cerber | d16a7994d5bb51ea77a2dee74c09cd8ad23d6f812372e17c216c34ba6cf23826

Analysis

max time kernel
124s
max time network
122s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
27/03/2025, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wolf_Woofer_FREE v3.7.exe
Size

1.6MB
MD5

23119593e91f22d4a585f26d0363d968
SHA1

83aca1d89f48fcc5537daa2c958cb29411958c6a
SHA256

d16a7994d5bb51ea77a2dee74c09cd8ad23d6f812372e17c216c34ba6cf23826
SHA512

7002a39052466cf7ff29484d94f5321b8965615efb4f8fe691a829ef48719366f43ea20e1158dff43e9113f22f64b52f48ba6fe57e42a87e3dea8ded31593a7a
SSDEEP

49152:ZomiJqMHLl1b1uHIY/NmDDBGs5KGLhUlC2GQvPb:5iJXf8HT/NGDB1/2r

Score

10^/10

cerber discovery execution persistence ransomware

Malware Config

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Cerber family
cerber

Executes dropped EXE 9 IoCs

pid	Process
3744	WOLF.exe
2036	WOLF.exe
896	WOLF.exe
2640	WOLF.exe
2128	WOLF.exe
2400	WOLF.exe
788	WOLF.exe
3924	WOLF.exe
2336	DutyCleaner.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	DutyCleaner.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1484	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wolf_Woofer_FREE v3.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2240	timeout.exe

Kills process with taskkill 11 IoCs

defense_evasion

pid	Process
3736	taskkill.exe
2532	taskkill.exe
2008	taskkill.exe
3476	taskkill.exe
3308	taskkill.exe
4300	taskkill.exe
3124	taskkill.exe
1548	taskkill.exe
4932	taskkill.exe
3440	taskkill.exe
3380	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3744	WOLF.exe
3744	WOLF.exe
2036	WOLF.exe
2036	WOLF.exe
896	WOLF.exe
896	WOLF.exe
2640	WOLF.exe
2640	WOLF.exe
2128	WOLF.exe
2128	WOLF.exe
2400	WOLF.exe
2400	WOLF.exe
788	WOLF.exe
788	WOLF.exe
3924	WOLF.exe
3924	WOLF.exe
1484	powershell.exe
1484	powershell.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	Wolf_Woofer_FREE v3.7.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	3440	taskkill.exe
Token: SeDebugPrivilege	3380	taskkill.exe
Token: SeDebugPrivilege	4300	taskkill.exe
Token: SeDebugPrivilege	2532	taskkill.exe
Token: SeDebugPrivilege	2008	taskkill.exe
Token: SeDebugPrivilege	3476	taskkill.exe
Token: SeDebugPrivilege	3124	taskkill.exe
Token: SeDebugPrivilege	3308	taskkill.exe
Token: SeDebugPrivilege	1548	taskkill.exe
Token: SeDebugPrivilege	4932	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 2340	960	Wolf_Woofer_FREE v3.7.exe	82
PID 960 wrote to memory of 2340	960	Wolf_Woofer_FREE v3.7.exe	82
PID 960 wrote to memory of 2340	960	Wolf_Woofer_FREE v3.7.exe	82
PID 2340 wrote to memory of 2228	2340	cmd.exe	84
PID 2340 wrote to memory of 2228	2340	cmd.exe	84
PID 2340 wrote to memory of 2228	2340	cmd.exe	84
PID 2228 wrote to memory of 4692	2228	net.exe	85
PID 2228 wrote to memory of 4692	2228	net.exe	85
PID 2228 wrote to memory of 4692	2228	net.exe	85
PID 2340 wrote to memory of 3744	2340	cmd.exe	86
PID 2340 wrote to memory of 3744	2340	cmd.exe	86
PID 2340 wrote to memory of 2036	2340	cmd.exe	87
PID 2340 wrote to memory of 2036	2340	cmd.exe	87
PID 2340 wrote to memory of 896	2340	cmd.exe	88
PID 2340 wrote to memory of 896	2340	cmd.exe	88
PID 2340 wrote to memory of 2640	2340	cmd.exe	89
PID 2340 wrote to memory of 2640	2340	cmd.exe	89
PID 2340 wrote to memory of 2128	2340	cmd.exe	90
PID 2340 wrote to memory of 2128	2340	cmd.exe	90
PID 2340 wrote to memory of 2400	2340	cmd.exe	91
PID 2340 wrote to memory of 2400	2340	cmd.exe	91
PID 2340 wrote to memory of 788	2340	cmd.exe	92
PID 2340 wrote to memory of 788	2340	cmd.exe	92
PID 2340 wrote to memory of 3924	2340	cmd.exe	93
PID 2340 wrote to memory of 3924	2340	cmd.exe	93
PID 2340 wrote to memory of 2240	2340	cmd.exe	94
PID 2340 wrote to memory of 2240	2340	cmd.exe	94
PID 2340 wrote to memory of 2240	2340	cmd.exe	94
PID 960 wrote to memory of 2336	960	Wolf_Woofer_FREE v3.7.exe	95
PID 960 wrote to memory of 2336	960	Wolf_Woofer_FREE v3.7.exe	95
PID 2336 wrote to memory of 4392	2336	DutyCleaner.exe	96
PID 2336 wrote to memory of 4392	2336	DutyCleaner.exe	96
PID 4392 wrote to memory of 4148	4392	cmd.exe	98
PID 4392 wrote to memory of 4148	4392	cmd.exe	98
PID 4148 wrote to memory of 1532	4148	net.exe	99
PID 4148 wrote to memory of 1532	4148	net.exe	99
PID 4392 wrote to memory of 1484	4392	cmd.exe	100
PID 4392 wrote to memory of 1484	4392	cmd.exe	100
PID 960 wrote to memory of 2748	960	Wolf_Woofer_FREE v3.7.exe	101
PID 960 wrote to memory of 2748	960	Wolf_Woofer_FREE v3.7.exe	101
PID 960 wrote to memory of 2748	960	Wolf_Woofer_FREE v3.7.exe	101
PID 2748 wrote to memory of 3440	2748	cmd.exe	103
PID 2748 wrote to memory of 3440	2748	cmd.exe	103
PID 2748 wrote to memory of 3440	2748	cmd.exe	103
PID 960 wrote to memory of 248	960	Wolf_Woofer_FREE v3.7.exe	104
PID 960 wrote to memory of 248	960	Wolf_Woofer_FREE v3.7.exe	104
PID 960 wrote to memory of 248	960	Wolf_Woofer_FREE v3.7.exe	104
PID 2748 wrote to memory of 3380	2748	cmd.exe	106
PID 2748 wrote to memory of 3380	2748	cmd.exe	106
PID 2748 wrote to memory of 3380	2748	cmd.exe	106
PID 2748 wrote to memory of 3736	2748	cmd.exe	107
PID 2748 wrote to memory of 3736	2748	cmd.exe	107
PID 2748 wrote to memory of 3736	2748	cmd.exe	107
PID 2748 wrote to memory of 4300	2748	cmd.exe	108
PID 2748 wrote to memory of 4300	2748	cmd.exe	108
PID 2748 wrote to memory of 4300	2748	cmd.exe	108
PID 2748 wrote to memory of 2532	2748	cmd.exe	109
PID 2748 wrote to memory of 2532	2748	cmd.exe	109
PID 2748 wrote to memory of 2532	2748	cmd.exe	109
PID 2748 wrote to memory of 2008	2748	cmd.exe	110
PID 2748 wrote to memory of 2008	2748	cmd.exe	110
PID 2748 wrote to memory of 2008	2748	cmd.exe	110
PID 2748 wrote to memory of 3476	2748	cmd.exe	111
PID 2748 wrote to memory of 3476	2748	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\Wolf_Woofer_FREE v3.7.exe
"C:\Users\Admin\AppData\Local\Temp\Wolf_Woofer_FREE v3.7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\KillaSpoof.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:4692
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /BM "To Be Filled By O.E.M."
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3744
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /SM "To Be Filled By O.E.M."
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2036
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /SS "W2700129230"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:896
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /BS "W1994516023"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2640
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /BP "W2882824400-73Z-46385475-XN12088"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2128
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /SP "W2117516754-P5A-948330872-XN6615"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2400
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /PSN "W2396327195"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:788
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /SU auto
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3924
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2240
- C:\Users\Public\Documents\DutyCleaner\DutyCleaner.exe
  "C:\Users\Public\Documents\DutyCleaner\DutyCleaner.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "Duty Cleaner.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Windows\system32\net.exe
      NET SESSION
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 SESSION
        5⤵
        
        PID:1532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; $xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText01); $text = $xml.CreateTextNode('Thank you for using the program!'); $xml.GetElementsByTagName('text').AppendChild($text); $toast = [Windows.UI.Notifications.ToastNotification]::new($xml); [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('Duty Cleaning Program').Show($toast);"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im epicgameslauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im UnrealCEFSubProcess.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im CEFProcess.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im EasyAntiCheat.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BEService.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BEServices.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BattleEye.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /b ::: "C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\DutyCleaner\FortnitecleanerSmall.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Duty Cleaner.bat

Filesize
208KB

MD5
00375ee83226cbdd0e8bc5f2c71aa38d

SHA1
0ff7ea34203a1729140f2429358bc58aa28e5bb2

SHA256
dd97aed20239f8546bfab3556a04426b80b263f04e8436264c4213043919249f

SHA512
a8587b43a10b015746cfc519362d1402c9cb09f4d932cf9e1d2fc1d2bcb7b9b76f8747057606d75ff15782ba5de9919ec0f63a515ba6673536e2e989923111c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mxju4rim.nc0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\KillaSpoof.bat

Filesize
1KB

MD5
44d499f2de89cb19a6c55cde1dddfdcc

SHA1
09122b371d901d298552ff699667f0a1e0cf6f09

SHA256
93ba415a352cf208331ec65718f16de18f040a9f613595427f6f7e176cbebc69

SHA512
cb76943ba6ee361f56e25d8fd59fa9933ea4f350782511312834ddf582f804001bf00ba3697e55301481f6b1de6f3023da8d8468e76da953d77a7fde65200926

Download Submit
C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe

Filesize
4.9MB

MD5
b7219857e8e1305def7a814ad27f5fb5

SHA1
b41ee7cf66e7cfbc19764c1ca5bbddcc6141e0bb

SHA256
c3d568da2c0055824bfc629de90970014fe15164693f7acc478dc7e06891516f

SHA512
fa35a119b73e9fba4dad22966f5a13ae5486931c1f1559ec7e0e4fbf4523d5b463407c7058254fdc5160352cd668bf3ae55dbb352a1276704233d5e313dcd9fd

Download Submit
C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\amifldrv64.sys

Filesize
18KB

MD5
785045f8b25cd2e937ddc6b09debe01a

SHA1
029c678674f482ababe8bbfdb93152392457109d

SHA256
37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

SHA512
40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9

Download Submit
C:\Users\Public\Documents\DutyCleaner\DutyCleaner.exe

Filesize
190KB

MD5
b51c7b53dc6f6119198f306493affb6d

SHA1
1fa6013669ce756dd09fe03fc192136cbe13daaf

SHA256
1243ca1244a25b33fae69e0525b8b3e17f059323cba2d2586c6247d33b602f50

SHA512
42460a6d3923aae34f6bb4f2616ebb9e3bd8551095d594eb6625fcc740223c3561b45ae9a62ca54b8e8bceaea3dde8def06123f345d2250b322deb13a45cded5

Download Submit
C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat

Filesize
1.5MB

MD5
9f11b2a3e7a02c82b93a629b3be3e1d0

SHA1
c838319bd14ea3c31d48d236a8f63ad826c89a17

SHA256
8f9d69d08d71c182799f59f851231193bd5da5ac4a0a11f19543080dbf0525ba

SHA512
a90399e751bc58ffec2b721483fe8438bf1b1537ff9fffeae37beebd6354ca92d11c240d2cd92d16689c4986fc7a0e17031f9447737245ad5bfce210a99c709a

Download Submit
C:\Users\Public\Documents\DutyCleaner\FortnitecleanerSmall.bat

Filesize
41KB

MD5
defa26d378888c30e48eba0f049cea6f

SHA1
f748c93804b2ecd67f214b7506f45f8569c25563

SHA256
cd7f44c3574c63897307d9e6ab7164733b1a8289c26882fc806c68fe3ec4ab9f

SHA512
43a9ad2f6f0a794e77c4ec69da360761a8bc26d18d6e0e5775b408b7146d80030bbfa6a0d9aa1682fc9c1336d4ac7107598a1105a891489adeebcd6e3d6f6982

Download Submit
memory/788-63-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/896-43-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/960-9-0x0000000074C60000-0x0000000075411000-memory.dmp

Filesize
7.7MB

Download
memory/960-8-0x00000000011B0000-0x0000000001216000-memory.dmp

Filesize
408KB

Download
memory/960-13-0x000000000A800000-0x000000000A812000-memory.dmp

Filesize
72KB

Download
memory/960-10-0x0000000074C60000-0x0000000075411000-memory.dmp

Filesize
7.7MB

Download
memory/960-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/960-1-0x0000000000860000-0x00000000009F8000-memory.dmp

Filesize
1.6MB

Download
memory/960-4-0x0000000005540000-0x000000000554A000-memory.dmp

Filesize
40KB

Download
memory/960-6-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/960-2-0x0000000005B20000-0x00000000060C6000-memory.dmp

Filesize
5.6MB

Download
memory/960-5-0x0000000074C60000-0x0000000075411000-memory.dmp

Filesize
7.7MB

Download
memory/960-3-0x0000000005490000-0x0000000005522000-memory.dmp

Filesize
584KB

Download
memory/960-11-0x00000000069C0000-0x00000000069CA000-memory.dmp

Filesize
40KB

Download
memory/960-7-0x0000000074C60000-0x0000000075411000-memory.dmp

Filesize
7.7MB

Download
memory/1484-92-0x0000022AC19F0000-0x0000022AC1A12000-memory.dmp

Filesize
136KB

Download
memory/1484-96-0x0000022AC1940000-0x0000022AC194A000-memory.dmp

Filesize
40KB

Download
memory/1484-97-0x0000022AC1950000-0x0000022AC1958000-memory.dmp

Filesize
32KB

Download
memory/1484-99-0x0000022AC2150000-0x0000022AC21C6000-memory.dmp

Filesize
472KB

Download
memory/1484-103-0x0000022AC1B30000-0x0000022AC1B4E000-memory.dmp

Filesize
120KB

Download
memory/2036-38-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/2128-53-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/2400-58-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/2640-48-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/3744-35-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/3744-34-0x000000014007B000-0x000000014038F000-memory.dmp

Filesize
3.1MB

Download
memory/3744-32-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/3744-29-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/3744-28-0x00007FF982FF0000-0x00007FF982FF2000-memory.dmp

Filesize
8KB

Download
memory/3744-27-0x000000014007B000-0x000000014038F000-memory.dmp

Filesize
3.1MB

Download
memory/3924-68-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download