http://185.10.68.147/win/val/ichigo.bin
http://185.10.68.147/win/del.ps1
http://185.10.68.147/win/sasd.bat
http://www.royerconseil-finances.ch/js/tiny_mce/temp/l.exe
http://185.10.68.147/mssql
https://www.royerconseil-finances.ch/js/tiny_mce/temp/r.exe
https://185.10.68.147/win/min/32.exe
https://185.10.68.147/win/3p/ichigo-lite.ps1
https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-PowerDump.ps1
https://raw.githubusercontent.com/Kevin-Robertson/Invoke-TheHash/master/Invoke-WMIExec.ps1
https://raw.githubusercontent.com/Kevin-Robertson/Invoke-TheHash/master/Invoke-TheHash.ps1