1968AF
316CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\prod0compressed
MD5:CD9C77BC5840AF008799985F397FE1C3
SHA256:26D7704B540DF18E2BCCD224DF677061FFB9F03CAB5B3C191055A84BF43A9085
316CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\is-GO4LL.tmpcompressed
MD5:CD9C77BC5840AF008799985F397FE1C3
SHA256:26D7704B540DF18E2BCCD224DF677061FFB9F03CAB5B3C191055A84BF43A9085
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
18
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
316
CheatEngine75.tmp
13.32.23.28:443
d3cored83b0wp2.cloudfront.net
AMAZON-02
US
unknown
1216
saBSI.exe
34.218.39.180:443
analytics.apis.mcafee.com
AMAZON-02
US
unknown
1216
saBSI.exe
88.221.110.59:443
sadownload.mcafee.com
Akamai International B.V.
DE
unknown
984
WerFault.exe
104.208.16.93:443
watson.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
d3cored83b0wp2.cloudfront.net
  • 13.32.23.28
  • 13.32.23.67
  • 13.32.23.72
  • 13.32.23.44
unknown
analytics.apis.mcafee.com
  • 34.218.39.180
  • 35.84.88.155
  • 35.161.52.207
  • 34.209.243.51
  • 52.34.217.174
  • 44.231.52.75
  • 35.160.42.0
  • 52.35.142.129
unknown
sadownload.mcafee.com
  • 88.221.110.59
  • 88.221.110.99
whitelisted
watson.microsoft.com
  • 104.208.16.93
whitelisted

Threats

No threats detected
Process
Message
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-6FSBJ.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CheatEngine75.exe