Technical Information
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe
- '<SYSTEM32>\taskkill.exe' /f /im svchost.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\wudfhost.exe
- %TEMP%\b7b4.tmp\supracheat001.cmd
- nul
- <SYSTEM32>\ntoskrnl.exe
- %WINDIR%\boot\pcat\fi-fi\bootmgr.exe.mui
- %WINDIR%\boot\pcat\es-es\bootmgr.exe.mui
- %WINDIR%\boot\pcat\en-us\memtest.exe.mui
- %WINDIR%\boot\pcat\en-us\bootmgr.exe.mui
- %WINDIR%\boot\pcat\el-gr\bootmgr.exe.mui
- %WINDIR%\boot\pcat\de-de\bootmgr.exe.mui
- %WINDIR%\boot\pcat\da-dk\bootmgr.exe.mui
- %WINDIR%\boot\pcat\cs-cz\bootmgr.exe.mui
- %WINDIR%\boot\pcat\bootmgr
- %WINDIR%\boot\fonts\wgl4_boot.ttf
- %WINDIR%\boot\fonts\kor_boot.ttf
- %WINDIR%\boot\fonts\jpn_boot.ttf
- %WINDIR%\boot\fonts\cht_boot.ttf
- %WINDIR%\boot\fonts\chs_boot.ttf
- %WINDIR%\boot\efi\zh-tw\bootmgr.efi.mui
- %WINDIR%\boot\efi\zh-tw\bootmgfw.efi.mui
- %WINDIR%\boot\efi\zh-hk\bootmgr.efi.mui
- %WINDIR%\boot\efi\zh-hk\bootmgfw.efi.mui
- %WINDIR%\boot\efi\zh-cn\bootmgr.efi.mui
- %WINDIR%\boot\pcat\fr-fr\bootmgr.exe.mui
- %WINDIR%\boot\pcat\it-it\bootmgr.exe.mui
- <SYSTEM32>\ntdll.dll
- %WINDIR%\boot\pcat\ja-jp\bootmgr.exe.mui
- <SYSTEM32>\win32k.sys
- <SYSTEM32>\gdi32.dll
- <SYSTEM32>\user32.dll
- <SYSTEM32>\advapi32.dll
- <SYSTEM32>\kernel32.dll
- %WINDIR%\bfsvc.exe
- %WINDIR%\boot\pcat\zh-tw\bootmgr.exe.mui
- %WINDIR%\boot\pcat\zh-hk\bootmgr.exe.mui
- %WINDIR%\boot\pcat\zh-cn\bootmgr.exe.mui
- %WINDIR%\boot\pcat\tr-tr\bootmgr.exe.mui
- %WINDIR%\boot\pcat\sv-se\bootmgr.exe.mui
- %WINDIR%\boot\pcat\ru-ru\bootmgr.exe.mui
- %WINDIR%\boot\pcat\pt-pt\bootmgr.exe.mui
- %WINDIR%\boot\pcat\pt-br\bootmgr.exe.mui
- %WINDIR%\boot\pcat\pl-pl\bootmgr.exe.mui
- %WINDIR%\boot\pcat\nl-nl\bootmgr.exe.mui
- %WINDIR%\boot\pcat\nb-no\bootmgr.exe.mui
- %WINDIR%\boot\pcat\memtest.exe
- %WINDIR%\boot\pcat\ko-kr\bootmgr.exe.mui
- %WINDIR%\boot\efi\zh-cn\bootmgfw.efi.mui
- %WINDIR%\boot\pcat\hu-hu\bootmgr.exe.mui
- %WINDIR%\boot\efi\tr-tr\bootmgr.efi.mui
- %WINDIR%\boot\efi\hu-hu\bootmgfw.efi.mui
- %WINDIR%\boot\efi\fr-fr\bootmgfw.efi.mui
- %WINDIR%\boot\efi\fi-fi\bootmgr.efi.mui
- %WINDIR%\boot\efi\fi-fi\bootmgfw.efi.mui
- %WINDIR%\boot\efi\es-es\bootmgr.efi.mui
- %WINDIR%\boot\efi\es-es\bootmgfw.efi.mui
- %WINDIR%\boot\efi\en-us\memtest.efi.mui
- %WINDIR%\boot\efi\en-us\bootmgr.efi.mui
- %WINDIR%\boot\efi\en-us\bootmgfw.efi.mui
- %WINDIR%\boot\efi\el-gr\bootmgr.efi.mui
- %WINDIR%\boot\efi\el-gr\bootmgfw.efi.mui
- %WINDIR%\boot\efi\de-de\bootmgr.efi.mui
- %WINDIR%\boot\efi\de-de\bootmgfw.efi.mui
- %WINDIR%\boot\efi\da-dk\bootmgr.efi.mui
- %WINDIR%\boot\efi\da-dk\bootmgfw.efi.mui
- %WINDIR%\boot\efi\cs-cz\bootmgr.efi.mui
- %WINDIR%\boot\efi\cs-cz\bootmgfw.efi.mui
- %WINDIR%\boot\efi\bootmgr.efi
- %WINDIR%\boot\efi\bootmgfw.efi
- %WINDIR%\boot\dvd\pcat\en-us\bootfix.bin
- %WINDIR%\boot\efi\fr-fr\bootmgr.efi.mui
- %WINDIR%\boot\efi\hu-hu\bootmgr.efi.mui
- %WINDIR%\boot\efi\sv-se\bootmgr.efi.mui
- %WINDIR%\boot\efi\it-it\bootmgfw.efi.mui
- %WINDIR%\boot\efi\sv-se\bootmgfw.efi.mui
- %WINDIR%\boot\efi\ru-ru\bootmgr.efi.mui
- %WINDIR%\boot\efi\ru-ru\bootmgfw.efi.mui
- %WINDIR%\boot\efi\pt-pt\bootmgr.efi.mui
- %WINDIR%\boot\efi\pt-pt\bootmgfw.efi.mui
- %WINDIR%\boot\efi\pt-br\bootmgr.efi.mui
- %WINDIR%\boot\efi\pt-br\bootmgfw.efi.mui
- %WINDIR%\boot\efi\pl-pl\bootmgr.efi.mui
- %WINDIR%\boot\efi\pl-pl\bootmgfw.efi.mui
- %WINDIR%\boot\efi\nl-nl\bootmgr.efi.mui
- %WINDIR%\boot\efi\nl-nl\bootmgfw.efi.mui
- %WINDIR%\boot\efi\nb-no\bootmgr.efi.mui
- %WINDIR%\boot\efi\nb-no\bootmgfw.efi.mui
- %WINDIR%\boot\efi\memtest.efi
- %WINDIR%\boot\efi\ko-kr\bootmgr.efi.mui
- %WINDIR%\boot\efi\ko-kr\bootmgfw.efi.mui
- %WINDIR%\boot\efi\ja-jp\bootmgr.efi.mui
- %WINDIR%\boot\efi\ja-jp\bootmgfw.efi.mui
- %WINDIR%\boot\efi\it-it\bootmgr.efi.mui
- %WINDIR%\boot\efi\tr-tr\bootmgfw.efi.mui
- %TEMP%\b7b4.tmp\supracheat001.cmd
- ClassName: '' WindowName: ''
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\B7B4.tmp\SupraCheat001.cmd" "<Full path to file>""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\B7B4.tmp\SupraCheat001.cmd" "<Full path to file>""
- '<SYSTEM32>\svchost.exe' -k RPCSS
- '<SYSTEM32>\svchost.exe' -k DcomLaunch
- '<SYSTEM32>\svchost.exe' -k LocalServiceNetworkRestricted
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\hal.dll" /grant "user":F
- '<SYSTEM32>\takeown.exe' -f "<SYSTEM32>\hall.dll"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\ntdll.dll" /grant "user":F
- '<SYSTEM32>\takeown.exe' -f "<SYSTEM32>\ntdll.dll"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\win32k.sys" /grant "user":F
- '<SYSTEM32>\takeown.exe' -f "<SYSTEM32>\win32k.sys"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\gdi32.dll" /grant "user":F
- '<SYSTEM32>\takeown.exe' -f "<SYSTEM32>\gdi32.dll"
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\user32.dll" /grant "user":F
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\advapi32.dll" /grant "user":F
- '<SYSTEM32>\takeown.exe' -f "<SYSTEM32>\advapi32.dll"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\kernel32.dll" /grant "user":F
- '<SYSTEM32>\takeown.exe' -f "<SYSTEM32>\kernel32.dll"
- '<SYSTEM32>\icacls.exe' "%WINDIR%\bfsvc.exe" /grant "user":F
- '<SYSTEM32>\takeown.exe' -f "%WINDIR%\bfsvc.exe"
- '<SYSTEM32>\icacls.exe' "%WINDIR%\Boot" /t /c /grant "user":F
- '<SYSTEM32>\takeown.exe' -r -f -skipsl "%WINDIR%\Boot"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\ntoskrnl.exe" /grant "user":F
- '<SYSTEM32>\takeown.exe' -f "<SYSTEM32>\ntoskrnl.exe"
- '<SYSTEM32>\timeout.exe' /t 3 /nobreak
- '<SYSTEM32>\takeown.exe' -f "<SYSTEM32>\user32.dll"
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted