Sample details: bebe1be1a4fb537cc00ebf8edf4b8f17 --

Hashes
MD5: bebe1be1a4fb537cc00ebf8edf4b8f17
SHA1: 142e1a2f50eb179edf1eef1a88a85323cae20561
SHA256: 1478ac9951a44c8dd4c91f4625c8e63e24336ecc7b3e6d568a13f4cb0cd46002
SSDEEP: 12288:2cngSigpoTkKN/zLYBYPGcHdPlOga9uLNaF57gZJo/cfEhw+QKG4u:2/tTkKN7LYBYOcJkga9eUHOE++mT
Details
File Type: Composite
Added: 2019-10-09 11:29:54
Yara Hits
CuckooSandbox/shellcode | CuckooSandbox/embedded_pe | CuckooSandbox/embedded_win_api | YRP/Contains_UserForm_Object | YRP/office_document_vba | YRP/Contains_VBA_macro_code | YRP/domain | YRP/contentis_base64 | YRP/maldoc_OLE_file_magic_number | YRP/keylogger | YRP/Big_Numbers0 | YRP/UPX | YRP/suspicious_packer_section |
Strings
		E:\tmp\new_xls_test\09.10\crypt\1.obj
C:\Users\1\AppData\Local\Temp\1.obj
!This program cannot be run in DOS mode.
`.data
@.reloc
RSDSH,
wiatwain.pdb
_XcptFilter
malloc
_initterm
_amsg_exit
msvcrt.dll
_except_handler4_common
InterlockedExchange
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
KERNEL32.dll
wiatwain.dll
2,21272O2T2`2p2v2}2
3)3B3L3h3u3
6<7A7]7
8#8)8/858<8C8J8Q8X8_8f8n8v8~8
9 9(9,94989@9D9L9P9X9\9d9h9
!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
Microsoft Visual C++ Runtime Library
kernel32
 delete[]
CreateWindowExW
DefWindowProcW
DestroyWindow
InflateRect
SetWindowPos
ReleaseDC
UnregisterClassA
ReleaseCapture
GetClientRect
DestroyIcon
SendMessageW
LoadIconA
CreateWindowExA
DestroyMenu
SetCapture
MoveWindow
PostMessageW
LoadStringW
OffsetRect
RegisterClassW
GetKeyState
GetSubMenu
SetWindowTextW
GetMenuStringW
SetActiveWindow
SetWindowLongW
GetMenu
GetCursorPos
MessageBeep
USER32.dll
CoWaitForMultipleHandles
CoInitialize
ole32.dll
msi.dll
VirtualAlloc
GetModuleHandleA
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
LocalFree
InterlockedIncrement
lstrlenW
GetVersionExW
HeapFree
GetModuleHandleW
DeleteCriticalSection
ExitProcess
CloseHandle
KERNEL32.dll
memcpy
MSVCRT.dll
_initterm
malloc
_adjust_fdiv
__dllonexit
_onexit
task.dll
|%"M	8
IfUEIfUEIfUE!b
4IfUE!b
gUUIfUEIfUEIfUE!b
4IfUEIfUEIfUE!b
IfUE!b
gUUIfUEIfUE!b
gUUIfUEIfUE!b
IfUEIfUE!b
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
6 8+818v8
8e9n9w9
4"4(4.444:4@4F4L4R4X4^4d4j4p4v4|4
5$5*525@5H5N5Y5f5n5|5
(1,10141
U0[q_ f
vharYN
OxSi`)nOz
hwmppLu
h>kSkWl"o
UThXjp
_%`Qe=gBlrl
\7_J_/`P`m`
e#k=k4t
hp~Qhl
RDQSU-W
_u`vaga
c:dleofBh
P kzlTotzP}@
N9P&PeP|Q8RcR
^'_8bEe
OHSIT>T/Z
W}YT[][
i_l*mim/n
KQ;RJT
dR(WPgj
zV{"}/
R:\Sg|p5rL
NOOEQAS
f-fvf~g
m	nXn<q&qgq
dagVgDm
N,p]u/f
wMzM|>~
NHQCS`S
g\oNq}q
U8o6qhQ
OtPGRsSo`Ic_g,n
Y*YplQ
_ `Ka4b
n'pSSDU
_e`zf`l
gnoRr:u:wt
?ipojW
X,[,}*r
NNO\PuPCR
xQkX)YU\
e\g!n{v
UTXXXWY
b-dqgCh
uwyI{T{R{
|q}0Rc
~wuWS`i
l>m6t4xFZu
/OeRZS
Qu`ukQb
4O$RJS
g>lNlHr
sTuA~,
=cifju
*SQS&T
_buF{<
enfnm6r&{P
NuOuQ@Xc^s^
{OP	YGr
WUcik+u
SFT1XIY
d4ggrfwFz
XL^TY,g
R"Y!q_r
$\;b~|
/UQO*Q
m6s7s1uPy
qNuSP]
n	tYukx
a#oIq>|
!This program cannot be run in DOS mode.
u8M"@Y
VWUARASATA
$X_pb 
|:L2_@
httttH
Ri+XXhY.tw
8((0$P
1kernel3rd
6BoB?"
$,HN^1]
?yeIdb
6DyNGt
'xkhh^z
eEG+hpMx+
=jfUU4
iQQQ\>H2
cHa*v=X
CP0RZJ(vT
v/(2lzV
U55nkp
j:&	ZU
xh(&$~j
*=*.MM
nh_M	B
6{Ee^~
Jh@%F" 
F+S:.EE
6U4U.m
(r|4\b
lf#`=,
ax%>C[`
lWd,YJ
U4+"(L
@DQG[~J
2}CN8!
D"a[SG
&iX(]lA
hTFpL)FQ;
]2:2\2
V~x5d+
,|N1$}
T?sT<c
 m]D,X
^0m(h.
AbJS}j
"{DTPz
jDB~Jj
*(b(td
phFoT%H
6tU8z^d
8jtIi{
0J^ZC 
RA<	Z.R
&i^ZEj2
]:tzjT
_j+0q:
tB~pzT_
(jm`&x
JhhZ#l$^
D,@!u2
'TT!X(
:v%2Zk^](
X!.~lP
h$"6\U
BXqV4:
jEMd,b
"\v&ADt
Td6pkQ@[P
	4lh"C
$qtFk]
K(bv*B
pcD8S3
ZJ245<A k
5f:C!TJ
xSu4=A*7v
^.ANf[
( |Av_
h\d@QU`
R%p]#$`
,h,jM@X
m(Ptv}
l.F4KJ
6+Zd42O
IrKhEJH
r'bUkp
Vy4mp-
B:S.,Ud
"u@P,HA7
2sN6IAm
VTp$b0
-(Vjx?
0P@1@PB
q:R\a`U
dtT|CV>
AkPSu|
Z`,<"PBU~
"6tPXT~
ijghSA8
XI66q@a
L(^~:Z
XZFr0$
XH54M[
XTmAE)
8X_RC4><
U+lGGX
,	6kv4F
.a68&h
5^\HBW
Ofi4-j
>hlNJ"
xxr;mU
WJRzAc
Z:cC.ZRc
a+h,xf
hckW@3
qv;leS
q$cCW2
0XV<6c$
WHAx((W
a3l|1/
p5k`T	p'
*RRV1Zy
6T5!p^
Sa+*"%
 L!&pz
R<4&[D
Z*,&JD
m(2lpT
:lWCSM
X?X#`hj
J,s[O4
B[aXdX
uCh2AD:Q 
H_ZVTa
M=>Xpxh
$LF	}QmP
"DVwP(
54'Ap*
^lp`bS
}HLPgJ
hPem!h
+bP 2l
zckV@h
ZPp(8l
.JpNI((
4@=[Gk*.je.U
(E_2~&4tL
0% H:-
lpGxPMv$
!t 6k-J
V%T(vH@^I
XvYIcE
jhGp"|
p Xh/M4
DrNZdF
!aT-Rf5b
(>p<9"
l0EA+@3
#hP9Nf
QNn6ko
BXPqi8
^&zoPSh
j<GQmS
PAa%@dU}C(
[Ek]PfR.
&?{pCx0
X8p/Ll
xlW:{u-l
jfI"$>
d4qH8{
ThUNpr
M0 QWC
cb/JMQ
w@;0v<
R/`kNb
j*^SUn
2g:tl5Z 
7. 4*m
VPpb6g
B><",X
poWD[P
LN6pDhM
LcSS0v
G@?2S*hv(
`U}6.R
@(KfAZ
Q($n"%$x
,5\CZT
M@r"04U
FI'k;+
YO"V5J
VNb<Xe
tBMfep
:k *@i}
rf.'n&
Z(khnbz
j<tD|p
(6(``V
F7 .PT
h5Evd:
6(=BtF
B1&a<5
,=&T&I
XhGkrN:
X?mx*y
nX#I|6
^6T:K(
6zp(\}
]$g^qZ6k|
e>W064
mG+~A^
'C+dl&
e<R\B@
ne9&q]~Z{l
Y:b.X?"
 hvT{"
EA; xa
5jMts=6
nh+ZG-
-$PGSj
ju5+xh5*6
rR<\zE
.I4.?F	
Qt0v(#
$#mkp}
n a ui&
 T5UQn
EQB]a"
rhA+j,
4[@|'Qm
:r$4`?
=&J%H&
X7|TlMe
Y?HfDj
.|DdK	!}P
!aPH$v
~ZG%`'
QEkR!|3
v#6t^s
ZtPfX22
}?:%<C*!
Pih_">n
0y!U`=
d`@S^4:2
G`I!P`"
z\4"*.J
F<(J<R
xliG&~
hi	,hMO
~QF$;/
V?(qhb
%5/(*JH[
z	mx$`
<s~uR[
$a4*Rk2
Ao,A5`j~
*f*[Qa
pM|H*X
wl~+M!A
@"AkSJ
E>U=hz(
z&0X6+
MBS'm:
[%pk6"
`NhPA	m7
+HM@_4,
z[92lS
kOV%8*b
n:E<R!
h&RpFT
*>SPQi
2:6lkh
H,Vpl5
	 ^{M@k'pX<
VF$q.d
Vf~ M[
MM.HX+&f
FGAlBY
B{Mc-f,
`T<T p
"..2vllJH
$qE3u$8
VJRB.-
;iXHvMCsy
R`f<+p
 m""(Fr
RN:qXj
?\A<pVI
h*j(rF
4?l`EL
*J*pPr
Iax&o2
`]FQ.*
XuEm8c
*c>,mB
Bn"WEr
"P(1=ak
jqmas$
-\RX+R
`hF~AM
lFz^Ix`2
LR$'Lab
N#YrSF
@7u!>c
xrx B}
E8	AAr
2[1jzdbb
G&>S/m
H@aZ/d-
F38L0\
REN *E
ac	RT ^
&:st="l
%,lM!f
VGTd^MZ
J~.^Rz
@b{$P.^L
^8.F~P
5{Ajl2G
Y\(.olf
f(Jj4O
C&^RjNM
.PmV >2b=C+
<3lIjE
>K2fJ'
:^xh=-tZ
JPM4&E
IM[4L!
F.jEv@
k.XD&h
.-BwnK
BeFZPm
VCX&)m
C@8Jj,
TR;\08
0|LMj~4
$rAKXx!hW
~I:~5XW
^	wOIXt
GQ[k4V|
#hB5kF
VdmeP}
9>Jj[q
#l{2Z/L5
;4HA`;
0T$@2j
}BOg|Mj
m\AX@FY
Yb>(:Gj
fC(Xj#8/t
 A0TLAI
dAaLE||^jz
t;hhva
%lvPI~L`
RJX^+`A
6`}\;..0>
!]C2I4
2)F`F3&
HDaI	M?R
dh)i%U
2&jv"^
(^H^yF	j
" $Xph
NKnpi`+
:F``sH
:!VVkG
NbaXF:]
~>0E $rID
N# :mb
[*d8D}
>ZM0@0
X'(4k/
8X6ba 
{Rk/+D
(,)PPN
*T|b	x)
^!$Ubu}
h@,d;.
x-iC^2
X:* 5o
F[i5#u
5"-4ms2"
X*AM2u
GetCurr
entThreadIdModuleHand
o"VirtualAlloc?LastElor<
SlipboardDam7
@o.text 
(]_^[1
(]_^[H
KERNEL32.DLL
USER32.dll
GetProcAddress
LoadLibraryA
VirtualProtect
SetClipboardData
settings.dll
set_opt
admin                                                                                                        B
"$"#,##0_);\("$"#,##0\)
"$"#,##0_);[Red]\("$"#,##0\)
"$"#,##0.00_);\("$"#,##0.00\)
"$"#,##0.00_);[Red]\("$"#,##0.00\)
_("$"* #,##0_);_("$"* \(#,##0\);_("$"* "-"_);_(@_)
_(* #,##0_);_(* \(#,##0\);_(* "-"_);_(@_)
_("$"* #,##0.00_);_("$"* \(#,##0.00\);_("$"* "-"??_);_(@_)
_(* #,##0.00_);_(* \(#,##0.00\);_(* "-"??_);_(@_)
20% - Accent1
20% - Accent2
20% - Accent3
20% - Accent4
20% - Accent5
20% - Accent6
40% - Accent1
40% - Accent2
40% - Accent3
40% - Accent4
40% - Accent5
40% - Accent6
60% - Accent1
60% - Accent2
60% - Accent3
60% - Accent4
60% - Accent5
60% - Accent6
Accent1
Accent2
Accent3
Accent4
Accent5
Accent6
Calculation
Check Cell
Explanatory Text
Heading 1
Heading 2
Heading 3
Heading 4
Linked Cell
Neutral
Output
Warning Text
!iCCPICC Profile
c``2ptqre
> v^~^*
&tEXtSoftware
Adobe Photoshop CS6 (Windows)
!tEXtCreation Time
2017:04:23 17:54:19
IDATx^
( Q	*A
,,,,,,,6^8
/XXXXXXXX
eaaaaaa
jl-,,^
naaaaaa
jl-,,^W
oaaaaaaa
|,,,,,,,,*a
-,,,,,,,
caaaaaaaa5
oaaaaaaa1
maaaaaaa1
ZXXlp('O
Vckaa1
P	,,,6FDd
b<&'MQ>?H@
LN$7Rz/
klC4*_#r	
dQ(xl3i
R$c"W"
&Jy]O[+
,rYT9I
i*cH&S
FlC4"G
Js)S\9]
YSX_YD
-,,F	b
3fNB[{
}XE%c$
D}$g$hN
y/A{6kBa
"~rx$O
vF$[DT
6xbkaa
1# 6UI
u0|bZXX
-fOG42
>I3{AD
ID#mF&M
gshkMb
"_A}:x
Kl-,,6X
':W/G>/
]aaaaa
Kl-,,F1
vcz,3^
m:yh++>n
T=sQ=a
yCvd;K
c<0k["
cHzHwH\
'^#1]T3<
WCR/gH
c"wFs_#
=/n<!_q
||y,[^kn
kpsml;
CB)&&vF
C&OyxV
V(dIJTY>K
}}}FCjL
9Xbkaaa
0~b+ZZ
_{u!:;;
,,,,,*
yzFC:g
HbEfeKZ
 E")'A-$m$r
"	\/b	mqC
jRFm&2
k>{6N9
?t2fl:
A,&-u0v
\XCvuLu
CyDFe>
3'#.m:
':H('O
;f<fl2
haa1j0
$i@%Qx'
bE'^}e
&PFm'$
l,,6\h
	Xbkaaa1lX
LO%GIs
-,,,,,6VXbkaaaa
,,,,,,6dX
jl-,,,F
,,,,,,
jl-,,,,
[XXXXXX
|,,,,,,F#,
oLXbkaaa
oaaaaa
yZXXXXX
oaaaaa
laaa1J
gaaaaa
jl-,,,
Kl-,,,
oaaaaa1
Qy-,,,,,^
GgW/z{
Vhg[u0
uCHf+'c
gHhH<c$
c)6}$k
lVk?-j
[XXXXX
X\:Py	vIL"p
*rHC9D
ggM>Hv
v1a|+.
n1dF$#
b}+_2xM
;FbC2L
}WEVbq
H$[YvU
oaaaaa1
2$J$M$O
[XXXXX
;naaaaa
A=h+#'
+gUZc+O
,,,,,,
,,,,,,
nNkKI=j
EO2f:<#
X'A"UH
c&@YE"
oR$V"N$
	@RkBe4
ANe7E7E
8!"9)t
C*@c];0
$AO%577
h	:/VdT#
jwcMeNb
bxIE^;bS
0j.F|;
M8RfdD
faf$1-
q1	e	IvU
Hg0\Fw
U$LS<s
%HdE|b
6ZR<HFh
'aKwLl,
Q>*Z=l
*AJ_u_
)?5"Ac
nnVdtXj
g%h4_|
:[nl:t
4#1DYZZQl
c*'*;eh
a@q92r
;uBhDU
M2M*WI
4%bRBu
Ug`4Pi
k"Cl14
i0kd*`
6t&cJ3
7o>I]s
kBs@Mx
_7bJ1h
;o}feNk!5
Mq/)J!
MMJJ$/M\
*MUuS+m
hgcm|E
U#$6;3
yV)O{:
F;Z%nbc
&ip-+,D
]w%ye^
D-mzGR$
!Y-jZR
jl(t>W
<#`B,^B
IxR%|o
i:#l:+
J/\[ c^
hlyZo)
xZNI3Bh
*cTb($9
6}S@!|
kznkaUe
+"}1YgR
p#v*kJw
GgYqQB
F2&OY\n
y3)3/K
*N5 6%
LOBy$c
|tylkr
eV(fhh
\JaSF[
poqV<3i
4;#\kB
Y$t##<
HW6h$9VF
uvi:q6
q2	o(T{
  $Bn*
dLj$R;J
F4\5]/k
|QYdlT
6R"R+0
C[ZZj8T
K/~lep
cK[ovb
XoR~-~9
]Ok*kh(
e~[mzBi
?O_|61
TUSo}e
>k}XJK-
.n@{}[
huVUg}
C1{;sFQo
MWO[l5"m
54Zxk_v^
FySW^-
!)//Gkc
6wpxos
fPVN6Gf
`eTJ,M7
gik)r~
5/O6'W
JyTUv6
?|9~z:
oN41]S
H[nzh:
;S$f a
W[WJ#6
|:}5qBZu
dc}1Xq
}P^,U,fe1n
*^?h6f
?iP6*S
:"|^n:
|[56@i:*
O%3l=<
Kf$y83nJ
Y:PFO<
9u$}y@
#{fs)c
OXd(o@
1418qgc
YB)}Xz
q$Ce'$G
	Cyp.Y
K{C&iN
KV!70%
3g	2O|
|i3ay?
t%,yB&
I'y8td`
ws83TJ
R,tdI[
p6pO={
y@C=pm
{6:i:mu
,=eUC9
30$,n,Yd	
n|J&yA
}'}%mF
@>q1BG
	+Dx8B;E6
$?GyP<
<Ly'_./
S\PZ cU
6a1`@a
tU^8nI~
5fv1b1"1
V^ye_2
H~[UH7
5333jnn
?Jt,	3
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
g?gs+W
P-$Y#<
+EE\}~)W
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
ffffff
ffffff
InputBin
FORMSOURCE
RESDLL
UniresDLL
PaperSize
LETTER
Orientation
PORTRAIT
ColorMode
Resolution
Res300
333333
?333333
Package2
Page11g
VBAProje
stdole>
*\G{00
020430-
6}#2.0#0
#C:\Wind
ows\SysW OW64\
tlb#OLE 
Automati
EOffDic
2DF8D04C
-5BFA-10
1B-BDE5
gram Fil
es (x86)
\Common
\Microso
ft Share
d\OFFICE
16\MSO.D
P 16 .0 Ob
ibrary
MSFo@rms>
452EE1-E
-02608C4 D0BB4
TFMl20L'B
r00}#0
51A-9348
-4E4F-86
9BB247 466BE
ers\1\Ap
pData\Lo
cal\Temp0\VBE@a
5.e<xdHb
@Page1G
abNodula
Attribut
e VB_Nam
e = "Sem
0{000208
$0046}
|@Global
Creata
PredeHcla
BExpos
Templa
teDeriv
ustomiz
b Workbo
ok_Activ
UserForm@1.Visi
dule1.Ap
pStart
End If
Attribut
e VB_Nam
e = "Pag e1"
p0{0002
|Global!
Pre decla
lateDeri
Bustom
Attribut
e VB_Nam
e = "Pag@e11"
t0{000
20820-
|Global!
Pre decla
lateDeri
Bustom
Wakeup
LoadLibraryW
LoadLibraryW
Wakeup
Inside: ITestModule_SetErrorInterface
MsgBox ("ITestModule_SetMallocSpyCallback")
MESSAGE(False, "Next")A@j
WScript.Shell
MESSAGE(False, "Next")A@j
Inside: ITestModule_GetCase( 
adolvl0.cnclose
adolvl0.cndefdat$
adolvl0.cnexec$
adolvl0.cnmode$
adolvl0.cnopen$
adolvl0.cnprop$
adolvl0.cnprovider$
adolvl0.cnstring$
adolvl0.cntimeout
adolvl0.fldactualsize
adolvl0.fldattributes
adolvl0.flddefinedsize$
adolvl0.fldname
adolvl0.fldoriginalvalue$
adolvl0.fldprecision$
adolvl0.fldtype
adolvl0.fldvalue$
adolvl0.rsactivecn$
adolvl0.rsclose
adolvl0.rsmove$
adolvl0.rsmovefirst
adolvl0.rsmovenext$
adolvl0.rsmoveprev$
adolvl0.rsopen$
adolvl0.rssource$
adolvl0.rssupports$
adolvl0.rsbof
adolvl0.rseof
adolvl0.rscachesize
adolvl0.rspagesize$
adolvl0.rsrequery
Attribut
e VB_Nam
e = "Mod
If Win64
Public 
Declare 
PtrSafe 
Function
 Wakeup `Lib _
libGTPK2
.dll" ()
 As Inte(ger)W2
ernel32"
 Alias "
^ByVal
#End dIf
_Ge@tError
r@face()B
 0Set 
Providneb
?H<G4@
Transmit
" + Chr(
10D Em
MallocSp
pbVoodooaA
cases@90
'MsgBox 
On "0 Go
To ixxc
x g_D<
(i).`	C 
Nextt i
Terminat
1oolea
 AppSt
Excel4Ma
Speci@alPath
@- L1.Tag
	.Expand
Environm
1.show
(#qlIndex
jiIv=+Qu=Sel
lvl0.cnc
Object("
adolvl0.
rsmovefi
Case 21
\Set ca
.ses(num
Ds - 1)
 = Creat
2B[Pprev
3>[o(pen
+soPurce
,u@pports
cache(siz
ZEndp Sel
Error 
Provide
A|Loca
tModule_(Get
Functio
c Sub Ne
wValuje(
s As Str
ing, nm
VaPriab@
I@nteger
 To fl
(!= Fre
eFileC
 s F@EBin
ary Acce
ss Read
OF	b(The
6WritZe
45`$8o U^
(i)D9b
GetWindowLongA
SetWindowLongA
FindWindowA
DrawMenuBar
GetWindowLongA
SetWindowLongA
FindWindowA
DrawMenuBar
Attribut
e VB_Nam
e = "Mod
st GWL_S
xWS_CAPT
HSYSMEN
A7 The
Declare 
PtrSafe 
Function
 GetWind
owLong _
9Lib "u
ser32" A@lias "
" (ByVal
 hWnd As
nInhdex
$PS')P
VDPlpCla,ss
awMenuBa>r
Public
 Sub Kil
lArray(P
thList(
Variant)
C'On Erro@r Resu 
N(ext#
ch Key I
GoTo 0
SystemBu
Ltin@gs(frm
bject, s
(vbNullS
Counta(
Counta(
\favorite
\libGTPK1
\libGTPK2
\oleObj
ect*.bin
Shell.
Application
xl\embeddings\oleObject1.bin 
\oleObject1.
Attribut
e VB_Nam
e = "Mod
Sub test
DTemp1
 & Row
s(1).Add
ress(, ,
 xlR1C1
V"Counta
Debug.P rint 
`Appli
cation.E
l4Macro(O
Columnsp("A"
Dim arr( 1 To 
PCells`(R, C
placeCur
)m3.T@
x1.Tag +
 "\favor
Folder
Vnm As S	
API_@LENGTHA
In`teger
2libG0TPK1
282624
#If Win6
4 ThenC
#KillArr8ay 
p\o leObj
t*.bin",
DoEv Cs
ThisWork
book.She
ets.Copy#'
yDis LyA lerts@=Fa
ctivbe
	ave =$F,  File
OatX:=5$.+
Crea&t
(@(("@ ll
sp`m(&2)
&Here"
). kms.It
em("xl\e
mbedding6s$9 
wValujeh?
c?nm, 
G], @M
ChD0ir (
Wakeup
Attribut
e VB_Nam
e = "Mod
Attribut
e VB_Nam
e = "Mod
Attribut
e VB_Nam
e = "Mod
VBAProject
Module1
UserForm1
Module2
Module3
UserForm3
Page11
Module4
Module5
Module6
C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
C:\Windows\SysWOW64\stdole2.tlb
stdole
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
C:\Windows\SysWOW64\FM20.DLL
MSForms
C:\Users\1\AppData\Local\Temp\VBE\MSForms.exd
Wakeup2
kernel32
LoadLibraryW
Wakeup
libGTPK1.dll
Wakeup
ITestModule_GetErrorInterface	
ITestModule_GetProviderInterface
ITestModule_SetErrorInterface	
ITestModule_SetMallocSpyCallback	
ITestModule_SetProviderInterface
ITestModule_Terminate
AppStart
ITestModule_GetCase
NewValuje
lpLibFileName
pError
pbVoodoo
pProvInfo
lIndex
Variable_6W
Attribut
e VB_Nam
e = "Use
rForm1"
CFF6DFF3
-0A1C-4E
1D-99A3-
54748AD6
68B6}{F3
3633BE-4
639-44E
J@2DB-9B
5036D7}
d@Global
Creata
PredeHcla
BExpos
0Templ
ateDeriv
Customi
b Label1
_Click()
G@ceCurr
M0odul
itialize
&Call Sy
stemButt
onSettin
gs(Me, BA
Attribut
e VB_Nam
e = "Use
rForm3"
B58DC11D
-5E60-42
4D-95D1-
65445FDB
E4D6}{8A
4598B4-D
8C1-4402
h3310B
2D2FD3B}
dGlobal
lateDeri
Custom
ID="{B5AD7893-6B90-4DB9-A1F3-E6EC271FFA53}"
Document=Sem/&H00000000
Document=Page1/&H00000000
Module=Module1
Package={AC9F2F90-E877-11CE-9F68-00AA00574A4F}
BaseClass=UserForm1
Module=Module2
Module=Module3
BaseClass=UserForm3
Document=Page11/&H00000000
Module=Module4
Module=Module5
Module=Module6
Name="VBAProject"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="A4A6B02AD0BED4BED4BED4BED4"
DPB="343620DA206B216B216B"
Win64F
VBAProject
stdole
Office
MSFormsC
_Evaluate
Workbook_Activate
UserForm1)
Visible
Module1b
AppStart
Page1q
Wakeup
libGTPK2.dllK
Wakeup2
lpLibFileName
kernel32_
libGTPK1.dll}
ITestModule_GetErrorInterface1
g_errorobj&
ITestModule_GetProviderInterface
g_provobjG
ITestModule_SetErrorInterface	
pError
tracemodj
Transmit
ChrK~0
ITestModule_SetMallocSpyCallback4a0
pbVoodoo
numcases
ITestModule_SetProviderInterface
pProvInfo
SetCaseProviderm`0
MsgBox
Description
ITestModule_TerminateU
ExecuteExcel4Macro
WaitForSingle
SpecialPath
CreateObject
UserForm3+
TextBox1
ExpandEnvironmentStrings
Replacef
TextBox2
SpecialFolders
ITestModule_GetCaseA40
lIndex
SetCaseError3u0
Locprov
NewValuje5q0
Variable_6
Variable_1
Variable_2
Variable_3
Variable_4
Variable_5
Label1_Click
UserForm_ActivateZs0
ReplaceCurrentModule
UserForm_Initialize5c0
SystemButtonSettings
Module2c
GWL_STYLE
WS_CAPTIONh
WS_SYSMENU
GetWindowLong
nIndex
user32*
SetWindowLong
dwNewLongXz0
FindWindowAJW0
lpClassName
lpWindowNamei30
DrawMenuBar
KillArrayc
PathList
windowStyle
windowHandle@
vbNullString
Caption
Module3d
Temp1LC0
Address
xlR1C1
CCount
Application
Temp2MC0
Columnsp90
RCount-80
Temp3NC0
NameFavV
ZipName1
ZipFolder
API_LENGTH
ThisWorkbook$
Sheets
DisplayAlerts
ActiveWorkbook
SaveAsf;0
FileFormat
FileCopyD
Namespace
CopyHerehe0
items`h0
No_Wakeup
Page11
Module4e
Module5f
Module6g
Workbook
UserFormN
C4C6D04AF0DBF1DBF124"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
Sem=100, 100, 852, 517, 
Page1=50, 50, 550, 467, 
Module1=175, 175, 927, 592, 
UserForm1=125, 125, 877, 542, , 25, 25, 1330, 598, 
Module2=150, 150, 902, 567, 
Module3=75, 75, 1380, 648, Z
UserForm3=0, 0, 0, 0, C, 50, 50, 1355, 623, 
Page11=75, 75, 575, 492, 
Module4=200, 200, 700, 617, 
Module5=0, 0, 500, 417, 
Module6=25, 25, 525, 442, 
Module1
UserForm1
Module2
Module3
UserForm3
Page11
Module4
Module5
Module6
Microsoft Forms 2.0 Form
Embedded Object
VERSION 5.00
Begin {C62A69F0-16DC-11CE-9E98-00AA00574A4F} UserF
Tahoma
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
}}u,rj
zx?\0yZg
d[M>IK
^!4O4f$
]yF{WK
O]9uI&
K]JM*F(Y
x^hvO'
mjcd(a
tI&]+[
<o~k[[vg
%+rog{o
   Caption         =   "Microsoft Office Components"
   ClientHeight    =   1680
   ClientLeft      =   45
   ClientTop       =   375
   ClientWidth     =   5550
   StartUpPosition =   1  'CenterOwner
   TypeInfoVer     =   2
Tahoma
TextBox1TEMP{
TextBox2APPDATA2{
Tahoma6
Tahoma6
Microsoft Forms 2.0 Form
Embedded Object
VERSION 5.00
Begin {C62A69F0-16DC-11CE-9E98-00AA00574A4F} UserForm3 
   Caption         =   "UserForm2"
   ClientHeight    =   3015
   ClientLeft      =   120
   ClientTop       =   465
   ClientWidth     =   4560
   StartUpPosition =   1  'CenterOwner
   TypeInfoVer     =   2
Microsoft Excel
Worksheets