File name:

cheatengine63.exe

Full analysis: https://app.any.run/tasks/65c8a200-22c3-4263-9dc8-e515726f2475
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 09, 2025, 21:24:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
inno
installer
delphi
stealer
lua
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

A80DC3D17C3C4B05AE9C2074B5DEC4AD

SHA1:

23322B394B8112FC8E26F9D00BECFD84AD01A90B

SHA256:

888D6BAEA57D833B4BC506E571046EE8BAE7F0F1D7604188B057748099EEC175

SSDEEP:

98304:LSBvM0HkpHnwt+yc4kOaCcrI5j3TiyZDVwtZIooPFyPh2JLxoKmzxPwjxDx0uUfu:RSXKUunMkp9RoihAyD21

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • CheatEngine71.tmp (PID: 6252)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • cheatengine63.exe (PID: 5972)
      • cheatengine63.exe (PID: 6184)
      • cheatengine63.tmp (PID: 4272)
      • CheatEngine71.exe (PID: 3140)
      • CheatEngine71.tmp (PID: 6252)
      • CheatEngine71.exe (PID: 684)

    • Reads security settings of Internet Explorer

      • cheatengine63.tmp (PID: 5344)
      • CheatEngine71.tmp (PID: 2644)
      • CheatEngine71.tmp (PID: 6252)
      • Cheat Engine.exe (PID: 3676)
      • cheatengine-x86_64.exe (PID: 2332)

    • Reads the Windows owner or organization settings

      • cheatengine63.tmp (PID: 4272)
      • CheatEngine71.tmp (PID: 6252)

    • Process drops legitimate windows executable

      • cheatengine63.tmp (PID: 4272)
      • CheatEngine71.tmp (PID: 6252)

    • There is functionality for taking screenshot (YARA)

      • rundll32.exe (PID: 3888)
      • cheatengine63.tmp (PID: 4272)
      • cheatengine-x86_64.exe (PID: 2332)

    • Reads Microsoft Outlook installation path

      • CheatEngine71.tmp (PID: 6252)

    • Process drops SQLite DLL files

      • CheatEngine71.tmp (PID: 6252)

    • Reads Internet Explorer settings

      • CheatEngine71.tmp (PID: 6252)

    • Drops a system driver (possible attempt to evade defenses)

      • CheatEngine71.tmp (PID: 6252)

    • Uses ICACLS.EXE to modify access control lists

      • CheatEngine71.tmp (PID: 6252)

    • There is functionality for communication over UDP network (YARA)

      • cheatengine-x86_64.exe (PID: 2332)

    • Detected use of alternative data streams (AltDS)

      • cheatengine-x86_64.exe (PID: 2332)

  • INFO

    • Reads the computer name

      • cheatengine63.tmp (PID: 5344)
      • cheatengine63.tmp (PID: 4272)
      • CheatEngine71.exe (PID: 2420)
      • CheatEngine71.tmp (PID: 2644)
      • CheatEngine71.tmp (PID: 6252)
      • CheatEngine71.exe (PID: 2552)
      • Kernelmoduleunloader.exe (PID: 4756)
      • cheatengine-x86_64.exe (PID: 2332)
      • Cheat Engine.exe (PID: 3676)

    • Checks supported languages

      • cheatengine63.exe (PID: 5972)
      • cheatengine63.exe (PID: 6184)
      • cheatengine63.tmp (PID: 5344)
      • cheatengine63.tmp (PID: 4272)
      • CheatEngine71.exe (PID: 2552)
      • CheatEngine71.exe (PID: 2420)
      • CheatEngine71.exe (PID: 3140)
      • CheatEngine71.exe (PID: 684)
      • CheatEngine71.tmp (PID: 2644)
      • CheatEngine71.tmp (PID: 6252)
      • _setup64.tmp (PID: 2600)
      • Kernelmoduleunloader.exe (PID: 4756)
      • windowsrepair.exe (PID: 6944)
      • Cheat Engine.exe (PID: 3676)
      • cheatengine-x86_64.exe (PID: 2332)

    • Create files in a temporary directory

      • cheatengine63.exe (PID: 5972)
      • cheatengine63.exe (PID: 6184)
      • CheatEngine71.exe (PID: 3140)
      • CheatEngine71.exe (PID: 684)
      • CheatEngine71.tmp (PID: 6252)
      • cheatengine-x86_64.exe (PID: 2332)
      • cheatengine63.tmp (PID: 4272)

    • Process checks computer location settings

      • cheatengine63.tmp (PID: 5344)
      • CheatEngine71.tmp (PID: 2644)
      • Cheat Engine.exe (PID: 3676)

    • Checks proxy server information

      • rundll32.exe (PID: 3888)
      • CheatEngine71.tmp (PID: 6252)
      • cheatengine-x86_64.exe (PID: 2332)
      • slui.exe (PID: 744)
      • rundll32.exe (PID: 6372)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 3888)
      • rundll32.exe (PID: 6372)

    • Detects InnoSetup installer (YARA)

      • cheatengine63.exe (PID: 5972)
      • cheatengine63.tmp (PID: 5344)
      • cheatengine63.exe (PID: 6184)
      • cheatengine63.tmp (PID: 4272)
      • CheatEngine71.exe (PID: 3140)
      • CheatEngine71.exe (PID: 684)
      • CheatEngine71.tmp (PID: 2644)
      • CheatEngine71.tmp (PID: 6252)

    • Compiled with Borland Delphi (YARA)

      • cheatengine63.tmp (PID: 5344)
      • cheatengine63.tmp (PID: 4272)
      • CheatEngine71.exe (PID: 3140)
      • CheatEngine71.exe (PID: 684)
      • CheatEngine71.tmp (PID: 2644)
      • CheatEngine71.tmp (PID: 6252)
      • cheatengine-x86_64.exe (PID: 2332)

    • Manual execution by a user

      • CheatEngine71.exe (PID: 2552)
      • CheatEngine71.exe (PID: 2420)
      • CheatEngine71.exe (PID: 3140)
      • chrome.exe (PID: 4012)

    • The sample compiled with english language support

      • CheatEngine71.tmp (PID: 6252)
      • cheatengine63.tmp (PID: 4272)

    • Reads the machine GUID from the registry

      • CheatEngine71.tmp (PID: 6252)
      • cheatengine-x86_64.exe (PID: 2332)

    • Reads Environment values

      • CheatEngine71.tmp (PID: 6252)

    • Creates files in the program directory

      • CheatEngine71.tmp (PID: 6252)
      • cheatengine-x86_64.exe (PID: 2332)

    • Creates a software uninstall entry

      • CheatEngine71.tmp (PID: 6252)

    • Reads the software policy settings

      • cheatengine-x86_64.exe (PID: 2332)
      • slui.exe (PID: 744)

    • Creates files or folders in the user directory

      • cheatengine-x86_64.exe (PID: 2332)

    • The process uses Lua

      • cheatengine-x86_64.exe (PID: 2332)

    • Application launched itself

      • chrome.exe (PID: 4012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0x9c40
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.3.0.0
ProductVersionNumber: 6.3.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Cheat Engine
FileDescription: Cheat Engine 6.3 Setup
FileVersion: 6.3.0.0
LegalCopyright: Cheat Engine
ProductName: Cheat Engine 6.3
ProductVersion: 6.3.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
170
Monitored processes
33
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
start cheatengine63.exe cheatengine63.tmp no specs cheatengine63.exe cheatengine63.tmp rundll32.exe no specs rundll32.exe no specs cheatengine71.exe no specs cheatengine71.exe no specs slui.exe cheatengine71.exe cheatengine71.tmp no specs cheatengine71.exe cheatengine71.tmp _setup64.tmp no specs conhost.exe no specs kernelmoduleunloader.exe no specs windowsrepair.exe no specs icacls.exe no specs conhost.exe no specs cheat engine.exe no specs cheatengine-x86_64.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Users\admin\Desktop\CheatEngine71.exe" /SPAWNWND=$60272 /NOTIFYWND=$50252 C:\Users\admin\Desktop\CheatEngine71.exe
CheatEngine71.tmp
User:
admin
Company:
Cheat Engine
Integrity Level:
HIGH
Description:
Cheat Engine Setup
Exit code:
0
Version:
7.1.0.11
Modules
Images
c:\users\admin\desktop\cheatengine71.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
744C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
968"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4732 --field-trial-handle=1900,i,4556157650830279523,12030104037712684345,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1004"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1896 --field-trial-handle=1900,i,4556157650830279523,12030104037712684345,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1312"icacls" "C:\Program Files\Cheat Engine 7.1" /grant *S-1-15-2-1:(OI)(CI)(RX) /TC:\Windows\System32\icacls.exe—CheatEngine71.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2316"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5448 --field-trial-handle=1900,i,4556157650830279523,12030104037712684345,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2332"C:\Program Files\Cheat Engine 7.1\cheatengine-x86_64.exe" C:\Program Files\Cheat Engine 7.1\cheatengine-x86_64.exe
Cheat Engine.exe
User:
admin
Company:
Cheat Engine
Integrity Level:
HIGH
Description:
Cheat Engine
Version:
7.1.0.6341
Modules
Images
c:\program files\cheat engine 7.1\cheatengine-x86_64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2420"C:\Users\admin\Desktop\CheatEngine71.exe" C:\Users\admin\Desktop\CheatEngine71.exe—explorer.exe
User:
admin
Company:
Cheat Engine
Integrity Level:
MEDIUM
Description:
Cheat Engine Setup
Exit code:
1
Version:
7.1.0.11
Modules
Images
c:\users\admin\desktop\cheatengine71.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2552"C:\Users\admin\Desktop\CheatEngine71.exe" C:\Users\admin\Desktop\CheatEngine71.exe—explorer.exe
User:
admin
Company:
Cheat Engine
Integrity Level:
MEDIUM
Description:
Cheat Engine Setup
Exit code:
1
Version:
7.1.0.11
Modules
Images
c:\users\admin\desktop\cheatengine71.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll
2600helper 105 0x84C:\Users\admin\AppData\Local\Temp\is-TAN10.tmp\_isetup\_setup64.tmp—CheatEngine71.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\is-tan10.tmp\_isetup\_setup64.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
9 376
Read events
9 338
Write events
36
Delete events
2

Modification events

(PID) Process:(6252) CheatEngine71.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6252) CheatEngine71.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6252) CheatEngine71.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6252) CheatEngine71.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Cheat Engine\VersionCheck
Operation:writeName:CheckOnLaunch
Value:
1
(PID) Process:(6252) CheatEngine71.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Cheat Engine\VersionCheck
Operation:writeName:CheckInterval
Value:
1
(PID) Process:(6252) CheatEngine71.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.9 (u)
(PID) Process:(6252) CheatEngine71.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Cheat Engine 7.1
(PID) Process:(6252) CheatEngine71.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Cheat Engine 7.1\
(PID) Process:(6252) CheatEngine71.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Cheat Engine 7.1
(PID) Process:(6252) CheatEngine71.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
124
Suspicious files
663
Text files
317
Unknown types
0

Dropped files

PID
Process
Filename
Type
4272cheatengine63.tmpC:\Users\admin\AppData\Local\Temp\is-KFATN.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
6252CheatEngine71.tmpC:\Users\admin\AppData\Local\Temp\nsd11664219515\csshover3.htcbinary
MD5:52FA0DA50BF4B27EE625C80D36C67941
SHA256:E37E99DDFC73AC7BA774E23736B2EF429D9A0CB8C906453C75B14C029BDD5493
5972cheatengine63.exeC:\Users\admin\AppData\Local\Temp\is-GG04F.tmp\cheatengine63.tmpexecutable
MD5:385408FC2DAA39776467F9BF5146F9DE
SHA256:EA6480C3C83CE0B2971E98E33E4CE56E58AB1A23B0C6085B82795078A02AA1D2
3140CheatEngine71.exeC:\Users\admin\AppData\Local\Temp\is-34GOV.tmp\CheatEngine71.tmpexecutable
MD5:D79B3CFCE983CE259B7DE0A7D9537B13
SHA256:F37BD0CCE610C1DFFDC88CB7337E84773452E81BD3985B25FFAE6F075130EE1C
6252CheatEngine71.tmpC:\Users\admin\AppData\Local\Temp\nsd11664219515\css\sdk-ui\button.csstext
MD5:37E1FF96E084EC201F0D95FEEF4D5E94
SHA256:8E806F5B94FC294E918503C8053EF1284E4F4B1E02C7DA4F4635E33EC33E0534
6252CheatEngine71.tmpC:\Users\admin\AppData\Local\Temp\nsd11664219515\css\ie6_main.csstext
MD5:74F08D5A243AE79F1DE64DFFDAF846CB
SHA256:15590060BFD227F656E569031113A080E0D45621A5C944DFC352F869EADAFEF2
6252CheatEngine71.tmpC:\Users\admin\AppData\Local\Temp\nsd11664219515\css\main.csstext
MD5:9B27E2A266FE15A3AABFE635C29E8923
SHA256:166AA42BC5216C5791388847AE114EC0671A0D97B9952D14F29419B8BE3FB23F
6252CheatEngine71.tmpC:\Users\admin\AppData\Local\Temp\0011CC55.logtext
MD5:9F66D0B78F559906372B5043ACF1CE63
SHA256:0CA3D82FF3D23CF8B2A009F222C907B26A9CC9D2356D38932F01E5F2BDC27C6D
4272cheatengine63.tmpC:\Users\admin\AppData\Local\Temp\is-KFATN.tmp\_isetup\_RegDLL.tmpexecutable
MD5:0EE914C6F0BB93996C75941E1AD629C6
SHA256:4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
4272cheatengine63.tmpC:\Users\admin\AppData\Local\Temp\is-KFATN.tmp\OCSetupHlp.dllexecutable
MD5:B0CD8CC76479C210353EBC7586DCA8C0
SHA256:78301C11BD9947A87970C69481C580DEF402EF9CEFAD75404840D66C11C96D6E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
36
DNS requests
44
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6068
SIHClient.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2332
cheatengine-x86_64.exe
GET
200
142.250.185.99:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
2332
cheatengine-x86_64.exe
GET
200
142.250.185.99:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
6068
SIHClient.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6068
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6068
SIHClient.exe
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.42
whitelisted
google.com
  • 142.250.74.206
whitelisted
api.opencandy.com
  • —
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.128
  • 40.126.31.128
  • 40.126.31.2
  • 40.126.31.129
  • 20.190.159.130
  • 20.190.159.68
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 23.37.237.227
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cheatengine63.exe