Marzuki marz-hunter

Inspired by this

More of my guides: Debloating LDPlayer - Debloating Nox (Updated)

Edit 22/8/2021: I have updated MEmu and it seems like it reinstalls the apps and re-enables the services. Repeat steps 5, 7, 8, and 9 if you update MEmu.

Debloating MEmu

In my experience, Nox can be quite slow and choppy, and looks like I'm not the only person with this problem. A lot of people say that MEmu performs better than Nox, and I could agree with that. I have no chopping issues with it so far. But like Nox, there are kinda shady stuff going on.

	#!/bin/bash
	# bash generate random alphanumeric string
	#

	# bash generate random 32 character alphanumeric string (upper and lowercase) and
	NEW_UUID=$(cat /dev/urandom \| tr -dc 'a-zA-Z0-9' \| fold -w 32 \| head -n 1)

	# bash generate random 32 character alphanumeric string (lowercase only)
	cat /dev/urandom \| tr -dc 'a-z0-9' \| fold -w 32 \| head -n 1

	function onOpen() {
	var ss = SpreadsheetApp.getActiveSpreadsheet();
	var menuEntries = [ {name: "Run Query", functionName: "runQuery"} ];
	ss.addMenu("HTTP Archive + BigQuery", menuEntries);
	}

	function runQuery() {
	var projectNumber = 'httparchive';

	var sheet = SpreadsheetApp.getActiveSheet();

	https://github.com/search?q=BROWSER_STACK_ACCESS_KEY= OR BROWSER_STACK_USERNAME= OR browserConnectionEnabled= OR BROWSERSTACK_ACCESS_KEY=&s=indexed&type=Code
	https://github.com/search?q=CHROME_CLIENT_SECRET= OR CHROME_EXTENSION_ID= OR CHROME_REFRESH_TOKEN= OR CI_DEPLOY_PASSWORD= OR CI_DEPLOY_USER=&s=indexed&type=Code
	https://github.com/search?q=CLOUDAMQP_URL= OR CLOUDANT_APPLIANCE_DATABASE= OR CLOUDANT_ARCHIVED_DATABASE= OR CLOUDANT_AUDITED_DATABASE=&s=indexed&type=Code
	https://github.com/search?q=CLOUDANT_ORDER_DATABASE= OR CLOUDANT_PARSED_DATABASE= OR CLOUDANT_PASSWORD= OR CLOUDANT_PROCESSED_DATABASE=&s=indexed&type=Code
	https://github.com/search?q=CONTENTFUL_PHP_MANAGEMENT_TEST_TOKEN= OR CONTENTFUL_TEST_ORG_CMA_TOKEN= OR CONTENTFUL_V2_ACCESS_TOKEN=&s=indexed&type=Code
	https://github.com/search?q=-DSELION_BROWSER_RUN_HEADLESS= OR -DSELION_DOWNLOAD_DEPENDENCIES= OR -DSELION_SELENIUM_RUN_LOCALLY=&s=indexed&type=Code
	https://github.com/search?q=ELASTICSEARCH_PASSWORD= OR ELASTICSEARCH_USERNAME= OR EMAIL_NOTIFI

	from pydriller import RepositoryMining
	import re
	import base64

	foundSet = set()
	for commit in RepositoryMining('./').traverse_commits():
	for mod in commit.modifications:
	if mod.source_code_before != None:
	regex = re.findall(r"<text encoding=\"base64\">[^>]+</text>", mod.source_code_before)
	for result in regex:

	.php
	.html
	.txt
	.htm
	.aspx
	.asp
	.js
	.css
	.pgsql.txt
	.mysql.txt

	#!/usr/bin/env python3

	import json
	from urllib.parse import quote, quote_plus
	import sys
	import os
	import argparse


	parser = argparse.ArgumentParser(

	import xml.etree.ElementTree as ET
	import urllib
	import base64
	import math
	import sys
	import re

	# usage: Open Burp, navigate to proxy history, ctrl-a to select all records, right click and "Save Items" as an .xml file.
	# python burplist.py burprequests.xml
	# output is saved to wordlist.txt

	import httplib
	import urllib

	http = httplib.HTTPSConnection('example.com', 443)

	cookie = 'your=cookies';

	http.request("GET", "/api/v1/csrf", "", {
	'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.146 Safari/537.36',
	'referer': 'https://example.com/',

	Loki
	https://www.shodan.io/search?query=%22Loki+Locker%22

	BlackBit
	https://www.shodan.io/search?query=%22Encrypted+by+BlackBit%22

	BlackHunt
	https://www.shodan.io/search?query=%22Your+Network+Infected+with+BlackHunt+Ransomware+Team%22

	Amelia, Proxima