107.23.195.145 Malware

"script";
var USER = {
    "id": "462B6B49102BD815",
    "country": "de",
    "channel": "ffai3",
    "product": 9,
    "section": 164,
    "beta": false,
    "custom1": [],
    "lastVersion": 0,
    "lastUpdateFailed": false,
    "installationDate": new Date(1464642000000),
    "commandLine": "\/SL5=$50A92,119296,119296,C:UsersOZebidiAppDataLocalProgramsGENGEN.exe \/task \/STAGE2 \/VERYSILENT \/SUPPRESSMSGBOXES \/NORESTART \/PASSWORD=C84PKG-160330-125306 \/LOG=C:UsersOZebidiAppDataLocalTempis-6GCJI.tmpstage2.log"
};
var NOW = new Date(1576505676000);

/* GLOBAL */
"object"!=typeof JSON&&(JSON={}),function(){"use strict";function f(t){return 10>t?"0"+t:t}function this_value(){return this.valueOf()}function quote(t){return rx_escapable.lastIndex=0,rx_escapable.test(t)?'"'+t.replace(rx_escapable,function(t){var e=meta[t];return"string"==typeof e?e:"\\u"+("0000"+t.charCodeAt(0).toString(16)).slice(-4)})+'"':'"'+t+'"'}function str(t,e){var r,n,o,u,f,a=gap,i=e[t];switch(i&&"object"==typeof i&&"function"==typeof i.toJSON&&(i=i.toJSON(t)),"function"==typeof rep&&(i=rep.call(e,t,i)),typeof i){case"string":return quote(i);case"number":return isFinite(i)?String(i):"null";case"boolean":case"null":return String(i);case"object":if(!i)return"null";if(gap+=indent,f=[],"[object Array]"===Object.prototype.toString.apply(i)){for(u=i.length,r=0;u>r;r+=1)f[r]=str(r,i)||"null";return o=0===f.length?"[]":gap?"[\n"+gap+f.join(",\n"+gap)+"\n"+a+"]":"["+f.join(",")+"]",gap=a,o}if(rep&&"object"==typeof rep)for(u=rep.length,r=0;u>r;r+=1)"string"==typeof rep[r]&&(n=rep[r],o=str(n,i),o&&f.push(quote(n)+(gap?": ":":")+o));else for(n in i)Object.prototype.hasOwnProperty.call(i,n)&&(o=str(n,i),o&&f.push(quote(n)+(gap?": ":":")+o));return o=0===f.length?"{}":gap?"{\n"+gap+f.join(",\n"+gap)+"\n"+a+"}":"{"+f.join(",")+"}",gap=a,o}}var rx_one=/^[\],:{}\s]*$/,rx_two=/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g,rx_three=/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g,rx_four=/(?:^|:|,)(?:\s*\[)+/g,rx_escapable=/[\\\"\u0000-\u001f\u007f-\u009f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,rx_dangerous=/[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g;"function"!=typeof Date.prototype.toJSON&&(Date.prototype.toJSON=function(){return isFinite(this.valueOf())?this.getUTCFullYear()+"-"+f(this.getUTCMonth()+1)+"-"+f(this.getUTCDate())+"T"+f(this.getUTCHours())+":"+f(this.getUTCMinutes())+":"+f(this.getUTCSeconds())+"Z":null},Boolean.prototype.toJSON=this_value,Number.prototype.toJSON=this_value,String.prototype.toJSON=this_value);var gap,indent,meta,rep;"function"!=typeof JSON.stringify&&(meta={"\b":"\\b","	":"\\t","\n":"\\n","\f":"\\f","\r":"\\r",'"':'\\"',"\\":"\\\\"},JSON.stringify=function(t,e,r){var n;if(gap="",indent="","number"==typeof r)for(n=0;r>n;n+=1)indent+=" ";else"string"==typeof r&&(indent=r);if(rep=e,e&&"function"!=typeof e&&("object"!=typeof e||"number"!=typeof e.length))throw new Error("JSON.stringify");return str("",{"":t})}),"function"!=typeof JSON.parse&&(JSON.parse=function(text,reviver){function walk(t,e){var r,n,o=t[e];if(o&&"object"==typeof o)for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(n=walk(o,r),void 0!==n?o[r]=n:delete o[r]);return reviver.call(t,e,o)}var j;if(text=String(text),rx_dangerous.lastIndex=0,rx_dangerous.test(text)&&(text=text.replace(rx_dangerous,function(t){return"\\u"+("0000"+t.charCodeAt(0).toString(16)).slice(-4)})),rx_one.test(text.replace(rx_two,"@").replace(rx_three,"]").replace(rx_four,"")))return j=eval("("+text+")"),"function"==typeof reviver?walk({"":j},""):j;throw new SyntaxError("JSON.parse")})}();

function SHA1(s){function U(a,b,c){while(0<c--)a.push(b)}function L(a,b){return(a<<b)|(a>>>(32-b))}function P(a,b,c){return a^b^c}function A(a,b){var c=(b&0xFFFF)+(a&0xFFFF),d=(b>>>16)+(a>>>16)+(c>>>16);return((d&0xFFFF)<<16)|(c&0xFFFF)}var B="0123456789abcdef";return(function(a){var c=[],d=a.length*4,e;for(var i=0;i<d;i++){e=a[i>>2]>>((3-(i%4))*8);c.push(B.charAt((e>>4)&0xF)+B.charAt(e&0xF))}return c.join('')}((function(a,b){var c,d,e,f,g,h=a.length,v=0x67452301,w=0xefcdab89,x=0x98badcfe,y=0x10325476,z=0xc3d2e1f0,M=[];U(M,0x5a827999,20);U(M,0x6ed9eba1,20);U(M,0x8f1bbcdc,20);U(M,0xca62c1d6,20);a[b>>5]|=0x80<<(24-(b%32));a[(((b+65)>>9)<<4)+15]=b;for(var i=0;i<h;i+=16){c=v;d=w;e=x;f=y;g=z;for(var j=0,O=[];j<80;j++){O[j]=j<16?a[j+i]:L(O[j-3]^O[j-8]^O[j-14]^O[j-16],1);var k=(function(a,b,c,d,e){var f=(e&0xFFFF)+(a&0xFFFF)+(b&0xFFFF)+(c&0xFFFF)+(d&0xFFFF),g=(e>>>16)+(a>>>16)+(b>>>16)+(c>>>16)+(d>>>16)+(f>>>16);return((g&0xFFFF)<<16)|(f&0xFFFF)})(j<20?(function(t,a,b){return(t&a)^(~t&b)}(d,e,f)):j<40?P(d,e,f):j<60?(function(t,a,b){return(t&a)^(t&b)^(a&b)}(d,e,f)):P(d,e,f),g,M[j],O[j],L(c,5));g=f;f=e;e=L(d,30);d=c;c=k}v=A(v,c);w=A(w,d);x=A(x,e);y=A(y,f);z=A(z,g)}return[v,w,x,y,z]}((function(t){var a=[],b=255,c=t.length*8;for(var i=0;i<c;i+=8){a[i>>5]|=(t.charCodeAt(i/8)&b)<<(24-(i%32))}return a}(s)).slice(),s.length*8))))}

WScript.Sleep(500);

var __reportErrorCB = function(msg) {};
var lastError = "";

var __logFile = null;
(function() {
	try {
		var shell = new ActiveXObject("WScript.Shell");
		var fso = new ActiveXObject("Scripting.FileSystemObject");
		var filename = fso.BuildPath(shell.Environment("Process").Item("TEMP"), "genius.log");
		__logFile = fso.OpenTextFile(filename, 2, true);
		__logFile.WriteLine("Started at " + new Date().toString());
		__logFile.WriteLine("User object = " + JSON.stringify(USER, null, 4));
	} catch(e) {}
})();

function __log(msg) {
	WScript.Echo(msg);
	if(__logFile) __logFile.WriteLine(msg.replace(/[^\x00-\xFF]/g, "?"));
}

__log("Script started");

function __logError(err, fatal) {
	try {
		var n = "";
		try {
			var en = err.number;
			if(en < 0) en += 0x100000000;
			n = "0x" + en.toString(16).toUpperCase();
		} catch(e) {}
		lastError = ((typeof err == "string") ? err : (err.message || err.description || err.code || n || err.name || "UNKNOWN"));
		if(lastError == "UNKNOWN" && typeof e == "object") {
			try {
				lastError = JSON.stringify(err);
			} catch(e) {
				try {
					lastError = err.toString();
				} catch(e2) {}
			}
		}
	} catch(e) {
		lastError = "UNKNOWN_DF";
	}

	var stack = "";
	var msg = lastError;
	try {
		var fn = arguments.callee.caller;
		var seenFns = [];
		do {
			if(seenFns.indexOf(fn) != -1) {
				stack += "<" + "?RECURSIVE?";
				break;
			}
			seenFns.push(fn);
			var match = fn.toString().match(/function\s*([^(]+)\s*\(/);
			var fnName = match ? match[1] : "?";
			stack += "<" + fnName;

			fn = fn.caller;
		} while(fn);
	} catch(e) {
		try {
			__log('Error during stack creation: ' + e);
		} catch(e2) {}
	}
	lastError += stack;

	__log('ERROR: ' + lastError);
	try {
		if(fatal) __reportErrorCB(lastError.replace(/[()#*&%^]/g, "_"));
	} catch(e) {}
}

function __updateVersion(ver) {
	try {
		var shell = new ActiveXObject("WScript.Shell");
		var filename = shell.Environment("Process").Item("GENIUS_VERSION_FILE");
		if(!filename) {
			__log("Version script finished: " + ver);
			return;
		}
		var fso = new ActiveXObject("Scripting.FileSystemObject");
		var oldver = 0;
		try {
			var fileR = fso.OpenTextFile(filename, 1);
			oldver = Number(fileR.ReadAll());
			fileR.Close();
		} catch(e) {}
		var updated = false;
		if(ver > oldver) {
			updated = true;
			var fileW = fso.OpenTextFile(filename, 2, true);
			fileW.Write(ver);
			fileW.Close();
		}
		__log("Version script finished: " + ver + ", updated: " + (updated ? "yes" : "no"));
	} catch(e) { __logError(e); }
}

function __notify() {
	try {
		var shell = new ActiveXObject("WScript.Shell");
		var filename = shell.Environment("Process").Item("GENIUS_MAIN_FILE");
		if(!filename) return;
		shell.Run('"' + filename + '" /notify');
	} catch(e) { __logError(e); }
	__log("Notified");
}

__notify();

/* Latest: 0, LatestTop: 0, SkippedAfter: 0, ActualLatest: 855 */
/* EOF */