D14e3fb2e1c2525cd1affdb6a1b1e36b

From aldeid
Jump to navigation Jump to search

Description

Summary

  • Keylogger features
  • Saves log file in C:\WINDOWS\system
  • Sends log file to [email protected]

Identification

MD5 d14e3fb2e1c2525cd1affdb6a1b1e36b
SHA1 41552d0c4ea10437af3c68c950aaa3544ea02880
SHA256 dbe49a4bddbb790e6d7eb541277202b023d7bf4cf45a687f0db3449955e05600
ssdeep 1536:t/xVYpIDwdr+QnfQGXSrpP/BCuIYFfqxxZp:rCOwYQfQo6NJCdtxF
imphash 56571887bf0abe4b5e46b36ea3e21690
File size 100.0 KB ( 102400 bytes )
File type Win32 EXE
Magic literal PE32 executable for MS Windows (GUI) Intel 80386 32-bit

Antivirus detection

Antivirus Result Update
AVG PSW.Generic.EQO 20140225
Ad-Aware Trojan.Spy.Agent.NZI 20140225
Agnitum TrojanSpy.AdvKeyLogger!TBLBiCDPYuU 20140223
AhnLab-V3 Win-Trojan/Advkeylogger.102400 20140224
AntiVir TR/RedNeck.KeyLog 20140225
Antiy-AVL Trojan[Spy]/Win32.AdvKeyLogger 20140225
Avast Win32:Trojan-gen 20140225
Baidu-International Trojan.Win32.AdvKeyLogger.Ap 20140225
BitDefender Trojan.Spy.Agent.NZI 20140225
Bkav W32.AdvKeyLoggerLnr.Trojan 20140224
CAT-QuickHeal Trojan.VB.Gen 20140225
CMC Generic.Win32.d14e3fb2e1!MD 20140220
ClamAV Trojan.Spy.Keylogger-14 20140225
Commtouch W32/SysKeylog.B.gen!Eldorado 20140225
Comodo TrojWare.Win32.Spy.AdvKeyLogger 20140225
DrWeb BackDoor.Generic.575 20140225
ESET-NOD32 Win32/Spy.AdvKeyLogger 20140225
Emsisoft Trojan.Spy.Agent.NZI (B) 20140225
F-Prot W32/SysKeylog.B.gen!Eldorado 20140225
F-Secure Trojan.Spy.Agent.NZI 20140225
Fortinet W32/RedNeck!tr 20140225
GData Trojan.Spy.Agent.NZI 20140225
Ikarus Trojan-Spy.Win32.KeyLogger.gs 20140225
Jiangmin TrojanSpy.AdvKeyLogger 20140225
K7AntiVirus Riskware ( d7dc1d590 ) 20140224
K7GW Backdoor ( 04c4c8191 ) 20140224
Kaspersky Trojan-Spy.Win32.AdvKeyLogger 20140225
Kingsoft Win32.Troj.AdvKeyLogger.(kcloud) 20140225
McAfee PWS-RedNeck 20140225
McAfee-GW-Edition PWS-RedNeck 20140225
MicroWorld-eScan Trojan.Spy.Agent.NZI 20140225
Microsoft TrojanSpy:Win32/AdvKeylogger 20140225
NANO-Antivirus Trojan.Win32.AdvKeyLogger-Spy.fcqj 20140225
Norman Suspicious_Gen2.OVBIA 20140224
Panda Trojan Horse 20140224
Rising PE:Trojan.Win32.Generic.122B7AD3!304839379 20140223
Sophos Troj/RedNeck 20140225
Symantec Infostealer 20140225
TheHacker PWS/RedNeck 20140224
TrendMicro TSPY_ADKEYLOG.A 20140225
TrendMicro-HouseCall TSPY_ADKEYLOG.A 20140225
VBA32 TrojanSpy.AdvKeyLogger 20140224
VIPRE Trojan-Spy.Win32.VB.misc!cobra (v) 20140225
ViRobot Trojan.Win32.AdvKeyLogger.102400 20140225
nProtect Trojan-Spy/W32.Agent.102400.BE 20140225
ByteHero 20140225
Malwarebytes 20140225
Qihoo-360 20140220
SUPERAntiSpyware 20140225
TotalDefense 20140225

Defensive capabilities

INCOMPLETE SECTION OR ARTICLE
This section/article is being written and is therefore not complete.
Thank you for your comprehension.

Dynamic analysis

Files

Log file

The malware acts as a keylogger that logs the activity in C:\WINDOWS\SYSTEM\{EXE_NAME}.TXT where {EXE_NAME} is the name of the executable:

"[Log Start: 25/02/2014 14:05:50]"
"--------------------------------------------------"
"logged keys
"
""
""
"{alt}{tab}"
"{tab}"
""
""
""
""
"e
[14:07:13 - Current Window: Explorateur Windows] 
[14:07:13 - Current Window: Poste de travail] "
"{down}{down}"
"
[14:07:14 - Current Window: C:\] "
"{tab}{down}"
"{down}{down}{down}{down}{down}{down}{down}{down}{down}"
"{down}<CrLf>
[14:07:16 - Current Window: C:\WINDOWS] "
"{down}"
"{down}{down}{down}{down}{down}{down}{down}{down}{down}"
"s"
"{down}{down}{down}{down}"
"{down}"
"{down}{down}{down}"
"{up}{up}{up}"
"<CrLf>
[14:07:21 - Current Window: C:\WINDOWS\system] "
""
"{down}{down}"
"{down}{down}"

IEXPLORE.EXE

The malware copies itself into C:\WINDOWS\system\IEXPLORE.EXE

Registry keys

INCOMPLETE SECTION OR ARTICLE
This section/article is being written and is therefore not complete.
Thank you for your comprehension.

Network indicators

DNS queries

FakeNet confirms that the following domain is requested:

[DNS Query Received.]
  Domain name: mail.hotmail.com
[DNS Response sent.]

This is to send the email (see next section).

Email ([email protected])

The log file is sent to [email protected] as shown on the nelow extract from FakeNet:

[Received new connection on port: 25.]
220 PracticalMalwareAnalysis.COM STMP Service Ready
[New Data on port 25.]
HELO New Look
250 PracticalMalwareAnalysis.com
[New Data on port 25.]
MAIL FROM: <New Look>
250 OK
[New Data on port 25.]
RCPT TO: <[email protected]>
250 OK
[New Data on port 25.]
DATA
354 start mail input, end with <CRLF>.<CRLF>
[New Data on port 25.]
Message-ID: 92178780436515.84721.qmail@New Look
[New Data on port 25.]
DATE: 14:23:39
[New Data on port 25.]
FROM: malware (France) 14:23:40 <New Look>
[New Data on port 25.]
TO: 50 <[email protected]>
[New Data on port 25.]
Reply-to:  <[email protected]>
[New Data on port 25.]
SUBJECT: 25/02/14
[New Data on port 25.]
MIME-Version: 1.0
[New Data on port 25.]
Content-Type: text/plain; charset=us-ascii
[New Data on port 25.]
Username- malware
Computer Name- MALWARE-418EE9F
[Log Start: 25/02/2014 14:05:50]-----------------------------------------------
--logged keys

[14:06:27 - Current Window: Regshot 1.9.0 x86 ANSI]
[14:06:36 - Current Window: Sans titre - Bloc-notes]
[14:06:36 - Current Window: ~res-x86.txt - Bloc-notes] {alt}{tab}{tab}e
[14:07:13 - Current Window: Explorateur Windows]
[14:07:13 - Current Window: Poste de travail] {down}{down}
[14:07:14 - Current Window: C:\] {tab}{down}{down}{down}{down}{down}{down}{down
{down}{down}{down}{down}<CrLf>
[14:07:16 - Current Window: C:\WINDOWS] {down}{down}{down}{down}{down}{down}{do
n}{down}{down}{down}s{down}{down}{down}{down}{down}{down}{down}{down}{up}{up}{u
}<CrLf>

[SNIP]

[14:23:23 - Curr[New Data on port 25.]
e[New Data on port 25.]
nt Window: C:\WINDOWS\system32\cmd.exe]
[14:23:39 - Current Window: C:\WINDOWS\system32\cmd.exe - FakeNet.exe] acdefk8{
ab}<CrLf>{ctrl}{alt} [New Data on port 25.]

.
250 OK
[New Data on port 25.]
QUIT
221 PracticalMalwareAnalysis.com bye

Static analysis

Sections

Name       VirtAddr     VirtSize     RawSize      Entropy     
--------------------------------------------------------------------------------
.text      0x1000       0x15448      0x16000      5.658386    
.data      0x17000      0xf6c        0x1000       0.000000    
.rsrc      0x18000      0x764        0x1000       2.024022

IAT

MSVBVM60.DLL

  • _adj_fdivr_m64
  • Ord(546)
  • Ord(518)
  • __vbaGenerateBoundsError
  • __vbaStrFixstr
  • __vbaInputFile
  • _adj_fprem
  • __vbaR8ErrVar
  • __vbaAryMove
  • Ord(537)
  • __vbaCopyBytes
  • _adj_fdiv_r
  • _allmul
  • __vbaLsetFixstrFree
  • __vbaRecAnsiToUni
  • __vbaChkstk
  • __vbaObjSetAddref
  • __vbaFixstrConstruct
  • _adj_fdiv_m64
  • __vbaHresultCheckObj
  • __vbaI2Var
  • _CIlog
  • Ord(616)
  • _adj_fptan
  • __vbaFileClose
  • Ord(581)
  • __vbaI4Var
  • __vbaRecUniToAnsi
  • __vbaFreeVar
  • __vbaFreeStr
  • __vbaStrI2
  • __vbaStrR8
  • __vbaStrI4
  • __vbaFreeStrList
  • __vbaI2I4
  • _adj_fdiv_m16i
  • EVENT_SINK_QueryInterface
  • Ord(607)
  • __vbaLenBstr
  • __vbaResume
  • Ord(594)
  • Ord(576)
  • __vbaStrToUnicode
  • _adj_fdiv_m32i
  • Ord(717)
  • __vbaExceptHandler
  • __vbaSetSystemError
  • DllFunctionCall
  • __vbaUbound
  • __vbaVarTstLt
  • Ord(608)
  • __vbaBoolVarNull
  • __vbaVargVarMove
  • __vbaLbound
  • __vbaFileOpen
  • Ord(571)
  • Ord(526)
  • Ord(606)
  • __vbaInStrVar
  • __vbaAryLock
  • __vbaLsetFixstr
  • __vbaVarTstEq
  • Ord(593)
  • __vbaOnError
  • __vbaVargVarCopy
  • __vbaStrCat
  • __vbaVarDup
  • _adj_fdiv_m32
  • EVENT_SINK_Release
  • __vbaStrCmp
  • __vbaAryUnlock
  • __vbaStrVarCopy
  • __vbaFreeObjList
  • Ord(666)
  • __vbaFreeVarList
  • __vbaStrVarMove
  • Ord(578)
  • __vbaExitProc
  • __vbaVarTstNe
  • __vbaAryConstruct2
  • __vbaFreeObj
  • _adj_fdivr_m32
  • __vbaStrVarVal
  • __vbaVarSub
  • Ord(660)
  • __vbaVarTstGt
  • _CIcos
  • __vbaStrErrVarCopy
  • __vbaVarMove
  • __vbaFPInt
  • __vbaErrorOverflow
  • __vbaNew2
  • __vbaAryDestruct
  • __vbaStrMove
  • _adj_fprem1
  • Ord(563)
  • __vbaWriteFile
  • Ord(535)
  • __vbaLenVar
  • __vbaEnd
  • Ord(685)
  • Ord(617)
  • _adj_fpatan
  • EVENT_SINK_AddRef
  • _adj_fdivr_m32i
  • __vbaVarVargNofree
  • __vbaStrCopy
  • Ord(632)
  • __vbaFPException
  • _adj_fdivr_m16i
  • __vbaVarAdd
  • Ord(100)
  • _CIsin
  • _CIsqrt
  • __vbaVarCopy
  • Ord(612)
  • _CIatan
  • _CItan
  • Ord(529)
  • __vbaObjSet
  • __vbaVarCat
  • __vbaStr2Vec
  • _CIexp
  • __vbaStrToAnsi
  • __vbaFpR8
  • __vbaFpI4
  • Ord(598)
  • __vbaFpI2

Strings

\MVOK
Project1
Form1
wwwwwx
wwwwx
wwwwwwwx
wwwwww
wwxpww
DDHw
wwww
Form1
txtstatus
tells email status
Text2
content of logfile to be mailed
Command1
&blah ice
MS Sans Serif
Text1
logged keys
MS Sans Serif
Timer2
Timer1
VB5!
setup
Project1
B3IC
Form1
WinsockBas
smtpmailer
Hide
modRegistry
Project1
Form
C:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Text2
Timer2
txtstatus
Command1
Text1
user32
GetAsyncKeyState
hP/@
GetKeyState
advapi32.dll
RegOpenKeyExA
RegSetValueExA
h80@
RegCloseKey
h|0@
Kernel32.dll
RegisterServiceProcess
user32.dll
GetForegroundWindow
h<1@
SetWindowPos
GetWindowTextA
GetWindowTextLengthA
kernel32
GetComputerNameA
hx2@
GetUserNameA
CAPSLOCKON
FormOntop
GetCaption
inform
GetLocaleInfoA
CallWindowProcA
SetWindowLongA
h84@
recvfrom
PostMessageA
RtlMoveMemory
h,<@
lstrlenA
hp<@
wsock32.dll
accept
bind
closesocket
htons
hP=@
connect
ioctlsocket
getpeername
getsockname
h\>@
getsockopt
htonl
inet_addr
hX?@
inet_ntoa
listen
ntohl
ntohs
h\@@
recv
select
send
hPA@
sendto
setsockopt
shutdown
socket
hXB@
gethostbyaddr
gethostbyname
gethostname
h,C@
getservbyport
htC@
getservbyname
getprotobynumber
getprotobyname
hPD@
WSAStartup
WSACleanup
WSASetLastError
h E@
WSAGetLastError
hhE@
WSAIsBlocking
WSAUnhookBlockingHook
__vbaErrorOverflow
WSASetBlockingHook
h`F@
WSACancelBlockingCall
WSAAsyncGetServByName
WSAAsyncGetServByPort
hPG@
WSAAsyncGetProtoByName
WSAAsyncGetProtoByNumber
WSAAsyncGetHostByName
hDH@
WSAAsyncGetHostByAddr
WSACancelAsyncRequest
WSAAsyncSelect
h,I@
WSARecvEx
hpI@
I  S
s\icychyll.BASE\
__vbaLbound
VBA6.DLL
__vbaVarCopy
__vbaLsetFixstr
__vbaFixstrConstruct
__vbaStrToUnicode
__vbaStrToAnsi
__vbaInputFile
__vbaStrCmp
__vbaObjSet
__vbaFileClose
__vbaWriteFile
__vbaFileOpen
__vbaFreeObj
__vbaStrVarVal
__vbaVarTstNe
__vbaOnError
__vbaFreeVarList
__vbaVarDup
__vbaVarCat
__vbaStrVarMove
__vbaFreeObjList
__vbaFreeStrList
__vbaStrMove
__vbaStrCat
__vbaVarMove
__vbaFreeStr
__vbaStrCopy
__vbaFreeVar
__vbaEnd
__vbaObjSetAddref
__vbaHresultCheckObj
__vbaNew2
__vbaSetSystemError
__vbaStrFixstr
__vbaAryDestruct
__vbaAryUnlock
__vbaGenerateBoundsError
__vbaAryLock
__vbaUbound
__vbaStrErrVarCopy
__vbaVarVargNofree
__vbaStrVarCopy
__vbaStr2Vec
__vbaAryMove
__vbaExitProc
__vbaResume
__vbaFpI4
__vbaFpI2
__vbaFpR8
__vbaLenBstr
__vbaInStrVar
__vbaVarSub
__vbaI4Var
__vbaRecAnsiToUni
__vbaRecUniToAnsi
__vbaStrI2
__vbaCopyBytes
__vbaBoolVarNull
__vbaI2I4
__vbaI2Var
__vbaVargVarMove
__vbaLsetFixstrFree
__vbaVarTstLt
__vbaLenVar
__vbaVarTstGt
__vbaVarTstEq
__vbaStrR8
__vbaR8ErrVar
__vbaFPInt
__vbaVarAdd
__vbaStrI4
__vbaAryConstruct2
GetCurrentProcessId
htd@
__vbaVargVarCopy
`,e@
`(e@
`0e@
`(e@
FormName
WindowHandle
f91uJ
hd3@
hT3@
}#jhht3@
hd3@
hT3@
hd3@
hT3@
}#j|ht3@
hd3@
hT3@
}#jdht3@
} jXh
h$.@
hd3@
hT3@
}#jPht3@
hd3@
hT3@
}#jXht3@
hd3@
hT3@
}#jXht3@
Q8Rj
hH5@
|SVW
hT5@
F8Pj
hH5@
h4x@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
Rh 4@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
Rh$6@
hT5@
h$.@
h$.@
hT5@
Qh,6@
hT5@
h$.@
h$.@
hT5@
Rh46@
hT5@
h$.@
h$.@
hT5@
Qh<6@
hT5@
h$.@
h$.@
hT5@
RhD6@
hT5@
h$.@
h$.@
hT5@
QhL6@
hT5@
h$.@
h$.@
hT5@
RhT6@
hT5@
h$.@
h$.@
hT5@
Qh\6@
hT5@
h$.@
h$.@
hT5@
Rhd6@
hT5@
h$.@
h$.@
hT5@
Qhl6@
hT5@
h$.@
h$.@
hT5@
Rht6@
hT5@
h$.@
h$.@
hT5@
Qh|6@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
Rh$7@
hT5@
h$.@
h$.@
hT5@
Qh,7@
hT5@
h$.@
h$.@
hT5@
Rh47@
hT5@
h$.@
h$.@
hT5@
Qh<7@
hT5@
h$.@
h$.@
hT5@
RhD7@
hT5@
h$.@
h$.@
hT5@
QhL7@
hT5@
h$.@
h$.@
hT5@
RhT7@
hT5@
hT5@
Qh\7@
hT5@
hT5@
Rhd7@
hT5@
hT5@
Qhl7@
hT5@
hT5@
Rht7@
hT5@
hT5@
Qh|7@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
Rh 8@
hT5@
hT5@
Qh48@
hT5@
hT5@
PhH8@
hT5@
hT5@
Rh\8@
hT5@
hT5@
Qhl8@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
Ph 9@
hT5@
hT5@
Ph89@
hT5@
hT5@
Qh@9@
hT5@
hT5@
PhH9@
hT5@
hT5@
QhP9@
hT5@
hT5@
PhX9@
hT5@
hT5@
Qh`9@
hT5@
hT5@
PhP5@
hT5@
hT5@
Qhh9@
hT5@
hT5@
Php9@
hT5@
hT5@
Qhx9@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
Ph@5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
QhP9@
hT5@
hT5@
PhP5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
Rh,:@
hT5@
hT5@
Qh<:@
hT5@
hT5@
PhL:@
hT5@
hT5@
Rh\:@
hT5@
hT5@
Qhl:@
hT5@
hT5@
Ph|:@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
Ph\7@
hT5@
hT5@
Rhl7@
hT5@
hT5@
Qh|7@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
h(;@
hT5@
hT5@
h$.@
N8Qj
h0;@
hT5@
hT5@
hT5@
hT5@
WWWWj
LSVW
hT5@
hT5@
hT5@
hd"A
dSVW
Ph@9@
RPhd;@
QRhd;@
RPhd;@
QRhd;@
ht(A
hl*A
DSVW
hppA
hppA
hppA
h(^@
h(pA
Qh(pA
hx^@
h(pA
Ph(pA
gw_3
`SVW
Php9@
PhX_@
8SVW
$SVW
hT5@
hT5@
hT5@
hT5@
5lpA
hl_@
=lpA
hL`@
hLpA
=lpA
Ph(pA
h(pA
=lpA
h(pA
h(pA
=lpA
h(pA
=lpA
h|a@
h|a@
h(pA
=lpA
Rh(pA
Ph b@
Ph,b@
hTb@
h8b@
hp9@
hp9@
h(pA
=lpA
h$c@
h(pA
=lpA
Qh(pA
kh4c@
DSVW
hbZA
hbZA
(SVW
9=(xA
h(xA
5(xA
hN[A
MSVBVM60.DLL
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaResume
__vbaStrCat
__vbaWriteFile
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaVargVarCopy
__vbaLenVar
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaStrFixstr
__vbaVarTstLt
__vbaBoolVarNull
__vbaFpR8
_CIsin
__vbaVargVarMove
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaLbound
_adj_fpatan
__vbaFixstrConstruct
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaStr2Vec
__vbaExceptHandler
__vbaInputFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaR8ErrVar
__vbaFPException
__vbaInStrVar
__vbaUbound
__vbaStrVarVal
__vbaVarCat
__vbaLsetFixstrFree
__vbaI2Var
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaFpI2
__vbaFpI4
__vbaVarCopy
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
_CItan
__vbaFPInt
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
dDx<
dDx<
dDx<
dDx<
dDx<
dDx<
dDx<
dDx<
wwxpww
DDHw
wwww
wwwwwx
wwwwx
wwwwwwwx
wwwwww


Comments