2f3214f799b0f0a2f3955dbdc64c7e7c0e216f1a09d2c1ad5d0a99921782e363

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-uk
resource tags

arch:x64arch:x86image:win11-20260513-uklocale:uk-uaos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cheat Engine/windowsrepair.exe
Size 262KB
Sample260702-rydfaads5m
SHA256 2f3214f799b0f0a2f3955dbdc64c7e7c0e216f1a09d2c1ad5d0a99921782e363
MD5 9a4d1b5154194ea0c42efebeb73f318f
SHA1 220f8af8b91d3c7b64140cbb5d9337d7ed277edb
SHA512 6eef3254fc24079751fc8c38dda9a8e44840e5a4df1ff5adf076e4be87127075a7fea59ba7ef9b901aaf10eb64f881fc8fb306c2625140169665dd3991e5c25b
SSDEEP 6144:0drkqKo/nt7PrwnoK0M6EZgugEkkoSE5O7Z3LLr:6rkm9mP6EZgugEnoSE5OB
TLSH
T167446D56AA13C37BC5837EF84BC486F157B1EA142D3590DB32C60B2E6A75FE02F25219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsrepair.exe

C:\Users\Admin\AppData\Local\Temp\Cheat Engine\windowsrepair.exe
"C:\Users\Admin\AppData\Local\Temp\Cheat Engine\windowsrepair.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads