Analysis
-
max time kernel
20s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-01-2025 01:18
Behavioral task
behavioral1
Sample
FuckTheCore.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
FuckTheCore.exe
Resource
win10ltsc2021-20250113-en
General
-
Target
FuckTheCore.exe
-
Size
4.7MB
-
MD5
d442d703f5e157ebc8599c407d02121d
-
SHA1
9f5968b9a0e71744f0ccd750b093e1477faa6b75
-
SHA256
c486e1a0e7fd07b046d7bf229d49fae292a79663224472c77598fab95877611e
-
SHA512
8be12fd13f8a94c414760391e55291d6fa29d2358e64a8572a7c5de8dad9c9048f624abf32591ef925af679351aa0e36028f4303c53f9d3ab1443aa5d7e68baa
-
SSDEEP
49152:OK1A6CVYmiSrTsL1VON/giCnSJwDznaAkrGOTpr+y3Z3fM6sPAxBh4:OK1xUrTsBVvzaDGOlZ3fLsPm2
Malware Config
Signatures
-
Darkcomet family
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FuckTheCore.exe File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE File opened for modification C:\Windows\system32\drivers\etc\hosts FUCKTHECORE.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUCKTHECORE.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3168 FuckTheCore.exe Token: SeSecurityPrivilege 3168 FuckTheCore.exe Token: SeTakeOwnershipPrivilege 3168 FuckTheCore.exe Token: SeLoadDriverPrivilege 3168 FuckTheCore.exe Token: SeSystemProfilePrivilege 3168 FuckTheCore.exe Token: SeSystemtimePrivilege 3168 FuckTheCore.exe Token: SeProfSingleProcessPrivilege 3168 FuckTheCore.exe Token: SeIncBasePriorityPrivilege 3168 FuckTheCore.exe Token: SeCreatePagefilePrivilege 3168 FuckTheCore.exe Token: SeBackupPrivilege 3168 FuckTheCore.exe Token: SeRestorePrivilege 3168 FuckTheCore.exe Token: SeShutdownPrivilege 3168 FuckTheCore.exe Token: SeDebugPrivilege 3168 FuckTheCore.exe Token: SeSystemEnvironmentPrivilege 3168 FuckTheCore.exe Token: SeChangeNotifyPrivilege 3168 FuckTheCore.exe Token: SeRemoteShutdownPrivilege 3168 FuckTheCore.exe Token: SeUndockPrivilege 3168 FuckTheCore.exe Token: SeManageVolumePrivilege 3168 FuckTheCore.exe Token: SeImpersonatePrivilege 3168 FuckTheCore.exe Token: SeCreateGlobalPrivilege 3168 FuckTheCore.exe Token: 33 3168 FuckTheCore.exe Token: 34 3168 FuckTheCore.exe Token: 35 3168 FuckTheCore.exe Token: 36 3168 FuckTheCore.exe Token: SeIncreaseQuotaPrivilege 2540 FUCKTHECORE.EXE Token: SeSecurityPrivilege 2540 FUCKTHECORE.EXE Token: SeTakeOwnershipPrivilege 2540 FUCKTHECORE.EXE Token: SeLoadDriverPrivilege 2540 FUCKTHECORE.EXE Token: SeSystemProfilePrivilege 2540 FUCKTHECORE.EXE Token: SeSystemtimePrivilege 2540 FUCKTHECORE.EXE Token: SeProfSingleProcessPrivilege 2540 FUCKTHECORE.EXE Token: SeIncBasePriorityPrivilege 2540 FUCKTHECORE.EXE Token: SeCreatePagefilePrivilege 2540 FUCKTHECORE.EXE Token: SeBackupPrivilege 2540 FUCKTHECORE.EXE Token: SeRestorePrivilege 2540 FUCKTHECORE.EXE Token: SeShutdownPrivilege 2540 FUCKTHECORE.EXE Token: SeDebugPrivilege 2540 FUCKTHECORE.EXE Token: SeSystemEnvironmentPrivilege 2540 FUCKTHECORE.EXE Token: SeChangeNotifyPrivilege 2540 FUCKTHECORE.EXE Token: SeRemoteShutdownPrivilege 2540 FUCKTHECORE.EXE Token: SeUndockPrivilege 2540 FUCKTHECORE.EXE Token: SeManageVolumePrivilege 2540 FUCKTHECORE.EXE Token: SeImpersonatePrivilege 2540 FUCKTHECORE.EXE Token: SeCreateGlobalPrivilege 2540 FUCKTHECORE.EXE Token: 33 2540 FUCKTHECORE.EXE Token: 34 2540 FUCKTHECORE.EXE Token: 35 2540 FUCKTHECORE.EXE Token: 36 2540 FUCKTHECORE.EXE Token: SeIncreaseQuotaPrivilege 4720 FUCKTHECORE.EXE Token: SeSecurityPrivilege 4720 FUCKTHECORE.EXE Token: SeTakeOwnershipPrivilege 4720 FUCKTHECORE.EXE Token: SeLoadDriverPrivilege 4720 FUCKTHECORE.EXE Token: SeSystemProfilePrivilege 4720 FUCKTHECORE.EXE Token: SeSystemtimePrivilege 4720 FUCKTHECORE.EXE Token: SeProfSingleProcessPrivilege 4720 FUCKTHECORE.EXE Token: SeIncBasePriorityPrivilege 4720 FUCKTHECORE.EXE Token: SeCreatePagefilePrivilege 4720 FUCKTHECORE.EXE Token: SeBackupPrivilege 4720 FUCKTHECORE.EXE Token: SeRestorePrivilege 4720 FUCKTHECORE.EXE Token: SeShutdownPrivilege 4720 FUCKTHECORE.EXE Token: SeDebugPrivilege 4720 FUCKTHECORE.EXE Token: SeSystemEnvironmentPrivilege 4720 FUCKTHECORE.EXE Token: SeChangeNotifyPrivilege 4720 FUCKTHECORE.EXE Token: SeRemoteShutdownPrivilege 4720 FUCKTHECORE.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3168 FuckTheCore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3168 wrote to memory of 2540 3168 FuckTheCore.exe 77 PID 3168 wrote to memory of 2540 3168 FuckTheCore.exe 77 PID 3168 wrote to memory of 2540 3168 FuckTheCore.exe 77 PID 2540 wrote to memory of 4720 2540 FUCKTHECORE.EXE 78 PID 2540 wrote to memory of 4720 2540 FUCKTHECORE.EXE 78 PID 2540 wrote to memory of 4720 2540 FUCKTHECORE.EXE 78 PID 4720 wrote to memory of 244 4720 FUCKTHECORE.EXE 79 PID 4720 wrote to memory of 244 4720 FUCKTHECORE.EXE 79 PID 4720 wrote to memory of 244 4720 FUCKTHECORE.EXE 79 PID 3168 wrote to memory of 228 3168 FuckTheCore.exe 80 PID 3168 wrote to memory of 228 3168 FuckTheCore.exe 80 PID 3168 wrote to memory of 228 3168 FuckTheCore.exe 80 PID 3168 wrote to memory of 2012 3168 FuckTheCore.exe 81 PID 3168 wrote to memory of 2012 3168 FuckTheCore.exe 81 PID 244 wrote to memory of 4048 244 FUCKTHECORE.EXE 82 PID 244 wrote to memory of 4048 244 FUCKTHECORE.EXE 82 PID 244 wrote to memory of 4048 244 FUCKTHECORE.EXE 82 PID 4048 wrote to memory of 3988 4048 FUCKTHECORE.EXE 233 PID 4048 wrote to memory of 3988 4048 FUCKTHECORE.EXE 233 PID 4048 wrote to memory of 3988 4048 FUCKTHECORE.EXE 233 PID 3988 wrote to memory of 3580 3988 FUCKTHECORE.EXE 84 PID 3988 wrote to memory of 3580 3988 FUCKTHECORE.EXE 84 PID 3988 wrote to memory of 3580 3988 FUCKTHECORE.EXE 84 PID 3580 wrote to memory of 3912 3580 FUCKTHECORE.EXE 155 PID 3580 wrote to memory of 3912 3580 FUCKTHECORE.EXE 155 PID 3580 wrote to memory of 3912 3580 FUCKTHECORE.EXE 155 PID 3912 wrote to memory of 4876 3912 FUCKTHECORE.EXE 266 PID 3912 wrote to memory of 4876 3912 FUCKTHECORE.EXE 266 PID 3912 wrote to memory of 4876 3912 FUCKTHECORE.EXE 266 PID 4876 wrote to memory of 2416 4876 FUCKTHECORE.EXE 87 PID 4876 wrote to memory of 2416 4876 FUCKTHECORE.EXE 87 PID 4876 wrote to memory of 2416 4876 FUCKTHECORE.EXE 87 PID 2416 wrote to memory of 1608 2416 FUCKTHECORE.EXE 88 PID 2416 wrote to memory of 1608 2416 FUCKTHECORE.EXE 88 PID 2416 wrote to memory of 1608 2416 FUCKTHECORE.EXE 88 PID 1608 wrote to memory of 3160 1608 FUCKTHECORE.EXE 318 PID 1608 wrote to memory of 3160 1608 FUCKTHECORE.EXE 318 PID 1608 wrote to memory of 3160 1608 FUCKTHECORE.EXE 318 PID 3160 wrote to memory of 1096 3160 FUCKTHECORE.EXE 90 PID 3160 wrote to memory of 1096 3160 FUCKTHECORE.EXE 90 PID 3160 wrote to memory of 1096 3160 FUCKTHECORE.EXE 90 PID 1096 wrote to memory of 2440 1096 FUCKTHECORE.EXE 91 PID 1096 wrote to memory of 2440 1096 FUCKTHECORE.EXE 91 PID 1096 wrote to memory of 2440 1096 FUCKTHECORE.EXE 91 PID 2440 wrote to memory of 2484 2440 FUCKTHECORE.EXE 321 PID 2440 wrote to memory of 2484 2440 FUCKTHECORE.EXE 321 PID 2440 wrote to memory of 2484 2440 FUCKTHECORE.EXE 321 PID 2484 wrote to memory of 2884 2484 FUCKTHECORE.EXE 93 PID 2484 wrote to memory of 2884 2484 FUCKTHECORE.EXE 93 PID 2484 wrote to memory of 2884 2484 FUCKTHECORE.EXE 93 PID 2884 wrote to memory of 1112 2884 FUCKTHECORE.EXE 94 PID 2884 wrote to memory of 1112 2884 FUCKTHECORE.EXE 94 PID 2884 wrote to memory of 1112 2884 FUCKTHECORE.EXE 94 PID 1112 wrote to memory of 4644 1112 FUCKTHECORE.EXE 95 PID 1112 wrote to memory of 4644 1112 FUCKTHECORE.EXE 95 PID 1112 wrote to memory of 4644 1112 FUCKTHECORE.EXE 95 PID 4644 wrote to memory of 4052 4644 FUCKTHECORE.EXE 167 PID 4644 wrote to memory of 4052 4644 FUCKTHECORE.EXE 167 PID 4644 wrote to memory of 4052 4644 FUCKTHECORE.EXE 167 PID 4052 wrote to memory of 2140 4052 FUCKTHECORE.EXE 97 PID 4052 wrote to memory of 2140 4052 FUCKTHECORE.EXE 97 PID 4052 wrote to memory of 2140 4052 FUCKTHECORE.EXE 97 PID 2140 wrote to memory of 5072 2140 FUCKTHECORE.EXE 98 PID 2140 wrote to memory of 5072 2140 FUCKTHECORE.EXE 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\FuckTheCore.exe"C:\Users\Admin\AppData\Local\Temp\FuckTheCore.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"4⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"5⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"6⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"7⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"9⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"10⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"11⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"12⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"13⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"14⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"15⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"17⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"18⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"19⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"20⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"21⤵
- System Location Discovery: System Language Discovery
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"22⤵
- System Location Discovery: System Language Discovery
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"23⤵
- Drops file in Drivers directory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"24⤵
- Drops file in Drivers directory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"25⤵
- Drops file in Drivers directory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"26⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"27⤵
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"28⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"29⤵
- Drops file in Drivers directory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"30⤵
- Drops file in Drivers directory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"31⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"32⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"33⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"34⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"35⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"36⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"37⤵
- System Location Discovery: System Language Discovery
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"38⤵
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"39⤵
- System Location Discovery: System Language Discovery
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"40⤵
- System Location Discovery: System Language Discovery
PID:244 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"41⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"42⤵
- System Location Discovery: System Language Discovery
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"43⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"44⤵
- Drops file in Drivers directory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"45⤵
- Drops file in Drivers directory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"46⤵
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"47⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"48⤵
- Drops file in Drivers directory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"49⤵
- System Location Discovery: System Language Discovery
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"50⤵
- System Location Discovery: System Language Discovery
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"51⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"52⤵
- Drops file in Drivers directory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"53⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"54⤵
- Drops file in Drivers directory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"55⤵
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"56⤵
- Drops file in Drivers directory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"57⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"58⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"59⤵
- Drops file in Drivers directory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"60⤵
- System Location Discovery: System Language Discovery
PID:764 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"61⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"62⤵
- Drops file in Drivers directory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"63⤵
- System Location Discovery: System Language Discovery
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"64⤵
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"65⤵
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"66⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"67⤵
- System Location Discovery: System Language Discovery
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"68⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"69⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"70⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"71⤵
- Drops file in Drivers directory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"72⤵
- System Location Discovery: System Language Discovery
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"73⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"74⤵
- Drops file in Drivers directory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"75⤵
- System Location Discovery: System Language Discovery
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"76⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"77⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"78⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"79⤵
- Drops file in Drivers directory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"80⤵
- Drops file in Drivers directory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"81⤵
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"82⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"83⤵
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"84⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"85⤵
- System Location Discovery: System Language Discovery
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"86⤵
- Drops file in Drivers directory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"87⤵
- Drops file in Drivers directory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"88⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"89⤵
- Drops file in Drivers directory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"90⤵
- System Location Discovery: System Language Discovery
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"91⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"92⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"93⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"94⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"95⤵
- Drops file in Drivers directory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"96⤵
- Drops file in Drivers directory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"97⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"98⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"99⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"100⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"101⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"102⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"103⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"104⤵
- Drops file in Drivers directory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"105⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"106⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"107⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"108⤵
- System Location Discovery: System Language Discovery
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"109⤵
- Drops file in Drivers directory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"110⤵
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"111⤵
- System Location Discovery: System Language Discovery
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"112⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"114⤵
- Drops file in Drivers directory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"115⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"116⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"117⤵
- Drops file in Drivers directory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"118⤵
- Drops file in Drivers directory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"119⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"120⤵
- Drops file in Drivers directory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"121⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"C:\Users\Admin\AppData\Local\Temp\FUCKTHECORE.EXE"122⤵PID:2524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-