It was 47 megabytes of pure text.

"Converter v2... payload delivered... vector acquired... migrating..."

At 20 megabytes, the server’s hard drive light went solid red.

That’s when he found it buried on a defunct FTP server from 1999: exe2bat_v2.zip .

And then 46.9 megabytes of hexadecimal numbers printed via ECHO , each line ending with a pipe to DEBUG.EXE .

ECHO ■■■■■■■■■■■■■■■■■□□□□□□□□□□□ ECHO ■■□□■□■□■□■□□■□■□■□■□□□■□■□ ECHO ◙☺☻♥♦♣♠•◘○◙♂♀♪♫☼►◄↕‼¶§▬↨↑↓→←∟↔▲▼ At the very top, however, was a header:

Leo got an email from the CISO ten minutes later.

CALL :DECODE_0x7F4A