Evade AV detection

This commit is contained in:
WindowsAddict 2025-06-26 22:49:57 +05:30
parent d7a6994363
commit 409c4f71ad
11 changed files with 96 additions and 95 deletions

View file

@ -190,7 +190,7 @@ goto dk_done
::pstst $ExecutionContext.SessionState.LanguageMode :pstst
for /f "delims=" %%a in ('%psc% "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[io.file]::ReadAllText('!_batp!') -split ':pstst';iex ($f[1])}" %nul6%') do (set tstresult=%%a)
for /f "delims=" %%a in ('%psc% "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[io.f%blank%ile]::ReadA%blank%llText('!_batp!') -sp%blank%lit ':pstst';ie%blank%x ($f[1])}" %nul6%') do (set tstresult=%%a)
if /i not "%tstresult%"=="FullLanguage" (
%eline%
@ -547,7 +547,7 @@ goto :oe_edition
cls
call :ch_getinfo
call :oe_tempcleanup
%psc% "$f=[io.file]::ReadAllText('!_batp!') -split ':getlist\:.*';iex ($f[1])"
%psc% "$f=[io.f%blank%ile]::ReadA%blank%llText('!_batp!') -sp%blank%lit ':getlist\:.*';ie%blank%x ($f[1])"
:oe_editionchange
@ -621,7 +621,7 @@ cls
set suites=
echo %list% | find /i "Suites" %nul1% && (
set suites=1
%psc% "$f=[io.file]::ReadAllText('!_batp!') -split ':getappnames\:.*';iex ($f[1])"
%psc% "$f=[io.f%blank%ile]::ReadA%blank%llText('!_batp!') -sp%blank%lit ':getappnames\:.*';ie%blank%x ($f[1])"
if not exist %SystemRoot%\Temp\getAppIds.txt (
%eline%
echo Failed to generate available apps list.
@ -1102,7 +1102,7 @@ if not defined terminal mode 105, 32
:: Get build number for the target FFN, using build number with OfficeC2RClient.exe command to trigger updates provides accurate results
set build=
for /f "delims=" %%a in ('%psc% "$f=[io.file]::ReadAllText('!_batp!') -split ':getbuild\:.*';iex ($f[1])" %nul6%') do (set build=%%a)
for /f "delims=" %%a in ('%psc% "$f=[io.f%blank%ile]::ReadA%blank%llText('!_batp!') -sp%blank%lit ':getbuild\:.*';ie%blank%x ($f[1])" %nul6%') do (set build=%%a)
echo "%build%" | find /i "16." %nul% || set build=
echo: