Evade AV detection

This commit is contained in:
2025-07-02 23:35:17 +05:30
parent 5aa7d4f3de
commit ef411e14ca
11 changed files with 93 additions and 93 deletions

View File

@ -190,7 +190,7 @@ goto dk_done
::pstst $ExecutionContext.SessionState.LanguageMode :pstst
for /f "delims=" %%a in ('%psc% "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[io.file]::ReadAllText('!_batp!') -split ':pstst';iex ($f[1])}" %nul6%') do (set tstresult=%%a)
for /f "delims=" %%a in ('%psc% "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('!_batp!') -split ':pstst';& ([scriptblock]::Create($f[1]))}" %nul6%') do (set tstresult=%%a)
if /i not "%tstresult%"=="FullLanguage" (
%eline%
@ -547,7 +547,7 @@ goto :oe_edition
cls
call :ch_getinfo
call :oe_tempcleanup
%psc% "$f=[io.file]::ReadAllText('!_batp!') -split ':getlist\:.*';iex ($f[1])"
%psc% "$f=[System.IO.File]::ReadAllText('!_batp!') -split ':getlist\:.*';& ([scriptblock]::Create($f[1]))"
:oe_editionchange
@ -621,7 +621,7 @@ cls
set suites=
echo %list% | find /i "Suites" %nul1% && (
set suites=1
%psc% "$f=[io.file]::ReadAllText('!_batp!') -split ':getappnames\:.*';iex ($f[1])"
%psc% "$f=[System.IO.File]::ReadAllText('!_batp!') -split ':getappnames\:.*';& ([scriptblock]::Create($f[1]))"
if not exist %SystemRoot%\Temp\getAppIds.txt (
%eline%
echo Failed to generate available apps list.
@ -1102,7 +1102,7 @@ if not defined terminal mode 105, 32
:: Get build number for the target FFN, using build number with OfficeC2RClient.exe command to trigger updates provides accurate results
set build=
for /f "delims=" %%a in ('%psc% "$f=[io.file]::ReadAllText('!_batp!') -split ':getbuild\:.*';iex ($f[1])" %nul6%') do (set build=%%a)
for /f "delims=" %%a in ('%psc% "$f=[System.IO.File]::ReadAllText('!_batp!') -split ':getbuild\:.*';& ([scriptblock]::Create($f[1]))" %nul6%') do (set build=%%a)
echo "%build%" | find /i "16." %nul% || set build=
echo: