File name:

CheatEngine75.exe

Full analysis: https://app.any.run/tasks/99920a14-d1e4-4ba9-94b4-556fc187f24f
Verdict: Malicious activity
Analysis date: November 28, 2023, 23:55:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

96D1196BD8E52D9889656B2960A27E5B

SHA1:

75B17106B9AA54CCEA7583C8339B81993F27E69E

SHA256:

75F32AB1A2E666CA53D9D8E3D9D6D7E64EE068AA92AF66BDD1E4F6527E83E1EC

SSDEEP:

98304:p+cD4dn4FEEnnT/6wIIeFEEnnT/6wIIeFEEnnT/6wIIDO7UClKtIu/uuf+EE2nuG:i/U

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • CheatEngine75.exe (PID: 2708)
      • CheatEngine75.exe (PID: 2512)
      • CheatEngine75.tmp (PID: 2504)
      • CheatEngine75.exe (PID: 2760)
      • CheatEngine75.tmp (PID: 944)

    • Starts NET.EXE for service management

      • CheatEngine75.tmp (PID: 944)
      • net.exe (PID: 3380)
      • net.exe (PID: 2336)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • CheatEngine75.tmp (PID: 2504)
      • CheatEngine75.tmp (PID: 944)

    • Reads settings of System Certificates

      • CheatEngine75.tmp (PID: 2504)

    • Reads the Internet Settings

      • CheatEngine75.tmp (PID: 2504)
      • Cheat Engine.exe (PID: 2696)
      • Cheat Engine.exe (PID: 3900)
      • saBSI.exe (PID: 1452)

    • Starts SC.EXE for service management

      • CheatEngine75.tmp (PID: 944)

    • Uses ICACLS.EXE to modify access control lists

      • CheatEngine75.tmp (PID: 944)

    • Reads security settings of Internet Explorer

      • saBSI.exe (PID: 1452)

    • Process drops SQLite DLL files

      • CheatEngine75.tmp (PID: 944)

    • Process drops legitimate windows executable

      • CheatEngine75.tmp (PID: 944)

    • Checks Windows Trust Settings

      • saBSI.exe (PID: 1452)

  • INFO

    • Create files in a temporary directory

      • CheatEngine75.exe (PID: 2708)
      • CheatEngine75.exe (PID: 2512)
      • CheatEngine75.tmp (PID: 2504)
      • CheatEngine75.exe (PID: 2760)

    • Checks supported languages

      • CheatEngine75.tmp (PID: 128)
      • CheatEngine75.exe (PID: 2708)
      • CheatEngine75.exe (PID: 2512)
      • CheatEngine75.tmp (PID: 2504)
      • wmpnscfg.exe (PID: 2952)
      • CheatEngine75.tmp (PID: 944)
      • CheatEngine75.exe (PID: 2760)
      • saBSI.exe (PID: 1452)
      • Cheat Engine.exe (PID: 2696)
      • Kernelmoduleunloader.exe (PID: 3084)
      • windowsrepair.exe (PID: 3712)
      • cheatengine-i386.exe (PID: 3252)
      • Cheat Engine.exe (PID: 3900)
      • cheatengine-i386.exe (PID: 3496)

    • Reads the computer name

      • CheatEngine75.tmp (PID: 128)
      • CheatEngine75.tmp (PID: 2504)
      • wmpnscfg.exe (PID: 2952)
      • saBSI.exe (PID: 1452)
      • CheatEngine75.tmp (PID: 944)
      • Kernelmoduleunloader.exe (PID: 3084)
      • Cheat Engine.exe (PID: 2696)
      • cheatengine-i386.exe (PID: 3252)
      • Cheat Engine.exe (PID: 3900)
      • cheatengine-i386.exe (PID: 3496)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2952)
      • Cheat Engine.exe (PID: 3900)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 2952)
      • CheatEngine75.tmp (PID: 2504)
      • saBSI.exe (PID: 1452)

    • Creates files in the program directory

      • saBSI.exe (PID: 1452)
      • CheatEngine75.tmp (PID: 944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:15 15:54:16+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 89600
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 7.5.0.0
ProductVersionNumber: 7.5.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: EngineGame Installer
FileVersion: 7.5.0
LegalCopyright: © EngineGame
OriginalFileName:
ProductName: EngineGame
ProductVersion: 7.5.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
22
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cheatengine75.exe no specs cheatengine75.tmp no specs cheatengine75.exe cheatengine75.tmp wmpnscfg.exe no specs sabsi.exe cheatengine75.exe no specs cheatengine75.tmp no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs icacls.exe no specs kernelmoduleunloader.exe windowsrepair.exe no specs icacls.exe no specs cheat engine.exe no specs cheatengine-i386.exe cheat engine.exe cheatengine-i386.exe

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Users\admin\AppData\Local\Temp\is-PVBA3.tmp\CheatEngine75.tmp" /SL5="$701E6,2349502,832512,C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe" C:\Users\admin\AppData\Local\Temp\is-PVBA3.tmp\CheatEngine75.tmp—CheatEngine75.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-pvba3.tmp\cheatengine75.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
944"C:\Users\admin\AppData\Local\Temp\is-1S8O2.tmp\CheatEngine75.tmp" /SL5="$80108,26511452,832512,C:\Users\admin\AppData\Local\Temp\is-MA738.tmp\CheatEngine75.exe" /VERYSILENT /ZBDISTC:\Users\admin\AppData\Local\Temp\is-1S8O2.tmp\CheatEngine75.tmp—CheatEngine75.exe
User:
admin
Company:
Cheat Engine
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-1s8o2.tmp\cheatengine75.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1452"C:\Users\admin\AppData\Local\Temp\is-MA738.tmp\prod0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=DEC:\Users\admin\AppData\Local\Temp\is-MA738.tmp\prod0_extract\saBSI.exe
CheatEngine75.tmp
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Exit code:
4294967295
Version:
4,1,1,818
Modules
Images
c:\users\admin\appdata\local\temp\is-ma738.tmp\prod0_extract\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1660"sc" delete BadlionAnticC:\Windows\System32\sc.exe—CheatEngine75.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1728C:\Windows\system32\net1 stop BadlionAnticheatC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
2336"net" stop BadlionAnticheatC:\Windows\System32\net.exe—CheatEngine75.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
2504"C:\Users\admin\AppData\Local\Temp\is-V3MON.tmp\CheatEngine75.tmp" /SL5="$D0194,2349502,832512,C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe" /SPAWNWND=$7019C /NOTIFYWND=$701E6 C:\Users\admin\AppData\Local\Temp\is-V3MON.tmp\CheatEngine75.tmp
CheatEngine75.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-v3mon.tmp\cheatengine75.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2512"C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe" /SPAWNWND=$7019C /NOTIFYWND=$701E6 C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe
CheatEngine75.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
EngineGame Installer
Exit code:
0
Version:
7.5.0
Modules
Images
c:\users\admin\appdata\local\temp\cheatengine75.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2696"C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe—CheatEngine75.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
6.3.0.0
Modules
Images
c:\program files\cheat engine 7.5\cheat engine.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2708"C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe" C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe—explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
EngineGame Installer
Exit code:
0
Version:
7.5.0
Modules
Images
c:\users\admin\appdata\local\temp\cheatengine75.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
6 032
Read events
5 981
Write events
38
Delete events
13

Modification events

(PID) Process:(2952) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{5D6FDBA1-AC93-4CC0-9BDA-8AE41E3C841D}\{2EA63D80-004F-4B63-8203-9BC0C518550B}
Operation:delete keyName:(default)
Value:
(PID) Process:(2952) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{5D6FDBA1-AC93-4CC0-9BDA-8AE41E3C841D}
Operation:delete keyName:(default)
Value:
(PID) Process:(2952) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{E6A34EFB-EC33-4A18-B117-8FFEACD8A1FA}
Operation:delete keyName:(default)
Value:
(PID) Process:(2504) CheatEngine75.tmpKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2504) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2504) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2504) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2504) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2504) CheatEngine75.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E7070B0002001C00170038000400E003010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(944) CheatEngine75.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
115
Executable files
125
Suspicious files
47
Text files
431
Unknown types
0

Dropped files

PID
Process
Filename
Type
2504CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-MA738.tmp\finish.pngimage
MD5:6B7CB2A5A8B301C788C3792802696FE8
SHA256:3EED2E41BC6CA0AE9A5D5EE6D57CA727E5CBA6AC8E8C5234AC661F9080CEDADF
2504CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-MA738.tmp\error.pngimage
MD5:6B7CB2A5A8B301C788C3792802696FE8
SHA256:3EED2E41BC6CA0AE9A5D5EE6D57CA727E5CBA6AC8E8C5234AC661F9080CEDADF
2504CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-MA738.tmp\WebAdvisor.pngimage
MD5:E7E01716964900D02C8DF9DB3125F8FE
SHA256:79301DD2BB2C8A67852C63163A3FF6448D9EFB202A611404F82C348BF9D1A5D2
2504CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-MA738.tmp\is-EHN0D.tmpimage
MD5:E7E01716964900D02C8DF9DB3125F8FE
SHA256:79301DD2BB2C8A67852C63163A3FF6448D9EFB202A611404F82C348BF9D1A5D2
2504CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-MA738.tmp\is-FITGS.tmpcompressed
MD5:CD9C77BC5840AF008799985F397FE1C3
SHA256:26D7704B540DF18E2BCCD224DF677061FFB9F03CAB5B3C191055A84BF43A9085
2504CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-MA738.tmp\zbShieldUtils.dllexecutable
MD5:FAD0877741DA31AB87913EF1F1F2EB1A
SHA256:73FF938887449779E7A9D51100D7BE2195198A5E2C4C7DE5F93CEAC7E98E3E02
2504CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-MA738.tmp\CheatEngine75.exeexecutable
MD5:E0F666FE4FF537FB8587CCD215E41E5F
SHA256:F88B0E5A32A395AB9996452D461820679E55C19952EFFE991DEE8FEDEA1968AF
944CheatEngine75.tmpC:\Program Files\Cheat Engine 7.5\is-B9721.tmpexecutable
MD5:9A4D1B5154194EA0C42EFEBEB73F318F
SHA256:2F3214F799B0F0A2F3955DBDC64C7E7C0E216F1A09D2C1AD5D0A99921782E363
2760CheatEngine75.exeC:\Users\admin\AppData\Local\Temp\is-1S8O2.tmp\CheatEngine75.tmpexecutable
MD5:9AA2ACD4C96F8BA03BB6C3EA806D806F
SHA256:1B81562FDAEAA1BC22CBAA15C92BAB90A12080519916CFA30C843796021153BB
2708CheatEngine75.exeC:\Users\admin\AppData\Local\Temp\is-PVBA3.tmp\CheatEngine75.tmpexecutable
MD5:2DBB23C62848635C596FA85BA7DEE128
SHA256:296DF81AD382686280652E45750AB5D9C0C35D4B308265FE5FF039017B7345A3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
16
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
868
svchost.exe
95.101.148.135:80
—
Akamai International B.V.
NL
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
868
svchost.exe
184.30.20.134:80
armmf.adobe.com
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2504
CheatEngine75.tmp
18.245.78.226:443
d3cored83b0wp2.cloudfront.net
—
US
unknown
1452
saBSI.exe
34.213.112.26:443
analytics.apis.mcafee.com
AMAZON-02
US
unknown
1452
saBSI.exe
23.50.131.76:443
sadownload.mcafee.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
armmf.adobe.com
  • 184.30.20.134
whitelisted
d3cored83b0wp2.cloudfront.net
  • 18.245.78.226
  • 18.245.78.159
  • 18.245.78.24
  • 18.245.78.134
unknown
analytics.apis.mcafee.com
  • 34.213.112.26
  • 35.83.27.31
  • 52.41.182.30
  • 54.148.66.20
  • 35.84.88.155
  • 52.89.229.104
  • 52.89.205.168
  • 35.82.215.155
unknown
sadownload.mcafee.com
  • 23.50.131.76
  • 23.50.131.75
whitelisted

Threats

No threats detected
Process
Message
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-MA738.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-MA738.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-MA738.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-MA738.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-MA738.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-MA738.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CheatEngine75.exe