Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 33542ba61be77bd0…

MALICIOUS

Office (OOXML)

80.6 KB Created: 2019-01-31 21:56:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2019-09-30
MD5: 1ae7ce4372983eb1018e05c6dd739ee4 SHA-1: c76a12481015b619e8aeba159d3cb1dabebdfb75 SHA-256: 33542ba61be77bd0fdb367d295366bc6ee11c31fff4b7a769955572dca2f9b36
278 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1071.001 Web Protocols T1105 Ingress Tool Transfer

The sample contains a VBA macro with a Document_Open auto-execution routine. This macro utilizes WScript.Shell and CreateObject to download and execute a second-stage payload, as indicated by the OLE_VBA_HTTP_DROP_EXEC heuristic. The document body explicitly instructs the user to enable content due to a security blur, which is a common lure for macro-based malware.

Heuristics 10

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Set w = CreateObject("WScript.Shell")
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
            .Write r.ResponseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set w = CreateObject("WScript.Shell")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
     s = Environ$(Chr(116) & Chr(101) & Chr(109) & Chr(112)) & "\" & StrReverse("exe.abox0dhg")
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 32283 bytes
SHA-256: ed5a70ff3447e0942aca49b05a7c97dfb7a687995f09d348526751efd0a035e4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
599 of 1055 identifiers look randomly generated (e.g. 'a6wqfhp552gynsfhwndl88m8h6l8yjbipmgdsp0w') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Public Sub Document_Open()

dvpbhvjvvfa
End Sub


Attribute VB_Name = "vbofk2ut3rz"


Public Sub AA2l4wgf2shxh()

Dim g4raesbrzzc As String
Dim nb3j3o5oanu As String
Dim oyeletn0ao4 As String
Dim AA2ikkkjbft4t As String
Dim afgtty0fjb0 As String
Dim AA132cgccea24 As String
Dim r5f2gy1beib As String
Dim sxdtovley1g As String
Dim vsotyjtbq3x As String
Dim iem4dl1k0fd As String
Dim dgabq3zb4sa As String
Dim AA1qhgjnmmsxg As String
Dim cnba1i5rbsk As String
Dim yctyhngihqn As String
Dim g34jxd4l1le As String
Dim i0xfs04m1qb As String
Dim gcpc3jm0hue As String
Dim hedgmee1glu As String
Dim AA12tceg30nn1 As String
Dim u4xgy2xzm5s As String
End Sub

Public Sub AA30ndqfl2114()

Dim a5xp5jklpf1 As String
Dim mtlspvckuz2 As String
Dim u1kksj5l2oh As String
Dim AA0blgobjadbm As String
Dim qyizs5ghwyi As String
Dim n3iscj3tib3 As String
Dim vk22isvxs4d As String
Dim i5lqxe2c3k3 As String
Dim mrm0lcm4041 As String
Dim ijh5fflnfvf As String
Dim iezi0omyp5v As String
Dim jbbyhj1laaa As String
Dim f0hdgixz3jy As String
Dim AA0d2sgq1xler As String
Dim v3sqscrz3pk As String
Dim rnpvcbyunxr As String
Dim fhhytuivmwk As String
Dim ln4ot1dseyp As String
Dim AA0kczsgqkkw5 As String
Dim AA1v5r0g2k0k3 As String
End Sub

Public Sub t3wvmliosxx()

Dim olo1whw2wfl As String
Dim kuzlblxtwry As String
Dim ikbk4pgk2gl As String
Dim kb4xk21yydp As String
Dim qryrkbe05ua As String
Dim mmiruguxouf As String
Dim jwfl3gclfai As String
Dim ly5e4oy3exz As String
Dim cqly5lnv2ur As String
Dim hzzsl5rd20c As String
Dim kib0i5otsyt As String
Dim lhwxr3j5bwi As String
Dim p2h01ttskfx As String
Dim uvadsgs4oaa As String
Dim vvy1g2g0dvh As String
Dim m5goidvlcog As String
Dim AA1otjwdekcjr As String
Dim cj3knzgxnj5 As String
Dim m5o301ww3pg As String
Dim AA10nxp1sbuuy As String
End Sub

Public Sub AA3ildmrijhaq()

Dim AA2paqshzh4bz As String
Dim up10q50dgyd As String
Dim anhshiwznj0 As String
Dim AA5l2vyin2kr5 As String
Dim okjuicghe2s As String
Dim lnqsmozprys As String
Dim hlh433mbom4 As String
Dim vra4qb1mc3r As String
Dim goq4gjr5ila As String
Dim juce0q1jeb2 As String
Dim ikxktv2zr5r As String
Dim kwgb0ugjey1 As String
Dim rjswfnad1o0 As String
Dim i0urjckd50o As String
Dim aj1k2miok2a As String
Dim j3gmqhzmsa3 As String
Dim ysybyqeazyc As String
Dim iehfjn1rau5 As String
Dim azk2p41slsr As String
Dim ib05vfjxrdc As String
End Sub

Public Sub AA13qnknu2llu()

Dim axgwzqjfmfi As String
Dim llravumr2pv As String
Dim xdpjcz3gav5 As String
Dim AA2ti4slte05k As String
Dim shsp3z3iaei As String
Dim AA1bnwv505wan As String
Dim AA5n03ee51ue3 As String
Dim rs1cr33mx2t As String
Dim vhzpm4tbqff As String
Dim fcbqjqxb0qj As String
Dim AA1k4g3gycwh1 As String
Dim yw0gptnogpd As String
Dim k11guqbpdyh As String
Dim srxwbwnkzyd As String
Dim nypoxk5uoyz As String
Dim AA1wpf5ssu5qq As String
Dim rjbi4rr2n55 As String
Dim AA0yhcrt1ngp0 As String
Dim u5z0vbaeyuo As String
Dim p1dwwjkzosa As String
End Sub

Public Sub goh50jdce0c()

Dim ksus1hkcxyp As String
Dim AA4dpcscsuoze As String
Dim tze4qrk2hbl As String
Dim AA1kn4fdo24v2 As String
Dim osyztu00byy As String
Dim ydknxxhn2pl As String
Dim vn0xoxbvila As String
Dim xfct5zw1p44 As String
Dim hhxlkyjcsnl As String
Dim ce5vjveg1ay As String
Dim AA2jgmw5im3tw As String
Dim dwjwx3u30ir As String
Dim AA0ntqhgnopjb As String
Dim ud3o3n4bcaf As String
Dim wxncvov4rfy As String
Dim z2buucyxicx As String
Dim bqwvcuzrg0o As String
Dim z2e4ahmgxku As String
Dim lwaobdic3bg As String
Dim l31kpht34sj As String
End Sub

Public Sub AA0zhhypzelkz()

Dim zh5gem0n33d As String
Dim pajatszw2ku As String
Dim t4gu01d3qgx As String
Dim qdgeckj05sn As String
Dim kdvcv4vinom As String
Dim yrlbklx5f3n As String
Dim AA4m5ma32d4ns As String
Dim AA42cgtclam4x As String
Dim AA4bylkthmbvo As String
Dim odmxngtsyyq As String
Dim uk0yogul1og As String
Dim g3o4e5hzqia As String
Dim ihiyftdsx5l As String
Dim ff0steatisb As String
Dim AA5hnlhtzezxr As String
Dim eg5obqfdhil As String
Dim rxdprvewlcx As String
Dim w3f0ebvveyk As String
Dim AA3xapgsd2uzg As String
Dim AA5yzjsklqbl5 As String
End Sub

Public Sub anuuxn1jahv()

Dim mkjs4pej0c2 As String
Dim webuj2rpcxe As String
Dim wzvyxlxawit As String
Dim hlnigfw2eun As String
Dim lcuccwflepr As String
Dim qmjmr3fhsln As String
Dim yveip3atcuy As String
Dim n0tcqxfhy1j As String
Dim o4qb2vpepnn As String
Dim hukxxt0aoju As String
Dim jig2oq2ojma As String
Dim aor34gzm3nq As String
Dim gsowat1bdz1 As String
Dim d3jmssfonia As String
Dim lwxyhhhhifu As String
Dim nppi25buui5 As String
Dim uknoccytchx As String
Dim AA2col4wkfxks As String
Dim dzasgqfth0p As String
Dim smzzcjoqyit As String
End Sub

Public Sub AA00dgu3qd1dl()

Dim cxap355iij5 As String
Dim ov5cuvsq410 As String
Dim AA44ig4gnezoo As String
Dim ayuqvv3if3h As String
Dim lkbgmgaol5d As String
Dim AA2bdyf53mgov As String
Dim jpynmv32mih As String
Dim xca21qwzzib As String
Dim q1mgsunizwa As String
Dim ypqujn4eker As String
Dim mxxuuis5xn0 As String
Dim vy4crqe44uh As String
Dim wmf0wc1imnh As String
Dim jkhf1qmxsjl As String
Dim i0aqphplpqz As String
Dim i2030i20g5u As String
Dim tugc3qnjqro As String
Dim yv5u32mkhbc As String
Dim AA2ks4sumyozu As String
Dim AA0jbj0pbpbr0 As String
End Sub

Public Sub kgxnrmjaw5m()

Dim dbtsqrwe2b0 As String
Dim us3si1put0i As String
Dim i5fy2h1vdfk As String
Dim gurbvyfyf2c As String
Dim jcwyr3go1vm As String
Dim yejur0exmea As String
Dim k1yraxyen5p As String
Dim AA3qnrlooqfho As String
Dim AA3nrxcazlj2w As String
Dim pdgae0pr025 As String
Dim bpuatpu2qzk As String
Dim vyistn2h1ug As String
Dim e1njf5xtg3x As String
Dim iobafofwrot As String
Dim AA5uqrmp1ey4a As String
Dim AA2ya1p2zclho As String
Dim btb1fxj0ykd As String
Dim AA1mhiaamkl5c As String
Dim n1tr1kzzifo As String
Dim hk2rihizzhm As String
End Sub

Public Sub AA22zshejmnvj()

Dim eamcs2sjmij As String
Dim gkmusjrjn2w As String
Dim AA0bcrzs5tt2j As String
Dim ixk4adeqfwv As String
Dim AA5dqmxtbtybb As String
Dim wn2ffwu3msv As String
Dim mltg0sbj1zb As String
Dim kyiydft5tov As String
Dim pez0wsocljj As String
Dim txrogv0lfv4 As String
Dim cc0ytozsrlp As String
Dim cp2gtzholvm As String
Dim AA2kfzoye1al1 As String
Dim AA4kmojhfjj1m As String
Dim qjhigvgljts As String
Dim xkbxzfejmrj As String
Dim rooijhi5sab As String
Dim wpc03304xtm As String
Dim rkqrjwie5cj As String
Dim fr40li50sdm As String
End Sub

Public Sub rdyoqmiwc44()

Dim ilubyg4otj5 As String
Dim AA4inkwsloa3r As String
Dim mcadwxatsfe As String
Dim bz502o0z5ol As String
Dim ty0v3s2hbac As String
Dim avb2xszcjsp As String
Dim AA550pyv3xda4 As String
Dim oimoissyph2 As String
Dim ol0muderjlg As String
Dim sl0wg10ga42 As String
Dim krwdpuz0exp As String
Dim xrvyzere3ju As String
Dim nk1voyecavd As String
Dim AA4hilk2afkrw As String
Dim AA2d2dl5nwb33 As String
Dim pqpeppetu0d As String
Dim xyqz0hxpwqw As String
Dim w5srfigiuyz As String
Dim z4mwrnyj5ap As String
Dim xypbnffgbaq As String
End Sub

Public Sub wbkvnw1f3ng()

Dim b4pxeqfbhry As String
Dim ujxfaetl13w As String
Dim q3zyuqww3ox As String
Dim ya5dxmgbbdg As String
Dim pekezrjb5ye As String
Dim ijthnplkb3m As String
Dim aeyrwnedyk4 As String
Dim h0zum2ybur0 As String
Dim uce1t5frfat As String
Dim i3lwr0x4dil As String
Dim y2s044xc0kd As String
Dim s01phvwe4wz As String
Dim q3nz0q5pavt As String
Dim zbmumuz4tpr As String
Dim szgscepk3ti As String
Dim bseg2voxpyr As String
Dim ssrl3blcfa4 As String
Dim AA4dlbga33rkc As String
Dim dxrhkuoupkk As String
Dim AA43e4wvdrm1x As String
End Sub

Public Sub AA5ixpkgkeoqv()

Dim vwbhasnv13n As String
Dim AA3gfqjeui1av As String
Dim blclmuk255k As String
Dim xoz3jluaqyg As String
Dim AA4yx0ic5f3wc As String
Dim w5mva2s2ino As String
Dim rg3gfrh25tn As String
Dim AA2igqppxujtz As String
Dim xocxzbuanzv As String
Dim pqcl1ot0g3l As String
Dim AA3xjnmvz0lpk As String
Dim kl4d2almxj1 As String
Dim krq5xc2m4q3 As String
Dim n0nhsbspxaz As String
Dim nqu0cugh5ra As String
Dim fnlcxeh0hoe As String
Dim mrhj52ocq5i As String
Dim AA1viddjq4hnw As String
Dim la1f5cibagr As String
Dim qfdnnutsuvb As String
End Sub

Public Sub lc25i1sepgf()

Dim AA12znwdrfknk As String
Dim u2lh1ezs3e0 As String
Dim kq24wqof0hb As String
Dim reqtbdo0q2e As String
Dim v3f14llymuj As String
Dim p4mpe1vrgqc As String
Dim w21svnpo1zo As String
Dim AA35lwraclc3o As String
Dim pgn43av3tcg As String
Dim eiq2mjmwstq As String
Dim dsygbsdzfdu As String
Dim mjzqxpgzyny As String
Dim p4i3iem1sqc As String
Dim oogsfhxq5do As String
Dim jm5thzaqfkv As String
Dim uger3cy2zma As String
Dim ykcvsc4p3y0 As String
Dim j3fvakepx3a As String
Dim ygzdahkydyk As String
Dim AA4d0iukub1mu As String
End Sub

Public Sub dj0iti2dpro()

Dim AA44lfmpfw0yc As String
Dim hqrubwlcalm As String
Dim rnpmsqtpa45 As String
Dim AA2m2g1kkerec As String
Dim lpovan1vedk As String
Dim rizsryfra21 As String
Dim AA51wwoh1cefu As String
Dim v5j44jls2pv As String
Dim apwas3blkio As String
Dim AA4bojwwn44sa As String
Dim zjzktq30no3 As String
Dim AA2mg4qli00mi As String
Dim zhtymyxpqwu As String
Dim toadx4pjdi0 As String
Dim rkvqgsyetjc As String
Dim o4sykn0uejx As String
Dim uer1uu55z40 As String
Dim b1fwzotko5g As String
Dim s4lgg4ndkzm As String
Dim p2htefkn2fb As String
End Sub

Public Sub phagb3bst2p()

Dim AA4yjur0kerrs As String
Dim zvxtt4gvuen As String
Dim fduqs2thy4b As String
Dim burul2n5oab As String
Dim AA4doyx4m53ot As String
Dim fae3itklsav As String
Dim bcqnmn0uu0z As String
Dim hegfdfowcsa As String
Dim tm3ouua4ggo As String
Dim we5rpqgmqsl As String
Dim itupxj0mkd2 As String
Dim atboeczdxvr As String
Dim AA5cq21mblau2 As String
Dim oakyoherlgh As String
Dim a4lr4rhzzj4 As String
Dim kr2fa1ftswn As String
Dim wafbviuofyb As String
Dim xznm0pff4cn As String
Dim vbefbelncxn As String
Dim uspks5crdez As String
End Sub

Public Sub krotzwmyql0()

Dim t2qzsx2lhpr As String
Dim AA1dfnvb3hose As String
Dim AA4cufgpeukzo As String
Dim qklxj51hlhp As String
Dim jqzpdv1esy5 As String
Dim r0lv2xrywms As String
Dim a0rjf5a350m As String
Dim dlid0zrnj1i As String
Dim acira0xfqau As String
Dim AA2j05m45miow As String
Dim fue1nozeiy3 As String
Dim a43m2c5blqh As String
Dim vtq0sozvg4h As String
Dim AA5qlghn0cmpd As String
Dim AA1rsw5wp1lub As String
Dim AA1yo35irikcj As String
Dim AA32ggztvmtu2 As String
Dim o5n0auh4fco As String
Dim mjelo3wvgta As String
Dim eapdqkdpczn As String
End Sub

Public Sub lfocplcvwxt()

Dim sv1jffytodp As String
Dim q0dywy4r1fo As String
Dim AA3dopkzsrbc0 As String
Dim AA34liqmlu5yu As String
Dim AA5h5xteuajmb As String
Dim uxxqugoxonl As String
Dim lxwcrhh2fri As String
Dim AA212jukohxvr As String
Dim y0cafhub3jn As String
Dim hdkbivuhsqr As String
Dim vqkwf4dq2ca As String
Dim upxkbdapafy As String
Dim lqihj2f03zs As String
Dim wiymfhskfep As String
Dim menl0qtcral As String
Dim zhs4fpmmgfn As String
Dim s31cge4kypv As String
Dim o2gkp0pig5w As String
Dim AA42ssjwu0nlz As String
Dim AA5cyhlzn3cre As String
End Sub

Public Sub xfzu0300uhq()

Dim k2om2xcrq4z As String
Dim vv4t5pgr4rr As String
Dim qm0mg1odzxg As String
Dim krvp2fbhid1 As String
Dim mcsi1tfzlhx As String
Dim AA4dzeqn0pyab As String
Dim df2tbjryvzw As String
Dim AA03fbgf234po As String
Dim worliacpdea As String
Dim d32barbenpf As String
Dim f4obdixbwyf As String
Dim rr02uneqz1v As String
Dim rpbd2tagiex As String
Dim uugw5lhvxx4 As String
Dim AA2gd10imen3j As String
Dim ukc4pa4121g As String
Dim ixcz1hct2fy As String
Dim dy4x40yeswj As String
Dim qnbvqxwkwcs As String
Dim lbfpql0hnqi As String
End Sub

Public Sub hiwo5xq15rv()

Dim bja5v1ptuk5 As String
Dim sxmmycqezt3 As String
Dim swsosfzgv3p As String
Dim g3qhrhm35ld As String
Dim p1w0yttqiun As String
Dim kxwdb4rfdfm As String
Dim dx3yppbp0fc As String
Dim fyplqhzf2sg As String
Dim yrnafh5s0w0 As String
Dim AA2vactvji0pc As String
Dim ynh3jhbuzcq As String
Dim AA5jlpmpelzax As String
Dim ta4t0ifcek2 As String
Dim AA2rmjbd21gmk As String
Dim uluuwfpe3iw As String
Dim zz0urzjozoo As String
Dim a4jn2zn5wff As String
Dim jvq3oqve4qc As String
Dim AA5luq3vmsuwa As String
Dim AA45j2ihvr3oj As String
End Sub

Public Sub AA4lq5tdxv1g3()

Dim z0zbiuphnyv As String
Dim d2yd425nfz0 As String
Dim avrm20qn0hr As String
Dim AA5pxqd3xbaup As String
Dim pqqjvfx0iqw As String
Dim uafxwqddoxj As String
Dim ixzkfxavdgx As String
Dim kl40e5xp5ho As String
Dim yfzpsm3pjnl As String
Dim ejf3q3xqpuu As String
Dim AA3pmt3cfjgp3 As String
Dim kbydhngf3bw As String
Dim AA44xbjje3b3s As String
Dim rk0psp32hts As String
Dim bv4yzy0ctms As String
Dim mmwgdt4tjgr As String
Dim v10a4azwxdl As String
Dim xzu3s11fv4j As String
Dim sqdpkdo4ohn As String
Dim AA5ieyiyppleh As String
End Sub

Public Sub pfnwzegsa1a()

Dim yxzzxnesnnp As String
Dim AA3pgckmxbydr As String
Dim AA3vnnvmjcdtn As String
Dim nrhxpqfcy2j As String
Dim AA2g2p1a0rpmo As String
Dim hqsu4ccf2ik As String
Dim bgf4qddfbhz As String
Dim AA4ayr4fg3vm1 As String
Dim da525z02jly As String
Dim wcvaus1rdkf As String
Dim nm2eh1btgd0 As String
Dim adxnepmzxwv As String
Dim su11cuwwsjj As String
Dim xykunhdz51a As String
Dim q4mhxog51c5 As String
Dim ou0ygj15jsz As String
Dim rzgw21asggh As String
Dim dgtamsjoa32 As String
Dim a1ldkyj4ihb As String
Dim AA33rcnzxsuwk As String
End Sub

Public Sub t1car5jaias()

Dim p3ewk2eee5e As String
Dim wu3e1lnfd0q As String
Dim xzdmamyxktx As String
Dim dcbypmludlr As String
Dim v2mq0xef5xh As String
Dim AA33djhalfrxq As String
Dim AA4z4wjao1ptr As String
Dim h4jvjp3orib As String
Dim usd250ivq0t As String
Dim lyfmf2vmrmc As String
Dim nathgu3aqcp As String
Dim jt3ktwhrj2x As String
Dim ghfcxrjiytw As String
Dim hfmyr3rzpkv As String
Dim pvg345pf1gd As String
Dim sc54qe550rp As String
Dim fvyneaott3o As String
Dim ehe1yfgl4n1 As String
Dim m23okge5ky3 As String
Dim jw5sk5ydnhe As String
End Sub

Public Sub tido2bt5rkp()

Dim a22rg0ynv4l As String
Dim yl4b21ylgto As String
Dim motlriwwciu As String
Dim AA5ialbxygcjn As String
Dim rl2yoandud5 As String
Dim bzfckfxw01d As String
Dim ftojulbjfwi As String
Dim rqdt0wudx1f As String
Dim xj2lww54mli As String
Dim is2cqkdnlud As String
Dim eamu52bxjsx As String
Dim zzk5fqto01l As String
Dim AA42ldjdpbvx5 As String
Dim AA3cndvi3rsel As String
Dim lhyoz34aed5 As String
Dim lzi3pjyin5n As String
Dim airrqucqz1s As String
Dim nqjkhzqlp1p As String
Dim AA5fzzcfj2rem As String
Dim j2sxom3g2lp As String
End Sub

Public Sub mkua3v003eh()

Dim ap4ige4j3ov As String
Dim i1o0h2xnnwy As String
Dim s3ns0tbweaa As String
Dim cf0mtsacgrx As String
Dim wkgh2hbsoqw As String
Dim AA25hveueszoh As String
Dim tq4qu03j442 As String
Dim AA4qdpvlwbrq0 As String
Dim phwspzz5cw5 As String
Dim mmvqly0qz1j As String
Dim icda0s250jl As String
Dim oizmkwbjtqc As String
Dim vwbupt11bgs As String
Dim koyrxjgeusj As String
Dim xjzvrlnxhtz As String
Dim AA3lk4srrssvd As String
Dim vvskjcdi1n5 As String
Dim djp2np2y5zf As String
Dim r34avkfohyy As String
Dim AA0hl4vhodiok As String
End Sub

Public Sub AA4by2j1w34ml()

Dim crohyuynmuk As String
Dim se5o4eevfml As String
Dim epzhpmwxdl0 As String
Dim kv4hswhuenp As String
Dim gzwdnw04opc As String
Dim z00pbihjnjt As String
Dim vkytwmcz2gi As String
Dim pjrgkdavmt2 As String
Dim fu4evjn4u3f As String
Dim k2kjdriuzwn As String
Dim xyfpta2sxh1 As String
Dim okxfhilotv3 As String
Dim a5rqrgbuj0f As String
Dim lgxi1g3zapa As String
Dim d4nb3abl2is As String
Dim e1k3aif4jen As String
Dim AA0zhszedvagj As String
Dim af1zvokjog3 As String
Dim gz1se23w0vd As String
Dim eqiafzaeify As String
End Sub

Public Sub nnfxeqe32ai()

Dim bjuqmefrtgq As String
Dim o5ralk4jtlu As String
Dim AA0j3smjpf3d0 As String
Dim htd1m3mks5v As String
Dim cyslu2rxskk As String
Dim gkqar2e433v As String
Dim tqbhkzziwl4 As String
Dim wul2hbe4xfs As String
Dim y234ia01yl1 As String
Dim opgpaig04k1 As String
Dim AA1fspz5ujcvm As String
Dim rm1upbczhd5 As String
Dim sszspt032vr As String
Dim AA1s52fkezq4i As String
Dim AA44qb135cbuo As String
Dim AA5xc54zjvfz1 As String
Dim egbisyjh5mt As String
Dim gxujccgycfz As String
Dim gzcyv0guvj3 As String
Dim qdhx5oqx221 As String
End Sub

Public Sub gg0c5ywxmnf()

Dim ornhaj124rl As String
Dim ir451eeodcc As String
Dim wyxbg3dbjzm As String
Dim uqxvxs21jkb As String
Dim bwbqrjoihgo As String
Dim udzfowjtmtu As String
Dim qqszau2czc5 As String
Dim AA01grjcfdzgt As String
Dim d2awhrhmqrw As String
Dim AA45kdoujplaa As String
Dim d3w4h420drl As String
Dim AA2i44bgvj2ic As String
Dim mnp1f1mhylk As String
Dim ymffqhlfn0b As String
Dim AA1nacs53mb2h As String
Dim dscotvapowm As String
Dim giavn4qdfrx As String
Dim b4lrb1xazvp As String
Dim lw3o3lfdii0 As String
Dim wybecdambsz As String
End Sub

Public Sub bakyfcxlomx()

Dim lp13nxajegz As String
Dim ihirrozunrd As String
Dim d23m5w5pfer As String
Dim AA13nphqwsync As String
Dim pdi10cid54q As String
Dim AA2m3ri0wikdq As String
Dim AA1mdh1ok1ej4 As String
Dim AA3gyx3gnguok As String
Dim AA3klqg0hkqah As String
Dim rswrwik13xg As String
Dim gmch2dhdktl As String
Dim cbqko52i2ql As String
Dim cvs1tphmkr0 As String
Dim dz2o4zbsqiz As String
Dim zlgaeck4sde As String
Dim zyf1bohdfqe As String
Dim tbzo4lkog2d As String
Dim jvze2uzi5ph As String
Dim ofttmi2xirn As String
Dim AA0tkjnyn5k5k As String
End Sub

Public Sub mboibjujmay()

Dim iwenbwjjl5d As String
Dim x3wwscpf4p4 As String
Dim nuxjfgjq3xr As String
Dim g5opdeyp2u5 As String
Dim vaypzyfigbp As String
Dim sr0lch1miyi As String
Dim eva4euk5n5h As String
Dim erhpkffaure As String
Dim AA3ufpenmfpdh As String
Dim bxdj1onnxcm As String
Dim AA2ravmpgiqah As String
Dim rohss2wwd21 As String
Dim xiy14zdqvto As String
Dim AA2jkdoz0zgfz As String
Dim ub3bdsomfv1 As String
Dim AA1ccfafc30tu As String
Dim ynsirqbvylx As String
Dim dzg34saxziy As String
Dim dp2pu0emwwh As String
Dim q4lyxsqskjr As String
End Sub

Public Sub vnexsvlrlvu()

Dim tudn13jzxfs As String
Dim mzjjxtsrjmb As String
Dim ovcxoomsalm As String
Dim AA5onaoy21sgd As String
Dim gvnxswkbyf4 As String
Dim okvp5jbo2lg As String
Dim h0jlvdiyufd As String
Dim xfffizjhpei As String
Dim AA1tdsry50b5d As String
Dim virgcxjis5t As String
Dim AA150p0d1q2vz As String
Dim norpqirk1oz As String
Dim cnzvc3qg53v As String
Dim hj0ob5r5qv0 As String
Dim AA1eypjlwxceu As String
Dim AA1k0g4ll152g As String
Dim fs0lgrqi25u As String
Dim n1tqdznne0c As String
Dim vhl4wfhcthz As String
Dim jzzj5r2jhwu As String
End Sub

Public Sub xj2albk4yuh()

Dim lnv11b3pq1e As String
Dim hvor0wsvwqj As String
Dim AA3bflodq2l04 As String
Dim hfkaz0k3byz As String
Dim oy1jrqtudg5 As String
Dim csc5cavdfaf As String
Dim z2pokr0opkh As String
Dim vmec2kcp3w3 As String
Dim d0trvtkbnqp As String
Dim zyh2ph0kkjh As String
Dim AA1jwufoj53pb As String
Dim co4e5ttqybi As String
Dim aa1neyqlrvf As String
Dim zq5jj4tvpf0 As String
Dim wdr5nnzoex3 As String
Dim suptrrjpne3 As String
Dim AA3orhmccth42 As String
Dim ogeknvemf4i As String
Dim xbpru5qmr4g As String
Dim fivibwkyuci As String
End Sub

Public Sub AA40rkmxq4df3()

Dim lgujf4ubscj As String
Dim itdlmkqdlw1 As String
Dim h5pcoa05agp As String
Dim hh23rgnpaqr As String
Dim AA1tn2x2fhm5c As String
Dim ryrjg3l3p51 As String
Dim mebwmt1vxqv As String
Dim jvtrvtpgnfp As String
Dim ggxbh4xxojj As String
Dim cmofwgcs3l3 As String
Dim sxhnkujuqtn As String
Dim ag4hnr4vypd As String
Dim caiyqle14hz As String
Dim ct5wsj03f5l As String
Dim AA3rziy2fsvss As String
Dim wknj1kgwyqk As String
Dim rt4bgo2xane As String
Dim tx1u0yhkkrr As String
Dim cnyowxdbxmt As String
Dim ifsd1djipih As String
End Sub

Public Sub bxr0d1irthi()

Dim qsoe41a2lij As String
Dim mkbimjkdjzu As String
Dim h3zztdiv5ej As String
Dim k0ap3jpxcgw As String
Dim chp0wlbgk4y As String
Dim ewfz0mbbdy3 As String
Dim auxbk100xpy As String
Dim ygfhyccgbvb As String
Dim yem044cewp4 As String
Dim avmfg0ykp0k As String
Dim dcerdd032cn As String
Dim j0fqxtzwck2 As String
Dim tvrjplewysh As String
Dim wxn2yj1sjpj As String
Dim AA1ynjqnjyo5j As String
Dim wkcc3qkxtid As String
Dim fjfbwfxhpe0 As String
Dim yqc12nv0mdr As String
Dim nyda1oy2gvh As String
Dim iwbkzwrbny5 As String
End Sub

Public Sub tmugzuynb3c()

Dim AA0w4x5vbp113 As String
Dim unpb4kri0ko As String
Dim bcqqzitvzxy As String
Dim ur4vac5p04o As String
Dim oozagzcqhee As String
Dim gu4qchom1se As String
Dim zb504vnswdu As String
Dim AA1j0gnlr3x4l As String
Dim e4ox3xe24ry As String
Dim toimo4dhtjx As String
Dim f3nm5tbvyqy As String
Dim ru0mulpym0h As String
Dim AA33h3e4sj22n As String
Dim udsrlrdpbaa As String
Dim AA3pvr0oydp0b As String
Dim y0lp22vtcge As String
Dim kmes5pmwska As String
Dim tzh4psbux1c As String
Dim lzry4k3qf2u As String
Dim hhzg31j5v2k As String
End Sub

Public Sub zvrjvofwvsq()

Dim AA1rnhzcnuu41 As String
Dim ajwppdwizvj As String
Dim wkvxhgc2lby As String
Dim AA2byxcfipqtc As String
Dim AA0pxh5pfrgvr As String
Dim qmmtaa5zbd2 As String
Dim qwr3sa4o2gy As String
Dim d0y3m50i3r0 As String
Dim b4204sqzdpg As String
Dim brbqc4ldfmt As String
Dim owq0lrsg0kw As String
Dim iulblf4i2xx As String
Dim AA3bgisaagngt As String
Dim hrxuqe31db5 As String
Dim kqm1fwu1qnq As String
Dim id5nfzwweqf As String
Dim gxjfognhlvj As String
Dim AA1zqz4ddn1az As String
Dim hucvwepugx4 As String
Dim tmkdhtyocoh As String
End Sub

Public Sub zqkkjkxqivc()

Dim s1c4xffwpa2 As String
Dim AA2v33obqlpa3 As String
Dim susb3x5n5q4 As String
Dim dwqere3ztw2 As String
Dim ktdtttz5upf As String
Dim ap2zupdbfhk As String
Dim d5d2dlqg5s3 As String
Dim jn21zulg2kv As String
Dim qavbpmitj4v As String
Dim AA2nm5zg0zu45 As String
Dim AA10gjbs3qyne As String
Dim cd2vmo3wenx As String
Dim uwdn2kfgvmo As String
Dim jgwiqbdxcsp As String
Dim dht3l3zsh4h As String
Dim ds30picyvo0 As String
Dim kjjwjzzhlrx As String
Dim sifslv0z5i0 As String
Dim qskgmnj4jqr As String
Dim ofc4ujimun1 As String
End Sub

Public Sub zw2rl0pwa4d()

Dim x0jaupcmqbs As String
Dim wdipvnwq0dj As String
Dim AA1i0tgyyarq1 As String
Dim AA3p2sc0kt2fg As String
Dim ocis2ejtcvl As String
Dim AA4zc5ryocacf As String
Dim anclpneech5 As String
Dim AA1mjt4kurjxt As String
Dim tz50gfo4gsp As String
Dim awfke0ufnsf As String
Dim zan2jscvdso As String
Dim npdiwldk515 As String
Dim uwb1yuz2y10 As String
Dim y1fhk3s1xvf As String
Dim i0hsxfdv2xa As String
Dim imwrqqz13n4 As String
Dim jythopjnazh As String
Dim deno25h4swr As String
Dim rhzgcs032tf As String
Dim oupdjnnppm2 As String
End Sub

Public Sub qcwxwjz4awq()

Dim AA31qukxnvbcq As String
Dim hklhoxythio As String
Dim AA1dkoppupp52 As String
Dim AA4mmgjkuwgyx As String
Dim za2bepeeluu As String
Dim kzyd2hbsft0 As String
Dim ekroacznmhs As String
Dim gypfr3a10t4 As String
Dim o5z0gt1u0ey As String
Dim wckhx5sku1y As String
Dim ngnedymuro0 As String
Dim kbrlnicadcs As String
Dim fasgudcjiva As String
Dim vqwxpcdliln As String
Dim mtcyjxvo5xh As String
Dim ieb0jbxwiiz As String
Dim AA4mh2mdnwuuy As String
Dim AA3fakqih2toj As String
Dim r044qqxn01s As String
Dim AA0zvazblued5 As String
End Sub

Public Sub l2q3t1ks2sd()

Dim fnmubbekapv As String
Dim t53kpb0rpa1 As String
Dim AA0y5bk0elwsf As String
Dim AA1ut2lg1rudj As String
Dim AA5ekbopujhli As String
Dim kmkybixzph1 As String
Dim AA5jkm4obbhnc As String
Dim a0jsfdyzgf1 As String
Dim dtqf24xja4n As String
Dim u2cj5g1a4oe As String
Dim v1ncrkqngiq As String
Dim esgsunjzh3q As String
Dim ez245obbvz5 As String
Dim vh2pwirakco As String
Dim wmx42itnyep As String
Dim mxasmezw4ic As String
Dim fyefufjfjkq As String
Dim AA3r2ldzhgmsn As String
Dim z0do1mqsmb4 As String
Dim aq0mpkbqdzk As String
End Sub
…
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 102400 bytes
SHA-256: 137c5342f0ec98719d46b329dbf8e33f730a53a62752e8561fcf171ee8194b8c