File name:

CheatEngine76.exe

Full analysis: https://app.any.run/tasks/40583b87-46a0-4321-b0dd-29a43edb71c6
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 09, 2025, 21:15:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
arch-exec
stealer
lua
arch-html
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

81F487F8A51713DED70994F3BDB01892

SHA1:

E9F7CEDF0CB6D04D337DD0BEFB450712F6D3F1AF

SHA256:

7F57AB6697F2D27604BE2D63D03768612E6022A1C3B708507AF8FB23D461428A

SSDEEP:

98304:qrq3BdwaTZwM9dHW9F1ya8U8qqgGPDiNoZA38EuSlNfdPI6bpEq8p8qnE5BFzfxs:eRdT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 5260)
      • CheatEngine76.tmp (PID: 2420)
      • net.exe (PID: 5228)
      • net.exe (PID: 5136)

    • Actions looks like stealing of personal data

      • servicehost.exe (PID: 6576)
      • uihost.exe (PID: 5188)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • CheatEngine76.exe (PID: 6108)
      • CheatEngine76.exe (PID: 896)
      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.exe (PID: 5344)
      • CheatEngine76.tmp (PID: 2420)
      • saBSI.exe (PID: 2564)
      • icacls.exe (PID: 6652)
      • saBSI.exe (PID: 6156)
      • installer.exe (PID: 6740)
      • installer.exe (PID: 6656)

    • Reads security settings of Internet Explorer

      • CheatEngine76.tmp (PID: 1912)
      • CheatEngine76.tmp (PID: 4692)
      • saBSI.exe (PID: 2564)
      • saBSI.exe (PID: 6156)
      • Cheat Engine.exe (PID: 720)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • uihost.exe (PID: 5188)
      • installer.exe (PID: 6656)

    • Reads the Windows owner or organization settings

      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.tmp (PID: 2420)

    • There is functionality for taking screenshot (YARA)

      • CheatEngine76.tmp (PID: 4692)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • Starts SC.EXE for service management

      • CheatEngine76.tmp (PID: 2420)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6972)
      • sc.exe (PID: 6036)
      • sc.exe (PID: 6148)

    • Uses ICACLS.EXE to modify access control lists

      • CheatEngine76.tmp (PID: 2420)

    • Process drops SQLite DLL files

      • CheatEngine76.tmp (PID: 2420)

    • Adds/modifies Windows certificates

      • saBSI.exe (PID: 2564)
      • servicehost.exe (PID: 6576)

    • Process drops legitimate windows executable

      • CheatEngine76.tmp (PID: 2420)
      • installer.exe (PID: 6656)

    • The process verifies whether the antivirus software is installed

      • saBSI.exe (PID: 6156)
      • installer.exe (PID: 6740)
      • installer.exe (PID: 6656)
      • uihost.exe (PID: 5188)
      • updater.exe (PID: 7644)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 7912)
      • servicehost.exe (PID: 6576)

    • Creates/Modifies COM task schedule object

      • installer.exe (PID: 6656)

    • The process creates files with name similar to system file names

      • installer.exe (PID: 6656)

    • Detected use of alternative data streams (AltDS)

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • There is functionality for communication over UDP network (YARA)

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • Creates a software uninstall entry

      • installer.exe (PID: 6656)
      • servicehost.exe (PID: 6576)

    • Executes as Windows Service

      • servicehost.exe (PID: 6576)

    • Reads Mozilla Firefox installation path

      • servicehost.exe (PID: 6576)
      • uihost.exe (PID: 5188)

    • Starts CMD.EXE for commands execution

      • updater.exe (PID: 7644)

    • Searches for installed software

      • updater.exe (PID: 7644)

    • Executes application which crashes

      • CheatEngine76.tmp (PID: 4692)

  • INFO

    • Checks supported languages

      • CheatEngine76.exe (PID: 6108)
      • CheatEngine76.tmp (PID: 1912)
      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.exe (PID: 896)
      • saBSI.exe (PID: 2564)
      • CheatEngine76.exe (PID: 5344)
      • CheatEngine76.tmp (PID: 2420)
      • _setup64.tmp (PID: 2236)
      • saBSI.exe (PID: 6156)
      • Kernelmoduleunloader.exe (PID: 6240)
      • windowsrepair.exe (PID: 1240)
      • installer.exe (PID: 6740)
      • installer.exe (PID: 6656)
      • Cheat Engine.exe (PID: 720)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • servicehost.exe (PID: 6576)
      • uihost.exe (PID: 5188)
      • updater.exe (PID: 7644)

    • Reads the computer name

      • CheatEngine76.tmp (PID: 1912)
      • CheatEngine76.tmp (PID: 4692)
      • saBSI.exe (PID: 2564)
      • CheatEngine76.tmp (PID: 2420)
      • CheatEngine76.exe (PID: 896)
      • saBSI.exe (PID: 6156)
      • Kernelmoduleunloader.exe (PID: 6240)
      • installer.exe (PID: 6656)
      • CheatEngine76.exe (PID: 5344)
      • Cheat Engine.exe (PID: 720)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • uihost.exe (PID: 5188)
      • servicehost.exe (PID: 6576)
      • updater.exe (PID: 7644)

    • Detects InnoSetup installer (YARA)

      • CheatEngine76.tmp (PID: 1912)
      • CheatEngine76.exe (PID: 6108)
      • CheatEngine76.exe (PID: 896)
      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.exe (PID: 5344)

    • Create files in a temporary directory

      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.exe (PID: 5344)
      • CheatEngine76.exe (PID: 6108)
      • CheatEngine76.tmp (PID: 2420)
      • CheatEngine76.exe (PID: 896)
      • saBSI.exe (PID: 6156)
      • installer.exe (PID: 6656)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • Compiled with Borland Delphi (YARA)

      • CheatEngine76.exe (PID: 6108)
      • CheatEngine76.exe (PID: 896)
      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.tmp (PID: 1912)
      • CheatEngine76.exe (PID: 5344)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • The sample compiled with english language support

      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.tmp (PID: 2420)
      • saBSI.exe (PID: 2564)
      • installer.exe (PID: 6740)
      • installer.exe (PID: 6656)

    • Reads the software policy settings

      • CheatEngine76.tmp (PID: 4692)
      • saBSI.exe (PID: 2564)
      • saBSI.exe (PID: 6156)
      • slui.exe (PID: 4892)
      • installer.exe (PID: 6656)
      • servicehost.exe (PID: 6576)
      • uihost.exe (PID: 5188)
      • updater.exe (PID: 7644)
      • slui.exe (PID: 6248)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • Checks proxy server information

      • CheatEngine76.tmp (PID: 4692)
      • saBSI.exe (PID: 2564)
      • saBSI.exe (PID: 6156)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • slui.exe (PID: 6248)

    • Reads the machine GUID from the registry

      • CheatEngine76.tmp (PID: 4692)
      • saBSI.exe (PID: 6156)
      • saBSI.exe (PID: 2564)
      • installer.exe (PID: 6656)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • servicehost.exe (PID: 6576)
      • uihost.exe (PID: 5188)
      • updater.exe (PID: 7644)

    • Process checks computer location settings

      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.tmp (PID: 1912)
      • Cheat Engine.exe (PID: 720)
      • uihost.exe (PID: 5188)
      • servicehost.exe (PID: 6576)

    • Creates files in the program directory

      • saBSI.exe (PID: 2564)
      • CheatEngine76.tmp (PID: 2420)
      • installer.exe (PID: 6740)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • installer.exe (PID: 6656)
      • saBSI.exe (PID: 6156)
      • servicehost.exe (PID: 6576)
      • uihost.exe (PID: 5188)

    • Creates a software uninstall entry

      • CheatEngine76.tmp (PID: 2420)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5020)
      • WerFault.exe (PID: 6240)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • The process uses Lua

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • Manual execution by a user

      • Taskmgr.exe (PID: 3192)
      • Taskmgr.exe (PID: 4988)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 4988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 159744
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 7.6.0.0
ProductVersionNumber: 7.6.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: ЕngineGame Downloader
FileVersion: 7.6.0
LegalCopyright: © ЕngineGame
OriginalFileName:
ProductName: ЕngineGame
ProductVersion: 7.6.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
191
Monitored processes
49
Malicious processes
9
Suspicious processes
3

Behavior graph

Click at the process to see the details
start cheatengine76.exe cheatengine76.tmp no specs cheatengine76.exe cheatengine76.tmp sppextcomobj.exe no specs slui.exe sabsi.exe cheatengine76.exe cheatengine76.tmp net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs _setup64.tmp no specs conhost.exe no specs icacls.exe conhost.exe no specs sabsi.exe kernelmoduleunloader.exe no specs slui.exe windowsrepair.exe no specs icacls.exe no specs conhost.exe no specs installer.exe installer.exe cheat engine.exe no specs cheatengine-x86_64-sse4-avx2.exe werfault.exe no specs werfault.exe no specs servicehost.exe uihost.exe updater.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\Program Files\Cheat Engine\Cheat Engine.exe"C:\Program Files\Cheat Engine\Cheat Engine.exe—CheatEngine76.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
6.3.0.0
Modules
Images
c:\program files\cheat engine\cheat engine.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896"C:\Users\admin\AppData\Local\Temp\CheatEngine76.exe" /SPAWNWND=$6028A /NOTIFYWND=$7034C C:\Users\admin\AppData\Local\Temp\CheatEngine76.exe
CheatEngine76.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
ЕngineGame Downloader
Exit code:
3221226525
Version:
7.6.0
Modules
Images
c:\users\admin\appdata\local\temp\cheatengine76.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
1040"icacls" "C:\Program Files\Cheat Engine" /grant *S-1-15-2-1:(OI)(CI)(RX)C:\Windows\System32\icacls.exe—CheatEngine76.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1096\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240"C:\Program Files\Cheat Engine\windowsrepair.exe" /sC:\Program Files\Cheat Engine\windowsrepair.exe—CheatEngine76.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\cheat engine\windowsrepair.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1272\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1568C:\WINDOWS\system32\net1 stop BadlionAnticC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\netutils.dll
1764C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1912"C:\Users\admin\AppData\Local\Temp\is-1NCUB.tmp\CheatEngine76.tmp" /SL5="$7034C,2341115,845824,C:\Users\admin\AppData\Local\Temp\CheatEngine76.exe" C:\Users\admin\AppData\Local\Temp\is-1NCUB.tmp\CheatEngine76.tmp—CheatEngine76.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
3221226525
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-1ncub.tmp\cheatengine76.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
Total events
35 908
Read events
35 622
Write events
265
Delete events
21

Modification events

(PID) Process:(2564) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:UUID
Value:
{7B30F5B1-357A-41C9-A608-FE224DF69DB3}
(PID) Process:(2564) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:InstallerFlags
Value:
1
(PID) Process:(4692) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E907040003000900150010003400EF00010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(4692) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
01000000000000007ED0A9B694A9DB01
(PID) Process:(2420) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
74090000BF1129B794A9DB01
(PID) Process:(2420) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
1CCD6956E0411D84EDC7CAC318133EFD853BC6A324AD0025B4A41B25DFF8C643
(PID) Process:(2420) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(2420) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFiles0000
Value:
C:\Program Files\Cheat Engine\windowsrepair.exe
(PID) Process:(2420) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFilesHash
Value:
CA4C7AD46170FDDD363133B0DFEC6916D464EDD067B14B476C84F68A1963B5CF
(PID) Process:(2564) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
Operation:delete valueName:4EFC31460C619ECAE59C1BCE2C008036D94C84B8
Value:
Executable files
161
Suspicious files
286
Text files
1 200
Unknown types
0

Dropped files

PID
Process
Filename
Type
896CheatEngine76.exeC:\Users\admin\AppData\Local\Temp\is-GVDA4.tmp\CheatEngine76.tmpexecutable
MD5:24F7AE63B369D26136574781735A2F6C
SHA256:CC34EC320B9C5DF608E9F7EEFFAD8C4885FCED83F9F41E66F4CB90EB3D9143B3
6108CheatEngine76.exeC:\Users\admin\AppData\Local\Temp\is-1NCUB.tmp\CheatEngine76.tmpexecutable
MD5:24F7AE63B369D26136574781735A2F6C
SHA256:CC34EC320B9C5DF608E9F7EEFFAD8C4885FCED83F9F41E66F4CB90EB3D9143B3
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\logo.pngimage
MD5:9CC8A637A7DE5C9C101A3047C7FBBB33
SHA256:8C5C80BBC6B0FDB367EAB1253517D8B156C85545A2D37D1EE4B78F3041D9B5DB
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\prod0compressed
MD5:F68008B70822BD28C82D13A289DEB418
SHA256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\is-DM39F.tmpimage
MD5:378F74A0CBDD582D8B434B7B978FF375
SHA256:1225AFDA135B0BF3B5633595AF4096F8C6620EBB34AA5DF7C64253F03668B33D
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\WebAdvisor.pngimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\finish.pngimage
MD5:B24E872BD8F92295273197602AAC8352
SHA256:41031EFC4F7E322DC5FFACC94B9296FB28B9B922B1CE3B3DA13BF659A5FD2985
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\is-B83S3.tmpimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
2564saBSI.exeC:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_00000057003F001D0006.txttext
MD5:F1A9692FDF2CE5CFA060F70ABA673465
SHA256:278B939CCF82ADC487DB57389E08F22E6F1CC7225296581999D637BA81403A6C
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\is-6TMUA.tmpcompressed
MD5:F68008B70822BD28C82D13A289DEB418
SHA256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
37
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5972
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5744
cheatengine-x86_64-SSE4-AVX2.exe
GET
200
142.250.186.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
5972
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5744
cheatengine-x86_64-SSE4-AVX2.exe
GET
200
142.250.186.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4692
CheatEngine76.tmp
18.245.78.141:443
d37tdtb0ed9odn.cloudfront.net
—
US
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5972
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.74.206
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.25
  • 23.216.77.42
  • 23.216.77.28
  • 23.216.77.20
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.0
  • 40.126.31.1
  • 20.190.159.128
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
d37tdtb0ed9odn.cloudfront.net
  • 18.245.78.141
  • 18.245.78.213
  • 18.245.78.200
  • 18.245.78.129
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CheatEngine76.exe