06/12/16 04:10:35
<job>
<script language="JScript">
function deRLE(src){
return src.replace(/\s/g,"").replace(/(.)\.(.)/g,function($0,$1,$2){
return Array(parseInt($2,35)+(($2<"A")?56:($2<"a")?-6:20)).join($1);});}
</script>
<script language="VBScript">
Set fso=CreateObject("Scripting.FileSystemObject")
path=fso.BuildPath(fso.GetSpecialFolder(2),"SwHide.exe")
Set elm=CreateObject("Microsoft.XMLDOM").createElement("data")
elm.DataType="bin.base64":elm.text=deRLE(getResource("bin"))
With CreateObject("ADODB.Stream")
.Open:.Type=1:.Write elm.NodeTypedValue:.SaveToFile path:.Close
End With
CreateObject("WScript.Shell").Run path,1,True
WScript.Sleep 1000:fso.DeleteFile path
</script>
<resource id="bin">
TVqQAAMA.BEA.B//8AALgA.GQA.syA.C4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm
5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJA.HvsN/Fa9GxlmvRsZZr0bGWqN7slm7RsZZr0
bCWadGxlkwXw5Zp0bGWTBfJlmrRsZZSaWNoa9GxlgA.RBQRQAATAEDADWwgkUA.HOAAAwELA
QgAAAIA.BEA.GBA.CQA.BIA.CBA.BQA.CgAABA.HEA.HBA.CBA.GIAAAQAABAAABA.DEAAAE
A.FBA.MBAgAAA8A.9A.tIAAAEA.hC50ZXh0A.BRQA.CQA.CgA.BQA.PCAAAGAucmRhdGEAAJ
YA.CIA.CIA.BGA.PBAAABALmRhdGEA.BEA.CDA.bQAAAwA.9A.9A.9A.9A.9A.9A.9A.9A.9
A.dIPsJFaLNQggQACNRCQEUGoEx0QkDCQAAADHRCQQA.CP/WD7bIg/H/jVQkBIPhAVKDyQJq
ColMJCz/1moA/xUAIEAAXgA.9A.9A.9A.9A.9A.9A.9A.9A.9A.LXCA.FB4IA.FEwgA.KGog
A.BIAAAVCA.LiiA.BggA.aFwgA.FeCA.FC5AEV4aXRQcm9jZXNzAEtFUk5FTDMyLmRsbAAAd
gBTSEFwcEJhck1lc3NhZ2UAU0hFTEwzMi5kbGwA.9A.9A.9A.9A.9A.9A.9A.h=
</resource>
</job>