Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 b9d3310354ce1c48…

MALICIOUS

Office (OOXML)

535.2 KB Created: 2016-05-27 16:38:37 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-10-16
MD5: 40ecbb903002d05782d29945796bfbab SHA-1: 3ab3785e8a038afbda04958673d550e9dd508dad SHA-256: b9d3310354ce1c48729e4ca0f5393e759fdc9ef5c6a4cd725bcdbac5112a9674
278 Risk Score

Heuristics 9

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA stages a PowerShell/LOLBin download-and-run command critical OLE_VBA_BITSTRANSFER_DROPPER
    The macro assembles a download command using a PowerShell or LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil, ...) that fetches a remote payload, then executes it -- writing it to a script file and running it, or launching it directly from an auto-exec handler. The keywords are commonly split with PowerShell backtick / cmd caret escapes to evade scanners; this detection de-escapes the source first. A high-confidence downloader/dropper, stronger than the individual Shell / download keywords on their own.
    Matched line in script
    Private Sub Workbook_Open()
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
            strURL = WinHttpReq.ResponseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set WinHttpReq = CreateObject("Microsoft.XMLHTTP")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set CodeTab = GetObject(Dateiname)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • External workbook data link low OOXML_EXTERNAL_REL_DATALINK
    External workbook reference in xl/externalLinks/_rels/externalLink1.xml.rels: MK_Code.xlsm
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.kaps-computer.de/downloads/mensurkomplett/MK_Code.xlsm Referenced by macro
    • http://www.kaps-computer.de/downloads/mensurkomplett/MK_Standardwerte.xlsxReferenced by macro

Extracted artifacts 31

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 14536 bytes
SHA-256: 3576c2b1c248b8ae366f9b7740d3a94b09fa6471101dfad6333e771e56f13821
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "DieseArbeitsmappe"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'Private Declare Function URLDownloadToFile Lib "urlmon" _
'    Alias "URLDownloadToFileA" ( _
'    ByVal pCaller As Long, _
'    ByVal szURL As String, _
'    ByVal szFileName As String, _
'    ByVal dwReserved As Long, _
'    ByVal lpfnCB As Long) As Long

Sub HauptButtonsAnlegen() 'nur temporär - wird sonst nicht benötigt
    Dim Tabelle As Worksheet
    Set Tabelle = Worksheets("Registerübersicht")
    Dim Butneu As Object
    
    With Tabelle.Range("B10:B11")
        Set Butneu = Tabelle.Buttons.Add(Left:=.Left, Top:=.Top + 1, Width:=.Width, Height:=.Height - 2)
    End With
    With Butneu
        .Name = "BtnUbersichtAktualisieren"
        .Characters.Text = "Übersicht aktualisieren"
        .OnAction = "MK_Code.xlsm!Uebersichtanlegen"
    End With
    
    With Tabelle.Range("B12:B13")
        Set Butneu = Tabelle.Buttons.Add(Left:=.Left, Top:=.Top + 1, Width:=.Width, Height:=.Height - 2)
    End With
    With Butneu
        .Name = "BtnUbersichtPDF"
        .Characters.Text = "Übersicht als PDF ausgeben"
        .OnAction = "MK_Code.xlsm!UebersichtPDF"
    End With
    
    With Tabelle.Range("B14:B15")
        Set Butneu = Tabelle.Buttons.Add(Left:=.Left, Top:=.Top + 1, Width:=.Width, Height:=.Height - 2)
    End With
    With Butneu
        .Name = "BtnAllePDF"
        .Characters.Text = "Alle PDF ausgeben"
        .OnAction = "MK_Code.xlsm!AllePDFAusgeben"
    End With
    
    With Tabelle.Range("B16:B17")
        Set Butneu = Tabelle.Buttons.Add(Left:=.Left, Top:=.Top + 1, Width:=.Width, Height:=.Height - 2)
    End With
    With Butneu
        .Name = "BtnAlleDAT"
        .Characters.Text = "Alle DAT ausgeben"
        .OnAction = "MK_Code.xlsm!AlleDatAusgeben"
    End With
    
  

End Sub
Sub buttonanlegen()
    Dim Tabelle As Worksheet
    Set Tabelle = Worksheets("Registerübersicht")
    Dim Butneu As Object
    
    With Tabelle.Range("F20:G21")
        Set Butneu = Tabelle.Buttons.Add(Left:=.Left, Top:=.Top, Width:=.Width, Height:=.Height)
    End With
    With Butneu
        .Name = "BtnRegisterSortieren"
        .Characters.Text = "Register verschieben"
        .OnAction = "MK_Code.xlsm!Registersortieren"
    End With

End Sub

Sub HauptButtonsReset()

    Call BtnReset("BtnUbersichtAktualisieren", "Uebersichtanlegen")
    Call BtnReset("BtnUbersichtPDF", "UebersichPDF")
    Call BtnReset("BtnAllePDF", "AllePDFAusgeben")
    Call BtnReset("BtnAlleDAT", "AlleDatAusgeben")
    Call BtnReset("BtnRegisterSortieren", "Registersortieren")

End Sub

Sub AlleButtonsReset()

Call BtnReset("BtnGemischteStimme", "Mixturfenster")
Call BtnReset("BtnImport", "Import")
Call BtnReset("BtnDruckBereichIntonateur", "ButtonDruckbereichIntonateur")
Call BtnReset("BtnDruckBereichMetallpfeifen", "ButtonDruckbereichMetallpfeifen")
Call BtnReset("BtnDruckBereichholzpfeifen", "ButtonDruckbereichHolzpfeifen")
Call BtnReset("BtnDruckBereichKonstrukteur", "ButtonDruckbereichKonstrukteur")
Call BtnReset("BtnDruckBereichZungen", "ButtonDruckbereichZungen")
Call BtnReset("BtnDATAusgabe", "ButtonDATAusgeben")
Call BtnReset("BtnPDFAusgabe", "ButtonPDFAusgeben")
Call BtnReset("PropKonstReset", "GrundwertProportionKonstante")
Call BtnReset("Fusslaenge", "VorschlagUebernehmenFusslaenge")
Call BtnReset("MaterialPlus", "ButtonPlusMaterial")
Call BtnReset("MaterialMinus", "ButtonMinusMaterial")
Call BtnReset("PfeifePlus", "ButtonPlusPfeife")
Call BtnReset("PfeifeMinus", "ButtonMinusPfeife")
Call BtnReset("KernspalteReset", "KernspalteReset")
Call BtnReset("Aufschnitt", "VorschlagUebernehmenAufschnitt")
Call BtnReset("Schleifenbohrung", "VorschlagUebernehmenSchleifenbohrung")
Call BtnReset("Bohrunggroesser", "ButtonBohrungPlus")
Call BtnReset("BohrungKleiner", "ButtonBohrungMinus")
Call BtnReset("Becherlänge", "VorschlagUebernehmenBecher")
Call BtnReset("btnReset", "Standardsladen")


End Sub

Sub BtnReset(btnName As String, btnAction As String)
With ActiveSheet
    If .Shapes(btnName).OnAction <> "MK_Code.xlsm!" & btnAction Then .Shapes(btnName).OnAction = "MK_Code.xlsm!" & btnAction
End With
End Sub
 

Private Sub Workbook_Open()

Dim strPfad As String
Dim strDatei As String
Dim strVersionsnummer As String
Dim wb As Workbook
Dim binschonoffen, binschonoffen2 As Boolean
Dim lngResult As Long
Dim strURL As String

Dim strDatei2 As String
Dim strURL2 As String

Dim WinHttpReq As Object
Set WinHttpReq = CreateObject("Microsoft.XMLHTTP")


strDatei = "MK_Code.xlsm"
strPfad = ThisWorkbook.Path
strURL = "http://www.kaps-computer.de/downloads/mensurkomplett/MK_Code.xlsm"

strDatei2 = "MK_Standardwerte.xlsx"
strURL2 = "http://www.kaps-computer.de/downloads/mensurkomplett/MK_Standardwerte.xlsx"

Application.ScreenUpdating = False

For Each wb In Application.Workbooks
    If wb.Name = strDatei Then binschonoffen = True
    If wb.Name = strDatei2 Then binschonoffen2 = True
Next wb

If Not binschonoffen Then
    If Dir(strPfad & "\" & strDatei) = "" Then
        WinHttpReq.Open "GET", strURL, False
        WinHttpReq.send
        strURL = WinHttpReq.ResponseBody
        If WinHttpReq.Status = 200 Then
            Set oStream = CreateObject("ADODB.Stream")
            oStream.Open
            oStream.Type = 1
            oStream.Write WinHttpReq.ResponseBody
            oStream.SaveToFile strPfad & "\" & strDatei, 1
            oStream.Close
        End If

'        lngResult = URLDownloadToFile(0, strURL, strPfad & "\" & strDatei, 0, 0)
'        If lngResult = 0 Then
'            MsgBox "Code-Date war nicht vorhanden." & vbCrLf & "Die neueste Version wurde heruntergeladen und im aktuellen Pfad gespeichert."
'        Else
'            MsgBox "Code-Datei nicht vorhanden und Download nicht möglich."
'        End If
    End If
    Call VBA_Laden(strPfad & "\" & strDatei)
End If

If Not binschonoffen2 Then
    If Dir(strPfad & "\" & strDatei2) = "" Then
        WinHttpReq.Open "GET", strURL2, False
        WinHttpReq.send
        strURL2 = WinHttpReq.ResponseBody
        If WinHttpReq.Status = 200 Then
            Set oStream = CreateObject("ADODB.Stream")
            oStream.Open
            oStream.Type = 1
            oStream.Write WinHttpReq.ResponseBody
            oStream.SaveToFile strPfad & "\" & strDatei2, 1
            oStream.Close
        End If
    
    
'        lngResult = URLDownloadToFile(0, strURL2, strPfad & "\" & strDatei2, 0, 0)
'
'        If lngResult = 0 Then
'            MsgBox "Standards-Datei war nicht vorhanden." & vbCrLf & "Die neueste Version wurde heruntergeladen und im aktuellen Pfad gespeichert."
'        Else
'            MsgBox "Standards-Datei nicht vorhanden und Download nicht möglich."
'        End If
    End If
End If


If Worksheets.Count < 3 Then
    Application.Run strDatei & "!Standardsladen"
    Application.Run strDatei & "!TabelleAnlegen"
End If

With Worksheets("Registerübersicht")
    .Range("A20").Value = 1
    .Activate
    .Hyperlinks.Add Anchor:=.Range("E20"), Address:="", SubAddress:="1!B10", TextToDisplay:="zur Tabelle"
End With

Call HauptButtonsReset
Application.Run strDatei & "!Willkommen"
Application.ScreenUpdating = True

End Sub

Attribute VB_Name = "Tabelle1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CommandButton1, 2, 0, MSForms, CommandButton"
Private Sub CommandButton1_Click()
    Dim i As Integer
    Dim strRange As String
    Dim rng As Range
    
    With Application
        .ScreenUpdating = False
        .Calculation = xlCalculationManual
        .EnableEvents = False
    End With

    For i = 20 To 200
        If ActiveSheet.Cells(i, 1).Value = "" Then
            ActiveSheet.Cells(i, 1).Value = ActiveSheet.Cells(i - 1, 1).Value + 1
            strRange = Cells2Range(i + 1, 2) & ":" & Cells2Range(i + 2, 2)
            Set rng = ActiveSheet.Range(strRange)
            
            With ActiveSheet.OLEObjects(1)
                .Top = rng.Top
                .Left = rng.Left
                .Width = rng.Width
                .Height = rng.Height
            End With
            With ActiveSheet
                .Hyperlinks.Add Anchor:=ActiveSheet.Cells(i, 5), Address:="", SubAddress:="'" & i - 19 & "'!B10", TextToDisplay:="zur Tabelle"
                .Range("B" & i & ":D" & i).Interior.Color = RGB(226, 239, 218)
            
            ' In Werk das erste Werk eintragen für praktischere Drop-Downliste
                        
                .Range("C" & i).Value = "32"
                .Range("D" & i).Value = .Range("F6").Value
            
            End With
            Exit For
        End If
    Next
           
    Application.Run "MK_Code.xlsm!TabelleAnlegen"
    
    Worksheets("Registerübersicht").Activate
    
    With Application
        .ScreenUpdating = True
        .Calculation = xlCalculationAutomatic
        .EnableEvents = True
    End With

End Sub

Private Sub Worksheet_Activate()
    Call ThisWorkbook.HauptButtonsReset
End Sub

Attribute VB_Name = "Tabelle2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Modul1"
Option Explicit

Function Cells2Range(Zeile, Spalte)
    Spalte = Columns(Spalte).Address(False, False)
    Spalte = Left(Spalte, InStr(Spalte, ":") - 1)
    Cells2Range = Spalte & Zeile
End Function


Sub VBA_Laden(Dateiname As String)

Dim CodeTab As Workbook
Set CodeTab = GetObject(Dateiname)

End Sub




Attribute VB_Name = "Tabelle3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox1, 11, 0, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 13, 1, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 18, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 20, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 22, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 24, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox7, 28, 6, MSForms, CheckBox"
Private Sub Worksheet_Activate()
    Call ThisWorkbook.AlleButtonsReset
    Application.Run "MK_Code.xlsm!Standardsladen"
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub
Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Attribute VB_Name = "Tabelle4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox7, 28, 0, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 24, 1, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 22, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 20, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 18, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 13, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox1, 11, 6, MSForms, CheckBox"
Option Explicit
Private Sub Worksheet_Activate()
    Call ThisWorkbook.AlleButtonsReset
    Application.Run "MK_Code.xlsm!Standardsladen"
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Attribute VB_Name = "Tabelle5"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox7, 28, 0, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 24, 1, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 22, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 20, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 18, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 13, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox1, 11, 6, MSForms, CheckBox"
Option Explicit
Private Sub Worksheet_Activate()
    Call ThisWorkbook.AlleButtonsReset
    Application.Run "MK_Code.xlsm!Standardsladen"
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Attribute VB_Name = "Tabelle6"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox1, 11, 0, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 13, 1, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 18, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 20, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 22, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 24, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox7, 28, 6, MSForms, CheckBox"
Private Sub Worksheet_Activate()
    Call ThisWorkbook.AlleButtonsReset
    Application.Run "MK_Code.xlsm!Standardsladen"
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub
Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 75264 bytes
SHA-256: e386e93c5094063e0f8c41789600bc25132c36cc61ea422652ebd65019e6b657
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image17.emf 3020 bytes
SHA-256: bd455f76f6fd6b8c1b2674b7829c5042f7efd5f36e37387237ecb91bf049b934
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image5.emf 3020 bytes
SHA-256: 473f2a45ffb9e8197d6b69b4ca9f18242158081359b7a21b8a16aaa8398373a0
emf_02.emf ooxml-emf OOXML EMF part: xl/media/image12.emf 3020 bytes
SHA-256: 419e832bf271815a537282142b4a21e7585af8bc572d191f09b8d9a6ab77333c
emf_03.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 2852 bytes
SHA-256: 6251d37176ffe9bdd7f7558ff3a5dd614e474814599e9f79b13b8faa1352f868
emf_04.emf ooxml-emf OOXML EMF part: xl/media/image6.emf 3020 bytes
SHA-256: 05403a577cc5532b97c98cc95b9a47059f27756e2c90cf41122de5e0b9e23175
emf_05.emf ooxml-emf OOXML EMF part: xl/media/image15.emf 3020 bytes
SHA-256: 6b6eaa192e0a1b5ba4995cfd63d4a1ee4cb0939ed999053e5e5f79a6bc5f37d5
emf_06.emf ooxml-emf OOXML EMF part: xl/media/image7.emf 3020 bytes
SHA-256: 178e94d9c0469661c9561c447147769905cc1ba8364cad5e619dcc4ea1590fab
emf_07.emf ooxml-emf OOXML EMF part: xl/media/image18.emf 3020 bytes
SHA-256: 3c844d986d50a83759ae3242cf7937b79f1986ac4141e153870cfada2131a3ba
emf_08.emf ooxml-emf OOXML EMF part: xl/media/image9.emf 3020 bytes
SHA-256: 5b2b9992761e23725ded2410473f9b07c9f1186723b0b5ab6fbf86d7c4285775
emf_09.emf ooxml-emf OOXML EMF part: xl/media/image8.emf 3020 bytes
SHA-256: 0b380c457c715a861bdc72f49bebe63742e3e29d5835542e2aa8fc344da4d983
emf_10.emf ooxml-emf OOXML EMF part: xl/media/image13.emf 3020 bytes
SHA-256: 0c93536066252adfee93003d848935e9a4cafcf35b058a764c4be76e6df674f3
emf_11.emf ooxml-emf OOXML EMF part: xl/media/image16.emf 3020 bytes
SHA-256: 514822e10d59987ee367f051ead410213eb2f7ce4c375b295c59ee013c03927e
emf_12.emf ooxml-emf OOXML EMF part: xl/media/image2.emf 3020 bytes
SHA-256: 979e64c4ae3444e3c59bd1bf5c9770183881f60475eedd95a02c72c8efb2f27c
emf_13.emf ooxml-emf OOXML EMF part: xl/media/image10.emf 3020 bytes
SHA-256: 2c1e43e81606842c484a841b7276bc0c1c4b1e9e76577a83b070af754d379d62
emf_14.emf ooxml-emf OOXML EMF part: xl/media/image3.emf 3020 bytes
SHA-256: 4facb1b4f8a7b61a3872fb6e5fb7e8d281e4c41d34b5e5f068a5b9cc8f48a724
emf_15.emf ooxml-emf OOXML EMF part: xl/media/image14.emf 3020 bytes
SHA-256: a139b64b211809a5447b77591304df469b03d6971867ed27693bd8c09fa1a378
emf_16.emf ooxml-emf OOXML EMF part: xl/media/image11.emf 3020 bytes
SHA-256: 2a87462105be10347008bc9efd4a2b7079307bb170b3beb2d857a2001c3edf27
emf_17.emf ooxml-emf OOXML EMF part: xl/media/image4.emf 3020 bytes
SHA-256: 2094dc84067f1686a4de14f8dacddb729244797e3605ed24dee3536427cdbd59
emf_18.emf ooxml-emf OOXML EMF part: xl/media/image19.emf 3020 bytes
SHA-256: fc81eca4caf91d73c4df5045d30d9f0dff4f9964a60746760da5d15d5fb21660
emf_19.emf ooxml-emf OOXML EMF part: xl/media/image20.emf 3020 bytes
SHA-256: 17f4045238e8b0e41de61cf4f1a6e8808366f2b6b3755d6fe602cff580421a69
emf_20.emf ooxml-emf OOXML EMF part: xl/media/image21.emf 3020 bytes
SHA-256: 03e3957c767bd5c453098e709171c90c830da48e4c090a93bc7d81842c08c55b
emf_21.emf ooxml-emf OOXML EMF part: xl/media/image22.emf 3020 bytes
SHA-256: 222236805c9222dca16af09dd883ea432dcaceb04810aba1724974106a057240
emf_22.emf ooxml-emf OOXML EMF part: xl/media/image23.emf 3020 bytes
SHA-256: 44138442d52cd4a6d723ab0747476536cd9210d5efc891093468804c86b6bcc9
emf_23.emf ooxml-emf OOXML EMF part: xl/media/image24.emf 3020 bytes
SHA-256: 83bc7757eea17498b9e0db5c7e1b140cb8585b589be18da1a2a31ecd8f797fa9
emf_24.emf ooxml-emf OOXML EMF part: xl/media/image25.emf 3020 bytes
SHA-256: bc91508a1ddac81667d8ccabcd8bd2099a4e5e8fa7e0ebe31c040ec444352f36
emf_25.emf ooxml-emf OOXML EMF part: xl/media/image26.emf 3020 bytes
SHA-256: 82412ee18d659f5b2c6572dfedf74826acc754e5237cc88ec6fcb5ae36b7aa5a
emf_26.emf ooxml-emf OOXML EMF part: xl/media/image27.emf 3020 bytes
SHA-256: 30e682d8175f108950d427cf3c905810f9289c2e2245a8ef6f448eb0c7920d67
emf_27.emf ooxml-emf OOXML EMF part: xl/media/image28.emf 3020 bytes
SHA-256: 2f8224e7d383d49a538bd8b048fc03fddfb577176bfbffb1a5d042228b01d859
emf_28.emf ooxml-emf OOXML EMF part: xl/media/image29.emf 3020 bytes
SHA-256: 17f7262ec39346db344d6216a0fe8d1a449363a18059e332269cc9006f2e61fd

Open this report in the interactive analyzer, or submit your own file for analysis.