API tools faq
paste
jroosen

Annoying AgentTesla Loader Malspam 12/08/20

jroosen
Dec 8th, 2020
19,571
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 43.69 KB | None | 0 0
raw download clone embed print report
  1. Annoying AgentTesla Loader Malspam 12/08/20
  2.  
  3. - All the sudden out of nowhere got a good 20 of these sent to random people in my org.
  4.  
  5. Sending IP : 203.124.39.171
  6. From: accounts@mzne.com.pk
  7. Subject: Re:Re: Re: Purchase Order 1
  8.  
  9. Email Template:
  10. __________________
  11.  
  12. Reply-To: accountbank@indoheavy.indo-heavy.com
  13. From: Accounts <accounts@mzne.com.pk>
  14. To: target@yourdomain.com
  15. Subject: Re:Re: Re: Purchase Order 1
  16. Date: 08 Dec 2020 11:40:18 -0800
  17. Message-ID: <20201208114018.A98C974F129962B3@mzne.com.pk>
  18.  
  19. <HTML><HEAD>
  20. <META name=GENERATOR content="MSHTML 11.00.9600.19130"></HEAD>
  21. <body>
  22. <P>Good Day (Target),</P>
  23. <P>My colleague is currently on vacation. I am writing regarding to our invoice .Please find the attached Bank Account Details.</P>
  24. <P>We made a payment to your account for invoice attached as provided by payment<BR>us know when you receive the payment.</P>
  25. <P>Thank You.</P>
  26. <P>Regards,</P>
  27. <P>Belin Guchery<BR>Strategic&nbsp; Sourcing Manager<BR>Accounts Department<BR><BR>Pacific Limited<BR>C.E.O.<BR>.......................................<BR>Sent from my iPhone 2020-12-08</P></BODY></HTML>
  28.  
  29. ------=_NextPart_000_0012_6DDC0F49.CE46D407
  30. Content-Type: application/vnd.ms-excel; name="Bank Account Details.xla"
  31. Content-Transfer-Encoding: base64
  32. Content-Disposition: attachment; filename="Bank Account Details.xla"
  33. __________________
  34.  
  35.  
  36. All 20 emails were basically the same attachment of Bank Account Details.xla.
  37.  
  38. Hash:
  39. c0c51ffe276c5f788f2f72cbacbced8da72ff5ef78b73b62fb1e93c0be38b189
  40.  
  41. Sandbox Run:
  42. https://tria.ge/201209-fxkv3n3f3n
  43. https://app.any.run/tasks/6cb6d0af-9c1f-4478-a16c-a1b597a51699
  44.  
  45. Path to infection here is macro in XLS => https://cutt.ly/ShEtP1G => http://193.239.147.76/bat/scriptxls_18f91a7a-549b-438b-b253-797529819b76_centank_wdexclusion.bat and then saving as PD.BAT.
  46. PD.BAT => https://cutt.ly/DhEtU3P downloads AgentTesla => http://sparepartiran.com/XC/TonyBro.exe
  47.  
  48. The sparepartiran.com site should ring some bells as it has been used a lot lately for distro of AgentTelsa.
  49.  
  50. The best part about this whole bit of garbage was the first cutt.ly link goes to http://193.239.147.76/bat/ which is an open directory FULL of bat files just like this one.
  51. I downloaded all of them and extracted and processed all URLs inside to report them and here are the IoCs:
  52.  
  53. Batch Hashes:
  54. 019e7c8c882c6de69c8955855847bd7862d29e544999fdbcec0e6490be14256e
  55. 01f5937ecdff55ea93d2f02b745aa4cbc36218ca47fa3c6253e5a68547cda355
  56. 0241b60819bcff11b67f00e183d7a70c7f9153e171b8759b2d4132d00320ba8e
  57. 07646e9fce0d3fedf11d14c988d8eaff9f54d9a6a7e3a22e21f83b7f027f1d2d
  58. 07d4de2a02314e137fdfe3c58c0954c3f93ef4915cd9aef37a2d4f3517aaf2b2
  59. 0bf31cd9dcc0b17f713a7447b4ea924a0d506396a08fd4d8a667398f365378f0
  60. 11f0c0960038571a4652293ca05d10db70939ec675966c62ed41d39d7c2998b1
  61. 125278f3d770343ed07193b46465fd1f25069c68b6d8cfc80e03e49719b4e584
  62. 137f529ac12d47a5afa9444cf238e7069aee1fa7037c4528d77738e1ca2e2e7e
  63. 1381110635058f72c1e64c4cddb4bf2bfe09ece258d299a6c899c468b2f425a3
  64. 13b523d44c3fc48af25d90763df2df845bbff4883c8745d3ad7203b2982eeb87
  65. 151bf82c0e28bf61dd81d96621ca2c1c616a1766d5b0b2212046010804532814
  66. 17d38926e0648383ff51bd9454525a0940b44510e089b3cec001868e0ad9bf38
  67. 1a15fc7713d5feb31d85e8abe4335793fc8a2c59742c50a05597411e3a85fb1d
  68. 1a67a2e81e746dc2d4f5fc2e37cbb283a3d17a4ad55e81012fc11f1ad6a0bbf9
  69. 1d4f0f8d7bcdfe1496c1417cb982b6c2f71444a2d0a4ecff84aac7436342f50e
  70. 1e3d3de2dc402d4676c75bf545551666adf6b067e8221373d4115a6db8314d29
  71. 1e68eb25cf5a64a7fa26379a54bc0e899c978c706d68d730303d28dc38706b7e
  72. 1ef5f62b442ece795a32bff7c5a3806edfded3d7545500eff2785b3c63221122
  73. 1ffc965a821175d16c1b1ce55594dc40e52123b2509ee14e8e0ee5a273691ce5
  74. 2045a3c7ecc4ca5cfd24530f50d9996b9f6d279a2cc8fd48fa609a2645d2c43d
  75. 2102c1856aeb032e32956a957acac7aa606fe9d562377af09d8af7291374c957
  76. 214713ded13bd26c6cf3354eefd27fa2fe7311a3d72da84cc6e91e3baaad840a
  77. 24042897ed50c24e05acbcd324f35fe8432a4a4cfed306f69a4675f4ec890fe5
  78. 25692bbcef35f6f107ee321b5cc7a9954b2f2aa8899db21bd13980ee0e0c35ea
  79. 257ed54c7cc9fac26f4163b85c6f253a167829a9d5a9cbf1d2484e46d4cf3270
  80. 25f5d46fae29155e944273c1dfef346891848260c27b2317d93974ab4348ee40
  81. 26a95d739af23f7e505256f4642df27ad65956718c80843e99b01b6af20a7e1c
  82. 28bfd89b852a9458e92c1a394ffc437dbf0f555c91bdb5063c2ed7397b3410fa
  83. 2b869ae6f896c085d6948f205adf907804a08dd30167d53766016c075e76a2a8
  84. 2d2e598d363ac2a5e8a860892301b08a874144ef6a14cd0dd068c60ccb83862a
  85. 2dacc67174e85d73bb90f566d91875cffac568785c0c799f0fada920a89a592c
  86. 2ff57caac50b073e69b2c36c895bb26f1428f5d190887c9c351db648762d8d04
  87. 30d295b14b40f645a67cddfcc74200f980f247d459ecae619695877bbe5a3409
  88. 30ea8491dffd3f4946bddeb2b386a5de00b503604785163050d9ea49b11efa1d
  89. 312664d6c322b0189c6f3e69f3e2f9da74b6f88f05164e489f69336588229a2c
  90. 31c5f3c4324f4448c090040b11364c20eeb854df9460f3db53704edaf9dd644e
  91. 331484a438fb6cb35cbe8dac3a9e3686c1479dbfb698f34dcd756eb3d1730aad
  92. 33868f002c7fbf744464b30515fc1eb3b76de52ec47edb4f4fe07ac9476972fb
  93. 352ef069285ea960939c1c44279168ac93a2c47b23db01ec17504d6f475884ef
  94. 373f07acdcef8f2c8bde8794b7cd21bf9de81da1901ad1653aa1534c67539ea9
  95. 39308f3b5073c59ab826601b508429c581383002cc801701f4247b6409dc5d6b
  96. 39aabfd6518a7f3438cd8c1ad3348772b8b8dd5ca5b27e04de37cd8426293d8b
  97. 3a64e57c7b0859257775e13b008a54b9c432bd07effe72a8d5c3943fdcadb83d
  98. 3b3b556dcd166c6ff45f5a92e75bbe041ac94edd417990bdb83ecd8cf55a67a5
  99. 3dfb046d9779bbaa2ba33fb120f80458f814db2bfed65fd67d069a63186eda41
  100. 3e4e8a198f89c6ff963fe01111f01052cb27debf11088466ebae16533db1f612
  101. 3fdaa6ae8ca1ac914cb205f73edc9c26454a1478d7da9d58fa80b1eeeae80d3a
  102. 40583d9f3ae263b3313ffe95a6034986b1cf22e0dff01a828f39926f81b827fd
  103. 417e3e703e4b6f2c87412ff441598c2c3ff3f2c0fc738d4d4998f09808d9fe64
  104. 41aeeb60591e3f7f01ae309c323ad83964332ed7367580e6a28caa4a8c1d09fb
  105. 4213a463c06b74d4c546c11d878f372d45053fa93d650b09455736fcc0281301
  106. 44a79ed31819f5b5a188a22a86424b7c9e9c069d56eadb60fe0bf63c5af8613b
  107. 44d6214bd839e4d7de48767620e9b80830e15abef32997bcd429c58cb33abb4d
  108. 4504ad87210a0ec9154b0565824ca8fa2d52e10dfcc39c1fba80e4e7d9461ec2
  109. 474d9c4ef65c39362f5ad83d686af0a58f8cd1716d76704e75a938121f4add58
  110. 4af0e7d4b85abf3e3d1fb4dfa6c50c7cbab07fbf155465c67a2c05a021a42d50
  111. 4be475c6596596c45354034504d324ba66cf1511df9e5bdfecaeea3a15448a8e
  112. 4fe5fec5a16f8461f5049106f0aeb62a6357d1c65574c7fe93a1d33961b8520e
  113. 512af46124b19a59c45f2e1ed80519d43a3551f118b75c8d496230142d0fe5e8
  114. 51f58e7f488f4b7b7c95ad88e6e4011d03bb3d6be837b7e639f874a636a3251a
  115. 52c9d2cc260f2995ad2f365f550526c08d104c5d88c280673c053f78248fc202
  116. 56b51b4cc824a90f760a51b4bdbee4bbac5a546d73b641923d3ba8fc971e5586
  117. 599eaa4ea3edbb88a89b4b2744ae29dce6c9575221df7af224889e8639fdc589
  118. 5a13faaa52c1c3c5fe19ba0e65131d49fbf9b37d3ed621fb8aa40c60a14d52ee
  119. 5b390f86d0c2afc3afb3bda5e7a5d29f04ad8473b76090266c444652a136b3ff
  120. 5c17c45f71a7390b0d0e3be7ebfa0ddcc049f6336f47f958500495736f8bf218
  121. 5c67bfd7d872a8fc75b760c66cb50b447ac6bbbcf94a0517df40999048616857
  122. 5c6f31dda47ce35ef170fe9fa90826f2e3520db5a7fe9440f13554439e8b85ae
  123. 5cf4971a3ed845f9935b15e4c6206e1d7467e883abf7d9cc5716317838d55d88
  124. 5d319a429e57c4efe709e76a496f477c188ef9e023638bfec2a6637613a54c2c
  125. 5f96fdd1b26ec00d87ace0506807dd4496a36088e4e521ea5acc8e908e07fd05
  126. 60cff7745bc569181feefa3412390b0e076dc551710ceedcc78d8de2dcda99dd
  127. 611bf4c7d22b5a56a55c0f3a0b35e285d7b1f0d70cb964e054d43362272322c4
  128. 624ad208ad4eaccb79c643d8d5f9b959aa31547756ef8b796002ebf5f6d4d2e4
  129. 62cace5904e8f438716561f135d71bb900af1b563ff123ab960591a24a276a76
  130. 630d4cdef06b110ac5ae284d92166ef1de06e01d031e426344eeffa7c2e3e04c
  131. 632a6283f859d65f295d359ac2710fb53682e3663a8492a5f2b3fc10d3ad9c64
  132. 6548c0eeca34171bd1d09640630d3f86c89b9697f4ef83a4e62761b4388812de
  133. 664d5384ce5b6db7e72d0c05a7bb0d424836b4b39cc5fae4bd82a47fcb0e1702
  134. 6842bff53b80c3eaf2a46114f207eb8fc69404b18ba8c3730e27a1d5b5ce2953
  135. 6898a0607b968c209b261208255a26b1f7e255846eef29e81cd33fde51fcd281
  136. 6da31a15b3d95bbe5e90f06f128f2429e012c083d6f41136ba3a93dd2b3137bb
  137. 6dcefbb65932ceee93a893ecbd58f9d5f0d9b0dc748f064e234663d4d5f695df
  138. 6f47c2a56a077ec0c5159c609c17a5bbbce187973c33b04a54748b89f160ecfd
  139. 6fa22986ae4f59af737ca1ef0e1d27661b0b7ab85e987ce44a753e0f1c3e599e
  140. 6fd610dbd25b34bfa49a7da131485739b5ec1d7d8a048557320ea16c17979624
  141. 71a2deade674b0834312adeee802f9e00c1d9e97948f89517c668b7404b667eb
  142. 71d8c454ffd1cbbe38e5d96c1f168b7b7ab9d4316893350632f6b52e0efbcf96
  143. 725e3b439f4098ca461bb5f4aef065f378fd067d3e7f187a7a91688e5923a2e0
  144. 732b6108bc0c9666cf5b38a56bb242a6ac977cfcdf35976b699c623365d95ba9
  145. 7343096c073f722963e7f925dfd22bfbb554c152caed01fb8bb1f21823ff8653
  146. 75fc43c9692a273e02f7c8ca79e127d499e5a88d697e5b722c6b2e0cb3fb328e
  147. 7667b1bf03ed6d0a928f8440050e19c904b3827e9869bbafbacde8d86266e0c7
  148. 76bbd32200ee9d1571d1c94cfb7d1a23e148b35b80d42d70da990cdab436b714
  149. 77d35902e56579343fb97574c5ca98981befbfb94900ff0f9d50fe19b9c02199
  150. 78a3600e9cc99698ad6939d63f91e67b5ca93b07914aa0bedc367d74d8a08d88
  151. 78d80c8bc1120559f31699f599363c13df225bdf60c318c339bc8079a39f2a58
  152. 78e36e53ce0056f85aa6c1fc31aa30738a05d36eba84a32a8ab1c4703c967595
  153. 7b1df1df7ef8d219cbc71f9c2f08c46164e1c27d15edb250cad1702f84131f50
  154. 7b62158664ef47acea10d68491de9a18a476c930aa8dffa3a54828f1e10969e0
  155. 7be6d1b5a387765293bcba19b347a37a68555a82c2a3bbba12f147e7fe44d4ea
  156. 7d3ff38deee09b2f7c1edb6b7391c4dcae8c281840b73977733a5c0787488691
  157. 7f9b588c0eb364b5784eba86797ec6fa596e9284756191a8dce6bbacac9dbdb7
  158. 81413f8672b9c70ec6d4207a2f8f50a6153a1770823e7667859d7615c623bc30
  159. 81ecd682b349f7c9fa8a3ce6fc09fc5d097111bc6b7c395946b4c8a945c69adb
  160. 82fc9d65847d17bf1c878c3f759fda77390c109a3ea0f85151f591a8d2e7c5f9
  161. 840e6cec8d25cf552e017245a7cb4cabe009cb1c5ca9ff369500c1854ac7fdb6
  162. 84542875855c99fccbc610ba8ef091bb34d51f1f846e72379067e893883f90d7
  163. 84741622fb1c1f492247a59fac40cf208cb60d1535eec63fdabb3bc0dd986fc9
  164. 84c64dbe0659b4bab66f0eb85df90b30473d32fe2f71343c684665c35db3cecb
  165. 8505a2264324e1b72729c51a5d2e1ff4f46497c080191393ed3b731ccd8f2dec
  166. 861df3bb5453a695f7fa70090c3afdf8b96d38e5d8314c7277526f24831f1db8
  167. 865447df716cf6f27c4522ec6c9e7d7e3ad428b658f87a9a759ea08a391b9087
  168. 8806f49dfd6bac60043d043c8140b37a288bde3369aaa5a4f451249b49e6d24a
  169. 883cd73b6257465050b2abf500202beb47a44baa8a3641a060e5fba84f222301
  170. 8a62858e09551a905ceef6843cc48735b6cd65df59ef1700cb16784d5afc73a0
  171. 8c26f70622163f8751883b4c1eacd3110cf3e5173bffff13722ac34ee9a43d0f
  172. 8e0854dfdba736c4686bb757131f3f722776bc97eade458ec349169aeb748cac
  173. 8f14cfaa0ca8d369eb35bd86d703a7998e243bc064107cc63485db9fd3aec6ec
  174. 916b6a8e9af4bd813591964805d341a469ce17c9817bc23940c28615c018f59a
  175. 9225d2b2ae265bc4a565c0714e6e3c03e9a6c7125a6a6d7667586af6eed67224
  176. 9231aaebe78348c7ff5f92e494c7577985b3b7a677800536993a925cf792fcf1
  177. 93bbc4c42c62cf501f3d80caf16c76027001559a4ebd274bbe92dbf50d61aedc
  178. 93d749207b08e03733cff397d20387d513c10c1939ab11063c0220597b2cfd44
  179. 958d4e4e9ad920c0017f162eadd193f455e1adbe128b68d6ececfde8478bfadc
  180. 95fbf8b2da2179cacc0d16c7a35fbf0ac29c42dc42af1fc31367cfb4f6a3db06
  181. 96c217bb9d6f1682e63fb32aec7ddaf529cd72b80ecfc3815677ee134c0d5075
  182. 9838554524dacd78c20105c148d435964cd1255ee64543a77630a60f55dc0f2a
  183. 9910ff5aba1b082509ebf35957de8fc8519513bab105c082d1805b10dafc2670
  184. 9915106e841b954944fde5dc0325d357af1a36379159cdda6b5820ad446cfd64
  185. 99b27f82bdf0b9d06d66fc5ba1b4724a70af7ff2ac8e946d943d34e57cc50e61
  186. 9a5d25a7aff93f16aedecdafd5177aaa3dad35c5edb8d9e8a518648f12395f17
  187. 9bd081c6e6dd85a2f9becf462b93103f6e20e7fbd3d32312af4cd09bb4d0c0ac
  188. 9cab0577c2ca6e719319f424034f979171c9f89f78a080bc9b9643592fa938a9
  189. 9d49cb782f8cdf1efde9fdbd91a2d060c6973781ae0ad446dd61e5e4df39bc52
  190. 9e88b55b8f1a8b7596a3451d20cec1409f1211029dff071065107cec95a17298
  191. a125ac5621c23d3b74e10b7abb328c382936dcb04cc93f2f4ef1a72247cac74f
  192. a175277db531750f67abd129455bc6ab3aa50fce6c7fc810bf028beeebe3d6cc
  193. a1c64aab8e7b730a923d7ae2fbe51a15156187f68de179a10d9661162645f131
  194. a47032d552fa88f613564c376f0e9bb9c61a06fb7a9ab276b6221fa5bc8bd785
  195. a61a0deda93d8fa80ab5dd3d4add6657f5b40a59dbd406e12da2b8cb81968f33
  196. a6460974c7b5b10560c276405ebb5319e8f1eacb51389521297279f19a8df153
  197. a9b0bd88342b96dbc45bd382e4a3156aab968ccdbbcaf1d46e10e3193437fd6b
  198. a9e9773794e01fe63ce9dbf716d6e488bd1b064643c9f2cde947986453c50f9f
  199. a9f98b9575b52930fddab76357c11a1c0e40a985ed9a6e00efce0473dcaf071f
  200. ab5a03b14350ede57924168d9dc2a342c0e1768388f7f6a7183534d3a52d0428
  201. b04d56e3fb5ce61f5ed0b2e5e4add5dd28e5b6f2ab6132b9cf180cabb95dd518
  202. b27a21774c2dd4405071542a9635409bfff2d6e540afe40baa6f2e7dd1535ee8
  203. b37b7a3e79f68138eb6c5a68df7f8566f140d2788a822e7c8f6d69e497ed5b2d
  204. b442f03a6b6659034dd878a3e91adb7f34a2fa0bfa3f51804161f2b632d23713
  205. b522bdfe828f59cc1a9f91943fadd53faece56a19b5296e31be7d026461c1cc8
  206. b5f8c59c6c8acdaf62b582520fc310ece91f8e2f547e9ea0078e949665e0e14a
  207. b660f958efb4b1cb5f67ad307cfc6fe04626d3e00bfde6428e29122600d5aae5
  208. b717281397c44903fe674990d4346a8147c5297d32ddaee92a35c328ed715c31
  209. b776f00014b1c3b386c1669d0b1c279da4a1e17cf78424daba87b8c4ec9979f0
  210. b7cfac0981cc5456afab642958615c3d810fa58792c4d5c7c3e7430ba6367e16
  211. b94c563a72f91b7e1373df33d066db2ef4c7e1f6225bf659073fdfb84b6b53b0
  212. b951a2ade0616c6fc9de663692fc538741367011233cd1173daeb0d086d39870
  213. bc56a31744a03ff135b2706369aa96f6cb80acc5c4817876bea596b8f7e9083d
  214. bd81a6045e54aaaf4778d4ff5289474d2ef48715ae832fc4fc4beffd85a1e3a1
  215. bdfc905723e6deeafd460753c28fbc3450e8b81ccfcba8bdee70a124b87ca1e3
  216. be016c94d35b0c5d5dccf45b52504abab023099d773eebb731f682dafa0088fb
  217. be1d7b3c09eb16e5c0f248950317edbe42cf5f8c5422a6e7a3493b314c6778d4
  218. be75708e4f776689a7f5777815d7a6f5c5d2b7004346879423d61936b41e0b05
  219. bf5ba15f514cdf9e063280b2ec00d69703703db200493c73a8b68235066043bc
  220. bf93bb0a3139b8785ac453c881a921fa74dc91b27decc3d422ea554f160d4b21
  221. c09824732f204c74e4243dffaee70134663d9def563e53283891e193df7da2aa
  222. c4eae866612de76a47fdedd285471b90cd6fe4845c2e082f926f4413fee82ca4
  223. c514bd3935753e7b7058ffe6631c1d8b6eb694efc98b0a17cbfc5a3b1640f4e9
  224. c6f03d7503e5d03eaa460412eee77681376e436d9486689180844d920e068d7b
  225. c72006f07b859c027c08ebb83184d7e74484640184e71740c8fc8c537e2fba5d
  226. c7a842aee397e0996480c949c1d66428c3e6b650432284738303b6ba682b690c
  227. c98d0bccc8a1c858d7fd2f281377e2ed53b54aab1984396f5654259817dadb77
  228. c9d4e79582c3d31a78031a6a4819db5d99c40e6d907a332d8e3c36631d1f3a17
  229. ca1c274d428472242c53c0830eb36046ff57533a2111546051c566261094f2c2
  230. ccc00c1c96a06cfbaeae127f194b53e0eac35f48892e09eb3f20717571814a72
  231. cce5b4145d636f85f1c521fc7d56a74b944e64d45c7f9b66144947eccbafc108
  232. cd1173e9315cd91381645aded85982dce5f519abc684b54d1b71f7fc1841b09f
  233. cd7d9a43dae373829301fde911c7eb2ca5b0516fc99d377b388fa27c08f939d0
  234. cdde15276e6f10f61c0d8a005681b618628078972ba479c67df7c61a730b322a
  235. d12d281e12797114f32f31403b6149c6044c6c7b40cae6a8db1c024a76e82cde
  236. d2ab5a9688af31b4446f10e7133b4b4e42c2c449357a15300f74c7c0c0f1134e
  237. d3d5cddf92e2a5b8e7b5d6b8cd07d60a145692dbeeaf7cf2d6eeff7603e5b322
  238. d4311d5210d35b832a062c8e8dba5d9b64b1c25064cc46b0995bb986c29caf73
  239. d61b48c70586dd7e01692732ec6c76912a92a161b79fe615708435019a356587
  240. d6204ff1edf9d160a0d264914d43906e1b753f15df0424d6abbc0e16d46f00a5
  241. d7702171cd1706455050bb026dc6f5b8559fd9ee974841bb91555f844ab09513
  242. d7ff897f133bca4a11aa92557ffbd3bcea2cef9d582ce9d6b308e1a53f0fdd8f
  243. d8bbce7c1ee9385140aa93917f5e7edbf75bf2c0911b8c7fd39d20f835fb1f39
  244. d90ecab55304791b2bb6dd2041ed84f433ae915d2d0e26ff3c5d5c4d216d48be
  245. d9dcbaad1e3ceb4147d4e841588001c0eab3ee2c23d5d974b35fbbbbae4da4f0
  246. da5b66e52a279a222ddd7f12883e511804575574f29892151b68d4d3980c9ac3
  247. dad88040c0e4684256ed75f02713d31fdf9ef97b02b4bee804e378431b5e1c9f
  248. db3328e5087175e84bea706d9c239594345732c01b35160b5481dae832cebf82
  249. dbae1269393a22f5861fd9b847d9e33f1f87533fef327a22ed2d44db53ca8726
  250. ddf2ed3fb73aaea862e3f84eb9c1252ff4fe1da952a4a8bfe8ae1b317da4922e
  251. de07fcacd4e142bb756fdeed63527d4e7fefe16997685dcb2c8ed5c61e21f10d
  252. de5ea95a0b56fca7ef2f1223af29130b9705648e94fb8fd16d8c978d86f4de5e
  253. de6fbf923b07d99ae0021978d6fed026d27113ce0db1ad73703ca2bd9da5637a
  254. df5882d5596b00dabc138c748280bc78b05b26b4a8f0680af13ffe38ff955e07
  255. df6d6d99cfba891fd3fc8c3cb013370b2958bc44ddad62317926fc659ea21ce7
  256. e04d2fc5796a8c35d5446f4f68bf67daec5e725137548ed76ed3bdabe9637adb
  257. e2b35af5cab71b850f4736bcf054468d2cb267a7e40e3397a1ebc6f0f8c553c5
  258. e7dd18222703ea3d2844ef40f799afad6160bbca890bad1c5a668cadcb2e2a15
  259. e8ba70717b7e75a1c0cc91f54bbacaeac093912aa9e107e72d38eb78ac75d159
  260. e9705127dcdee502eda30be52fced4606959957d110d254ab075214f507cd908
  261. ea26052887aac3f4cd58b5d93dd97fe2ae6b78c8b5eb588ceda47293aa546f1f
  262. eae2efc65c5e26541f05790a7f8448b9afebe9f0689f91460462e52e697b75a2
  263. eb022e6229e949b656ab48d64ed4ed94ac59a24cb9abf96c828e09cfa87d1403
  264. ec260a802cc50462c8facb7cdd0055c48661755c14ecdf38d2a44197ceaabbea
  265. ec914fd1883d0b483bd5c815652a4f675cc67f5a68b29e089fae4c3372c39478
  266. ee72f4a0e29491ef5f1d786ef18d20e0ad0497f6cb3146f873d429ecf8b75ef8
  267. ee9579d472883b5fe2b38b6b0f4c527e205704a3fc893f7f0779cc55785837ee
  268. f03c1dee1c834e59e35d07fb162460e7e5fdd90e82dea272ebbab187e29ec08f
  269. f3558f48c70c3e5855f45e1fe079b6cd4818c9b1299dc0a97550eddf0861997f
  270. f35bc40cbe6783437914a0b877e082a3e95bd394309b225f79aa16543e1c9c31
  271. f4221979504f593206b5de2a4d7dd7e8d8f49774a4a006f9b77e6e124983dd3f
  272. f427d267768229a7387c81b6baab4e89c1119ee570bd7ac756870762988d98c5
  273. f4853dcb6fc3ae947508fa8058dffc2fdda4c5a670f7489e3f611997cdb62788
  274. f6bfa6b402f492516094deab288c47a2138bea0e382b7939df167ce1fade64f8
  275. f893720e25dbd7e5a0a34c0ec4d4dc3f56eec175da3750d91cff86eada466645
  276. f97c3916551506275091f0ddf6c96ad27f8b317976ca3f903a0c98792c320248
  277. fab899a487cb3dfeb36dc025b5b2104ba4ee70cbf899db55f38ed99d74224ece
  278. fb5a1ca4132d75c30d45fc84f3095bcc9bb46d37fec770ab36e258299faf98ec
  279. fba60a6813832962a68282d08f4952f8c1f7439be8fe4a407949acb068504e2b
  280. fc054d9b5aea85f642daf1a767c6b9cb7790564e8e338804a2b9bdc04c4ce306
  281. fc14b495afee7e366c6835340af63ee075ec36d4d923e12d71ca44c50238de7f
  282. fc48afa1ad59768813f4a71a78c644f499f006124d771d799ad31d74af16f9cd
  283. fd4b2043471ac0035c810fad2dc20eb01ed5b8aed676390c3dbe87be8079c540
  284. fd597743ca76bf460cce1669923d1f50915bc87b16ce4d4a4eb83f3afdc63351
  285. fd70a1a49a96b3e2e027b30f7589b586840fa36b40534ef11a001b3b0530a49c
  286. fea94a94ab3de157cb844fd7f34c5761975f43c71b08fafe435a9c064d2ea24e
  287. ffb5cde146a4cc3c4b8457cc3650cd87436a140ca2c555c77364ccea98fcfa0d
  288.  
  289. Batch Names:
  290. scriptxls_00f55d60-97d6-42ab-9a9b-42206f363b95_btcjune_wddisabler.bat
  291. scriptxls_0a283509-fe1d-4a2e-acf1-31b31a4a407d_t5samsung2020_wddisabler.bat
  292. scriptxls_0b54896f-30e8-48c3-82fe-714f927f7154_nitrix.bat
  293. scriptxls_0ba7f648-a08f-442d-845b-a212db8331a7_btcjune_wdexclusion.bat
  294. scriptxls_0ddf6d19-9414-4750-919d-c0289f2df08f_nitrix_wddisabler.bat
  295. scriptxls_0ef51b30-be9c-4dfe-a83b-78e90c25a2f8_xavierdev_wdexclusion.bat
  296. scriptxls_0f7ac1da-d28a-4c78-9b1d-7c09f6ac9190_boblarsers2_wddisabler.bat
  297. scriptxls_0f53a4e9-68dc-4ecf-bb0e-d36dcf8d9548_mic12_wddisabler.bat
  298. scriptxls_0f863a3e-359f-46c5-af8c-25cc4a56d311_Python.bat
  299. scriptxls_01d1f8e4-8419-48a6-b693-5d128f0f7db8_zombie99_wdexclusion.bat
  300. scriptxls_1b63a204-a5ff-4e68-b2f1-9ce11250251d_nitrix_wdexclusion.bat
  301. scriptxls_1d642b08-63fb-48f0-b0ff-1cef804bfbff_btcjune_wdexclusion.bat
  302. scriptxls_1e556f0c-7666-4eac-97d5-02d851165a25_nitrix_wdexclusion.bat
  303. scriptxls_1f150bd6-4028-4835-9f8c-e6f9d47016c6_t5samsung2020_wdexclusion.bat
  304. scriptxls_1fa774d7-0061-41ce-a72a-8d47245135eb_nitrix_wdexclusion.bat
  305. scriptxls_2c339ad8-c046-48c5-b83f-7d5a34fa3754_centank_wdexclusion.bat
  306. scriptxls_2c272037-e30e-4cc7-9f8e-0545b9569f6d_ZaiTsev_wdexclusion.bat
  307. scriptxls_2cf89402-abfe-4ff9-8ecd-2c0d00de51b3_t5samsung2020_wddisabler.bat
  308. scriptxls_2d976489-9381-42ee-a595-6b96a31b72ba_btcjune_wdexclusion.bat
  309. scriptxls_2f7b9bf9-98ae-4da4-8776-cbbaa24aeef6_boblarsers2_wddisabler.bat
  310. scriptxls_2fd3474c-6a6d-4692-a057-dc126bec732f_nitrix_wdexclusion.bat
  311. scriptxls_03ecace0-b352-41f4-a343-c71d53da7343_warlords_wddisabler.bat
  312. scriptxls_03f5d3c5-13f8-493b-bb33-d8c7e357eb21_nitrix_wdexclusion.bat
  313. scriptxls_3a0dfabc-af72-4701-afec-941503e35501_apo93_wddisabler.bat
  314. scriptxls_3a5561be-3d2a-4cf2-b5f0-5dae93b1481d_nitrix_wddisabler.bat
  315. scriptxls_3be1c9dd-7082-4368-8ab1-269ace11f574_somasekharraddyn_wdexclusion.bat
  316. scriptxls_3d65fd14-73d7-4649-9536-dcd84e6bfa52_kingshakes_wdexclusion.bat
  317. scriptxls_3de7db24-35de-4862-8e3a-45867e2b865d_nitrix_wdexclusion.bat
  318. scriptxls_3e5387fe-5a63-424f-aba8-ee76bf325d7e_warlords_wdexclusion.bat
  319. scriptxls_3e376366-8b4a-47fa-b625-54b988403c40_crownking_wdexclusion.bat
  320. scriptxls_3f5be1ba-f93e-47af-9f75-9a1fe01bf2b5_tozmac_wdexclusion.bat
  321. scriptxls_3f4881bc-76f4-4384-9001-e1dd6176a269_t5samsung2020_wdexclusion.bat
  322. scriptxls_04a09d35-8cc1-4bc3-9caf-1ef3497ef648_centank_wdexclusion.bat
  323. scriptxls_4a6c3f8b-9714-4b72-aa7d-261fe1d35a4f_danmill5241_wdexclusion.bat
  324. scriptxls_4a572b0d-d305-4bdb-abae-2533598bf748_t5samsung2020_wdexclusion.bat
  325. scriptxls_4d3c94a8-4eb1-497e-be27-47945551c4c8_nitrix_wdexclusion.bat
  326. scriptxls_4d487a76-8f42-4da7-9c60-e81de6f81877_zombie99_wdexclusion.bat
  327. scriptxls_5b9f44c3-f477-4420-8584-eeb127ffcdff_mic12_wdexclusion.bat
  328. scriptxls_5d1bfbde-45ba-4873-93f9-da01490a141a_mic12_wddisabler.bat
  329. scriptxls_5d1688b5-241a-4a28-b94f-618209e03c2d_makaveli_wddisabler.bat
  330. scriptxls_5dc49f33-9a87-4344-9ac2-1404e2b1201a_ZaiTsev_wdexclusion.bat
  331. scriptxls_5ef43721-53b5-4cb2-85d4-2ae9138e4d04_motolux_wddisabler.bat
  332. scriptxls_5f8641a3-7f4a-47ca-b170-d131e64fa722_jew_wdexclusion.bat
  333. scriptxls_6a9cbef1-92b6-4848-a268-0c5c6b27274f_apo93_wdexclusion.bat
  334. scriptxls_6b77bd3e-9a30-475d-a3ac-26d1c63e1fbf_crownking.bat
  335. scriptxls_6c9ceb5d-e06d-4f50-a4b5-243c066c96a0_tozmac_wdexclusion.bat
  336. scriptxls_6cbcaea2-8f9f-4cc7-8ae0-f2aa4254d046_boblarsers2_wddisabler.bat
  337. scriptxls_6d7a92a7-fa00-4e92-bbfe-f906efa8e844_nitrix_wdexclusion.bat
  338. scriptxls_6d239558-eb6c-4914-abd9-095c5c498c8a_apo93_wdexclusion.bat
  339. scriptxls_6eb27a63-8458-4237-8273-067eb0452d8f_btcjune_wdexclusion.bat
  340. scriptxls_6ef03fb7-9a9e-483d-bf2b-5a7c3170cf32_xavierdev_wdexclusion.bat
  341. scriptxls_6f33e493-317b-4129-923b-95935a3cea76_mic12_wddisabler.bat
  342. scriptxls_6f930a6f-3770-49ea-8f5e-d31dd2d11c7c_nitrix_wdexclusion.bat
  343. scriptxls_7a23eb92-30cd-4d18-8038-7472a149ebea_ZaiTsev_wddisabler.bat
  344. scriptxls_7ce75859-983c-4754-9425-b06acd8f053e_mic12_wddisabler.bat
  345. scriptxls_7d8d736d-d47d-4f29-ba04-f0b2e81502cf_apo93_wdexclusion.bat
  346. scriptxls_7d157525-6763-4cb8-bfe2-502e9b81dac8_mikky_wdexclusion.bat
  347. scriptxls_7e06cb22-945e-4fb7-ac13-ca053b271d7d_nitrix_wdexclusion.bat
  348. scriptxls_7e79dec3-7c1a-429e-b9f0-50dd2c5cc8b8_rroki123_wdexclusion.bat
  349. scriptxls_7f3a3cbd-2af3-45a9-af55-6cfd68cbcfd9_COLAFORCE1010_wdexclusion.bat
  350. scriptxls_7f8c1364-9f19-4ef5-a0db-4119306df758_mic12_wddisabler.bat
  351. scriptxls_7fb76650-e063-41ca-84fe-130f94f56c91_btcjune_wdexclusion.bat
  352. scriptxls_08e13a78-d825-4d2e-878e-1355f933a01b_mic12_wddisabler.bat
  353. scriptxls_8c2d9e0f-a408-4fba-b748-8afaf9df4dec_boblarsers2_wddisabler.bat
  354. scriptxls_8ce320b0-f8b3-41ac-9c88-13accb2dfa99_nitrix_wdexclusion.bat
  355. scriptxls_8d7afdf5-7718-4700-a6e0-71cf6554ac25_nitrix.bat
  356. scriptxls_8d102c5a-e43b-47a3-a7e6-0b4d4802e731_xavierdev_wddisabler.bat
  357. scriptxls_8dc7fb9c-4faf-4576-bfdf-000c2237ab1b_makaveli_wddisabler.bat
  358. scriptxls_8e2e9235-daf1-4bda-a2b5-f58c316cf487_btcjune_wddisabler.bat
  359. scriptxls_8e9ffc32-f45f-49cd-8b12-f70df02fbc7c_mic12_wddisabler.bat
  360. scriptxls_8fbfe8c7-bd95-420f-a340-39af8318945a_bayalbatros_wdexclusion.bat
  361. scriptxls_9a4cf976-0d2a-4578-9aa4-32ca85b9f174_kingshakes_wdexclusion.bat
  362. scriptxls_9a61e95c-27dc-4350-a5da-0b5fa7ac190b_apo93_wddisabler.bat
  363. scriptxls_9a4930cd-ae70-46c9-870b-b5b948cf829f_btcjune_wdexclusion.bat
  364. scriptxls_9ab73e64-5784-46f6-8cbd-4f213426141b_ZaiTsev_wddisabler.bat
  365. scriptxls_9b774e24-5323-415a-ae34-9e51e2b1324a_btcjune_wddisabler.bat
  366. scriptxls_9ba7c4c7-b00c-4b2f-a79f-184d9b0c629a_crownking.bat
  367. scriptxls_9bfb114f-f10a-4ce9-b989-a952f673b451_nitrix_wdexclusion.bat
  368. scriptxls_9e6e1cc6-4c15-475b-b8e8-b507c8aacb88_nitrix_wdexclusion.bat
  369. scriptxls_9f3cafdd-c727-4dc6-abea-e928fb76b34a_makaveli_wddisabler.bat
  370. scriptxls_9f09bb5f-e16b-45f6-b944-143596495291_kingshakes_wddisabler.bat
  371. scriptxls_9f9b28ba-4999-4599-8296-a4f7716bebd9_nitrix_wdexclusion.bat
  372. scriptxls_13bf4049-defb-45cf-970e-6ae0438b59c1_tozmac_wdexclusion.bat
  373. scriptxls_14c2da69-0099-4e2b-a84e-99d26ebb80eb_boblarsers2_wddisabler.bat
  374. scriptxls_16cf7f9f-ea38-48d7-91c7-d8c03be31f93_ZaiTsev.bat
  375. scriptxls_18f91a7a-549b-438b-b253-797529819b76_centank_wdexclusion.bat
  376. scriptxls_19c6ee75-96e5-4b83-9aff-21d195976948_btcjune_wdexclusion.bat
  377. scriptxls_20f373f6-8279-473e-95bd-eae0a9e56f0f_nitrix_wdexclusion.bat
  378. scriptxls_23fd2498-68f2-4ef5-8eb3-c39d988a614a_btcjune_wdexclusion.bat
  379. scriptxls_24dbcf79-e159-4fca-8b58-8a457a4bd709_t5samsung2020_wddisabler.bat
  380. scriptxls_27a8d15b-8bff-4e61-9800-71a4b190949e_somasekharraddyn_wdexclusion.bat
  381. scriptxls_28bea83b-505a-4d84-b464-96690be0c071_nitrix_wdexclusion.bat
  382. scriptxls_30d68157-a5b5-4ba3-af86-c9acbef4ae25_motolux_wddisabler.bat
  383. scriptxls_36efe42f-ef42-450e-9490-8ed8ba6f97c8_tozmac_wdexclusion.bat
  384. scriptxls_048ede03-6fff-4104-ad45-7d5a96c1a1a6_btcjune_wdexclusion.bat
  385. scriptxls_51d78b6e-16e1-4a63-904e-785690e5368a_mcoode55_wdexclusion.bat
  386. scriptxls_52ae53f9-ed09-41c0-9894-17f4bceadf71_nitrix_wdexclusion.bat
  387. scriptxls_52c77428-1d4d-4263-9b7a-7de207aa950d_nitrix_wdexclusion.bat
  388. scriptxls_53bdc25c-0421-4469-a9b8-32584edea34e_danmill5241_wddisabler.bat
  389. scriptxls_57aa0b13-17a5-4944-8565-8c6bb7629d12_xavierdev_wdexclusion.bat
  390. scriptxls_59e49bee-dd24-482d-9516-bdd3cee2cf25_xavierdev_wddisabler.bat
  391. scriptxls_59ee875a-afcf-478c-a3df-3e1864bc61e2_boblarsers2_wddisabler.bat
  392. scriptxls_60acaae8-a9d7-4500-82f6-db3d9a66bf09_btcjune_wdexclusion.bat
  393. scriptxls_65c333d3-7bdc-41f1-93f5-c173dc279206_nitrix_wddisabler.bat
  394. scriptxls_65d2382b-dd21-4b82-bad8-f2e5d8dedd03_mic12_wddisabler.bat
  395. scriptxls_65fddfc8-2909-40a7-9095-f91084c47607_btcjune_wdexclusion.bat
  396. scriptxls_068c3f67-95d2-408c-aad4-00a0acc6ea40_xavierdev_wdexclusion.bat
  397. scriptxls_68d90805-bb42-4653-a429-be10143b475e_apo93_wdexclusion.bat
  398. scriptxls_70b67f36-3f19-42df-bf9b-f305ea6d1160_centank_wdexclusion.bat
  399. scriptxls_71e6f76c-69c5-4356-a5ab-dbf7efd0fbb6_kingshakes_wdexclusion.bat
  400. scriptxls_71eb40fe-100c-49aa-a424-7c14243f61b8_apo93_wddisabler.bat
  401. scriptxls_71f00899-12dc-4891-8381-553e5d770de5_centank_wddisabler.bat
  402. scriptxls_72f3148d-3b73-4bce-9582-371d7e3e3046_t5samsung2020_wddisabler.bat
  403. scriptxls_73e5ebd6-b3bc-4c37-935a-d6619c48e05d_xavierdev_wdexclusion.bat
  404. scriptxls_74dd26d5-a953-4ccf-933f-66876322a12c_somasekharraddyn_wdexclusion.bat
  405. scriptxls_75b17ba1-3c51-49b5-9161-3f2b4e1df48b_motolux_wddisabler.bat
  406. scriptxls_77ee59ec-95cc-452b-92ac-baa5474a8187_centank_wdexclusion.bat
  407. scriptxls_79bb9224-4434-4772-a8bd-969e2fd68d41_motolux_wddisabler.bat
  408. scriptxls_81b12716-c7d5-472b-a927-f9fcc0691fc6_btcjune_wddisabler.bat
  409. scriptxls_85e7a514-e786-4480-b48e-9cf10fa686ee_spicytorben_wdexclusion.bat
  410. scriptxls_87bed3a2-4d81-4ab9-9f3e-62523b4d99fb_rroki123_wdexclusion.bat
  411. scriptxls_89a157ee-caa5-45ba-946e-217750743b7f_mikky_wdexclusion.bat
  412. scriptxls_90cb1283-1000-41fd-b466-b584e94cd721_motolux_wddisabler.bat
  413. scriptxls_91a0b815-2715-49c4-b7db-414e6fa030ea_tozmac_wddisabler.bat
  414. scriptxls_91d335a1-0cf0-4cd9-8f5a-33030249a6d3_nitrix_wddisabler.bat
  415. scriptxls_91e6721c-2823-4f69-b77e-f955773a1fcf_apo93_wdexclusion.bat
  416. scriptxls_98b2be42-c503-4137-ad3b-05efa1d610c4_Python.bat
  417. scriptxls_98b984fd-3d8c-41c3-94ca-a4b1cfc26327_nitrix_wdexclusion.bat
  418. scriptxls_125cc861-c2d3-4ff7-b6cf-356c330c503c_mikky_wdexclusion.bat
  419. scriptxls_170dca22-7642-46d1-afdf-4826644f6b57_Python.bat
  420. scriptxls_175c2ed7-832c-4652-9f70-730e4320ecb9_crownking_wdexclusion.bat
  421. scriptxls_193a87a3-6c8c-4d89-8d14-8f62bee7e5ed_kingshakes_wdexclusion.bat
  422. scriptxls_205ad08f-5285-4a24-baf6-b71d2351cdcc_nitrix_wdexclusion.bat
  423. scriptxls_234f4d7c-1e3d-4484-9fa3-af3285a16f53_mcdon_wddisabler.bat
  424. scriptxls_252ccc03-cff7-4201-92b5-0ec0549f6b3f_apo93_wdexclusion.bat
  425. scriptxls_271d91d0-7aa2-4ce7-85ff-100823c65677_mic12_wddisabler.bat
  426. scriptxls_293d9d67-785c-4be1-b10c-1502952aa942_tozmac_wddisabler.bat
  427. scriptxls_356c5c57-603b-4fda-ae6d-342ad99a8157_nitrix_wdexclusion.bat
  428. scriptxls_368abcae-104a-4972-8945-a2c7f7dfd200_mic12_wddisabler.bat
  429. scriptxls_388ca40c-c86d-4e36-b0aa-367f574effda_ZaiTsev_wddisabler.bat
  430. scriptxls_389c7dca-54fc-4e8f-9833-db9acb4c9ea6_nitrix_wdexclusion.bat
  431. scriptxls_392ca006-2c08-4f76-a022-12c7ef904f02_tozmac_wdexclusion.bat
  432. scriptxls_451d3989-af8a-4ba1-9ad6-7133b2ec86b8_motolux_wddisabler.bat
  433. scriptxls_495d5a13-cc12-4ed7-9158-d3e77318094b_mic12_wddisabler.bat
  434. scriptxls_546e3c39-4b25-4a53-8027-32890708cc13_Python.bat
  435. scriptxls_556f4a3f-66ad-41be-97ae-d6d2ab1c3b3e_nitrix_wdexclusion.bat
  436. scriptxls_599c6ff5-8ad4-4d4a-8450-d8ad0f705dc8_nitrix_wdexclusion.bat
  437. scriptxls_632dd24c-fe3f-49f5-8d92-5183043eedff_btcjune_wdexclusion.bat
  438. scriptxls_663c821c-d997-4e5e-9a89-6c6939950e57_makaveli_wddisabler.bat
  439. scriptxls_693e34ca-7c80-4c7c-826e-aa7ea385b69f_apo93_wdexclusion.bat
  440. scriptxls_695ab846-8601-4ae4-9479-86ab4e6efd02_mic12_wddisabler.bat
  441. scriptxls_759ba26f-7eed-4063-9f01-3f462e21e715_apo93_wddisabler.bat
  442. scriptxls_778fa631-d5b3-4a4b-9b02-74d57f78a73a_nitrix_wdexclusion.bat
  443. scriptxls_792bc03a-5a9b-40fc-bac8-2693d215238b_ZaiTsev_wddisabler.bat
  444. scriptxls_886e98c3-38d9-4502-8f58-7dc94f5aff51_mic12_wdexclusion.bat
  445. scriptxls_930e2709-4817-4d86-b1cf-6853b4bcc4dc_nitrix_wdexclusion.bat
  446. scriptxls_933dc9f0-5682-4d68-af3b-9c7d1b582e60_ZaiTsev_wdexclusion.bat
  447. scriptxls_951a4da1-ca98-462d-b90e-06604d78bb1f_nitrix_wdexclusion.bat
  448. scriptxls_986ce3c6-9036-495b-af72-e3e37ab02afc_centank_wdexclusion.bat
  449. scriptxls_1017ffff-59e5-475c-99f2-4ac1b04946eb_motolux_wddisabler.bat
  450. scriptxls_1515bd72-8d98-407e-a963-3e540195a37c_bawbaw_wdexclusion.bat
  451. scriptxls_1611dcef-baee-4333-9dd2-9a11bf1eef60_mic12_wddisabler.bat
  452. scriptxls_1736de65-ad3a-4f2b-99aa-69795fb5d2ce_nitrix_wdexclusion.bat
  453. scriptxls_2912b007-5a00-4ddf-a3c6-6171b0a36522_mic12_wddisabler.bat
  454. scriptxls_3813b131-52dd-4171-b52b-d5a2051193c2_bayalbatros_wddisabler.bat
  455. scriptxls_4254ddfa-8db3-4b19-9dd1-32b707a1ab06_kingshakes_wddisabler.bat
  456. scriptxls_4758e4e5-8659-49d9-9791-ab9c0ab746d7_kingshakes_wddisabler.bat
  457. scriptxls_4867e5b3-3a76-4f80-bb28-e363fb78e047_ZaiTsev_wddisabler.bat
  458. scriptxls_5310ca51-3c91-4d3b-b948-9dc0bd07edb2_t5samsung2020_wdexclusion.bat
  459. scriptxls_5936b152-d11d-467b-bba0-16db5803bfb4_centank_wdexclusion.bat
  460. scriptxls_5961eeee-36da-4a48-bc3b-1763a61a2753_nitrix_wdexclusion.bat
  461. scriptxls_6871b9bc-edc3-46ee-b6ba-d254fde65f54_mikky_wdexclusion.bat
  462. scriptxls_7889fbbb-2021-4bbf-a8e7-8240b0f46b30_makaveli_wddisabler.bat
  463. scriptxls_8249ba6d-5fc3-44a7-9526-f3d2dc501e27_nitrix_wdexclusion.bat
  464. scriptxls_8991be2a-968f-48a7-a5d6-7ad0fa743a2d_kingshakes_wdexclusion.bat
  465. scriptxls_8999c4e8-7972-4f0c-95ca-5b4292602427_t5samsung2020_wddisabler.bat
  466. scriptxls_9888dcd2-8734-4ee1-a873-3f22c05e7ac7_bambobimpe1_wddisabler.bat
  467. scriptxls_13143cf7-e476-44b8-8967-c948fcfa9cbc_mic12_wddisabler.bat
  468. scriptxls_14597d74-310a-43d4-8637-53f635a44a46_btcjune_wdexclusion.bat
  469. scriptxls_21774f0f-cd6e-48b4-b5d7-41e5cd854d17_btcjune_wddisabler.bat
  470. scriptxls_31755a41-9504-4577-a038-4128e4f573a9_mic12_wddisabler.bat
  471. scriptxls_41427f56-37af-4efe-ae13-7da351b60e10_t5samsung2020_wddisabler.bat
  472. scriptxls_51545d2f-1ca8-48d3-8015-22ce3810ee89_makaveli_wdexclusion.bat
  473. scriptxls_53418a90-651f-4011-8203-d2b5b995fb41_jew_wddisabler.bat
  474. scriptxls_61658e47-446f-425f-b077-df55860fbd94_kingshakes_wddisabler.bat
  475. scriptxls_90848acc-42d3-479c-87e0-697e76b84d16_kingshakes_wdexclusion.bat
  476. scriptxls_92428bd5-5155-4550-8dcd-0ac1d8f45dbd_bawbaw_wdexclusion.bat
  477. scriptxls_521425c5-f026-494e-9563-51d3bada40d1_apo93_wdexclusion.bat
  478. scriptxls_799079b3-8d0f-45bc-9d5e-e4d1291aa417_kingshakes_wdexclusion.bat
  479. scriptxls_877547c4-7774-4a12-9821-8331d2b43f23_apo93_wdexclusion.bat
  480. scriptxls_0922578a-4fde-4239-a275-249c95365da3_ZaiTsev_wddisabler.bat
  481. scriptxls_01005139-2a03-4123-9c40-a751fa3c2827_kingshakes_wdexclusion.bat
  482. scriptxls_2214754e-bd0b-4e70-875d-cf6cce8b93b0_nitrix_wdexclusion.bat
  483. scriptxls_6543847b-e91f-4408-b61d-3ede2ea705da_nullptr_wdexclusion.bat
  484. scriptxls_8396856d-847a-4e9b-979e-8d2118b0d40d_jew_wddisabler.bat
  485. scriptxls_9254751a-73bc-4ffa-921b-f95b3087fcf7_btcjune_wdexclusion.bat
  486. scriptxls_9530757d-f12a-479e-a9be-1930b62d2233_somasekharraddyn_wdexclusion.bat
  487. scriptxls_36504510-4f0f-452e-b927-731de1cec796_tozmac_wddisabler.bat
  488. scriptxls_76815903-bf12-4618-bcce-e61889d0bcc1_crownking_wdexclusion.bat
  489. scriptxls_89902768-e943-4844-a55e-d8b625773e63_rroki123_wdexclusion.bat
  490. scriptxls_a0d35a90-dfbe-4b75-ac5a-db7035028c75_nitrix_wdexclusion.bat
  491. scriptxls_a1b4c423-bf53-42ad-8022-e9348794ac71_nitrix_wdexclusion.bat
  492. scriptxls_a9cfe9ac-e625-4293-9f2e-8c7e3b01793a_tozmac_wddisabler.bat
  493. scriptxls_a9d8cf80-53d5-4c48-8ff2-f7e8e53ba10e_kingshakes_wddisabler.bat
  494. scriptxls_a10df4f4-5269-4795-8806-23a7b23de634_apo93_wdexclusion.bat
  495. scriptxls_a56a6c16-d2c0-4ec2-a0d6-3f384d1f3b04_makaveli_wddisabler.bat
  496. scriptxls_a56d5e96-532e-4141-a2ed-61fa4d3cb2b4_apo93_wdexclusion.bat
  497. scriptxls_a65fa9f1-17dc-47e1-bb67-54a6ccfb7d2e_nitrix.bat
  498. scriptxls_a0629e99-58c7-43b1-9a56-e2ac1a083709_nitrix_wdexclusion.bat
  499. scriptxls_a4311e24-6438-4de5-ae99-e5a8b695b008_t5samsung2020_wdexclusion.bat
  500. scriptxls_a9539c8b-8844-486f-b4b6-89eb27e72ddc_mic12_wddisabler.bat
  501. scriptxls_a631565f-7073-4d9d-95a6-693abcbf1c1e_motolux_wdexclusion.bat
  502. scriptxls_aa327173-14bb-4a40-9bd1-2c2a063d32f3_boblarsers2_wddisabler.bat
  503. scriptxls_abd3bc6f-7ce9-48fa-b9db-a755ec9c009d_Python.bat
  504. scriptxls_ac8e89b2-6de0-4b70-942b-aab9287a312b_silenthide_wdexclusion.bat
  505. scriptxls_ae8d80b7-3eb7-4ef9-96f4-23428965c9b1_mic12_wddisabler.bat
  506. scriptxls_af1f057f-7397-4a2d-8019-5afba537d2e5_t5samsung2020_wddisabler.bat
  507. scriptxls_b3d3a769-5e46-481c-90bb-b7aa7ea6fe56_nitrix_wdexclusion.bat
  508. scriptxls_b06be87e-360f-41a3-a8fa-f2f9141e1b93_nitrix_wdexclusion.bat
  509. scriptxls_b9d6d1fc-6595-4dbb-8683-e2ff50cdf6d5_mic12_wddisabler.bat
  510. scriptxls_b9e3f1e5-a6c2-49f4-a1d6-cb39c1504e2d_fryandsell@gmail.com_wddisabler.bat
  511. scriptxls_b24aa1ba-1ff6-4686-bd3e-d275074bcc46_centank_wdexclusion.bat
  512. scriptxls_b73ccf73-7c11-4b69-a056-8bc00b2f6283_apo93_wddisabler.bat
  513. scriptxls_b77d3467-3fa9-476c-8d87-b28acb6151a7_nitrix_wdexclusion.bat
  514. scriptxls_b81aa404-5fbb-47ef-a32e-15d623978620_mic12_wddisabler.bat
  515. scriptxls_b088eeaa-7c4d-4be8-9388-2cc8e8f2f275_mic12_wddisabler.bat
  516. scriptxls_b96fb058-4eaa-4467-86e8-f0d366176680_spicytorben_wdexclusion.bat
  517. scriptxls_b1001b8a-8bc8-4b7a-a702-0563140829e2_crownking_wdexclusion.bat
  518. scriptxls_b87712e1-360e-40a2-ac21-467d04362be4_xavierdev_wdexclusion.bat
  519. scriptxls_ba7f964d-8d3a-4491-ac35-2e42574ecd50_kingshakes_wdexclusion.bat
  520. scriptxls_be5cf268-13f0-4b32-9ddc-92538b893249_makaveli_wddisabler.bat
  521. scriptxls_be15db82-4b22-4afb-8c1c-3332a7de107f_tozmac_wdexclusion.bat
  522. scriptxls_bf544d50-20b2-44d9-916f-90776d3727f8_jonathanandy77_wdexclusion.bat
  523. scriptxls_c0b3c446-27d4-4e7c-9f36-8523a7d5332c_bambobimpe1_wddisabler.bat
  524. scriptxls_c2b7b897-c525-45d4-a601-ffad26929381_jew_wdexclusion.bat
  525. scriptxls_c8eaa6db-4b1d-4b15-9822-69472bff1ea5_mcoode55_wdexclusion.bat
  526. scriptxls_c13b2fb8-c0fb-4cdc-8fb3-c647acbb1d4f_crownking_wdexclusion.bat
  527. scriptxls_c18dfde3-29ff-4f85-b2af-2bcaff5b6b23_motolux_wddisabler.bat
  528. scriptxls_c26f782c-9add-4a81-99c1-326d6b1509be_Python.bat
  529. scriptxls_c69df2e5-2d47-4944-b764-d9593342cee1_kingshakes_wdexclusion.bat
  530. scriptxls_c70c4f57-62d6-4374-803d-5746a5171268_bawbaw_wdexclusion.bat
  531. scriptxls_c71e0460-6344-4a72-8f19-569c84b52463_makaveli_wddisabler.bat
  532. scriptxls_c74b49f5-aba6-4ee2-a3fc-672536d51f00_nitrix_wdexclusion.bat
  533. scriptxls_c92b812f-7a6b-45c0-889b-c0893c9cd5e2_btcjune_wdexclusion.bat
  534. scriptxls_c610c5ae-a3ed-4175-afb2-90a1181b8463_btcjune_wdexclusion.bat
  535. scriptxls_c67350e2-502b-4fd8-8163-0eb96c7525bc_nitrix_wdexclusion.bat
  536. scriptxls_c85906c3-51bb-4549-879f-bb7f5d7f194a_motolux_wddisabler.bat
  537. scriptxls_c4872155-989a-4c41-9543-3652409c4877_t5samsung2020_wdexclusion.bat
  538. scriptxls_cb09f580-c5db-49c3-bb19-a3b401cb6cc8_kingshakes_wdexclusion.bat
  539. scriptxls_cb4147b3-a39d-4d7a-9d41-57e28d04d0a8_mikky_wdexclusion.bat
  540. scriptxls_cbd37258-fccc-4c54-aa6e-a10995235589_btcjune_wddisabler.bat
  541. scriptxls_cc6c7b33-cad2-49a7-9fc1-7d8ae2da87ee_mic12_wddisabler.bat
  542. scriptxls_ccf6bb61-c8ee-4384-a33d-4337416ce196_makaveli_wdexclusion.bat
  543. scriptxls_ce8be52a-aa96-4ddb-90e1-affe405a3361_btcjune_wdexclusion.bat
  544. scriptxls_ce8fa1cb-f48d-42f3-b53b-416c70bbd936_kingshakes_wdexclusion.bat
  545. scriptxls_d1dc5176-0525-45ba-be13-79a349505c84_xavierdev_wdexclusion.bat
  546. scriptxls_d3d975db-59e7-4d64-bdae-9f656eb86127_mic12_wddisabler.bat
  547. scriptxls_d05abab2-e11c-4ae3-9334-b850db63c65a_xavierdev_wdexclusion.bat
  548. scriptxls_d07c6510-00f9-4c85-ab8f-e1464613d8ac_boblarsers2_wddisabler.bat
  549. scriptxls_d7acce94-a60e-409c-aba6-7c1860dae29e_nitrix_wdexclusion.bat
  550. scriptxls_d9b73bc2-a472-4e1c-9d18-e6df8d4d36a7_mic12_wdexclusion.bat
  551. scriptxls_d1657d68-4f88-43d6-91e3-73d2e61833af_centank_wdexclusion.bat
  552. scriptxls_d7841bc3-e66c-4ddf-b2d2-d100f5d63ba8_tozmac_wddisabler.bat
  553. scriptxls_d8688eec-1081-433d-bb04-ebe5ed7b230e_mic12_wddisabler.bat
  554. scriptxls_d33440af-f62d-42ec-b64c-0fb6179ff8ee_crownking_wdexclusion.bat
  555. scriptxls_db775aa7-814f-46a6-944f-9d531612a14a_nitrix_wdexclusion.bat
  556. scriptxls_dc01d6d7-e0e9-4802-839b-4a8d88456300_pr3torian_wdexclusion.bat
  557. scriptxls_dcc93656-64e8-4ec0-82ae-ffb4c88fe1e9_boblarsers2_wddisabler.bat
  558. scriptxls_dd178a90-9c94-4dc9-a8aa-b93a99887ad0_kingshakes_wdexclusion.bat
  559. scriptxls_dd113836-bba3-4ee5-a09c-0fd83a5d1510_tozmac_wdexclusion.bat
  560. scriptxls_de4a9ec2-e549-4801-a6a2-abc7358bf889_apo93_wdexclusion.bat
  561. scriptxls_df3b7ee8-0ed3-4c3b-b015-59ec302de06c_btcjune_wdexclusion.bat
  562. scriptxls_df4c66f8-e972-45ac-abd4-ad198f78a4a0_nitrix.bat
  563. scriptxls_df669d16-3f88-44b8-b14b-5e6cb0c97b0d_kingshakes_wdexclusion.bat
  564. scriptxls_dfbc21a7-b1cb-4ae1-8cfc-e621ec6d0b3f_crownking_wdexclusion.bat
  565. scriptxls_dff75464-c311-4a70-8b3d-724b5f876fb6_t5samsung2020_wdexclusion.bat
  566. scriptxls_e1a7435d-cb51-45c3-b7cb-0bb4a3ce7e19_makaveli_wddisabler.bat
  567. scriptxls_e1dd2342-a5ae-4cd2-8d1a-9622a241a5db_nitrix.bat
  568. scriptxls_e4c2bdf1-4b26-4c82-a5da-b0fc4217b222_tozmac_wddisabler.bat
  569. scriptxls_e20f76c2-1b83-4df4-99dd-1ae20052c1d5_apo93_wdexclusion.bat
  570. scriptxls_e41dd20a-7037-4db3-8d59-05da41f12d2e_t5samsung2020_wddisabler.bat
  571. scriptxls_e717a852-3968-41cc-9fd7-0356e4de364e_nitrix_wddisabler.bat
  572. scriptxls_e6439a6d-1fe9-41e5-a887-6e076bbd9ae4_nitrix_wdexclusion.bat
  573. scriptxls_e6646d4b-b6c6-40b1-bc2a-c6aad7d8df49_nitrix_wdexclusion.bat
  574. scriptxls_e8924656-045f-4e75-b89c-2c24ff2543b8_makaveli_wdexclusion.bat
  575. scriptxls_eac83d15-9997-4607-90e6-85a1ac088678_centank_wdexclusion.bat
  576. scriptxls_eb83e8ac-3d66-4c67-a689-0211fcdd2e12_makaveli_wddisabler.bat
  577. scriptxls_ede8b46d-7b21-4fa7-9065-867b49d1dfdf_ZaiTsev_wddisabler.bat
  578. scriptxls_ee34fcbc-f420-440f-99c8-26123cf6706f_bawbaw_wdexclusion.bat
  579. scriptxls_ef0bdd5a-4220-4d03-8a53-6f17da6b7c0f_centank_wdexclusion.bat
  580. scriptxls_f4d7b7c9-ccaf-4cf4-9dbc-c5910152897b_t5samsung2020_wddisabler.bat
  581. scriptxls_f4e79834-cc33-4a3b-95eb-92a0dc9e3c1a_nitrix.bat
  582. scriptxls_f31bac21-8f83-4e86-a2b6-7ca2f206feb6_tozmac_wdexclusion.bat
  583. scriptxls_f45ef2d8-2e99-4085-aa39-890dd5dc43a8_mikky_wdexclusion.bat
  584. scriptxls_f52d838e-7250-4cbf-8c00-63e9565f66a7_Python.bat
  585. scriptxls_f779fab9-ed6f-47c0-bbb2-26fd0051a75f_ZaiTsev_wdexclusion.bat
  586. scriptxls_f4208e5a-cea7-4c52-aeb7-2beb88383e85_nitrix_wdexclusion.bat
  587. scriptxls_f11495e4-c340-4a2c-948b-044ece58c045_makaveli_wdexclusion.bat
  588. scriptxls_f61154c7-5474-43b0-911c-47b11e165661_kingshakes_wdexclusion.bat
  589. scriptxls_f95183e6-cd57-41fe-bb6a-cba4fcb7eb88_nitrix.bat
  590. scriptxls_fa162ad9-db04-4fa6-9248-e1a5625c9dad_apo93_wdexclusion.bat
  591. scriptxls_fbba7f3d-a824-4738-8ba3-d0b5df54eb28_Python.bat
  592. scriptxls_fcd4744f-d89c-4fb8-9fdb-6ae4481fa2f2_nitrix_wdexclusion.bat
  593. scriptxls_fcea02dd-2b0b-4341-b6d6-1682202ac061_tozmac_wdexclusion.bat
  594. scriptxls_fd626e49-9b8b-4901-a57d-c1a87808f89b_nitrix_wdexclusion.bat
  595. scriptxls_fde89b8d-0ce7-4725-b8d4-1098143dbb25_silenthide_wdexclusion.bat
  596. scriptxls_fe9ef1bb-f86a-419a-a51a-044da3f05b69_nitrix_wdexclusion.bat
  597. scriptxls_ff6819ce-e437-45d5-8bac-2368859bf79b_pr3torian_wdexclusion.bat
  598. scriptxls_ffcc05ef-32b0-4c01-9455-0b458144001b_t5samsung2020_wdexclusion.bat
  599. scriptxls_ffd48fe9-e5f6-4313-b872-2e8cc9142335_COLAFORCE1010_wdexclusion.bat
  600.  
  601. Extracted URLs via grep regex:
  602. http://10.52.53.196
  603. http://192.119.111.83/fp.exe
  604. http://dosha.bg/kapa2/ferrapos/gudda/ferrapos/abm/iola.exe
  605. http://google.fr
  606. http://medicalcorp.ro/royal1/helper/gd/zt/fola.exe
  607. http://medicalcorp.ro/royal3/gged/wrt/vwz/iola.exe
  608. http://medicalcorp.ro/szvbmxy/bmplksd/zmp/glp/gola.exe
  609. http://shorturl.at/jmnX0
  610. http://taskmgr.fr/SWIFT
  611. http://thunderco-tw.com/para/hackstup39.exe
  612. https://app.aritic.com/frontend/assets/gallery/go676hvkw6135/putty.exe
  613. https://app11.easysendyapp.com/frontend/assets/gallery/ey212zrjf4aa3/crypted.exe
  614. https://cdn.discordapp.com/attachments/781875899602567178/782710315993268224/putty.exe
  615. https://cutt.ly/0gJ91Mr
  616. https://cutt.ly/0hguJV5
  617. https://cutt.ly/4hn1jvc
  618. https://cutt.ly/9hccItz
  619. https://cutt.ly/ahfpmLL
  620. https://cutt.ly/ahjpaIs
  621. https://cutt.ly/Chjs42f
  622. https://cutt.ly/DhEtU3P
  623. https://cutt.ly/ehbJECN
  624. https://cutt.ly/ghjUz9x
  625. https://cutt.ly/ghWMrKZ
  626. https://cutt.ly/IhWH4UW
  627. https://cutt.ly/Lhzy2bK
  628. https://cutt.ly/MhkI0BK
  629. https://cutt.ly/mhzQmuT
  630. https://cutt.ly/Nhm2Iap
  631. https://cutt.ly/Qhz2yoN
  632. https://cutt.ly/rhccEjT
  633. https://cutt.ly/RhQuNPI
  634. https://cutt.ly/rhWNfyK
  635. https://cutt.ly/ShEtP1G
  636. https://cutt.ly/thccZ5f
  637. https://cutt.ly/ThfUIJG
  638. https://cutt.ly/thWBa1Q
  639. https://cutt.ly/Thz9FGV
  640. https://cutt.ly/ugVEcyG
  641. https://cutt.ly/VhkEjlw
  642. https://cutt.ly/vhvrtsY
  643. https://cutt.ly/vhx8VZL
  644. https://cutt.ly/Xhm9Vso
  645. https://google.fr
  646. https://livrelevelife.com.br/ri.exe
  647. https://rb.gy/49hcw2
  648. https://rb.gy/ana1cv
  649. https://rb.gy/lgfiyy
  650. https://srv-store4.gofile.io/download/g3fDdJ/virus.exe
  651. https://the.earth.li/
  652. https://tinyurl.com/ghjdfs
  653. https://tinyurl.com/y2b8ajhl
  654. https://tinyurl.com/y2e4gblk
  655. https://tinyurl.com/y2egsnod
  656. https://tinyurl.com/y2upzjtt
  657. https://tinyurl.com/y3847n92
  658. https://tinyurl.com/y385u6pb
  659. https://tinyurl.com/y3mq4anw
  660. https://tinyurl.com/y3stxpr8
  661. https://tinyurl.com/y45o33ls
  662. https://tinyurl.com/y48um798
  663. https://tinyurl.com/y52ygmwa
  664. https://tinyurl.com/y578ckr9
  665. https://tinyurl.com/y57a55rt
  666. https://tinyurl.com/y58rx7ds
  667. https://tinyurl.com/y5cd8dlg
  668. https://tinyurl.com/y5czlznn
  669. https://tinyurl.com/y5f93z6w
  670. https://tinyurl.com/y5kedunf
  671. https://tinyurl.com/y5uwy4oo
  672. https://tinyurl.com/y5wxts7j
  673. https://tinyurl.com/y5ya3ybp
  674. https://tinyurl.com/y64yxyrh
  675. https://tinyurl.com/y686wk97
  676. https://tinyurl.com/y6de9myn
  677. https://tinyurl.com/y6klaaz3
  678. https://tinyurl.com/y6kur38q
  679. https://tinyurl.com/yxb8gku3
  680. https://tinyurl.com/yxkxk8tb
  681. https://tinyurl.com/yxvhjarg
  682. https://tinyurl.com/yykrpk7k
  683. https://tinyurl.com/yyut5y4z
  684. https://warlords00.to/vlc.exe
  685. https://www.upload.ee/download/12569255/e4c568956d5b1846318d/Name_Changer.exe
  686.  
  687. Working (recently) Malware URLs derived from this:
  688. http://146.59.160.173/TEST1/noup.exe
  689. http://146.59.160.173/TEST1/P0.exe
  690. http://gordana.mycpanel.rs/gcr.exe
  691. http://sparepartiran.com/XC/AYnBjTXSlkDlSOE.exe
  692. http://sparepartiran.com/XC/gnHtx3VKOGDjoD5.exe
  693. http://sparepartiran.com/XC/huaa.exe
  694. http://sparepartiran.com/XC/TonyBro.exe
  695. http://stkbor.com/order.exe
  696. https://anonfiles.com/l3PcW9w5p0/osno-crypted_exe
  697. https://cdn.discordapp.com/attachments/767360657930190894/783000656964878367/iencli12.dotm
  698. https://cdn.discordapp.com/attachments/769713843571523595/781301687800430642/doc.exe
  699. https://cdn.discordapp.com/attachments/769713843571523595/783825300739325993/invoice.exe
  700. https://cdn.discordapp.com/attachments/769968439627612212/782265348418175016/MuhasebeMasaustu3.exe
  701. https://cdn.discordapp.com/attachments/775303846645334037/784920798212784158/X2.exe
  702. https://cdn.discordapp.com/attachments/775608373949235243/781793491722305556/Reycmtl_Signed_.xlsx
  703. https://cdn.discordapp.com/attachments/775608373949235243/782988374272770089/maerst.xls
  704. https://cdn.discordapp.com/attachments/775608373949235243/783380974456799282/image.jpg
  705. https://cdn.discordapp.com/attachments/775608373949235243/783418680947245116/mmm.pdf
  706. https://cdn.discordapp.com/attachments/775608373949235243/783621141779447809/docs34.xlsx
  707. https://cdn.discordapp.com/attachments/777508363029184525/782598665130606592/att.ps1
  708. https://cdn.discordapp.com/attachments/777508363029184525/782613562019282984/Bills.vbs
  709. https://cdn.discordapp.com/attachments/783937641132982302/785739537422614528/Host.exe
  710. https://cdn.discordapp.com/attachments/784488221174005823/784488276634501129/to3.exe
  711. https://icaremedical.org/f4.jar
  712. https://srv-store4.gofile.io/download/Y3yZHK/payload.exe
  713.  
  714. For a look at what the PS1 and VBS are, see this post:
  715. https://twitter.com/JRoosen/status/1336490986000838656?s=20
  716. https://pastebin.com/raw/apPas1k5
  717.  
  718. So this barrage of email turned into a bunch of IoCs. Thanks kids. Enjoy.
  719.  
  720. Thanks to @lazyactivist192 for his help as we took this all apart. :)
  721.  
  722.  
  723.  
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!