7f14d25a6d20a0f6658ec977e4751e2c951ede27f5b4d5c5f3d469b131d8e008

Analysis

max time kernel
267s
max time network
273s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
01-03-2024 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cheat Engine.exe
Size

371KB
MD5

ea1a9d53dab1e72847b024a22d372d62
SHA1

558271c71a9df6da04f87564cf34e854abdf25c9
SHA256

8bc19af09574a0cc32c58b4e9ab4d3a496eb48465a226a97be32aaf6ade4901a
SHA512

5ad2a9a45a0b12e02556514cd3208a8226314179eed5aa4f72d909edac1babe86f933a20a504839f01a6a9361dd7f49133804382742782ab9a5c38da50edc595
SSDEEP

6144:Cl010wHB5zP3sHFQJZBuMLI/NCVpdIAkttAqgmMk044tmZ8B+gugEkkoSE5f:2010wHrzPcHFQjL2CVpGzJ+44EZ8B+gd

Score

8^/10

Malware Config

Signatures

Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

Processes:

cheatengine-x86_64-SSE4-AVX2.exe

description ioc process

File opened for modification C:\Windows\System32\WINTRUST.dll cheatengine-x86_64-SSE4-AVX2.exe

description	ioc	process
File opened for modification	C:\Windows\System32\WINTRUST.dll	cheatengine-x86_64-SSE4-AVX2.exe

Drops file in System32 directory 64 IoCs

Processes:

cheatengine-x86_64-SSE4-AVX2.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DiagnosticDataSettings.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\dxcore.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\IMM32.DLL	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\windows.staterepositoryclient.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\AudioSes.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\ksuser.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\sechost.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\ncryptsslp.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\bcp47mrm.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\twinapi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\prnfldr.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\NetworkUXBroker.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wintypes.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\VAULTCLI.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\EhStorShell.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\cdp.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\FirewallAPI.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\twinui.pcshell.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\inputhost.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\netutils.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\winsta.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\SLC.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\SettingsHandlers_DesktopTaskbar.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\DPAPI.DLL	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\windows.staterepositorycore.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\dusmapi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\uiautomationcore.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ShellCommonCommonProxyStub.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\Windows.Media.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\AEPIC.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\USERENV.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\SAMLIB.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\dcomp.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\WKSCLI.DLL	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\fwpuclnt.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\TWINAPI.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\UiaManager.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\dot3api.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\DWrite.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\Windows.UI.Xaml.Controls.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\gpapi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wevtapi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\rsaenh.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ApplicationFrame.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\Windows.Internal.UI.Shell.WindowTabManager.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\Windows.Security.Authentication.OnlineId.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\NETAPI32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\srchadmin.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\midimap.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\srumapi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\msi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wkscli.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\Windows.Shell.BlueLightReduction.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\StructuredQuery.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\dmEnrollEngine.DLL	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\sxs.dll	cheatengine-x86_64-SSE4-AVX2.exe

Drops file in Program Files directory 64 IoCs

Processes:

cheatengine-x86_64-SSE4-AVX2.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\dwmapi.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\TextShaping.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\WindowsCodecs.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\wpnapps.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\apphelp.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\rpcrt4.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\msvcp_win.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\XmlLite.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\winsta.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\cryptngc.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\combase.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\nlansp_c.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\windowsudk.shellcommon.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\mswsock.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\win32u.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\DLL\imm32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\CLBCatQ.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\WindowsCodecs.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\rasadhlp.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\ole32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\Windows.Storage.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\Windows.StateRepositoryCore.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dbghelp.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\userenv.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\sechost.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\shlwapi.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dpapi.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\normaliz.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\devobj.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\fwbase.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\DLL\UIAutomationCore.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\mscms.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\TenantRestrictionsPlugin.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\windowsudk.shellcommon.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dhcpcsvc6.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\Windows.Security.Authentication.OnlineId.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\Windows.Devices.Enumeration.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\wtsapi32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\wkscli.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\Windows.System.Launcher.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\cryptsp.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\cryptsp.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\fwpuclnt.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\msedge_elf.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\MMDevAPI.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\DataExchange.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\Windows.System.Launcher.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\Windows.UI.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\XmlLite.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\setupapi.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\oleaut32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\DRV\winspool.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\netutils.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.dll.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\ws2_32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\propsys.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\wpnapps.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\apphelp.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\shell32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\symbols\dll\nlansp_c.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\msedge.dll.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dll\fwbase.pdb	cheatengine-x86_64-SSE4-AVX2.exe

Drops file in Windows directory 64 IoCs

Processes:

cheatengine-x86_64-SSE4-AVX2.exe

description	ioc	process
File opened for modification	C:\Windows\symbols\dll\sspicli.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\wintrust.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\PCShellCommonProxyStub.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\d3d11.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\wosc.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\winsta.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\AppExtension.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\ntshrui.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\setupapi.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\Windows.UI.Core.TextInput.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\BluetoothApis.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\mpr.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\msi.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\Explorer.EXE	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\windows.energy.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\avrt.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\propsys.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\bcrypt.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\DevDispItemProvider.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\uxtheme.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\Windows.Globalization.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\EthernetMediaManager.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\avrt.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\dxgi.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\Windows.Shell.BlueLightReduction.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\TaskFlowUI.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\msvcp140_app.amd64.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\msvcp140_app.amd64.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\pnidui.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\shell32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\AppXDeploymentClient.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\Windows.CloudStore.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\Windows.UI.Immersive.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\Windows.Shell.BlueLightReduction.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\BluetoothApis.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\cfgmgr32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\TileDataRepository.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\LanguageOverlayUtil.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\TaskFlowUI.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\sxs.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\WINMMBASE.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\msiltcfg.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\aepic.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\samlib.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\thumbcache.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\DevDispItemProvider.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SyncCenter.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\Taskbar.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\staterepository.core.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dhcpcsvc6.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\shcore.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\shlwapi.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\propsys.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\bcryptprimitives.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\msctf.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\DLL\dhcpcsvc.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\InputSwitch.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\symbols\dll\CoreUIComponents.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\dll\gdi32full.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\cryptbase.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\DLL\wkscli.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467\COMCTL32.dll	cheatengine-x86_64-SSE4-AVX2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

Processes:

cheatengine-x86_64-SSE4-AVX2.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
2136	msedge.exe
2136	msedge.exe
4788	msedge.exe
4788	msedge.exe
5072	identity_helper.exe
5072	identity_helper.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
4504	msedge.exe
4504	msedge.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe
1532	cheatengine-x86_64-SSE4-AVX2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

cheatengine-x86_64-SSE4-AVX2.exe

pid process

1532 cheatengine-x86_64-SSE4-AVX2.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4788 msedge.exe
4788 msedge.exe
4788 msedge.exe
4788 msedge.exe
4788 msedge.exe
4788 msedge.exe
4788 msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

cheatengine-x86_64-SSE4-AVX2.exe

description	pid	process
Token: SeDebugPrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeTcbPrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeTcbPrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeLoadDriverPrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeCreateGlobalPrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeLockMemoryPrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: 33	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeSecurityPrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeTakeOwnershipPrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeManageVolumePrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeBackupPrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeCreatePagefilePrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeShutdownPrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeRestorePrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: 33	1532	cheatengine-x86_64-SSE4-AVX2.exe
Token: SeIncBasePriorityPrivilege	1532	cheatengine-x86_64-SSE4-AVX2.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

cheatengine-x86_64-SSE4-AVX2.exemsedge.exe

pid	process
1532	cheatengine-x86_64-SSE4-AVX2.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Cheat Engine.execheatengine-x86_64-SSE4-AVX2.exemsedge.exe

description	pid	process	target process
PID 232 wrote to memory of 1532	232	Cheat Engine.exe	cheatengine-x86_64-SSE4-AVX2.exe
PID 232 wrote to memory of 1532	232	Cheat Engine.exe	cheatengine-x86_64-SSE4-AVX2.exe
PID 1532 wrote to memory of 1556	1532	cheatengine-x86_64-SSE4-AVX2.exe	Tutorial-x86_64.exe
PID 1532 wrote to memory of 1556	1532	cheatengine-x86_64-SSE4-AVX2.exe	Tutorial-x86_64.exe
PID 4788 wrote to memory of 1696	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1696	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 1028	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 2136	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 2136	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe
PID 4788 wrote to memory of 3536	4788	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Cheat Engine.exe
"C:\Users\Admin\AppData\Local\Temp\Cheat Engine.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:232

C:\Users\Admin\AppData\Local\Temp\cheatengine-x86_64-SSE4-AVX2.exe
"C:\Users\Admin\AppData\Local\Temp\cheatengine-x86_64-SSE4-AVX2.exe"
2⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1532

C:\Users\Admin\AppData\Local\Temp\Tutorial-x86_64.exe
"C:\Users\Admin\AppData\Local\Temp\Tutorial-x86_64.exe"
3⤵
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe7fb73cb8,0x7ffe7fb73cc8,0x7ffe7fb73cd8
2⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,3818104842773602967,3843968850848665601,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
2⤵
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,3818104842773602967,3843968850848665601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,3818104842773602967,3843968850848665601,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
2⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,3818104842773602967,3843968850848665601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
2⤵
PID:1000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,3818104842773602967,3843968850848665601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,3818104842773602967,3843968850848665601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
2⤵
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,3818104842773602967,3843968850848665601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
2⤵
PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,3818104842773602967,3843968850848665601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3300 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,3818104842773602967,3843968850848665601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,3818104842773602967,3843968850848665601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
2⤵
PID:776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,3818104842773602967,3843968850848665601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
2⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,3818104842773602967,3843968850848665601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
2⤵
PID:2548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
656bb397c72d15efa159441f116440a6

SHA1
5b57747d6fdd99160af6d3e580114dbbd351921f

SHA256
770ed0fcd22783f60407cdc55b5998b08e37b3e06efb3d1168ffed8768751fab

SHA512
5923db1d102f99d0b29d60916b183b92e6be12cc55733998d3da36d796d6158c76e385cef320ec0e9afa242a42bfb596f7233b60b548f719f7d41cb8f404e73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d459a8c16562fb3f4b1d7cadaca620aa

SHA1
7810bf83e8c362e0c69298e8c16964ed48a90d3a

SHA256
fa31bc49a2f9af06d325871104e36dd69bfe3847cd521059b62461a92912331a

SHA512
35cb00c21908e1332c3439af1ec9867c81befcc4792248ee392080b455b1f5ce2b0c0c2415e344d91537469b5eb72f330b79feb7e8a86eeb6cf41ec5be5dfd2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea5ccf2b197813ce37d86d31f01382d0

SHA1
37f680a5e69300b28ba82934b1c56184f6a464a9

SHA256
fdc38b1d4fd727c62757892a8f42e5b6b0fb75598498425be3d80ad9d6896462

SHA512
d1ca524ec43ef859361a8ee9a19c65230b32376afb2dfb78f6f81b4dafc48e697f904fd4197735151ec6d40d333dfc01a49df4d79e167ba9b3b78f8aa2ea3e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bca7e1b0c39fb10daef47638a518b153

SHA1
50920d3aa2052912697735337d50a73b6828930f

SHA256
88293e248b6aa688005d39783493d8220740d32c4c1e30e943e33d84a4036736

SHA512
a13617fb8a53f2f22e4a16b1722af71cd67592906280ce6091194b3a8c65add9dbdae6124fc10939c2037887c76bb80a2b4bf8c15725d215edf315cd2f78d4b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c5a44c333bcf4169ecd69aea0fe4e276

SHA1
7e0e0e370e440ca53cd23a12fbe10cbc3baf348f

SHA256
a40c61da6009a7d52ac835874249b4994b85177bd9359911ba6613a57294bca2

SHA512
07f401221ca352f70f2237bc009055601c79f40d9615adb5953745c6fc540a8a9d84005353d3ac085a82b483de8f9dfeb6732ad53b2fe7743b115c03b3de645b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9aaa0f478416c6b214e606f5bf9ea13a

SHA1
ca9377c0727c70b9ed24b8e6ab8d65ab7ca08e73

SHA256
ab7f102662490c065c76892dfd0524ea35b9c56716653e79e09b28ca0af0eda0

SHA512
8b08f76abe0654f8bf2deeba153aa45c70307b9207332b3549e725cfbfe77631b5030353d8d3cafe37bcd43bf511f7982b71f1ee6f3e923defa60bdbadb87ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
611bbe98d525f84b62222d7d0a33c57f

SHA1
4274fe901a5d99e6fc2782e063d1297b4c8758d1

SHA256
706d1d34e047a780f7298c062eeafe8cf02ec8f20f66028134962e844327ddf3

SHA512
82ea31d21487f5a0b4b8b473025cccda333c98395e7b500fa46991ad1e29fccb7dede78e1793e02e5858fda5f9f4245a88d3540e5ed96ebd6b232fc41d41b070

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
93fd095eac72b7d0d9ff78f9bae62b43

SHA1
d3f89ac3e3058f3f32d3bd4151aa27a6b37c258f

SHA256
f70c4741c6f81634367651efc68524528cecceaffcb4a54157a6bea15bc76d68

SHA512
3fd053a5339242cd31763f321852b70b67d19f8f4fae3a606dfbae71691afb9451fde654c876ae488cc7847afdf8178fcd696281feb4ddd5cc90a27639ee980d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\{35E6C99B-39E4-4527-B6CD-F7E8353248B3}\ADDRESSES.TMP

Filesize
7B

MD5
ecdf0684a14d5b747c245d659b5f33b1

SHA1
fee7035409106461ca06d14236db42543aa042ee

SHA256
631bdc5422d1339287bf86b7a204f35956f676d473b27879f304d608238c318d

SHA512
e4cdd4b29e1a8cb4d1161a019a304122df5299d62001c3a03426d89b9b7f1fe69e3c3adff0bd036f333490d8673081da50b3165d44c4978e00980b4df7aa920d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\{B0AB4E02-56AC-4E9A-AF8E-A72C6CA387E6}\ADDRESSES.TMP

Filesize
637KB

MD5
d670cc004da85e8cdea99a7d3cfe062a

SHA1
f2244f3832391180525f5e813f7b13e9fb54d36c

SHA256
f1ded386030fcf422c5d2653c3884bac14a433af5e3bd8d5b3934bb940f7f9c1

SHA512
1957411bcbcaeafb6887ed4c715905025feab58840e17e36fc93e3af2dd47c8cc0065719531305c961ad0acab64b09acd8ec9577dc15c605b22f50935d0459da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\{B0AB4E02-56AC-4E9A-AF8E-A72C6CA387E6}\ADDRESSES.TMP

Filesize
637KB

MD5
ca65fd4ea3d79df9e380d1cc5c48934f

SHA1
bfd6dfb2b1a7e3f616ad5416cdf4bc20bfbff67c

SHA256
54d52459f754510a024f0da8fd203a336168f174df4b5581a26c40bb650dec66

SHA512
9db88e9facd27341895ebab51197296c3cac698937d59d5960ee0bb0aacaf57b856ff28467e04a078b779224d338f343bc3d7f43699238a787dddb05f9f0c1b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\{B0AB4E02-56AC-4E9A-AF8E-A72C6CA387E6}\ADDRESSES.TMP

Filesize
641KB

MD5
4729c839b4e73d5deea6a69c1a4a6c5c

SHA1
22b7b6043c56d57c3569e24fbb2d748a01193515

SHA256
7dc90ca5479b13bc471c8acc107b17b0ada8aeca14b5d7b0a3becede07075d39

SHA512
be7d0d230c6d563bd10b18e84619da832dc1920ef2d89966ca00e5a8cc667d4361a9ec12d8f39164ee218a0b40724400c4e22adfda02aa8c659f4b7d7fbf6dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\{B0AB4E02-56AC-4E9A-AF8E-A72C6CA387E6}\ADDRESSES.TMP

Filesize
634KB

MD5
0bd0193a13e70333ed010cc0b7a3f648

SHA1
a166468936918c5d211ac3d65588927d073577e1

SHA256
9bcb13edcbb9c40c1f9b0f53e260fe3d4b47fb7500d72932fd8d5431e67d7a54

SHA512
98f8669b458cc3e1e085bb99d2733c3449f2f942b91e4d0270dec04612333ab6ab668b6c72988d291cf3bd8b0c1d02012b3970d9df9d0dcdb222d97fd7b5702c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\{B0AB4E02-56AC-4E9A-AF8E-A72C6CA387E6}\ADDRESSES.TMP

Filesize
635KB

MD5
1364316ce9dec253a69dcbaf3159b30f

SHA1
e708503731fbd25b465de1b04ee0270340b55c47

SHA256
07afcbce26d07454e7abca04f5e219a502506c376208c87552457597be210d70

SHA512
b4aa9be1b6a11cc0552d48608f79379747b1010d1f45402cbdc6085b48dfabde1951cfa23fe629189fb589c8e7fd6f8e298b4588cb2d8e404d9cd1672ad128de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\{B0AB4E02-56AC-4E9A-AF8E-A72C6CA387E6}\MEMORY.FIRST

Filesize
320KB

MD5
9bdbd74401ea24fe853f87b477062e8d

SHA1
f153f10a98a56c5bb7a9050f0dd6f3da1635c295

SHA256
51b2d15389c021d6aeb3519e5d2277ff7d6578f624f36dfdf3751244db1b22cc

SHA512
576800b9b78447bb30ebd596aac4da3f44b27daaa20f8995da26623e19db7932daae81aa3ba15419a452c27a68b28a401d46620afb587f2793d3fdb2e49dd17a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\{B9175EDF-5CA0-4C15-9F4E-54636179BB3F}\inuse.lock

Filesize
4B

MD5
d1b3975b3b1aed5a9231936c5bb069b8

SHA1
35f13bffcfddaac34e7c1b7f201a2d150af6673a

SHA256
7fad8f30a43c97d3495ccfd5dbd2d32bc1ad5ec7764fab0844a781bab306be8a

SHA512
0b5275e0b0b6e101de01a692d76d9a6c78d8ff5f8609233d34f79edf029eca76d1308d19f07f74cf8a78a4e7ac7d9d8abb71bf9bae2a1e213f673b1cbbca7f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\languages\language.ini

Filesize
283B

MD5
af5ed8f4fe5370516403ae39200f5a4f

SHA1
9299e9998a0605182683a58a5a6ab01a9b9bc037

SHA256
4aa4f0b75548d45c81d8e876e2db1c74bddfd64091f102706d729b50a7af53a5

SHA512
f070049a2fae3223861424e7fe79cbae6601c9bee6a56fadde4485ad3c597dc1f3687e720177ab28564a1faab52b6679e9315f74327d02aa1fb31e7b8233a80f

Download Submit
\??\pipe\LOCAL\crashpad_4788_PETPDQWHFQHAFNLK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1532-20-0x0000000006F50000-0x0000000006F51000-memory.dmp

Filesize
4KB

Download
memory/1532-1-0x0000000006D00000-0x0000000006D01000-memory.dmp

Filesize
4KB

Download
memory/1532-18-0x0000000006F40000-0x0000000006F41000-memory.dmp

Filesize
4KB

Download
memory/1532-14-0x0000000006F40000-0x0000000006F41000-memory.dmp

Filesize
4KB

Download
memory/1532-12-0x0000000006F30000-0x0000000006F31000-memory.dmp

Filesize
4KB

Download
memory/1532-22-0x0000000006F50000-0x0000000006F51000-memory.dmp

Filesize
4KB

Download
memory/1532-5-0x0000000006D20000-0x0000000006D21000-memory.dmp

Filesize
4KB

Download
memory/1532-3-0x0000000006D10000-0x0000000006D11000-memory.dmp

Filesize
4KB

Download
memory/1532-0-0x0000000006D00000-0x0000000006D01000-memory.dmp

Filesize
4KB

Download
memory/1532-24-0x0000000006F50000-0x0000000006F51000-memory.dmp

Filesize
4KB

Download