Windows toolkit: kitanai/nandemo/ufw.exe and upd-ms.bat to strangled.net:7070

ills3c Intel&Coffee@Ills3C

•updated today•0•0•1

Detects execution and network activity associated with the cache_base operator toolkit, including JuicyPotatoNG (kitanai.exe), RegPwn (nandemo.exe), ufw.exe reverse shell, and upd-ms.bat launching these tools with connections to *.strangled.net on port 7070.