Analysis
- geolocation tags
- user interaction
yes - max time kernel
598s - max time network
466s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
28/05/2026, 19:24
General
- Target https://www.mediafire.com/file/l0lfxz5i7gsuwu8/Fortnite_Woofer.exe/file
- Sample260528-x4r4hsb16w
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 1 IoCs
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of FindShellTrayWindow 44 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/l0lfxz5i7gsuwu8/Fortnite_Woofer.exe/file1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffc7580c188,0x7ffc7580c194,0x7ffc7580c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,2868373557726707336,1025165528472843754,524288 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,6552377259491339436,14813909700044646401,262144 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,4387184039136079419,15501353760631937852,524288 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,6513309383382960299,6020295908208063627,2097152 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2791768460610818338,17109613674297430734,2097152 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=1660 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,1312122425930798391,4292280913526857334,524288 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,1150073577831775207,10221879139047417624,524288 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,15764702347232692370,9293044795785526772,524288 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,15764702347232692370,9293044795785526772,524288 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6024,i,12142930643048823823,4403369207233935729,2097152 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,14569034358307659072,4957034173816544088,524288 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6496,i,1091130489131382050,15350230926216752524,2097152 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,11348254375057266230,6401848193084851873,524288 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile16⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=136,i,4491039522138927412,9286373106198527917,524288 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,2201610867821077077,17626296276573072668,524288 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,1260086582920919649,17889612710027995410,524288 --field-trial-handle=2312,i,10683413070488938974,11495877877643328400,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffc7580c188,0x7ffc7580c194,0x7ffc7580c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,2256150458446517403,2460381819546240801,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,8050911176088926691,10459110676134688040,262144 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,16988675665355931954,18256614534313402075,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,1378503956457983076,9452075002367319171,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,1378503956457983076,9452075002367319171,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,16552882649554526314,15455191089860783897,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,3642172652959044812,6624494840442644713,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,16566855069405168521,580925638997594745,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,14982764428813536218,6099775666989540586,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,17465303781673700972,750370092621334544,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4500,i,11157812614919127020,17638758590629772093,262144 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,6759598719388524344,3057922924537213495,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3004,i,1858115481060088015,17352176456812127152,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4080,i,574497067762062524,16189096667150646339,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,5410633836383161812,2484552619958918699,524288 --field-trial-handle=2336,i,3232185394359218313,15630543972408493455,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile11⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile12⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile13⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile14⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile15⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile16⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile17⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile18⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile19⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile20⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile21⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile22⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile23⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile24⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile25⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile26⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile27⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile28⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile29⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile30⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile31⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile32⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile33⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile34⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile35⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile36⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile37⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile38⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile39⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile40⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile41⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile42⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile43⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile44⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile45⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile46⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile47⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile48⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile49⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile50⤵
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile51⤵
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile52⤵
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile53⤵
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile54⤵
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile55⤵
-
C:\Users\Admin\Downloads\Fortnite Woofer.exe"C:\Users\Admin\Downloads\Fortnite Woofer.exe" -m pip install --upgrade requests psutil pywin32 pycryptodome browser-cookie3 opencv-python numpy pillow pyinstaller pefile56⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
the-real-index~RFe58b486.TMP
data_1
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_zstd.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
base_library.zip
libffi-8.dll
python3.dll
python314.dll
ucrtbase.dll
Fortnite Woofer.exe
miniwallet.bundle.js.LICENSE.txt
notification.bundle.js.LICENSE.txt
strings.json
memory/740-237-0x0000020A360E0000-0x0000020A370E0000-memory.dmp
memory/3460-904-0x000002975BEE0000-0x000002975CEE0000-memory.dmp