Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM UnrealCEFSubProcess.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM EpicGamesLauncher.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM FortniteClient-Win64-Shipping.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM FortniteLauncher.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM FortniteClient-Win64-Shipping_BE.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM FortniteClient-Win64-Shipping_EAC.exe /T
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021081020210811\index.dat
- \device\harddiskvolume2
Deletes the following files
- %WINDIR%\logs\cbs\cbs.log
Network activity
Connects to
- 'ch###ing.win':80
- 'ch###ing.win':443
TCP
HTTP GET requests
- http://www.ch###ing.win/favicon.ico
Other
- 'ch###ing.win':443
UDP
- DNS ASK ch###ing.win
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c color 0b
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\UnrealEngine\4.23\Saved\Config\Windows\Manifest.ini
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\UnrealEngine\4.23\Saved\Config\Windows\*
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\UnrealEngine\4.25\Saved\Config\WindowsClient\*
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\index.txt
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Recent\trace.lnk
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Windows\Logs\CBS\CBS.log
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Windows\System32\eac_usermode_2277074302322.dll
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\04064286607c4c97b723d99d528c31f7\ClientSettings.Sav
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\Online_Client_Tracing_Log.json
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Windows\INF\oem7.PNF
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Windows\System32\LogFiles\WMI\RtBackup\EtwRTGraphicsPerfMonitorSession.etl
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Program Files (x86)\Common Files\BattlEye\BEDaisy.sys
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.ep#######.com_0.indexeddb.leveldb
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.ep#######.#####.indexeddb.leveldb\LOG.old~RF23c7f63.TMP
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000055
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Windows\ServiceState\EventLog\Data\lastalive0.dat
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\7a77559880614da4bc488cc46feb8d50.dat
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\EMS\*
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\Staged\7a77559880614da4bc488cc46feb8d50.dat
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\IECompatCache
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\History\Low\History.IE5
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\History\Low
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat\gamelauncher.log
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat\12\loader.log
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat\12\easyanticheat_wow64_x64.eac.metadata
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat\12\easyanticheat_wow64_x64.eac
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\L.%username%.cdp
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\L.defaultuser0.cdp
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\*
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\a0face1ee0264e23982a5b6a06c280c7\*
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Program Files (x86)\Common Files\BattlEye\BEService_fn.exe
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Program Files (x86)\Common Files\BattlEye\BEService.exe
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Programs\CrashReportClient\Content\Paks\CrashReportClient.pak
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\ProgramData\Intel\ShaderCache
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\GameDVR\KnownGameList.bin
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UE4CC-Windows-6245BE8A4D7AB47C4BC3CC8EEE4F7F55\CrashReportClient.ini
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UE4CC-Windows-6245BE8A4D7AB47C4BC3CC8EEE4F7F55
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK\FortniteClient-Win64-Shipping_4324.log
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%WindowsSystem32LogFilesWMIRtBackupEtwRTGraphicsPerfMonitorSession.etl
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\ProgramData\Intel\ShaderCache\dwm_1
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index-dir\temp-index
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Visited Links
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\LOG
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\000003.log
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_1
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\1988c03d-d144-44ab-a0b4-76b1d1e44...
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\0e93d303-040f-4e32-bcef-10a498edf...
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index-dir
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\Staged\a0face1ee0264e23982a5b6a06c280c7.dat
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\Staged
- '<SYSTEM32>\cmd.exe' /c @TASKKILL /F /IM FortniteClient-Win64-Shipping_EAC.exe /T
- '<SYSTEM32>\cmd.exe' /c @TASKKILL /F /IM FortniteClient-Win64-Shipping_BE.exe /T
- '<SYSTEM32>\cmd.exe' /c @TASKKILL /F /IM FortniteLauncher.exe /T
- '<SYSTEM32>\cmd.exe' /c @TASKKILL /F /IM FortniteClient-Win64-Shipping.exe /T
- '<SYSTEM32>\cmd.exe' /c @TASKKILL /F /IM EpicGamesLauncher.exe /T
- '<SYSTEM32>\cmd.exe' /c @TASKKILL /F /IM UnrealCEFSubProcess.exe /T
- '<SYSTEM32>\cmd.exe' /c cls
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\a0face1ee0264e23982a5b6a06c280c7.dat
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index-dir\the-real-index~RF65619d.TMP
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index-dir\the-real-index
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_0
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\*
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Input.ini
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\*
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\UnrealEngine\4.25\Saved\Config\WindowsClient\Manifest.ini
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\ProgramData\Intel\ShaderCache\*
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.ep#######.#om_0.indexeddb.leveldb\LOG
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher.log
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\EditorPerProjectUserSettings.ini
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Hardware.ini
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Lightmass.ini
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Compat.ini
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Game.ini
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_1
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\cef3.log
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cookies-journal
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cookies
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_www.ep#######.com_0.localstorage
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_www.ep#######.#om_0.localstorage-journal
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\QuotaManager-journal
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\QuotaManager
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_3
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_2
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\IECompatCache\Low
- '<SYSTEM32>\cmd.exe' /c del /f /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\IECompatUaCache
