File name:

CheatEngine76.exe

Full analysis: https://app.any.run/tasks/40583b87-46a0-4321-b0dd-29a43edb71c6
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 09, 2025, 21:15:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
arch-exec
stealer
lua
arch-html
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

81F487F8A51713DED70994F3BDB01892

SHA1:

E9F7CEDF0CB6D04D337DD0BEFB450712F6D3F1AF

SHA256:

7F57AB6697F2D27604BE2D63D03768612E6022A1C3B708507AF8FB23D461428A

SSDEEP:

98304:qrq3BdwaTZwM9dHW9F1ya8U8qqgGPDiNoZA38EuSlNfdPI6bpEq8p8qnE5BFzfxs:eRdT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • CheatEngine76.tmp (PID: 2420)
      • net.exe (PID: 5260)
      • net.exe (PID: 5228)
      • net.exe (PID: 5136)

    • Actions looks like stealing of personal data

      • servicehost.exe (PID: 6576)
      • uihost.exe (PID: 5188)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • CheatEngine76.exe (PID: 896)
      • CheatEngine76.exe (PID: 6108)
      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.exe (PID: 5344)
      • CheatEngine76.tmp (PID: 2420)
      • icacls.exe (PID: 6652)
      • saBSI.exe (PID: 2564)
      • saBSI.exe (PID: 6156)
      • installer.exe (PID: 6656)
      • installer.exe (PID: 6740)

    • Reads security settings of Internet Explorer

      • CheatEngine76.tmp (PID: 1912)
      • CheatEngine76.tmp (PID: 4692)
      • saBSI.exe (PID: 2564)
      • saBSI.exe (PID: 6156)
      • Cheat Engine.exe (PID: 720)
      • installer.exe (PID: 6656)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • uihost.exe (PID: 5188)

    • Reads the Windows owner or organization settings

      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.tmp (PID: 2420)

    • There is functionality for taking screenshot (YARA)

      • CheatEngine76.tmp (PID: 4692)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6148)
      • sc.exe (PID: 6972)
      • sc.exe (PID: 6036)

    • Starts SC.EXE for service management

      • CheatEngine76.tmp (PID: 2420)

    • Uses ICACLS.EXE to modify access control lists

      • CheatEngine76.tmp (PID: 2420)

    • Adds/modifies Windows certificates

      • saBSI.exe (PID: 2564)
      • servicehost.exe (PID: 6576)

    • The process verifies whether the antivirus software is installed

      • installer.exe (PID: 6740)
      • saBSI.exe (PID: 6156)
      • installer.exe (PID: 6656)
      • uihost.exe (PID: 5188)
      • servicehost.exe (PID: 6576)
      • updater.exe (PID: 7644)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 7912)

    • Process drops SQLite DLL files

      • CheatEngine76.tmp (PID: 2420)

    • Process drops legitimate windows executable

      • CheatEngine76.tmp (PID: 2420)
      • installer.exe (PID: 6656)

    • Detected use of alternative data streams (AltDS)

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • Executes application which crashes

      • CheatEngine76.tmp (PID: 4692)

    • The process creates files with name similar to system file names

      • installer.exe (PID: 6656)

    • Creates/Modifies COM task schedule object

      • installer.exe (PID: 6656)

    • Creates a software uninstall entry

      • installer.exe (PID: 6656)
      • servicehost.exe (PID: 6576)

    • Executes as Windows Service

      • servicehost.exe (PID: 6576)

    • There is functionality for communication over UDP network (YARA)

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • Reads Mozilla Firefox installation path

      • uihost.exe (PID: 5188)
      • servicehost.exe (PID: 6576)

    • Searches for installed software

      • updater.exe (PID: 7644)

    • Starts CMD.EXE for commands execution

      • updater.exe (PID: 7644)

  • INFO

    • Process checks computer location settings

      • CheatEngine76.tmp (PID: 1912)
      • CheatEngine76.tmp (PID: 4692)
      • Cheat Engine.exe (PID: 720)
      • uihost.exe (PID: 5188)
      • servicehost.exe (PID: 6576)

    • Reads the computer name

      • CheatEngine76.tmp (PID: 1912)
      • CheatEngine76.exe (PID: 896)
      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.exe (PID: 5344)
      • CheatEngine76.tmp (PID: 2420)
      • saBSI.exe (PID: 2564)
      • saBSI.exe (PID: 6156)
      • Kernelmoduleunloader.exe (PID: 6240)
      • installer.exe (PID: 6656)
      • Cheat Engine.exe (PID: 720)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • servicehost.exe (PID: 6576)
      • uihost.exe (PID: 5188)
      • updater.exe (PID: 7644)

    • Checks supported languages

      • CheatEngine76.exe (PID: 6108)
      • CheatEngine76.exe (PID: 896)
      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.tmp (PID: 1912)
      • saBSI.exe (PID: 2564)
      • CheatEngine76.tmp (PID: 2420)
      • CheatEngine76.exe (PID: 5344)
      • _setup64.tmp (PID: 2236)
      • saBSI.exe (PID: 6156)
      • Kernelmoduleunloader.exe (PID: 6240)
      • windowsrepair.exe (PID: 1240)
      • installer.exe (PID: 6740)
      • Cheat Engine.exe (PID: 720)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • installer.exe (PID: 6656)
      • servicehost.exe (PID: 6576)
      • updater.exe (PID: 7644)
      • uihost.exe (PID: 5188)

    • Create files in a temporary directory

      • CheatEngine76.exe (PID: 6108)
      • CheatEngine76.exe (PID: 896)
      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.tmp (PID: 2420)
      • CheatEngine76.exe (PID: 5344)
      • saBSI.exe (PID: 6156)
      • installer.exe (PID: 6656)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • Compiled with Borland Delphi (YARA)

      • CheatEngine76.tmp (PID: 1912)
      • CheatEngine76.exe (PID: 896)
      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.exe (PID: 6108)
      • CheatEngine76.exe (PID: 5344)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • Reads the machine GUID from the registry

      • CheatEngine76.tmp (PID: 4692)
      • saBSI.exe (PID: 2564)
      • saBSI.exe (PID: 6156)
      • installer.exe (PID: 6656)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • servicehost.exe (PID: 6576)
      • uihost.exe (PID: 5188)
      • updater.exe (PID: 7644)

    • Checks proxy server information

      • CheatEngine76.tmp (PID: 4692)
      • saBSI.exe (PID: 2564)
      • saBSI.exe (PID: 6156)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • slui.exe (PID: 6248)

    • Detects InnoSetup installer (YARA)

      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.exe (PID: 896)
      • CheatEngine76.exe (PID: 6108)
      • CheatEngine76.tmp (PID: 1912)
      • CheatEngine76.exe (PID: 5344)

    • The sample compiled with english language support

      • CheatEngine76.tmp (PID: 4692)
      • CheatEngine76.tmp (PID: 2420)
      • saBSI.exe (PID: 2564)
      • installer.exe (PID: 6740)
      • installer.exe (PID: 6656)

    • Reads the software policy settings

      • CheatEngine76.tmp (PID: 4692)
      • saBSI.exe (PID: 2564)
      • slui.exe (PID: 4892)
      • saBSI.exe (PID: 6156)
      • installer.exe (PID: 6656)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • servicehost.exe (PID: 6576)
      • uihost.exe (PID: 5188)
      • updater.exe (PID: 7644)
      • slui.exe (PID: 6248)

    • Creates files in the program directory

      • saBSI.exe (PID: 2564)
      • CheatEngine76.tmp (PID: 2420)
      • saBSI.exe (PID: 6156)
      • installer.exe (PID: 6740)
      • installer.exe (PID: 6656)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • servicehost.exe (PID: 6576)
      • uihost.exe (PID: 5188)

    • Creates a software uninstall entry

      • CheatEngine76.tmp (PID: 2420)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5020)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)
      • WerFault.exe (PID: 6240)

    • The process uses Lua

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5744)

    • Manual execution by a user

      • Taskmgr.exe (PID: 4988)
      • Taskmgr.exe (PID: 3192)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 4988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 159744
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 7.6.0.0
ProductVersionNumber: 7.6.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: ЕngineGame Downloader
FileVersion: 7.6.0
LegalCopyright: © ЕngineGame
OriginalFileName:
ProductName: ЕngineGame
ProductVersion: 7.6.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
191
Monitored processes
49
Malicious processes
9
Suspicious processes
3

Behavior graph

Click at the process to see the details
start cheatengine76.exe cheatengine76.tmp no specs cheatengine76.exe cheatengine76.tmp sppextcomobj.exe no specs slui.exe sabsi.exe cheatengine76.exe cheatengine76.tmp net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs _setup64.tmp no specs conhost.exe no specs icacls.exe conhost.exe no specs sabsi.exe kernelmoduleunloader.exe no specs slui.exe windowsrepair.exe no specs icacls.exe no specs conhost.exe no specs installer.exe installer.exe cheat engine.exe no specs cheatengine-x86_64-sse4-avx2.exe werfault.exe no specs werfault.exe no specs servicehost.exe uihost.exe updater.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\Program Files\Cheat Engine\Cheat Engine.exe"C:\Program Files\Cheat Engine\Cheat Engine.exe—CheatEngine76.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
6.3.0.0
Modules
Images
c:\program files\cheat engine\cheat engine.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896"C:\Users\admin\AppData\Local\Temp\CheatEngine76.exe" /SPAWNWND=$6028A /NOTIFYWND=$7034C C:\Users\admin\AppData\Local\Temp\CheatEngine76.exe
CheatEngine76.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
ЕngineGame Downloader
Exit code:
3221226525
Version:
7.6.0
Modules
Images
c:\users\admin\appdata\local\temp\cheatengine76.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
1040"icacls" "C:\Program Files\Cheat Engine" /grant *S-1-15-2-1:(OI)(CI)(RX)C:\Windows\System32\icacls.exe—CheatEngine76.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1096\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240"C:\Program Files\Cheat Engine\windowsrepair.exe" /sC:\Program Files\Cheat Engine\windowsrepair.exe—CheatEngine76.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\cheat engine\windowsrepair.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1272\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1568C:\WINDOWS\system32\net1 stop BadlionAnticC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\netutils.dll
1764C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1912"C:\Users\admin\AppData\Local\Temp\is-1NCUB.tmp\CheatEngine76.tmp" /SL5="$7034C,2341115,845824,C:\Users\admin\AppData\Local\Temp\CheatEngine76.exe" C:\Users\admin\AppData\Local\Temp\is-1NCUB.tmp\CheatEngine76.tmp—CheatEngine76.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
3221226525
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-1ncub.tmp\cheatengine76.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
Total events
35 908
Read events
35 622
Write events
265
Delete events
21

Modification events

(PID) Process:(2564) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:UUID
Value:
{7B30F5B1-357A-41C9-A608-FE224DF69DB3}
(PID) Process:(2564) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:InstallerFlags
Value:
1
(PID) Process:(4692) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E907040003000900150010003400EF00010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(4692) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
01000000000000007ED0A9B694A9DB01
(PID) Process:(2420) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
74090000BF1129B794A9DB01
(PID) Process:(2420) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
1CCD6956E0411D84EDC7CAC318133EFD853BC6A324AD0025B4A41B25DFF8C643
(PID) Process:(2420) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(2420) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFiles0000
Value:
C:\Program Files\Cheat Engine\windowsrepair.exe
(PID) Process:(2420) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFilesHash
Value:
CA4C7AD46170FDDD363133B0DFEC6916D464EDD067B14B476C84F68A1963B5CF
(PID) Process:(2564) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
Operation:delete valueName:4EFC31460C619ECAE59C1BCE2C008036D94C84B8
Value:
Executable files
161
Suspicious files
286
Text files
1 200
Unknown types
0

Dropped files

PID
Process
Filename
Type
6108CheatEngine76.exeC:\Users\admin\AppData\Local\Temp\is-1NCUB.tmp\CheatEngine76.tmpexecutable
MD5:24F7AE63B369D26136574781735A2F6C
SHA256:CC34EC320B9C5DF608E9F7EEFFAD8C4885FCED83F9F41E66F4CB90EB3D9143B3
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\is-B83S3.tmpimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\logo.pngimage
MD5:9CC8A637A7DE5C9C101A3047C7FBBB33
SHA256:8C5C80BBC6B0FDB367EAB1253517D8B156C85545A2D37D1EE4B78F3041D9B5DB
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\zbShieldUtils.dllexecutable
MD5:3037E3D5409FB6A697F12ADDB01BA99B
SHA256:A860BD74595430802F4E2E7AD8FD1D31D3DA3B0C9FAF17AD4641035181A5CE9E
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\WebAdvisor.pngimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
896CheatEngine76.exeC:\Users\admin\AppData\Local\Temp\is-GVDA4.tmp\CheatEngine76.tmpexecutable
MD5:24F7AE63B369D26136574781735A2F6C
SHA256:CC34EC320B9C5DF608E9F7EEFFAD8C4885FCED83F9F41E66F4CB90EB3D9143B3
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\is-DF48H.tmpimage
MD5:0B4FA89D69051DF475B75CA654752EF6
SHA256:60A9085CEA2E072D4B65748CC71F616D3137C1F0B7EED4F77E1B6C9E3AA78B7E
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\prod0_extract\saBSI.exeexecutable
MD5:143255618462A577DE27286A272584E1
SHA256:F5AA950381FBCEA7D730AA794974CA9E3310384A95D6CF4D015FBDBD9797B3E4
4692CheatEngine76.tmpC:\Users\admin\AppData\Local\Temp\is-BIJ63.tmp\finish.pngimage
MD5:B24E872BD8F92295273197602AAC8352
SHA256:41031EFC4F7E322DC5FFACC94B9296FB28B9B922B1CE3B3DA13BF659A5FD2985
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
37
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5972
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5972
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5744
cheatengine-x86_64-SSE4-AVX2.exe
GET
200
142.250.186.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
5744
cheatengine-x86_64-SSE4-AVX2.exe
GET
200
142.250.186.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4692
CheatEngine76.tmp
18.245.78.141:443
d37tdtb0ed9odn.cloudfront.net
—
US
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5972
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.74.206
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.25
  • 23.216.77.42
  • 23.216.77.28
  • 23.216.77.20
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.0
  • 40.126.31.1
  • 20.190.159.128
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
d37tdtb0ed9odn.cloudfront.net
  • 18.245.78.141
  • 18.245.78.213
  • 18.245.78.200
  • 18.245.78.129
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CheatEngine76.exe