Is A Plague Tale Ultrawide.exe safe?
Multiple independent engines identify a Cheat Engine-based hacktool, while runtime evidence records process-injection capability and the executable lacks an authenticated publisher.
The file is consistently identified as a Cheat Engine-based game hack or riskware tool: 33 of 75 engines flagged it, including six tier-1 engines. Runtime evidence also maps its activity to T1055 process injection, a capability that can manipulate another process even when used as a game trainer.
bcf34541929b4cdf11…75eea586d403b5Recommended next actions
Before running
Do not run it. Delete this file from the device, then empty the Recycle Bin or Trash.
If you already ran it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The file is consistently identified as a Cheat Engine-based game hack or riskware tool: 33 of 75 engines flagged it, including six tier-1 engines. Runtime evidence also maps its activity to T1055 process injection, a capability that can manipulate another process even when used as a game trainer.
Thirty-three of 75 engines detected the executable, and six tier-1 engines contributed detections. ESET-NOD32 specifically identified Cheat Engine hacktool functionality, while GData and Ikarus also used hacktool classifications. The corroborated hacktool flag is decisive under the handling policy, regardless of whether the intended use is modifying a game. One completed sandbox run recorded T1055 process-injection behavior, which is consistent with trainer functionality, although it did not issue a malicious sandbox verdict. The executable is unsigned, and no complete reputation check is available for the observed direct-IP contacts.
What We Detected
Thirty-three of 75 antivirus engines flagged this executable. Six tier-1 engines detected it, with ESET-NOD32 naming Cheat Engine and GData and Ikarus identifying hacktool or riskware functionality. The corroborated hacktool indicator is especially significant because multiple independent products agree on the file's process-manipulation purpose.
Threat Behavior
One completed sandbox run mapped activity to MITRE T1055, Process Injection. The sample also unpacked trainer components into a temporary directory and launched extracted executables, behavior consistent with a Cheat Engine trainer. No malicious sandbox verdict or confirmed malicious dropped child was recorded, but the six dropped files remain unclassified. Direct IP contacts were observed; however, no complete host-reputation cross-check is available, so their safety cannot be established.
What To Do Now
Do not run the executable on a personal, work, or gaming account system. Remove or quarantine it while keeping endpoint protection enabled, and obtain any legitimate game modification only from a verified publisher or well-established project channel.
Where this verdict could be wrong5 caveats
- engines.tier1FamilyConsensus.strong=false; only 2 tier-1 engines converged specifically on Cheat Engine, although six tier-1 engines flagged the file overall.
- behaviour.hasMaliciousSandboxVerdict=false, and droppedChildren.hasMaliciousChild=false across 6 inspected children.
- externalIntel.yaraify.ruleCount=0 and externalIntel.circl.hit=false, providing no researcher-curated corroboration.
- prevalence.classification=common_old with 121 sources and 128 submissions, indicating this is not a newly observed sample.
- PE analysis reports peAnalysis.highEntropyCode=false and peAnalysis.likelyPacked=false.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No completed sandbox issued a malicious verdict
- No inspected dropped child was confirmed malicious
- The sample is established rather than newly observed
- No high-entropy code or likely packing was identified
- No YARAify or CIRCL malicious corroboration was returned
- 33 of 75 antivirus engines detected the executable
- Six tier-1 engines produced detections
- Corroborated Cheat Engine or hacktool labeling
- T1055 Process Injection observed during runtime analysis
- Unsigned Win32 executable
- Six extracted child files remain unclassified
Quarantine or remove the file and keep endpoint protection enabled. If this trainer is needed, replace it with a version obtained from a verifiable, trusted source and test it only in an isolated environment.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete33 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial5 runtime contacts were observed without a completed reputation cross-check.
YARA
Complete2 signature or behavior rules matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 14MITRE ATT&CK techniques
- 15spawned processes
- 5network contacts
- 32filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
High concern: Used an input-capture technique that can record credentials or keystrokes.
High concern: Changed an auto-start location that can make code run after sign-in or restart.
High concern: Manipulated how the operating system loads code, which can redirect execution.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Removed execution artefacts or logs, which can conceal activity.
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How hacktools are abused
This is a hacking or cracking tool — the kind used to bypass software licences, generate fake keys, or attack other systems. Even when the tool 'works', these downloads very often carry hidden malware.
Bottom line:Running one means trusting an anonymous author with full access to your PC — rarely worth the risk.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
A Plague Tale Ultrawide.exe
bcf34541929b4cdf11e8967cbc1fc3eb5444868af1829794db75eea586d403b5
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\file.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
"C:\Users\<USER>\AppData\Local\Temp\cetrainers\CETCD52.tmp\file.exe" -ORIGIN:"C:\Users\<USER>\Desktop\"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
CET_Archive.dat
C:\Users\<USER>\AppData\Local\Temp\cetrainers\CETCD52.tmp\CET_Archive.dat
04Isolated runtime analysis - Written fileObserved
file.exe
C:\Users\<USER>\AppData\Local\Temp\cetrainers\CETCD52.tmp\file.exe
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
a83f:8110:403:0:0:0:403:0
Contact observed during runtime.
06Isolated runtime analysis - Contacted hostObserved
20.99.132.105
Contact observed during runtime.
07Isolated runtime analysis - +1 more recorded observation in Analyst mode
7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- a83f:8110:403:0:0:0:403:0
- 20.99.132.105
- 23.40.197.184
- a83f:8110:0:200:0:0:0:0
- 239.255.255.250
- C:\Users\<USER>\AppData\Local\Temp\cetrainers\CETCD52.tmp\CET_Archive.dat
- C:\Users\<USER>\AppData\Local\Temp\cetrainers\CETCD52.tmp\file.exe
- C:\Users\<USER>\AppData\Local\Temp\cetrainers\CETCD52.tmp\extracted\CET_TRAINER.CETRAINER
- C:\Users\<USER>\AppData\Local\Temp\cetrainers\CETCD52.tmp\extracted\defines.lua
- C:\Users\<USER>\AppData\Local\Temp\cetrainers\CETCD52.tmp\extracted\file.exe
- C:\Users\<USER>\AppData\Local\Temp\cetrainers\CETCD52.tmp\extracted\CET_TRAINER.CETRAINER
- %USERPROFILE%\AppData\Local\Temp\cetrainers\CETE30D.tmp\extracted\CET_TRAINER.CETRAINER
- C:\Windows\System32\spp\store\2.0\cache\cache.dat
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER3033.tmp.WERInternalMetadata.xml
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER3035.tmp.csv
- DBWinMutex
- \Sessions\1\BaseNamedObjects\DBWinMutex
Files this sample writes at runtime
This file drops 6 children at runtime. None are currently flagged malicious in our cache.
- 98734a612b20b2354cbc…61bba5Never scannednever seen before
- f2cb4b0bc5db9b97bb41…88327bNever scannednever seen before
- dab3003436b6861ae220…e3d6afNever scannednever seen before
- 81b735df4edb880bee67…006a21Never scannednever seen before
- 522fd7cac73f55f249b8…be8fabNever scannednever seen before
- 879555f1afe27b22da98…726344Never scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 2rule hits recorded
- 33 / 75engines flagged
- 121sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 02
33 of 75 antivirus engines flagged the file, including alibabacloud and Antiy-AVL.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
The hash has a long, established submission history across 121 sources.
ProvenanceDerivedSourceSubmission historyObserved at - 04
Scanned file: A Plague Tale Ultrawide.exe — bcf34541929b4cdf11e8967cbc1fc3eb5444868af1829794db75eea586d403b5
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\<USER>\Desktop\file.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — "C:\Users\<USER>\AppData\Local\Temp\cetrainers\CETCD52.tmp\file.exe" -ORIGIN:"C:\Users\<USER>\Desktop\"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: CET_Archive.dat — C:\Users\<USER>\AppData\Local\Temp\cetrainers\CETCD52.tmp\CET_Archive.dat
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: file.exe — C:\Users\<USER>\AppData\Local\Temp\cetrainers\CETCD52.tmp\file.exe
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: a83f:8110:403:0:0:0:403:0 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at - 10
Contacted host: 20.99.132.105 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: hacktool
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
Evidence"C:\Users\<USER>\Desktop\file.exe"The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidencea83f:8110:403:0:0:0:403:0 · 20.99.132.105 · 23.40.197.184
33 of 75 engines flagged this file
View all 75 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Fingerprint and provenance
- File name
- A Plague Tale Ultrawide.exe
- Format
- Win32 EXE
- Code signing
- No verified publisher
- Size
- 5.7 MB
- Last analyzed
- Sep 9, 2026, 8:28 PM UTC
bcf34541929b4cdf11e8967cbc1fc3eb5444868af1829794db75eea586d403b5Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't run this file. Delete this file from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already ran it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
From a different, clean device, change the passwords on your important accounts (email and banking first) and turn on two-factor authentication.
- Recovery step 04
Get a fresh copy from the developer's official site or an official app store.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is A Plague Tale Ultrawide.exe a virus?
What is A Plague Tale Ultrawide.exe?
How many antivirus engines detected A Plague Tale Ultrawide.exe?
What should I do if I already ran A Plague Tale Ultrawide.exe?
How do I remove A Plague Tale Ultrawide.exe?
What kind of malware is A Plague Tale Ultrawide.exe?
What is the SHA-256 hash of A Plague Tale Ultrawide.exe?
How up to date is this analysis of A Plague Tale Ultrawide.exe?
Community
Member reviews and reports for this exact file hash.