| File name: | CheatEngine73.exe |
| Full analysis: | https://app.any.run/tasks/89a3b02f-c231-456f-894f-5914bc11427b |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | July 08, 2025, 12:28:55 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections |
| MD5: | 7ED6B58360D0D7E033237F37DD314F47 |
| SHA1: | 6925AA78B2A1E18524BCBBE09611D079B7BDC9ED |
| SHA256: | 9B8480581FFD010C93C4504D0BB5DCD8C2EBA5C57812E399DA8C6C58024A4903 |
| SSDEEP: | 98304:6Sif4opH4opH4opuE9vBuN1EdKKBEXJhJJ:SDBDBDlDKKB2/ |
| .exe | | | Inno Setup installer (67.7) |
|---|---|---|
| .exe | | | Win32 EXE PECompact compressed (generic) (25.6) |
| .exe | | | Win32 Executable (generic) (2.7) |
| .exe | | | Win16/32 Executable Delphi generic (1.2) |
| .exe | | | Generic Win/DOS Executable (1.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2020:11:15 09:48:30+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 741376 |
| InitializedDataSize: | 102912 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5eec |
| OSVersion: | 6.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 7.3.0.0 |
| ProductVersionNumber: | 7.3.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | |
| FileDescription: | EngineGame Installer |
| FileVersion: | 7.3.0 |
| LegalCopyright: | |
| OriginalFileName: | |
| ProductName: | EngineGame |
| ProductVersion: | 7.3.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 32 | "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" | C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Weather Information Service Integrity Level: SYSTEM Description: Weather Delivery Service Version: 1.0.0.9 Modules
| |||||||||||||||
| 436 | "icacls" "C:\Program Files\Cheat Engine 7.3" /grant *S-1-15-2-1:(OI)(CI)(RX) | C:\Windows\System32\icacls.exe | — | CheatEngine73.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 504 | "C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --field-trial-handle=9044,6230262323459737487,1081633641400832709,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file="C:\Users\admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=9328 /prefetch:1 | C:\Program Files\Avast Software\Avast\AvastUI.exe | — | AvastUI.exe | |||||||||||
User: admin Company: Gen Digital Inc. Integrity Level: MEDIUM Description: Avast Antivirus Version: 25.6.10221.0 Modules
| |||||||||||||||
| 888 | "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.cat | C:\Program Files\Avast Software\Avast\SetupInf.exe | — | instup.exe | |||||||||||
User: admin Company: Gen Digital Inc. Integrity Level: HIGH Description: Avast Antivirus Installer Exit code: 0 Version: 25.6.10221.0 Modules
| |||||||||||||||
| 1044 | "C:\Program Files\McAfee\Temp1855103906\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade | C:\Program Files\McAfee\Temp1855103906\installer.exe | installer.exe | ||||||||||||
User: admin Company: McAfee, LLC Integrity Level: HIGH Description: McAfee WebAdvisor(installer) Exit code: 0 Version: 4,1,1,1054 Modules
| |||||||||||||||
| 1080 | "C:\WINDOWS\Temp\asw.5b3813cefeb26c60\instup.exe" /sfx:lite /sfxstorage:C:\WINDOWS\Temp\asw.5b3813cefeb26c60 /edition:1 /prod:ais /stub_context:4a0ace23-0b5f-4b03-89c0-d68e38c64d69:11665632 /guid:90a1d014-b0db-4975-8605-b7e977854748 /ga_clientid:cb131748-ed58-4d35-acd1-e9b57fc8cfd2 /silent /ws /psh:2bJ1koXNT4FT01gO1KZw0Bh6T3GuBRRURqdvh8UePFJUjxDL9hefzM3t2goqYEa6CZKq233v2l8SC /cookie:mmm_irs_ppi_005_888_a /ga_clientid:cb131748-ed58-4d35-acd1-e9b57fc8cfd2 /edat_dir:C:\WINDOWS\Temp\asw.dd625157eaad7448 | C:\Windows\Temp\asw.5b3813cefeb26c60\Instup.exe | avast_free_antivirus_setup_online_x64.exe | ||||||||||||
User: admin Company: Gen Digital Inc. Integrity Level: HIGH Description: Avast Antivirus Installer Exit code: 0 Version: 25.6.10221.0 Modules
| |||||||||||||||
| 1096 | "C:\Users\admin\AppData\Local\Temp\is-1LUCM.tmp\CheatEngine73.exe" /VERYSILENT /ZBDIST | C:\Users\admin\AppData\Local\Temp\is-1LUCM.tmp\CheatEngine73.exe | — | CheatEngine73.tmp | |||||||||||
User: admin Company: Cheat Engine Integrity Level: HIGH Description: Cheat Engine Setup Exit code: 0 Version: 7.3.0.11 Modules
| |||||||||||||||
| 1096 | "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" install | C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe | — | WZSetup.exe | |||||||||||
User: admin Company: Weather Information Service Integrity Level: HIGH Description: Weather Delivery Service Exit code: 0 Version: 1.0.0.9 Modules
| |||||||||||||||
| 1332 | "C:\Users\admin\AppData\Local\Temp\is-2AONV.tmp\CheatEngine73.tmp" /SL5="$A0222,2408085,845312,C:\Users\admin\AppData\Local\Temp\CheatEngine73.exe" | C:\Users\admin\AppData\Local\Temp\is-2AONV.tmp\CheatEngine73.tmp | — | CheatEngine73.exe | |||||||||||
User: admin Company: Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 1388 | "C:\Program Files\Avast Software\Avast\defs\25070703\engsup.exe" /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie /get_latest_trpar | C:\Program Files\Avast Software\Avast\defs\25070703\engsup.exe | — | instup.exe | |||||||||||
User: admin Company: Gen Digital Inc. Integrity Level: HIGH Description: Avast Antivirus vps tool Exit code: 0 Version: 18.0.2282.0 Modules
| |||||||||||||||
| (PID) Process: | (5168) CheatEngine73.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001 |
| Operation: | write | Name: | Owner |
Value: 30140000C9B7F2F503F0DB01 | |||
| (PID) Process: | (5168) CheatEngine73.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001 |
| Operation: | write | Name: | SessionHash |
Value: A13D066D5C6B292E967CAA42809372CD89DAAA2E93721F64F7DEDBD2C18442E2 | |||
| (PID) Process: | (5168) CheatEngine73.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (5168) CheatEngine73.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001 |
| Operation: | write | Name: | RegFiles0000 |
Value: C:\Program Files\Cheat Engine 7.3\windowsrepair.exe | |||
| (PID) Process: | (5168) CheatEngine73.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001 |
| Operation: | write | Name: | RegFilesHash |
Value: F93A785064F4635A6696A9753898C8E216E2F7F1BE1855E44254F1B9F422D264 | |||
| (PID) Process: | (5168) CheatEngine73.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Cheat Engine\VersionCheck |
| Operation: | write | Name: | CheckOnLaunch |
Value: 1 | |||
| (PID) Process: | (5168) CheatEngine73.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Cheat Engine\VersionCheck |
| Operation: | write | Name: | CheckInterval |
Value: 1 | |||
| (PID) Process: | (5168) CheatEngine73.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001 |
| Operation: | delete value | Name: | RegFiles0000 |
Value: C:\Program Files\Cheat Engine 7.3\windowsrepair.exe | |||
| (PID) Process: | (5168) CheatEngine73.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001 |
| Operation: | delete value | Name: | Sequence |
Value: | |||
| (PID) Process: | (5168) CheatEngine73.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001 |
| Operation: | delete value | Name: | SessionHash |
Value: 㶡洆歜⸩粖䊪鎀쵲�⺪犓搟�틛蓁 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5924 | CheatEngine73.tmp | C:\Users\admin\AppData\Local\Temp\is-1LUCM.tmp\_isetup\_setup64.tmp | executable | |
MD5:E4211D6D009757C078A9FAC7FF4F03D4 | SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95 | |||
| 5924 | CheatEngine73.tmp | C:\Users\admin\AppData\Local\Temp\is-1LUCM.tmp\zbShieldUtils.dll | executable | |
MD5:E1F18A22199C6F6AA5D87B24E5B39EF1 | SHA256:62C56C8CF2AC6521CE047B73AA99B6D3952CA53F11D34B00E98D17674A2FC10D | |||
| 5924 | CheatEngine73.tmp | C:\Users\admin\AppData\Local\Temp\is-1LUCM.tmp\is-I5TOO.tmp | compressed | |
MD5:F68008B70822BD28C82D13A289DEB418 | SHA256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589 | |||
| 5924 | CheatEngine73.tmp | C:\Users\admin\AppData\Local\Temp\is-1LUCM.tmp\WeatherZero.png | image | |
MD5:9AC6287111CB2B272561781786C46CDD | SHA256:AB99CDB7D798CB7B7D8517584D546AA4ED54ECA1B808DE6D076710C8A400C8C4 | |||
| 5924 | CheatEngine73.tmp | C:\Users\admin\AppData\Local\Temp\is-1LUCM.tmp\AVAST.png | image | |
MD5:378F74A0CBDD582D8B434B7B978FF375 | SHA256:1225AFDA135B0BF3B5633595AF4096F8C6620EBB34AA5DF7C64253F03668B33D | |||
| 6612 | CheatEngine73.exe | C:\Users\admin\AppData\Local\Temp\is-2AONV.tmp\CheatEngine73.tmp | executable | |
MD5:04F7929159C24D9D1A04E7771F285B57 | SHA256:2DDE2C775E7F549C63F95E6AAE533E61B1B4E33400C9034664F826B4A4EF6639 | |||
| 5924 | CheatEngine73.tmp | C:\Users\admin\AppData\Local\Temp\is-1LUCM.tmp\is-6UO7O.tmp | image | |
MD5:378F74A0CBDD582D8B434B7B978FF375 | SHA256:1225AFDA135B0BF3B5633595AF4096F8C6620EBB34AA5DF7C64253F03668B33D | |||
| 5924 | CheatEngine73.tmp | C:\Users\admin\AppData\Local\Temp\is-1LUCM.tmp\WebAdvisor.png | image | |
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24 | SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856 | |||
| 4040 | CheatEngine73.exe | C:\Users\admin\AppData\Local\Temp\is-KJK6F.tmp\CheatEngine73.tmp | executable | |
MD5:04F7929159C24D9D1A04E7771F285B57 | SHA256:2DDE2C775E7F549C63F95E6AAE533E61B1B4E33400C9034664F826B4A4EF6639 | |||
| 5924 | CheatEngine73.tmp | C:\Users\admin\AppData\Local\Temp\is-1LUCM.tmp\is-TPCUG.tmp | image | |
MD5:9AC6287111CB2B272561781786C46CDD | SHA256:AB99CDB7D798CB7B7D8517584D546AA4ED54ECA1B808DE6D076710C8A400C8C4 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6676 | cookie_mmm_irs_ppi_005_888_a.exe | POST | 200 | 142.250.185.142:80 | http://www.google-analytics.com/collect | unknown | — | — | whitelisted |
6732 | WZSetup.exe | GET | 200 | 142.250.185.99:80 | http://c.pki.goog/r/r4.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4580 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
2404 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
2404 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6676 | cookie_mmm_irs_ppi_005_888_a.exe | POST | 200 | 142.250.185.142:80 | http://www.google-analytics.com/collect | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6676 | cookie_mmm_irs_ppi_005_888_a.exe | POST | 204 | 34.117.223.223:80 | http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi | unknown | — | — | whitelisted |
1080 | Instup.exe | GET | 200 | 92.122.166.32:80 | http://r6726306.iavs9x.u.avast.com/iavs9x/avbugreport_x64_ais-a6e.vpx | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1268 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6368 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1268 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4580 | svchost.exe | 20.190.159.128:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4580 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
d2oq4dwfbh6gxl.cloudfront.net |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
— | — | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
— | — | A Network Trojan was detected | ET ADWARE_PUP Win32/OfferCore Checkin M1 |
— | — | Generic Protocol Command Decode | SURICATA HTTP Request unrecognized authorization method |
— | — | A Network Trojan was detected | ET ADWARE_PUP Win32/OfferCore Checkin M2 |
— | — | Generic Protocol Command Decode | SURICATA HTTP Request unrecognized authorization method |
— | — | Possibly Unwanted Program Detected | ADWARE [ANY.RUN] InnoSetup Installer |
— | — | A Network Trojan was detected | ET ADWARE_PUP Win32/OfferCore Checkin M2 |
— | — | Generic Protocol Command Decode | SURICATA HTTP Request unrecognized authorization method |
— | — | Possibly Unwanted Program Detected | ADWARE [ANY.RUN] InnoSetup Installer |
— | — | Generic Protocol Command Decode | SURICATA HTTP Request unrecognized authorization method |
Process | Message |
|---|---|
Kernelmoduleunloader.exe | Kernelmodule unloader |
Kernelmoduleunloader.exe | setup=true |
Kernelmoduleunloader.exe | attempting to unload |
Kernelmoduleunloader.exe | Setup. So do not show messages |
Kernelmoduleunloader.exe | count=0 |
Kernelmoduleunloader.exe | Running in wow64 |
Kernelmoduleunloader.exe | SCManager opened |
saBSI.exe | NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
|
saBSI.exe | NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-1LUCM.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-1LUCM.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
|
saBSI.exe | NCPrivateLoadAndValidateMPTDll: Looking in current directory
|