CheatEngine[.]exe | Triage™

CheatEngine.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 cb7084768cef8b1be0cc7892a9dd6a87e044ff2e6a4d5857025dada2d7a9edbb
MD5 281b20c2b6cb2bbe7b2f49e6b4192f27
SHA1 76594b61d5fe54bd2c66b479d2c3a4e7140624d1
SHA512 a8d4588da0ca096130b2cf823c7600adef3d82b9a718680b4128b106d078703e6b0b2da893f7c9624ee80e6570d6a491de3e6873d260f6c13ee54733085ec3dc
SSDEEP 24576:H0a8Bb4crwHEIAPTQ+mJNqqeeMUOTcj2nb+hPxQVOwrcRrzEcihXOP5LTL:H8b4cUR0mJNFeFzcj1xQVUzR/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

2d:15:28:db:2c:40:fb:6a:0e:42:36:fb:79:af:39:43:d6:c5:c6:a6

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=LAVALYS,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Licensing Department,O=LAVALYS,L=Laval,ST=Quebec,C=CA

Chains

Mar 31, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=LAVALYS,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Licensing Department,O=LAVALYS,L=Laval,ST=Quebec,C=CA

Serial Number

73:9a:73:c1:86:4a:e2:7d:7d:9c:dc:f7:05:58:88:e4

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 4, 2008 - Oct 17, 2010

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

0

Major OS version

5

Entry point

13289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$TEMP/Loud.pub

SHA256 7b363b19955b115e661279e017b69b4af0a7ca6de0903e08d80b4be0e520fd86
MD5 c8abe2dd22b0c4312de58c81890eb1bf
SHA1 80a430cf4193a7517d47584768c70bea8f25e889
SHA512 e0d530254c3a90429a802a80cae529fc429d98a8e8ca5c852e63884d5e0dae11bead331875f884fa105cdcc7425e747f017f9316d675732c792aeb0de521524b
SSDEEP 768:aasTHy9CQ+fhsnhNMQ/10NvxS0Qsf5Ji1pDKyVZwyDa0qHzis/K5o7b3bybrUgvx:Ejy9CrUMQ/6pnxJfGTDa0qH+H5fbgK
MD5 SHA1 SHA512 SSDEEP

AirportsDirectors/Determining.pub

SHA256 bc8ee59c9f150dd4d9ae9efa67e335a6b23598baaa4a7df63153c0866e7c9fc8
MD5 2ed3aa1df69f3343e90958946bacae97
SHA1 0bd7a13824028cc03ff6b7b6e7c5f85cb8cc6437
SHA512 73d14a7d80bbecb553358921a4ccde85bb818f75981451ecaf0747aa215ce4430f9f3bf094159d556b22aed106c7560b81a15d6733b5c5d3ea7a801aed03f7eb
SSDEEP 1536:/70Sh6SdR308UzvMnosi7nYcUA8Kie5C5TYnHFuUnPiepc+juuajS6hT:/70SkSXUMnoVYreIYnAUaeTUthT
MD5 SHA1 SHA512 SSDEEP

RaiseController/Aged.pub

SHA256 69bed85a702aaefa9810b6455de4953631c18ca1aa916ce06c3dd82a706d1c66
MD5 647b3db1e3200f3eb2703e2f6ec77909
SHA1 f5f7367ff56dbd60bbf85d097b90cf24a0ede28a
SHA512 d8acff64ae9bd8ddddae297cfaf4db94edf305918492f919f8e2ab4788fd39b0e24b5d5fc37129e49c6c0d47023e5c80f66ebdbe1ec683372fe4fdbefeeb825b
SSDEEP 1536:84n3SV3MMFWsjQyxjO2107nD8GKJ/F5MKwNZXt3qVu5ciz:xCKMVQol10zIGwN5MKwnXJqE5d
MD5 SHA1 SHA512 SSDEEP

RaiseController/Ancient.pub

SHA256 0e1a90d5e84726cbf35dfd0072a1a0511cde7c96156580bf9286979d9a359aee
MD5 5326967a20c1ab6f5a9939a193a08632
SHA1 e00744d5ea68e23cdb5d7fe2f5d70d7d4d21e369
SHA512 a1022c58b389fb2f0371a29e31ef3b457666a837beabd8fcba30f8ca3defe6e915b434c013109bcc2bd5b61350cd6a8ed8caf95892e613a3da8f57151c9ace27
SSDEEP 1536:qM4/lT4zp7zdxlLskoSRmRZ677YnqGbi8NtJeYjBOeu3efdntdX:o/pCPvlAkhSc77YqyiCJeYpdtJ
MD5 SHA1 SHA512 SSDEEP

RaiseController/Eva.pub

SHA256 492ffc1855bd5e87c3d7d2be0ecee163d30f46dcda62c512c848a2c9544e3402
MD5 b71224e03d0fce7b2258f042a0b2d21f
SHA1 5c9325ce52c5fa08aa412eee5a89893c742f4b5a
SHA512 a8cd408a6ce9cbc9e48aed8c730cfa72fd736de5a6d6a00304f05c0453d0a2b2f295ef89d9ae6ae5e82b1775d5b183f1615658db4dc73f55b6cabfcf35128b41
SSDEEP 768:1NiVIQC11X+YsDCv1OKtGic7Q5Bf+dsPmwb1p9rd/09Z0iCc2OHXBmfnhIwN26R7:1YVZtytGic74BssPmC9rddiCq8CbmuE
MD5 SHA1 SHA512 SSDEEP

RaiseController/Fx.pub

SHA256 2340d834df335e63855967d4409f68e2c244efd16793a22a911536bc6beeb798
MD5 7cb49277509a0bdf924855c85c4178bf
SHA1 afe8a361503aac7cbd8d6c5dbf1c02b12a2cbf2f
SHA512 2d069192bcb209e545de316d92c4c5d5e53a58904832221bbd40528a671fda7d91414937f6969606b80fd5a3cd7fd028ed29d336cc0067369ed0f928c22a0da6
SSDEEP 384:9EcQsTlOXSntk1Gufqh5xoCj7n1ejKtnVI:9ZlAStkKrmKtnO
MD5 SHA1 SHA512 SSDEEP

RaiseController/Household.pub

SHA256 0975f51b8b520b1dcf5e0cb136c14fad2e2c177283b1f30b9c998a86ba87cb0e
MD5 47e249e10085e4bac27e6717390971c5
SHA1 9f7f438e5012f756f0de27c778bcdd11b213206e
SHA512 71eb1db8da8bc3498131d32154e69df35ddb4c5b4e94a89d998752eb3d798179f30d58c91aff88fc995a50931f8151a8640491b6172d5034bff9b31e4bd52f18
SSDEEP 768:gBH5MsiOsx+xP7LFCgwesSm+nGfMRsN42NmcQB/6lkxjhy4lBtMAoKXihV/:1ROsx+xP7L8VesFzfMavchhyqBtMAoZ/
MD5 SHA1 SHA512 SSDEEP

RaiseController/Peripheral.pub

SHA256 c7d717e3c5cf63201160c62c0d4dcfe5e857c1dc123837f53084b99112e78b62
MD5 e50400e6cfa56ba0087b593759a9c645
SHA1 b160a5b4f3630f4ff88fcae9c308c77626689e1a
SHA512 f734af5d853942d3bba70b46317c443b7740ddc2460af8f947040e81536be033e9c218a35714b3a5df936289c1bfab80bb1f49d6ed7e19598c5c9db4e29a302a
SSDEEP 3072:mhe7TyiVTHolm1T2+mMEYwsXBWKR2cVJj+wBsGgeXKF:We7TTH4mVEYJx+IsGg5
MD5 SHA1 SHA512 SSDEEP

RaiseController/Shipment.pub

SHA256 cb4876e3a2598eed1504eb5a67a2d9683bcdd7ff537deea69f17b8fcd1201c0b
MD5 6b881c299d647645a5e78431324e3df8
SHA1 fad136a812cc858b4b7b88b28a95916241ccc703
SHA512 b3f18d00f1d35b736ee72a75f74ba364c31a66f6b61d4f9329cd15539f6ffe33c289ce81424e4f2be16b7ca8d4ccba5b889e570a39457fdabd5bd566472d1f21
SSDEEP 12288:LIAP25eGmEaKn8nJ/kPHKwflHfufGu4TAZNXsxsgXd7:8AP25jc5/wt9Hfufv4TAnEsgB
MD5 SHA1 SHA512 SSDEEP

Catalyst

SHA256 cf247fbdee8aec0446b981f11e29f937a2bca68406a4ec8f9651a56c32ef2638
MD5 5857877e4b9a8318845a806958d1122c
SHA1 35e7094276ec2e08a4300d323054a48bad4ef1c9
SHA512 3c47412f7fe5590efc0c87c65d77ec66791cdbe21c39a67fe9d15053ebb2b992b3d2a9a2eea98dc089ec54920d1fd61bebb1c29b2cb09b3cfa91b112fff1d3f2
SSDEEP 768:uu8rbPDmhdimkIXqURPN2mldrfa04VQv7Qf0VosQE7YmFdni8yDJ6bV6yw:uFrbCyI7P4Cxi8q0vQEcmFdni8yDGV6
MD5 SHA1 SHA512 SSDEEP

Consider

SHA256 4a05993709a60bf4be3a26c4f20a835d274dd3c7991d293576456a6346cec939
MD5 76480c1faa2d6c2336ca1040a3cc4f5d
SHA1 891eb0ac55e411215323cd47c66dbd2857b55a95
SHA512 c946c51cb6681239b6ba8187e20869b81ad090f56dc9bc825f3826d3c0751dd922830e33daae5f38c134dced3b773caf8cc87e66e11c4bb054a519b70db26c24
MD5 SHA1 SHA512

Faces

SHA256 6eab652841730917b99234440e5a70222e98eeb7ba583ddda2239b46d1fe8d3e
MD5 856ab83b5f94db2422d77222a6e926a5
SHA1 06af6e22ab4214fe5b8d07db280939460fe311ef
SHA512 43ff57d10b3579c3764e983f0e37ff0cb58eecb3060e0ffdc78fcf7479568fac505f96d8b430c0a238a205bf4125dae13ccda8961dfd9a7b7cdf1c45bd96671c
SSDEEP 3072:xW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNbjaAtsY:xWWt/Dd314V14ZgP0JaAOz04phdyY
MD5 SHA1 SHA512 SSDEEP

Honest

SHA256 9a6ad582c2ab8fe4f3a67a234bcf296e37230ee4e2533c30784766a516ae58e5
MD5 6f12aee950079a930884bdcccf810bf8
SHA1 67a233e12f12abfc70f841c482796d14a3eba51e
SHA512 6e38b06ab85de90aae33c30b43cc3ab83a0bce0e8bd653c2e0c37ddad32312fb7a3116615d2c80194e9cfa320bb3b3c0635d2397cdb385e9b9957faf4323b316
SSDEEP 1536:x1/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfFv:xZg5PXPeiR6MKkjGWoUlJUPdv
MD5 SHA1 SHA512 SSDEEP

Realm

SHA256 86034da6cb691421940a7b1b3fbc8f3ffea3e1b58382f8b38dc7e97d1c2f3544
MD5 c34fa26092cb94a15ef46f313bb8fa27
SHA1 66b4bd12be4cadcdf3ae69b345003d9ff03bb7a8
SHA512 31517b2dca26835f7f03132954ea7b21538c48380873b29d806553abb3ded727f3d12d331eef0c7331f1554c30f296fcb67ed205aa53c60f3d437580e8defda0
SSDEEP 768:ax/SGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EYr8qcDP8N:adKaj6iTcPAsAhxjgarB/5el3EYrDN
MD5 SHA1 SHA512 SSDEEP

Recent

SHA256 f51cd118d5550a6e8c01da11f1a26b73c75ff64ac37520b8420dfd3517283039
MD5 213fe2baea83fedc455e95ab13c3dcd5
SHA1 b6fc1920200b33e3f31f95bb5d52049c1599dff1
SHA512 a8402d841f4eaa0547707f3cafcd51a27907c8bb844fcfc5f6cde17b4d2ad02ab6cb4bd82c695147580eddc294ee6e6a2f88f85e7ad819fb039b90a0b370fb0f
SSDEEP 1536:oE5gOHu1CwCMIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwANU6:jPtCZEMnVIPPBxT/sZydTmRxlHS3NxA
MD5 SHA1 SHA512 SSDEEP

Referral

SHA256 cb206e86ad082566e4246528d44776d6ee6d10166e1271cad15091f03e93a2ae
MD5 25c2114343c60642783a4102a3c93424
SHA1 b1ce662c7a9c8dc26174e586134db8ef7142935b
SHA512 17aa657d325ac742cf41640e5bb129f2a2aeb11637360621ab92df2ae6121d32f3edf4d1f7c93fc2a07514172f0b9a95f6cbc83085a1d2f2df3e2fe454bb8dc2
SSDEEP 3072:oQa8Bp/LxyA3laW2UDQWf05mjccBiqXvpgF4qv+32eOyKODOSpQSJ:oQaE/loUDtf0accB3gBmmLsiS+SJ
MD5 SHA1 SHA512 SSDEEP

Te

SHA256 fbce87409e41e244ad5e2f87704038be0555ac503f180988a793555dbb3b83b8
MD5 4e151e6a865a421fa86cf59a59625401
SHA1 45b6a142834db08c3ded48ad3ccd510b9a018591
SHA512 d25c30045a6336cf83a679002df3f87b6c0447143b03aa9db05cfd360ae3557002e423ccf9ac9c0b052a6c94a897465565a7d36b4d387541f003169cdf9e1b43
SSDEEP 1536:zoHdMJ3RraSXL21rKoUn9r5C03Eq30BcrTrhCX4aVmoJiKwtk2ukC5HRu+OoQjzs:8HSBRtNPnj0nEoXnmowS2u5hVOoQs
MD5 SHA1 SHA512 SSDEEP

Thunder

SHA256 2ab982498e4da884668f0c4486dbb7e34eb39a41e13671cc07cff71af59eabd1
MD5 34a5f62b511aa735acbe8bbcd38ed9ca
SHA1 344918fd39d92f3baf9aba96efe3a2689fe40e47
SHA512 f6478f5bd7f8d11c87975de9bdecf14d8927ee94bd745f12dff9738689434ad2aee358c24892813238ad44b37634a229344f5df855b53fa0e52a50a35e6215da
SSDEEP 1536:Iyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:Iy4ZNoGmROL7F1G7ho2kOb
MD5 SHA1 SHA512 SSDEEP

Workforce

SHA256 933d101bb379871318bd479af255063d415a2785717fa8579d4847622355bdd5
MD5 ddd70559e4db1efccd9e2455d56e7c59
SHA1 c3818c0a995a8950d0d957ef5c10b145fcff7262
SHA512 ec3f26cd2010c723dd44f376055fe1fea7e57bee018ce35f04d59b0c1a610dc5addf4cbb63944edd6543328ef21b17d5625cef5a8c1d864026e05bcd6c4352f7
SSDEEP 3072:yt8T6pUkBJR8CThpmESv+AqVnBypIbv18mLthfhnueoMmOqDoioO5bLe5:y6AUkB0CThp6vmVnjphfhnvO5bLe5
MD5 SHA1 SHA512 SSDEEP

RaiseController/Tab.pub

SHA256 e9d6b92ef5c6b056674040ea50c1d14fc3fec149ba8eb940a6473c2344f4d065
MD5 620fd0738c782a7e23713649439089b5
SHA1 2ff033e3d4a36affcdcbf610716b402b4ea0561b
SHA512 b39bf84b73cb8bc2bb4bc3c8019df68a3fa15588652fb1698624a76185dfd17be8bda2b70c6c0a64e72f4477455f5de71a636256bda5d14deea6207344d40f04
SSDEEP 1536:gQZCaSBnNjd23N6DxKc3d4/DSdiq7rGUWIkoRM+f48GHIFLk7j:gQZCJnN5esxKU0sWIkoDVwI+P
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

CheatEngine.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$TEMP/Loud.pub

AirportsDirectors/Determining.pub

RaiseController/Aged.pub

RaiseController/Ancient.pub

RaiseController/Eva.pub

RaiseController/Fx.pub

RaiseController/Household.pub

RaiseController/Peripheral.pub

RaiseController/Shipment.pub

Catalyst

Consider

Faces

Honest

Realm

Recent

Referral

Te

Thunder

Workforce

RaiseController/Tab.pub