Hi,

I examined couples of ole field where CLSID is located in different places.
Only logigal place (?) that differs between OLEs was in offset 0x200 - 0x250

* CLSID in 0x800+1
00000200 FD FF FF FF FE FF FF FF FE FF FF FF FE FF FF FF
00000210 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000220 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000230 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000240 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000250 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

* CLSID in 0x8CC+1  Excel.Sheet.8
00000200 FD FF FF FF 04 00 00 00 FE FF FF FF 05 00 00 00
00000210 0A 00 00 00 06 00 00 00 07 00 00 00 08 00 00 00
00000220 09 00 00 00 0B 00 00 00 FE FF FF FF 0C 00 00 00
00000230 FE FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000240 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000250 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

* CLSID in 0x900+1
00000200 FD FF FF FF FE FF FF FF FE FF FF FF FE FF FF FF
00000210 05 00 00 00 06 00 00 00 07 00 00 00 08 00 00 00
00000220 09 00 00 00 0A 00 00 00 FE FF FF FF FF FF FF FF
00000230 0D 00 00 00 0E 00 00 00 0F 00 00 00 10 00 00 00
00000240 11 00 00 00 12 00 00 00 13 00 00 00 14 00 00 00
00000250 04 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF

What do you think?

I try to decrypt above but will see as binary isn't my strongest asset :(

AT