Overview

overview

7

Static

static

3

cheat.exe

windows10-2004-x64

7

cheat.exe

windows10-ltsc_2021-x64

7

cheat.exe

windows11-21h2-x64

7

cheat.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    139s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    09/08/2026, 20:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cheat.exe
  • Size 22.6MB
  • Sample260809-y2c29acc89
  • SHA256 c6fbb548272e6020ae730b14dc386f86c159d759eb04b9dbcbb00d51607707ba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cheat.exe
    "C:\Users\Admin\AppData\Local\Temp\cheat.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1964
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
    1⤵
      PID:4948

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ExLoader_Installer.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
          • Size 194KB
          • SHA256 8d0a7a9698fe13202023ec1cf604008be3b3d338ce49186b5e313fb6e9e860b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSVCP140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\MSVCP140.dll
          • Size 559KB
          • SHA256 1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WebView2Loader.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\WebView2Loader.dll
          • Size 162KB
          • SHA256 1d963a02d8a7fa3e7eac2e936dad5559c4d63327f35b0a09787ffc1d58f9c18d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          audioplayers_windows_plugin.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\audioplayers_windows_plugin.dll
          • Size 193KB
          • SHA256 713117e82b6587f00b2b7656ee048cebbc6718f6ba47977a15c0391fbf62458a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app.so
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\app.so
          • Size 18.8MB
          • SHA256 bcc6be262fe5d6da28ac10605022073f9cdfc713925cac6282cb8a76e22c0ae1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AssetManifest.bin
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\AssetManifest.bin
          • Size 9KB
          • SHA256 8a8f632e9a9f7b633d2465fabf2e74050be35f7b1541b9ddbbcb2200771812a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FontManifest.json
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\FontManifest.json
          • Size 332B
          • SHA256 9e0903a9ceb64e32f7a139a143324252aae77dc58dbefb1f211fe03aa33460db
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NativeAssetsManifest.json
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\NativeAssetsManifest.json
          • Size 45B
          • SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
          • MD5 SHA1 SHA512
          Submit Download

          Warcraft.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\backgrounds\Warcraft.jpg
          • Size 98KB
          • SHA256 f88b682b452ad60cf3803cefe5c5c992db9688d47e550d757fa9c2d2114e72ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NoirPro-Bold.otf
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Bold.otf
          • Size 46KB
          • SHA256 b012d85155925bbe2106b20234b96522dec7914f03b09bc6e2fff71554f31bf6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NoirPro-Light.otf
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Light.otf
          • Size 45KB
          • SHA256 3c9ef459625f995c62b993b64da299204b741e153ba8e6d988463aaa86b1aa44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NoirPro-Medium.otf
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Medium.otf
          • Size 46KB
          • SHA256 a728e91375dcadbdf6ef6d7e3cd0bbf5c56fb992d5b1be6640b83214c9d015ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NoirPro-Regular.otf
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Regular.otf
          • Size 45KB
          • SHA256 c7fc6d9f2ff611073fa09a6c61a8c086da0ebe8da841a9f4ec4087a3e9b52152
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NoirPro-SemiBold.otf
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-SemiBold.otf
          • Size 46KB
          • SHA256 50000ce2f0f8bf3018f1d04aa5c6716583b808ca05c802c46a9de4f084a91f7d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          grain.png
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\images\grain.png
          • Size 79KB
          • SHA256 cc453dfe977598a839a52037ef947388e008e5cdfe91b1f1a4e85afb5509bee2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          background_image.frag
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\background_image.frag
          • Size 13KB
          • SHA256 9986d66db87b6ab3ee7182a688736c411459c0ac4f583e966fe529d685c15a80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          modification_card_image.frag
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\modification_card_image.frag
          • Size 30KB
          • SHA256 880e1a838aa9b41af69fdfaf54a2a5f2ab0d60cf75d0df91acc3e8dd101c16cf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          raindrops.frag
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\raindrops.frag
          • Size 51KB
          • SHA256 e139581178d563fc75aca12781a47e75c9020e13de3581273f901715afb691bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          shimmer_effect.frag
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\shimmer_effect.frag
          • Size 7KB
          • SHA256 fb4e69dedfd10f3690e863547a9a50567a1e2ab6c35ee7e56a3fa3dee7263de1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          winter.frag
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\winter.frag
          • Size 70KB
          • SHA256 43373bf6ccc11cf8a96ce00bc33bd0f20ff116b057a587557b4279a2b23edd54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icudtl.dat
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\icudtl.dat
          • Size 760KB
          • SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          flutter_inappwebview_windows_plugin.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_inappwebview_windows_plugin.dll
          • Size 1.1MB
          • SHA256 f87164b23f6bde71d0cd680273c44a214bfc66e4814fb36d82e0a465edc25586
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          flutter_windows.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll
          • Size 18.2MB
          • SHA256 c2081cc44ad8bcac04d801c91691304a601d62a76a0a4c71ec14cfef341daa37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          permission_handler_windows_plugin.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\permission_handler_windows_plugin.dll
          • Size 117KB
          • SHA256 826c7c87715dcc3cc51ee6ece9b91744013a5412e141dce0e5c4bda81f0faec8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          url_launcher_windows_plugin.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\url_launcher_windows_plugin.dll
          • Size 96KB
          • SHA256 01a0fe8fc2738fb7d391676249de887a42b05aab7ee1320e277d656ac81735fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcruntime140.dll
          • Size 116KB
          • SHA256 a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          shared_preferences.json
          • Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json
          • Size 104B
          • SHA256 e7b2abf38f4ceba9b0fa502ca65f69aba29f29feecaabf8451322a719eb01553
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1964-467-0x000001C14BA30000-0x000001C14CCF9000-memory.dmp
          Download

          memory/1964-468-0x000001C1476F0000-0x000001C1476F1000-memory.dmp
          Download

          memory/1964-466-0x000001C14BA30000-0x000001C14CCF9000-memory.dmp
          Download

          memory/1964-465-0x000001C14BA30000-0x000001C14CCF9000-memory.dmp
          Download

          memory/1964-464-0x000001C1476E0000-0x000001C1476E1000-memory.dmp
          Download