cerber | d16a7994d5bb51ea77a2dee74c09cd8ad23d6f812372e17c216c34ba6cf23826

Resubmissions

25/03/2025, 00:32

250325-avmq4sytht 10

25/03/2025, 00:31

250325-ave19ssjz5 3

Analysis

max time kernel
83s
max time network
74s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
25/03/2025, 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wolf_Woofer_FREE v3.7.exe
Size

1.6MB
MD5

23119593e91f22d4a585f26d0363d968
SHA1

83aca1d89f48fcc5537daa2c958cb29411958c6a
SHA256

d16a7994d5bb51ea77a2dee74c09cd8ad23d6f812372e17c216c34ba6cf23826
SHA512

7002a39052466cf7ff29484d94f5321b8965615efb4f8fe691a829ef48719366f43ea20e1158dff43e9113f22f64b52f48ba6fe57e42a87e3dea8ded31593a7a
SSDEEP

49152:ZomiJqMHLl1b1uHIY/NmDDBGs5KGLhUlC2GQvPb:5iJXf8HT/NGDB1/2r

Score

10^/10

cerber discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Cerber family
cerber

Executes dropped EXE 7 IoCs

pid	Process
3972	WOLF.exe
5996	WOLF.exe
1168	WOLF.exe
2904	WOLF.exe
6016	WOLF.exe
1108	DutyCleaner.exe
728	DutyCleaner.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	DutyCleaner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	DutyCleaner.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\E:	cmd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\rtucx21x64.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_system.inf	cmd.exe
File opened for modification	C:\Windows\INF\digitalmediadevice.inf	cmd.exe
File opened for modification	C:\Windows\INF\ehstorpwddrv.inf	cmd.exe
File opened for modification	C:\Windows\INF\gameport.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmntt1.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmolic.inf	cmd.exe
File opened for modification	C:\Windows\INF\bcmfn2.inf	cmd.exe
File opened for modification	C:\Windows\INF\display.inf	cmd.exe
File opened for modification	C:\Windows\INF\HelloFace.inf	cmd.exe
File opened for modification	C:\Windows\INF\ialpssi_gpio.inf	cmd.exe
File opened for modification	C:\Windows\INF\MSDTC\msdtcprf.h	cmd.exe
File opened for modification	C:\Windows\INF\msux64w10.inf	cmd.exe
File opened for modification	C:\Windows\INF\netwtw06.inf	cmd.exe
File opened for modification	C:\Windows\INF\rdyboost\0000\ReadyBoostPerfCounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~2.0\0C0A\_ServiceModelOperationPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\c_fsquotamgmt.inf	cmd.exe
File opened for modification	C:\Windows\INF\mshidkmdf.inf	cmd.exe
File opened for modification	C:\Windows\INF\netvg63a.inf	cmd.exe
File opened for modification	C:\Windows\INF\pcmcia.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmpn1.inf	cmd.exe
File opened for modification	C:\Windows\INF\.NETFramework\0000\corperfmonsymbols_d.ini	cmd.exe
File opened for modification	C:\Windows\INF\ESENT\0411\esentprf.ini	cmd.exe
File opened for modification	C:\Windows\INF\mdmmhzel.inf	cmd.exe
File opened for modification	C:\Windows\INF\rdyboost\0407\ReadyBoostPerfCounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\SMSvcHost 4.0.0.0\_SMSvcHostPerfCounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\WINDOW~1.0\0410\PerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\wvmbusvideo.inf	cmd.exe
File opened for modification	C:\Windows\INF\audioendpoint.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmsun2.inf	cmd.exe
File opened for modification	C:\Windows\INF\WINDOW~1.0\0409\PerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\.NET CLR Data\040C\_DataPerfCounters_d.ini	cmd.exe
File opened for modification	C:\Windows\INF\MSDTCB~1.0\0000\_TransactionBridgePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\MSDTCB~1.0\0410\_TransactionBridgePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\mdm5674a.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmsier.inf	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~3.0\0409\_ServiceModelServicePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\termmou.inf	cmd.exe
File opened for modification	C:\Windows\INF\netmlx4eth63.inf	cmd.exe
File opened for modification	C:\Windows\INF\rdyboost\040C\ReadyBoostPerfCounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\iaLPSS2i_I2C_GLK.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmairte.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmgcs.inf	cmd.exe
File opened for modification	C:\Windows\INF\UGatherer\040C\gsrvctr.ini	cmd.exe
File opened for modification	C:\Windows\INF\c_battery.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_sdhost.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdm5674a.inf	cmd.exe
File opened for modification	C:\Windows\INF\MSDTCB~1.0\0411\_TransactionBridgePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\TAPISRV\040C\tapiperf.ini	cmd.exe
File opened for modification	C:\Windows\INF\MSDTC Bridge 4.0.0.0\0410\_TransactionBridgePerfCounters_d.ini	cmd.exe
File opened for modification	C:\Windows\INF\c_fscontinuousbackup.inf	cmd.exe
File opened for modification	C:\Windows\INF\netnwifi.inf	cmd.exe
File opened for modification	C:\Windows\INF\netrtwlane01.inf	cmd.exe
File opened for modification	C:\Windows\INF\rdyboost\ReadyBoostPerfCounters.h	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~2.0\0407\_ServiceModelOperationPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\mdmatm2k.inf	cmd.exe
File opened for modification	C:\Windows\INF\netrtwlane.inf	cmd.exe
File opened for modification	C:\Windows\INF\nulhpopr.inf	cmd.exe
File opened for modification	C:\Windows\INF\PerceptionSimulationSixDofModels.inf	cmd.exe
File opened for modification	C:\Windows\INF\pmem.inf	cmd.exe
File opened for modification	C:\Windows\INF\WINDOW~1.0\040C\PerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\cht4nulx64.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmmct.inf	cmd.exe
File opened for modification	C:\Windows\INF\3ware.inf	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2256	powershell.exe
4404	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wolf_Woofer_FREE v3.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 38 IoCs

defense_evasion

pid	Process
5324	taskkill.exe
2824	taskkill.exe
5704	taskkill.exe
3048	taskkill.exe
5920	taskkill.exe
5512	taskkill.exe
4576	taskkill.exe
2184	taskkill.exe
1176	taskkill.exe
3784	taskkill.exe
2900	taskkill.exe
5612	taskkill.exe
1468	taskkill.exe
3264	taskkill.exe
1976	taskkill.exe
860	taskkill.exe
5516	taskkill.exe
5908	taskkill.exe
1852	taskkill.exe
3484	taskkill.exe
2880	taskkill.exe
4960	taskkill.exe
4620	taskkill.exe
6124	taskkill.exe
4056	taskkill.exe
4408	taskkill.exe
4660	taskkill.exe
4572	taskkill.exe
5440	taskkill.exe
5696	taskkill.exe
5944	taskkill.exe
5424	taskkill.exe
2940	taskkill.exe
4564	taskkill.exe
832	taskkill.exe
2172	taskkill.exe
3248	taskkill.exe
4736	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3972	WOLF.exe
3972	WOLF.exe
5996	WOLF.exe
5996	WOLF.exe
1168	WOLF.exe
1168	WOLF.exe
2904	WOLF.exe
2904	WOLF.exe
6016	WOLF.exe
6016	WOLF.exe
2256	powershell.exe
2256	powershell.exe
4404	powershell.exe
4404	powershell.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	Wolf_Woofer_FREE v3.7.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	4660	taskkill.exe
Token: SeDebugPrivilege	5324	taskkill.exe
Token: SeDebugPrivilege	860	taskkill.exe
Token: SeDebugPrivilege	4572	taskkill.exe
Token: SeDebugPrivilege	5944	taskkill.exe
Token: SeDebugPrivilege	1176	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	5440	taskkill.exe
Token: SeDebugPrivilege	5516	taskkill.exe
Token: SeDebugPrivilege	832	taskkill.exe
Token: SeDebugPrivilege	5908	taskkill.exe
Token: SeDebugPrivilege	1852	taskkill.exe
Token: SeDebugPrivilege	3484	taskkill.exe
Token: SeDebugPrivilege	3784	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	5704	taskkill.exe
Token: SeDebugPrivilege	6124	taskkill.exe
Token: SeDebugPrivilege	5612	taskkill.exe
Token: SeDebugPrivilege	2172	taskkill.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	5424	taskkill.exe
Token: SeDebugPrivilege	3248	taskkill.exe
Token: SeDebugPrivilege	2880	taskkill.exe
Token: SeDebugPrivilege	5696	taskkill.exe
Token: SeDebugPrivilege	1468	taskkill.exe
Token: SeDebugPrivilege	3264	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	4056	taskkill.exe
Token: SeDebugPrivilege	4564	taskkill.exe
Token: SeDebugPrivilege	4960	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	4736	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	5920	taskkill.exe
Token: SeDebugPrivilege	1976	taskkill.exe
Token: SeDebugPrivilege	5512	taskkill.exe
Token: SeDebugPrivilege	4576	taskkill.exe
Token: SeDebugPrivilege	2184	taskkill.exe
Token: SeDebugPrivilege	4620	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1072	1004	Wolf_Woofer_FREE v3.7.exe	85
PID 1004 wrote to memory of 1072	1004	Wolf_Woofer_FREE v3.7.exe	85
PID 1004 wrote to memory of 1072	1004	Wolf_Woofer_FREE v3.7.exe	85
PID 1072 wrote to memory of 5188	1072	cmd.exe	87
PID 1072 wrote to memory of 5188	1072	cmd.exe	87
PID 1072 wrote to memory of 5188	1072	cmd.exe	87
PID 5188 wrote to memory of 5220	5188	net.exe	88
PID 5188 wrote to memory of 5220	5188	net.exe	88
PID 5188 wrote to memory of 5220	5188	net.exe	88
PID 1072 wrote to memory of 3972	1072	cmd.exe	89
PID 1072 wrote to memory of 3972	1072	cmd.exe	89
PID 1072 wrote to memory of 5996	1072	cmd.exe	90
PID 1072 wrote to memory of 5996	1072	cmd.exe	90
PID 1072 wrote to memory of 1168	1072	cmd.exe	91
PID 1072 wrote to memory of 1168	1072	cmd.exe	91
PID 1072 wrote to memory of 2904	1072	cmd.exe	92
PID 1072 wrote to memory of 2904	1072	cmd.exe	92
PID 1072 wrote to memory of 6016	1072	cmd.exe	93
PID 1072 wrote to memory of 6016	1072	cmd.exe	93
PID 1004 wrote to memory of 1108	1004	Wolf_Woofer_FREE v3.7.exe	94
PID 1004 wrote to memory of 1108	1004	Wolf_Woofer_FREE v3.7.exe	94
PID 1108 wrote to memory of 4928	1108	DutyCleaner.exe	95
PID 1108 wrote to memory of 4928	1108	DutyCleaner.exe	95
PID 4928 wrote to memory of 1972	4928	cmd.exe	97
PID 4928 wrote to memory of 1972	4928	cmd.exe	97
PID 1972 wrote to memory of 2128	1972	net.exe	98
PID 1972 wrote to memory of 2128	1972	net.exe	98
PID 4928 wrote to memory of 2256	4928	cmd.exe	99
PID 4928 wrote to memory of 2256	4928	cmd.exe	99
PID 1004 wrote to memory of 5872	1004	Wolf_Woofer_FREE v3.7.exe	100
PID 1004 wrote to memory of 5872	1004	Wolf_Woofer_FREE v3.7.exe	100
PID 1004 wrote to memory of 5872	1004	Wolf_Woofer_FREE v3.7.exe	100
PID 1004 wrote to memory of 5732	1004	Wolf_Woofer_FREE v3.7.exe	103
PID 1004 wrote to memory of 5732	1004	Wolf_Woofer_FREE v3.7.exe	103
PID 1004 wrote to memory of 5732	1004	Wolf_Woofer_FREE v3.7.exe	103
PID 5872 wrote to memory of 4660	5872	cmd.exe	102
PID 5872 wrote to memory of 4660	5872	cmd.exe	102
PID 5872 wrote to memory of 4660	5872	cmd.exe	102
PID 5872 wrote to memory of 5324	5872	cmd.exe	105
PID 5872 wrote to memory of 5324	5872	cmd.exe	105
PID 5872 wrote to memory of 5324	5872	cmd.exe	105
PID 5872 wrote to memory of 860	5872	cmd.exe	106
PID 5872 wrote to memory of 860	5872	cmd.exe	106
PID 5872 wrote to memory of 860	5872	cmd.exe	106
PID 5872 wrote to memory of 4572	5872	cmd.exe	107
PID 5872 wrote to memory of 4572	5872	cmd.exe	107
PID 5872 wrote to memory of 4572	5872	cmd.exe	107
PID 5872 wrote to memory of 5944	5872	cmd.exe	108
PID 5872 wrote to memory of 5944	5872	cmd.exe	108
PID 5872 wrote to memory of 5944	5872	cmd.exe	108
PID 5872 wrote to memory of 1176	5872	cmd.exe	109
PID 5872 wrote to memory of 1176	5872	cmd.exe	109
PID 5872 wrote to memory of 1176	5872	cmd.exe	109
PID 5872 wrote to memory of 2824	5872	cmd.exe	110
PID 5872 wrote to memory of 2824	5872	cmd.exe	110
PID 5872 wrote to memory of 2824	5872	cmd.exe	110
PID 5872 wrote to memory of 5440	5872	cmd.exe	111
PID 5872 wrote to memory of 5440	5872	cmd.exe	111
PID 5872 wrote to memory of 5440	5872	cmd.exe	111
PID 5872 wrote to memory of 5516	5872	cmd.exe	112
PID 5872 wrote to memory of 5516	5872	cmd.exe	112
PID 5872 wrote to memory of 5516	5872	cmd.exe	112
PID 5872 wrote to memory of 832	5872	cmd.exe	113
PID 5872 wrote to memory of 832	5872	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\Wolf_Woofer_FREE v3.7.exe
"C:\Users\Admin\AppData\Local\Temp\Wolf_Woofer_FREE v3.7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\KillaSpoof.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5188
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:5220
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /BM "To Be Filled By O.E.M."
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3972
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /SM "To Be Filled By O.E.M."
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5996
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /SS "W1528827127"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1168
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /BS "W1110526213"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2904
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /BP "W1959121956-73Z-1729626706-XN20359"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:6016
- C:\Users\Public\Documents\DutyCleaner\DutyCleaner.exe
  "C:\Users\Public\Documents\DutyCleaner\DutyCleaner.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "Duty Cleaner.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\system32\net.exe
      NET SESSION
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1972
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 SESSION
        5⤵
        
        PID:2128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; $xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText01); $text = $xml.CreateTextNode('Thank you for using the program!'); $xml.GetElementsByTagName('text').AppendChild($text); $toast = [Windows.UI.Notifications.ToastNotification]::new($xml); [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('Duty Cleaning Program').Show($toast);"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im epicgameslauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im UnrealCEFSubProcess.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im CEFProcess.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im EasyAntiCheat.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BEService.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BEServices.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BattleEye.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1816
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /b ::: "C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\DutyCleaner\FortnitecleanerSmall.bat" "
  2⤵
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im epicgameslauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2972
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:616
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3916
- C:\Users\Public\Documents\DutyCleaner\DutyCleaner.exe
  "C:\Users\Public\Documents\DutyCleaner\DutyCleaner.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:728
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "Duty Cleaner.bat"
    3⤵
    PID:5888
  - - C:\Windows\system32\net.exe
      NET SESSION
      4⤵
      PID:6004
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 SESSION
        5⤵
        
        PID:2568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; $xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText01); $text = $xml.CreateTextNode('Thank you for using the program!'); $xml.GetElementsByTagName('text').AppendChild($text); $toast = [Windows.UI.Notifications.ToastNotification]::new($xml); [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('Duty Cleaning Program').Show($toast);"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im epicgameslauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im UnrealCEFSubProcess.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im CEFProcess.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im EasyAntiCheat.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BEService.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BEServices.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BattleEye.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2224
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /b ::: "C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\DutyCleaner\FortnitecleanerSmall.bat" "
  2⤵
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im epicgameslauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4620
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1036
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3240
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
2e8d916333868aa91655b02320b95bcd

SHA1
7a4359b4f695466dc73b67ce3787bcef3fb17913

SHA256
63fe189fccf7be8d06342953d3d4138ec96f252b55f28a90f8745a18387276cf

SHA512
2f9e76f0d97e2591497ea3ab5729ac3c23e11319d526a2434b7e0a450e58bc4136b047a5294698a5a04fd7f4cc0bad5fd97595445773c4d18fe6a66affe95191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
2KB

MD5
a35679fff243bb1b9e5835d5b5474048

SHA1
cdcca82b5bd2ee70d9a7ec93b5902bcf311b5164

SHA256
9ba9ca498e17245b59806c2e7aae1b62fbd107af8862b1b19bddc7d79c7c6e28

SHA512
f500f05e336ceb2550123ab38f44d710ab771e87b8405d72d184065fe7e57f06022664372adeabf1d046e148d00393160b7c1591ecb53827bc729e2da27e2157

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Duty Cleaner.bat

Filesize
208KB

MD5
00375ee83226cbdd0e8bc5f2c71aa38d

SHA1
0ff7ea34203a1729140f2429358bc58aa28e5bb2

SHA256
dd97aed20239f8546bfab3556a04426b80b263f04e8436264c4213043919249f

SHA512
a8587b43a10b015746cfc519362d1402c9cb09f4d932cf9e1d2fc1d2bcb7b9b76f8747057606d75ff15782ba5de9919ec0f63a515ba6673536e2e989923111c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0e5wjw3o.3mr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\KillaSpoof.bat

Filesize
1KB

MD5
44d499f2de89cb19a6c55cde1dddfdcc

SHA1
09122b371d901d298552ff699667f0a1e0cf6f09

SHA256
93ba415a352cf208331ec65718f16de18f040a9f613595427f6f7e176cbebc69

SHA512
cb76943ba6ee361f56e25d8fd59fa9933ea4f350782511312834ddf582f804001bf00ba3697e55301481f6b1de6f3023da8d8468e76da953d77a7fde65200926

Download Submit
C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe

Filesize
4.9MB

MD5
b7219857e8e1305def7a814ad27f5fb5

SHA1
b41ee7cf66e7cfbc19764c1ca5bbddcc6141e0bb

SHA256
c3d568da2c0055824bfc629de90970014fe15164693f7acc478dc7e06891516f

SHA512
fa35a119b73e9fba4dad22966f5a13ae5486931c1f1559ec7e0e4fbf4523d5b463407c7058254fdc5160352cd668bf3ae55dbb352a1276704233d5e313dcd9fd

Download Submit
C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\amifldrv64.sys

Filesize
18KB

MD5
785045f8b25cd2e937ddc6b09debe01a

SHA1
029c678674f482ababe8bbfdb93152392457109d

SHA256
37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

SHA512
40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9

Download Submit
C:\Users\Public\Documents\DutyCleaner\DutyCleaner.exe

Filesize
190KB

MD5
b51c7b53dc6f6119198f306493affb6d

SHA1
1fa6013669ce756dd09fe03fc192136cbe13daaf

SHA256
1243ca1244a25b33fae69e0525b8b3e17f059323cba2d2586c6247d33b602f50

SHA512
42460a6d3923aae34f6bb4f2616ebb9e3bd8551095d594eb6625fcc740223c3561b45ae9a62ca54b8e8bceaea3dde8def06123f345d2250b322deb13a45cded5

Download Submit
C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat

Filesize
1.5MB

MD5
9f11b2a3e7a02c82b93a629b3be3e1d0

SHA1
c838319bd14ea3c31d48d236a8f63ad826c89a17

SHA256
8f9d69d08d71c182799f59f851231193bd5da5ac4a0a11f19543080dbf0525ba

SHA512
a90399e751bc58ffec2b721483fe8438bf1b1537ff9fffeae37beebd6354ca92d11c240d2cd92d16689c4986fc7a0e17031f9447737245ad5bfce210a99c709a

Download Submit
C:\Users\Public\Documents\DutyCleaner\FortnitecleanerSmall.bat

Filesize
41KB

MD5
defa26d378888c30e48eba0f049cea6f

SHA1
f748c93804b2ecd67f214b7506f45f8569c25563

SHA256
cd7f44c3574c63897307d9e6ab7164733b1a8289c26882fc806c68fe3ec4ab9f

SHA512
43a9ad2f6f0a794e77c4ec69da360761a8bc26d18d6e0e5775b408b7146d80030bbfa6a0d9aa1682fc9c1336d4ac7107598a1105a891489adeebcd6e3d6f6982

Download Submit
memory/1004-31-0x0000000075160000-0x0000000075911000-memory.dmp

Filesize
7.7MB

Download
memory/1004-10-0x000000000A420000-0x000000000A42A000-memory.dmp

Filesize
40KB

Download
memory/1004-6-0x000000007516E000-0x000000007516F000-memory.dmp

Filesize
4KB

Download
memory/1004-5-0x0000000075160000-0x0000000075911000-memory.dmp

Filesize
7.7MB

Download
memory/1004-7-0x0000000075160000-0x0000000075911000-memory.dmp

Filesize
7.7MB

Download
memory/1004-1-0x0000000000D70000-0x0000000000F08000-memory.dmp

Filesize
1.6MB

Download
memory/1004-2-0x0000000005F40000-0x00000000064E6000-memory.dmp

Filesize
5.6MB

Download
memory/1004-3-0x0000000005A30000-0x0000000005AC2000-memory.dmp

Filesize
584KB

Download
memory/1004-0-0x000000007516E000-0x000000007516F000-memory.dmp

Filesize
4KB

Download
memory/1004-12-0x000000000A650000-0x000000000A662000-memory.dmp

Filesize
72KB

Download
memory/1004-9-0x0000000075160000-0x0000000075911000-memory.dmp

Filesize
7.7MB

Download
memory/1004-4-0x00000000059C0000-0x00000000059CA000-memory.dmp

Filesize
40KB

Download
memory/1004-8-0x0000000009AC0000-0x0000000009B26000-memory.dmp

Filesize
408KB

Download
memory/1168-42-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/2256-79-0x0000021554370000-0x00000215543E6000-memory.dmp

Filesize
472KB

Download
memory/2256-83-0x0000021554070000-0x000002155408E000-memory.dmp

Filesize
120KB

Download
memory/2256-78-0x0000021553B80000-0x0000021553B88000-memory.dmp

Filesize
32KB

Download
memory/2256-73-0x0000021553C10000-0x0000021553C32000-memory.dmp

Filesize
136KB

Download
memory/2256-77-0x0000021553B70000-0x0000021553B7A000-memory.dmp

Filesize
40KB

Download
memory/2904-47-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/3972-26-0x000000014007B000-0x000000014038F000-memory.dmp

Filesize
3.1MB

Download
memory/3972-34-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/3972-33-0x000000014007B000-0x000000014038F000-memory.dmp

Filesize
3.1MB

Download
memory/3972-27-0x00007FFAD8B30000-0x00007FFAD8B32000-memory.dmp

Filesize
8KB

Download
memory/3972-28-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/5996-37-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/6016-52-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download