File name:

Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe

Full analysis: https://app.any.run/tasks/ece6af39-52bc-44a3-9080-0fc050286147
Verdict: Malicious activity
Analysis date: May 08, 2026, 01:02:15
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
flingtrainer
cheat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

FB748F036FA1A2EBD3BBC0A6901C20E9

SHA1:

0E34E2C07BDD47E4BCF6A336ACC5B3C0E77877D3

SHA256:

FB342EB237F6EC8AD4292249C97F2A84CB7625B22ADFB89E17E16C6CC0FB11D3

SSDEEP:

49152:oOX+9Q5Pdeedfzvb4rGEM0BDnh0sKoboyZu9a5m5rHf+J9jEJpOVYMpQwJOXdDhf:oOX+K5PdeedH4rGEpZu9acrH69jEeVQv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • FLINGTRAINER mutex has been found

      • Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe (PID: 1904)

  • INFO

    • Reads the machine GUID from the registry

      • Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe (PID: 1904)

    • Reads Environment values

      • Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe (PID: 1904)

    • Checks supported languages

      • Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe (PID: 1904)

    • Reads the computer name

      • Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe (PID: 1904)

    • Creates files or folders in the user directory

      • Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe (PID: 1904)

    • Reads security settings of Internet Explorer

      • Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe (PID: 1904)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:02:13 21:20:25+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.39
CodeSize: 711168
InitializedDataSize: 855552
UninitializedDataSize: -
EntryPoint: 0x81518
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: 3DMGAME
FileDescription: Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer
FileVersion: 1.0.0.0
InternalName: Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer
LegalCopyright: FLiNG Copyright (C) 2025
OriginalFileName: Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe
ProductName: Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer
ProductVersion: 1.0.834.23
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #FLINGTRAINER cyberpunk 2077 v2.0-v2.13 plus 46 trainer.exe cyberpunk 2077 v2.0-v2.13 plus 46 trainer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1904"C:\Users\admin\AppData\Local\Temp\Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe" C:\Users\admin\AppData\Local\Temp\Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe
explorer.exe
User:
admin
Company:
3DMGAME
Integrity Level:
HIGH
Description:
Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cyberpunk 2077 v2.0-v2.13 plus 46 trainer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7776"C:\Users\admin\AppData\Local\Temp\Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe" C:\Users\admin\AppData\Local\Temp\Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe—explorer.exe
User:
admin
Company:
3DMGAME
Integrity Level:
MEDIUM
Description:
Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cyberpunk 2077 v2.0-v2.13 plus 46 trainer.exe
c:\windows\system32\ntdll.dll
Total events
2 244
Read events
2 241
Write events
3
Delete events
0

Modification events

(PID) Process:(1904) Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1904) Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1904) Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
5
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1904Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:2595E903FCB3B99996ADB2CC2BF504C8
SHA256:71CCD39DE69EC147AFD8AD4337A36829DCABABBF40897250380C7770DE551242
1904Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:047F3E9D21D6B325D592B1959E4362E6
SHA256:D2BB091268ADE68AD8121D2184D0FBCE128070156304BD4DE312E6FBD267409C
1904Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:F8C95809AE7C2839098A4E163E9BF020
SHA256:65C825BE20DD15A7133016A138B76EB5091139CC464827051BFE4F3503E96A32
1904Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exeC:\Users\admin\AppData\Local\FLiNGTrainer\TrainerSettings.initext
MD5:100AD43A6E39D44013FAD7F3AA343E3B
SHA256:A7B15EE77DD0DB946E7FDBF574889BD30C23FA3D7BFF6D509DF118595EE14EC5
1904Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:DC5E230451C1EA6C390149FB6BE35D7D
SHA256:8E1C4964DF183AC7905151C0588A6E50B9F82D1AA08C7C474C381F8B5692922A
1904Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exeC:\cyberpunk-2077-trainerbinary
MD5:82C7A06EA9BE40D6701108E18B8EF0EE
SHA256:3DA597C05DF2C2EAD87AE90EC1C531FAA6773CC4A70C90503170AE587BAE88D8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
23
DNS requests
18
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1904
Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe
GET
200
142.251.13.94:80
http://c.pki.goog/r/gsr1.crl
US
binary
1.70 Kb
whitelisted
5276
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
1904
Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe
GET
200
172.67.73.26:443
https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-update
US
text
6 b
unknown
2100
SIHClient.exe
GET
304
74.178.240.61:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
1904
Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe
GET
200
172.67.73.26:443
https://flingtrainer.com/wp-content/check-for-trainer-update/cyberpunk-2077-trainer
US
text
12 b
unknown
1904
Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe
GET
200
142.251.13.94:80
http://c.pki.goog/r/r4.crl
US
binary
528 b
whitelisted
2100
SIHClient.exe
GET
200
20.165.94.54:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
2100
SIHClient.exe
GET
200
74.178.240.61:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
2100
SIHClient.exe
GET
304
74.178.240.61:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
5316
svchost.exe
POST
400
40.126.32.68:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
204 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
3352
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5276
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
1904
Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe
172.67.73.26:443
flingtrainer.com
CLOUDFLARENET
US
suspicious
1904
Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe
142.251.13.94:80
c.pki.goog
GOOGLE
US
whitelisted
5316
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5316
svchost.exe
23.11.41.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted
3428
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 51.104.136.2
  • 51.124.78.146
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
google.com
  • 142.251.14.102
  • 142.251.14.138
  • 142.251.14.113
  • 142.251.14.101
  • 142.251.14.100
  • 142.251.14.139
whitelisted
flingtrainer.com
  • 172.67.73.26
  • 104.26.14.72
  • 104.26.15.72
unknown
c.pki.goog
  • 142.251.13.94
whitelisted
login.live.com
  • 40.126.32.68
  • 20.190.160.17
  • 40.126.32.136
  • 20.190.160.130
  • 40.126.32.72
  • 20.190.160.2
  • 20.190.160.22
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 23.11.41.157
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted

Threats

PID
Process
Class
Message
3352
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Cyberpunk 2077 v2.0-v2.13 Plus 46 Trainer.exe