File name:

CheatEngine75.exe

Full analysis: https://app.any.run/tasks/dbd978c3-2229-48be-8d99-423e80577af3
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: July 24, 2025, 03:48:53
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
bundleinstaller
adware
delphi
inno
installer
lua
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

929BB4590A71EAC440A457C06874D70A

SHA1:

35C06F84B42DE0FA8F4B7C8CA0C294ACD4B8FEAE

SHA256:

C60318B77A92713978EE0A70BECC5CF0FE71AAAFECCF35AB18F60645D6377523

SSDEEP:

98304:nrq3BdwWTZwM9dHW9F1ya8U8qqgGPDiNoZA38EuSlNfdPI6bpEq8p8qnE5BFzfx9:5RH8k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bundleinstaller mutex has been found

      • CheatEngine75.tmp (PID: 3832)

    • Starts NET.EXE for service management

      • net.exe (PID: 3672)
      • net.exe (PID: 1148)
      • CheatEngine76.tmp (PID: 768)
      • net.exe (PID: 5764)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • CheatEngine75.exe (PID: 1508)
      • CheatEngine75.exe (PID: 3028)
      • CheatEngine75.tmp (PID: 3832)
      • CheatEngine76.exe (PID: 856)
      • CheatEngine76.tmp (PID: 768)
      • icacls.exe (PID: 2628)

    • Reads security settings of Internet Explorer

      • CheatEngine75.tmp (PID: 2140)
      • Cheat Engine.exe (PID: 4700)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7116)

    • Reads the Windows owner or organization settings

      • CheatEngine75.tmp (PID: 3832)
      • CheatEngine76.tmp (PID: 768)

    • Starts SC.EXE for service management

      • CheatEngine76.tmp (PID: 768)

    • Windows service management via SC.EXE

      • sc.exe (PID: 1740)
      • sc.exe (PID: 2120)
      • sc.exe (PID: 3852)

    • Uses ICACLS.EXE to modify access control lists

      • CheatEngine76.tmp (PID: 768)

    • Process drops SQLite DLL files

      • CheatEngine76.tmp (PID: 768)

    • Process drops legitimate windows executable

      • CheatEngine76.tmp (PID: 768)

    • There is functionality for taking screenshot (YARA)

      • CheatEngine75.tmp (PID: 3832)
      • CheatEngine76.tmp (PID: 768)

    • There is functionality for communication over UDP network (YARA)

      • CheatEngine76.tmp (PID: 768)

    • Detected use of alternative data streams (AltDS)

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7116)

  • INFO

    • Checks supported languages

      • CheatEngine75.exe (PID: 1508)
      • CheatEngine75.tmp (PID: 2140)
      • CheatEngine75.exe (PID: 3028)
      • CheatEngine75.tmp (PID: 3832)
      • CheatEngine76.exe (PID: 856)
      • CheatEngine76.tmp (PID: 768)
      • Kernelmoduleunloader.exe (PID: 1128)
      • _setup64.tmp (PID: 5988)
      • windowsrepair.exe (PID: 4540)
      • Cheat Engine.exe (PID: 4700)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7116)

    • Create files in a temporary directory

      • CheatEngine75.exe (PID: 1508)
      • CheatEngine75.exe (PID: 3028)
      • CheatEngine75.tmp (PID: 3832)
      • CheatEngine76.exe (PID: 856)
      • CheatEngine76.tmp (PID: 768)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7116)

    • Process checks computer location settings

      • CheatEngine75.tmp (PID: 2140)
      • Cheat Engine.exe (PID: 4700)

    • Reads the computer name

      • CheatEngine75.tmp (PID: 2140)
      • CheatEngine75.exe (PID: 3028)
      • CheatEngine75.tmp (PID: 3832)
      • CheatEngine76.exe (PID: 856)
      • CheatEngine76.tmp (PID: 768)
      • Kernelmoduleunloader.exe (PID: 1128)
      • Cheat Engine.exe (PID: 4700)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7116)

    • The sample compiled with english language support

      • CheatEngine75.tmp (PID: 3832)
      • CheatEngine76.tmp (PID: 768)

    • Reads the software policy settings

      • CheatEngine75.tmp (PID: 3832)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7116)

    • Reads the machine GUID from the registry

      • CheatEngine75.tmp (PID: 3832)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7116)

    • Checks proxy server information

      • CheatEngine75.tmp (PID: 3832)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7116)

    • Detects InnoSetup installer (YARA)

      • CheatEngine75.exe (PID: 1508)
      • CheatEngine75.tmp (PID: 2140)
      • CheatEngine75.tmp (PID: 3832)
      • CheatEngine75.exe (PID: 3028)
      • CheatEngine76.exe (PID: 856)
      • CheatEngine76.tmp (PID: 768)

    • Compiled with Borland Delphi (YARA)

      • CheatEngine75.tmp (PID: 2140)
      • CheatEngine75.exe (PID: 1508)
      • CheatEngine75.exe (PID: 3028)
      • CheatEngine75.tmp (PID: 3832)
      • CheatEngine76.exe (PID: 856)
      • CheatEngine76.tmp (PID: 768)

    • Creates files in the program directory

      • CheatEngine76.tmp (PID: 768)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7116)

    • The process uses Lua

      • CheatEngine76.tmp (PID: 768)

    • Creates a software uninstall entry

      • CheatEngine76.tmp (PID: 768)

    • Creates files or folders in the user directory

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 159744
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 7.6.0.0
ProductVersionNumber: 7.6.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: ЕngineGame Downloader
FileVersion: 7.6.0
LegalCopyright: © ЕngineGame
OriginalFileName:
ProductName: ЕngineGame
ProductVersion: 7.6.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
32
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cheatengine75.exe cheatengine75.tmp no specs cheatengine75.exe #BUNDLEINSTALLER cheatengine75.tmp cheatengine76.exe cheatengine76.tmp net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs _setup64.tmp no specs conhost.exe no specs icacls.exe conhost.exe no specs kernelmoduleunloader.exe windowsrepair.exe no specs icacls.exe no specs conhost.exe no specs cheat engine.exe no specs cheatengine-x86_64-sse4-avx2.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
768"C:\Users\admin\AppData\Local\Temp\is-E734U.tmp\CheatEngine76.tmp" /SL5="$70366,28695682,869888,C:\Users\admin\AppData\Local\Temp\is-LHG2C.tmp\CheatEngine76.exe" /VERYSILENT /ZBDISTC:\Users\admin\AppData\Local\Temp\is-E734U.tmp\CheatEngine76.tmp
CheatEngine76.exe
User:
admin
Company:
Cheat Engine
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-e734u.tmp\cheatengine76.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
856"C:\Users\admin\AppData\Local\Temp\is-LHG2C.tmp\CheatEngine76.exe" /VERYSILENT /ZBDISTC:\Users\admin\AppData\Local\Temp\is-LHG2C.tmp\CheatEngine76.exe
CheatEngine75.tmp
User:
admin
Company:
Cheat Engine
Integrity Level:
HIGH
Description:
Cheat Engine Setup
Exit code:
0
Version:
7.6.0.5
Modules
Images
c:\users\admin\appdata\local\temp\is-lhg2c.tmp\cheatengine76.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
1128"C:\Program Files\Cheat Engine\Kernelmoduleunloader.exe" /SETUPC:\Program Files\Cheat Engine\Kernelmoduleunloader.exe
CheatEngine76.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\cheat engine\kernelmoduleunloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1148"net" stop vgkC:\Windows\System32\net.exe—CheatEngine76.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1508"C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe" C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
ЕngineGame Downloader
Exit code:
0
Version:
7.6.0
Modules
Images
c:\users\admin\appdata\local\temp\cheatengine75.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
1740"sc" delete BadlionAnticheatC:\Windows\System32\sc.exe—CheatEngine76.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1828C:\WINDOWS\system32\net1 stop vgkC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\netutils.dll
2120"sc" delete BadlionAnticC:\Windows\System32\sc.exe—CheatEngine76.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2140"C:\Users\admin\AppData\Local\Temp\is-BNBC7.tmp\CheatEngine75.tmp" /SL5="$A02F0,2341115,845824,C:\Users\admin\AppData\Local\Temp\CheatEngine75.exe" C:\Users\admin\AppData\Local\Temp\is-BNBC7.tmp\CheatEngine75.tmp—CheatEngine75.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-bnbc7.tmp\cheatengine75.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
2628"icacls" "C:\Program Files\Cheat Engine" /grant *S-1-15-2-1:(OI)(CI)(RX)C:\Windows\System32\icacls.exe
CheatEngine76.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
2 589
Read events
2 551
Write events
32
Delete events
6

Modification events

(PID) Process:(768) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
00030000376D46EE4DFCDB01
(PID) Process:(768) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
EB486861578B6C80F14D4DFB8FFA617CB0AA0962AEE88867AA32618E6F71DAA5
(PID) Process:(768) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(768) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFiles0000
Value:
C:\Program Files\Cheat Engine\windowsrepair.exe
(PID) Process:(768) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFilesHash
Value:
CF4ADCD420AF63A04AD1CB3B28085E3ECABDD2775A9BBA098AB124F38FFD32C1
(PID) Process:(768) CheatEngine76.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.4.1
(PID) Process:(768) CheatEngine76.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Cheat Engine
(PID) Process:(768) CheatEngine76.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Cheat Engine\
(PID) Process:(768) CheatEngine76.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Cheat Engine
(PID) Process:(768) CheatEngine76.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
140
Suspicious files
44
Text files
478
Unknown types
34

Dropped files

PID
Process
Filename
Type
3028CheatEngine75.exeC:\Users\admin\AppData\Local\Temp\is-L6P2O.tmp\CheatEngine75.tmpexecutable
MD5:8E72FBBFD90AA6E59D684F7BC450554F
SHA256:962C9824010BCC4D275DC42CD45A3D8D1207FA5A7E43DC458CE050E470D73A68
3832CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-LHG2C.tmp\finish.pngimage
MD5:B24E872BD8F92295273197602AAC8352
SHA256:41031EFC4F7E322DC5FFACC94B9296FB28B9B922B1CE3B3DA13BF659A5FD2985
3832CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-LHG2C.tmp\zbShieldUtils.dllexecutable
MD5:3037E3D5409FB6A697F12ADDB01BA99B
SHA256:A860BD74595430802F4E2E7AD8FD1D31D3DA3B0C9FAF17AD4641035181A5CE9E
3832CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-LHG2C.tmp\error.pngimage
MD5:2C5238DA8AAF78FB2722F82435B59EB0
SHA256:1AEE87904EAAC431C564438807BDBD8FB34290831E7B3C0A502FDF1EF8EAA6A1
3832CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-LHG2C.tmp\is-LFMEE.tmpexecutable
MD5:707C3A94A3B3ECF9F83707CF51706D55
SHA256:4B9130295AA7686619DBE8F163B880B2C418B56C4596B5119B67718161AB2D57
856CheatEngine76.exeC:\Users\admin\AppData\Local\Temp\is-E734U.tmp\CheatEngine76.tmpexecutable
MD5:2DD329D3BA2220F137AFB66ECC98585C
SHA256:DC533E0EF05D4C140E03F50DDCC43BD882953EDF9247D79BAC5A30FE2F78EA70
768CheatEngine76.tmpC:\Program Files\Cheat Engine\is-UCDET.tmpexecutable
MD5:2DD329D3BA2220F137AFB66ECC98585C
SHA256:DC533E0EF05D4C140E03F50DDCC43BD882953EDF9247D79BAC5A30FE2F78EA70
768CheatEngine76.tmpC:\Program Files\Cheat Engine\is-59C35.tmpexecutable
MD5:9A4D1B5154194EA0C42EFEBEB73F318F
SHA256:2F3214F799B0F0A2F3955DBDC64C7E7C0E216F1A09D2C1AD5D0A99921782E363
3832CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-LHG2C.tmp\WebAdvisor.pngimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
3832CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-LHG2C.tmp\logo.pngimage
MD5:9CC8A637A7DE5C9C101A3047C7FBBB33
SHA256:8C5C80BBC6B0FDB367EAB1253517D8B156C85545A2D37D1EE4B78F3041D9B5DB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
24
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6180
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6180
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7116
cheatengine-x86_64-SSE4-AVX2.exe
GET
200
142.250.185.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
7116
cheatengine-x86_64-SSE4-AVX2.exe
GET
200
142.250.185.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
2232
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1040
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3832
CheatEngine75.tmp
18.173.184.163:443
d37tdtb0ed9odn.cloudfront.net
—
US
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.78
whitelisted
d37tdtb0ed9odn.cloudfront.net
  • 18.173.184.163
  • 18.173.184.162
  • 18.173.184.219
  • 18.173.184.62
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.0
  • 40.126.31.128
  • 40.126.31.71
  • 20.190.159.129
  • 40.126.31.73
  • 20.190.159.75
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
cheatengine.org
  • 172.66.137.64
  • 172.66.134.217
whitelisted

Threats

No threats detected
Process
Message
Kernelmoduleunloader.exe
setup=true
Kernelmoduleunloader.exe
Setup. So do not show messages
Kernelmoduleunloader.exe
Kernelmodule unloader
Kernelmoduleunloader.exe
attempting to unload
Kernelmoduleunloader.exe
count=0
Kernelmoduleunloader.exe
SCManager opened
Kernelmoduleunloader.exe
Running in wow64
cheatengine-x86_64-SSE4-AVX2.exe
syncobjs2
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CheatEngine75.exe