2d3272c4e2daca9621f56b0724743c467a8a70cd30826b505bb7c3d3a1dfd482

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
10/07/2025, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiscordClient.exe
Size 6.2MB
Sample250710-tk8qdavkw4
SHA256 2d3272c4e2daca9621f56b0724743c467a8a70cd30826b505bb7c3d3a1dfd482
MD5 1579988168051a140f9b3730a887a5ac
SHA1 2912ad1955e8ac3e96171bdc244aeee61b7b9af0
SHA512 f37449cbc08fb97e45453165106c5ac4be31661f9d356bb1aa83af735a36eec64aa49604b57ed15844bdd0a74e6bfc95a9dcb20bfd1c18c6727c5e07b3d9d364
SSDEEP 196608:zCC8QfL0rNgXylky+Y4b+ZZ3V6fd/V6wEhp0C/y+N9:dfGuyZ4iV6fd/chp2A
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\1dEdJTtc\ImagePath = "\\??\\C:\\Windows\\System32\\1dEdJTtc.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ulri97x7\ImagePath = "\\??\\C:\\Windows\\System32\\Ulri97x7.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hlKWyJzL\ImagePath = "\\??\\C:\\Windows\\System32\\hlKWyJzL.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zCrxWu1u\ImagePath = "\\??\\C:\\Windows\\System32\\zCrxWu1u.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\7sfNAmr7\ImagePath = "\\??\\C:\\Windows\\System32\\7sfNAmr7.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\7a2KBHZN\ImagePath = "\\??\\C:\\Windows\\System32\\7a2KBHZN.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ycI63E7c\ImagePath = "\\??\\C:\\Windows\\System32\\ycI63E7c.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Qibjs0AP\ImagePath = "\\??\\C:\\Windows\\System32\\Qibjs0AP.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\oOR8MqX9\ImagePath = "\\??\\C:\\Windows\\System32\\oOR8MqX9.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\c925Iz1a\ImagePath = "\\??\\C:\\Windows\\System32\\c925Iz1a.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\XVUFrkjM\ImagePath = "\\??\\C:\\Windows\\System32\\XVUFrkjM.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\HyCjNu2t\ImagePath = "\\??\\C:\\Windows\\System32\\HyCjNu2t.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vLdG8w4J\ImagePath = "\\??\\C:\\Windows\\System32\\vLdG8w4J.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gUGIgTyC\ImagePath = "\\??\\C:\\Windows\\System32\\gUGIgTyC.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rrNsCR9d\ImagePath = "\\??\\C:\\Windows\\System32\\rrNsCR9d.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QncVVic6\ImagePath = "\\??\\C:\\Windows\\System32\\QncVVic6.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\HeWeHpb6\ImagePath = "\\??\\C:\\Windows\\System32\\HeWeHpb6.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RkZUUxlr\ImagePath = "\\??\\C:\\Windows\\System32\\RkZUUxlr.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nxSuyYzM\ImagePath = "\\??\\C:\\Windows\\System32\\nxSuyYzM.sys"	sihost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ejOzi3Dr\ImagePath = "\\??\\C:\\Windows\\System32\\ejOzi3Dr.sys"	sihost.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
28	discord.com
29	discord.com
31	discord.com

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\System32\HeWeHpb6.sys	sihost.exe
File created	C:\Windows\System32\XVUFrkjM.sys	sihost.exe
File created	C:\Windows\System32\HyCjNu2t.sys	sihost.exe
File created	C:\Windows\System32\vLdG8w4J.sys	sihost.exe
File created	C:\Windows\System32\ejOzi3Dr.sys	sihost.exe
File created	C:\Windows\System32\Qibjs0AP.sys	sihost.exe
File created	C:\Windows\System32\gUGIgTyC.sys	sihost.exe
File created	C:\Windows\System32\Ulri97x7.sys	sihost.exe
File created	C:\Windows\System32\hlKWyJzL.sys	sihost.exe
File created	C:\Windows\System32\zCrxWu1u.sys	sihost.exe
File created	C:\Windows\System32\RkZUUxlr.sys	sihost.exe
File created	C:\Windows\System32\c925Iz1a.sys	sihost.exe
File created	C:\Windows\System32\ycI63E7c.sys	sihost.exe
File created	C:\Windows\System32\QncVVic6.sys	sihost.exe
File created	C:\Windows\System32\1dEdJTtc.sys	sihost.exe
File created	C:\Windows\System32\7sfNAmr7.sys	sihost.exe
File created	C:\Windows\System32\rrNsCR9d.sys	sihost.exe
File created	C:\Windows\System32\7a2KBHZN.sys	sihost.exe
File created	C:\Windows\System32\nxSuyYzM.sys	sihost.exe
File created	C:\Windows\System32\oOR8MqX9.sys	sihost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 540 set thread context of 2152	540	DiscordClient.exe	81

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1559682075\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_877732834\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_877732834\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1683906830\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1559682075\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4552_1775843540\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_93_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1683906830\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_877732834\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1559682075\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_877732834\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1559682075\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_877732834\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_67468799\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1559682075\_metadata\verified_contents.json	msedge.exe

Launches sc.exe 20 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4708	sc.exe
2712	sc.exe
1324	sc.exe
5404	sc.exe
4776	sc.exe
3520	sc.exe
3272	sc.exe
5076	sc.exe
2384	sc.exe
2320	sc.exe
5292	sc.exe
1804	sc.exe
5004	sc.exe
3036	sc.exe
5276	sc.exe
5288	sc.exe
2272	sc.exe
6004	sc.exe
5004	sc.exe
2176	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 40 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5840	cmd.exe
8	cmd.exe
3276	cmd.exe
4656	cmd.exe
5616	cmd.exe
1160	cmd.exe
5320	cmd.exe
5428	cmd.exe
6020	cmd.exe
5728	cmd.exe
1840	cmd.exe
3108	cmd.exe
5172	cmd.exe
1140	cmd.exe
5308	cmd.exe
1472	cmd.exe
6052	cmd.exe
6032	cmd.exe
2872	cmd.exe
4332	cmd.exe
6068	cmd.exe
2188	cmd.exe
3176	cmd.exe
1752	cmd.exe
5184	cmd.exe
8	cmd.exe
1484	cmd.exe
6028	cmd.exe
4560	cmd.exe
3640	cmd.exe
5736	cmd.exe
3916	cmd.exe
3276	cmd.exe
2628	cmd.exe
228	cmd.exe
3692	cmd.exe
5728	cmd.exe
5308	cmd.exe
424	cmd.exe
5428	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
2060	taskkill.exe
4800	taskkill.exe
4984	taskkill.exe
3464	taskkill.exe
4044	taskkill.exe
5796	taskkill.exe
3064	taskkill.exe
5196	taskkill.exe
564	taskkill.exe
2288	taskkill.exe
5572	taskkill.exe
1784	taskkill.exe
4488	taskkill.exe
4200	taskkill.exe
5732	taskkill.exe
3036	taskkill.exe
1424	taskkill.exe
2480	taskkill.exe
4836	taskkill.exe
4236	taskkill.exe
5844	taskkill.exe
1428	taskkill.exe
4640	taskkill.exe
1280	taskkill.exe
5628	taskkill.exe
5524	taskkill.exe
4548	taskkill.exe
4036	taskkill.exe
6028	taskkill.exe
2872	taskkill.exe
5928	taskkill.exe
5104	taskkill.exe
2348	taskkill.exe
2396	taskkill.exe
1820	taskkill.exe
4756	taskkill.exe
5780	taskkill.exe
1680	taskkill.exe
3788	taskkill.exe
1536	taskkill.exe
5944	taskkill.exe
1356	taskkill.exe
6008	taskkill.exe
4672	taskkill.exe
4180	taskkill.exe
6104	taskkill.exe
5256	taskkill.exe
5540	taskkill.exe
2296	taskkill.exe
4696	taskkill.exe
5908	taskkill.exe
5088	taskkill.exe
2332	taskkill.exe
2348	taskkill.exe
5488	taskkill.exe
1424	taskkill.exe
5616	taskkill.exe
684	taskkill.exe
3124	taskkill.exe
5748	taskkill.exe
3296	taskkill.exe
3756	taskkill.exe
5984	taskkill.exe
4840	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133966373009761670"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-903960561-1545645218-4290906778-1000\{0BF60936-587C-4AE2-BD00-ED2435069299}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-903960561-1545645218-4290906778-1000\{65FE9315-7F29-42B5-B4F7-3F98ECBE2957}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
2152	sihost.exe
2152	sihost.exe
2152	sihost.exe
2152	sihost.exe
2152	sihost.exe
2152	sihost.exe
2152	sihost.exe
2152	sihost.exe
2152	sihost.exe
2152	sihost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	taskkill.exe
Token: SeDebugPrivilege	1048	taskkill.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	5732	taskkill.exe
Token: SeDebugPrivilege	1280	taskkill.exe
Token: SeDebugPrivilege	4044	taskkill.exe
Token: SeDebugPrivilege	4484	taskkill.exe
Token: SeDebugPrivilege	3788	taskkill.exe
Token: SeDebugPrivilege	5864	taskkill.exe
Token: SeDebugPrivilege	5540	taskkill.exe
Token: SeDebugPrivilege	5984	taskkill.exe
Token: SeDebugPrivilege	3176	taskkill.exe
Token: SeDebugPrivilege	4488	taskkill.exe
Token: SeDebugPrivilege	5456	taskkill.exe
Token: SeLoadDriverPrivilege	2152	sihost.exe
Token: SeDebugPrivilege	5908	taskkill.exe
Token: SeDebugPrivilege	4776	taskkill.exe
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	3368	taskkill.exe
Token: SeDebugPrivilege	1536	taskkill.exe
Token: SeDebugPrivilege	4048	taskkill.exe
Token: SeDebugPrivilege	5320	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	2396	taskkill.exe
Token: SeDebugPrivilege	3488	taskkill.exe
Token: SeDebugPrivilege	5944	taskkill.exe
Token: SeDebugPrivilege	1032	taskkill.exe
Token: SeDebugPrivilege	5796	taskkill.exe
Token: SeLoadDriverPrivilege	2152	sihost.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	4756	taskkill.exe
Token: SeDebugPrivilege	5488	taskkill.exe
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeDebugPrivilege	4236	taskkill.exe
Token: SeDebugPrivilege	1372	taskkill.exe
Token: SeDebugPrivilege	4696	taskkill.exe
Token: SeDebugPrivilege	5008	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	2480	taskkill.exe
Token: SeDebugPrivilege	5196	taskkill.exe
Token: SeDebugPrivilege	5748	taskkill.exe
Token: SeDebugPrivilege	228	taskkill.exe
Token: SeDebugPrivilege	5184	taskkill.exe
Token: SeLoadDriverPrivilege	2152	sihost.exe
Token: SeDebugPrivilege	6104	taskkill.exe
Token: SeDebugPrivilege	5256	taskkill.exe
Token: SeDebugPrivilege	4884	taskkill.exe
Token: SeDebugPrivilege	1356	taskkill.exe
Token: SeDebugPrivilege	1428	taskkill.exe
Token: SeDebugPrivilege	1352	taskkill.exe
Token: SeDebugPrivilege	6008	taskkill.exe
Token: SeDebugPrivilege	4640	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	1424	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	5288	taskkill.exe
Token: SeDebugPrivilege	5780	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeLoadDriverPrivilege	2152	sihost.exe
Token: SeDebugPrivilege	5840	taskkill.exe
Token: SeDebugPrivilege	5616	taskkill.exe
Token: SeDebugPrivilege	2872	taskkill.exe
Token: SeDebugPrivilege	780	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 2152	540	DiscordClient.exe	81
PID 540 wrote to memory of 2152	540	DiscordClient.exe	81
PID 540 wrote to memory of 2152	540	DiscordClient.exe	81
PID 540 wrote to memory of 2152	540	DiscordClient.exe	81
PID 540 wrote to memory of 2152	540	DiscordClient.exe	81
PID 540 wrote to memory of 2152	540	DiscordClient.exe	81
PID 540 wrote to memory of 2152	540	DiscordClient.exe	81
PID 540 wrote to memory of 2152	540	DiscordClient.exe	81
PID 540 wrote to memory of 2152	540	DiscordClient.exe	81
PID 540 wrote to memory of 2152	540	DiscordClient.exe	81
PID 2152 wrote to memory of 2268	2152	sihost.exe	86
PID 2152 wrote to memory of 2268	2152	sihost.exe	86
PID 2268 wrote to memory of 4552	2268	cmd.exe	87
PID 2268 wrote to memory of 4552	2268	cmd.exe	87
PID 4552 wrote to memory of 4644	4552	msedge.exe	88
PID 4552 wrote to memory of 4644	4552	msedge.exe	88
PID 4552 wrote to memory of 2456	4552	msedge.exe	89
PID 4552 wrote to memory of 2456	4552	msedge.exe	89
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91
PID 4552 wrote to memory of 808	4552	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\DiscordClient.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordClient.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\System32\sihost.exe
  "C:\Windows\System32\sihost.exe"
  2⤵
  - Sets service image path in registry
  - Drops file in System32 directory
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://discord.gg/ebfrNZyqRB
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/ebfrNZyqRB
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ffd479af208,0x7ffd479af214,0x7ffd479af220
        5⤵
        
        PID:4644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1812,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
        5⤵
        
        PID:2456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2172,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
        5⤵
        
        PID:2408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2432,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
        5⤵
        
        PID:808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3396,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
        5⤵
        
        PID:5068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3420,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
        5⤵
        
        PID:4308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4804,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
        5⤵
        
        PID:5912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4940,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:6124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4756,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:12
        5⤵
        
        PID:912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5176,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
        5⤵
        
        PID:5800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5232,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
        5⤵
        
        PID:2804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6120,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
        5⤵
        
        PID:5488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6160,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
        5⤵
        
        PID:5748
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        6⤵
        
        PID:4584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6120,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
        5⤵
        
        PID:1052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6188,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
        5⤵
        
        PID:3216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6280,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
        5⤵
        
        PID:1688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6472,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
        5⤵
        
        PID:1452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
        5⤵
        
        PID:6020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6276,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
        5⤵
        
        PID:3108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5252,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
        5⤵
        
        PID:6068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5456,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
        5⤵
        
        PID:2172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5312,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
        5⤵
        
        PID:3368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6260,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=872 /prefetch:14
        5⤵
        
        PID:5952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6540,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6236,i,8954145150178840833,3286271812114834371,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
        5⤵
        
        PID:564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM vgc.exe > nul 2>&1
    3⤵
    PID:5780
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vgc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM valorant.exe > nul 2>&1
    3⤵
    PID:2688
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM valorant.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM faceit.exe > nul 2>&1
    3⤵
    PID:2900
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM faceit.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4656
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat.exe > nul 2>&1
    3⤵
    PID:1548
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat_EOS.exe > nul 2>&1
    3⤵
    PID:3504
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat_EOS.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService_x64.exe > nul 2>&1
    3⤵
    PID:2332
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService_x64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe > nul 2>&1
    3⤵
    PID:692
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5840
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5616
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2872
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteLauncher.exe > nul 2>&1
    3⤵
    PID:2548
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteLauncher.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe > nul 2>&1
    3⤵
    PID:3956
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheatLauncher.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe > nul 2>&1
    3⤵
    PID:1372
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BattleEyeLauncher.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgk > nul 2>&1
    3⤵
    PID:4232
  - - C:\Windows\system32\sc.exe
      sc stop vgk
      4⤵
      Launches sc.exe
      PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc > nul 2>&1
    3⤵
    PID:1652
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:1324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgk.sys > nul 2>&1
    3⤵
    PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgc.sys > nul 2>&1
    3⤵
    PID:4856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM vgc.exe > nul 2>&1
    3⤵
    PID:4708
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vgc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM valorant.exe > nul 2>&1
    3⤵
    PID:4344
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM valorant.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM faceit.exe > nul 2>&1
    3⤵
    PID:2088
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM faceit.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4332
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat.exe > nul 2>&1
    3⤵
    PID:2004
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat_EOS.exe > nul 2>&1
    3⤵
    PID:1452
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat_EOS.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService_x64.exe > nul 2>&1
    3⤵
    PID:4916
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService_x64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe > nul 2>&1
    3⤵
    PID:1428
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6028
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2188
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3692
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteLauncher.exe > nul 2>&1
    3⤵
    PID:1744
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteLauncher.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe > nul 2>&1
    3⤵
    PID:5304
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheatLauncher.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe > nul 2>&1
    3⤵
    PID:4560
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BattleEyeLauncher.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgk > nul 2>&1
    3⤵
    PID:5736
  - - C:\Windows\system32\sc.exe
      sc stop vgk
      4⤵
      Launches sc.exe
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc > nul 2>&1
    3⤵
    PID:3272
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:5404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgk.sys > nul 2>&1
    3⤵
    PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgc.sys > nul 2>&1
    3⤵
    PID:1276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM vgc.exe > nul 2>&1
    3⤵
    PID:5500
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vgc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM valorant.exe > nul 2>&1
    3⤵
    PID:5584
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM valorant.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM faceit.exe > nul 2>&1
    3⤵
    PID:5784
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM faceit.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3176
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat.exe > nul 2>&1
    3⤵
    PID:4488
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat_EOS.exe > nul 2>&1
    3⤵
    PID:5456
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat_EOS.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService_x64.exe > nul 2>&1
    3⤵
    PID:3344
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService_x64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe > nul 2>&1
    3⤵
    PID:3764
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5728
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1160
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteLauncher.exe > nul 2>&1
    3⤵
    PID:540
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteLauncher.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe > nul 2>&1
    3⤵
    PID:1848
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheatLauncher.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe > nul 2>&1
    3⤵
    PID:3356
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BattleEyeLauncher.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgk > nul 2>&1
    3⤵
    PID:4296
  - - C:\Windows\system32\sc.exe
      sc stop vgk
      4⤵
      Launches sc.exe
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc > nul 2>&1
    3⤵
    PID:4344
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgk.sys > nul 2>&1
    3⤵
    PID:2340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgc.sys > nul 2>&1
    3⤵
    PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM vgc.exe > nul 2>&1
    3⤵
    PID:5820
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vgc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM valorant.exe > nul 2>&1
    3⤵
    PID:6004
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM valorant.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM faceit.exe > nul 2>&1
    3⤵
    PID:4524
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM faceit.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5320
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat.exe > nul 2>&1
    3⤵
    PID:4548
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat_EOS.exe > nul 2>&1
    3⤵
    PID:4256
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat_EOS.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService_x64.exe > nul 2>&1
    3⤵
    PID:3572
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService_x64.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe > nul 2>&1
    3⤵
    PID:4372
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3108
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5172
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1140
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteLauncher.exe > nul 2>&1
    3⤵
    PID:4664
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteLauncher.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe > nul 2>&1
    3⤵
    PID:6064
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheatLauncher.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe > nul 2>&1
    3⤵
    PID:2384
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BattleEyeLauncher.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgk > nul 2>&1
    3⤵
    PID:2416
  - - C:\Windows\system32\sc.exe
      sc stop vgk
      4⤵
      Launches sc.exe
      PID:3520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc > nul 2>&1
    3⤵
    PID:5404
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:3272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgk.sys > nul 2>&1
    3⤵
    PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgc.sys > nul 2>&1
    3⤵
    PID:5480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM vgc.exe > nul 2>&1
    3⤵
    PID:5608
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vgc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM valorant.exe > nul 2>&1
    3⤵
    PID:5284
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM valorant.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM faceit.exe > nul 2>&1
    3⤵
    PID:5340
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM faceit.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5428
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat.exe > nul 2>&1
    3⤵
    PID:4240
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat.exe
      4⤵
      PID:1392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat_EOS.exe > nul 2>&1
    3⤵
    PID:2824
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat_EOS.exe
      4⤵
      Kills process with taskkill
      PID:2296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService_x64.exe > nul 2>&1
    3⤵
    PID:4684
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService_x64.exe
      4⤵
      PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe > nul 2>&1
    3⤵
    PID:5132
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService.exe
      4⤵
      Kills process with taskkill
      PID:5088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5308
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe
      4⤵
      PID:2672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3276
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe
      4⤵
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1752
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe
      4⤵
      PID:3060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteLauncher.exe > nul 2>&1
    3⤵
    PID:5408
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteLauncher.exe
      4⤵
      Kills process with taskkill
      PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe > nul 2>&1
    3⤵
    PID:2668
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheatLauncher.exe
      4⤵
      Kills process with taskkill
      PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe > nul 2>&1
    3⤵
    PID:2568
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BattleEyeLauncher.exe
      4⤵
      Kills process with taskkill
      PID:1680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgk > nul 2>&1
    3⤵
    PID:5888
  - - C:\Windows\system32\sc.exe
      sc stop vgk
      4⤵
      Launches sc.exe
      PID:5076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc > nul 2>&1
    3⤵
    PID:2768
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgk.sys > nul 2>&1
    3⤵
    PID:4424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgc.sys > nul 2>&1
    3⤵
    PID:6080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM vgc.exe > nul 2>&1
    3⤵
    PID:5760
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vgc.exe
      4⤵
      PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM valorant.exe > nul 2>&1
    3⤵
    PID:5752
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM valorant.exe
      4⤵
      Kills process with taskkill
      PID:684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM faceit.exe > nul 2>&1
    3⤵
    PID:1984
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM faceit.exe
      4⤵
      PID:6008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1472
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping.exe
      4⤵
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat.exe > nul 2>&1
    3⤵
    PID:1820
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat.exe
      4⤵
      PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat_EOS.exe > nul 2>&1
    3⤵
    PID:1624
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat_EOS.exe
      4⤵
      Kills process with taskkill
      PID:1424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService_x64.exe > nul 2>&1
    3⤵
    PID:3692
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService_x64.exe
      4⤵
      Kills process with taskkill
      PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe > nul 2>&1
    3⤵
    PID:3144
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService.exe
      4⤵
      PID:5288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6052
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe
      4⤵
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4560
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe
      4⤵
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5736
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe
      4⤵
      PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteLauncher.exe > nul 2>&1
    3⤵
    PID:5404
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteLauncher.exe
      4⤵
      Kills process with taskkill
      PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe > nul 2>&1
    3⤵
    PID:868
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheatLauncher.exe
      4⤵
      Kills process with taskkill
      PID:564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe > nul 2>&1
    3⤵
    PID:1904
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BattleEyeLauncher.exe
      4⤵
      Kills process with taskkill
      PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgk > nul 2>&1
    3⤵
    PID:2068
  - - C:\Windows\system32\sc.exe
      sc stop vgk
      4⤵
      Launches sc.exe
      PID:5292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc > nul 2>&1
    3⤵
    PID:960
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgk.sys > nul 2>&1
    3⤵
    PID:5432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgc.sys > nul 2>&1
    3⤵
    PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM vgc.exe > nul 2>&1
    3⤵
    PID:5612
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vgc.exe
      4⤵
      PID:5616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM valorant.exe > nul 2>&1
    3⤵
    PID:3952
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM valorant.exe
      4⤵
      PID:2872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM faceit.exe > nul 2>&1
    3⤵
    PID:3176
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM faceit.exe
      4⤵
      PID:780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3916
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping.exe
      4⤵
      PID:1392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat.exe > nul 2>&1
    3⤵
    PID:1652
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat.exe
      4⤵
      Kills process with taskkill
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat_EOS.exe > nul 2>&1
    3⤵
    PID:4856
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat_EOS.exe
      4⤵
      PID:3164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService_x64.exe > nul 2>&1
    3⤵
    PID:2056
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService_x64.exe
      4⤵
      Kills process with taskkill
      PID:2288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe > nul 2>&1
    3⤵
    PID:5132
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService.exe
      4⤵
      PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5308
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe
      4⤵
      PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3276
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe
      4⤵
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5184
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe
      4⤵
      Kills process with taskkill
      PID:3296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteLauncher.exe > nul 2>&1
    3⤵
    PID:6056
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteLauncher.exe
      4⤵
      Kills process with taskkill
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe > nul 2>&1
    3⤵
    PID:5548
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheatLauncher.exe
      4⤵
      PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe > nul 2>&1
    3⤵
    PID:5860
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BattleEyeLauncher.exe
      4⤵
      PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgk > nul 2>&1
    3⤵
    PID:1536
  - - C:\Windows\system32\sc.exe
      sc stop vgk
      4⤵
      Launches sc.exe
      PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc > nul 2>&1
    3⤵
    PID:5448
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:6004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgk.sys > nul 2>&1
    3⤵
    PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgc.sys > nul 2>&1
    3⤵
    PID:1452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM vgc.exe > nul 2>&1
    3⤵
    PID:5164
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vgc.exe
      4⤵
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM valorant.exe > nul 2>&1
    3⤵
    PID:964
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM valorant.exe
      4⤵
      PID:1496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM faceit.exe > nul 2>&1
    3⤵
    PID:5032
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM faceit.exe
      4⤵
      Kills process with taskkill
      PID:2060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2628
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping.exe
      4⤵
      Kills process with taskkill
      PID:5572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat.exe > nul 2>&1
    3⤵
    PID:3156
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat.exe
      4⤵
      PID:4504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat_EOS.exe > nul 2>&1
    3⤵
    PID:5176
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat_EOS.exe
      4⤵
      PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService_x64.exe > nul 2>&1
    3⤵
    PID:5040
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService_x64.exe
      4⤵
      Kills process with taskkill
      PID:2348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe > nul 2>&1
    3⤵
    PID:4036
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService.exe
      4⤵
      PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:424
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe
      4⤵
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6020
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe
      4⤵
      PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6068
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe
      4⤵
      Kills process with taskkill
      PID:2396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteLauncher.exe > nul 2>&1
    3⤵
    PID:1580
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteLauncher.exe
      4⤵
      PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe > nul 2>&1
    3⤵
    PID:4532
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheatLauncher.exe
      4⤵
      PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe > nul 2>&1
    3⤵
    PID:3136
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BattleEyeLauncher.exe
      4⤵
      PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgk > nul 2>&1
    3⤵
    PID:5304
  - - C:\Windows\system32\sc.exe
      sc stop vgk
      4⤵
      Launches sc.exe
      PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc > nul 2>&1
    3⤵
    PID:3404
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgk.sys > nul 2>&1
    3⤵
    PID:5732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgc.sys > nul 2>&1
    3⤵
    PID:1408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM vgc.exe > nul 2>&1
    3⤵
    PID:3568
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vgc.exe
      4⤵
      Kills process with taskkill
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM valorant.exe > nul 2>&1
    3⤵
    PID:5284
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM valorant.exe
      4⤵
      PID:1788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM faceit.exe > nul 2>&1
    3⤵
    PID:5340
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM faceit.exe
      4⤵
      Kills process with taskkill
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5428
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping.exe
      4⤵
      PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat.exe > nul 2>&1
    3⤵
    PID:4240
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat.exe
      4⤵
      Kills process with taskkill
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat_EOS.exe > nul 2>&1
    3⤵
    PID:1372
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat_EOS.exe
      4⤵
      PID:5672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService_x64.exe > nul 2>&1
    3⤵
    PID:992
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService_x64.exe
      4⤵
      Kills process with taskkill
      PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe > nul 2>&1
    3⤵
    PID:5096
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService.exe
      4⤵
      PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe
      4⤵
      PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5728
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe
      4⤵
      Kills process with taskkill
      PID:5628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:228
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe
      4⤵
      PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteLauncher.exe > nul 2>&1
    3⤵
    PID:5900
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteLauncher.exe
      4⤵
      PID:1752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe > nul 2>&1
    3⤵
    PID:5408
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheatLauncher.exe
      4⤵
      PID:3856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe > nul 2>&1
    3⤵
    PID:4196
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BattleEyeLauncher.exe
      4⤵
      Kills process with taskkill
      PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgk > nul 2>&1
    3⤵
    PID:3060
  - - C:\Windows\system32\sc.exe
      sc stop vgk
      4⤵
      Launches sc.exe
      PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc > nul 2>&1
    3⤵
    PID:1680
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgk.sys > nul 2>&1
    3⤵
    PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgc.sys > nul 2>&1
    3⤵
    PID:5076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM vgc.exe > nul 2>&1
    3⤵
    PID:6104
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vgc.exe
      4⤵
      Kills process with taskkill
      PID:5524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM valorant.exe > nul 2>&1
    3⤵
    PID:4516
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM valorant.exe
      4⤵
      Kills process with taskkill
      PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM faceit.exe > nul 2>&1
    3⤵
    PID:4144
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM faceit.exe
      4⤵
      PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3640
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping.exe
      4⤵
      Kills process with taskkill
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat.exe > nul 2>&1
    3⤵
    PID:3324
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat.exe
      4⤵
      PID:4636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat_EOS.exe > nul 2>&1
    3⤵
    PID:2528
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat_EOS.exe
      4⤵
      PID:5648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService_x64.exe > nul 2>&1
    3⤵
    PID:4916
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService_x64.exe
      4⤵
      Kills process with taskkill
      PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe > nul 2>&1
    3⤵
    PID:6084
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService.exe
      4⤵
      Kills process with taskkill
      PID:5844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6032
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_BE.exe
      4⤵
      Kills process with taskkill
      PID:4548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1840
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe
      4⤵
      PID:5760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe > nul 2>&1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1484
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe
      4⤵
      Kills process with taskkill
      PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteLauncher.exe > nul 2>&1
    3⤵
    PID:2488
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteLauncher.exe
      4⤵
      Kills process with taskkill
      PID:6028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe > nul 2>&1
    3⤵
    PID:2448
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheatLauncher.exe
      4⤵
      Kills process with taskkill
      PID:3756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe > nul 2>&1
    3⤵
    PID:2188
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BattleEyeLauncher.exe
      4⤵
      Kills process with taskkill
      PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgk > nul 2>&1
    3⤵
    PID:3124
  - - C:\Windows\system32\sc.exe
      sc stop vgk
      4⤵
      Launches sc.exe
      PID:5276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc > nul 2>&1
    3⤵
    PID:5944
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:5288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgk.sys > nul 2>&1
    3⤵
    PID:3692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c devcon remove *vgc.sys > nul 2>&1
    3⤵
    PID:1032

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4344

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C8
1⤵
PID:2724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\autofill_bypass_cache_forms.json
Size 146B
SHA256 b6c37df977f149c5a444c72ea4469ce666c7975d34c6e2e0d9d8ec416f57dd44
MD5 9357a694006d8bec3d0f8c9607b76ff8
SHA1 6335ce691999ec10de742cd07d074eb648631259
SHA512 87c2d0192f3a78b13a691cda14da507f260d13331b792eb973869bd6dbd0f207faa48f68882be691641b46c06ed12ee8b9728a3b596df67a1f9a4831b4369a44
MD5 SHA1 SHA512

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\edge_autofill_global_block_list.json
Size 5KB
SHA256 7655c9afb5f2ea39b18e302498b34009ca02b72451f82a6d4e7fb4d8d954f050
MD5 adb5f6058f82680a26d6ed02b44e5a21
SHA1 6197ee74e40c742e184357dcb6dfcc7e32818cae
SHA512 742dd8f6eaf1bd5f24b37e90d7a3dce7bd0a8edf399c2dec25cd92d2bd6e1d663ebab3c68234812f0144061d4f22f0c2c43de890f60e24d93133bbfe23a6d1c5
SSDEEP 96:MYL77CC6fQinLk252b/lF4NXtKK5b+QiG2ZwOSZqWqxtxpttx6lydMsSRa4/i:MYL7O9FnLk25+tF4B8K5b+QiGoztWuDZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\v1FieldTypes.json
Size 509KB
SHA256 f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1
MD5 c1a0d30e5eebef19db1b7e68fc79d2be
SHA1 de4ccb9e7ea5850363d0e7124c01da766425039c
SHA512 f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVI:Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c4278254cc16ba1099967b98859236cc3b690f4824e682cfab43169fcb06a336
MD5 017bc3fcd328486192fd0c7082796709
SHA1 8cfba6809f90567fdffd047fdfb707682a7d0595
SHA512 73fc2778be9284d2b28c9489a216b3d2e454920a36478f72640bccddb03a916c1653964d008872edccd42b6c5fe11f2c2b843ce90f437e5ccbf7490645740363
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 d628e49d72582bf492ff592d50514439127ecb8e775efcf21ce2e0be52cd5edf
MD5 fe2cccdda799529b3bc031e47401fcbf
SHA1 5338c2d9439e95a3b9368dcc4349540c702443a7
SHA512 40159d1e82695422520fcb510e2cbec3dcc674ae58b1f17dfc80e7c0d2e60f123d48ab6f9af594e4f4d541a4d427cac29075f007a5e546a413ae136d0b992e41
SSDEEP 96:vIDF1PqWOnzDymVEjLIg/z1KWskx4+g9/:vy1eZYLvJsXZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index~RFe581558.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe581558.TMP
Size 3KB
SHA256 d73248c8b4880448f9c3e1889d8073c3d3b6927a941a1987b2876174fe9a743b
MD5 57f05ab82379d0eef5a09c69183f1f7b
SHA1 0b1ad0c2e03d52427cde19c2aaea5d362711445f
SHA512 388010dc673b27cdbcbd9534041e8e7cbdab3a1300f0a4a0a6eb56fbaaa1eb4350fbb6410381ec49c37d684323285e78b5c096508d7a9a86ad2147d0a14d2926
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 ed5586dcd64718acb03b62456fda21c0ae2e116b787aca7ef24bb719cae9f48e
MD5 5d2e65bf482f1e7b272b73cef1cd48c1
SHA1 f9ca9db3a8a8f65449378c1b340ee70855dc06d7
SHA512 893eb18749954a10fdd2d909983aad3887bfe4e53a295cda4fae2f02613d0ff02fc5774884303f35b8d40bed3313d4ca7eba7ad5054648ef37238f69af1ac8d5
SSDEEP 1536:I6LPH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:RPHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

025c35a3-6d30-4b24-9a99-6ef5b5bc2c2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\025c35a3-6d30-4b24-9a99-6ef5b5bc2c2f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fc589e8d5eb85acfddfb3ecbc2bda74db170ced178c4e312de6893cf0fa2b21d
MD5 4381043c10840dd531359905b09b7196
SHA1 cef8ec7a4e58cd9aff253eb9e73428cee187bd08
SHA512 6842aaea3acb5199539da3c59482e5047b4c007e2b4dad6e2824f96611c8c26400643a4b771a0f666b0899427263b9487f0121c38435bfbc4d57b0c203c42de4
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 c2fccd9a8b0bb5cd085040c3c2301e6ee1856bb30a652704130ae566d606fc2c
MD5 3e7a94d358e035ca242ff9b35b56fa1e
SHA1 9f27db066f6b143ecc532680563d01adbbbd9902
SHA512 214db6f187c905506a1d6080c7a999566f94f11251c72473ea4412b63f981f5fbbe39646e8f05adb52e1fb75735df7884b9bb690fc74b3ca23997c5fccafeee8
SSDEEP 384:sVw3Eq1pwbs7FAZukFETfyI/SrXVehki/:s+Dr7AZukFG5/SpehX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 12b5dcb1bcd34922e5a30be9ff4bac172465b1a9f04550d37fe5701834254d0b
MD5 344d12a9954e7fb4c080fe76e7fca1dd
SHA1 fe6323f63eaa5524f69c5dac3b0090d8bc36bf7b
SHA512 b1c1966fb87ecd7024e5e9ab7ff55121bfa1bdf29274112c531802c5430e7287cd7e222824c787825489257101606e5c041172610cc60cce632471bd2852586b
SSDEEP 192:sVwRoyMqv/Ky0hl8M3pwbs78cwlwIuvornNoETfnsZLz1oZ8pzc/Y+WNE0WaVegm:sVw3EPpwbs7FAZuvFETfyI/SrXVehyiR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 a59e93848b8043eeb264480756e5365bfd785fb9b5b6e2065f44dd0ad1aab772
MD5 6515157c98a2f1e2fa2219b03ae31223
SHA1 90abb04195487d078f32f8ee03103c30749b5b9a
SHA512 bbf5b0ee2ddf4d74e7785edeccd8d1a747a9a84085676fec186ab763a1519a7e1f3cd180f14674e82c114719caf804b8c21ae92956ad1326114be80e251ac2f5
SSDEEP 768:hPAtA8/025y7pLtLz8bWRWf1QXJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3V0Z6Llo:hPAtA8/025K5z8bWRWf1QXJu1jaKV0Zv
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 60cd64b5b8784c191db238c02e46c881b70b336f78fcf4aa735ae7b7d0794bb6
MD5 871d33c995fc05d87f84ee155309cc3f
SHA1 12b1972ed11c8e1ee173876d7830f876b2aa528b
SHA512 5f9d4d445c63fb47d269657cc837d098008df8d81c6e81adaf0c701d7fb8bf31afd714990f7968ab158c37fb054d5e197c92a68ec68a750c7dfa468a76923caa
SSDEEP 96:58Kx2QKD7KfyPKDTKceWKGcK5iFK0mKdqbKLYKJKfmb/pRR+/hwPf+KxFVfIFYRi:zbHzIpeiHU
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 460B
SHA256 322d9841fac278960413a4e16686456e39db15791d26947cd9bf92329da13ac9
MD5 dd0d4e896e9d820adc39eaf57ef4a42b
SHA1 39518450ae25a087e5c9fef10991ecf4e9d507cc
SHA512 3a52a55a4c6b8cca1f558bc3de5d579e766e52c964d0a29ff39ca97917071219a9de597c0be67b300879234b489dee7cad7107fd865f759f7196bc7f3578ecaa
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 51KB
SHA256 93ec03612ae0ccabf45489ff9819d0a1ca4c6a781fd3a8662fee31cca13d098b
MD5 c68e20ce0898b638eb84acf1bf9e3ebb
SHA1 6816c53c27fdeba7f41bba57ecae2bdf7e17c51f
SHA512 e03aaee502b5bf49d7ac022eed7cc46d1d0f37de802c3fcb7dd91b506ada25fff0374334dd91d70926b6f1133d41ebac3fcf5a760661540e5562143fd6d2bc1f
SSDEEP 768:8FSE6esE8lDldUGN3/CgHn327kSfQ86HPuSQ48ox8qQmvO6Rp1qqAx8vyGRcv9h6:LeB85d13zTn2L9ogop1qqAxjlvK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8a3b39d36f42690d3f47248c3819c1961072c021d3221ad8edfdeb056cd17087
MD5 c535f0682c5a1ffca707431c120f5c62
SHA1 e5a3960f3bf70f995f610ceb57baf6f22f86300f
SHA512 1345c03fa7ee748c3367ba9de96cba9606b2ad2bdff2b5aeafebcc76266de3cd8f3c46ebcc7a2da12b486c6e923bf5632116f13bc82a36cec361a641f4f74c4b
SSDEEP 768:HFiE6esE8lDldUGs3/CgHF327kSfQ86HPuXQIAx8vyGRcv9hjyp1G44z:WeB85dk3NTn2gIAxjlvep1Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 0b54e63f29ee4d1cdef3a37c2a2ca0c94f962cd910b58417b023ad41efe97416
MD5 2ddaecea903b38bf5a43121904f36813
SHA1 d3ce8f565682bd08c8e9095753f92849eba5eb37
SHA512 111e9d57ee198fb906b828e873722874d8328a56c8cb7c221a8269f0b773cd96c97366711973303532f4b25fe276637ae4a17e4438318242950955f135f34f4d
SSDEEP 768:HFSE6esE8lDldUGs3/CgHF327kSfQ86HPuuQ48ox8qQmvO6Rp1qqAx8vyGRcv9h6:aeB85dk3NTn2n9ogop1qqAxjlvK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e384510b5a88de9e22c83164921c60b36c3ccbd2110891f97c22aeb0b55dc5c8
MD5 41ec24c954e0b4b6e4515f3e2c5e341f
SHA1 d910fc236756f9cf1b2c823665a080de5863e616
SHA512 145d5d847126a5f2f66e4bc7524c242c2915a80af1d4339de82aba8152ef3568a377a0ce2e44c2dc8955d33ad646cbf6db076c2ccad0addfe5e0791d0de4b078
SSDEEP 768:9FiE6esE8lDldUGz3UCgdvsF27kSfQ8eVcmzAx8vyGRcv9hjyp1P4z:keB85d73IGTdcmzAxjlvep1a
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.0a6b11a5b642bf6c1938189707e109a1f48eb02018cfb146f09e74a753567d1b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.0a6b11a5b642bf6c1938189707e109a1f48eb02018cfb146f09e74a753567d1b
Size 156KB
SHA256 0a6b11a5b642bf6c1938189707e109a1f48eb02018cfb146f09e74a753567d1b
MD5 b384b2c8acf11d0ca778ea05a710bc01
SHA1 4d3e01b65ed401b19e9d05e2218eeb01a0a65972
SHA512 272dd92a3efbf6cefe4b13127e09a9bd6455f5fc4913e7477c6712e4c3fd67efe87bd0d5bf1ec6b1e65f8d3aa0ac99d5bcf88d8a44d3f3116527253a01dde3be
SSDEEP 3072:REqT/cpnWG/Mrp/D8JSZJtO7ytDxzD0Obh9FyqnwKIBcrxavPh:6yknM9/rJtO7ytDxpysFISIvPh
MD5 SHA1 SHA512 SSDEEP

Submit Download

7sfNAmr7.sys

Path C:\Windows\System32\7sfNAmr7.sys
Size 5.5MB
SHA256 9b6b7e4b5f60a7f66bb0b8c54a41d71fb57ed215bad274bccf90267570aec3a0
MD5 3e3494686d4ae9e0e4c29dae2edc3b52
SHA1 0fc1c23f9311dc6e44b2a67242459db3fd609d4d
SHA512 48c630445b0398fe53237c13d3de010446dd80ac3e69d45fd4b6a4ad667c28af90957c4db8edc5c06c77491122667c2a6e4e6337d5d2f1cc2e282aa092713e3f
SSDEEP 98304:iLjINR0yk1kIy6s+siy+Y18p6ErmH09GZ3V6UUZD/V6wEXK0p0C/y+dH9:iL0rNgXylky+Y4b+ZZ3V6fd/V6wEhp06
MD5 SHA1 SHA512 SSDEEP

Submit Download

oOR8MqX9.sys

Path C:\Windows\System32\oOR8MqX9.sys
Size 25KB
SHA256 31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427
MD5 9ab9f3b75a2eb87fafb1b7361be9dfb3
SHA1 fe10018af723986db50701c8532df5ed98b17c39
SHA512 5b37fb591670329a6b030bd9d2cbee48e9d56c7c7d2752e6049f551d869298d1ec6cea6c83e0301699e0873d1fdf0c49b4a4092c6aca750dc23b1ab95dbd1ae8
SSDEEP 384:y+1TM02RprUzhy3aW0mJD/Mjch8JCPipnYPLK1M6j79SbC0N:91TMbYI3aW31MjHCPip1MmMbC0N
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1559682075\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1559682075\manifest.json
Size 84B
SHA256 2e9e6138305d702f3c9b89d6e9dc4931b548c69bb86db64e585fa2e37b8ef654
MD5 e0909520982fc48e47a6451443b11741
SHA1 0e46425274933c153ebf5a03f25e693267a8cea2
SHA512 3fdf504cb0bf39a807fa15a8ec31a6efd8083888692935ec31d70b4ef6eef89b8527c6a75a46bf7ae3efeeaa507ac3c7cccda5246a2f073ac603a7ffa10d20a8
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1683906830\manifest.json
Size 176B
SHA256 8a4800ed5f63b9371a024c501ee2b031af94539e32e6753214e6d99c625c018c
MD5 8177721150435a9b333475e2b8a6e691
SHA1 8aa8981617e8f3d8967a0a4a2d20315317eba293
SHA512 540c4c52030c6a4e1efcfab5eb59760c696bb3e3f1b8f93c97a6368639a911ba3d395190fc0798d99f3c63e25b6dcf2ded482bbda34d36ddd874dd20c2cfdf74
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_877732834\manifest.json
Size 119B
SHA256 1148c28e540b9b96237b35170a547a13165d6c7c039b8fff9e4b2cd774b92f5a
MD5 390af74c5ae643320cad0cef4fa8fee1
SHA1 22ce727f9bcff9a914eb1d58ba8384de6fbda7e1
SHA512 deaeeeffdddea1a9047e97d82e3bb701fb865adcd77ef9e985bb0ec5e4057155e7b83cad4f9f3dd256edf89f19d1075349cea5005dffff8420da4d0646be413a
MD5 SHA1 SHA512

Submit Download

memory/2152-0-0x0000000140000000-0x0000000140640000-memory.dmp

Download

memory/2152-401-0x0000000140000000-0x0000000140640000-memory.dmp

Download

memory/2152-3-0x0000000140000000-0x0000000140640000-memory.dmp

Download

memory/2152-2-0x0000000140000000-0x0000000140640000-memory.dmp

Download

memory/2152-1-0x0000000140000000-0x0000000140640000-memory.dmp

Download