8eb72c8341be372e533736b84d8a7196cde5e28130eadb774c40871fcf0cf7b3

General

Target

HyperFree..exe
Size

5.8MB
MD5

5260c1a254c8af84557b82e195363a98
SHA1

80af1991a492833e039891117fd594d74366545e
SHA256

8eb72c8341be372e533736b84d8a7196cde5e28130eadb774c40871fcf0cf7b3
SHA512

623692226d361a2795f4e5c4c330ec8435170832aa11c2e5336915b36e9340e0a18b27e0c932213e4d22ea05349a962ceb6d75216608680b41c997a75568f02b
SSDEEP

98304:aEO3yMulKYLin3eE7CKG5Ea+k0XhXtFV0lb81vcBnLDCg6yrXA8CcbQh1lAL/dbs:aErts9+xEa+k0elb8hcB/C7yjA8J1O

Score

8^/10

evasion vmprotect

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

HyperFree..exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	HyperFree..exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/2600-134-0x00007FF759860000-0x00007FF75A2E1000-memory.dmp	vmprotect

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
1308	sc.exe
4240	sc.exe
3852	sc.exe
4436	sc.exe
2040	sc.exe
2400	sc.exe
2996	sc.exe
1852	sc.exe
4992	sc.exe
1068	sc.exe
2348	sc.exe
3860	sc.exe
4032	sc.exe
3760	sc.exe
2468	sc.exe
2200	sc.exe
2088	sc.exe
4760	sc.exe
2224	sc.exe
2224	sc.exe
4672	sc.exe
4072	sc.exe
4020	sc.exe
780	sc.exe
1820	sc.exe
428	sc.exe
4208	sc.exe
4820	sc.exe
1164	sc.exe
4200	sc.exe
1908	sc.exe
2868	sc.exe
2156	sc.exe
3768	sc.exe
2232	sc.exe
3240	sc.exe
3380	sc.exe
568	sc.exe
492	sc.exe
1628	sc.exe
4832	sc.exe
4768	sc.exe
2200	sc.exe
2996	sc.exe
1520	sc.exe
1944	sc.exe
2616	sc.exe
1308	sc.exe
2500	sc.exe
5076	sc.exe
4020	sc.exe
3432	sc.exe
1432	sc.exe
3336	sc.exe
1000	sc.exe
5040	sc.exe
3560	sc.exe
724	sc.exe
456	sc.exe
724	sc.exe
4660	sc.exe
4112	sc.exe
1552	sc.exe
4408	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 17 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2588	taskkill.exe
228	taskkill.exe
220	taskkill.exe
756	taskkill.exe
2704	taskkill.exe
1744	taskkill.exe
3404	taskkill.exe
4228	taskkill.exe
4032	taskkill.exe
5016	taskkill.exe
2868	taskkill.exe
4436	taskkill.exe
1068	taskkill.exe
3152	taskkill.exe
3240	taskkill.exe
3080	taskkill.exe
4008	taskkill.exe

Runs net.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

HyperFree..exe

pid process

2600 HyperFree..exe
2600 HyperFree..exe
2600 HyperFree..exe
2600 HyperFree..exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

HyperFree..exe

pid process

2600 HyperFree..exe

pid	process
2600	HyperFree..exe
2600	HyperFree..exe
2600	HyperFree..exe
2600	HyperFree..exe

pid	process
2600	HyperFree..exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2868	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	4436	taskkill.exe
Token: SeDebugPrivilege	1744	taskkill.exe
Token: SeDebugPrivilege	3404	taskkill.exe
Token: SeDebugPrivilege	4228	taskkill.exe
Token: SeDebugPrivilege	1068	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	5016	taskkill.exe
Token: SeDebugPrivilege	3240	taskkill.exe
Token: SeDebugPrivilege	2588	taskkill.exe
Token: SeDebugPrivilege	228	taskkill.exe
Token: SeDebugPrivilege	4032	taskkill.exe
Token: SeDebugPrivilege	3080	taskkill.exe
Token: SeDebugPrivilege	220	taskkill.exe
Token: SeDebugPrivilege	756	taskkill.exe
Token: SeDebugPrivilege	4008	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

HyperFree..execmd.execmd.execmd.exenet.execmd.execmd.exenet.execmd.execmd.exenet.exenet.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2600 wrote to memory of 1304	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 1304	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 3864	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 3864	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 3544	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 3544	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 1664	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 1664	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 4320	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 4320	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 212	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 212	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 4288	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 4288	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 812	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 812	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 1896	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 1896	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 3884	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 3884	2600	HyperFree..exe	cmd.exe
PID 1304 wrote to memory of 1504	1304	cmd.exe	net.exe
PID 1304 wrote to memory of 1504	1304	cmd.exe	net.exe
PID 2600 wrote to memory of 756	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 756	2600	HyperFree..exe	cmd.exe
PID 3864 wrote to memory of 3652	3864	cmd.exe	net.exe
PID 3864 wrote to memory of 3652	3864	cmd.exe	net.exe
PID 3544 wrote to memory of 2244	3544	cmd.exe	net.exe
PID 3544 wrote to memory of 2244	3544	cmd.exe	net.exe
PID 2600 wrote to memory of 5108	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 5108	2600	HyperFree..exe	cmd.exe
PID 1504 wrote to memory of 3528	1504	net.exe	net1.exe
PID 1504 wrote to memory of 3528	1504	net.exe	net1.exe
PID 1664 wrote to memory of 3380	1664	cmd.exe	sc.exe
PID 1664 wrote to memory of 3380	1664	cmd.exe	sc.exe
PID 4320 wrote to memory of 4628	4320	cmd.exe	net.exe
PID 4320 wrote to memory of 4628	4320	cmd.exe	net.exe
PID 3652 wrote to memory of 3572	3652	net.exe	net1.exe
PID 3652 wrote to memory of 3572	3652	net.exe	net1.exe
PID 2600 wrote to memory of 4312	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 4312	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 488	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 488	2600	HyperFree..exe	cmd.exe
PID 212 wrote to memory of 456	212	cmd.exe	sc.exe
PID 212 wrote to memory of 456	212	cmd.exe	sc.exe
PID 3884 wrote to memory of 1068	3884	cmd.exe	sc.exe
PID 3884 wrote to memory of 1068	3884	cmd.exe	sc.exe
PID 4628 wrote to memory of 2960	4628	net.exe	net1.exe
PID 4628 wrote to memory of 2960	4628	net.exe	net1.exe
PID 2600 wrote to memory of 1648	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 1648	2600	HyperFree..exe	cmd.exe
PID 2244 wrote to memory of 2768	2244	net.exe	net1.exe
PID 2244 wrote to memory of 2768	2244	net.exe	net1.exe
PID 2600 wrote to memory of 4584	2600	HyperFree..exe	cmd.exe
PID 2600 wrote to memory of 4584	2600	HyperFree..exe	cmd.exe
PID 4288 wrote to memory of 5076	4288	cmd.exe	sc.exe
PID 4288 wrote to memory of 5076	4288	cmd.exe	sc.exe
PID 488 wrote to memory of 1944	488	cmd.exe	sc.exe
PID 488 wrote to memory of 1944	488	cmd.exe	sc.exe
PID 1896 wrote to memory of 4072	1896	cmd.exe	sc.exe
PID 1896 wrote to memory of 4072	1896	cmd.exe	sc.exe
PID 812 wrote to memory of 4032	812	cmd.exe	sc.exe
PID 812 wrote to memory of 4032	812	cmd.exe	sc.exe
PID 756 wrote to memory of 2200	756	cmd.exe	sc.exe
PID 756 wrote to memory of 2200	756	cmd.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\HyperFree..exe
"C:\Users\Admin\AppData\Local\Temp\HyperFree..exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop FACEIT >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:3528

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop FACEIT >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:3864

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
- Suspicious use of WriteProcessMemory
PID:3652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop ESEADriver2 >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:3544

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop HTTPDebuggerPro >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:3380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop HTTPDebuggerPro >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:456

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop ESEADriver2 >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:4320

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
- Suspicious use of WriteProcessMemory
PID:4628

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:2960

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker3 >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:4032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker3 >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:4288

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:5076

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker2 >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:4072

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker2 >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:3884

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:1068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker1 >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:2200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:5108

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:2088

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop wireshark >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:488

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:1944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop npf >nul 2>&1
2⤵
PID:1648

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:4768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop npf >nul 2>&1
2⤵
PID:4584

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:2996

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop wireshark >nul 2>&1
2⤵
PID:4312

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:4020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
2⤵
PID:4876

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
2⤵
PID:3788

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:4000

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:2400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
2⤵
PID:1308

C:\Windows\system32\taskkill.exe
taskkill /IM HTTPDebuggerSvc.exe /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
2⤵
PID:3696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile C:\Users\Admin\AppData\Local\Temp\HyperFree..exe MD5 >> C:\ProgramData\hash.txt
2⤵
PID:1980

C:\Windows\system32\certutil.exe
certutil -hashfile C:\Users\Admin\AppData\Local\Temp\HyperFree..exe MD5
3⤵
PID:3560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
2⤵
PID:1020

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
2⤵
PID:3660

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:2592

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
PID:216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
2⤵
PID:2072

C:\Windows\system32\taskkill.exe
taskkill /IM HTTPDebuggerSvc.exe /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
2⤵
PID:1352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
2⤵
PID:4532

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
2⤵
PID:3824

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:1952

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:4760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
2⤵
PID:4608

C:\Windows\system32\taskkill.exe
taskkill /IM HTTPDebuggerSvc.exe /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
2⤵
PID:4628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:3992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop FACEIT >nul 2>&1
2⤵
PID:1080

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
PID:1400

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:1904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop ESEADriver2 >nul 2>&1
2⤵
PID:2172

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
PID:4208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:1628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:4296

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:2224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:1776

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:3768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:2084

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:3432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:3232

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:2996

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop wireshark >nul 2>&1
2⤵
PID:1760

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:1552

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop npf >nul 2>&1
2⤵
PID:3732

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:2232

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop FACEIT >nul 2>&1
2⤵
PID:1296

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
PID:2704

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:3292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop ESEADriver2 >nul 2>&1
2⤵
PID:2392

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
PID:1860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:2680

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:3172

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:4112

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:2564

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
PID:4240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:4660

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:4436

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
PID:3244

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop wireshark >nul 2>&1
2⤵
PID:3560

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
PID:2420

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop npf >nul 2>&1
2⤵
PID:4708

C:\Windows\system32\sc.exe
sc stop npf
3⤵
PID:1352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:1380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop FACEIT >nul 2>&1
2⤵
PID:3892

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
PID:1628

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:2116

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:2164

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:3240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop ESEADriver2 >nul 2>&1
2⤵
PID:3544

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
PID:4768

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:1188

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:1400

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:2200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:4060

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:2616

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:180

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:1908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop wireshark >nul 2>&1
2⤵
PID:3176

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:4020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop npf >nul 2>&1
2⤵
PID:4928

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:2348

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop FACEIT >nul 2>&1
2⤵
PID:1520

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
PID:4000

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:3064

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop ESEADriver2 >nul 2>&1
2⤵
PID:3800

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
PID:460

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:1288

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:3204

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
PID:3980

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:4584

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:4660

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:1980

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:1308

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:4884

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop wireshark >nul 2>&1
2⤵
PID:4300

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:4820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:1644

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop npf >nul 2>&1
2⤵
PID:5040

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:1164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:4064

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop FACEIT >nul 2>&1
2⤵
PID:3372

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
PID:1840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:2612

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop ESEADriver2 >nul 2>&1
2⤵
PID:1832

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
PID:4792

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:4992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:4532

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:1552

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:3080

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:3336

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:2996

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:4408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:1652

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:1852

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop wireshark >nul 2>&1
2⤵
PID:1648

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:1000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop npf >nul 2>&1
2⤵
PID:4088

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:3760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop FACEIT >nul 2>&1
2⤵
PID:2084

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
PID:1844

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:348

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop ESEADriver2 >nul 2>&1
2⤵
PID:1368

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
PID:4272

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:3996

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:1860

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:4200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:2424

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:1308

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:5112

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:4240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:2144

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:3860

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop wireshark >nul 2>&1
2⤵
PID:952

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:5040

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop npf >nul 2>&1
2⤵
PID:724

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:1820

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop FACEIT >nul 2>&1
2⤵
PID:4056

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
PID:4052

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:3380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop ESEADriver2 >nul 2>&1
2⤵
PID:1020

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
PID:4064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:4504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:3172

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:4992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:1432

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
PID:2200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:3180

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:1628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:3840

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:2500

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop wireshark >nul 2>&1
2⤵
PID:3296

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop npf >nul 2>&1
2⤵
PID:3436

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:2224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop FACEIT >nul 2>&1
2⤵
PID:3896

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
PID:1656

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:4200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop ESEADriver2 >nul 2>&1
2⤵
PID:2976

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
PID:5108

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:2348

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:3224

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:3852

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:2836

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:4832

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:3704

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:4436

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:1300

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:1520

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop wireshark >nul 2>&1
2⤵
PID:4808

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
PID:4884

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop npf >nul 2>&1
2⤵
PID:4620

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1368

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:3560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop FACEIT >nul 2>&1
2⤵
PID:4624

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
PID:4360

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:3836

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop ESEADriver2 >nul 2>&1
2⤵
PID:1292

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
PID:4052

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:1856

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:3732

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:1432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:2124

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:2040

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:2152

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
PID:2564

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:4112

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:4672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop wireshark >nul 2>&1
2⤵
PID:4708

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:2868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc stop npf >nul 2>&1
2⤵
PID:3500

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:2156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
2⤵
PID:2764

C:\Windows\system32\taskkill.exe
taskkill /f /im EpicGamesLauncher.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
2⤵
PID:4652

C:\Windows\system32\taskkill.exe
taskkill /f /im FortniteClient-Win64-Shipping.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /IM EpicGamesLauncher.exe
2⤵
PID:2996

C:\Windows\system32\taskkill.exe
taskkill /F /IM EpicGamesLauncher.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /IM EasyAntiCheatLauncher.exe
2⤵
PID:1896

C:\Windows\system32\taskkill.exe
taskkill /F /IM EasyAntiCheatLauncher.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /IM BEService.exe
2⤵
PID:2188

C:\Windows\system32\taskkill.exe
taskkill /F /IM BEService.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /IM BattleEyeLauncher.exe
2⤵
PID:2348

C:\Windows\system32\taskkill.exe
taskkill /F /IM BattleEyeLauncher.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:220

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /IM FortniteClient-Win64-Shipping.exe
2⤵
PID:1244

C:\Windows\system32\taskkill.exe
taskkill /F /IM FortniteClient-Win64-Shipping.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheat >nul 2>&1
2⤵
PID:4212

C:\Windows\system32\sc.exe
sc stop EasyAntiCheat
3⤵
- Launches sc.exe
PID:428

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /IM FortniteLauncher.exe
2⤵
PID:2120

C:\Windows\system32\taskkill.exe
taskkill /F /IM FortniteLauncher.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheatSys >nul 2>&1
2⤵
PID:1484

C:\Windows\system32\sc.exe
sc stop EasyAntiCheatSys
3⤵
- Launches sc.exe
PID:2468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop BEService >nul 2>&1
2⤵
PID:1688

C:\Windows\system32\sc.exe
sc stop BEService
3⤵
- Launches sc.exe
PID:4208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop BEDaisy >nul 2>&1
2⤵
PID:1296

C:\Windows\system32\sc.exe
sc stop BEDaisy
3⤵
- Launches sc.exe
PID:724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:2060

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
1⤵
PID:2768

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
1⤵
PID:3572

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\hash.txt
Filesize
150B

MD5
efa647c18cb7535b6f3faaa5bf163c7d

SHA1
665550ff2eca0b35c289382e9edda66547861608

SHA256
2a902287e15e496c4d5726c6fcfedc58d50c92a9dfc8f2ad5b0f1e275310210a

SHA512
6c03b273afd12eccca29f2b3a4525b220ee2e51145d344763a07a5da9d33b232c86d481124d5135fda7bc6dc5446fcf777d0074ae9b6039b302e78ba6a1d8bd7

Download Submit
memory/2600-133-0x00007FFAE3AF0000-0x00007FFAE3AF2000-memory.dmp

Filesize
8KB

Download
memory/2600-134-0x00007FF759860000-0x00007FF75A2E1000-memory.dmp

Filesize
10.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads