quasar | 7ce9d2b8f4a344b07a8e3b9bf58ede5a2ba7a85bfa94d8b103179183fbb7c24f

Analysis

max time kernel
1042s
max time network
1042s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
15-12-2024 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fortnite cloud.exe
Size

3.1MB
MD5

a39f29a2f774febb2c532577de2f407c
SHA1

bf97e76565ae9a78f33601c154e97ef9e2631430
SHA256

7ce9d2b8f4a344b07a8e3b9bf58ede5a2ba7a85bfa94d8b103179183fbb7c24f
SHA512

ca28aa66f392356e19d3fb43327ffb9cf1aae0777c8fcdc3530b02f50b50a0347a12db76f90717c51355f8c25de020a989b722c231a14f0995b7e149303a4fa0
SSDEEP

49152:KvYt62XlaSFNWPjljiFa2RoUYIy6jrcFGnoGdoXuTHHB72eh2NT:Kv062XlaSFNWPjljiFXRoUYIy6HcFKo

Score

10^/10

quasar fortnite cloud discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

fortnite cloud

roham:9999

Mutex

34f9808a-f860-420a-9060-bdcca871577f

Attributes

encryption_key
C98F5FD72C77D3C38A5C7ECBED91435EDD8177FE
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
fortnite updater cloud
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/2956-1-0x0000000000910000-0x0000000000C34000-memory.dmp	family_quasar
behavioral1/files/0x001c00000002aa9e-6.dat	family_quasar

Executes dropped EXE 64 IoCs

pid	Process
4956	Client.exe
3068	Client.exe
4856	Client.exe
3340	Client.exe
2428	Client.exe
3668	Client.exe
3664	Client.exe
4872	Client.exe
692	Client.exe
4032	Client.exe
3712	Client.exe
2704	Client.exe
3084	Client.exe
3976	Client.exe
4776	Client.exe
2124	Client.exe
1252	Client.exe
4324	Client.exe
2448	Client.exe
2184	Client.exe
4656	Client.exe
2436	Client.exe
804	Client.exe
2112	Client.exe
3664	Client.exe
2248	Client.exe
4856	Client.exe
4840	Client.exe
3488	Client.exe
4536	Client.exe
3448	Client.exe
1720	Client.exe
3680	Client.exe
4180	Client.exe
1436	Client.exe
2644	Client.exe
2044	Client.exe
4028	Client.exe
3592	Client.exe
1480	Client.exe
4228	Client.exe
4248	Client.exe
3856	Client.exe
2572	Client.exe
3212	Client.exe
2888	Client.exe
1824	Client.exe
1736	Client.exe
3788	Client.exe
4992	Client.exe
2080	Client.exe
4228	Client.exe
352	Client.exe
2964	Client.exe
4372	Client.exe
3228	Client.exe
3824	Client.exe
4968	Client.exe
3376	Client.exe
1188	Client.exe
4036	Client.exe
2748	Client.exe
1732	Client.exe
3972	Client.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File created	C:\Windows\system32\SubDir\Client.exe	fortnite cloud.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	fortnite cloud.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1336	PING.EXE
1564	PING.EXE
4344	PING.EXE
4164	PING.EXE
1832	PING.EXE
3312	PING.EXE
1692	PING.EXE
2868	PING.EXE
2952	PING.EXE
3892	PING.EXE
2184	PING.EXE
4892	PING.EXE
1188	PING.EXE
2660	PING.EXE
656	PING.EXE
3500	PING.EXE
1064	PING.EXE
3088	PING.EXE
960	PING.EXE
4260	PING.EXE
4864	PING.EXE
4248	PING.EXE
4228	PING.EXE
4832	PING.EXE
1968	PING.EXE
1144	PING.EXE
4908	PING.EXE
3208	PING.EXE
4124	PING.EXE
2868	PING.EXE
3680	PING.EXE
4456	PING.EXE
1076	PING.EXE
232	PING.EXE
2572	PING.EXE
1720	PING.EXE
4948	PING.EXE
3052	PING.EXE
1544	PING.EXE
4200	PING.EXE
3180	PING.EXE
2932	PING.EXE
4828	PING.EXE
968	PING.EXE
5100	PING.EXE
3932	PING.EXE
3200	PING.EXE
2852	PING.EXE
4468	PING.EXE
2376	PING.EXE
4808	PING.EXE
1784	PING.EXE
72	PING.EXE
1964	PING.EXE
1032	PING.EXE
3940	PING.EXE
4696	PING.EXE
4556	PING.EXE
4032	PING.EXE
2928	PING.EXE
3968	PING.EXE
1936	PING.EXE
4944	PING.EXE
3316	PING.EXE

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
1964	PING.EXE
4080	PING.EXE
3932	PING.EXE
4892	PING.EXE
4456	PING.EXE
2932	PING.EXE
3312	PING.EXE
3436	PING.EXE
3680	PING.EXE
1188	PING.EXE
2148	PING.EXE
3208	PING.EXE
3500	PING.EXE
2376	PING.EXE
2868	PING.EXE
4228	PING.EXE
4084	PING.EXE
1784	PING.EXE
4260	PING.EXE
4248	PING.EXE
72	PING.EXE
576	PING.EXE
1436	PING.EXE
3200	PING.EXE
1072	PING.EXE
4828	PING.EXE
968	PING.EXE
4324	PING.EXE
2520	PING.EXE
1832	PING.EXE
5100	PING.EXE
4468	PING.EXE
3484	PING.EXE
960	PING.EXE
4944	PING.EXE
4696	PING.EXE
3964	PING.EXE
2952	PING.EXE
3940	PING.EXE
656	PING.EXE
3052	PING.EXE
1720	PING.EXE
2868	PING.EXE
4200	PING.EXE
3088	PING.EXE
3892	PING.EXE
1144	PING.EXE
1564	PING.EXE
3412	PING.EXE
232	PING.EXE
4164	PING.EXE
4556	PING.EXE
4032	PING.EXE
1064	PING.EXE
3968	PING.EXE
2572	PING.EXE
3316	PING.EXE
1968	PING.EXE
4948	PING.EXE
1032	PING.EXE
1544	PING.EXE
2928	PING.EXE
1336	PING.EXE
1076	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4608	schtasks.exe
1300	schtasks.exe
3672	schtasks.exe
4648	schtasks.exe
1568	schtasks.exe
3936	schtasks.exe
1220	schtasks.exe
2976	schtasks.exe
2124	schtasks.exe
2740	schtasks.exe
2564	schtasks.exe
2180	schtasks.exe
4236	schtasks.exe
2556	schtasks.exe
3260	schtasks.exe
2148	schtasks.exe
1512	schtasks.exe
3992	schtasks.exe
1980	schtasks.exe
660	schtasks.exe
2608	schtasks.exe
2460	schtasks.exe
3992	schtasks.exe
3164	schtasks.exe
3912	schtasks.exe
4620	schtasks.exe
2588	schtasks.exe
2336	schtasks.exe
5024	schtasks.exe
1480	schtasks.exe
3340	schtasks.exe
1036	schtasks.exe
2052	schtasks.exe
4460	schtasks.exe
3664	schtasks.exe
1768	schtasks.exe
2772	schtasks.exe
4320	schtasks.exe
3240	schtasks.exe
1956	schtasks.exe
1188	schtasks.exe
1280	schtasks.exe
4112	schtasks.exe
1856	schtasks.exe
1604	schtasks.exe
2088	schtasks.exe
4200	schtasks.exe
2144	schtasks.exe
4036	schtasks.exe
3668	schtasks.exe
3068	schtasks.exe
4036	schtasks.exe
4608	schtasks.exe
3964	schtasks.exe
2892	schtasks.exe
1804	schtasks.exe
4556	schtasks.exe
4816	schtasks.exe
4336	schtasks.exe
2928	schtasks.exe
3456	schtasks.exe
3596	schtasks.exe
3196	schtasks.exe
4752	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	fortnite cloud.exe
Token: SeDebugPrivilege	4956	Client.exe
Token: SeDebugPrivilege	3068	Client.exe
Token: SeDebugPrivilege	4856	Client.exe
Token: SeDebugPrivilege	3340	Client.exe
Token: SeDebugPrivilege	2428	Client.exe
Token: SeDebugPrivilege	3668	Client.exe
Token: SeDebugPrivilege	3664	Client.exe
Token: SeDebugPrivilege	692	Client.exe
Token: SeDebugPrivilege	4032	Client.exe
Token: SeDebugPrivilege	3712	Client.exe
Token: SeDebugPrivilege	2704	Client.exe
Token: SeDebugPrivilege	3084	Client.exe
Token: SeDebugPrivilege	3976	Client.exe
Token: SeDebugPrivilege	4776	Client.exe
Token: SeDebugPrivilege	2124	Client.exe
Token: SeDebugPrivilege	1252	Client.exe
Token: SeDebugPrivilege	4324	Client.exe
Token: SeDebugPrivilege	2448	Client.exe
Token: SeDebugPrivilege	2184	Client.exe
Token: SeDebugPrivilege	4656	Client.exe
Token: SeDebugPrivilege	2436	Client.exe
Token: SeDebugPrivilege	804	Client.exe
Token: SeDebugPrivilege	2112	Client.exe
Token: SeDebugPrivilege	3664	Client.exe
Token: SeDebugPrivilege	2248	Client.exe
Token: SeDebugPrivilege	4856	Client.exe
Token: SeDebugPrivilege	4840	Client.exe
Token: SeDebugPrivilege	3488	Client.exe
Token: SeDebugPrivilege	4536	Client.exe
Token: SeDebugPrivilege	3448	Client.exe
Token: SeDebugPrivilege	1720	Client.exe
Token: SeDebugPrivilege	3680	Client.exe
Token: SeDebugPrivilege	4180	Client.exe
Token: SeDebugPrivilege	1436	Client.exe
Token: SeDebugPrivilege	2644	Client.exe
Token: SeDebugPrivilege	2044	Client.exe
Token: SeDebugPrivilege	4028	Client.exe
Token: SeDebugPrivilege	3592	Client.exe
Token: SeDebugPrivilege	1480	Client.exe
Token: SeDebugPrivilege	4228	Client.exe
Token: SeDebugPrivilege	4248	Client.exe
Token: SeDebugPrivilege	3856	Client.exe
Token: SeDebugPrivilege	2572	Client.exe
Token: SeDebugPrivilege	3212	Client.exe
Token: SeDebugPrivilege	2888	Client.exe
Token: SeDebugPrivilege	1824	Client.exe
Token: SeDebugPrivilege	1736	Client.exe
Token: SeDebugPrivilege	3788	Client.exe
Token: SeDebugPrivilege	4992	Client.exe
Token: SeDebugPrivilege	2080	Client.exe
Token: SeDebugPrivilege	4228	Client.exe
Token: SeDebugPrivilege	352	Client.exe
Token: SeDebugPrivilege	2964	Client.exe
Token: SeDebugPrivilege	4372	Client.exe
Token: SeDebugPrivilege	3228	Client.exe
Token: SeDebugPrivilege	3824	Client.exe
Token: SeDebugPrivilege	4968	Client.exe
Token: SeDebugPrivilege	3376	Client.exe
Token: SeDebugPrivilege	1188	Client.exe
Token: SeDebugPrivilege	4036	Client.exe
Token: SeDebugPrivilege	2748	Client.exe
Token: SeDebugPrivilege	1732	Client.exe
Token: SeDebugPrivilege	3972	Client.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4956	Client.exe
3068	Client.exe
4856	Client.exe
3340	Client.exe
2428	Client.exe
3668	Client.exe
3664	Client.exe
692	Client.exe
4032	Client.exe
3712	Client.exe
2704	Client.exe
3084	Client.exe
3976	Client.exe
4776	Client.exe
2124	Client.exe
1252	Client.exe
4324	Client.exe
2448	Client.exe
2184	Client.exe
4656	Client.exe
2436	Client.exe
804	Client.exe
2112	Client.exe
3664	Client.exe
2248	Client.exe
4856	Client.exe
4840	Client.exe
3488	Client.exe
4536	Client.exe
3448	Client.exe
1720	Client.exe
3680	Client.exe
4180	Client.exe
1436	Client.exe
2644	Client.exe
2044	Client.exe
4028	Client.exe
3592	Client.exe
1480	Client.exe
4228	Client.exe
4248	Client.exe
3856	Client.exe
2572	Client.exe
3212	Client.exe
2888	Client.exe
1824	Client.exe
1736	Client.exe
3788	Client.exe
4992	Client.exe
2080	Client.exe
4228	Client.exe
352	Client.exe
2964	Client.exe
4372	Client.exe
3228	Client.exe
3824	Client.exe
4968	Client.exe
3376	Client.exe
1188	Client.exe
4036	Client.exe
2748	Client.exe
1732	Client.exe
3972	Client.exe
2912	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1856	2956	fortnite cloud.exe	77
PID 2956 wrote to memory of 1856	2956	fortnite cloud.exe	77
PID 2956 wrote to memory of 4956	2956	fortnite cloud.exe	79
PID 2956 wrote to memory of 4956	2956	fortnite cloud.exe	79
PID 4956 wrote to memory of 1568	4956	Client.exe	80
PID 4956 wrote to memory of 1568	4956	Client.exe	80
PID 4956 wrote to memory of 2204	4956	Client.exe	82
PID 4956 wrote to memory of 2204	4956	Client.exe	82
PID 2204 wrote to memory of 1140	2204	cmd.exe	84
PID 2204 wrote to memory of 1140	2204	cmd.exe	84
PID 2204 wrote to memory of 2988	2204	cmd.exe	85
PID 2204 wrote to memory of 2988	2204	cmd.exe	85
PID 2204 wrote to memory of 3068	2204	cmd.exe	86
PID 2204 wrote to memory of 3068	2204	cmd.exe	86
PID 3068 wrote to memory of 3164	3068	Client.exe	87
PID 3068 wrote to memory of 3164	3068	Client.exe	87
PID 3068 wrote to memory of 3508	3068	Client.exe	89
PID 3068 wrote to memory of 3508	3068	Client.exe	89
PID 3508 wrote to memory of 3504	3508	cmd.exe	91
PID 3508 wrote to memory of 3504	3508	cmd.exe	91
PID 3508 wrote to memory of 3940	3508	cmd.exe	92
PID 3508 wrote to memory of 3940	3508	cmd.exe	92
PID 3508 wrote to memory of 4856	3508	cmd.exe	93
PID 3508 wrote to memory of 4856	3508	cmd.exe	93
PID 4856 wrote to memory of 4196	4856	Client.exe	94
PID 4856 wrote to memory of 4196	4856	Client.exe	94
PID 4856 wrote to memory of 4464	4856	Client.exe	96
PID 4856 wrote to memory of 4464	4856	Client.exe	96
PID 4464 wrote to memory of 928	4464	cmd.exe	98
PID 4464 wrote to memory of 928	4464	cmd.exe	98
PID 4464 wrote to memory of 1144	4464	cmd.exe	99
PID 4464 wrote to memory of 1144	4464	cmd.exe	99
PID 4464 wrote to memory of 3340	4464	cmd.exe	100
PID 4464 wrote to memory of 3340	4464	cmd.exe	100
PID 3340 wrote to memory of 1512	3340	Client.exe	101
PID 3340 wrote to memory of 1512	3340	Client.exe	101
PID 3340 wrote to memory of 3852	3340	Client.exe	103
PID 3340 wrote to memory of 3852	3340	Client.exe	103
PID 3852 wrote to memory of 2192	3852	cmd.exe	105
PID 3852 wrote to memory of 2192	3852	cmd.exe	105
PID 3852 wrote to memory of 960	3852	cmd.exe	106
PID 3852 wrote to memory of 960	3852	cmd.exe	106
PID 3852 wrote to memory of 2428	3852	cmd.exe	107
PID 3852 wrote to memory of 2428	3852	cmd.exe	107
PID 2428 wrote to memory of 2740	2428	Client.exe	108
PID 2428 wrote to memory of 2740	2428	Client.exe	108
PID 2428 wrote to memory of 1732	2428	Client.exe	110
PID 2428 wrote to memory of 1732	2428	Client.exe	110
PID 1732 wrote to memory of 656	1732	cmd.exe	112
PID 1732 wrote to memory of 656	1732	cmd.exe	112
PID 1732 wrote to memory of 4892	1732	cmd.exe	113
PID 1732 wrote to memory of 4892	1732	cmd.exe	113
PID 1732 wrote to memory of 3668	1732	cmd.exe	114
PID 1732 wrote to memory of 3668	1732	cmd.exe	114
PID 3668 wrote to memory of 5024	3668	Client.exe	115
PID 3668 wrote to memory of 5024	3668	Client.exe	115
PID 3668 wrote to memory of 3248	3668	Client.exe	117
PID 3668 wrote to memory of 3248	3668	Client.exe	117
PID 3248 wrote to memory of 4580	3248	cmd.exe	119
PID 3248 wrote to memory of 4580	3248	cmd.exe	119
PID 3248 wrote to memory of 4908	3248	cmd.exe	120
PID 3248 wrote to memory of 4908	3248	cmd.exe	120
PID 3248 wrote to memory of 3664	3248	cmd.exe	121
PID 3248 wrote to memory of 3664	3248	cmd.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fortnite cloud.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite cloud.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1856
- C:\Windows\system32\SubDir\Client.exe
  "C:\Windows\system32\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3xZwkuI4cAVS.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1140
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      PID:2988
  - - C:\Windows\system32\SubDir\Client.exe
      "C:\Windows\system32\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xIk6yc5TAjiO.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3508
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3504
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3940
      - C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        
        PID:4196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AZhyBYODJmgN.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:928
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1144
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\U0JcDSEtRBr0.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2192
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:960
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6gabA67sGpvV.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:656
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4892
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IEtvkYZLT9Uc.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4580
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4908
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3664
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f1ZfYS1WcXJz.bat" "
        15⤵
        
        PID:5052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3044
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4944
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        16⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0QX9AGy7CtSV.bat" "
        17⤵
        
        PID:2376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4368
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        
        PID:1472
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:692
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AfC5jxYeqd76.bat" "
        19⤵
        
        PID:1348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1336
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4032
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\X4kvbGTBNHjm.bat" "
        21⤵
        
        PID:3488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2848
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        
        PID:2968
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3712
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        
        PID:2228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YjgAI349CVz2.bat" "
        23⤵
        
        PID:1480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4196
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1564
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BstFW15UuWPR.bat" "
        25⤵
        
        PID:3472
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2280
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        Runs ping.exe
        
        PID:3412
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3084
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\h9eCBc11ZfoI.bat" "
        27⤵
        
        PID:2888
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2452
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3680
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3976
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        
        PID:2516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aYSnhOgRcDps.bat" "
        29⤵
        
        PID:2076
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:1728
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        
        PID:1804
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4776
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iW96s9nTZ072.bat" "
        31⤵
        
        PID:5004
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2016
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4696
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        33⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FBl7JUFfhv5R.bat" "
        33⤵
        
        PID:3564
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        34⤵
        
        PID:4500
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        34⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4456
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1252
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        35⤵
        
        PID:4320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\J5RDG4yoSTLA.bat" "
        35⤵
        
        PID:2956
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        36⤵
        
        PID:1968
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        36⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2868
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4324
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        37⤵
        
        PID:4952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uQzPRRgjNGOk.bat" "
        37⤵
        
        PID:4284
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        38⤵
        
        PID:976
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        38⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:232
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        38⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        39⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TslBSiRhnTin.bat" "
        39⤵
        
        PID:3220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        40⤵
        
        PID:848
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        40⤵
        Runs ping.exe
        
        PID:3964
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2184
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        41⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1WTsWIF1jiww.bat" "
        41⤵
        
        PID:3304
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        42⤵
        
        PID:2344
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        42⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1076
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        42⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4656
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        43⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EHP7zW9m8ijA.bat" "
        43⤵
        
        PID:3292
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        44⤵
        
        PID:5028
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        44⤵
        
        PID:2808
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2436
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        45⤵
        
        PID:4448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jj56icvdV8nc.bat" "
        45⤵
        
        PID:3680
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        46⤵
        
        PID:4340
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        46⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3200
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        46⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:804
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        47⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\taavowrYA3PJ.bat" "
        47⤵
        
        PID:3836
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        48⤵
        
        PID:1344
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        48⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2572
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2112
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        49⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ReS8OnG9ydnC.bat" "
        49⤵
        
        PID:4316
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        50⤵
        
        PID:5104
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        50⤵
        Runs ping.exe
        
        PID:2520
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3664
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        51⤵
        
        PID:3500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ahEeS7xuYStH.bat" "
        51⤵
        
        PID:4456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        52⤵
        
        PID:3628
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        52⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4344
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2248
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        53⤵
        
        PID:3240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XBSbSHZvmhyr.bat" "
        53⤵
        
        PID:1256
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        54⤵
        
        PID:2472
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        54⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1784
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        54⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4856
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        55⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GSrc4G4WX7T7.bat" "
        55⤵
        
        PID:2496
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        56⤵
        
        PID:3776
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        56⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4260
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4840
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        57⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XrxzAbWhYg1z.bat" "
        57⤵
        
        PID:3952
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        58⤵
        
        PID:4948
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        58⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1188
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3488
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        59⤵
        
        PID:1856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jtVCPnbXVzSw.bat" "
        59⤵
        
        PID:3604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        60⤵
        
        PID:2032
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        60⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4556
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        60⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4536
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        61⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8UkKA67GxBIU.bat" "
        61⤵
        
        PID:3264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        62⤵
        
        PID:1492
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        62⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3208
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3448
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        63⤵
        
        PID:1536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ot3GyOamAtFx.bat" "
        63⤵
        
        PID:3672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        64⤵
        
        PID:656
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        64⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4248
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        64⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1720
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        65⤵
        
        PID:4960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SYpeeGbjcR0u.bat" "
        65⤵
        
        PID:844
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        66⤵
        
        PID:1300
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        66⤵
        Runs ping.exe
        
        PID:1072
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        66⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3680
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        67⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uHAvt2K5XTaX.bat" "
        67⤵
        
        PID:5024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        68⤵
        
        PID:5100
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        68⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2932
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        68⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4180
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        69⤵
        
        PID:4564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WOJ6C1QU45OG.bat" "
        69⤵
        
        PID:4976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        70⤵
        
        PID:104
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        70⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:72
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        70⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1436
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        71⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4JPnQRUtcWJy.bat" "
        71⤵
        
        PID:3664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        72⤵
        
        PID:4736
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        72⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2660
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        72⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2644
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        73⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OIkAABPJkDWM.bat" "
        73⤵
        
        PID:3556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        74⤵
        
        PID:4552
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        74⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3316
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        74⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2044
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        75⤵
        
        PID:3524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\akRvkDTWHIrh.bat" "
        75⤵
        
        PID:2956
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        76⤵
        
        PID:1160
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        76⤵
        
        PID:464
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        76⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4028
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        77⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msAkvgX7JghF.bat" "
        77⤵
        
        PID:3516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        78⤵
        
        PID:3788
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        78⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4032
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        78⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3592
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        79⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aF3OSoLb0Kq5.bat" "
        79⤵
        
        PID:3220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        80⤵
        
        PID:3964
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        80⤵
        
        PID:1184
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        80⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1480
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        81⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EjXGYb373eRI.bat" "
        81⤵
        
        PID:868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        82⤵
        
        PID:4752
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        82⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4124
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        82⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4228
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        83⤵
        
        PID:3108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Og47rZFHCYNO.bat" "
        83⤵
        
        PID:2628
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        84⤵
        
        PID:3448
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        84⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:656
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        84⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4248
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        85⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TsEup56blCXb.bat" "
        85⤵
        
        PID:4980
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        86⤵
        
        PID:3216
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        86⤵
        Runs ping.exe
        
        PID:576
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        86⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3856
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        87⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XhlKnb6rbecn.bat" "
        87⤵
        
        PID:2508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        88⤵
        
        PID:4176
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        88⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1964
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        88⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        89⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A5JFShoFnl50.bat" "
        89⤵
        
        PID:3020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        90⤵
        
        PID:496
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        90⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1032
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        90⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3212
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        91⤵
        
        PID:572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Y50EElVM0AZr.bat" "
        91⤵
        
        PID:3772
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        92⤵
        
        PID:436
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        92⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3500
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        92⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2888
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        93⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wfnrAzR2A0Nl.bat" "
        93⤵
        
        PID:2712
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        94⤵
        
        PID:2248
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        94⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4164
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        94⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1824
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        95⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CFEUJW42A8SV.bat" "
        95⤵
        
        PID:1180
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        96⤵
        
        PID:1768
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        96⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4828
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        96⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1736
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        97⤵
        
        PID:2724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pHLc1uazkjbX.bat" "
        97⤵
        
        PID:4024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        98⤵
        
        PID:4844
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        98⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3052
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        98⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3788
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        99⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jKRtYomiv3yW.bat" "
        99⤵
        
        PID:3508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        100⤵
        
        PID:3952
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        100⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1832
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        100⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4992
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        101⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b9YYqFPCoT6C.bat" "
        101⤵
        
        PID:4520
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        102⤵
        
        PID:1688
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        102⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1544
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        102⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2080
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        103⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tjmT90a1qTOB.bat" "
        103⤵
        
        PID:4052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        104⤵
        
        PID:1112
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        104⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2852
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        104⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4228
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        105⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BTysTtFLpokz.bat" "
        105⤵
        
        PID:4448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        106⤵
        
        PID:1732
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        106⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4200
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        106⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:352
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        107⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3tZSg3KC98Se.bat" "
        107⤵
        
        PID:1132
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        108⤵
        
        PID:3972
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        108⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2928
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        108⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2964
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        109⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eyFJwp8sY9gA.bat" "
        109⤵
        
        PID:1964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        110⤵
        
        PID:3648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        110⤵
        Runs ping.exe
        
        PID:4080
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        110⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4372
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        111⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Zro2OjkCfSJm.bat" "
        111⤵
        
        PID:4708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        112⤵
        
        PID:2460
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        112⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2952
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        112⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3228
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        113⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EqjeufzTh07G.bat" "
        113⤵
        
        PID:4500
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        114⤵
        
        PID:3664
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        114⤵
        Runs ping.exe
        
        PID:2148
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        114⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3824
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        115⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MAw2mA0fD9lN.bat" "
        115⤵
        
        PID:4164
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        116⤵
        
        PID:5020
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        116⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3180
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        116⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4968
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        117⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\W7Yv6ErmNYZI.bat" "
        117⤵
        
        PID:2368
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        118⤵
        
        PID:2200
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        118⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1064
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        118⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3376
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        119⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cCNBMx0JfvyJ.bat" "
        119⤵
        
        PID:4220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        120⤵
        
        PID:4512
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        120⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4864
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        120⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1188
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        121⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PfXWFhqOKNLx.bat" "
        121⤵
        
        PID:3964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        122⤵
        
        PID:1592
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        122⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3312
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        122⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4036
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        123⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cDnTuz5Wg4CE.bat" "
        123⤵
        
        PID:580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        124⤵
        
        PID:4752
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        124⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:968
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        124⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        125⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CIAb0U91W5YL.bat" "
        125⤵
        
        PID:2412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        126⤵
        
        PID:2136
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        126⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4228
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        126⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        127⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ir9k9H0t7WzC.bat" "
        127⤵
        
        PID:1868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        128⤵
        
        PID:3584
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        128⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1692
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        128⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3972
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        129⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\O3Qjk44NwLm7.bat" "
        129⤵
        
        PID:3168
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        130⤵
        
        PID:3544
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        130⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4468
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        130⤵
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        131⤵
        
        PID:3728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\38aXef9UUYZn.bat" "
        131⤵
        
        PID:3932
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        132⤵
        
        PID:780
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        132⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5100
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        132⤵
        Drops file in System32 directory
        
        PID:4180
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        133⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VAOQRCrkEocl.bat" "
        133⤵
        
        PID:4928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        134⤵
        
        PID:1492
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        134⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3088
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        134⤵
        Drops file in System32 directory
        
        PID:3228
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        135⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\M86ENQwAfezM.bat" "
        135⤵
        
        PID:2512
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        136⤵
        
        PID:2752
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        136⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2376
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        136⤵
        Drops file in System32 directory
        
        PID:3824
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        137⤵
        
        PID:2556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZM7X1dHB4LL.bat" "
        137⤵
        
        PID:1028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        138⤵
        
        PID:3680
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        138⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3968
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        138⤵
        Drops file in System32 directory
        
        PID:692
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        139⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KFVBosKq7bMg.bat" "
        139⤵
        
        PID:4844
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        140⤵
        
        PID:1568
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        140⤵
        Runs ping.exe
        
        PID:4324
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        140⤵
        Drops file in System32 directory
        
        PID:3300
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        141⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\svSB3GPHD2mx.bat" "
        141⤵
        
        PID:3124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        142⤵
        
        PID:220
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        142⤵
        Runs ping.exe
        
        PID:3484
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        142⤵
        
        PID:3032
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        143⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WXuEwl21pzjq.bat" "
        143⤵
        
        PID:2348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        144⤵
        
        PID:4852
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        144⤵
        Runs ping.exe
        
        PID:3436
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        144⤵
        Drops file in System32 directory
        
        PID:3268
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        145⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vxn3sJ9lYNPy.bat" "
        145⤵
        
        PID:3404
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        146⤵
        
        PID:976
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        146⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4832
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        146⤵
        Drops file in System32 directory
        
        PID:2452
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        147⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wz4I7kmJ3c8g.bat" "
        147⤵
        
        PID:4340
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        148⤵
        
        PID:4804
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        148⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1720
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        148⤵
        Drops file in System32 directory
        
        PID:2432
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        149⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\V0CNkhZ8wMld.bat" "
        149⤵
        
        PID:5044
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        150⤵
        
        PID:2892
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        150⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4808
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        150⤵
        Drops file in System32 directory
        
        PID:4916
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        151⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\T77aibODAEmA.bat" "
        151⤵
        
        PID:4840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        152⤵
        
        PID:3188
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        152⤵
        Runs ping.exe
        
        PID:4084
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        152⤵
        Drops file in System32 directory
        
        PID:1192
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        153⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wBa5HZRsgWbi.bat" "
        153⤵
        
        PID:1404
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        154⤵
        
        PID:432
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        154⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3932
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        154⤵
        Drops file in System32 directory
        
        PID:1528
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        155⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\crQqNWmzuEde.bat" "
        155⤵
        
        PID:4584
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        156⤵
        
        PID:3792
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        156⤵
        Runs ping.exe
        
        PID:1436
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        156⤵
        Drops file in System32 directory
        
        PID:932
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        157⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AYXgsyiLOfmU.bat" "
        157⤵
        
        PID:2752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        158⤵
        
        PID:1256
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        158⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1968
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        158⤵
        Drops file in System32 directory
        
        PID:4192
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        159⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6vIUkDaZ34bJ.bat" "
        159⤵
        
        PID:2988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        160⤵
        
        PID:1784
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        160⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2868
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        160⤵
        Drops file in System32 directory
        
        PID:1476
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        161⤵
        
        PID:796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xbb3h21bzSZB.bat" "
        161⤵
        
        PID:1568
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        162⤵
        
        PID:3716
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        162⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4948
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        162⤵
        Drops file in System32 directory
        
        PID:4864
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        163⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7Psp1qmoEkeM.bat" "
        163⤵
        
        PID:764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        164⤵
        
        PID:3124
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        164⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3892
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        164⤵
        Drops file in System32 directory
        
        PID:3312
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        165⤵
        
        PID:4288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tGhlIa9Tqq2Q.bat" "
        165⤵
        
        PID:4988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        166⤵
        
        PID:196
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        166⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2184
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        166⤵
        Drops file in System32 directory
        
        PID:2612
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fortnite updater cloud" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        167⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HyM34bufcVEh.bat" "
        167⤵
        
        PID:1820
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        168⤵
        
        PID:3076
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        168⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Filesize
2KB

MD5
15eab799098760706ed95d314e75449d

SHA1
273fb07e40148d5c267ca53f958c5075d24c4444

SHA256
45030bd997f50bb52c481f7bc86fac5f375d08911bcc106b98d9d8f0c2ce9778

SHA512
50c125e2a98740db0a0122d7f4de97c50d84623e800b3d3e173049c8e28ff0fbe4add7677bc56cb2228f78ed17522f67ae8f1b85f62824012414ce38ce0b500c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1WTsWIF1jiww.bat

Filesize
196B

MD5
c2cb19195f7186b45f1efd43b3e0265a

SHA1
5d3e89a363d8b3b1b2634c9825e04e0f499abe83

SHA256
e271ddce44160c2408716154f17617a262406825b057f4ed972964b779b02272

SHA512
c2cf318c241c575680fd74e37c09bbc6b09d8a0860098ae250adf078045dcfce23127b0f4613b001bcf7973b1de14800751541890778ad2b185280aa0d68cd7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3xZwkuI4cAVS.bat

Filesize
196B

MD5
ea79c0d67e10135c89e8e4c2fe9c3a58

SHA1
c657c25aa02d289523e8794078b1fd58f056f111

SHA256
8bc112aa77c58a7179dad61bb291ef57c8e22cd83101c1077b6a1b20983f18d9

SHA512
15f81dc3adb730a1e55f8aeecef1ee5c5eefcb00f0d91a229f64f9612285911934a47dc1d552544abd1ce029ff9c242431d308e0d5b78e7e0cfb567f1cb2eed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\6gabA67sGpvV.bat

Filesize
196B

MD5
8a9c296c1c0a556527233923ff7ebed3

SHA1
6e7e849f85b72a8fe2f0286388ce1b277635557f

SHA256
0ddcf57ba902203dc001b9701e0657e6349096ca46af896d5c1345bedf8ad83b

SHA512
bf1dd96c18ede67332aeb5b190fa2e4573ab9c20198414e0b7c66018ab504cf17add7a155fa67da90b408e257471519376f3e8333c8984a29f2206484c023d2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\8UkKA67GxBIU.bat

Filesize
196B

MD5
b24abff8540267ebb07e350c09a62995

SHA1
fea7372d78b83a925e6ebb894cde9806450b0d70

SHA256
640224b45616627821ae40d7fe66e41e5816febca0953ab9047d143e0ab8f952

SHA512
d3a36b6f59fac8963127d81053c8c2a5027c8f6b3e6c7bcdd826c42f82df77447a5dce4ef6aa521d78fa5f58036e013f2b3a28b836cdd78c36795e9ea96a836c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZhyBYODJmgN.bat

Filesize
196B

MD5
04ff54b519926f86e89dd7fc5498fcb8

SHA1
9056f1e42e710c3f7268a0a58c89444264ab1a9c

SHA256
2680b71b4e9fd64f8057881c4b9075f616c9ead03c6cf96cfa14d904fcaebc1d

SHA512
41df17c7a5f1c38fbf1c988f63965f0f8be0e6a1c366cec8599273bae5ec4255408a8801127fd57d19b235ecc9a64adbb4b97eb8e17c0ca0b5270da31ebe52e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\AfC5jxYeqd76.bat

Filesize
196B

MD5
bef837cd2b9c01370265e081eb26720e

SHA1
9fb45e0ee3f8fde061b2dc1ad16259b5a67f8f9e

SHA256
a727c4835f09709690903048ec2bd3506b432e60ad00316d5050324f40ecda02

SHA512
e89949f0e81888966cda9dee4f1e8edcb98d3ebebaad5cf2e0df90df4dc11596f42a785491aece3ee493de03fc5e008f77ab2202f63756c30a4a6913af594166

Download Submit
C:\Users\Admin\AppData\Local\Temp\BstFW15UuWPR.bat

Filesize
196B

MD5
c94c6ded42306b3b1ec060511eaeaa55

SHA1
d21e24ed9e0af4510e7076f92922133602ba8491

SHA256
9f21d7021c4b3ab6dcae0b73159f367f0b8e7f68862a57c173b05f6fa7f74505

SHA512
b7ba9f3d2f4e484bdec786308a4f02dc96f79023009978026680da48b80c30fe9b178b50d8260be317a0a7a2e4683d8d0dd7ea2e97dcc23d371a6a87d1c5f325

Download Submit
C:\Users\Admin\AppData\Local\Temp\EHP7zW9m8ijA.bat

Filesize
196B

MD5
aa8d89847ccf2e33cf0714f88006b693

SHA1
94c4d0ae1c7408a05a01cb96f01a87b6b9f51685

SHA256
947819b07cc34da46360a946cc4cabae9c52967443a504fb78eff066ef38038e

SHA512
1a3d753ffe5ba0ac4d4fc3e5f467cdbafe1d57743349f3ec33f6206a97e68e328cd56b00425a2b019a5f2d890a1e7e579df8e080a3ec499adb31b8c6b27cb04a

Download Submit
C:\Users\Admin\AppData\Local\Temp\FBl7JUFfhv5R.bat

Filesize
196B

MD5
db402de0e665d2da2891f131dd7a2f3b

SHA1
33b68ac46df679e9e4642af45785fafffe8dc5de

SHA256
7b9eaa8cc597c86195a5f8fe346be50c9612598ac19d713b93f0ce845383aa79

SHA512
0f518028a3c063e726e8c9bddfe4f2887ea4788f48b5ddf009373acfa39b46b2b8cc3d6d77e5f3452683582e95d0a9438034969e5411c90bf6933ff617b73b0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\GSrc4G4WX7T7.bat

Filesize
196B

MD5
e59e28c95a429925c9158d9c0d846301

SHA1
2e095134a02b86f3ebb431ba638a417f72084dac

SHA256
4cc379d97b184d84bc0c04d92dc557220924664d86d68703fa0604d74b274596

SHA512
5c95b0f5305a0d858883518bd376024b70ffe1c106700b3a37dda6ca722165996d8c53fb54c67498a585077f2df02a688e7e65a94705cbaf1f8c5d38d1b1d828

Download Submit
C:\Users\Admin\AppData\Local\Temp\IEtvkYZLT9Uc.bat

Filesize
196B

MD5
8bda5bc5049a4eff0241568c9a0a901b

SHA1
5eed3e6ef533c074205d264b869027e2a98e6f6d

SHA256
bee2854abebd5eebbd56fd29fff55800c102be75c97ad58e1e6f119e05ba7e7f

SHA512
63ab85ba3d01b4471f609b18e67c768d71d9158bf68e0481bf74a1d309f28981a63ed6f4f300d073bea504d12f52cc9c8138d95a795cc794da72ed7834011d38

Download Submit
C:\Users\Admin\AppData\Local\Temp\J5RDG4yoSTLA.bat

Filesize
196B

MD5
540ed49a2c0c00720d4c2f2ae04d6bf1

SHA1
af487de7e5f8077cbec019a38a6e3d92ea2df7d0

SHA256
95af795953bcad4770d527dac91e877775e9d9819af82fb9105cc9b6f7cabbee

SHA512
de2e094cbc94a8420b3c680e94b3f5e5bafbe474db466a007082fde7a153f03544ae8224660ab5444c5d7bc7c74814f3b295ee07e2cd180a1878a43f776f0f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jj56icvdV8nc.bat

Filesize
196B

MD5
ee96a74a8fde53a1d835f177b3db4915

SHA1
11ebb6f04bcee0916dcf88a18fba4efba623bb8a

SHA256
60362308941f0bd7cb9ee4eba46cceb4df7c3e5edc3a8ba634e67ab3b1af1a98

SHA512
f4b9f8bf013df368cf3d41da368b92c8b9f65a8728d6f82059258e5804db65784e777b555f6718879eb2d0116baf5cf20fc55c86f715190f7144ee30606259d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ot3GyOamAtFx.bat

Filesize
196B

MD5
abf5dc0e35be3f45f2dd2d414097ab02

SHA1
023a2df0057a2a8941df8e6b8e579d1857b3e2d1

SHA256
8241f2204730caf721d650603caf5593bea528dc26973cb6f5e27a98a8755adb

SHA512
ae3448ac65a1601b914acd89f4aff60ed2ed790d1f859b2bff3d044441940501c5b04fc80f951608489187b23840cb30cc57dfc9388c24ee8e33c57e3749af62

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReS8OnG9ydnC.bat

Filesize
196B

MD5
3b7fed4946b99a26da7b82452fe7bb5a

SHA1
2a5ea3bebaf2fdb4d13e6be24ed7159aea83600e

SHA256
d83e090504a6beb053bb4e925baf620b2606fcd58f18b0952ee88a810482e1b1

SHA512
18739a13fc68d65e0f3c34bfc3a1146278dd362b569783c47ee414659a2f02c3025a3251ee8587ffd9125ea833e048d8452c7526a7883e5d0e97f8fa94d8a3c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TslBSiRhnTin.bat

Filesize
196B

MD5
0a6a2dc130ef4401b3932c7e785558a9

SHA1
84c8381506b3281acd0f9ccd3786237b912f0cc5

SHA256
e4e32c112e284a230f91f9e9dad5ebb5362d65ee53a1355b7bee22e1476980dd

SHA512
426e2b79b169b6e2a1c843fd6a8e331b84d25ba79a79cd7c9db9de2e6b765a310820199f07cb7fc897eb455a409049f7db014df68056ab50f7d0ba3683cbccc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\U0JcDSEtRBr0.bat

Filesize
196B

MD5
5835ae69ad38f9b33349c516a0521ef1

SHA1
e8211466a6f7c6a9af1072bc903065c05d2e0084

SHA256
5497aea733bfdd5e2887106f70335dc4e3d7e589b53f025da4fe8a3cd88dcd68

SHA512
88a27a53a1c381cd43794f36eddb16c2a2fbf3aca781c741841e585887c4c2e66e7144a306c8b968578d8b592a7c8eb4db6a80ef17922552e862110c7207bfad

Download Submit
C:\Users\Admin\AppData\Local\Temp\X4kvbGTBNHjm.bat

Filesize
196B

MD5
fa860e48bb4d9a31de37dc42542c91a3

SHA1
4ed2464b24670de1536a34607cbcc1a14ffae5d1

SHA256
d5c28db743a9654b8cb5c0f90160082039bf693fade8c82bb2251d04c676bd86

SHA512
e720f73209708b1c7433fcb5623ea2be8bf97e1d2574ac1689733dc28454686a8224a10f12c952927b0a4a6123d68d0ff0e8b7a17b5902891bb884170ec3a414

Download Submit
C:\Users\Admin\AppData\Local\Temp\XBSbSHZvmhyr.bat

Filesize
196B

MD5
6f699db27a34ef1f8a1201c5bb307abc

SHA1
cabb16e0182ae19c6a89b071dd321a73ae07db33

SHA256
06dba5d2cad3ce2dfea880a3f90ab166cd41b79a3279212c7860ff3dbcb94a18

SHA512
e002ebb2d668914e90f9576a8adf9e493f76b314a8851da538cea4c54a68e198acec2d79d6a8822cc389220f1b00b79b642d403c6d18e960402e1fbcacfff98d

Download Submit
C:\Users\Admin\AppData\Local\Temp\XrxzAbWhYg1z.bat

Filesize
196B

MD5
26c3e9bde7fc47a859bb7dfca938fad6

SHA1
da20aaec0e234c6f691a9e833d6d90879d52de28

SHA256
391d78ce83622165420b37dd58fce96b40782ec3759f0ae1d250213f5fb4101a

SHA512
b95f890ac1df4a0a160f865d0cf69ca1755bf398a9dff323e6ea4ff9ea4872994757912557e8801e963e74444618f5e960039663eeab0b54140fed55ba819597

Download Submit
C:\Users\Admin\AppData\Local\Temp\YjgAI349CVz2.bat

Filesize
196B

MD5
9cd2df782d282cff4b36a55001625a46

SHA1
0b71b50cbb5dc3caf89cb4c3fe3e9ab15b85e2b5

SHA256
69af39ba8248c4d581e32d2eb234b5141ba90810577a3017121b0d21fa16a9bc

SHA512
e90fc83d9648926ebfab661c6a4384fb652728fb2da454f261da3694b706c0cd0a6a7026e751a60f70494157c521784dec30ad841bbd078201da56a94d3f1afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\aYSnhOgRcDps.bat

Filesize
196B

MD5
ce26600219dfcc7f59913c79e317e378

SHA1
15a94a474617d839c3ab03b15cdb8a677045176f

SHA256
dd3560c8f0409a976a3b3880f26063dd4c110c0f4de287a6a5bfd055a7ebaaed

SHA512
db815b8fb002c593ef482aa9bc6bfad5e2b641ba5370ea37d2d482d8e7220177ba2bfffd58cb1f6785ab279f797a150d10b62703e4d8a9174d5052188ed559f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ahEeS7xuYStH.bat

Filesize
196B

MD5
3b0e9474a00cfad7554274eaf96550d9

SHA1
8a32c92e7814b22b7b7ca4a5170a9550cb2a70e9

SHA256
a429036ef51ee9963dcc9a0e320274be8b69983cf2fdb55fde609cd4d4923491

SHA512
1984d54280e5743e54423a2e5a28cf41122ec9afe420f78beb06f6bfdb1efe8fa26aa4497269872429b036515e36c936117ab4c5482dd671f5d89ad44d7f224d

Download Submit
C:\Users\Admin\AppData\Local\Temp\f1ZfYS1WcXJz.bat

Filesize
196B

MD5
5f655d342c01f5f54c844d89bfd18746

SHA1
d216432015d346d5bd4d574c4deef8ca9fe4953d

SHA256
486eb13a1b96b4f3b8622ff1e611f2e8b31fa6fd32567d5d3171817b2bccc474

SHA512
23686d6a876ae6b1c38bc1d647277627f8f393bca423114d5260293151bf65df452e619795763bf67e1f84fd242dc642c5fb4a1a08afbae323c452c48bbc8d71

Download Submit
C:\Users\Admin\AppData\Local\Temp\h9eCBc11ZfoI.bat

Filesize
196B

MD5
eaedf1d08235a5d809df9245c20ca15e

SHA1
f6a241d96bdf856115ce74f0ae50cef1a75ae3bc

SHA256
365a481e4487d0acbf889eaac5633a6d4461dc5c5704e09f7e323e9a575d2e90

SHA512
116003de65d00362c606896339ef0f26572f305d4f7575e0dac57320bde2d28e9707fa866e11d4d2985346b4cacb0921042c62606023acbc4d1db6065e462642

Download Submit
C:\Users\Admin\AppData\Local\Temp\iW96s9nTZ072.bat

Filesize
196B

MD5
bea4ee8e15a4bc8af609aa1471dd1678

SHA1
e07d9606ded1d4388fae3f3210da6e911a66cdd7

SHA256
6851844f92f2902b5a285248a54578e2656ee0644c2ac85990b4cb3774f89671

SHA512
c4b5ee2727c4b2c8f035c99401f65494299c4f01497581b671bc218ff599808ee251167ce45c45a9dd964718feda12ecbc230e24a54436d32daaca89b026b018

Download Submit
C:\Users\Admin\AppData\Local\Temp\jtVCPnbXVzSw.bat

Filesize
196B

MD5
0d55dc3177d34227418189cd98327797

SHA1
53f0c29c1ecf50a8543c1e47e805edcf072fa21a

SHA256
54cae50ed09af536f7d3a22400e171635b95b814f19004f15cf6484538996234

SHA512
f87a70ed33aa3172325fde9a5ae6ba72d57ad4e232ccb5a71a75cc4523535af4f90f2175d06babe71f1e1ba266595320a930b5166ad58c1e058e3598c9ad5b21

Download Submit
C:\Users\Admin\AppData\Local\Temp\taavowrYA3PJ.bat

Filesize
196B

MD5
63809952ac03c1e68fd6460f0c9ea008

SHA1
6f7db6fcd43fedd035cf5040604c50f16241e276

SHA256
dc91452a934cda3a8cfb56ec385dca5274de1a12d81b2d936bdc8191ccd2a752

SHA512
c6f850a4e257e516787bb78891abb2d8269c8fed21f61ef70874672c9a35cdc4500bdb265c9206fe891b9e1167cfd13a9994ff9609f5f806fac11379f680ee7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\uQzPRRgjNGOk.bat

Filesize
196B

MD5
a3ac6afa42d84ba4277a28179c0fa2c9

SHA1
d634ed4feb0f44618e9afb61cf6b8edafcdc27aa

SHA256
fbe677921c151aefb5c4264ef7c82935c473cafdbb64cf8ba5fac169cd2d072b

SHA512
ce624b2ea38ca8cde05939b85d075daaf48a341f4c167b16bbdcc78b7552c8c3906add16154b7507bf3e73d293f17af760188cf47b4245cd80f645d5e585e57b

Download Submit
C:\Users\Admin\AppData\Local\Temp\xIk6yc5TAjiO.bat

Filesize
196B

MD5
837ee93189401dbc551dd9ba74eeb67c

SHA1
13045de82f6a3a234940438201c8a8319a3028d0

SHA256
2092a33a9fc634ca054be0e78197354d36016f5197da4e34fcc12f9ec8b7c0a7

SHA512
814f37f18a475b6f051272cb88827305dbf1886c0f5be9b4158b819b3e2f7daed1e979ca7d9282252aad25f7a3da0a646ad27e56621eff09233f64e3e55a32b9

Download Submit
C:\Windows\System32\SubDir\Client.exe

Filesize
3.1MB

MD5
a39f29a2f774febb2c532577de2f407c

SHA1
bf97e76565ae9a78f33601c154e97ef9e2631430

SHA256
7ce9d2b8f4a344b07a8e3b9bf58ede5a2ba7a85bfa94d8b103179183fbb7c24f

SHA512
ca28aa66f392356e19d3fb43327ffb9cf1aae0777c8fcdc3530b02f50b50a0347a12db76f90717c51355f8c25de020a989b722c231a14f0995b7e149303a4fa0

Download Submit
memory/2956-0-0x00007FF996B93000-0x00007FF996B95000-memory.dmp

Filesize
8KB

Download
memory/2956-1-0x0000000000910000-0x0000000000C34000-memory.dmp

Filesize
3.1MB

Download
memory/2956-2-0x00007FF996B90000-0x00007FF997652000-memory.dmp

Filesize
10.8MB

Download
memory/2956-10-0x00007FF996B90000-0x00007FF997652000-memory.dmp

Filesize
10.8MB

Download
memory/4956-19-0x00007FF996B90000-0x00007FF997652000-memory.dmp

Filesize
10.8MB

Download
memory/4956-9-0x00007FF996B90000-0x00007FF997652000-memory.dmp

Filesize
10.8MB

Download
memory/4956-11-0x00007FF996B90000-0x00007FF997652000-memory.dmp

Filesize
10.8MB

Download
memory/4956-12-0x0000000002D50000-0x0000000002DA0000-memory.dmp

Filesize
320KB

Download
memory/4956-13-0x000000001BF40000-0x000000001BFF2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads