URL:

https://www.cheatengine.org/downloads.php

Full analysis: https://app.any.run/tasks/a3ed5cf6-b7ce-4085-8dcf-d2a809175a45
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: February 23, 2026, 15:14:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
cheatengine
tool
bundleinstaller
adware
arch-exec
delphi
inno
installer
innosetup
Indicators:
MD5:

5FBBF01C2EB9C3BA9FCBF4E53CD9CCC8

SHA1:

849ADDD6D9786E9F31A17B50960165D8DD853D5E

SHA256:

0E2C7E997B747C964A288B75BD35A684F63870CAB73D03640DC9A77AA22020A1

SSDEEP:

3:N8DSLHMLV:2OLH2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bundleinstaller mutex has been found

      • CheatEngine76.tmp (PID: 7660)

    • Starts NET.EXE for service management

      • net.exe (PID: 7824)
      • net.exe (PID: 4876)
      • net.exe (PID: 5804)
      • CheatEngine76.tmp (PID: 6848)

    • Changes settings of System certificates

      • saBSI.exe (PID: 5160)
      • servicehost.exe (PID: 1316)

    • INNOSETUP has been detected (SURICATA)

      • CheatEngine76.tmp (PID: 7660)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • CheatEngine76.exe (PID: 5224)
      • CheatEngine76.exe (PID: 8036)
      • CheatEngine76.tmp (PID: 7660)
      • CheatEngine76.tmp (PID: 6848)
      • CheatEngine76.exe (PID: 2280)
      • saBSI.exe (PID: 1428)
      • icacls.exe (PID: 5168)
      • installer.exe (PID: 6232)
      • saBSI.exe (PID: 5160)
      • installer.exe (PID: 2548)

    • Reads the Windows owner or organization settings

      • CheatEngine76.tmp (PID: 7660)
      • CheatEngine76.tmp (PID: 6848)

    • Starts SC.EXE for service management

      • CheatEngine76.tmp (PID: 6848)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6240)
      • sc.exe (PID: 1316)
      • sc.exe (PID: 8764)

    • Uses ICACLS.EXE to modify access control lists

      • CheatEngine76.tmp (PID: 6848)

    • Adds/modifies Windows certificates

      • saBSI.exe (PID: 5160)
      • servicehost.exe (PID: 1316)

    • The process verifies whether the antivirus software is installed

      • saBSI.exe (PID: 1428)
      • installer.exe (PID: 6232)
      • servicehost.exe (PID: 1316)
      • uihost.exe (PID: 5472)
      • updater.exe (PID: 6600)
      • cmd.exe (PID: 9112)
      • installer.exe (PID: 2548)
      • cmd.exe (PID: 8060)

    • Process drops SQLite DLL files

      • CheatEngine76.tmp (PID: 6848)

    • The process creates files with name similar to system file names

      • installer.exe (PID: 2548)
      • servicehost.exe (PID: 1316)

    • Creates/Modifies COM task schedule object

      • installer.exe (PID: 2548)

    • Executes as Windows Service

      • servicehost.exe (PID: 1316)

    • Reads Mozilla Firefox installation path

      • servicehost.exe (PID: 1316)
      • uihost.exe (PID: 5472)

    • File deletion via cmd.exe

      • cmd.exe (PID: 8060)
      • cmd.exe (PID: 9112)

    • Searches for installed software

      • updater.exe (PID: 6600)

    • Executes application which crashes

      • CheatEngine76.tmp (PID: 7660)

    • Access to an unwanted program domain was detected

      • CheatEngine76.tmp (PID: 7660)

    • Starts CMD.EXE for commands execution

      • updater.exe (PID: 6600)

  • INFO

    • Drops script file

      • chrome.exe (PID: 9152)
      • installer.exe (PID: 6232)
      • installer.exe (PID: 2548)
      • servicehost.exe (PID: 1316)
      • updater.exe (PID: 6600)

    • Application launched itself

      • chrome.exe (PID: 9152)

    • Reads the computer name

      • CheatEngine76.tmp (PID: 8348)
      • CheatEngine76.exe (PID: 8036)
      • CheatEngine76.tmp (PID: 7660)
      • saBSI.exe (PID: 5160)
      • CheatEngine76.exe (PID: 2280)
      • CheatEngine76.tmp (PID: 6848)
      • saBSI.exe (PID: 1428)
      • Kernelmoduleunloader.exe (PID: 6628)
      • installer.exe (PID: 2548)
      • servicehost.exe (PID: 1316)
      • uihost.exe (PID: 5472)
      • updater.exe (PID: 6600)
      • Cheat Engine.exe (PID: 4608)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 4216)

    • Checks supported languages

      • CheatEngine76.exe (PID: 5224)
      • CheatEngine76.exe (PID: 8036)
      • CheatEngine76.tmp (PID: 8348)
      • CheatEngine76.tmp (PID: 7660)
      • CheatEngine76.exe (PID: 2280)
      • saBSI.exe (PID: 5160)
      • _setup64.tmp (PID: 5484)
      • CheatEngine76.tmp (PID: 6848)
      • saBSI.exe (PID: 1428)
      • Kernelmoduleunloader.exe (PID: 6628)
      • installer.exe (PID: 6232)
      • installer.exe (PID: 2548)
      • windowsrepair.exe (PID: 8144)
      • servicehost.exe (PID: 1316)
      • uihost.exe (PID: 5472)
      • updater.exe (PID: 6600)
      • Cheat Engine.exe (PID: 4608)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 4216)

    • Create files in a temporary directory

      • CheatEngine76.exe (PID: 5224)
      • CheatEngine76.exe (PID: 8036)
      • CheatEngine76.tmp (PID: 7660)
      • CheatEngine76.tmp (PID: 6848)
      • CheatEngine76.exe (PID: 2280)
      • saBSI.exe (PID: 1428)
      • installer.exe (PID: 2548)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 4216)

    • Reads security settings of Internet Explorer

      • CheatEngine76.tmp (PID: 8348)
      • CheatEngine76.tmp (PID: 7660)
      • saBSI.exe (PID: 5160)
      • saBSI.exe (PID: 1428)
      • installer.exe (PID: 2548)
      • uihost.exe (PID: 5472)
      • Cheat Engine.exe (PID: 4608)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 4216)
      • Taskmgr.exe (PID: 4936)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 9152)

    • Process checks computer location settings

      • CheatEngine76.tmp (PID: 8348)
      • CheatEngine76.tmp (PID: 7660)
      • servicehost.exe (PID: 1316)
      • Cheat Engine.exe (PID: 4608)

    • Detects InnoSetup installer (YARA)

      • CheatEngine76.tmp (PID: 8348)
      • CheatEngine76.exe (PID: 5224)
      • CheatEngine76.exe (PID: 8036)
      • CheatEngine76.tmp (PID: 7660)

    • Reads the machine GUID from the registry

      • CheatEngine76.tmp (PID: 7660)
      • saBSI.exe (PID: 5160)
      • saBSI.exe (PID: 1428)
      • installer.exe (PID: 2548)
      • servicehost.exe (PID: 1316)
      • uihost.exe (PID: 5472)
      • updater.exe (PID: 6600)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 4216)

    • Compiled with Borland Delphi (YARA)

      • CheatEngine76.exe (PID: 5224)
      • CheatEngine76.tmp (PID: 8348)
      • CheatEngine76.exe (PID: 8036)
      • CheatEngine76.tmp (PID: 7660)

    • Creates files in the program directory

      • saBSI.exe (PID: 5160)
      • CheatEngine76.tmp (PID: 6848)
      • saBSI.exe (PID: 1428)
      • installer.exe (PID: 6232)
      • installer.exe (PID: 2548)
      • servicehost.exe (PID: 1316)
      • uihost.exe (PID: 5472)
      • updater.exe (PID: 6600)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 4216)

    • Checks proxy server information

      • CheatEngine76.tmp (PID: 7660)
      • saBSI.exe (PID: 5160)
      • saBSI.exe (PID: 1428)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 4216)
      • WerFault.exe (PID: 5772)
      • WerFault.exe (PID: 5284)
      • slui.exe (PID: 4256)

    • CHEATENGINE mutex has been found

      • CheatEngine76.tmp (PID: 7660)

    • The sample compiled with english language support

      • saBSI.exe (PID: 5160)
      • icacls.exe (PID: 5168)
      • CheatEngine76.tmp (PID: 6848)
      • CheatEngine76.tmp (PID: 7660)
      • saBSI.exe (PID: 1428)
      • installer.exe (PID: 6232)
      • installer.exe (PID: 2548)

    • There is functionality for taking screenshot (YARA)

      • CheatEngine76.tmp (PID: 7660)

    • Creates a software uninstall entry

      • CheatEngine76.tmp (PID: 6848)
      • installer.exe (PID: 2548)
      • servicehost.exe (PID: 1316)

    • Creates files or folders in the user directory

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 4216)
      • WerFault.exe (PID: 5772)
      • WerFault.exe (PID: 5284)

    • Manual execution by a user

      • Taskmgr.exe (PID: 4608)
      • Taskmgr.exe (PID: 4936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
239
Monitored processes
83
Malicious processes
6
Suspicious processes
7

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs cheatengine76.exe cheatengine76.tmp no specs cheatengine76.exe #INNOSETUP cheatengine76.tmp sabsi.exe cheatengine76.exe cheatengine76.tmp net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs _setup64.tmp no specs conhost.exe no specs icacls.exe conhost.exe no specs sabsi.exe kernelmoduleunloader.exe installer.exe installer.exe slui.exe windowsrepair.exe no specs icacls.exe no specs conhost.exe no specs servicehost.exe uihost.exe updater.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cheat engine.exe no specs cheatengine-x86_64-sse4-avx2.exe werfault.exe werfault.exe taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
792\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1156"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=7312,i,12332491068660988787,13423110599516988096,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=7116 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1172"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=6528,i,12332491068660988787,13423110599516988096,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=6604 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1176"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5024,i,12332491068660988787,13423110599516988096,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=4860 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1316"sc" delete BadlionAnticheatC:\Windows\System32\sc.exe—CheatEngine76.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1316"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\servicehost.exe
services.exe
User:
SYSTEM
Company:
McAfee, LLC
Integrity Level:
SYSTEM
Description:
McAfee WebAdvisor(service)
Version:
4,1,1,1088
Modules
Images
c:\program files\mcafee\webadvisor\servicehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1424"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=7020,i,12332491068660988787,13423110599516988096,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=6952 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1428"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true InstallID=GnjW1de8JLGRJR5eYijA8BlIyNdyTW4mLl0V2HWl9sLEMpDStTsDNi0riwVFxfbvGF2AsY8VFAvPW5kY2Pg saBsiVersion=4.1.1.865 CountryCode=DE /no_self_updateC:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
saBSI.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Exit code:
0
Version:
4,1,1,1006
Modules
Images
c:\programdata\mcafee\webadvisor\sabsi\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1432\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
42 130
Read events
41 820
Write events
290
Delete events
20

Modification events

(PID) Process:(7660) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000EA070200010017000F000E002C002900010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(7660) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000EA070200010017000F000E002C003800010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(5160) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:UUID
Value:
{99F45000-6DAB-4A96-B1DC-DD93BA389972}
(PID) Process:(5160) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:InstallerFlags
Value:
1
(PID) Process:(6848) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
C01A0000BE793F24D7A4DC01
(PID) Process:(6848) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
D89FB9DACD0E17A562F6C6D7DE63CCE1E4AF7789D50CBF39C2989735E48DCE1A
(PID) Process:(6848) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(6848) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFiles0000
Value:
C:\Program Files\Cheat Engine\windowsrepair.exe
(PID) Process:(6848) CheatEngine76.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFilesHash
Value:
52655C1D76A57E5DEE6BA599594F94617EAA21D939632DC6D322EB6D2DDF0FB8
(PID) Process:(5160) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
Operation:delete valueName:4EFC31460C619ECAE59C1BCE2C008036D94C84B8
Value:
Executable files
164
Suspicious files
338
Text files
1 325
Unknown types
94

Dropped files

PID
Process
Filename
Type
9152chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF1e5523.TMP —
MD5:—
SHA256:—
9152chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
9152chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF1e5523.TMP —
MD5:—
SHA256:—
9152chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF1e5523.TMP —
MD5:—
SHA256:—
9152chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old~RF1e5523.TMP —
MD5:—
SHA256:—
9152chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
9152chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
9152chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1e5532.TMP —
MD5:—
SHA256:—
9152chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF1e5532.TMP —
MD5:—
SHA256:—
9152chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
313
TCP/UDP connections
184
DNS requests
205
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
unknown
—
—
whitelisted
8716
chrome.exe
GET
200
104.17.24.14:443
https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css
unknown
—
3.85 Kb
unknown
8716
chrome.exe
GET
200
104.17.24.14:443
https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js
unknown
—
19.3 Kb
unknown
8716
chrome.exe
GET
200
172.66.137.64:443
https://www.cheatengine.org/images/chippick_small.png
unknown
image
11.4 Kb
unknown
8716
chrome.exe
GET
200
142.251.208.170:443
https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
unknown
—
41 b
whitelisted
8716
chrome.exe
GET
200
172.66.137.64:443
https://www.cheatengine.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
unknown
—
1.21 Kb
unknown
8716
chrome.exe
GET
200
172.66.137.64:443
https://www.cheatengine.org/download.gif
unknown
image
572 b
unknown
8716
chrome.exe
GET
200
142.251.141.136:443
https://www.googletagmanager.com/gtm.js?id=GTM-M7T9WGQ
unknown
—
294 Kb
unknown
8716
chrome.exe
GET
204
150.171.28.10:443
https://bat.bing.net/action/0?ti=5613023&Ver=2&mid=b1819913-e6b5-46af-9811-271493848452&bo=2&uach=pv%3D10.0.0&pi=918639831&lg=en-US&sw=1360&sh=768&sc=24&tl=Cheat%20Engine&p=https%3A%2F%2Fwww.cheatengine.org%2Fdownloads.php&r=&lt=1087&evt=pageLoad&sv=2&asc=D&cdb=AQAY&rn=596074
unknown
—
—
unknown
8716
chrome.exe
POST
204
150.171.28.10:443
https://bat.bing.net/actionp/0?ti=5613023&Ver=2&mid=b1819913-e6b5-46af-9811-271493848452&bo=1&evt=consent&src=enforced&cdb=AQAY&asc=D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
3344
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2944
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5568
SearchApp.exe
92.123.104.32:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
5568
SearchApp.exe
92.123.104.34:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8716
chrome.exe
142.251.141.142:80
clients2.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
www.bing.com
  • 92.123.104.32
  • 92.123.104.36
  • 92.123.104.37
  • 92.123.104.40
  • 92.123.104.35
  • 92.123.104.41
  • 92.123.104.33
  • 92.123.104.34
  • 92.123.104.38
whitelisted
th.bing.com
  • 92.123.104.34
  • 92.123.104.35
  • 92.123.104.36
  • 92.123.104.41
  • 92.123.104.33
  • 92.123.104.37
  • 92.123.104.38
  • 92.123.104.43
  • 92.123.104.40
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
clients2.google.com
  • 142.251.141.142
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 142.251.208.170
  • 216.58.206.42
  • 172.217.16.170
  • 142.250.187.234
  • 172.217.16.202
  • 172.217.20.138
  • 142.251.37.10
  • 142.251.141.106
  • 142.250.201.74
  • 142.251.36.106
  • 142.251.208.10
  • 142.251.141.138
  • 142.251.141.74
  • 172.217.168.74
  • 142.250.187.202
  • 142.250.201.170
whitelisted
clientservices.googleapis.com
  • 142.251.36.99
whitelisted

Threats

PID
Process
Class
Message
8716
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
8716
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
8716
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
8716
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
8716
chrome.exe
Misc activity
INFO [ANY.RUN] .cc TLD domain request
6768
MoUsoCoreWorker.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
7660
CheatEngine76.tmp
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
7660
CheatEngine76.tmp
A Network Trojan was detected
ET ADWARE_PUP Win32/OfferCore Checkin M1
7660
CheatEngine76.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
7660
CheatEngine76.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
Process
Message
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-C9S4V.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-C9S4V.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-C9S4V.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-C9S4V.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-C9S4V.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-C9S4V.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-C9S4V.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-C9S4V.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.cheatengine.org/downloads.php