Create Interactive Tour

Windows Analysis Report
MathType Commands 6 For Word 2016.dotm

Overview

General Information

Sample Name:	MathType Commands 6 For Word 2016.dotm
Analysis ID:	569457
MD5:	0a221e67f3fb93f04e41d25d8f608070
SHA1:	b0147383ce72c1e4b69bd9b5357b4a02935b2114
SHA256:	35ff22887b9aeee42b13dea38032a6923450b9b7443eb34693c5d97bb9411585
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with many string operations indicating source code obfuscation

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Document contains an embedded VBA which might only executes on specific systems (country or language check)

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 6896 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Joe Sandbox Signatures

• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• HIPS / PFW / Operating System Protection Evasion

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: winword.exe

Memory has grown: Private usage: 0MB later: 73MB

Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: vbaProjectSignature.bin, vbaProjectSignatureAgile.bin	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: vbaProjectSignature.bin, vbaProjectSignatureAgile.bin	String found in binary or memory: http://t2.symcb.com0
Source: vbaProjectSignature.bin, vbaProjectSignatureAgile.bin	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: vbaProjectSignature.bin, vbaProjectSignatureAgile.bin	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: vbaProjectSignature.bin, vbaProjectSignatureAgile.bin	String found in binary or memory: http://tl.symcd.com0&
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.office.net
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://augloop.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://cdn.entity.
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://cortana.ai
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://cr.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://directory.services.
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://edu-mathreco-prod.trafficmanager.net
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://edu-mathsolver-prod.trafficmanager.net
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://graph.windows.net
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://invites.office.com/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://login.windows.local
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://management.azure.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://management.azure.com/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://osi.office.net
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://outlook.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://roaming.edog.
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://tasks.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: vbaProjectSignature.bin, vbaProjectSignatureAgile.bin	String found in binary or memory: https://www.thawte.com/cps0/
Source: vbaProjectSignature.bin, vbaProjectSignatureAgile.bin	String found in binary or memory: https://www.thawte.com/repository0W

System Summary

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/Declarations' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/Declarations64' : found possibly 'ADODB.Stream' functions mode, position, open, write
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/Registry64' : found possibly 'ADODB.Stream' functions open, read, write
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UIEnableDisable' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UIHelpCls' : found possibly 'ADODB.Stream' functions mode, position, open
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UILib' : found possibly 'ADODB.Stream' functions open, read, write
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UIWrappersCls' : found possibly 'ADODB.Stream' functions mode, position, open, write
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/Declarations' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/Declarations64' : found possibly 'ADODB.Stream' functions mode, position, open, write
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/Registry64' : found possibly 'ADODB.Stream' functions open, read, write
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UIEnableDisable' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UIHelpCls' : found possibly 'ADODB.Stream' functions mode, position, open
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UILib' : found possibly 'ADODB.Stream' functions open, read, write
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UIWrappersCls' : found possibly 'ADODB.Stream' functions mode, position, open, write

Document contains an embedded VBA macro which may execute processes

Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function ShellExecute Lib "SHELL32.DLL" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Set cls = Application.Run("new_MTCommandsDispatchClass")
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function ShellExecute Lib "SHELL32.DLL" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Set cls = Application.Run("new_MTCommandsDispatchClass")

Document contains an embedded VBA macro with suspicious strings

Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' This error number is required because the CallByName
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' This error number is required because the CallByName
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Application.Quit
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function GlobalAlloc Lib "kernel32" (ByVal wFlags As Long, ByVal dwBytes As Long) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function GlobalFree Lib "kernel32" (ByVal hMem As Long) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function GlobalLock Lib "kernel32" (ByVal hMem As Long) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function GlobalSize Lib "kernel32" (ByVal hMem As Long) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function GlobalUnlock Lib "kernel32" (ByVal hMem As Long) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (lpvDest As Any, lpvSource As Any, ByVal cbCopy As Long)
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function lstrcpy Lib "kernel32" (ByVal lpString1 As Any, ByVal lpString2 As Any) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function GetEnvironmentVariable Lib "kernel32" Alias "GetEnvironmentVariableA" (ByVal lpName As String, ByVal lpBuffer As String, ByVal nSize As Long) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function GetEnvironmentVariable Lib "kernel32" Alias "GetEnvironmentVariableA" (ByVal lpName As String, ByVal lpBuffer As String, ByVal nSize As Long) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function GetLastError Lib "kernel32" () As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function GetLocaleInfo Lib "kernel32" Alias "GetLocaleInfoA" (ByVal Locale As Long, ByVal LCType As Long, ByVal lpLCData As String, ByVal cchData As Long) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function GetTickCount Lib "kernel32" () As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function SetEnvironmentVariable Lib "kernel32" Alias "SetEnvironmentVariableA" (ByVal lpName As String, ByVal lpValue As String) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function SetEnvironmentVariable Lib "kernel32" Alias "SetEnvironmentVariableA" (ByVal lpName As String, ByVal lpValue As String) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Function ShellExecute Lib "SHELL32.DLL" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Declare PtrSafe Sub MoveMemory Lib "kernel32" Alias "RtlMoveMemory" (dest As Any, ByVal Source As Long, ByVal length As Long)
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' get the path environment variable
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: result = GetEnvironmentVariable("Path", buf, 32767)
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: SetEnvironmentVariable "Path", buf
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' This error number is required because the CallByName
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' This error number is required because the CallByName
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: CallByName cls, command, VbMethod
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: CallByName cls, command, VbMethod ' this method is unavailable on the Mac
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' This error number is required because the CallByName
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' This error number is required because the CallByName
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' This error number is required because the CallByName
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' This error number is required because the CallByName
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' This error number is required because the CallByName
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' This error number is required because the CallByName
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' This error number is required because the CallByName
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' This error number is required because the CallByName
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Application.Quit
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function GlobalAlloc Lib "kernel32" (ByVal wFlags As Long, ByVal dwBytes As Long) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function GlobalFree Lib "kernel32" (ByVal hMem As Long) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function GlobalLock Lib "kernel32" (ByVal hMem As Long) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function GlobalSize Lib "kernel32" (ByVal hMem As Long) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function GlobalUnlock Lib "kernel32" (ByVal hMem As Long) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (lpvDest As Any, lpvSource As Any, ByVal cbCopy As Long)
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function lstrcpy Lib "kernel32" (ByVal lpString1 As Any, ByVal lpString2 As Any) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function GetEnvironmentVariable Lib "kernel32" Alias "GetEnvironmentVariableA" (ByVal lpName As String, ByVal lpBuffer As String, ByVal nSize As Long) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function GetEnvironmentVariable Lib "kernel32" Alias "GetEnvironmentVariableA" (ByVal lpName As String, ByVal lpBuffer As String, ByVal nSize As Long) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function GetLastError Lib "kernel32" () As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function GetLocaleInfo Lib "kernel32" Alias "GetLocaleInfoA" (ByVal Locale As Long, ByVal LCType As Long, ByVal lpLCData As String, ByVal cchData As Long) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function GetTickCount Lib "kernel32" () As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function SetEnvironmentVariable Lib "kernel32" Alias "SetEnvironmentVariableA" (ByVal lpName As String, ByVal lpValue As String) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function SetEnvironmentVariable Lib "kernel32" Alias "SetEnvironmentVariableA" (ByVal lpName As String, ByVal lpValue As String) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Function ShellExecute Lib "SHELL32.DLL" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Declare PtrSafe Sub MoveMemory Lib "kernel32" Alias "RtlMoveMemory" (dest As Any, ByVal Source As Long, ByVal length As Long)
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' get the path environment variable
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: result = GetEnvironmentVariable("Path", buf, 32767)
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: SetEnvironmentVariable "Path", buf
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' This error number is required because the CallByName
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' This error number is required because the CallByName
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: CallByName cls, command, VbMethod
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: CallByName cls, command, VbMethod ' this method is unavailable on the Mac
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' This error number is required because the CallByName
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' This error number is required because the CallByName
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' This error number is required because the CallByName
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' This error number is required because the CallByName
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' This error number is required because the CallByName
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' This error number is required because the CallByName

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/Declarations64' : found possibly 'WScript.Shell' functions environment, exec, environ
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/MTLibCommon' : found possibly 'WScript.Shell' functions environment, run, environ
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/Declarations64' : found possibly 'WScript.Shell' functions environment, exec, environ
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/MTLibCommon' : found possibly 'WScript.Shell' functions environment, run, environ

Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Attribute VB_Name = "AutoExec"
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: 'AutoExec 5.0
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: '$Header: /MathType/Windows/WordMacros/AutoExec.bas 56 10/17/11 11:13a Jimm $
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Private Const module As String = "AutoExec"
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Private Const moduleCLS As String = "AutoExecCls"
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Attribute VB_Name = "AutoExecCls"
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: 'AutoExecCls
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: '$Header: /MathType/Windows/WordMacros/AutoExecCls.cls 26 10/11/11 2:12p Jimm $
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Private Const module As String = "AutoExecCls"
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: WriteLog "AutoExecCls.NoDirectCall_Main success"
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: IsDocumentOpen = 512
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Private Sub App_DocumentOpen(ByVal Doc As Document)
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: RunDocCallback moduleCLS, "NoDirectCall_App_DocumentOpen"
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Private Sub App_DocumentChange()
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: RunDocCallback moduleCLS, "NoDirectCall_App_DocumentChange"
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' For example, the States.IsDocumentOpen enumeration value is used as a key,
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: UpdateCollection currentStatesCollection, States.IsDocumentOpen, temp
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' DocumentChange event to fire. Consequently, it is important that the
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' App_DocumentChange event handler be fast, and that it does not indirectly
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' We handle IsFunctionalityOK and IsDocumentOpen as special cases
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: If buttonStates(id) And States.IsDocumentOpen Then
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: If currentStatesCollection(CStr(States.IsDocumentOpen)) = False Then
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: GetDisabledString = superTipDisabledCollection(CStr(States.IsDocumentOpen))
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: DocumentStates.Add States.IsDocumentOpen
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: currentStatesCollection.Add False, CStr(States.IsDocumentOpen)
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: previousStatesCollection.Add False, CStr(States.IsDocumentOpen)
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: superTipDisabledCollection.Add GetUserString("!3001a document is not open"), CStr(States.IsDocumentOpen)
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: state = States.IsDocumentOpen
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: state = States.IsDocumentOpen Or States.Word97SelectionInCommentPane Or States.Word97SelectionInHeaderFooter Or States.Word97SelectionInFootnoteEndnotePane Or States.SelectionInTextBox
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: state = States.IsDocumentOpen
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' state = States.IsDocumentOpen Or States.MathPageOK Or States.IsFunctionalityOK
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Case "AutoExecCls"
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Set cls = New AutoExecCls
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Sub NoDirectCall_App_DocumentChange()
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: ' the versions of Word we still support. Further, our AutoExec code
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: WriteLog "NoDirectCall_App_DocumentChange error"
Source: MathType Commands 6 For Word 2016.dotm	OLE, VBA macro line: Public Sub NoDirectCall_App_DocumentOpen()
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Attribute VB_Name = "AutoExec"
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: 'AutoExec 5.0
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: '$Header: /MathType/Windows/WordMacros/AutoExec.bas 56 10/17/11 11:13a Jimm $
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Private Const module As String = "AutoExec"
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Private Const moduleCLS As String = "AutoExecCls"
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Attribute VB_Name = "AutoExecCls"
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: 'AutoExecCls
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: '$Header: /MathType/Windows/WordMacros/AutoExecCls.cls 26 10/11/11 2:12p Jimm $
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Private Const module As String = "AutoExecCls"
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: WriteLog "AutoExecCls.NoDirectCall_Main success"
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: IsDocumentOpen = 512
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Private Sub App_DocumentOpen(ByVal Doc As Document)
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: RunDocCallback moduleCLS, "NoDirectCall_App_DocumentOpen"
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Private Sub App_DocumentChange()
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: RunDocCallback moduleCLS, "NoDirectCall_App_DocumentChange"
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' For example, the States.IsDocumentOpen enumeration value is used as a key,
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: UpdateCollection currentStatesCollection, States.IsDocumentOpen, temp
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' DocumentChange event to fire. Consequently, it is important that the
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' App_DocumentChange event handler be fast, and that it does not indirectly
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' We handle IsFunctionalityOK and IsDocumentOpen as special cases
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: If buttonStates(id) And States.IsDocumentOpen Then
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: If currentStatesCollection(CStr(States.IsDocumentOpen)) = False Then
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: GetDisabledString = superTipDisabledCollection(CStr(States.IsDocumentOpen))
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: DocumentStates.Add States.IsDocumentOpen
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: currentStatesCollection.Add False, CStr(States.IsDocumentOpen)
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: previousStatesCollection.Add False, CStr(States.IsDocumentOpen)
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: superTipDisabledCollection.Add GetUserString("!3001a document is not open"), CStr(States.IsDocumentOpen)
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: state = States.IsDocumentOpen
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: state = States.IsDocumentOpen Or States.Word97SelectionInCommentPane Or States.Word97SelectionInHeaderFooter Or States.Word97SelectionInFootnoteEndnotePane Or States.SelectionInTextBox
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: state = States.IsDocumentOpen
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' state = States.IsDocumentOpen Or States.MathPageOK Or States.IsFunctionalityOK
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Case "AutoExecCls"
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Set cls = New AutoExecCls
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Sub NoDirectCall_App_DocumentChange()
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: ' the versions of Word we still support. Further, our AutoExec code
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: WriteLog "NoDirectCall_App_DocumentChange error"
Source: ~DF261296C872412495.TMP.0.dr	OLE, VBA macro line: Public Sub NoDirectCall_App_DocumentOpen()

Source: MathType Commands 6 For Word 2016.dotm	OLE indicator, VBA macros: true
Source: ~DF261296C872412495.TMP.0.dr	OLE indicator, VBA macros: true

Source: ~WRF{8C259D24-9E0A-43A2-BE9A-DB48617F29ED}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DF261296C872412495.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DF86B2F80858D4E010.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: WINWORD.box.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: ~DF261296C872412495.TMP.0.dr, ~WRF{8C259D24-9E0A-43A2-BE9A-DB48617F29ED}.tmp.0.dr, vbaProject.bin	Binary or memory string: .VBProject is unavailable on the Mac
Source: ~DF261296C872412495.TMP.0.dr, ~WRF{8C259D24-9E0A-43A2-BE9A-DB48617F29ED}.tmp.0.dr, vbaProject.bin	Binary or memory string: 32"t '.VBProject is unavailable o
Source: ~DF261296C872412495.TMP.0.dr, ~WRF{8C259D24-9E0A-43A2-BE9A-DB48617F29ED}.tmp.0.dr, vbaProject.bin	Binary or memory string: $.VBProject is unavailable on the Mac

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{BF47B5B4-A4B8-485C-9CD6-AB4E56E5D0A8} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal64.expl.evad.winDOTM@1/17@0/0

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/Asserts' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/AutoExec' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/AutoExecCls' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/CallbackGuard' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/CommandGuard' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/Declarations' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/Declarations64' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/MTLibCommon' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/MTW5' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/Preferences' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/Registry' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/Registry64' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UIEnableDisable' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UIEnableDisable2010' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UIHelp' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UIHelpCls' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UILib' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UILibCls' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UIRibbon' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UIRibbonCls' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UIWrappers' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UIWrappers2007' : VBA code
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UIWrappersCls' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/Asserts' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/AutoExec' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/AutoExecCls' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/CallbackGuard' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/CommandGuard' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/Declarations' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/Declarations64' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/MTLibCommon' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/MTW5' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/Preferences' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/Registry' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/Registry64' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UIEnableDisable' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UIEnableDisable2010' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UIHelp' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UIHelpCls' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UILib' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UILibCls' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UIRibbon' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UIRibbonCls' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UIWrappers' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UIWrappers2007' : VBA code
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UIWrappersCls' : VBA code

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: MathType Commands 6 For Word 2016.dotm

Initial sample: OLE zip file path = docProps/custom.xml

Source: MathType Commands 6 For Word 2016.dotm

Initial sample: OLE summary template = wordui2013x64.dotm

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: ~WRF{8C259D24-9E0A-43A2-BE9A-DB48617F29ED}.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

Document contains an embedded VBA with many string operations indicating source code obfuscation

Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/UILib' : High number of string operations
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/UILib' : High number of string operations

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/Declarations64' : Function GetLocaleInfo Lib "kernel32" Alias "GetLocaleInfoA
Source: MathType Commands 6 For Word 2016.dotm	Stream path 'VBA/Declarations64' : ng, ByVal languageID As Long) As LongPublic Declare PtrSafe
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/Declarations64' : Function GetLocaleInfo Lib "kernel32" Alias "GetLocaleInfoA
Source: ~DF261296C872412495.TMP.0.dr	Stream path 'VBA/Declarations64' : ng, ByVal languageID As Long) As LongPublic Declare PtrSafe

HIPS / PFW / Operating System Protection Evasion

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Source: MathType Commands 6 For Word 2016.dotm	OLE indicator, VBA stomping: true
Source: ~DF261296C872412495.TMP.0.dr	OLE indicator, VBA stomping: true

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	52 Scripting	Path Interception	1 Extra Window Memory Injection	1 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	52 Scripting	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
MathType Commands 6 For Word 2016.dotm	3%	Metadefender		Browse
MathType Commands 6 For Word 2016.dotm	0%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://roaming.edog.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://ncus.pagecontentsync.	0%	URL Reputation	safe
https://skyapi.live.net/Activity/	0%	URL Reputation	safe
https://dataservice.o365filtering.com	0%	URL Reputation	safe
https://api.cortana.ai	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://login.microsoftonline.com/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://shell.suite.office.com:1443	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://autodiscover-s.outlook.com/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://roaming.edog.	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://cdn.entity.	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://powerlift.acompli.net	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://cortana.ai	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://entitlement.diagnosticssdf.office.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://api.aadrm.com/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://api.microsoftstream.com/api/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://cr.office.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	Avira URL Cloud: safe	low
https://portal.office.com/account/?ref=ClientMeControl	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://graph.ppe.windows.net	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://officeci.azurewebsites.net/api/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://store.office.cn/addinstemplate	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://globaldisco.crm.dynamics.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://dev0-api.acompli.net/autodetect	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://api.powerbi.com/v1.0/myorg/groups	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://web.microsoftstream.com/video/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://dataservice.o365filtering.com/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://ncus.contentsync.	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
http://weather.service.msn.com/data.aspx	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://apis.live.net/v5.0/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://management.azure.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://outlook.office365.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://wus2.contentsync.	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://clients.config.office.net/user/v1.0/ios	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://insertmedia.bing.office.net/odc/insertmedia	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://api.office.net	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://incidents.diagnosticssdf.office.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://asgsmsproxyapi.azurewebsites.net/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://entitlement.diagnostics.office.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://substrate.office.com/search/api/v2/init	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://outlook.office.com/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://outlook.office365.com/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://webshell.suite.office.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://management.azure.com/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://login.windows.net/common/oauth2/authorize	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://api.powerbi.com/beta/myorg/imports	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://devnull.onenote.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://ncus.pagecontentsync.	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://messaging.office.com/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://augloop.office.com/v2	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://skyapi.live.net/Activity/	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/mac	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high
https://dataservice.o365filtering.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://api.cortana.ai	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com	28779A37-AFF8-4DF3-9AEE-F5056C51577D.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	569457
Start date:	09.02.2022
Start time:	16:31:22
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	MathType Commands 6 For Word 2016.dotm
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.expl.evad.winDOTM@1/17@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dotm Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.35.237.194, 184.30.21.144, 52.109.76.68, 52.109.8.22, 52.109.88.38
Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, client.wns.windows.com, prod-w.nexus.live.com.akadns.net, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, config.officeapps.live.com, nexus.officeapps.live.com, displaycatalog.mp.microsoft.com, e16646.dscg.akamaiedge.net, officeclient.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, europe.configsvc1.live.com.akadns.net, storeedgefd.dsx.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: MathType Commands 6 For Word 2016.dotm

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\28779A37-AFF8-4DF3-9AEE-F5056C51577D

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	143202
Entropy (8bit):	5.358520063023081
Encrypted:	false
SSDEEP:	1536:wcQIfgxrBdA3guw0/Q9DQW+zUk4F77nXmvidZXQE5LWm69:cIQ9DQW+zwXFe
MD5:	31B0F8F4FB4DD11B1EEEA523727EBCAF
SHA1:	C2EDAFF395ADB2986923C4CAE01E20C656A05925
SHA-256:	95757F5E4999EE9F3B982CA80A9FE409CB0FAA00D680FBE7C61108DB8664E25E
SHA-512:	BB5EEA54F189D85E5AC44558D4F54E725BAA1888916DEB306CBFB3BF792FBF85CF8E694CDCCBC47CA7A8D6C74726B43E038B8F6CD4B1D051644A643CA938D648
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2022-02-09T15:32:20">.. Build: 16.0.14930.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{8C259D24-9E0A-43A2-BE9A-DB48617F29ED}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	1550336
Entropy (8bit):	4.732141834723918
Encrypted:	false
SSDEEP:	24576:W3GMF0i/9NgvfTAjuRGMx07w9FpvPTAU:W3GMF0i/9WAaRGMx07w97A
MD5:	D7922777FB7EA41009F044EB1B110169
SHA1:	B572972D088B7825812626DF5D3DF00F348DFF39
SHA-256:	4B9F0118C7362AE1126482DFEEEAC92386B69DE2E3BA9BFEAEBCCB39180ADFDF
SHA-512:	93F474B89D3986D33839E8E585870422D3DADFD1762B241CC2410628B7EDBF6019D699FDE0F558291C11912DC5979A14D2AF33EFDF2492987B7FDBAFFF79014A
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................t.......Z.......\|...............r.......}.......~...............d.......t.......Z...............................................................................................................................................................................................................................................................................................................................................................n...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{94EA859A-E9F8-4782-9053-D15570117EA8}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	3756
Entropy (8bit):	2.873796485803567
Encrypted:	false
SSDEEP:	48:pALKANCaQVnMDWr+Jdcsp65PMxMehVU5wgMgSM+sBJrDO9hX:cN/QVnMqr+wS65PMxMx5VMgSM+aUX
MD5:	5C8FBD301900CA81EBF10CAD61F89F1D
SHA1:	FC0DF88B99CDB62B09FA73A770C1C5A3D0913BC9
SHA-256:	74C80D79D216E64ECA7FDB3F895FF027B96934EC8ED87E57D1007EE70943A416
SHA-512:	B85895E8DABCB539308D69E44826A37F7F0CA6DF8F0C097B917E86698373F0ACB626027945DAD2D8008D51D7B78929352A86EDA9C3565B6452388F78FED89442
Malicious:	false
Reputation:	low
Preview:	..M.a.t.h.T.y.p.e.. s. .C.o.m.m.a.n.d.s. .f.o.r. .M.i.c.r.o.s.o.f.t. .W.o.r.d. ..... .C.o.p.y.r.i.g.h.t. .2.0.1.3. .b.y. .D.e.s.i.g.n. .S.c.i.e.n.c.e.,. .I.n.c... .A.l.l. .R.i.g.h.t.s. .R.e.s.e.r.v.e.d...............................................................................................................................................................................................................................................................................................................................R...........8.............................................................................................................................................................................................................................................................................................................................................................................................................................................gdF.C..................h...(#.........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E14C8716-568E-4382-A8F5-7B59BED598FE}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	152056
Entropy (8bit):	4.414454763453576
Encrypted:	false
SSDEEP:	1536:fmmALzolWWpFpKKHAeedydju4HTbTuo+o5aQxJudUl9yhQL3ow:fWg8WpFpKKHHedydFeo+oQLUlPow
MD5:	0C9528C3981A18B0D8406CE0280C530C
SHA1:	BA36DA18E99B612BD641A0C4D8C06649953F13F2
SHA-256:	0237C71364A68E10C2885945B2C12E909623F60BE0D58C84B2237B46F46A1632
SHA-512:	42AA0A20BA68D51D5C5FFA397A3461B00A9BA73DB358297A7E977CED0AA24383954FBB89333180AD205293110D3009466829747B4E74E533CF9F7F3A2102AFB4
Malicious:	false
Reputation:	low
Preview:	MSFT................Q................................$......$....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*..\+...+..$,...,...,..P-...-......\|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8...8...9..l9...9..4:...:...:..`;...;..(<...<...<..T=...=...>...>...>..H?...?...@..t@...@..<A...A...B..hB.......B...........^...............g...............W...............F..............<G...............g...............i...I..............T..................................................................................................

C:\Users\user\AppData\Local\Temp\~DF261296C872412495.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	775680
Entropy (8bit):	4.766072139022877
Encrypted:	false
SSDEEP:	6144:qbzbChlYGT7KiLQJCGGMo0dpCG93i669hDpOvHTbu6IakLczwFnmrG:Zv5bGGMo0d8G99692vHTbuj9
MD5:	16C9C877C4BA4AFED8B1571A2585389C
SHA1:	3C45D8E6CE6312250A3D2E5867D609010FDCAE6F
SHA-256:	B709E0DF1A68A6765057E0A889A1DA39EDE7B45E35BF6012B8E7AB9B7B50D646
SHA-512:	E67D4398EAEC84E2B44E4C042EB74859F2D9419B661E0EAD24302D2B75FDCB54C2A16B56B30A81E8F73B933956BBEE33B0CB3A2941981B283F2AB745DB5DF3BF
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................t.......Z.......\|...............r...............................................................................................................................................................................................................................................................................................................................................................................................................n................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\~DF6FFD328AA4FD46DC.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF86B2F80858D4E010.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.1464700112623651
Encrypted:	false
SSDEEP:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
MD5:	72F5C05B7EA8DD6059BF59F50B22DF33
SHA1:	D5AF52E129E15E3A34772806F6C5FBF132E7408E
SHA-256:	1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
SHA-512:	6FF1E2E6B99BD0A4ED7CA8A9E943551BCD73A0BEFCACE6F1B1106E88595C0846C9BB76CA99A33266FFEC2440CF6A440090F803ABBF28B208A6C7BC6310BEB39E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE2EC4E5DC0D7925B.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFFCF043BC40DA11AD.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	0.1867548469616489
Encrypted:	false
SSDEEP:	48:2tytj7D22D7VRFeRLUMS8VfXAU05MAA1lQ/f8EfrCfeaf:2ol22D7DFeRLUGVQnYuf3frCfeaf
MD5:	8804CDC55B10BE6D566D5F0567717384
SHA1:	4070A05BA2358380C669F08588C5A62982D5A577
SHA-256:	FD3C9A50BA83761FB3B87D857A9C17108D23451AAAD5DD95DC0DEF341AB19347
SHA-512:	BB5329E3B0875917F322E9A86EB66D6650A0B9F6927719A2D322A2FBA97F6F03B3417715F09AC90131BD06D2C7AC5748111E7BB36F2E47D6B6092D5873528109
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Forms\WINWORD.box

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	2.4425284755608523
Encrypted:	false
SSDEEP:	48:rINwTIfOt4hfcJjK1tTbfcdd7D/f8sD7VRFeRLUMS8VfXAU05MAA1lQ:vTIfOyhf4+1bfcr/f/D7DFeRLUGVQnY
MD5:	9F0A77981A1A28CA8C085D673D10E5C2
SHA1:	B8C3D57157CAF552CC780563901F72AF003C79C1
SHA-256:	7051428877545DA6759BDCF3B9CD8375C0588E0920521436FE6F42AB309E70BA
SHA-512:	73B1810DC48932355091F84B4EC69642A288F3871F2E5FF7EF44659D3430A1259CFB2518D444CD5CB4504F2F54290E07D6701E41A9987F8C9F7130444FA5387A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO0127.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	13202
Entropy (8bit):	3.7191629974167104
Encrypted:	false
SSDEEP:	192:82f4eFOrtUF5AaTMuSsef4bSRZDtGWx8KLoBMeCTFbJ5/g49:87F2F5AaA0eAOR7XLocVI49
MD5:	4B482EBD212A51EC29056CA71B2CF70A
SHA1:	3EA71FEE58F8DF346830D68335988033FC14C114
SHA-256:	1B2D720C5951FA23B26605575DAC879BE26D4F782817F39874E99404869FD5CA
SHA-512:	D1A14CAC7676CB49CDBCA3175C8787DE7D8C4B4B7AE952DB7F1406A54757869E2EC5E96498444948A5EC601154A3CCE95827F12FEF5197D6BC5AFBB462C4DCB9
Malicious:	false
Preview:	.... ...3......:.....!.!.....< ....+.-...........-.+......"....-.>......!..............& ....:.:.....7"....:.=.....T"....<.<.....j"....<.=.....d"....>.=.....e"....>.>.....k"....\.A.l.p.h.a...........\.B.a.r.....?.....\.B.e.t.a...........\.C.h.i...........\.D.d.....E!....\.D.e.l.t.a...........\.D.e.l.t.a.e.q.....\"....\.D.o.w.n.a.r.r.o.w......!....\.E.p.s.i.l.o.n...........\.E.t.a...........\.G...........\.G.a.m.m.a...........\.I.m......!....\.I.o.t.a...........\.K.a.p.p.a...........\.L.a.m.b.d.a...........\.L.e.f.t.a.r.r.o.w......!....\.L.e.f.t.r.i.g.h.t.a.r.r.o.w......!....\.L.o.n.g.l.e.f.t.a.r.r.o.w......'....\.L.o.n.g.l.e.f.t.r.i.g.h.t.a.r.r.o.w......'....\.L.o.n.g.r.i.g.h.t.a.r.r.o.w......'....\.M.u...........\.N.u...........\.O...........\.O.m.e.g.a...........\.P.h.i...........\.P.i...........\.P.s.i...........\.R.a.n.g.l.e......'....\.R.b.r.a.c.k......'....\.R.e......!....\.R.h.o...........\.R.i.g.h.t.a.r.r.o.w......!....\.S.i.g.m.a...........\.T.a.u...........\.T.h.e.t.a.......

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\MathType Commands 6 For Word 2016.dotm.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Sep 23 14:11:36 2021, mtime=Wed Feb 9 23:32:21 2022, atime=Wed Feb 9 23:32:17 2022, length=343091, window=hide
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	4.668041787872907
Encrypted:	false
SSDEEP:	12:8cf1oRUvuElPCH2B5lMYYjt+Wy7UOHIO1uFGR8UjAyN/SbFcx+wHIO1uFGR1DaKF:8cZ5qSHlQ8AyNvIwHlQODTbAX7aB6m
MD5:	80D5645F996073E7D3F78EEEB6384FB1
SHA1:	9ED0BDEDFB325BED44578BCAFCE3BC0F76165E15
SHA-256:	44BCD402FD4887F68BBB7F95D612521CF9845E83023F75C25A7700069889D4BB
SHA-512:	8F1EAF2A58D83364F36EB46AE71B1757D2E98376BDF4BFBA12A2984190050AB3662DB9873A7363384782C51D0C398C10D133D471DA25E374E97AA3DAF2C915AA
Malicious:	true
Preview:	L..................F.... ..._.M.............(5.....3<...........................P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L..JT......................:.....q\|..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....7Sty..user.<.......Ny.JT.......S....................+..h.a.r.d.z.....~.1.....7Sxy..Desktop.h.......Ny.JT.......Y..............>.........D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2.3<..JT.. .MATHTY~1.DOT..~......7SsyJT......h.....................7lp.M.a.t.h.T.y.p.e. .C.o.m.m.a.n.d.s. .6. .F.o.r. .W.o.r.d. .2.0.1.6...d.o.t.m.......l...............-.......k...........>.S......C:\Users\user\Desktop\MathType Commands 6 For Word 2016.dotm..=.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.M.a.t.h.T.y.p.e. .C.o.m.m.a.n.d.s. .6. .F.o.r. .W.o.r.d. .2.0.1.6...d.o.t.m.........:..,.LB.)...As...`.......X.......536720...........!a..%.H.VZAj...I..M..........-..!a..%.H.VZAj...I..M..........-.............1SPS.XF.L8C....&.m.q......

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.887373596100238
Encrypted:	false
SSDEEP:	3:bDuMJlwEDFmTrWFTeBFFKNUYCmxWj4VFmTrWFTeBFFKNUYCv:bCcc+peFFK2Y+Yc+peFFK2Ys
MD5:	B45177F0CF298E485AC151A167739728
SHA1:	8535D36ED0EB38B50E040BAC42EC9BDDF7B16BAC
SHA-256:	DA5A484ECD9049608E573EFC39C520430672F60A8F48FADE82525106E91BDBC9
SHA-512:	6E5387F5C3C569E4A151D243EEB36AF5BFFAD0BA344A893425EB0CDCF39F192B24AADFEBFC167712A46FDB095013FC5DBA6046D81946D70E534EBE0A35082DCE
Malicious:	false
Preview:	[folders]..Templates.LNK=0..MathType Commands 6 For Word 2016.dotm.LNK=0..[misc]..MathType Commands 6 For Word 2016.dotm.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.253621536073301
Encrypted:	false
SSDEEP:	3:Rl/ZdVTAlflqKIllFlqKMSpt5:RtZXkQmCD5
MD5:	8345FFCDD5626934FDFAA038E0ECA3D8
SHA1:	26E7AA559FA371A713CCFAF59C6BC83BD5627F5B
SHA-256:	2CF1FD7F4D05B360AA31C8992EB70CDD89742C9714A1C0BABF09F448C3173D7E
SHA-512:	55F9C53A106C6D3C72E356B791F5B592B127B5FD25C3DB12A102967AD7D1DD9BF119093B47E64E13BE4BBF063A33FB4F725CD22AF9599BA7D0B2D7BCA7F76AD8
Malicious:	false
Preview:	.pratesh................................................p.r.a.t.e.s.h..........2>..%..........H.......6C.......2:..&..........$.......6C.......2...'..........$...

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	Little-endian UTF-16 Unicode text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\Desktop\~$thType Commands 6 For Word 2016.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.253621536073301
Encrypted:	false
SSDEEP:	3:Rl/ZdVTAlflqKIllFlqKMSpt5:RtZXkQmCD5
MD5:	8345FFCDD5626934FDFAA038E0ECA3D8
SHA1:	26E7AA559FA371A713CCFAF59C6BC83BD5627F5B
SHA-256:	2CF1FD7F4D05B360AA31C8992EB70CDD89742C9714A1C0BABF09F448C3173D7E
SHA-512:	55F9C53A106C6D3C72E356B791F5B592B127B5FD25C3DB12A102967AD7D1DD9BF119093B47E64E13BE4BBF063A33FB4F725CD22AF9599BA7D0B2D7BCA7F76AD8
Malicious:	false
Preview:	.pratesh................................................p.r.a.t.e.s.h..........2>..%..........H.......6C.......2:..&..........$.......6C.......2...'..........$...

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.971579413857639
TrID:	Word Microsoft Office Open XML Format document with Macro (52004/1) 33.99% Word Microsoft Office Open XML Format document (49504/1) 32.35% Word Microsoft Office Open XML Format document (43504/1) 28.43% ZIP compressed archive (8000/1) 5.23%
File name:	MathType Commands 6 For Word 2016.dotm
File size:	343091
MD5:	0a221e67f3fb93f04e41d25d8f608070
SHA1:	b0147383ce72c1e4b69bd9b5357b4a02935b2114
SHA256:	35ff22887b9aeee42b13dea38032a6923450b9b7443eb34693c5d97bb9411585
SHA512:	73e752bc66695586d29d7bd69b255d1227a3436f0c9a9879cae2f9ffddb9468ed6e887bec2d524390b1821a2e59c4e07576ab08190f7687f4ec27610b40714bd
SSDEEP:	6144:WM/UwilRO+2KDjFQZqoRTuoBAOAfEKZtyAFkEliexWJeofMDnFf29m8:WM/UwrpKFQZqiThBf4yAFMeieofMDFfs
File Content Preview:	PK..........!.,"......O.......[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon


Icon Hash:	d4dcd0d2f6929088

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "/opt/package/joesandbox/database/analysis/569457/sample/MathType Commands 6 For Word 2016.dotm"

Indicators

Has Summary Info:	False
Application Name:	unknown
Encrypted Document:	False
Contains Word Document Stream:
Contains Workbook/Book Stream:
Contains PowerPoint Document Stream:
Contains Visio Document Stream:
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Summary

Title:	MathType Commands 6 for Word
Subject:
Author:
Keywords:
Template:	wordui2013x64.dotm
Last Saved By:	Harry Arora
Revion Number:	4
Total Edit Time:	1
Create Time:	2015-12-03T23:05:00Z
Last Saved Time:	2018-01-09T00:11:00Z
Number of Pages:	1
Number of Words:	181
Number of Characters:	1032
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	8
Number of Paragraphs:	2
Thumbnail Scaling Desired:	false
Company:	Design Science
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	16.0000

Streams with VBA

VBA File Name: AssertDlg.frm, Stream Size: 2431

General
Stream Path:	VBA/AssertDlg
VBA File Name:	AssertDlg.frm
Stream Size:	2431
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 . . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I T . R # . u M . n ( . z T K S . . . . K . . A . h . . . t . . y . . . S . . E . ' ` i a . I . . . . . 6 . . y . . . G . f . . Y h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . 6 . . y . . . G . f . . Y h . . I T . R # . u M . n ( . z T K S . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 00 01 00 00 8e 06 00 00 e4 00 00 00 84 02 00 00 bd 06 00 00 ef 06 00 00 37 08 00 00 00 00 00 00 01 00 00 00 1d 6f e2 f7 00 00 ff ff 01 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 88 00 ff ff 00 00 49 54 8d 52 23 87 75 4d bd 6e 28 a9 7a 54 4b 53 b8 b3 e8 85 4b da 0f 41 93 68 e7 11 aa 74 88 e0 79 ef 99 fe 53 f8 14 45 86 27 60 69 61

VBA Code

Attribute VB_Name = "AssertDlg"
Attribute VB_Base = "0{DD923F7A-3302-44F5-BF5F-2A1434A36625}{2746DF1E-ACBC-4313-B2BA-B34EB508D4D3}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Private Sub CommandButtonBreak_Click()
    Me.tag = "Break"
    Me.Hide
End Sub

Private Sub CommandButtonIgnore_Click()
    Me.tag = "Ignore"
    Me.Hide
End Sub

VBA File Name: Asserts.bas, Stream Size: 8499

General
Stream Path:	VBA/Asserts
VBA File Name:	Asserts.bas
Stream Size:	8499
Data ASCII:	. . . . . . . . . " . . . . . . . ( . . . . . . . 2 . . . . . . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . h . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 22 0c 00 00 d4 00 00 00 28 02 00 00 ff ff ff ff 32 0e 00 00 a2 1a 00 00 00 00 00 00 01 00 00 00 1d 6f a2 a4 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Asserts"
'Asserts
'=====================================================================
' (c) Copyright 1992-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/Asserts.bas 11    10/17/11 11:13a Jimm $
'=====================================================================

' This is our private exception which starts at the lowest recommended user defined error number
Public Const DSI_ABORT_EXCEPTION As Long = vbObjectError + 512 + 1

' Used by CallbackGuard and CommandGuard classes... do not edit this value from
' outside of these classes
Public macroExecuting As Boolean
Public gVerboseLogging As Boolean
Private Const doAsserts = False

Public Sub WriteLog(msg As String)

    If gVerboseLogging = False Then
        Exit Sub
    End If

    On Error GoTo bye
    Dim folder As String
    Dim fileNum As Integer
    fileNum = 0
    Dim logFileName As String
    logFileName = "MT_VBA_Asserts.log"
    Dim logFilePath As String
    
    #If Win32 Then
        Dim fso As Object
        Set fso = CreateObject("Scripting.FileSystemObject")
    folder = fso.GetSpecialFolder(2)
        folder = folder & "\"
    #Else
        'Application.PathSeparator is undefined in Office 2011
        #If Word Then
        folder = Application.path & ":"
        #Else
        folder = GetMathTypeDir & ":"
        #End If
    #End If

    logFilePath = folder & logFileName
    fileNum = FileSystem.FreeFile
    If fileNum <> 0 Then
        Open logFilePath For Append Access Write Shared As #fileNum
        Print #fileNum, Now & ": "; msg
    End If
bye:
    If fileNum <> 0 Then
        Close #fileNum
    End If
End Sub

Public Sub AssertFailure(module As String, method As String, msg As String)
    WriteLog msg 'Log the error to a file in the user temp directory
    If doAsserts = True Then
         Dim dlg As AssertDlg
         Set dlg = New AssertDlg
         #If Mac And PP Then
         dlg.Message.Caption = ReplaceSubstring(dlg.Message.Caption, "x", module & "." & method & " " & msg)
         #Else
         dlg.Message.Caption = replace(dlg.Message.Caption, "x", module & "." & method & " " & msg)
         #End If
         
         dlg.Show
         
         If dlg.tag = "Ignore" Then
             Exit Sub
         ElseIf dlg.tag = "Break" Then
             Stop
             err.Raise DSI_ABORT_EXCEPTION
         End If
     Else
        MsgBox "MathType has detected an error in" & module & "." & method & ": " & msg & ". Please save your " &                "document and report this error to Design Science Technical Support."
        err.Raise DSI_ABORT_EXCEPTION
     End If
End Sub

Public Sub Assert(b As Boolean, module As String, method As String, msg As String)
    If b = False Then
        AssertFailure module, method, msg
    End If
End Sub

Public Sub LogAndAlert(module As String, method As String, msg As String)
    On Error GoTo done
    'Increment a version check variable counter.
    MTIncrementStatisticBy "OffAst", 1
    AssertFailure module, method, msg
done:
End Sub

VBA File Name: AutoExec.bas, Stream Size: 2725

General
Stream Path:	VBA/AutoExec
VBA File Name:	AutoExec.bas
Stream Size:	2725
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . m . . . . . . . . . . . . . . . . o 7 } . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 ca 04 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 6d 05 00 00 c9 08 00 00 00 00 00 00 01 00 00 00 1d 6f 37 7d 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "AutoExec"
'AutoExec 5.0
'=====================================================================
' (c) Copyright 1992-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/AutoExec.bas 56    10/17/11 11:13a Jimm $
'=====================================================================
Option Explicit

Public MTApp As New MTW5

Private Const module As String = "AutoExec"
Private Const moduleCLS As String = "AutoExecCls"

' This should start with MTCommand_ but it can not since Word expects this name
Public Sub Main()
    macroExecuting = False
    RunMTDLLCommand moduleCLS, "NoDirectCall_Main"
End Sub

VBA File Name: AutoExecCls.cls, Stream Size: 25638

General
Stream Path:	VBA/AutoExecCls
VBA File Name:	AutoExecCls.cls
Stream Size:	25638
Data ASCII:	. . . . . . . . . . . . . . . . . ( . . . . . . . . . . . . L . . . . . . . . . . . o . j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v . . . ? . N . . . . . . . . * = . . . . h . . 8 . . + 3 q . . . . . . . . . . . . . . . . . . . . . . . . . 3 $ & I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . 3 $ & I . . . . . . . . . v . . . ? . N . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 00 01 00 00 c2 15 00 00 e4 00 00 00 28 03 00 00 aa 18 00 00 b8 18 00 00 b8 4c 00 00 00 00 00 00 01 00 00 00 1d 6f d5 6a 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 80 00 ff ff 00 00 fe 76 f0 07 ec 3f 90 4e 88 fb d0 da b0 11 fe 8d 2a 3d fb fc fa a0 68 10 a7 38 08 00 2b 33 71 b5 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "AutoExecCls"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
'AutoExecCls
'=====================================================================
' (c) Copyright 1992-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/AutoExecCls.cls 26    10/11/11 2:12p Jimm $
'=====================================================================
Option Explicit

' Note: * all functions/subs that start with MTCommand_ are "top-level" entry points called from
'         OnAction handlers (e.g. buttons, menu items, etc).
'       * all functions/subs that start with MTCallback_ are are called by
'         Word 2007 as needed to refresh the Ribbon UI
'       * all functions/subs that start with NoDirectCall_
'          MUST NOT BE CALLED except via a RunXXX command

' module name
Private Const module As String = "AutoExecCls"

Private m_lError As Long
Private m_sError As String

' Expose the error description
' This error number is required because the CallByName
' function does not return the correct error
Public Property Get ErrorDescription() As String
    ErrorDescription = m_sError
End Property

' Expose the error number
' This error number is required because the CallByName
' function does not return the correct error
Public Property Get ErrorNumber() As Long
    ErrorNumber = m_lError
End Property

Public Sub NoDirectCall_Main()

    'If an error occurs in the logging initialization code, default to non-verbose logging
    On Error Resume Next

    Dim regValue As String
    regValue = GetPreference(HKEY_CURRENT_USER, mtreg_MT_WORDCMDS_LOCATION, mtreg_MT_VERBOSE_LOGGING_KEY)
    Select Case regValue
    Case "1"
        gVerboseLogging = True
    Case "0"
        gVerboseLogging = False
    Case Else
        gVerboseLogging = False
    End Select

    WriteLog "Word logging enabled"

    ' Replace logging init error handler with main error handler
    On Error GoTo fail


    WriteLog "Storing Application in MTApp"
    Set MTApp.App = Application

     'unload any MTW4 macros
    WriteLog "About to check MT4 macros"
    UnloadMT4Macros

    'check for MTW3 macros in the Normal template
    WriteLog "About to check for MTW3 macros in Normal template"
    If UILib.RemoveMT3Macros(NormalTemplate) Then
        WriteLog "Found MT3 macros"

        MsgBox UILib.GetUserString("!0201MathType has found and removed an old version of the MathType Commands for Word. The new commands will be available the next time you run Word. Word will now Exit."),             vbInformation, UILib.GetUserString("!0200MathType Commands")

        'make sure no MTW3 menu items remain...
        RemoveOldMenuItems

        WriteLog "removed MT3 macros - quitting"

        Application.Quit
    End If

    'initialize default side for equation numbering
    #If Win32 Then
    If Val(Application.version) >= kWord2007 Then
        WriteLog "About to initialize eqn numbering side"
        InitDefaultEqnNumSide
            WriteLog "Successfully initialized eqn numbering side"
        End If
    #Else
    WriteLog "About to initialize eqn numbering side"
    InitDefaultEqnNumSide
    WriteLog "Successfully initialized eqn numbering side"
    #End If

    #If Win32 Then
        WriteLog "About to call UIUpdate"
    UIUpdate
    If Val(Application.version) < kWord2007 Then
        If Not MTApp.App Is Nothing Then
            WriteLog "queuing UpdatePre2007CommandBar"
            MTApp.App.OnTime Now + TimeValue("00:00:01"), "UpdatePre2007CommandBar"
        End If
    End If
    #ElseIf 0 Then
    WriteLog "About to call UpdateState"
    UpdateState
    If Not MTApp.App Is Nothing Then
        ' http://valor:8080/browse/MT-2861
        WriteLog "Scheduling UpdatePre2007CommandBar before"
        On Error GoTo ScheduleErr1
        MTApp.App.OnTime Now + TimeValue("00:00:15"), "UpdatePre2007CommandBar"
        WriteLog "Scheduling UpdatePre2007CommandBar after"
        GoTo ScheduleComplete
ScheduleErr1:
        WriteLog "Scheduling Error - attempting immediate call of UpdatePre2007CommandBar"
        On Error GoTo ScheduleComplete
        UpdatePre2007CommandBar
        WriteLog "Returned from UpdatePre2007CommandBar immediate call"
ScheduleComplete:
    Else
        WriteLog "Scheduling UpdatePre2007CommandBar was skipped - MTApp.App is nothing"
    End If
    #End If

        'Update WordVer usage statistic
    Dim wordMajorVersion As Long
    wordMajorVersion = Int(Val(Application.version))
    MTSetStatistic "WordVer", wordMajorVersion

        'Install our keyboard shortcuts
    AddKeyboardShortcuts

    WriteLog "AutoExecCls.NoDirectCall_Main success"
    Exit Sub

fail:
    ' First, pass along any DSI_ABORT_EXCEPTIONs to be caught by the top-level handler
    If err.Number = DSI_ABORT_EXCEPTION Then
        err.Raise DSI_ABORT_EXCEPTION 'leaves other Err data intact
    Else
        ' handle unexpected error by displaying message, log error, throw DSI private error
        Asserts.AssertFailure module, "Main", err.Description
    End If

    Exit Sub

unload:
    'can't display error as WLL is missing, so continue quietly
    AddIns(MacroContainer).Installed = False

        WriteLog "Unloaded ourselves, and exiting quietly"
End Sub

'Unload MathType4 macros if found
Private Sub UnloadMT4Macros()
    Dim addin As addin
    Dim prefix As String
    Dim prefixLen As Long

    prefix = "MathType Commands For Word"
    prefixLen = Len(prefix)
    On Error GoTo errHandler
    For Each addin In AddIns

            WriteLog "Considering addin " & addin

        'XP has a 'bug' where asking the name for an unloaded & non-existent AddIn throws an error
        If left$(addin.name, prefixLen) = prefix Then

                WriteLog "matched prefix"

            MsgBox UILib.GetUserString("!0203An older version of the MathType Commands for Word is installed and will now be removed. Please ignore the ensuing message (Word cannot open this document template)."),                 vbInformation, UILib.GetUserString("!0200MathType Commands")
            addin.Installed = False

                WriteLog "About to Kill addin"
            KillAddIn addin.path, Application.PathSeparator, addin.name

                WriteLog "About to Delete addin"
            addin.Delete

                WriteLog "exiting prefix match conditional"
            End If
continue:
    Next
    Exit Sub

errHandler:
        WriteLog "in UnloadMT4Macros errhandler looking at error number " & err.Number
    Resume continue

End Sub

Private Sub KillAddIn(path As String, separator As String, name As String)
    'wrap Kill in error handler as it throws an exception if file is busy/missing
    On Error Resume Next
    FileSystem.Kill path & separator & name
End Sub

'Remove MTW3 menu items from Normal template
'Search all menus in the menubar to avoid using explicit menu names
Private Sub RemoveOldMenuItems()
    Dim curMenu As CommandBarControl
    Dim curItem As CommandBarControl

    CustomizationContext = NormalTemplate

        WriteLog "About to interate through menubar controls"

    For Each curMenu In CommandBars.ActiveMenuBar.Controls
        For Each curItem In curMenu.Controls
                WriteLog "considering" & curItem.Caption
            Select Case curItem.Caption
            Case "Equation Number", "Equation Reference", "Equation Section",                 "Equation Section...", "Equation Number Format...", "MathType Preferences",                 "MathType Preferences...", "Update Equations", "Update Equations..."

                curItem.Delete
                    WriteLog "deleted" & curItem.Caption
            End Select
        Next curItem
    Next curMenu

        WriteLog "exiting RemoveOldMenuItems"
End Sub

'Adds our keyboard shortcuts
'Inline Eqn                         = Ctrl+Alt+Q = 512 + 1024 + 81 = 1617
    'Mac                            = Ctrl+Option+Q         = 4096 + 2048 + 81 = 6225

'Display Eqn                        = Alt+Q = 1024 + 81 = 1105
    'Mac                            = Option+Q              = 2048 + 81 = 2129

'Right Numbered Disp Eqn            = Shift+Alt+Q = 256 + 1024 + 81 = 1361
    'Mac                            = Shift+Option+Q        = 512 + 2048 + 81 = 2641

'Left Numbered Disp Eqn             = Ctrl+Shift+Alt+Q = 512 + 256 + 1024 + 81 = 1873
    'Mac                            = Ctrl+Shift+Option+Q   = 4096 + 512 + 2048 + 81 = 6737

'Tex Toggle                         = Alt+\ = 1024 + 220 = 1244
    'Mac                            = n/a                   = 2048 + 220 = 2268
    'Mac Alternate                  = Ctrl+X                = 4096 + 88 = 4184

'Edit in place selected equation    = Alt+E = 1024 + 69 = 1093
    'Mac                            = n/a                   = 2048 + 69 = 2117 - For reference only, not supported on the Mac

'Edit in MT selected equation       = Alt+O = 1024 + 79 = 1103
    'Mac                            = Option+Command+O      = 2048 + 256 + 79 = 2383

'Open Math Input Panel              = Ctrl+Shift+M = 512 + 256 + 77 = 845
    'Mac                            = n/a                   = 4096 + 512 + 77 = 4685 - For reference only, not supported on the Mac

Public Sub AddKeyboardShortcuts()

    On Error Resume Next

    #If Win32 Then
    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_InsertInlineEqn", KeyCode:=Val(UILib.GetUserString("!24001617"))

    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_InsertDispEqn", KeyCode:=Val(UILib.GetUserString("!24011105"))

    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_InsertRightNumberedDispEqn", KeyCode:=Val(UILib.GetUserString("!24021361"))

    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_InsertLeftNumberedDispEqn", KeyCode:=Val(UILib.GetUserString("!24031873"))

    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_TeXToggle", KeyCode:=Val(UILib.GetUserString("!24041244"))

    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_EditEquationInPlace", KeyCode:=Val(UILib.GetUserString("!24051093"))

    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_EditEquationOpen", KeyCode:=Val(UILib.GetUserString("!24061103"))

    If IsMathInputPanelAvailable Then
        KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_MathInputControl", KeyCode:=Val(UILib.GetUserString("!24070845"))
    End If

    #Else
    WriteLog "AddKeyShortcut: InsertInlineEqn"
    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_InsertInlineEqn", KeyCode:=Val(UILib.GetUserString("!33246225"))

    WriteLog "AddKeyShortcut: InsertDispEqn"
    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_InsertDispEqn", KeyCode:=Val(UILib.GetUserString("!33252129"))

    WriteLog "AddKeyShortcut: InsertRightNumberedDispEqn"
    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_InsertRightNumberedDispEqn", KeyCode:=Val(UILib.GetUserString("!33262641"))

    WriteLog "AddKeyShortcut: InsertLeftNumberedDispEqn"
    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_InsertLeftNumberedDispEqn", KeyCode:=Val(UILib.GetUserString("!33276737"))

    WriteLog "AddKeyShortcut: TeXToggle"
    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_TeXToggle", KeyCode:=Val(UILib.GetUserString("!33282268"))
    If err.Number = 5346 Then
        WriteLog "Using alternate keystroke (Ctrl-X) for TexToggle"
        KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_TeXToggle", KeyCode:=Val(UILib.GetUserString("!33354184"))
    End If

    WriteLog "AddKeyShortcut: EditEquationOpen"
    KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, command:="MTCommand_EditEquationOpen", KeyCode:=Val(UILib.GetUserString("!33302383"))

    WriteLog "AddKeyShortcut: Finished"
    #End If

    'If the Word option "Prompt before saving Normal template" is checked on Word always
    'prompts to save normal.dot because of the above KeyBindings additions.
    'See http://valor:8080/browse/MT-2176
    'To prevent this prompt we clear the template dirty flag
    Application.NormalTemplate.saved = True

    Exit Sub

err:
    MsgBox "AddKeyShortcut: error " & err.Number & Chr(13) & err.Description
    Resume Next

End Sub

VBA File Name: CallbackGuard.cls, Stream Size: 6457

General
Stream Path:	VBA/CallbackGuard
VBA File Name:	CallbackGuard.cls
Stream Size:	6457
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . p . . . . . . \| . . . . q M . ? A " . . 3 4 * = . . . . h . . 8 . . + 3 q . . . . . . . . . . . . . . . . . . . . . , . . f . C . N . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . , . . f . C . N . I . . . . . . . \| . . . . q M . ? A " . . 3 4 . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 00 01 00 00 d2 08 00 00 e4 00 00 00 88 02 00 00 0d 0a 00 00 1b 0a 00 00 af 13 00 00 00 00 00 00 01 00 00 00 1d 6f ab bb 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 70 00 ff ff 00 00 09 7c 06 a4 d9 dc 71 4d 87 3f 41 22 01 1e 33 34 2a 3d fb fc fa a0 68 10 a7 38 08 00 2b 33 71 b5 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "CallbackGuard"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

'CallbackGuard
'=====================================================================
' (c) Copyright 1992-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/CallbackGuard.cls 15    9/17/12 1:21p Jimm $
'=====================================================================

' This file is shared between PP and Word

Private Sub Class_Initialize()

    ' initialize API
    Dim stat As Boolean
    Dim dllver As Long
    Dim msg As String
    Dim result As Long

    stat = False
    SetDLLPath
    
    #If Win32 Then
        Const ErrorVal As Integer = 0
    #Else
        Const ErrorVal As Integer = -1
    #End If
    
    ' Attempt to load the DLL
    result = MTInitAPI(mtinitLAUNCH_AS_NEEDED, 30)
    
    If result = mpMTDLL_NOT_FOUND Then
        ShowDLLNotFoundError
    ElseIf result <= ErrorVal Then
       msg = GetUserString2("1606", "3206", "The MathType commands could not communicate with MathType. There was a problem starting the API. Please be sure that MathType is properly installed.")
    Else
        'get the API Version (loads DLL)
        dllver = MTAPIVersion(MTAPI_VERSION)
        If dllver = mpBAD_VERSION Then
            ShowDLLNotFoundError
        'check the version against our constants
        ElseIf (dllver > mtversMajVerHi) Or (dllver < mtversMajVerLo) Then
            msg = GetUserString2("1607", "3207", "The version of this macro doesn't match the version of MathType's DLL. Reinstall MathType to fix this condition.")
        ElseIf (dllver < mtversMinVer) Then
            msg = GetUserString2("1608", "3208", "A more recent version of MathType's DLL is required to use this macro. Reinstall MathType to fix this condition.")
        Else
            stat = True
        End If
    End If

    If Not stat Then
        WriteLog "callbackguard error"
        EndAPI
        If (Len(msg) > 0) Then
            MsgBox msg, vbCritical, GetUserString2(1609, 3209, "MathType Commands for Microsoft Word Error")
        End If
        err.Raise DSI_ABORT_EXCEPTION
    End If
End Sub

Private Sub Class_Terminate()
    EndAPI
End Sub

Private Sub EndAPI()
    ' terminate API
    MTTermAPI
End Sub

VBA File Name: CommandGuard.cls, Stream Size: 7156

General
Stream Path:	VBA/CommandGuard
VBA File Name:	CommandGuard.cls
Stream Size:	7156
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . p . . . . . . L . p . . . F . . r . 3 m R ` * = . . . . h . . 8 . . + 3 q . . . . . . . . . . . . . . . . . . . . . # 0 . . . " S I . . \\ Q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . # 0 . . . " S I . . \\ Q . . . . . L . p . . . F . . r . 3 m R ` . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 00 01 00 00 d2 08 00 00 e4 00 00 00 88 02 00 00 0d 0a 00 00 1b 0a 00 00 b7 15 00 00 00 00 00 00 01 00 00 00 1d 6f ab 43 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 70 00 ff ff 00 00 03 4c 97 70 bb d2 f2 46 82 bd 72 c3 33 6d 52 60 2a 3d fb fc fa a0 68 10 a7 38 08 00 2b 33 71 b5 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "CommandGuard"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

'CommandGuard
'=====================================================================
' (c) Copyright 1992-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/CommandGuard.cls 14    9/17/12 1:21p Jimm $
'=====================================================================

' This file is shared between PP and Word

Private Sub Class_Initialize()

    On Error Resume Next

    ' Code to handle simultaneous execution
    If macroExecuting = True Then
        MsgBox "Only One MathType command can be executed at a time.  Please try again later."
        'Increment the OffBusy version check variable
        err.Raise DSI_ABORT_EXCEPTION
    Else
        macroExecuting = True
    End If

    ' initialize API
    Dim stat As Boolean
    Dim dllver As Long
    Dim msg As String
    Dim result As Long
    result = mpMTDLL_NOT_FOUND

    stat = False
    SetDLLPath

    #If Win32 Then
    Const ErrorVal As Integer = 0
    #Else
    Const ErrorVal As Integer = -1
    #End If

    ' Attempt to load the DLL
    result = MTInitAPI(mtinitLAUNCH_AS_NEEDED, 30)
        
    If result = mpMTDLL_NOT_FOUND Then
        ShowDLLNotFoundError
    ElseIf result <= ErrorVal Then
       msg = GetUserString2("1606", "3206", "The MathType commands could not communicate with MathType. There was a problem starting the API. Please be sure that MathType is properly installed.")
    Else
        'get the API Version (loads DLL)
        dllver = MTAPIVersion(MTAPI_VERSION)
        If dllver = mpBAD_VERSION Then
            ShowDLLNotFoundError
        'check the version against our constants
        ElseIf (dllver > mtversMajVerHi) Or (dllver < mtversMajVerLo) Then
            msg = GetUserString2("1607", "3207", "The version of this macro doesn't match the version of MathType's DLL. Reinstall MathType to fix this condition.")
        ElseIf (dllver < mtversMinVer) Then
            msg = GetUserString2("1608", "3208", "A more recent version of MathType's DLL is required to use this macro. Reinstall MathType to fix this condition.")
        Else
            stat = True
        End If
    End If

    If Not stat Then
        EndAPI
        If (Len(msg) > 0) Then
            MsgBox msg, vbCritical, GetUserString2("1609", "3209", "MathType Commands for Microsoft Word Error")
        End If
        err.Raise DSI_ABORT_EXCEPTION
    End If
End Sub

Private Sub Class_Terminate()
    EndAPI
End Sub

Private Sub EndAPI()

    On Error Resume Next

    ' code to release the execution lock
    macroExecuting = False

    ' terminate API
    MTTermAPI

End Sub

VBA File Name: Declarations.bas, Stream Size: 63095

General
Stream Path:	VBA/Declarations
VBA File Name:	Declarations.bas
Stream Size:	63095
Data ASCII:	. . . . . t . . . . c . . X . . . . . . . . . . . S f . . . . . . . . . . . . . . . o Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . R . X . . . R . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 74 03 00 00 ae 63 00 00 58 03 00 00 ac 04 00 00 ff ff ff ff 53 66 00 00 97 c8 00 00 00 00 00 00 01 00 00 00 1d 6f 5a 90 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Declarations"

'Declarations.bas
'bit independent declarations

'====================================================================
' (c) Copyright 1992-2015 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/Declarations.bas 9     12/02/15 4:39p Johns $
'====================================================================

' Note that this module is also shared between Word and PowerPoint

Option Explicit

'name of commands project
Public Const kMTCommands As String = "MTCommandsMain"

Public Const kAppMSW As String = "Microsoft Word"
Public Const kAppMSPP As String = "Microsoft PowerPoint"

'major version IDs of Word - Windows
Public Const kWord97 As Long = 8
Public Const kWord2000 As Long = 9
Public Const kWordX As Long = 10
Public Const kWord2003 As Long = 11
Public Const kWord2007 As Long = 12
Public Const kWord2010 As Long = 14
Public Const kWord2013 As Long = 15
Public Const kWord2016 As Long = 16
Public Const kWord2003SP3MinorVersion As Long = 8169
Public Const kWord2007SP2MinorVersion As Long = 6400

'major version IDs of Word - Mac
Public Const kWord2004 As Long = 11
Public Const kWord2008 As Long = 12
Public Const kWord2011 As Long = 14

'major version IDs of PPT - Windows
Public Const kPP2003 As Long = 11
Public Const kPP2007 As Long = 12
Public Const kPP2010 As Long = 14
Public Const kPP2013 As Long = 15
Public Const kPP2016 As Long = 16

'major version IDs of PPT - Mac
Public Const kPP2004 As Long = 11
Public Const kPP2008 As Long = 12
Public Const kPP2011 As Long = 14

'version # of the MathType API
Public Const MTAPI_VERSION As Integer = 5

' used with the return value from MTGetAppFunctionality
#If Win32 Then
Enum DemoMode
    dmNone = 0  ' no mode at all (completely fresh install)
    dmDemo      'full functionality, but with expiration date
    dmFull      ' full functionality, registered, no expiration
    dmExpired   ' reduced functionality, demo has expired
    dmCancelled ' reduced functionality, reg num has been cancelled by reg check
End Enum
#End If

'----------- Numbers we compare against with MTAPIvers ----------
Public Const mtversMajVerHi As Integer = 1535   '0x05ff
Public Const mtversMajVerLo As Integer = 1280   '0x0500
Public Const mtversMinVer As Integer = 1280     '0x0500

'Custom Properties
'Boolean, indicates type of equations in doc
Public Const mtprop_HAS_MAC_EQNS As String = "MTMacEqns"
Public Const mtprop_HAS_WIN_EQNS As String = "MTWinEqns"
Public Const mtprop_EQN_NUMS_ON_RIGHT As String = "MTEqnNumsOnRight"

'MT registry name
#If Win32 Then
Public Const mt_REGISTRY As String = ""             'use Windows registry
#Else
Public Const mt_REGISTRY As String = "MathType6"    'use Mac file
#End If

'Registry Locations
Public Const HKEY_CLASSES_ROOT = &H80000000
Public Const HKEY_CURRENT_USER = &H80000001
Public Const HKEY_LOCAL_MACHINE = &H80000002
Public Const HKEY_USERS = &H80000003
Public Const HKEY_PERFORMANCE_DATA = &H80000004
Public Const HKEY_CURRENT_CONFIG = &H80000005
Public Const HKEY_DYN_DATA = &H80000006

Public Const mtreg_HKLM = "HKEY_LOCAL_MACHINE"
Public Const mtreg_HKCU = "HKEY_CURRENT_USER"

Public Const mtreg_MT_HKLM_HOME = "SOFTWARE\Design Science\DSMT6"
Public Const mtreg_MT_HKCU_HOME = "Software\Design Science\DSMT6"
Public Const mtreg_MT_HKLM_DIRECTORIES = mtreg_MT_HKLM_HOME & "\Directories"
Public Const mtreg_MT_DIRECTORIES_LOCATION As String = "Software\Design Science\DSMT6\Directories"

Public Const mtreg_MT_ASK_ON_PASTE As String = "AskOnPaste"
Public Const mtreg_MT_EQN_NUMS_ON_RIGHT_KEY As String = "EqnNumsOnRight"
Public Const mtreg_MT_HELPDIR_KEY As String = "HelpDir"
Public Const mtreg_MT_HELPFILE_KEY As String = "HelpFile"
Public Const mtreg_MT_HELPFILE_LOCATION As String = "Software\Design Science\DSMT6\Config"
Public Const mtreg_MT_LANGUAGEDIR_KEY As String = "LangDir"             'language support files directory
Public Const mtreg_MT_MATHPAGE_KEY As String = mtreg_MT_HKCU_HOME & "\MathPage"
Public Const mtreg_MT_PASTECANCELDEF As String = "PasteCancelDefault"   'Continue default behavior for pasting
Public Const mtreg_MT_PREFDIR_KEY As String = "PrefsDir"                'system directory
Public Const mtreg_MT_PROGDIR_KEY As String = "ProgDir"                 'app directory
Public Const mtreg_MT_VERBOSE_LOGGING_KEY As String = "VerboseLogging"
Public Const mtreg_MT_WORDCMDS_LOCATION As String = mtreg_MT_HKCU_HOME & "\WordCommands"
Public Const mtreg_MT_WORD_2003_OMML_IN_RTF As String = "OMMLinRTF"     'if non-zero look in RTF instead of PNG in Word 2003
Public Const mtreg_MT_WORD_CONVFROM As String = "ConvertFrom"           'ConvertFrom key
Public Const mtreg_MT_WORD_CONVMISC As String = "ConvertMisc"           'ConvertMisc key
Public Const mtreg_MT_WORD_CONVTO As String = "ConvertTo"               'ConvertTo key
Public Const mtreg_MT_WORD_CONVTRANS As String = "ConvertTranslator"    'ConvertTranslator key
Public Const mtreg_MT_WORD_DEFAULT_EQNNUM_CUSTOM As String = "DefaultEqnNumCustom"      'Default eqn num. format
Public Const mtreg_MT_WORD_DEFAULT_EQNNUM_FORMAT As String = "DefaultEqnNumFormat"      'Default eqn num. format
Public Const mtreg_MT_WORD_DONTSHOW_EQNNUM_WARNING As String = "NoEqnNumWarningDlg"     'Don't Show EqnNum's 'Insert Break?' dialog key
Public Const mtreg_MT_WORD_DONTSHOW_EQNREFDLG As String = "NoInsertEqnRefDlg"           'Don't Show Insert Eqn Ref dialog key
Public Const mtreg_MT_WORD_DONTSHOW_LANGDLLERROR As String = "NoLanguageDLLError"       'Don't Show Missing Lang DLL key
Public Const mtreg_MT_WORD_DONTSHOW_SLOWEQNUPDATE As String = "NoSlowUpdateEqnDlg"      'Don't Show 'Slow EqnNum updates' key
Public Const mtreg_MT_WORD_EXPORT_DIRECTORY As String = "ExportDir"     'Default export dir
Public Const mtreg_MT_WORD_EXPORT_FILETYPE As String = "ExportFileType" 'Default export filetype
Public Const mtreg_MT_WORD_EXPORT_PATTERN As String = "ExportPattern"   'Default pattern
Public Const mtreg_MT_WORD_EXPORT_REPLACE As String = "ExportReplace"   'Replace?
Public Const mtreg_MT_WORD_MATHML_PASTEAS As String = "MMLPasteAs"
Public Const mtreg_MT_WORD_NOAPPLY_CONVERTED_EQN_STYLE As String = "ConvertEqnNoStyle" 'If set does not apply the MTConvertedEquation Style to converted equations
Public Const mtreg_MT_WORD_NO_SPACE_AFTER_INLINE As String = "NoSpaceAfterInline"
Public Const mtreg_MT_WORD_NO_CHECK_PROG_ID As String = "NoCheckProgID" 'MT-3373
Public Const mtreg_MT_WORD_OMML2MML_XSL_DIRNAME As String = "OMML2MMLXSL_DIR"
Public Const mtreg_MT_WORD_OMML2MML_XSL_FILENAME As String = "OMML2MMLXSL_FILE"
Public Const mtreg_MT_WORD_SEEN_MATHMLHELP As String = "SeenMathMLHelp" '"1" if MathMLHelp tip has been shown
Public Const mtreg_MT_CONVERTEQNS_DELAY As String = "ConvertEquationDelay"  ' amount of time to delay in milliseconds after copy to clipboard in convert equations

Public Const msoreg_WORD2007DIR_SECTION As String = "Software\Microsoft\Office\12.0\Word\Options\"
Public Const msoreg_WORD2010DIR_SECTION As String = "Software\Microsoft\Office\14.0\Word\Options\"
Public Const msoreg_WORD2013DIR_SECTION As String = "Software\Microsoft\Office\15.0\Word\Options\"
Public Const msoreg_WORD2016DIR_SECTION As String = "Software\Microsoft\Office\16.0\Word\Options\"
Public Const msoreg_WORDDIR_KEY As String = "PROGRAMDIR"

Public Const msoreg_WORD2007DIR_SECTION2 As String = "Software\Microsoft\Office\12.0\Word\InstallRoot\"
Public Const msoreg_WORD2010DIR_SECTION2 As String = "Software\Microsoft\Office\14.0\Word\InstallRoot\"
Public Const msoreg_WORD2013DIR_SECTION2 As String = "Software\Microsoft\Office\15.0\Word\InstallRoot\"
Public Const msoreg_WORD2016DIR_SECTION2 As String = "Software\Microsoft\Office\16.0\Word\InstallRoot\"
Public Const msoreg_WORDDIR_KEY2 As String = "Path"

' the following declarations are used for identifying buttons in the UI
Public Const mtbIDInsDispMTEqn As String = "MathType_B_InsDispMTEqn"
Public Const mtbIDInsDispMTEqn3 As String = "MathType_B_InsDispMTEqn3"
Public Const mtbIDInsDispMTEqnLeftNum As String = "MathType_B_InsDispMTEqnLeftNum"
Public Const mtbIDInsDispMTEqnLeftNum2 As String = "MathType_B_InsDispMTEqnLeftNum2"
Public Const mtbIDInsDispMTEqnLeftNum3 As String = "MathType_B_InsDispMTEqnLeftNum3"
Public Const mtbIDInsDispMTEqnRightNum As String = "MathType_B_InsDispMTEqnRightNum"
Public Const mtbIDInsDispMTEqnRightNum2 As String = "MathType_B_InsDispMTEqnRightNum2"
Public Const mtbIDInsDispMTEqnRightNum3 As String = "MathType_B_InsDispMTEqnRightNum3"
Public Const mtbIDInsEBEqn2 As String = "MathType_B_InsEBEqn2"
Public Const mtbIDInsHandEqn As String = "MathType_B_InsHandEqn"
Public Const mtbIDInsInlineMTEqn As String = "MathType_B_InsInlineMTEqn"
Public Const mtbIDInsInlineMTEqn3 As String = "MathType_B_InsInlineMTEqn3"
Public Const mtbIDSpeak As String = "MathType_B_Speak"
Public Const mtbIDSpeak3 As String = "MathType_B_Speak3"

'Public Const mtbIDMathType_B_InsEBEqn As String = "MathType_B_InsEBEqn" ' replaced by O2007 implementation
Public Const mtbIDInsEBEqnLeftNum As String = "MathType_B_InsEBEqnLeftNum"
Public Const mtbIDInsEBEqnRightNum As String = "MathType_B_InsEBEqnRightNum"

Public Const mtbIDInsertNumber As String = "MathType_B_InsertNumber"

Public Const mtbIDFormatEqnNums As String = "MathType_B_FormatEqnNums"
Public Const mtbIDUpdateEqnNums As String = "MathType_B_UpdateEqnNums"

Public Const mtbIDEquationReference As String = "MathType_B_EquationReference"

Public Const mtbIDManageChapterSections As String = "MathType_M_EqnNumsChapsSects"

Public Const mtbIDInsertNextSection As String = "MathType_B_InsertNextSection"
Public Const mtbIDInsertNextChapter As String = "MathType_B_InsertNextChapter"
Public Const mtbIDMoreBreaks As String = "MathType_B_MoreBreaks"
Public Const mtbIDModifyBreak As String = "MathType_B_ModifyBreak"

Public Const mtbIDBrowsePrev As String = "MathType_B_BrowsePrev"
Public Const mtbIDBrowseType As String = "MathType_DD_BrowseType"
Public Const mtbIDBrowseNext As String = "MathType_B_BrowseNext"

Public Const mtbIDSetEqnPrefs As String = "MathType_B_SetEqnPrefs"
Public Const mtbIDFormatEqns As String = "MathType_B_FormatEqns"
Public Const mtbIDConvertEqns As String = "MathType_B_ConvertEqns"
Public Const mtbIDTeXToggle As String = "MathType_B_TeXToggle"
Public Const mtbIDExportEqns As String = "MathType_B_ExportEqns"
Public Const mtbIDMathPage As String = "MathType_B_MathPage"

Public Const mtbIDHelp As String = "MathType_B_Help"
Public Const mtbIDHelpContents As String = "MathType_B_HelpContents"
Public Const mtbIDHelpMTInWord As String = "MathType_B_HelpMTInWord"
Public Const mtbIDHelpUnlockReg As String = "MathType_B_HelpUnlockReg"
Public Const mtbIDHelpAboutMT As String = "MathType_B_HelpAboutMT"

Public Const mtbIDWeb As String = "MathType_B_Web"
Public Const mtbIDWebHomePage As String = "MathType_B_WebHomePage"
Public Const mtbIDWebSupport As String = "MathType_B_WebSupport"
Public Const mtbIDWebEmailFeedback As String = "MathType_B_WebEmailFeedback"
Public Const mtbIDWebOrderMT As String = "MathType_B_WebOrderMT"
Public Const mtbIDFutureMT As String = "MathType_B_FutureMT"
Public Const mtbIDMTOptions As String = "MathType_DL_MTOptions"

Public Const mtbIDOMMathPage As String = "MathType_B_OMMathPage"

#If Word Then
Public Enum States
    AlwaysEnable = 1
    Word97SelectionInFootnoteEndnotePane = 2
    Word97SelectionInCommentPane = 4
    Word97SelectionInHeaderFooter = 8
    WordXPActiveWindowViewSplitSpecial = 16
    NotInReadingView = 32
    MTReferenceExists = 64
    NotInUnsupportedView = 128
    MathPageOK = 256
    IsDocumentOpen = 512
    SelectionInTextBox = 1024
    IsFunctionalityOK = 2048
End Enum
#ElseIf PP Then
    #If Win32 Then
    Public Enum States
        AlwaysEnable = 1
        IsPresentationOpen = 2
        ViewIsNotSlideSorter = 4
        ViewIsNotOutline = 8
        BrowseOK = 16
        NotInUnsupportedView = 32
    End Enum
    #Else ' no enum support on Mac PPT
    Public Const AlwaysEnable As Long = 1
    Public Const IsPresentationOpen As Long = 2
    Public Const ViewIsNotSlideSorter As Long = 4
    Public Const ViewIsNotOutline As Long = 8
    Public Const BrowseOK As Long = 16
    Public Const NotInUnsupportedView As Long = 32
    #End If
#End If

' major version # of this API
Public Const MPAPI_VERSION As Integer = 5

'----------- Numbers we compare against with MTAPIvers ----------
'MathType 5.01 uses the MathPage 5.1 API
Public Const mpversMajVerHi As Integer = 1535   '0x05ff
Public Const mpversMajVerLo As Integer = 1281   '0x0501
Public Const mpversMinVer As Integer = 1281     '0x0501

'API Return codes
Public Const mpOK As Long = 0
Public Const mpEQN_NO_BASELINE = 1000
Public Const mpBAD_VERSION As Long = -1000
Public Const mpMTDLL_NOT_FOUND As Long = -1001
Public Const mpFILE_INVALID As Long = -1002
Public Const mpFILE_NO_ACCESS As Long = -1003
Public Const mpNOT_AN_EQUATION As Long = -1004
Public Const mpERROR As Long = -9999

'Flag values for MPDocInit
Public Const mpdFullCompatibility As Integer = 1
Public Const mpdGenMathML As Integer = 2
Public Const mpdMathZoom As Integer = 4

'style values input to MPProcessSymbol
Public Const kPlainText As Integer = 0
Public Const kBoldText As Integer = 1
Public Const kItalicText As Integer = 2

'kind values, also returned by MPAnalyzeSymbol
Public Const kSIDefault As Long = 0                 'default value
Public Const kSIGIF As Long = 1                     'needs a GIF
Public Const kSIEntity As Long = 2                  'needs entity
Public Const kSIInsertSymbolPlaceholder As Long = 3 'maybe an inserted symbol
Public Const kSISubstituted As Long = 4             'char is being changed, 0 = delete char
Public Const kSIMissingFont As Long = 5             'font not installed

'Constants for 'cur sel' or 'whole doc'
Public Const mt_RANGE_DOCUMENT = 0
Public Const mt_RANGE_SELECTION = 1

'Flag bit for MTLib.SaveWordState()
Public Const mt_SWS_TRACKCHANGES = 1
Public Const mt_SWS_SMART_CUTPASTE = 2
Public Const mt_SWS_TYPING_REPLACE_SELECTION = 4
Public Const mt_SWS_PASTE_SMART_CUTPASTE = 8

'URL codes - also see UIHelp.bas mturl's
Public Const mturlMATHTYPE_OMML2MATHMLXSL As Long = 7

'Default OMML XSL file name
Public Const kOMML2MML_XSL_FILENAME As String = "OMML2MML.XSL"

'Word exe name
Public Const kWORDEXENAME = "WINWORD.EXE"

'MTMsgBox Constants
Public Const mt_MBYESNO = 1
Public Const mt_MBYESNOCANCEL = 2
Public Const mt_MBYES = 1
Public Const mt_MBNO = 2
Public Const mt_MBCANCEL = 3

' file type constants
Public Const kFTEPS_OSPICT As Integer = 0   'EPS+WMF, EPS+PICT
Public Const kFTEPS_NONE As Integer = 1     'EPS/None
Public Const kFTEPS_TIFF As Integer = 2     'EPS/TIFF (Win only)
Public Const kFTGIF As Integer = 3          'GIF
Public Const kFTOSPICT As Integer = 4       'WMF, PICT
Public Const kFTPDF As Integer = 5          'PDF

'Values for MTLib.GetPlatform()
Public Const kPlatformMac As Long = 1
Public Const kPlatformWin As Long = 2

' Predefined Clipboard Formats copied from C:\Program Files\Microsoft Visual Studio\Common\Tools\Winapi\WIN32API.TXT
Public Const CF_TEXT As Integer = 1
Public Const CF_BITMAP As Integer = 2
Public Const CF_METAFILEPICT As Integer = 3
Public Const CF_SYLK As Integer = 4
Public Const CF_DIF As Integer = 5
Public Const CF_TIFF As Integer = 6
Public Const CF_OEMTEXT As Integer = 7
Public Const CF_DIB As Integer = 8
Public Const CF_PALETTE As Integer = 9
Public Const CF_PENDATA As Integer = 10
Public Const CF_RIFF As Integer = 11
Public Const CF_WAVE As Integer = 12
Public Const CF_UNICODETEXT As Integer = 13
Public Const CF_ENHMETAFILE As Integer = 14

Public Const HWND_TOP = 0
Public Const SWP_SHOWWINDOW = &H40

' language type values for MTSetEqnFromLangStr
Public Const mtlangTEX_INPUT As Integer = 1
Public Const mtlangMATHML As Integer = 2
Public Const mtlangMTEF As Integer = 3

#If Win32 Then
'SHGetSpecialFolderPath parameter
Public Enum mceIDLPaths
    CSIDL_PROGRAM_FILES = &H26 ' * CSIDL_PROGRAM_FILES - Version 5.0. Program Files folder. A common path is C:\Program Files.
End Enum
#End If

Type SymbolInfo
    kind As Integer         'out from MPFindSymbol, input to MPProcessSymbol (see above)
    charCode As Integer     'out from MPFindSymbol, input to MPProcessSymbol
    isUniCode As Boolean    'private to WLL
    size As Single
    style As Integer        'see style constants above
    color As Long           'RGB value
End Type

Type BorderInfo
    width As Long           'one of wdLineWidth
    style As Long           'one of wdLineStyle
    color As Long           'RGB value
End Type

'display values for GIFInfo.display
Public Const mpdtInternal As Long = 0               'use internal inline/display setting
Public Const mpdtInline As Long = 1                 'make inline
Public Const mpdtDisplay As Long = 2                'make display

Type GIFInfo
    smooth As Boolean        'True to use anti-aliasing
    bkgndColor As Long       'only needed if (smooth || ! transparent)
    size As Single           'size of surrounding text
    fillType As Long         'one of msoFillType or 0
    topBorder As BorderInfo
    leftBorder As BorderInfo
    bottomBorder As BorderInfo
    rightBorder As BorderInfo
End Type

Type GIFInfo2
    version As Integer       'version of struct/API; 1 = MTW 5.0a
    smooth As Boolean        'True to use anti-aliasing
    bkgndColor As Long       'only needed if (smooth || ! transparent)
    size As Single           'size of surrounding text
    fillType As Long         'one of msoFillType or 0
    topBorder As BorderInfo
    leftBorder As BorderInfo
    bottomBorder As BorderInfo
    rightBorder As BorderInfo
    display As Long         'one of mpdtXXX constants
End Type

'struct for MPEnumMathMLTarget2
Type MPMathMLTarget
    browser As Integer      '0-based compatibility choice, -1 = all
    minWordVer As Integer   'min version of Word that supports target (8,9,10...)
    nameMax As Integer      'max len of name
    targetName As String    'MathML target name
    descMax As Integer      'max len of description
    targetDesc As String    'MathML target description
End Type

Type MPMathMLTarget2
    version As Integer      'struct/API version; MTW5.0a = 1
    browser As Integer      '0-based compatibility choice, -1 = all
    minWordVer As Integer   'min version of Word that supports target (8,9,10...)
    nameMax As Integer      'max len of name
    targetName As String    'MathML target name
    descMax As Integer      'max len of description
    targetDesc As String    'MathML target description
    extMax As Integer       'max len of extensions
    extensions As String    'valid file extensions, first is default
End Type

' maximum length of file paths, names, etc.
Public Const MTAPI_MAX_PATH As Long = 260

' Picture specifier
Public Type MTAPI_PICT
   mm    As Long
   xExt  As Long
   yExt  As Long
   hMF   As Long
End Type

Public Type RECT
   left     As Long
   top      As Long
   right    As Long
   bottom   As Long
End Type

' Picture dimensions
Public Type MTAPI_DIMS
   baseline As Integer  ' dist of baseline from bottom (points)
   bounds   As RECT     ' bounding rectangle (points)
End Type

'Info about chap/sec break
#If Word Then
Public Type BreakInfo
    parentField As Field                'Enclosing Macrobutton Field
    hasChapter As Boolean               'True if chapter field present
    isExplicitChapterNumber As Boolean  'True if chap# is explicit
    chapterNumber As String             'Explicit chap#'s value
    isExplicitSectionNumber As Boolean  'True if sec# is explicit
    sectionNumber As String             'Explicit sec#'s value
End Type
#Else
' Field is undefined in PowerPoint
Public Type BreakInfo
    'parentField As Field                'Enclosing Macrobutton Field
    hasChapter As Boolean               'True if chapter field present
    isExplicitChapterNumber As Boolean  'True if chap# is explicit
    chapterNumber As String             'Explicit chap#'s value
    isExplicitSectionNumber As Boolean  'True if sec# is explicit

VBA File Name: Declarations64.bas, Stream Size: 36697

General
Stream Path:	VBA/Declarations64
VBA File Name:	Declarations64.bas
Stream Size:	36697
Data ASCII:	. . . . . ` . . . . h . . D . . . . . . . . . . . . j . . o z . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . . p . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . M P A n a l y z e S y m b o l . . . h . P . . . . . . . . . . . . . . . . . . . . . . . . . . . M P A P I V e r s i o n . . . . . . h . . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . M P C o p y S u p p o r t F i l e s . . . . h . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . M P D o c I n i t
Data Raw:	01 16 03 00 06 60 17 00 00 ea 68 00 00 44 17 00 00 98 18 00 00 ff ff ff ff 83 6a 00 00 6f 7a 00 00 00 00 00 00 01 00 00 00 1d 6f d1 dd 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 70 16 00 00 00 00 68 08 20 00 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d 50 41 6e 61 6c 79 7a 65 53 79 6d 62 6f 6c 00 00 00 68 08 50 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Declarations64"

'Declarations64.bas
'64 bit declarations

'=====================================================================
' (c) Copyright 1992-2011 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/OS/Win/64-bits/Declarations64.bas 6     1/24/14 10:10a Jimm $
'=====================================================================

Public Const kBits As Long = 64

'=====================================================================
'MATHPAGE declarations
'=====================================================================
Public Declare PtrSafe Function MPAnalyzeSymbol Lib "MathPage.WLL" (ByVal charCode As Integer, ByVal font As String, ByRef info As SymbolInfo) As Long
Public Declare PtrSafe Function MPAPIVersion Lib "MathPage.WLL" (ByVal api As Integer) As Long
Public Declare PtrSafe Function MPCopySupportFiles Lib "MathPage.WLL" () As Long
Public Declare PtrSafe Function MPDocInit Lib "MathPage.WLL" (ByVal docDir As String, ByVal support As String, ByVal wordVer As Integer, ByVal flags As Integer, ByVal target As String) As Long
Public Declare PtrSafe Function MPDocTerm Lib "MathPage.WLL" () As Long
Public Declare PtrSafe Function MPEnumMathMLTarget Lib "MathPage.WLL" (ByVal index As Integer, ByRef targetInfo As MPMathMLTarget) As Long
Public Declare PtrSafe Function MPEnumMathMLTarget2 Lib "MathPage.WLL" (ByVal index As Integer, ByRef targetInfo As MPMathMLTarget2) As Long
Public Declare PtrSafe Function MPFileCleanup Lib "MathPage.WLL" (ByVal fileName As String, ByVal supportDir As String) As Long
#If Word Then
'Range is undefined in PowerPoint
Public Declare PtrSafe Function MPFindSymbol Lib "MathPage.WLL" (ByVal Range As Range, ByVal font As String, ByRef info As SymbolInfo) As Long
#End If
Public Declare PtrSafe Function MPOpenFileInBrowser Lib "MathPage.WLL" (ByVal path As String) As Long
Public Declare PtrSafe Function MPProcessEquation Lib "MathPage.WLL" (ByVal gifFile As String, ByRef info As GIFInfo, ByVal tagAttrs As String) As Long
Public Declare PtrSafe Function MPProcessEquation2 Lib "MathPage.WLL" (ByVal gifFile As String, ByRef info As GIFInfo2, ByVal tagAttrs As String) As Long
Public Declare PtrSafe Function MPProcessHTML Lib "MathPage.WLL" (ByVal inPath As String, ByVal outPath As String) As Long
Public Declare PtrSafe Function MPProcessHTML2 Lib "MathPage.WLL" (ByVal inPath As String, ByVal outPath As String, ByVal isMasterDoc As Long) As Long
Public Declare PtrSafe Function MPProcessSymbol Lib "MathPage.WLL" (ByVal gifFile As String, ByVal font As String, ByRef info As SymbolInfo, ByVal symbolID As String, ByVal tagAttrs As String) As Long
Public Declare PtrSafe Function MTAPIGetNestingLevel Lib "MathPage.WLL" () As Long
Public Declare PtrSafe Function MTAPIVersion Lib "MathPage.WLL" (ByVal api As Integer) As Long
Public Declare PtrSafe Function MTClearClipboard Lib "MathPage.WLL" () As Long
Public Declare PtrSafe Function MTCloseOleObject Lib "MathPage.WLL" (ByVal dwSaveOpts As Long, ByVal varOleObject As Object) As Long
Public Declare PtrSafe Function MTConvertPrefsToUIForm Lib "MathPage.WLL" (ByVal inPrefs As String, ByVal outPrefs As String, ByVal outPrefsLen As Integer) As Long
Public Declare PtrSafe Function MTCopyButtonFace Lib "MathPage.WLL" (ByVal tag As String) As Long
Public Declare PtrSafe Function MTCrashTest Lib "MathPage.WLL" (ByVal where As Long, ByVal how As Long) As Long
Public Declare PtrSafe Function MTCreateDirectory Lib "MathPage.WLL" (ByVal directory As String) As Long
Public Declare PtrSafe Function MTEnumTranslators Lib "MathPage.WLL" (ByVal index As Integer, ByVal transName As String, ByVal transNameLen As Integer, ByVal transDesc As String, ByVal transDescLen As Integer, ByVal transFile As String, ByVal transFileLen As Integer) As Long
Public Declare PtrSafe Function MTEquationOnClipboard Lib "MathPage.WLL" () As Long
Public Declare PtrSafe Function MTGetAppFunctionality Lib "MathPage.WLL" () As Long
Public Declare PtrSafe Function MTGetClipboardText Lib "MathPage.WLL" (ByVal cbText As String, ByRef cbTextLen As Long) As Long
Public Declare PtrSafe Function MTGetLangBytesFromEqn Lib "MathPage.WLL" (ByVal myObj As Object, ByVal langType As Integer, ByRef langBuff As Byte, ByRef buffLen As Long) As Long
Public Declare PtrSafe Function MTGetLangStrFromEqn Lib "MathPage.WLL" (ByVal myObj As Object, ByVal langType As Integer, ByVal langStr As String, ByRef strLen As Long) As Long
Public Declare PtrSafe Function MTGetLastDimension Lib "MathPage.WLL" (ByVal dimIndex As Integer) As Long
Public Declare PtrSafe Function MTGetLocaleDLL Lib "MathPage.WLL" (ByVal buffer As String, ByRef length As Long) As Long
Public Declare PtrSafe Function MTGetLocaleString Lib "MathPage.WLL" (ByVal str As String, ByVal buffer As String, ByRef length As Long) As Long
Public Declare PtrSafe Function MTGetMathMLFromClipboard Lib "MathPage.WLL" (ByVal mathMlStr As String, ByRef mathMlDataLen As Long) As Long
Public Declare PtrSafe Function MTGetMathMLFromClipboardText Lib "MathPage.WLL" (ByVal mathMlStr As String, ByRef mathMlDataLen As Long) As Long
Public Declare PtrSafe Function MTGetOMMLFromClipboardHTML Lib "MathPage.WLL" (ByVal ommlData As String, ByRef ommlDataLen As Long) As Long
Public Declare PtrSafe Function MTGetOMMLFromClipboardPNGOA Lib "MathPage.WLL" (ByVal ommlData As String, ByRef ommlDataLen As Long) As Long
Public Declare PtrSafe Function MTGetOMMLFromClipboardRTF Lib "MathPage.WLL" (ByVal ommlData As String, ByRef ommlDataLen As Long) As Long
Public Declare PtrSafe Function MTGetPreference Lib "MathPage.WLL" (ByVal name As String, ByVal value As String, ByRef valueLen As Integer, ByVal section As String, ByVal filePath As String) As Long
Public Declare PtrSafe Function MTGetPrefsFromClipboard Lib "MathPage.WLL" (ByVal prefs As String, ByVal prefsLen As Integer) As Long
Public Declare PtrSafe Function MTGetPrefsFromFile Lib "MathPage.WLL" (ByVal prefFile As String, ByVal prefs As String, ByVal prefsLen As Integer) As Long
Public Declare PtrSafe Function MTGetPrefsMTDefault Lib "MathPage.WLL" (ByVal prefs As String, ByVal prefsLen As Integer) As Long
Public Declare PtrSafe Function MTGetTickCount Lib "MathPage.WLL" () As Long
Public Declare PtrSafe Function MTGetTranslatorsInfo Lib "MathPage.WLL" (ByVal infoIndex As Integer) As Long
Public Declare PtrSafe Function MTGetURL Lib "MathPage.WLL" (ByVal whichURL As Long, ByVal bGoToURL As Boolean, ByVal strURL As String, ByVal sizeURL As Long) As Long
Public Declare PtrSafe Function MTGetUserString Lib "MathPage.WLL" (ByVal str As String, ByVal buffer As String, ByRef length As Long) As Long
Public Declare PtrSafe Function MTGetUserWString Lib "MathPage.WLL" (ByVal str As String, ByRef buffer As Byte, ByRef length As Long) As Long
Public Declare PtrSafe Function MTIncrementStatisticBy Lib "MathPage.WLL" (ByVal name As String, ByVal value As Long) As Long
Public Declare PtrSafe Function MTInitAPI Lib "MathPage.WLL" (ByVal options As Integer, ByVal timeout As Integer) As Long
Public Declare PtrSafe Function MTInitLocaleStringDLL Lib "MathPage.WLL" (ByVal version As Long, ByVal languageID As Long) As Long
Public Declare PtrSafe Function MTInsertHandwrittenMath Lib "MathPage.WLL" () As Long
Public Declare PtrSafe Function MTIsClipboardFormatAvailable Lib "MathPage.WLL" (ByVal lpsFormat As String, ByVal iFormat As Integer, ByRef isAvailable As Boolean) As Long
Public Declare PtrSafe Function MTIsFullFunctionality Lib "MathPage.WLL" () As Long
Public Declare PtrSafe Function MTIsMathInputPanelAvailable Lib "MathPage.WLL" (ByRef isAvailable As Boolean) As Long
Public Declare PtrSafe Function MTIsMathInputPanelTheClipboardOwner Lib "MathPage.WLL" (ByRef mipIsCBOwner As Boolean) As Long
Public Declare PtrSafe Function MTOpenFileDialog Lib "MathPage.WLL" (ByVal fileType As Integer, ByVal title As String, ByVal dir As String, ByVal file As String, ByVal fileLen As Integer) As Long
Public Declare PtrSafe Function MTPreviewDialog Lib "MathPage.WLL" (ByVal parent As Long, ByVal title As String, ByVal prefs As String, ByVal closeBtnText As String, ByVal helpBtnText As String, ByVal helpID As Long, ByVal helpFile As String) As Long
Public Declare PtrSafe Function MTSaveFileDialog Lib "MathPage.WLL" (ByVal title As String, ByVal dir As String, ByVal file As String, ByVal filterName As String, ByVal filterSpec As String, ByVal buffer As String, ByRef length As Long) As Long
Public Declare PtrSafe Function MTSetClipboardText Lib "MathPage.WLL" (ByVal cbText As String) As Long
Public Declare PtrSafe Function MTSetEqnFromLangBytes Lib "MathPage.WLL" (ByVal myObj As Object, ByVal langType As Integer, langBuff As Byte, ByVal buffLen As Long) As Long
Public Declare PtrSafe Function MTSetEqnFromLangStr Lib "MathPage.WLL" (ByVal myObj As Object, ByVal langType As Integer, langStr As Any, ByVal strLen As Long) As Long
Public Declare PtrSafe Function MTSetMTPrefs Lib "MathPage.WLL" (ByVal mode As Integer, ByVal prefs As String, ByVal timeout As Integer) As Long
Public Declare PtrSafe Function MTSetPreference Lib "MathPage.WLL" (ByVal name As String, ByVal value As String, ByVal section As String, ByVal filePath As String) As Long
Public Declare PtrSafe Function MTSetStatistic Lib "MathPage.WLL" (ByVal name As String, ByVal value As Long) As Long
Public Declare PtrSafe Function MTShowAboutBox Lib "MathPage.WLL" () As Long
Public Declare PtrSafe Function MTTermAPI Lib "MathPage.WLL" () As Long
Public Declare PtrSafe Function MTXFormAddVarSub Lib "MathPage.WLL" (ByVal options As Integer, ByVal findType As Integer, ByVal find As String, ByVal findLen As Long, ByVal replaceType As Integer, ByVal replace As String, ByVal replaceLen As Long, ByVal replaceStyle As Integer) As Long
Public Declare PtrSafe Function MTXFormEqn Lib "MathPage.WLL" (ByVal src As Integer, ByVal srcFmt As Integer, ByVal srcData As String, ByVal srcDataLen As Long, ByVal dst As Integer, ByVal dstFmt As Integer, ByVal dstData As String, ByVal dstDataLen As Long, ByVal dstPath As String, ByRef dims As MTAPI_DIMS) As Long
Public Declare PtrSafe Function MTXFormEqnBytes Lib "MathPage.WLL" Alias "MTXFormEqn" (ByVal src As Integer, ByVal srcFmt As Integer, srcData As Byte, ByVal srcDataLen As Long, ByVal dst As Integer, ByVal dstFmt As Integer, ByVal dstData As String, ByVal dstDataLen As Long, ByVal dstPath As String, ByRef dims As MTAPI_DIMS) As Long
Public Declare PtrSafe Function MTXFormGetStatus Lib "MathPage.WLL" (ByVal index As Integer) As Long
Public Declare PtrSafe Function MTXFormReset Lib "MathPage.WLL" () As Long
Public Declare PtrSafe Function MTXFormSetPrefs Lib "MathPage.WLL" (ByVal prefType As Integer, ByVal prefStr As String) As Long
Public Declare PtrSafe Function MTXFormSetTranslator Lib "MathPage.WLL" (ByVal options As Integer, ByVal transName As String) As Long

'=====================================================================
'WINDOWS OS declarations
'=====================================================================

'For IDataObject manipulations
Public Declare PtrSafe Function GlobalAlloc Lib "kernel32" (ByVal wFlags As Long, ByVal dwBytes As Long) As Long
Public Declare PtrSafe Function GlobalFree Lib "kernel32" (ByVal hMem As Long) As Long
Public Declare PtrSafe Function GlobalLock Lib "kernel32" (ByVal hMem As Long) As Long
Public Declare PtrSafe Function GlobalSize Lib "kernel32" (ByVal hMem As Long) As Long
Public Declare PtrSafe Function GlobalUnlock Lib "kernel32" (ByVal hMem As Long) As Long
Public Declare PtrSafe Function RegisterClipboardFormat Lib "user32" Alias "RegisterClipboardFormatA" (ByVal lpString As String) As Long
Public Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (lpvDest As Any, lpvSource As Any, ByVal cbCopy As Long)

' Clipboard operations
Public Declare PtrSafe Function CloseClipboard Lib "user32" () As Integer
Public Declare PtrSafe Function CountClipboardFormats Lib "user32" () As Long
Public Declare PtrSafe Function EmptyClipboard Lib "user32" () As Long
Public Declare PtrSafe Function GetClipboardData Lib "user32" (ByVal wFormat As Integer) As Long
Public Declare PtrSafe Function lstrcpy Lib "kernel32" (ByVal lpString1 As Any, ByVal lpString2 As Any) As Long
Public Declare PtrSafe Function OpenClipboard Lib "user32" (ByVal hwnd As Integer) As Integer
Public Declare PtrSafe Function SetClipboardData Lib "user32" (ByVal wFormat As Long, ByVal hMem As Long) As Long

'System API's
Public Declare PtrSafe Function FindWindowByClass Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As Long) As Long
Public Declare PtrSafe Function GetEnvironmentVariable Lib "kernel32" Alias "GetEnvironmentVariableA" (ByVal lpName As String, ByVal lpBuffer As String, ByVal nSize As Long) As Long
Public Declare PtrSafe Function GetFileVersionInfo Lib "Version.dll" Alias "GetFileVersionInfoA" (ByVal lptstrFilename As String, ByVal dwhandle As Long, ByVal dwlen As Long, lpData As Any) As Long
Public Declare PtrSafe Function GetFileVersionInfoSize Lib "Version.dll" Alias "GetFileVersionInfoSizeA" (ByVal lptstrFilename As String, lpdwHandle As Long) As Long
Public Declare PtrSafe Function GetForegroundWindow Lib "user32" () As Long
Public Declare PtrSafe Function GetKeyState Lib "user32" (ByVal vKey As Long) As Integer
Public Declare PtrSafe Function GetLastError Lib "kernel32" () As Long
Public Declare PtrSafe Function GetLocaleInfo Lib "kernel32" Alias "GetLocaleInfoA" (ByVal Locale As Long, ByVal LCType As Long, ByVal lpLCData As String, ByVal cchData As Long) As Long
Public Declare PtrSafe Function GetTickCount Lib "kernel32" () As Long
Public Declare PtrSafe Function GetWindowRect Lib "user32" (ByVal hwnd As Long, ByRef hMem As RECT) As Boolean
Public Declare PtrSafe Function SetEnvironmentVariable Lib "kernel32" Alias "SetEnvironmentVariableA" (ByVal lpName As String, ByVal lpValue As String) As Long
Public Declare PtrSafe Function SetForegroundWindow Lib "user32" (ByVal hwnd As Long) As Long
Public Declare PtrSafe Function SetWindowPos Lib "user32" (ByVal hwnd As Long, ByVal hWndInsertAfter As Long, ByVal topx As Integer, ByVal topy As Integer, ByVal width As Integer, ByVal height As Integer, ByVal flags As Integer) As Boolean
Public Declare PtrSafe Function ShellExecute Lib "SHELL32.DLL" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
Public Declare PtrSafe Function SHGetSpecialFolderPath Lib "SHELL32.DLL" Alias "SHGetSpecialFolderPathA" (ByVal hwnd As Long, ByVal lpszPath As String, ByVal nFolder As Integer, ByVal fCreate As Boolean) As Boolean
Public Declare PtrSafe Function StringFromGUID2 Lib "OLE32.dll" (ByRef rGUID As Any, ByVal lpSz As String, ByVal cchMax As Long) As Long
Public Declare PtrSafe Function VerQueryValue Lib "Version.dll" Alias "VerQueryValueA" (pBlock As Any, ByVal lpSubBlock As String, lplpBuffer As Any, puLen As Long) As Long
Public Declare PtrSafe Sub MoveMemory Lib "kernel32" Alias "RtlMoveMemory" (dest As Any, ByVal Source As Long, ByVal length As Long)

'Help
Public Declare PtrSafe Function HtmlHelp Lib "hhctrl.ocx" Alias "HtmlHelpA" (ByVal hwnd As Long, ByVal lpHelpFile As String, ByVal wCommand As Long, ByVal dwData As Long) As Long
Public Declare PtrSafe Function WinHelp Lib "user32" Alias "WinHelpA" (ByVal hwnd As Long, ByVal lpHelpFile As String, ByVal wCommand As Long, ByVal dwData As Long) As Long

'Registry API's
Public Declare PtrSafe Function RegQueryInfoKey Lib "advapi32.dll" Alias "RegQueryInfoKeyA" (ByVal pRegKey As Long, sClass As String, sClassLen As Long, ByVal Reserved As Long, cSubKeys As Long, cMaxSubKeyLen As Long, cMaxClassLen As Long, cValues As Long, cMaxValueNameLen As Long, cMaxValueLen As Long, cbSecurityDescriptor As Long, ftLastWriteTime As Long) As Long

Public Declare PtrSafe Function RegCreateKeyEx Lib "advapi32.dll"     Alias "RegCreateKeyExA" (     ByVal lngKey As LongPtr,     ByVal lpSubKey As String,     ByVal Reserved As Long,     ByVal lpClass As String,     ByVal dwOptions As Long,     ByVal samDesired As Long,     ByVal lpSecurityAttributes As Long,     phkResult As LongPtr,     ByVal lpdwDisposition As Long) As Long

Public Declare PtrSafe Function RegQueryValueExString Lib "advapi32.dll"     Alias "RegQueryValueExA" (     ByVal lngKey As LongPtr,     ByVal lpValueName As String,     ByVal lpReserved As Long,     lpType As Long,     lpData As Any,     lpcbData As Long) As Long

Public Declare PtrSafe Function RegQueryValueExNULL Lib "advapi32.dll"     Alias "RegQueryValueExA" (     ByVal lngKey As LongPtr,     ByVal lpValueName As String,     ByVal lpReserved As LongPtr,     lpType As Long,     ByVal lpData As Long,     lpcbData As Long) As Long

Public Declare PtrSafe Function RegOpenKeyEx Lib "advapi32.dll"     Alias "RegOpenKeyExA" (     ByVal lngKey As LongPtr,     ByVal lpSubKey As String,     ByVal ulOptions As Long,     ByVal samDesired As Long,     phkResult As LongPtr) As Long

Public Declare PtrSafe Function RegCloseKey Lib "advapi32.dll"     (ByVal lngKey As LongPtr) As Long

Public Declare PtrSafe Function RegSetValueExString Lib "advapi32.dll"     Alias "RegSetValueExA" (     ByVal hKey As LongPtr,     ByVal lpValueName As String,     ByVal Reserved As Long,     ByVal dwType As Long,     ByVal lpValue As String,     ByVal cbData As Long) As Long

'=====================================================================

VBA File Name: MTLibCommon.bas, Stream Size: 6364

General
Stream Path:	VBA/MTLibCommon
VBA File Name:	MTLibCommon.bas
Stream Size:	6364
Data ASCII:	. . . . . . . . . . . . . . . . . ( . . . . . . . . . . . C . . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . p . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 8a 09 00 00 d4 00 00 00 28 02 00 00 ff ff ff ff cf 0a 00 00 43 14 00 00 00 00 00 00 01 00 00 00 1d 6f ff dd 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "MTLibCommon"

'=====================================================================
' (c) Copyright 1992-2011 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/MTLibCommon.bas 6     5/06/14 9:54a Jimm $
'=====================================================================

'
' Routines common to Word and PowerPoint
'

Option Explicit

Private gDLLNotFoundErrorShown As Boolean

Public Sub SetDLLPath()
#If Win32 Then
    Dim mtDir As String
    Dim mathPageDir As String
    Dim buf As String
    Dim result As Long
    Dim pathSep As String

    #If Word Then
    pathSep = Application.PathSeparator
    #Else
    pathSep = "\"
    #End If

    mathPageDir = GetMathTypeDir & pathSep & "MathPage" & pathSep & Trim(str(kBits))

    If (FileExists(mathPageDir) = False) Then
        mathPageDir = GetMathTypeDir & pathSep & "MathPage"
    End If

    ' set the buffer to the max length of the path
    buf = Space(32767)

    ' get the path environment variable
    result = GetEnvironmentVariable("Path", buf, 32767)

    If result <> 0 Then

        ' truncate the path to the proper length of the path
        buf = left(buf, result)

        ' if we have already added the mathpage dir to the path then exit
        If InStr(1, buf, mathPageDir, vbTextCompare) Then
            Exit Sub
        End If

        ' append the mathpage dir to the path
        buf = buf & ";" & mathPageDir
        SetEnvironmentVariable "Path", buf

    End If
#End If
End Sub

Public Function FileExists(fileName As String) As Boolean

    FileExists = False
  
    On Error GoTo done
    If Not dir(fileName, vbDirectory) = vbNullString Then
        FileExists = True
    End If
    
done:
    On Error GoTo 0

End Function

Public Sub ShowDLLNotFoundError()
    If gDLLNotFoundErrorShown = False Then
        MsgBox GetUserString("!1697The MathType DLL cannot be found. Please reinstall MathType."), vbCritical, GetUserString("!1609MathType Commands for Microsoft Word Error")
        gDLLNotFoundErrorShown = True
    End If
End Sub

VBA File Name: MTW5.cls, Stream Size: 8199

General
Stream Path:	VBA/MTW5
VBA File Name:	MTW5.cls
Stream Size:	8199
Data ASCII:	. . . . . . . . . : . . . . . . . . . . . z . . . . . . . . . . . . . . . . . . . . o 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . w . . i L . . . . l . g . * = . . . . h . . 8 . . + 3 q . . . . . . . . . . . . . . . . . . . . . H . . . . d - E . . . . . n ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . H . . . . d - E . . . . . n ( . . . . w . . i L . . . . l . g . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 00 01 00 00 3a 0e 00 00 e4 00 00 00 88 02 00 00 7a 0f 00 00 94 0f 00 00 0c 1a 00 00 00 00 00 00 01 00 00 00 1d 6f 33 e6 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 80 00 ff ff 00 00 dc c4 d1 77 ce 07 69 4c 9c 90 e2 ed 6c 8e 67 95 2a 3d fb fc fa a0 68 10 a7 38 08 00 2b 33 71 b5 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "MTW5"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
'MTW5 5.0
' (c) Copyright 1992-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/MTDLLPath.cls 42    10/11/11 2:12p Jimm $
Option Explicit

' Note: * all functions/subs that start with MTCommand_ are "top-level" entry points called from
'         OnAction handlers (e.g. buttons, menu items, etc).
'       * all functions/subs that start with MTCallback_ are are called by
'         Word 2007 as needed to refresh the Ribbon UI
'       * all functions/subs that start with NoDirectCall_
'          MUST NOT BE CALLED except via a RunXXX command


' module name
Private Const module As String = "MTW5"
Private Const moduleCLS As String = "UIWrappersCls"

Public WithEvents App As Application
Attribute App.VB_VarHelpID = -1

Private Sub App_DocumentBeforeSave(ByVal Doc As Document, SaveAsUI As Boolean, Cancel As Boolean)
    RunDocCallback moduleCLS, "NoDirectCall_App_DocumentBeforeSave"
End Sub

'Runs when a doc is created, opened or activated (W2000 and higher only)
'Checks if doc is marked as containing eqns from other platform
Private Sub App_DocumentOpen(ByVal Doc As Document)
    Set MTW5_aDoc = Doc
    RunDocCallback moduleCLS, "NoDirectCall_App_DocumentOpen"
End Sub

'Runs when doc is created, opened or activated
'Check if doc's template has old MT macros installed
Private Sub App_DocumentChange()
    RunDocCallback moduleCLS, "NoDirectCall_App_DocumentChange"
End Sub

Private Sub App_WindowActivate(ByVal Doc As Document, ByVal Wn As Window)
    RunDocCallback moduleCLS, "NoDirectCall_App_WindowActivate"
End Sub

'Private Sub App_WindowSelectionChange(ByVal sel As Selection)
'    RunDocCallback moduleCLS, "NoDirectCall_App_WindowSelectionChange"
'End Sub

' called when the class is being initialized
Private Sub Class_Initialize()
    On Error GoTo bye
    UIUpdate
    Exit Sub
bye:
        WriteLog "Class_Initialize error"
    ' First, pass along any DSI_ABORT_EXCEPTIONs to be caught by the top-level handler
    If err.Number = DSI_ABORT_EXCEPTION Then
        err.Raise DSI_ABORT_EXCEPTION 'leaves other Err data intact
    Else
        ' handle unexpected error by displaying message, log error, throw DSI private error
        Asserts.AssertFailure module, "Class_Initialize", err.Description
    End If
End Sub

VBA File Name: Module1.bas, Stream Size: 824

General
Stream Path:	VBA/Module1
VBA File Name:	Module1.bas
Stream Size:	824
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 8a 02 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff b8 02 00 00 0c 03 00 00 00 00 00 00 01 00 00 00 1d 6f ff 15 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Module1"

VBA File Name: Preferences.bas, Stream Size: 3820

General
Stream Path:	VBA/Preferences
VBA File Name:	Preferences.bas
Stream Size:	3820
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . _ . . . s . . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 0a 07 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 5f 07 00 00 73 0c 00 00 00 00 00 00 01 00 00 00 1d 6f f4 84 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Preferences"

'====================================================================
' (c) Copyright 1992-2011 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/Preferences.bas 2     5/06/14 9:54a Jimm $
'====================================================================

' Routines for reading/writing user preferences

Option Explicit

Public Function GetPreference(ByVal hive As Long, ByVal strFolder As String, ByVal strKey As String) As String

#If Win32 Then

    GetPreference = GetRegistryString(hive, strFolder, strKey)

#Else

    Dim stat As Long
    Dim value As String
    Const BUFSIZE As Integer = 1024

    value = Strings.Space(BUFSIZE)

    stat = MTGetPreference(strKey, value, BUFSIZE - 1, "", "")

    value = Strings.Trim(value)

    GetPreference = value

#End If

End Function

Public Sub SetPreference(ByVal hive As Long, ByVal strFolder As String, ByVal strKey As String, ByVal strValue As String)

#If Win32 Then
    SetRegistryString hive, strFolder, strKey, strValue
#Else
    Dim stat As Long
    stat = MTSetPreference(strKey, strValue, "", "")
#End If

End Sub

VBA File Name: Registry.bas, Stream Size: 3357

General
Stream Path:	VBA/Registry
VBA File Name:	Registry.bas
Stream Size:	3357
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o ! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 c2 05 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff f0 05 00 00 84 0a 00 00 00 00 00 00 01 00 00 00 1d 6f 21 ed 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Registry"
'=====================================================================
' (c) Copyright 1992-2011 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/Registry.bas 7     10/11/11 2:12p Jimm $
'=====================================================================
'Registry - a collection of registry functions
'Registry routines that are bitness independent

Option Explicit

'Unicode null-terminated string.
Public Const REG_SZ = 1
Public Const ERROR_SUCCESS = 0&

Public Const STANDARD_RIGHTS_ALL = &H1F0000
Public Const READ_CONTROL = &H20000
Public Const STANDARD_RIGHTS_READ = (READ_CONTROL)
Public Const STANDARD_RIGHTS_WRITE = (READ_CONTROL)
Public Const SYNCHRONIZE = &H100000
Public Const KEY_CREATE_LINK = &H20
Public Const KEY_CREATE_SUB_KEY = &H4
Public Const KEY_ENUMERATE_SUB_KEYS = &H8
Public Const KEY_NOTIFY = &H10
Public Const KEY_QUERY_VALUE = &H1
Public Const REG_OPTION_NON_VOLATILE = &H0
Public Const KEY_SET_VALUE = &H2
Public Const KEY_ALL_ACCESS = ((STANDARD_RIGHTS_ALL Or KEY_QUERY_VALUE Or KEY_SET_VALUE Or KEY_CREATE_SUB_KEY Or KEY_ENUMERATE_SUB_KEYS Or KEY_NOTIFY Or KEY_CREATE_LINK) And (Not SYNCHRONIZE))

VBA File Name: Registry64.bas, Stream Size: 9873

General
Stream Path:	VBA/Registry64
VBA File Name:	Registry64.bas
Stream Size:	9873
Data ASCII:	. . . . . . . . . 2 . . . . . . . . . . . . . . . . . . . C . . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 32 0c 00 00 d4 00 00 00 d8 01 00 00 ff ff ff ff f7 0c 00 00 43 1e 00 00 00 00 00 00 01 00 00 00 1d 6f f5 db 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Registry64"
'=====================================================================
' (c) Copyright 1992-2011 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/OS/Win/64-bits/Registry64.bas 1     10/11/11 2:07p Jimm $
'=====================================================================
'Registry - a collection of registry functions
'64-bit Registry routines

Option Explicit

Public Const KEY_WOW64_32 = &H200
'Public Const KEY_WOW64_64 = &H100
Public Const KEY_READ = ((STANDARD_RIGHTS_READ Or KEY_QUERY_VALUE Or KEY_ENUMERATE_SUB_KEYS Or KEY_NOTIFY) And (Not SYNCHRONIZE))
Public Const KEY_WRITE = ((STANDARD_RIGHTS_WRITE Or KEY_SET_VALUE Or KEY_CREATE_SUB_KEY) And (Not SYNCHRONIZE))


'KEY_READ                   131609  0x20219
'STANDARD_RIGHTS_READ       131072  0x20000
'KEY_QUERY_VALUE                 1  0x00001
'KEY_ENUMERATE_SUB_KEYS          8  0x00008
'KEY_NOTIFY                     16  0x00010
'KEY_WOW64_32                  512  0x00200
'total                              0x20219

'=====================================================================
'                   OpenKey
'This function returns a handle to an existing key, or zero if the
'key does not exist or if the function fails.
'---------------------------------------------------------------------
Public Function OpenKey(ByVal hive As Long, ByVal strKey As String) As LongPtr
    Dim lngReturn As Long
    Dim lngKey As LongPtr

    lngReturn = RegOpenKeyEx(hive, strKey, 0&, KEY_READ Or KEY_WOW64_32, lngKey)

    If lngReturn <> ERROR_SUCCESS Then
        lngKey = 0
    End If

    OpenKey = lngKey
End Function

'=====================================================================
'                       GetRegistryString
'Retrieves a string value from a specified key.
'Use HKEY_CURRENT_USER etc. for hive
'Returns an empty string if it fails.
'---------------------------------------------------------------------
Public Function GetRegistryString(ByVal hive As Long, ByVal strKey As String, ByVal strValueName As String) As String

    Dim strBuffer As String, strMsg As String
    Dim lngRetVal As Long
    Dim lngValueType As Long
    Dim lngValueLength As Long
    Dim lngKey As LongPtr

    'Open the existing key.
    lngKey = OpenKey(hive, strKey)
    If lngKey <> 0 Then

        ' get the required buffer size
        lngRetVal = RegQueryValueExNULL(lngKey, strValueName, 0&, lngValueType, 0&, lngValueLength)

        ' create a byte buffer. Using a string buffer results in a failed call to RegQueryValueExString
        ' and crashes PowerPoint
        Dim strBufferUnicode() As Byte
        ReDim strBufferUnicode(lngValueLength + 2)

        ' get the regkey
        lngRetVal = RegQueryValueExString(lngKey, strValueName, 0&, lngValueType, strBufferUnicode(0), lngValueLength)

        If lngRetVal = ERROR_SUCCESS Then
            If lngValueType = REG_SZ Then
                ' convert from byte array to string
                strBuffer = left(StrConv(strBufferUnicode, vbUnicode), lngValueLength - 1)
                strBuffer = Trim(strBuffer)
            Else
                strBuffer = ""
            End If
        Else
            strBuffer = ""
        End If

        'Call the API function to close the key (ignore errors)
       lngRetVal = RegCloseKey(lngKey)
    End If

    GetRegistryString = strBuffer
End Function

' Sets the indicated registry value, creating the key if necessary
Public Sub SetRegistryString(ByVal hive As Long, ByVal strKeyName As String, ByVal strValueName As String, ByVal vValueSetting As Variant)

    Dim lRetVal As Long  'result of the SetValueEx function
    Dim hKey As LongPtr     'handle of open key
    Dim lngDisp As Long  'whether an existing key was opened or a new one created
    Dim sam As Long

    If hive = HKEY_LOCAL_MACHINE Then
        sam = KEY_WRITE Or KEY_WOW64_32
    Else
        sam = KEY_WRITE
    End If

    'open the specified key
    lRetVal = RegCreateKeyEx(hive, strKeyName, 0, 0, REG_OPTION_NON_VOLATILE, sam, 0, hKey, lngDisp&)

    If lRetVal <> ERROR_SUCCESS Then
        hKey = 0
    Else
        Dim strValueSetting As String
        strValueSetting = vValueSetting & Chr$(0)
        RegSetValueExString hKey, strValueName, 0&, REG_SZ, strValueSetting, Len(strValueSetting)
        RegCloseKey (hKey)
    End If

End Sub

VBA File Name: ThisDocument.cls, Stream Size: 1188

General
Stream Path:	VBA/ThisDocument
VBA File Name:	ThisDocument.cls
Stream Size:	1188
Data ASCII:	. . . . . . . . . Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . p . . . . . , k . . . . o F . k . . . . . . . . . . . . . . . . . . . . . F . . . . . . . . . . . . . . . . . . . . . F & . . . o C . M ! . . v l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . F & . . . o C . M ! . . v l . , k . . . . o F . k . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 00 01 00 00 5a 03 00 00 e4 00 00 00 10 02 00 00 88 03 00 00 96 03 00 00 ea 03 00 00 00 00 00 00 01 00 00 00 1d 6f 15 de 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 70 00 ff ff 00 00 2c 6b f3 f3 c7 85 6f 46 80 6b 0d 9f 93 e7 dd e2 06 09 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: UIEnableDisable.bas, Stream Size: 52349

General
Stream Path:	VBA/UIEnableDisable
VBA File Name:	UIEnableDisable.bas
Stream Size:	52349
Data ASCII:	. . . . . . . . . z # . . . . . . . . . . . . . . . & . . R . . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 7a 23 00 00 d4 00 00 00 08 04 00 00 ff ff ff ff 8a 26 00 00 52 98 00 00 00 00 00 00 01 00 00 00 1d 6f 81 11 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 30 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UIEnableDisable"
'====================================================================
' (c) Copyright 1992-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/UIEnableDisableWord.bas 55    7/27/14 2:33p Johns $
'====================================================================
' This module is used to enable and disable the user interface elements
' for Word depending on the state of the selection.

' The following functions and subroutines must exist in the PowerPoint
' and Word versions of this module.
'
' NoDirectCall_IsEnabled
' UpdateState
' NoDirectCall_LocateSupertip
' Invalidate
' UpdatePre2007CommandBar

' a collection of long values which are used with a bit mask to
' store the enabled state for a particular button/menu item. It uses
' a string key of button id's (one of the mtbIDXXX constants)
Public buttonStates As Collection
' a collection of possible states (i.e. the States enumeration values)
Private DocumentStates As Collection
' a collection of boolean values whose key is a string version of each States enumeration
' This is used to store the values from the current UI update cycle
Public currentStatesCollection As Collection
' a collection of boolean values whose key is a string version of each States enumeration
' this is used to store the value from the previous UI update cycle
Private previousStatesCollection As Collection
' a collection of strings whose key is is a string version of each States enumeration
' each string represents what should be shown in the disabled state
Private superTipDisabledCollection As Collection
' a collection of strings whose key is a button ID
' each string represents what should be shown in the enabled state
Private superTipEnabledCollection As Collection


' tests to see if the application is in a state where it's ok to
' execute a particular command. If the button should be enabled,
' it returns true, otherwise false.
'
' buttonID must be one of the mtbIDXXX constants defined in UIDeclarations
Public Function NoDirectCall_IsEnabled(buttonID As String) As Boolean
    NoDirectCall_IsEnabled = True ' must be initialized to true

    On Error GoTo err

    ' make sure we are ready to run
    If InitializeStatesCollection = False Then
        ' if initialization fails, then we need to bail
        GoTo err
    End If

    ' iterate through each document state
    Dim aState
    For Each aState In DocumentStates
        ' use the aState bitmask against the value stored in buttonStates
        ' to determine if the state really applies
        If buttonStates(buttonID) And aState Then
            ' during each loop check the current state value and apply it to
            ' the result. Once the loop completes the NoDirectCall_IsEnabled value
            ' should reflect if the button/menu item should be enabled
            NoDirectCall_IsEnabled = NoDirectCall_IsEnabled And currentStatesCollection(CStr(aState))
        End If
    Next
    Exit Function
err:
    ' failure results in a disabled button
    NoDirectCall_IsEnabled = False
End Function

' this function is called to update the currentStatesCollection with the
' current state. It does this by setting a boolean value for a given state.
'
' For example, the States.IsDocumentOpen enumeration value is used as a key,
' and the value associated with this key is the result of Not (Documents.Count = 0)
'
' the function returns false if the current state is the same as the previous state
' and true if the state has really changed
Public Function UpdateState() As Boolean

    WriteLog "UpdateState start"

    UpdateState = False

    On Error GoTo err

    ' make sure all fof the necessary collections are built
    If InitializeStatesCollection = False Then
        ' if initialization fails, we need to bail out
        GoTo err
    End If

    ' Most of the commands used here require an active document
    Dim hasDocuments As Boolean
    ' we reuse this value over and over as the result of checking some state
    Dim temp As Boolean

    hasDocuments = Not (Documents.Count = 0)

    ' always enable state must always be set to true
    temp = True
    UpdateCollection currentStatesCollection, States.AlwaysEnable, temp

    'temp =
    'UpdateCollection currentStatesCollection, States.CheckSectionNumber, temp

    ' is document open state has the same value as the hasDocuments so just reuse it
    temp = hasDocuments
    UpdateCollection currentStatesCollection, States.IsDocumentOpen, temp

    If hasDocuments Then
        temp = ActiveDocument.saved And Len(ActiveDocument.path) > 0 And Not (ActiveDocument.ReadOnly)
    Else
        temp = False
    End If
    UpdateCollection currentStatesCollection, States.MathPageOK, temp

    ' make sure a document is open first before attempting to use a command
    ' many of the following states do the same thing
    If hasDocuments Then
        temp = ActiveDocument.Bookmarks.Exists("MTReference")
    Else
        temp = False
    End If
    UpdateCollection currentStatesCollection, States.MTReferenceExists, temp

    If hasDocuments Then
        temp = Not (Application.ActiveWindow.Selection.StoryType = wdTextFrameStory)
    Else
        temp = False
    End If
    UpdateCollection currentStatesCollection, States.SelectionInTextBox, temp

    If hasDocuments Then
        temp = IsNotInReadingView()
    End If
    UpdateCollection currentStatesCollection, States.NotInReadingView, temp

    ' Warning: there appears to be a bug in pre-2007 versions of Word whereby
    ' accessing the read-only Selection.Information(wdXXX) method causes a
    ' DocumentChange event to fire.   Consequently, it is important that the
    ' App_DocumentChange event handler be fast, and that it does not indirectly
    ' invoke another call to UpdateState, or an infinite loop ensues.  See MT-1159
    If hasDocuments Then
        temp = Not (Application.ActiveWindow.Selection.Information(wdInCommentPane))
    Else
        temp = False
    End If
    UpdateCollection currentStatesCollection, States.Word97SelectionInCommentPane, temp

    If hasDocuments Then
        temp = Not (Application.ActiveWindow.Selection.Information(wdInFootnoteEndnotePane))
    Else
        temp = False
    End If
    UpdateCollection currentStatesCollection, States.Word97SelectionInFootnoteEndnotePane, temp

    If hasDocuments Then
        temp = Not (Application.ActiveWindow.Selection.Information(wdInHeaderFooter))
    Else
        temp = False
    End If
    UpdateCollection currentStatesCollection, States.Word97SelectionInHeaderFooter, temp

    If hasDocuments Then
        If Val(Application.version) = kWordX Then
            temp = IsWordXPActiveWindowViewSplitSpecial()
        Else
            temp = False
        End If
    Else
        temp = False
    End If
    UpdateCollection currentStatesCollection, States.WordXPActiveWindowViewSplitSpecial, temp


    temp = IsFullFunctionality
    UpdateCollection currentStatesCollection, States.IsFunctionalityOK, temp

    temp = IsNotUnsupportedView
    UpdateCollection currentStatesCollection, States.NotInUnsupportedView, temp

    ' now check the previous state with the current state to see if we should allow
    ' an update of the UI
    Dim aState
    For Each aState In DocumentStates
        If previousStatesCollection(CStr(aState)) <> currentStatesCollection(CStr(aState)) Then
            UpdateState = True
            Exit For
        End If
    Next

    ' update the previous state with the current state
    Dim aStateLong As Long
    For Each aState In DocumentStates
        aStateLong = aState
        UpdateCollection previousStatesCollection, aStateLong, currentStatesCollection(CStr(aStateLong))
    Next

    WriteLog "UpdateState end"

    Exit Function
err:
    ' if error occurs, then we can't be sure if the previous and new states are different
    ' so just return false so no further action is taken
    WriteLog "UpdateState error"
    UpdateState = False
End Function

' This function determines the super tip for a button
' It is nearly the same as NoDirectCall_IsEnabled, but it creates a string
' that partially describes the reason for the disabled state,
' or an empty string if the button is enabled
Public Function NoDirectCall_LocateSupertip(id As String) As String
    Dim disabledString As String

    On Error GoTo err

    disabledString = GetDisabledString(id)

    NoDirectCall_LocateSupertip = superTipEnabledCollection(id)

    ' For MTW6, we only set the supertip based on app functionality, since we aren't actually
    ' disabling buttons based on document state
    Dim isEnabled
    isEnabled = NoDirectCall_GenEnabledByAppFunctionality(id)
    If Not isEnabled Then
        If Len(NoDirectCall_LocateSupertip) <> 0 Then
            NoDirectCall_LocateSupertip = NoDirectCall_LocateSupertip & vbNewLine & vbNewLine
        End If
        NoDirectCall_LocateSupertip = NoDirectCall_LocateSupertip & GetUserString("!3000This button is disabled because: ") & disabledString & "."
    End If
    Exit Function
err:
    NoDirectCall_LocateSupertip = ""
End Function

Public Function GetDisabledString(id As String)
    Dim aCurrentState As Boolean

    On Error GoTo err

    ' make sure we are ready to run
    If InitializeStatesCollection = False Then
        ' if initialization fails, then we need to bail
        GoTo err
    End If

    ' We handle IsFunctionalityOK and IsDocumentOpen as special cases
    ' since when they hold, they should be the only reason given for being disabled
    If buttonStates(id) And States.IsFunctionalityOK Then
        If currentStatesCollection(CStr(States.IsFunctionalityOK)) = False Then
            GetDisabledString = superTipDisabledCollection(CStr(States.IsFunctionalityOK))
            Exit Function
        End If
    End If
    ' We also handle protected view as a special case. Note we check IsNotUnsupportedView()
    ' directly, since currentStatesCollection is not dependably updated in protected view
    ' We would need to add event listeners for protected view activation/open events and
    ' rewrite much of UpdateStates for protected view windows.
    If buttonStates(id) And States.NotInUnsupportedView Then
        If IsNotUnsupportedView() = False Then
            GetDisabledString = superTipDisabledCollection(CStr(States.NotInUnsupportedView))
            Exit Function
        End If
    End If
    If buttonStates(id) And States.IsDocumentOpen Then
        If currentStatesCollection(CStr(States.IsDocumentOpen)) = False Then
            GetDisabledString = superTipDisabledCollection(CStr(States.IsDocumentOpen))
            Exit Function
        End If
    End If

    ' iterate through each document state
    Dim aState
    For Each aState In DocumentStates
        ' use the aState bitmask against the value stored in buttonStates
        ' to determine if the state really applies
        If buttonStates(id) And aState Then
            ' during each loop check the current state value and apply it to
            ' the result. Once the loop completes the IsEnabled value
            ' should reflect if the button/menu item should be enabled
            aCurrentState = currentStatesCollection(CStr(aState))
            If aCurrentState = False Then
                    ' add to the disabled string
                If GetDisabledString <> "" Then
                    GetDisabledString = GetDisabledString & ", " & superTipDisabledCollection(CStr(aState))
                    Else
                    GetDisabledString = superTipDisabledCollection(CStr(aState))
                    End If
                End If
            End If
    Next
    Exit Function
err:
    GetDisabledString = ""
End Function


Private Function IsNotInReadingView() As Boolean
    IsNotInReadingView = Not (ActiveWindow.View.Type = wdReadingView)
End Function

Private Function IsWordXPActiveWindowViewSplitSpecial() As Boolean
    IsWordXPActiveWindowViewSplitSpecial = Not (ActiveDocument.ActiveWindow.View.SplitSpecial = wdPaneRevisions And                     ActiveDocument.ActiveWindow.ActivePane.index > 1)
End Function

' called by the MTW5 class to inform the ribbon to update itself
' by initiating call backs to determine enable/disable state of buttons
Public Sub Invalidate()
    If Not IsEmpty(gMTRibbon) Then
        If Not (gMTRibbon Is Nothing) Then
            gMTRibbon.Invalidate
        End If
    End If
End Sub

' called by the MTW5 class to initiate an update of the CommandBars
' (i.e. menu items and buttons) to determine their enable/disable state
Public Sub UpdatePre2007CommandBar()

    WriteLog "UpdatePre2007CommandBar start"

    Dim MTToolbar As CommandBar
    Dim cb As CommandBar
    Dim cbc As CommandBarControl
    Dim foundMenuBar As Boolean
    Dim foundMathType As Boolean
    foundMenuBar = False
    foundMathType = False

    On Error GoTo errHandler
    Dim i As Long
    For i = 1 To CommandBars.Count
        Set cb = CommandBars(i)
        If Not (cb Is Nothing) And (cb.name = "Menu Bar" Or cb.name = "MathType") Then

            WriteLog "cb.Name: " & cb.name
            If cb.name = "Menu Bar" Then foundMenuBar = True
            If cb.name = "MathType" Then foundMathType = True

            UpdatePre2007UIItem cb, mtbIDBrowseNext
            UpdatePre2007UIItem cb, mtbIDBrowsePrev
            UpdatePre2007UIItem cb, mtbIDBrowseType
            UpdatePre2007UIItem cb, mtbIDConvertEqns
            UpdatePre2007UIItem cb, mtbIDTeXToggle
            UpdatePre2007UIItem cb, mtbIDEquationReference
            UpdatePre2007UIItem cb, mtbIDExportEqns
            UpdatePre2007UIItem cb, mtbIDFormatEqnNums
            UpdatePre2007UIItem cb, mtbIDFormatEqns
            UpdatePre2007UIItem cb, mtbIDFutureMT
            UpdatePre2007UIItem cb, mtbIDHelp
            UpdatePre2007UIItem cb, mtbIDHelpAboutMT
            UpdatePre2007UIItem cb, mtbIDHelpContents
            UpdatePre2007UIItem cb, mtbIDHelpMTInWord
            UpdatePre2007UIItem cb, mtbIDInsHandEqn

            Set cbc = UpdatePre2007UIItem(cb, mtbIDHelpUnlockReg)
            If Not (cbc Is Nothing) Then
                cbc.Caption = RunUICallback("NoDirectCall_GetUnlockUI")
            End If
            UpdatePre2007UIItem cb, mtbIDInsDispMTEqn
            UpdatePre2007UIItem cb, mtbIDInsDispMTEqnLeftNum
            UpdatePre2007UIItem cb, mtbIDInsDispMTEqnRightNum
            UpdatePre2007UIItem cb, mtbIDInsertNextChapter
            UpdatePre2007UIItem cb, mtbIDInsertNextSection
            UpdatePre2007UIItem cb, mtbIDInsertNumber
            UpdatePre2007UIItem cb, mtbIDInsInlineMTEqn
            UpdatePre2007UIItem cb, mtbIDMathPage
            UpdatePre2007UIItem cb, mtbIDModifyBreak
            UpdatePre2007UIItem cb, mtbIDMoreBreaks
            UpdatePre2007UIItem cb, mtbIDOMMathPage
            UpdatePre2007UIItem cb, mtbIDSetEqnPrefs
            UpdatePre2007UIItem cb, mtbIDUpdateEqnNums
            UpdatePre2007UIItem cb, mtbIDWeb
            UpdatePre2007UIItem cb, mtbIDWebEmailFeedback
            UpdatePre2007UIItem cb, mtbIDWebHomePage
            UpdatePre2007UIItem cb, mtbIDWebOrderMT
            UpdatePre2007UIItem cb, mtbIDWebSupport
            UpdatePre2007UIItem cb, mtbIDInsHandEqn
            UpdatePre2007UIItem cb, mtbIDMTOptions
            UpdatePre2007UIItem cb, mtbIDSpeak
        End If
    Next

    WriteLog "  foundMenuBar: " & foundMenuBar
    WriteLog "  foundMathType: " & foundMathType

finalize:
    On Error GoTo abort:
    Dim aTemplate As Template
    For Each aTemplate In Templates
        If aTemplate.name = MacroContainer.name Then
            aTemplate.saved = True
            Exit For
        End If
    Next

    WriteLog "UpdatePre2007CommandBar end"
    Exit Sub

errHandler:
    WriteLog "UpdatePre2007CommandBar error"
    Resume finalize

abort:
    WriteLog "UpdatePre2007CommandBar error"
End Sub

Private Function UpdatePre2007UIItem(cmdBar As CommandBar, id As String) As CommandBarControl

    'WriteLog "  UpdatePre2007UIItem start"
    On Error GoTo errHandler

    Dim cbc As CommandBarControl
    Set cbc = cmdBar.FindControl(id:=1, tag:=id, Recursive:=True)
    Set UpdatePre2007UIItem = cbc
    If Not (cbc Is Nothing) Then
        cbc.enabled = RunUICallback("NoDirectCall_GenEnabledByAppFunctionality", id)
        If (id = mtbIDInsHandEqn) Then
            WriteLog "GenEnabledByAppFunctionality set cbc.enbled to " & cbc.enabled
            ' Disable no matter what if the MIP isn't there
            Dim impa As Boolean
            impa = IsMathInputPanelAvailable
            WriteLog "Call to IsMathInputPanelAvailable returned " & impa
            If Not impa Then cbc.enabled = False
            WriteLog "Final value of cbc.enabled is " & cbc.enabled
            Exit Function
        End If
    End If

    'WriteLog "  UpdatePre2007UIItem end"

    Exit Function

errHandler:
    WriteLog "  UpdatePre2007UIItem error"

End Function

' this subroutine makes sure that the various state collections are populated with data
' returns true if no errors happened, false otherwise
Public Function InitializeStatesCollection() As Boolean
    InitializeStatesCollection = True ' default to success
    On Error GoTo err
    ' setup a collection with nothing more than the values found in the states enumeration
    If DocumentStates Is Nothing Then
        Set DocumentStates = New Collection
        DocumentStates.Add States.AlwaysEnable
        DocumentStates.Add States.IsDocumentOpen
        DocumentStates.Add States.MathPageOK
        DocumentStates.Add States.MTReferenceExists
        DocumentStates.Add States.SelectionInTextBox
        DocumentStates.Add States.NotInReadingView
        DocumentStates.Add States.Word97SelectionInCommentPane
        DocumentStates.Add States.Word97SelectionInFootnoteEndnotePane
        DocumentStates.Add States.Word97SelectionInHeaderFooter
        DocumentStates.Add States.WordXPActiveWindowViewSplitSpecial
        DocumentStates.Add States.IsFunctionalityOK
        DocumentStates.Add States.NotInUnsupportedView
    End If

    ' setup the current and previous states to dummy values if needed
    If currentStatesCollection Is Nothing Then
        Set currentStatesCollection = New Collection
        currentStatesCollection.Add False, CStr(States.AlwaysEnable)
        currentStatesCollection.Add False, CStr(States.IsDocumentOpen)
        currentStatesCollection.Add False, CStr(States.MathPageOK)
        currentStatesCollection.Add False, CStr(States.MTReferenceExists)
        currentStatesCollection.Add False, CStr(States.SelectionInTextBox)
        currentStatesCollection.Add False, CStr(States.NotInReadingView)
        currentStatesCollection.Add False, CStr(States.Word97SelectionInCommentPane)
        currentStatesCollection.Add False, CStr(States.Word97SelectionInFootnoteEndnotePane)
        currentStatesCollection.Add False, CStr(States.Word97SelectionInHeaderFooter)
        currentStatesCollection.Add False, CStr(States.WordXPActiveWindowViewSplitSpecial)
        currentStatesCollection.Add False, CStr(States.IsFunctionalityOK)
        currentStatesCollection.Add False, CStr(States.NotInUnsupportedView)
    End If
    If previousStatesCollection Is Nothing Then
        Set previousStatesCollection = New Collection
        previousStatesCollection.Add False, CStr(States.AlwaysEnable)
        previousStatesCollection.Add False, CStr(States.IsDocumentOpen)
        previousStatesCollection.Add False, CStr(States.MathPageOK)
        previousStatesCollection.Add False, CStr(States.MTReferenceExists)
        previousStatesCollection.Add False, CStr(States.SelectionInTextBox)
        previousStatesCollection.Add False, CStr(States.NotInReadingView)
        previousStatesCollection.Add False, CStr(States.Word97SelectionInCommentPane)
        previousStatesCollection.Add False, CStr(States.Word97SelectionInFootnoteEndnotePane)
        previousStatesCollection.

VBA File Name: UIEnableDisable2010.bas, Stream Size: 3662

General
Stream Path:	VBA/UIEnableDisable2010
VBA File Name:	UIEnableDisable2010.bas
Stream Size:	3662
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 12 06 00 00 d4 00 00 00 d8 01 00 00 ff ff ff ff ef 06 00 00 bb 0b 00 00 00 00 00 00 01 00 00 00 1d 6f e5 65 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UIEnableDisable2010"
'====================================================================
' (c) Copyright 2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/OfficeVersion/2010/UIEnableDisableWord2010.bas 1     10/11/11 2:05p Jimm $
'====================================================================

Public Function IsNotUnsupportedView() As Boolean

#If Win32 Then
    IsNotUnsupportedView = (ActiveProtectedViewWindow Is Nothing)
#Else
    IsNotUnsupportedView = True
    If (ActiveWindow.View = wdNotesView Or ActiveWindow.View = wdPublishingView) Then
        IsNotUnsupportedView = False
    End If
#End If
        
End Function

Public Function NoDirectCall_GenEnabledByAppFunctionality(id As String) As Boolean
    
    NoDirectCall_GenEnabledByAppFunctionality = True

    If buttonStates Is Nothing Then
        InitializeStatesCollection
    End If
    
#If Win32 Then
    If buttonStates(id) And NotInUnsupportedView Then
        If Not Application.ActiveProtectedViewWindow Is Nothing Then
            NoDirectCall_GenEnabledByAppFunctionality = False
            Exit Function
        End If
    End If
#End If
    
    If buttonStates(id) And IsFunctionalityOK Then
        NoDirectCall_GenEnabledByAppFunctionality = currentStatesCollection(CStr(IsFunctionalityOK))
    End If
    
End Function

VBA File Name: UIHelp.bas, Stream Size: 14098

General
Stream Path:	VBA/UIHelp
VBA File Name:	UIHelp.bas
Stream Size:	14098
Data ASCII:	. . . . . . . . . " . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 22 16 00 00 d4 00 00 00 d8 01 00 00 ff ff ff ff fd 16 00 00 c1 2e 00 00 00 00 00 00 01 00 00 00 1d 6f be c5 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UIHelp"
'====================================================================
' (c) Copyright 1992-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/UIHelp.bas 25    9/17/12 1:21p Jimm $
'====================================================================
' This module is dedicated to help related functionality
' It is shared between word and powerpoint

' Note: * all functions/subs that start with MTCommand_ are "top-level" entry points called from
'         OnAction handlers (e.g. buttons, menu items, etc).
'       * all functions/subs that start with MTCallback_ are are called by
'         Word 2007 as needed to refresh the Ribbon UI
'       * all functions/subs that start with NoDirectCall_
'          MUST NOT BE CALLED except via a RunXXX command

'URL codes - also see MTDeclarations.bas mturl's
Public Const mturlMATHTYPE_HOME As Long = 1
Public Const mturlMATHTYPE_SUPPORT As Long = 2
Public Const mturlMATHTYPE_FEEDBACK As Long = 3
Public Const mturlMATHTYPE_ORDER As Long = 4
Public Const mturlMATHTYPE_FUTURE As Long = 5
Public Const mturlMATHTYPE_REGISTER As Long = 6

'Constants for use in Help calls from dialogs
Public Const hlpMSWDMathType_Support_For_Word = 101

#If Win32 Then
Public Const hlpMSWDMathType_Support_For_Word_2007 = 102
#Else
Public Const hlpMSWDMathType_Support_For_Word_2007 = 3200
#End If

Public Const hlpMSWDMathType_Support_For_PP = 1

#If Win32 Then
Public Const hlpMSWDMathType_Support_For_PP_2007 = 3
#Else
Public Const hlpMSWDMathType_Support_For_PP_2007 = 3202
#End If

#If Win32 Then
Public Const hlpMSWDUnlock_MathType = 165
#Else
Public Const hlpMSWDUnlock_MathType = 195
#End If

Private Const module As String = "UIHelp"
Private Const moduleCLS As String = "UIHelpCls"

'Runs MathType Help
Public Sub MTCommand_ShowHelpContents()
#If Win32 Then
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowHelpContents", True, mtbIDHelpContents
#Else
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowHelpContents", True
#End If
End Sub

Public Sub MTCommand_ShowHelpMTInWord()
#If Win32 Then
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowHelpMTInWord", True, mtbIDHelpMTInWord
#Else
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowHelpMTInWord", True
#End If
End Sub

Public Sub MTCommand_ShowUnlockReg()
#If Win32 Then
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowUnlockReg", True, mtbIDHelpUnlockReg
#Else
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowUnlockReg", True
#End If
End Sub

' *** web help code ***

Public Sub MTCommand_ShowWebHomePage()
#If Win32 Then
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowWebHomePage", True, mtbIDWebHomePage
#Else
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowWebHomePage", True
#End If
End Sub

Public Sub MTCommand_ShowWebSupport()
#If Win32 Then
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowWebSupport", True, mtbIDWebSupport
#Else
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowWebSupport", True
#End If
End Sub

Public Sub MTCommand_ShowWebEmailFeedback()
#If Win32 Then
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowWebEmailFeedback", True, mtbIDWebEmailFeedback
#Else
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowWebEmailFeedback", True
#End If
End Sub

Public Sub MTCommand_ShowWebOrderMathType()
#If Win32 Then
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowWebOrderMathType", True, mtbIDWebOrderMT
#Else
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowWebOrderMathType", True
#End If
End Sub

Public Sub MTCommand_ShowFutureMT()
#If Win32 Then
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowFutureMT", True, mtbIDFutureMT
#Else
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowFutureMT", True
#End If
End Sub

' *** misc help code ***

Public Sub MTCommand_ShowAboutMT()
#If Win32 Then
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowAboutMT", True, mtbIDHelpAboutMT
#Else
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowAboutMT", True
#End If
End Sub

' called from UIEnableDisable and UIRibbon
Public Function NoDirectCall_GetUnlockUI() As String
    ' note: we changed the UI to combine unlock and registration
    ' we are keeping the old code (following this line) around just in case we want to switch back
    NoDirectCall_GetUnlockUI = GetUserString2("3103", "3104", "U&nlock/Register MathType...")

    'Dim result As Long
    'result = MTGetAppFunctionality
    'If result = DemoMode.dmFull Then
    '    NoDirectCall_GetUnlockUI = GetUserString("!1896O&nline Registration...")
    'Else
    '    NoDirectCall_GetUnlockUI = GetUserString("!1838U&nlock MathType...")
    'End If

    ' Office 12 and greater does not need a keyboard mnemonic
    If Val(Application.version) >= kWord2007 Then
        #If Mac And PP Then
        NoDirectCall_GetUnlockUI = ReplaceSubstring(NoDirectCall_GetUnlockUI, "&", "")
        #Else
        NoDirectCall_GetUnlockUI = replace(NoDirectCall_GetUnlockUI, "&", "")
        #End If
    End If
End Function

Public Function NoDirectCall_GetUnlockScreenTipUI() As String
    ' note: we changed the UI to combine unlock and registration
    ' we are keeping the old code (following this line) around just in case we want to switch back
    NoDirectCall_GetUnlockScreenTipUI = GetUserString("!3102Unlock/Register MathType")

    'Dim result As Long
    'result = MTGetAppFunctionality
    'If result = DemoMode.dmFull Then
    '    NoDirectCall_GetUnlockScreenTipUI = GetUserString("!3101Register MathType")
    'Else
    '    NoDirectCall_GetUnlockScreenTipUI = GetUserString("!3100Unlock MathType")
    'End If
End Function

VBA File Name: UIHelpCls.cls, Stream Size: 18413

General
Stream Path:	VBA/UIHelpCls
VBA File Name:	UIHelpCls.cls
Stream Size:	18413
Data ASCII:	. . . . . . . . . . . . . . . . . ( . . . . . . . . . . . . : . . . . . . . . . . . o . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . _ # a . 5 S K . . . . . h . . * = . . . . h . . 8 . . + 3 q . . . . . . . . . . . . . . . . . . . . . { . S . . g . @ . . L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . { . S . . g . @ . . L . . . . . . _ # a . 5 S K . . . . . h . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 00 01 00 00 c2 1d 00 00 e4 00 00 00 28 03 00 00 bf 1f 00 00 cd 1f 00 00 99 3a 00 00 00 00 00 00 01 00 00 00 1d 6f 18 70 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 80 00 ff ff 00 00 91 5f 23 61 f5 35 53 4b ab 0e 18 10 fd 68 ad 9c 2a 3d fb fc fa a0 68 10 a7 38 08 00 2b 33 71 b5 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UIHelpCls"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

'=====================================================================
' (c) Copyright 2007-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/UIHelpCls.cls 16    10/11/11 2:12p Jimm $
'=====================================================================

Private m_lError As Long
Private m_sError As String

' module name
Private Const module As String = "UIHelpCls"


' Expose the error description
' This error number is required because the CallByName
' function does not return the correct error
Public Property Get ErrorDescription() As String
    ErrorDescription = m_sError
End Property

' Expose the error number
' This error number is required because the CallByName
' function does not return the correct error
Public Property Get ErrorNumber() As Long
    ErrorNumber = m_lError
End Property

Public Sub NoDirectCall_ShowHelpContents()
    ShowHelpTopic 0
    MTIncrementStatisticBy "HCts", 1
End Sub

Public Sub NoDirectCall_ShowHelpMTInWord()
    If Application.name = kAppMSW Then
        If Val(Application.version) <= kWord2003 Then
            ShowHelpTopic hlpMSWDMathType_Support_For_Word
        Else
            ShowHelpTopic hlpMSWDMathType_Support_For_Word_2007
        End If
    ElseIf Application.name = kAppMSPP Then
        If Val(Application.version) <= kPP2003 Then
            ShowHelpTopic hlpMSWDMathType_Support_For_PP
        Else
            ShowHelpTopic hlpMSWDMathType_Support_For_PP_2007
        End If
    End If

    MTIncrementStatisticBy "HWrd", 1
End Sub

Public Sub NoDirectCall_ShowUnlockReg()
    ' note: we changed the UI to combine unlock and registration
    ' we are keeping the old code (following this line) around just in case we want to switch back
    ShowHelpTopic hlpMSWDUnlock_MathType

    'Dim result As Long

    'result = MTGetAppFunctionality

    'If result = DemoMode.dmFull Then
    '    result = MTGetURL(mturlMATHTYPE_REGISTER, True, "", 0)
    'Else
    '    ShowHelpTopic hlpMSWDUnlock_MathType
    'End If
End Sub


'Opens the MathType Help file to a particular topic
'topic = help constant from HELP.H (0 for index)
Private Sub ShowHelpTopic(topic As Long)

    SetPreference HKEY_CURRENT_USER, mtreg_MT_WORDCMDS_LOCATION, "HelpTopicArgument", str(topic)

    #If Word Then
        RunDispatch "", kMTCommands & ".MTHelp.MTHelpTopicViaRegistry", False
    #Else
            MTHelp.MTHelpTopicViaRegistry
    #End If

End Sub

Public Sub NoDirectCall_ShowWebHomePage()
    Dim result As Long
    result = MTGetURL(mturlMATHTYPE_HOME, True, "", 0)
End Sub

Public Sub NoDirectCall_ShowWebSupport()
    Dim result As Long
    result = MTGetURL(mturlMATHTYPE_SUPPORT, True, "", 0)
End Sub

Public Sub NoDirectCall_ShowWebEmailFeedback()
    If Application.name = kAppMSPP Then
        ShowWebEmailFeedbackPP
    ElseIf Application.name = kAppMSW Then
        ShowWebEmailFeedbackWord
    End If
End Sub

Private Sub ShowWebEmailFeedbackPP()
    #If PP Then

    Dim address As String
    Dim subject As String
    Dim prezo As Presentation
    Dim useTempDoc As Boolean
    Dim argumentsPosition
    Dim argumentsPresent As Boolean

    useTempDoc = Application.Presentations.Count = 0
    address = GetAddress(mturlMATHTYPE_FEEDBACK)

    ' test for URL arguments by looking for a question mark
    argumentsPresent = InStr(1, address, "?", vbTextCompare) > 0

    subject = "MathType feedback"
    If useTempDoc Then
        Set prezo = Presentations.Add
    Else
        Set prezo = ActivePresentation
    End If

    If argumentsPresent Then
        ' since arguments are present, just append the subject
        prezo.FollowHyperlink address & "&subject=" & subject
    Else
        ' since there are no arguments, add the argument char followed by the subject
        prezo.FollowHyperlink address & "?subject=" & subject
    End If
    If useTempDoc Then
        prezo.Close
    End If

    #End If
End Sub

Private Sub ShowWebEmailFeedbackWord()
    #If Word Then
    Dim address As String
    Dim subject As String
    Dim Doc As Document
    Dim useTempDoc As Boolean
    Dim argumentsPosition
    Dim argumentsPresent As Boolean

    useTempDoc = Application.Documents.Count = 0
    address = GetAddress(mturlMATHTYPE_FEEDBACK)

    ' test for URL arguments by looking for a question mark
    argumentsPresent = InStr(1, address, "?", vbTextCompare) > 0

    subject = "MathType feedback"
    If useTempDoc Then
        Set Doc = Documents.Add
    Else
        Set Doc = ActiveDocument
    End If

    If argumentsPresent Then
        ' since arguments are present, just append the subject
        Doc.FollowHyperlink address & "&subject=" & subject
    Else
        ' since there are no arguments, add the argument char followed by the subject
        Doc.FollowHyperlink address & "?subject=" & subject
    End If
    If useTempDoc Then
        Doc.Close False
    End If
    #End If
End Sub

Public Sub NoDirectCall_ShowWebOrderMathType()
    Dim result As Long
    result = MTGetURL(mturlMATHTYPE_ORDER, True, "", 0)
End Sub

Public Sub NoDirectCall_ShowFutureMT()
    Dim result As Long
    result = MTGetURL(mturlMATHTYPE_FUTURE, True, "", 0)
End Sub

Private Function GetAddress(whichURL As Long) As String
    On Error GoTo bye
    Dim buffer As String
    Dim bufLen As Long
    Dim result As Long

    GetAddress = ""
    ' set the buffer length to zero for the first pass
    bufLen = 0


    ' get back the length for the URL first which comes as the result of
    ' calling this function with a bufLen of zero
    result = MTGetURL(whichURL, False, buffer, bufLen)
    If result >= 0 Then ' negative values indiacate an error
        bufLen = result + 1
        ' initalize the buffer with spaces
        buffer = Space$(bufLen)

        ' call again, but this time we send in the buffer length
        result = MTGetURL(whichURL, False, buffer, bufLen)
        If result = mtOK Then
            buffer = left(buffer, bufLen - 1)
            GetAddress = buffer
        End If
    End If
    Exit Function
bye:
    ' First, pass along any DSI_ABORT_EXCEPTIONs to be caught by the top-level handler
    If err.Number = DSI_ABORT_EXCEPTION Then
        err.Raise DSI_ABORT_EXCEPTION 'leaves other Err data intact
    Else
        ' handle unexpected error by displaying message, log error, throw DSI private error
        Asserts.AssertFailure module, "GetAddress", err.Description
    End If
End Function

Public Sub NoDirectCall_ShowAboutMT()
    Dim result As Long
    result = MTShowAboutBox
End Sub

VBA File Name: UILib.bas, Stream Size: 62406

General
Stream Path:	VBA/UILib
VBA File Name:	UILib.bas
Stream Size:	62406
Data ASCII:	. . . . . . . . . . l . . . . . . . . . . . . . . U q . . . . . . . . . . . . . . . o . T . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . p . . . 8 . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 a2 6c 00 00 d4 00 00 00 08 04 00 00 ff ff ff ff 55 71 00 00 e1 ca 00 00 00 00 00 00 01 00 00 00 1d 6f d4 54 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 20 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UILib"
'UILib 5.2
'====================================================================
' (c) Copyright 1992-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/UILib.bas 107   5/06/14 9:54a Jimm $
'====================================================================

' Note: * all functions/subs that start with MTCommand_ are "top-level" entry points called from
'         OnAction handlers (e.g. buttons, menu items, etc).
'       * all functions/subs that start with MTCallback_ are are called by
'         Word 2007 as needed to refresh the Ribbon UI
'       * all functions/subs that start with NoDirectCall_
'          MUST NOT BE CALLED except via a RunXXX command

' variable for dispatch class
Private cls

' module name
Private Const module As String = "UILib"
Private Const moduleCLS As String = "UILibCls"

' browse variables
Public browseChoice As Long
Public forward As Boolean

Public gMTEqnNumsOnRight As Boolean

Public Sub MTCommand_MTBrowseNext(Optional choice)
    If IsMissing(choice) Then
        browseChoice = -1
    End If
    forward = True
    RunMTDLLCommand moduleCLS, "NoDirectCall_Browse"
End Sub

Public Sub MTCommand_MTBrowsePrevious(Optional choice)
    If IsMissing(choice) Then
        browseChoice = -1
    End If
    forward = False
    RunMTDLLCommand moduleCLS, "NoDirectCall_Browse"
End Sub

'Runs Set Equation Reference command
Public Sub MTPlaceRef()
    RunMTDLLCommand "", kMTCommands & ".MTPlaceRef.Main", False
End Sub

'Runs Modify Chapter/Section Break command
Public Sub MTEditEquationSection()
    RunMTDLLCommand "", kMTCommands & ".MTFormatEquationSection.EditEquationSection", False
End Sub

'Runs Modify Chapter/Section Break command
Public Sub MTEditEquationSection2()
    RunMTDLLCommand "", kMTCommands & ".MTFormatEquationSection.EditEquationSection", False
End Sub

'Runs Modify Chapter/Section Break command
Public Sub MTEditEquationSection3()
    RunMTDLLCommand "", kMTCommands & ".MTFormatEquationSection.NewVersion", False
End Sub

'Runs Modify Chapter/Section Break command
Public Sub MTEditEquationSection4()
    RunMTDLLCommand "", kMTCommands & ".MTFormatEquationSection.NewVersion", False
End Sub

'Runs Modify Chapter/Section Break command
Public Sub MTEditEquationSection5()
    RunMTDLLCommand "", kMTCommands & ".MTFormatEquationSection.NewVersion", False
End Sub

'Runs Export All MathPage command
Public Sub ExportAllMathPage()
    RunMTDLLCommand "", kMTCommands & ".MathPage.ExportAll", False
End Sub

'Runs Export to MathPage command
Public Sub MTCommand_ExportMathPage()
    RunMTDLLCommand "", kMTCommands & ".MathPage.MP_ExportTo", False, mtbIDMathPage
End Sub

'Runs Set Equation Preferences command
Public Sub MTCommand_SetEqnPrefs()
    RunMTDLLCommand "", kMTCommands & ".MTSetEqnPrefs.Main", False, mtbIDSetEqnPrefs
End Sub

'Runs Insert Inline Equation command
Public Sub MTCommand_InsertInlineEqn()
    RunMTDLLCommand moduleCLS, "NoDirectCall_InsertInlineEqn", True, mtbIDInsInlineMTEqn
End Sub

'Runs Insert Display Equation command
Public Sub MTCommand_InsertDispEqn()
    RunMTDLLCommand moduleCLS, "NoDirectCall_InsertDispEqn", True, mtbIDInsDispMTEqn
End Sub

'Runs Insert Left-Numbered Display Equation command
Public Sub MTCommand_InsertLeftNumberedDispEqn()
    RunMTDLLCommand moduleCLS, "NoDirectCall_InsertLeftNumberedDispEqn", True, mtbIDInsDispMTEqnLeftNum
End Sub

'Runs Insert Right-Numbered Display Equation command
Public Sub MTCommand_InsertRightNumberedDispEqn()
    RunMTDLLCommand moduleCLS, "NoDirectCall_InsertRightNumberedDispEqn", True, mtbIDInsDispMTEqnRightNum
End Sub

'Runs Insert Left-Numbered Display Equation command
Public Sub MTCommand_InsertLeftNumberedDispEqnEB()
    RunMTDLLCommand moduleCLS, "NoDirectCall_InsertLeftNumberedDispEqnEB"
End Sub

'Runs Insert Right-Numbered Display Equation command
Public Sub MTCommand_InsertRightNumberedDispEqnEB()
    RunMTDLLCommand moduleCLS, "NoDirectCall_InsertRightNumberedDispEqnEB"
End Sub

'Runs Insert Equation Number command
Public Sub MTCommand_InsertEqnNum()
    RunMTDLLCommand moduleCLS, "NoDirectCall_InsertEqnNum", True, mtbIDInsertNumber
End Sub

'Runs Insert Equation Reference command
Public Sub MTCommand_InsertEqnRef()
    RunMTDLLCommand moduleCLS, "NoDirectCall_InsertEqnRef", True, mtbIDEquationReference
End Sub

'Runs Insert Equation Section command
Public Sub MTCommand_InsertSecNum()
    RunMTDLLCommand "", kMTCommands & ".MTSecNum.Main", False, mtbIDMoreBreaks
End Sub

'Runs Insert Equation Section command
Public Sub MTCommand_InsertNextSection()
    RunMTDLLCommand "", kMTCommands & ".MTSecNum.InsertNextSectionBreak", False, mtbIDInsertNextSection
End Sub

'Runs Insert Equation Section command
Public Sub MTCommand_InsertNextChapter()
    RunMTDLLCommand "", kMTCommands & ".MTSecNum.InsertNextChapterBreak", False, mtbIDInsertNextChapter
End Sub

'Runs Modify Equation Section command
Public Sub MTCommand_FormatEqnSec()
    RunMTDLLCommand "", kMTCommands & ".MTFormatEquationSection.Main", False, mtbIDModifyBreak
End Sub

'Runs Format Equation Numbers command
Public Sub MTCommand_FormatEqnNum()
    RunMTDLLCommand "", kMTCommands & ".MTEqnNumFormat.Main", False, mtbIDFormatEqnNums
End Sub

'Runs Format Equations command
Public Sub MTCommand_FormatEqns()
    RunMTDLLCommand "", kMTCommands & ".MTFormatEquations.Main", False, mtbIDFormatEqns
End Sub

'Runs Convert Equations command
Public Sub MTCommand_ConvertEqns()
    RunMTDLLCommand "", kMTCommands & ".MTConvertEquations.Main", False, mtbIDConvertEqns
End Sub

'Runs Export Equations command
Public Sub MTCommand_ExportEqns()
    RunMTDLLCommand "", kMTCommands & ".MTExportEquations.Main", False, mtbIDExportEqns
End Sub

'Runs Update Fields command
Public Sub MTCommand_UpdateEqns()
    RunMTDLLCommand moduleCLS, "NoDirectCall_UpdateEqns", True, mtbIDUpdateEqnNums
End Sub

Public Sub MTCommand_TeXToggle()
   RunMTDLLCommand "", kMTCommands & ".MTTeXToggle.Main", False, mtbIDTeXToggle
End Sub

Public Sub MTCommand_EditEquationOpen()
    RunMTDLLCommand "", kMTCommands & ".MTLib.MTEditEquationOpen", False
End Sub

Public Sub MTCommand_EditEquationInPlace()
    RunMTDLLCommand "", kMTCommands & ".MTLib.MTEditEquationInPlace", False
End Sub

Public Sub MTCommand_MathInputControl()
    RunMTDLLCommand "", kMTCommands & ".MTMathInputControl.Main", False
End Sub

Public Sub MTCommand_MTOptions()
    RunMTDLLCommand "", kMTCommands & ".MTOptions.Main", False, mtbIDMTOptions
End Sub

'Runs a synchronous command (requiring the DLL) inside an error handler
Public Sub RunMTDLLCommand(module As String, command As String, Optional isLocal As Boolean = True, Optional btnID As String = "")
    RunMTDLLCode module, command, "command", isLocal, btnID
End Sub

'Runs a asynchronous command (requiring the DLL) inside an error handler
Public Sub RunDocCallback(module As String, command As String, Optional isLocal As Boolean = True, Optional btnID As String = "")
    RunMTDLLCode module, command, "callback", isLocal, btnID
End Sub

'Runs code (requiring the DLL) inside an error handler with a guard
Private Sub RunMTDLLCode(module As String, command As String, calltype As String, Optional isLocal As Boolean = True, Optional btnID As String = "")
    On Error GoTo abort

    ' Instantiate the guard object
    Dim toplevelguard As Object
    If calltype = "callback" Then
        Set toplevelguard = New CallbackGuard
    Else
        Set toplevelguard = New CommandGuard
    End If

    If LoadMathTypeCommands() Then
        RunDispatch module, command, isLocal, btnID
    End If

    Exit Sub

abort:
    WriteLog "RunMTDLLCode error:" & module & ":" & command & ":" & calltype
    ' generic automation error
    If err.Number = 440 Then
        Dim errNum
        Dim errDesc

        If (Not cls Is Nothing) And (Not IsEmpty(cls)) Then
            errNum = cls.ErrorNumber
            errDesc = cls.ErrorDescription
        End If
        ' extract the real error from the class
        Asserts.LogAndAlert module, "RunMTDLLCode", errNum & " " & errDesc
    ElseIf err.Number <> DSI_ABORT_EXCEPTION Then
        Dim desc As String
        desc = err.Description
        ' We use AssertFailure to notify the end user of the unexpected exception
        ' and to log the error.  However, since AssertFailure raises another
        ' DSI_ABORT_EXCEPTION, we need to set things up to resume after the assert and exit
        Asserts.LogAndAlert module, "Error running cmd=" & command & " mod=" & module & " in RunMTDLLCommand", desc
    End If
    ' No action needed for DSI_ABORT_EXCEPTION errors
    ' Exiting the subroutine will clear the error
End Sub

' dispatches a command to its associated class
Public Sub RunDispatch(module As String, command As String, Optional isLocal As Boolean = True, Optional btnID As String = "")
    ' We used to enable/disable the UI controls based on document state.
    ' Now we just bail out and display an error message if we cannot
    ' run our commands due to an invalid document state
    ' note that an empty string for btnID skips checking
    If Len(btnID) <> 0 Then
        UpdateState
        If Not NoDirectCall_IsEnabled(btnID) Then
            Dim msg As String
            msg = GetDisabledString(btnID)
            If Len(msg) = 0 Then
                MsgBox "Unable to execute this command"
            Else
                MsgBox GetUserString("!3014This command cannot be executed because ") & msg
            End If
            Exit Sub
        End If
    End If

    If isLocal Then
        Select Case module
            Case "AutoExecCls"
                Set cls = New AutoExecCls
            Case "UIHelpCls"
                Set cls = New UIHelpCls
            Case "UILibCls"
                Set cls = New UILibCls
            Case "UIWrappersCls"
                Set cls = New UIWrappersCls
            Case "UIRibbonCls"
                Set cls = New UIRibbonCls
        End Select
        If (Not cls Is Nothing) And (Not IsEmpty(cls)) Then
            On Error GoTo CallError
               CallByName cls, command, VbMethod
            GoTo done
CallError:
            WriteLog "RunDispatch error (1):" & command
        End If
    Else
        If module <> "" Then
            Asserts.AssertFailure "UILib", "RunDispatch", "Can't dispatch to unkown module" & module
            WriteLog "RunDispatch error (2):" & command
        Else
            ' on the Mac, Application.Run is a Sub, not a Function
            #If Win32 Then
            command = replace(command, ".", "_", , , vbTextCompare)
            Set cls = Application.Run("new_MTCommandsDispatchClass")
            WriteLog "sanity checking cls"
            If (Not cls Is Nothing) And (Not IsEmpty(cls)) Then
                WriteLog "Calling " & command
                    CallByName cls, command, VbMethod ' this method is unavailable on the Mac
            End If
            #Else
                On Error GoTo AppRunError
                Application.Run command
AppRunError:
            #End If
        End If
    End If
done:
End Sub

'Runs a function (requiring the DLL) inside an error handler,
'but does not execute LoadMathTypeCommands
Public Function RunUICallback(command As String, ParamArray args() As Variant)
    On Error GoTo abort

    ' Instantiate the guard object
    Dim toplevelguard As CallbackGuard
    Set toplevelguard = New CallbackGuard

    Select Case command
        Case "NoDirectCall_GetUnlockScreenTipUI"
            RunUICallback = NoDirectCall_GetUnlockScreenTipUI()
        Case "NoDirectCall_GetUnlockUI"
            RunUICallback = NoDirectCall_GetUnlockUI()
        Case "NoDirectCall_IsEnabled"
            RunUICallback = NoDirectCall_IsEnabled((args(0)))
        Case "NoDirectCall_LocateSupertip"
            RunUICallback = NoDirectCall_LocateSupertip((args(0)))
        Case "NoDirectCall_GetNumEqVisible"
            RunUICallback = NoDirectCall_GetNumEqVisible((args(0)))
        Case "NoDirectCall_GenEnabledByAppFunctionality"
            RunUICallback = NoDirectCall_GenEnabledByAppFunctionality((args(0)))
        Case Else
            WriteLog "RunUICallback error 1:" & command
    End Select

    Exit Function
abort:
    WriteLog "RunUICallback error 2:" & command
    If err.Number <> DSI_ABORT_EXCEPTION Then
        Dim desc As String
        desc = err.Description
        ' We use AssertFailure to notify the end user of the unexpected exception
        ' and to log the error.  However, since AssertFailure raises another
        ' DSI_ABORT_EXCEPTION, we need to set things up to resume after the assert and exit
        On Error Resume Next
        Asserts.LogAndAlert module, "RunUICallback", desc
    End If
    ' No action needed for DSI_ABORT_EXCEPTION errors
    ' Exiting the subroutine will clear the error
End Function

'Loads MathType Commands template if not already loaded
Function LoadMathTypeCommands() As Boolean
    Dim addin As String
    Dim mtDir As String

    LoadMathTypeCommands = False

    mtDir = GetMathTypeDir

    #If Win32 Then
    addin = mtDir & Application.PathSeparator &             "Office Support" & Application.PathSeparator &             Trim(str(kBits)) & Application.PathSeparator &             "WordCmds.dot"
    #Else
    addin = mtDir & Application.PathSeparator &             "Office Support" & Application.PathSeparator &             "WordCmds.dot"
    #End If

    If IsAddInInstalled(addin) = False Then
        System.Cursor = wdCursorWait
        On Error GoTo err
        AddIns.Add fileName:=addin, Install:=True
        On Error GoTo 0
        System.Cursor = wdCursorNormal
        If IsAddInInstalled(addin) Then
            LoadMathTypeCommands = True
        Else
            ShowReinstallError
        End If
    Else
        LoadMathTypeCommands = True
    End If
    Exit Function

err:
    'trap office XP error when in reviewing pane
    If err.Number = 4605 Then 'command unavailable error
        If HandleCommandUnavailable(addin) Then
            Resume Next
        End If
    End If
    'otherwise show reinstall error
    UILib.ShowReinstallError
End Function

Private Function HandleCommandUnavailable(addin As String) As Boolean
    Dim curPane As Pane
    On Error GoTo err
    If Val(Application.version) >= kWordX Then
        Set curPane = ActiveDocument.ActiveWindow.ActivePane
        ActiveDocument.Bookmarks("\StartOfDoc").Select
        AddIns.Add fileName:=addin, Install:=True
        curPane.Activate
        HandleCommandUnavailable = True
        Exit Function
    End If
err:
    WriteLog "HandleCommandUnavailable error"
    HandleCommandUnavailable = False
End Function

'Returns True if addIn/Template is already installed
Private Function IsAddInInstalled(addin As String) As Boolean

    IsAddInInstalled = False
    On Error GoTo err
    IsAddInInstalled = AddIns(addin).Installed
    If IsAddInInstalled = True Then Exit Function
err:
    On Error GoTo 0

    'one last attempt to brute force install the addin
    'as a fix for http://valor:8080/browse/MT-2085
    Dim currentAddin As addin
    Dim found As Boolean
    found = False

    For Each currentAddin In AddIns
        Dim currentAddinFullPath As String
        ' Sometimes AddIns don't respond well to .path or .name
        On Error GoTo skip
        currentAddinFullPath = currentAddin.path & Application.PathSeparator & currentAddin.name
        If (Strings.LCase(currentAddinFullPath) = Strings.LCase(addin)) And            (PathExists(currentAddinFullPath)) Then
            found = True
        End If
skip:
        On Error GoTo 0
    Next currentAddin

    If found = True Then
        AddIns(addin).Installed = True
        IsAddInInstalled = AddIns(addin).Installed
    End If

End Function

Private Function PathExists(path As String) As Boolean

    PathExists = False

    If Len(dir$(path)) > 0 And Len(path) > 0 Then
        PathExists = True
    End If

End Function

'Returns True if MT3 macros were found & removed
Public Function RemoveMT3Macros(aTemplate As Template) As Boolean
    RemoveMT3Macros = False

    'make sure we don't call it for our current templates
    'remove if MTLib exists, but "MTW4" AND "MT5API" do not exist
    If HasComponent(aTemplate, "MTLib") Then
        If Not HasComponent(aTemplate, "MTW4") Then
            If Not HasComponent(aTemplate, "MT5API") Then ' Attibute VB_Name for Mtapi.bas
                If Not HasComponent(aTemplate, "Declarations") Then
                    If LoadMathTypeCommands() Then
                        'Can't pass template, but we got it as activedoc.template
                        'and that's what MTCleanup does
                        WriteLog "Calling MTCleanup"
                        RunDispatch "", kMTCommands & ".MTLib.MTCleanup", False
                        RemoveMT3Macros = True
                    End If
                End If
            End If
        End If
    End If
End Function

'Returns True if component exists in the template
Private Function HasComponent(aTemplate As Template, name As String) As Boolean
    Dim temp As String

    On Error GoTo abort
    HasComponent = False
#If Win32 Then '.VBProject is unavailable on the Mac
    temp = aTemplate.VBProject.VBComponents(name).name
    HasComponent = True
#End If
abort:
End Function

'Takes a localizable string of the form "!nnnnString", where nnnn is a 4-digit string ID.
'If current language is English, or the language DLL can't be found, just strip the prefix
Public Function GetUserString(englishString As String) As String

    Dim buffer(1023) As Byte
    Dim tmpStr As String
    Dim bufLen As Long
   
    bufLen = 512
    MTGetUserWString englishString, buffer(0), bufLen
    tmpStr = buffer
    GetUserString = LeftB(tmpStr, bufLen * 2)

End Function

Public Function GetUserString2(winID As String, macID As String, englishString) As String

    Dim nnnnString As String
    Dim strID As String

    #If Win32 Then
        strID = winID
    #Else
        strID = macID
    #End If

    nnnnString = "!" + strID + englishString

    GetUserString2 = GetUserString(nnnnString)

End Function

'Displays error telling user to reinstall MathType
Public Sub ShowReinstallError()
    Beep
    MsgBox GetUserString("!0202An error occurred starting MathType's Commands for Word. Please re-install MathType."),         vbOKOnly, GetUserString("!0200MathType Commands")
End Sub

'Returns True if MathType's Full Functionality is available (i.e. not an expired demo)
Public Function IsFullFunctionality() As Boolean
    IsFullFunctionality = (MTIsFullFunctionality() = 1)
End Function

Public Sub CrashTest()
    RunMTDLLCommand moduleCLS, "NoDirectCall_CrashTest"
End Sub

'Callback routine that determines which split button for inserting numbered eqns is visible
Public Function NoDirectCall_GetNumEqVisible(id As String)
    NoDirectCall_GetNumEqVisible = False
    If id = "MathType_SB_NumEqnL" And gMTEqnNumsOnRight = False Then
        'Make left-default sb visible when the last numbered eqn was on left
        NoDirectCall_GetNumEqVisible = True
    ElseIf id = "MathType_SB_NumEqnR" And gMTEqnNumsOnRight = True Then
        'Make right-default sb visible when the last numbered eqn was on right
        NoDirectCall_GetNumEqVisible = True
    End If
End Function

' inits eqn numbering side from doc props, registry or default
Public Sub InitDefaultEqnNumSide()
    Dim regValue As String

    On Error GoTo missing
    ' default
    gMTEqnNumsOnRight = True

    ' if we find a per document setting, use it
    Dim Doc As Document
    Set Doc = ActiveDocument

    If Doc.CustomDocumentProperties.Item(mtprop_EQN_NUMS_ON_RIGHT).value = True Then
        gMTEqnNumsOnRight = True
    ElseIf Doc.CustomDocumentProperties.Item(mtprop_EQN_NUMS_ON_RIGHT).value = False Then
        gMTEqnNumsOnRight = False
    End If
    Exit Sub

missing:
    regV

VBA File Name: UILibCls.cls, Stream Size: 13843

General
Stream Path:	VBA/UILibCls
VBA File Name:	UILibCls.cls
Stream Size:	13843
Data ASCII:	. . . . . . . . . * . . . . . . . 0 . . . . . . . . . . . - . . . . . . . . . . . . o i . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a J F 8 . E . . . & k . . y * = . . . . h . . 8 . . + 3 q . . . . . . . . . . . . . . . . . . . . . ( ? . . . . _ A . . 5 . H . G ~ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . ( ? . . . . _ A . . 5 . H . G ~ . . a J F 8 . E . . . & k . . y . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 00 01 00 00 2a 1b 00 00 e4 00 00 00 30 03 00 00 c7 1c 00 00 d5 1c 00 00 2d 2e 00 00 00 00 00 00 01 00 00 00 1d 6f 69 dc 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 80 00 ff ff 00 00 d9 da 61 4a 46 38 8a 45 a1 fa 94 26 6b 8b ef 79 2a 3d fb fc fa a0 68 10 a7 38 08 00 2b 33 71 b5 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UILibCls"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

'=====================================================================
' (c) Copyright 2007-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/UILibCls.cls 7     10/11/11 2:12p Jimm $
'=====================================================================

Private m_lError As Long
Private m_sError As String

' Expose the error description
' This error number is required because the CallByName
' function does not return the correct error
Public Property Get ErrorDescription() As String
    ErrorDescription = m_sError
End Property

' Expose the error number
' This error number is required because the CallByName
' function does not return the correct error
Public Property Get ErrorNumber() As Long
    ErrorNumber = m_lError
End Property

Public Sub NoDirectCall_Browse()
    Dim userChoice As Integer
    Dim dropDown As Office.CommandBarComboBox
    Dim command As String

    If browseChoice = -1 Then
        ' serach for the only combo box
        Set dropDown = CommandBars("MathType").FindControl(msoControlDropdown)
        If Not dropDown Is Nothing Then
            userChoice = dropDown.ListIndex
        Else
            userChoice = 1
        End If
    Else
        userChoice = browseChoice
    End If

    If forward Then
        Select Case userChoice
        Case 0 To 1
            command = kMTCommands & ".MTBrowse.BrowseEquationsForward"
        Case 2
            command = kMTCommands & ".MTBrowse.BrowseEquationNumberRefForward"
        Case 3
            command = kMTCommands & ".MTBrowse.BrowseChapterSectionForward"
        End Select
    Else
        Select Case userChoice
        Case 0 To 1
            command = kMTCommands & ".MTBrowse.BrowseEquationsBackward"
        Case 2
            command = kMTCommands & ".MTBrowse.BrowseEquationNumberRefBackward"
        Case 3
            command = kMTCommands & ".MTBrowse.BrowseChapterSectionBackward"
        End Select
    End If

    If Not command = "" Then
        RunDispatch "", command, False
    End If
    MTIncrementStatisticBy "WDBr", 1
End Sub

Public Sub NoDirectCall_InsertInlineEqn()
    WriteLog "Entering InsertInlineEqn"
    RunDispatch "", kMTCommands & ".MTInsertEquation.InsertInlineEquation", False
    
    WriteLog "Incrementing CInline VC stat"
    MTIncrementStatisticBy "CInline", 1
    
    WriteLog "Exiting InsertInlineEqn"
End Sub

Public Sub NoDirectCall_InsertDispEqn()
    RunDispatch "", kMTCommands & ".MTInsertEquation.InsertDisplayEquation", False
    MTIncrementStatisticBy "CDisp", 1
End Sub

Public Sub NoDirectCall_InsertLeftNumberedDispEqn()
    RunDispatch "", kMTCommands & ".MTInsertEquation.InsertLeftNumberedDisplayEquation", False
    MTIncrementStatisticBy "CDispL", 1
End Sub

Public Sub NoDirectCall_InsertRightNumberedDispEqn()
    RunDispatch "", kMTCommands & ".MTInsertEquation.InsertRightNumberedDisplayEquation", False
    MTIncrementStatisticBy "CDispR", 1
End Sub

Public Sub NoDirectCall_InsertLeftNumberedDispEqnEB()
    RunDispatch "", kMTCommands & ".MTInsertEBEquation.InsertEBLeftNumberedDisplayEquation", False
    MTIncrementStatisticBy "CEBDispL", 1
End Sub

Public Sub NoDirectCall_InsertRightNumberedDispEqnEB()
    RunDispatch "", kMTCommands & ".MTInsertEBEquation.InsertEBRightNumberedDisplayEquation", False
    MTIncrementStatisticBy "CEBDispR", 1
End Sub

Public Sub NoDirectCall_InsertEqnNum()
    RunDispatch "", kMTCommands & ".MTEqnNum.Main", False
    MTIncrementStatisticBy "CEqNum", 1
End Sub

Public Sub NoDirectCall_InsertEqnRef()
    RunDispatch "", kMTCommands & ".MTMarkRef.Main", False
    MTIncrementStatisticBy "CEqRef", 1
End Sub

Public Sub NoDirectCall_UpdateEqns()
    RunDispatch "", kMTCommands & ".MTUpdateFields.Main", False
    MTIncrementStatisticBy "CUpdEqNum", 1
End Sub

Public Sub NoDirectCall_CrashTest()
    Dim result As Long
    Dim where, how
    where = 1 '1 for WLL; 2 for DLL
    how = 1   '1 for Assert; 2 for divide by zero
    result = MTCrashTest(where, how)
End Sub

'checks if Word is being used as an embedded object
'if Word's window does not have a caption, we assume it is embedded
Private Function IsEmbeddedObject() As Boolean
    IsEmbeddedObject = (Len(Application.ActiveWindow.Caption) = 0)
End Function

VBA File Name: UIRibbon.bas, Stream Size: 30914

General
Stream Path:	VBA/UIRibbon
VBA File Name:	UIRibbon.bas
Stream Size:	30914
Data ASCII:	. . . . . . . . . . K . . . . . . ( . . . . . . . . L . . . l . . . . . . . . . . . o . B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 02 4b 00 00 d4 00 00 00 28 02 00 00 ff ff ff ff 0a 4c 00 00 b6 6c 00 00 00 00 00 00 01 00 00 00 1d 6f 18 42 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 10 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UIRibbon"
'UIRibbon 5.3
'====================================================================
' (c) Copyright 1992-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/UIRibbon.bas 57    6/23/10 6:50p Robertm $
'====================================================================

' This file is shared between Word and PowerPoint. Some functions are only
' intended to be used by Word at this time. Since a user might try to execute
' one of these macros, we will do a application name check to limit their execution.

Option Explicit

Public gMTBrowseType As Integer
Public gMTRibbon As IRibbonUI

Private Const module As String = "UIRibbon"
Private Const moduleCLS As String = "UIRibbonCls"

'called when ribbon loads; save ribbon to invoke its Invalidate method later
Public Sub MTCommand_OnRibbonLoaded(ribbon As IRibbonUI)
    Set gMTRibbon = ribbon
End Sub

'call back for setting the initial state of the browse dropdown
Public Sub MTCommand_OnSelectedIndexBrowseType(control As IRibbonControl, ByRef index)
    RunDocCallback moduleCLS, "NoDirectCall_OnSelectedIndexBrowseType"
End Sub

'Runs Insert Inline Equation command
Public Sub MTCommand_OnInsertInlineEqn(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnInsertInlineEqn", True, mtbIDInsInlineMTEqn
End Sub

'Runs Insert Display Equation command
Public Sub MTCommand_OnInsertDispEqn(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnInsertDispEqn", True, mtbIDInsDispMTEqn
End Sub

'Runs Insert Left-Numbered Display Equation command
Public Sub MTCommand_OnInsertLeftNumberedDispEqn(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnInsertLeftNumberedDispEqn", True, mtbIDInsDispMTEqnLeftNum
End Sub

'Runs Insert Right-Numbered Display Equation command
Public Sub MTCommand_OnInsertRightNumberedDispEqn(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnInsertRightNumberedDispEqn", True, mtbIDInsDispMTEqnRightNum
End Sub

'Runs Insert Handwritten Math command
Public Sub MTCommand_OnInsHandEqn(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnInsHandEqn", True, mtbIDInsHandEqn
End Sub

'Inserts EB Inline Equation
Public Sub MTCommand_OnInsertInlineEqnEB(control As IRibbonControl, cancelDefault)
    'RunMTDLLCommand moduleCLS, "NoDirectCall_OnInsertInlineEqnEB", True, mtbIDMathType_B_InsEBEqn
End Sub

'Inserts EB Left-Numbered Display Equation
Public Sub MTCommand_OnInsertLeftNumberedDispEqnEB(control As IRibbonControl)
    'RunMTDLLCommand moduleCLS, "NoDirectCall_OnInsertLeftNumberedDispEqnEB", True, mtbIDInsEBEqnLeftNum
End Sub

'Inserts EB Right-Numbered Display Equation
Public Sub MTCommand_OnInsertRightNumberedDispEqnEB(control As IRibbonControl)
    'RunMTDLLCommand moduleCLS, "NoDirectCall_OnInsertRightNumberedDispEqnEB", True, mtbIDInsEBEqnRightNum
End Sub

'Runs Format Equations command
Public Sub MTCommand_OnFormatEquations(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnFormatEquations", True, mtbIDFormatEqns
End Sub

'Runs Convert Equations command
Public Sub MTCommand_OnConvertEquations(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnConvertEquations", True, mtbIDConvertEqns
End Sub

'Runs TeX Toggle command
Public Sub MTCommand_OnTeXToggle(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnTeXToggle", True, mtbIDTeXToggle
End Sub

'Runs Export Equations command
Public Sub MTCommand_OnExportEquations(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnExportEquations", True, mtbIDExportEqns
End Sub


'Runs MathPage command
Public Sub MTCommand_OnMathPage(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnMathPage", True, mtbIDMathPage
End Sub

'Runs Set Equation Prefs command
Public Sub MTCommand_OnSetEquationPrefs(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnSetEquationPrefs", True, mtbIDSetEqnPrefs
End Sub

'Runs Insert Equation Number command
Public Sub MTCommand_OnInsertEquationNumber(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnInsertEquationNumber", True, mtbIDInsertNumber
End Sub

'Runs Format Equation Numbers command
Public Sub MTCommand_OnFormatEquationNumbers(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnFormatEquationNumbers", True, mtbIDFormatEqnNums
End Sub

'Runs Update Equation Numbers command
Public Sub MTCommand_OnUpdateEquationNumbers(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnUpdateEquationNumbers", True, mtbIDUpdateEqnNums
End Sub

'Runs Insert Equation Reference command
Public Sub MTCommand_OnEquationReference(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnEquationReference", True, mtbIDEquationReference
End Sub

'Runs Insert Chapter/Section Break command
Public Sub MTCommand_OnInsertChapterSectionBreak(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnInsertChapterSectionBreak", True, mtbIDMoreBreaks
End Sub

'Runs Insert Chapter/Section Break command
Public Sub MTCommand_OnInsertNextSection(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnInsertNextSection", True, mtbIDInsertNextSection
End Sub


'Runs Insert Chapter/Section Break command
Public Sub MTCommand_OnInsertNextChapter(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnInsertNextChapter", True, mtbIDInsertNextChapter
End Sub

'Runs Modify Chapter/Section Break command
Public Sub MTCommand_OnModifyChapterSectionBreak(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnModifyChapterSectionBreak", True, mtbIDModifyBreak
End Sub

'Runs MathType Help
Public Sub MTCommand_OnHelpContents(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnHelpContents", True, mtbIDHelp
End Sub

Public Sub MTCommand_OnHelpMTInWord(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnHelpMTInWord", True, mtbIDHelpMTInWord
End Sub

Public Sub MTCommand_OnUnlockReg(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnUnlockReg", True, mtbIDHelpUnlockReg
End Sub

Public Sub MTCommand_OnAboutMT(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnAboutMT", True, mtbIDHelpAboutMT
End Sub

Public Sub MTCommand_OnWebHomePage(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnWebHomePage", True, mtbIDWeb
End Sub

Public Sub MTCommand_OnWebSupport(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnWebSupport", True, mtbIDWebSupport

End Sub

Public Sub MTCommand_OnWebEmailFeedback(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnWebEmailFeedback", True, mtbIDWebEmailFeedback
End Sub

Public Sub MTCommand_OnWebOrderMathType(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnWebOrderMathType", True, mtbIDWebOrderMT
End Sub

Public Sub MTCommand_OnFutureMT(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnFutureMT", True, mtbIDFutureMT
End Sub

Public Sub MTCommand_OnMTOptions(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnMTOptions", True, mtbIDMTOptions
End Sub

'Set Browse Type
Public Sub MTCommand_OnBrowseType(control As IRibbonControl, selectedId As String, selectedIndex As Integer)

    'RunMTDLLCommand moduleCLS, "NoDirectCall_OnBrowseType"
    ' We can't use RunMTDLLCommand since we need a way to pass arguments.
    ' For now, I just instantiate a guard directly and did not
    ' provide an error handler in light of the simplicity of the code
    ' to be executed.

    Dim toplevelguard As CommandGuard
    Set toplevelguard = New CommandGuard

    If Application.name = kAppMSW Then
        ' first index comes through as 0, so add one
        gMTBrowseType = selectedIndex + 1
    End If

End Sub

'Browse to Previous
Public Sub MTCommand_OnBrowsePrevious(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnBrowsePrevious", True, mtbIDBrowsePrev
End Sub

'Browse to Next
Public Sub MTCommand_OnBrowseNext(control As IRibbonControl)
    RunMTDLLCommand moduleCLS, "NoDirectCall_OnBrowseNext", True, mtbIDBrowseNext
End Sub

Public Sub MTCallback_GetEnabled(control As IRibbonControl, ByRef enabled)
    enabled = RunUICallback("NoDirectCall_GenEnabledByAppFunctionality", control.id)
End Sub

Public Sub MTCallback_GetSupertip(control As IRibbonControl, ByRef screentip)
    screentip = RunUICallback("NoDirectCall_LocateSupertip", control.id)
End Sub

Public Sub MTCallback_GetLabel(control As IRibbonControl, ByRef label)
    label = RunUICallback("NoDirectCall_GetUnlockUI")
End Sub

Public Sub MTCallback_GetScreenTip(control As IRibbonControl, ByRef screentip)
    screentip = RunUICallback("NoDirectCall_GetUnlockScreenTipUI")
End Sub

Public Sub MTCallback_GetNumEqVisible(control As IRibbonControl, ByRef visible)
    visible = RunUICallback("NoDirectCall_GetNumEqVisible", control.id)
End Sub

Public Sub MTCallback_IsWin7(control As IRibbonControl, ByRef visible)
    visible = IsMathInputPanelAvailable
End Sub

Public Sub MTCallback_IsBeforeWin7(control As IRibbonControl, ByRef visible)
    visible = Not IsMathInputPanelAvailable
End Sub

VBA File Name: UIRibbonCls.cls, Stream Size: 27891

General
Stream Path:	VBA/UIRibbonCls
VBA File Name:	UIRibbonCls.cls
Stream Size:	27891
Data ASCII:	. . . . . . . . . " B . . . . . . . . . . a C . . o C . . ; b . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . J . # F . V > . A * = . . . . h . . 8 . . + 3 q . . . . . . . . . . . . . . . . . . . . . . o . . . . Q N . . . v . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . o . . . . Q N . . . v . . . . . . . A . . . J . # F . V > . A . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 00 01 00 00 22 42 00 00 e4 00 00 00 88 02 00 00 61 43 00 00 6f 43 00 00 3b 62 00 00 00 00 00 00 01 00 00 00 1d 6f a6 d4 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 80 00 ff ff 00 00 8a a4 09 41 1a 9e 92 4a a7 23 46 d1 56 3e 80 41 2a 3d fb fc fa a0 68 10 a7 38 08 00 2b 33 71 b5 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UIRibbonCls"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

'=====================================================================
' (c) Copyright 2007-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/UIRibbonCls.cls 18    6/23/10 6:50p Robertm $
'=====================================================================

Private Const kUILib As String = "UILibCls"
Private Const kPPInsertMTEquation As String = "PPInsertMTEquationCls"
Private Const kUIHelp As String = "UIHelpCls"
Private Const kUIBrowse As String = "PPBrowseCls"

Private m_lError As Long
Private m_sError As String

' Expose the error description
' This error number is required because the CallByName
' function does not return the correct error
Public Property Get ErrorDescription() As String
    ErrorDescription = m_sError
End Property

' Expose the error number
' This error number is required because the CallByName
' function does not return the correct error
Public Property Get ErrorNumber() As Long
    ErrorNumber = m_lError
End Property

Public Sub NoDirectCall_OnRibbonLoaded()
  Set gMTRibbon = ribbon
End Sub

Public Sub NoDirectCall_OnSelectedIndexBrowseType()
    If Application.name = kAppMSW Then
        If gMTBrowseType = 0 Then
            index = gMTBrowseType
        Else
            ' adjust to zero based index before setting the value
            index = gMTBrowseType - 1
        End If
    End If
End Sub

Public Sub NoDirectCall_OnInsertInlineEqn()
    If Application.name = kAppMSW Then
        RunDispatch kUILib, "NoDirectCall_InsertInlineEqn"
    ElseIf Application.name = kAppMSPP Then
        RunDispatch kPPInsertMTEquation, "NoDirectCall_OnInsertEquation"
    End If
End Sub

Public Sub NoDirectCall_OnInsertDispEqn()
    If Application.name = kAppMSW Then
        RunDispatch kUILib, "NoDirectCall_InsertDispEqn"
    End If
End Sub

Public Sub NoDirectCall_OnInsertLeftNumberedDispEqn()
    If Application.name = kAppMSW Then
        #If Word Then
        If gMTEqnNumsOnRight = True Then
            gMTEqnNumsOnRight = False
            Invalidate
            SaveDefaultEqnNumSide
        End If
        RunDispatch kUILib, "NoDirectCall_InsertLeftNumberedDispEqn"
        #End If
    End If
End Sub

Public Sub NoDirectCall_OnInsertRightNumberedDispEqn()
    If Application.name = kAppMSW Then
        #If Word Then
        If gMTEqnNumsOnRight = False Then
            gMTEqnNumsOnRight = True
            Invalidate
            SaveDefaultEqnNumSide
        End If
        RunDispatch kUILib, "NoDirectCall_InsertRightNumberedDispEqn"
        #End If
    End If
End Sub

Public Sub NoDirectCall_OnInsHandEqn()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTMathInputControl.Main", False, mtbIDInsHandEqn
    ElseIf Application.name = kAppMSPP Then
        RunDispatch kPPInsertMTEquation, "NoDirectCall_OnInsPPHandEqn"
    End If
End Sub

Public Sub NoDirectCall_OnInsertInlineEqnEB()
    #If Word Then
        If Documents.Count > 0 Then
            cancelDefault = False
            MTIncrementStatisticBy "CEBInline", 1
        End If
    #ElseIf PP Then
        If Presentations.Count > 0 Then
            cancelDefault = False
            MTIncrementStatisticBy "CEBInline", 1
        End If
    #End If
End Sub

Public Sub NoDirectCall_OnInsertLeftNumberedDispEqnEB()
    If Application.name = kAppMSW Then
        RunDispatch kUILib, "NoDirectCall_InsertLeftNumberedDispEqnEB"
    End If
End Sub

Public Sub NoDirectCall_OnInsertRightNumberedDispEqnEB()
   If Application.name = kAppMSW Then
        RunDispatch kUILib, "NoDirectCall_InsertRightNumberedDispEqnEB"
   End If
End Sub


Public Sub NoDirectCall_OnFormatEquations()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTFormatEquations.Main", False
    End If
End Sub

Public Sub NoDirectCall_OnConvertEquations()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTConvertEquations.Main", False
    End If
End Sub

Public Sub NoDirectCall_OnTeXToggle()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTTeXToggle.Main", False
    End If
End Sub

Public Sub NoDirectCall_OnExportEquations()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTExportEquations.Main", False
    End If
End Sub

Public Sub NoDirectCall_OnMathPage()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MathPage.MP_ExportTo", False
    End If
End Sub

Public Sub NoDirectCall_OnSetEquationPrefs()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTSetEqnPrefs.Main", False
    End If
End Sub

Public Sub NoDirectCall_OnInsertEquationNumber()
    If Application.name = kAppMSW Then
        RunDispatch kUILib, "NoDirectCall_InsertEqnNum"
    End If
End Sub


Public Sub NoDirectCall_OnFormatEquationNumbers()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTEqnNumFormat.Main", False
    End If
End Sub

Public Sub NoDirectCall_OnUpdateEquationNumbers()
    If Application.name = kAppMSW Then
        RunDispatch kUILib, "NoDirectCall_UpdateEqns", True
    End If
End Sub

Public Sub NoDirectCall_OnEquationReference()
    If Application.name = kAppMSW Then
        RunDispatch kUILib, "NoDirectCall_InsertEqnRef"
    End If
End Sub


Public Sub NoDirectCall_OnInsertChapterSectionBreak()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTSecNum.Main", False
    End If
End Sub

Public Sub NoDirectCall_OnInsertNextSection()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTSecNum.InsertNextSectionBreak", False
    End If
End Sub

Public Sub NoDirectCall_OnInsertNextChapter()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTSecNum.InsertNextChapterBreak", False
    End If
End Sub

Public Sub NoDirectCall_OnModifyChapterSectionBreak()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTFormatEquationSection.Main", False
    End If
End Sub

Public Sub NoDirectCall_OnHelpContents()
    RunDispatch kUIHelp, "NoDirectCall_ShowHelpContents"
End Sub

Public Sub NoDirectCall_OnHelpMTInWord()
     RunDispatch kUIHelp, "NoDirectCall_ShowHelpMTInWord"
End Sub

Public Sub NoDirectCall_OnUnlockReg()
    RunDispatch kUIHelp, "NoDirectCall_ShowUnlockReg"
End Sub

Public Sub NoDirectCall_OnAboutMT()
    RunDispatch kUIHelp, "NoDirectCall_ShowAboutMT"
End Sub

Public Sub NoDirectCall_OnWebHomePage()
    RunDispatch kUIHelp, "NoDirectCall_ShowWebHomePage"
End Sub

Public Sub NoDirectCall_OnWebSupport()
    RunDispatch kUIHelp, "NoDirectCall_ShowWebSupport"
End Sub

Public Sub NoDirectCall_OnWebEmailFeedback()
    RunDispatch kUIHelp, "NoDirectCall_ShowWebEmailFeedback"
End Sub

Public Sub NoDirectCall_OnWebOrderMathType()
    RunDispatch kUIHelp, "NoDirectCall_ShowWebOrderMathType"
End Sub

Public Sub NoDirectCall_OnFutureMT()
    RunDispatch kUIHelp, "NoDirectCall_ShowFutureMT"
End Sub

Public Sub NoDirectCall_OnMTOptions()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTOptions.Main", False
    End If
End Sub

Public Sub NoDirectCall_OnBrowseType()
    If Application.name = kAppMSW Then
        ' first index comes through as 0, so add one
        gMTBrowseType = selectedIndex + 1
    End If
End Sub

Public Sub NoDirectCall_OnBrowsePrevious()
    If Application.name = kAppMSW Then
        browseChoice = gMTBrowseType
        forward = False
        RunDispatch kUILib, "NoDirectCall_Browse"
    ElseIf Application.name = kAppMSPP Then
        forward = False
        RunDispatch kUIBrowse, "NoDirectCall_Browse"
    End If
End Sub

Public Sub NoDirectCall_OnBrowseNext()
    If Application.name = kAppMSW Then
        browseChoice = gMTBrowseType
        forward = True
        RunDispatch kUILib, "NoDirectCall_Browse"
    ElseIf Application.name = kAppMSPP Then
        forward = True
        RunDispatch kUIBrowse, "NoDirectCall_Browse"
    End If
End Sub

Public Sub NoDirectCall_OnMathInputControl()
    If Application.name = kAppMSW Then
        RunDispatch "", kMTCommands & ".MTMathInputControl.Main", False
    End If
End Sub

VBA File Name: UIWrappers.bas, Stream Size: 10206

General
Stream Path:	VBA/UIWrappers
VBA File Name:	UIWrappers.bas
Stream Size:	10206
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 9a 0d 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 17 0e 00 00 c3 20 00 00 00 00 00 00 01 00 00 00 1d 6f ea 93 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UIWrappers"
'UIWrappers: 5.01
'====================================================================
' (c) Copyright 1992-2010 by Design Science, Inc. All rights reserved
'$Header: /MathType/Windows/WordMacros/UIWrappers.bas 28    7/12/10 1:37p Jimm $
'====================================================================
Option Explicit

' Note: * all functions/subs that start with MTCommand_ are "top-level" entry points called from
'         OnAction handlers (e.g. buttons, menu items, etc).
'       * all functions/subs that start with MTCallback_ are are called by
'         Word 2007 as needed to refresh the Ribbon UI
'       * all functions/subs that start with NoDirectCall_
'          MUST NOT BE CALLED except via a RunXXX command

Private Const module As String = "UIWrappers"
Private Const moduleCLS As String = "UIWrappersCls"

' *** Begin MTW5 Globals ***
Public MTW5_aDoc As Document
' *** End MTW5 Globals ***

' this is called when the user selects File->Print Preview
' This should start with MTCommand_ but it can not since Word expects this name
Public Sub FilePrintPreview()
    ' We have to use RunDocCallback here, since concurrent execution is
    ' required for print preview.  See MT-1119
    RunDocCallback moduleCLS, "NoDirectCall_FilePrintPreview"
End Sub

'Called by Print button that has no UI
' This should start with MTCommand_ but it can not since Word expects this name
Public Sub FilePrintDefault()
    ' We have to use RunDocCallback here, since concurrent execution is
    ' required for print preview.  See MT-1119
    RunDocCallback moduleCLS, "NoDirectCall_FilePrintDefault"
End Sub

'Called by Print command, shows dialog
' This should start with MTCommand_ but it can not since Word expects this name
Public Sub FilePrint()
    RunMTDLLCommand moduleCLS, "NoDirectCall_FilePrint"
End Sub

'Starting with Word 2002, MTEF comment records are stripped out of WMF files
' by Word when they are placed on the clipboard.  Thus, in recent versions of
' Word, overriding the native EditPictureEdit command does no good in terms
' of being ablt to edit MT picture equations as equations. Moreover, in Word 2007
' calling the Activate method on an inline shape no longer invokes the default
' picture editor in Word, so it becomes quite difficult to hook the EditPictureEdit
' command without screwing up the native picture editing capabilities in Word.
' Thus, we remove this override in MT6.0b.  See MT-1131.
'Public Sub EditPictureEdit()
'    RunMTDLLCommand "", kMTCommands & ".MTLib.MTEditPicture", False
'End Sub


'Inserts an equation at the insertion point
'InsertEquation is called when the EE (square root of alpha) button is clicked
' This should start with MTCommand_ but it can not since Word expects this name
Public Sub InsertEquation()
    RunMTDLLCommand moduleCLS, "NoDirectCall_InsertEquation"
End Sub

'Shows/hides all nonprinting characters, and our Equation Breaks (avoids dirtying the doc)
' This should start with MTCommand_ but it can not since Word expects this name
Public Sub ShowAll()
    RunMTDLLCommand moduleCLS, "NoDirectCall_ShowAll"
End Sub

'This macro replaces one shipped with MathType1.x.
'Run when user clicks on an old paragraph (display) MathType equation.
' This should start with MTCommand_ but it can not since older MT versions expect this name
Public Sub EditTextEqn()
    RunMTDLLCommand moduleCLS, "NoDirectCall_EditTextEqn"
End Sub

'This macro replaces one shipped with MathType 1.x.
'Run when user clicks on an old inline (text) macrobutton MathType equation.
' This should start with MTCommand_ but it can not since older MT versions expect this name
Public Sub EditDispEqn()
    RunMTDLLCommand moduleCLS, "NoDirectCall_EditDispEqn"
End Sub

VBA File Name: UIWrappers2007.bas, Stream Size: 3044

General
Stream Path:	VBA/UIWrappers2007
VBA File Name:	UIWrappers2007.bas
Stream Size:	3044
Data ASCII:	. . . . . . . . . : . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . c . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 3a 05 00 00 d4 00 00 00 d8 01 00 00 ff ff ff ff f2 05 00 00 9e 09 00 00 00 00 00 00 01 00 00 00 1d 6f 18 63 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UIWrappers2007"
'UIWrappers2007: 5.01
'====================================================================
' (c) Copyright 1992-2010 by Design Science, Inc. All rights reserved
'$Header: /MathType/Windows/WordMacros/UIWrappers2007.bas 2     10/11/11 2:12p Jimm $
'====================================================================
Option Explicit

Private Const module As String = "UIWrappers"
Private Const moduleCLS As String = "UIWrappersCls"

Public Sub DSIEditPaste(control As IRibbonControl, cancelDefault)

    RunMTDLLCommand moduleCLS, "NoDirectCall_EditPaste"
    
    Dim strCancelDefault As String
    strCancelDefault = GetPreference(HKEY_CURRENT_USER, mtreg_MT_WORDCMDS_LOCATION, mtreg_MT_PASTECANCELDEF)
    
    If (strCancelDefault = "0") Then
        cancelDefault = False
    Else
        cancelDefault = True
    End If
        
End Sub

VBA File Name: UIWrappersCls.cls, Stream Size: 30098

General
Stream Path:	VBA/UIWrappersCls
VBA File Name:	UIWrappersCls.cls
Stream Size:	30098
Data ASCII:	. . . . . . . . . z 2 . . . . . . h . . . . 5 . . . 6 . . . _ . . . . . . . . . . . o q ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E . M . . . . . j g . * = . . . . h . . 8 . . + 3 q . . . . . . . . . . . . . . . . . . . . . . . . . . . H I . . . O . < P . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . H I . . . O . < P . . . . . . E . M . . . . . j g . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 00 01 00 00 7a 32 00 00 e4 00 00 00 68 04 00 00 fe 35 00 00 0c 36 00 00 d8 5f 00 00 00 00 00 00 01 00 00 00 1d 6f 71 60 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 80 00 ff ff 00 00 d8 f9 94 1c 04 45 1f 4d be ba e1 85 80 6a 67 dc 2a 3d fb fc fa a0 68 10 a7 38 08 00 2b 33 71 b5 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UIWrappersCls"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private m_lError As Long
Private m_sError As String

'=====================================================================
' (c) Copyright 2007-2010 by Design Science, Inc. All rights reserved.
'$Header: /MathType/Windows/WordMacros/UIWrappersCls.cls 25    5/06/14 9:54a Jimm $
'=====================================================================

' Support code for updating the cursor position
Private Const mttstyle_EB_NUMBERED_EQUATION As String = "MTEBNumberedEquation"

' Expose the error description
' This error number is required because the CallByName
' function does not return the correct error
Public Property Get ErrorDescription() As String
    ErrorDescription = m_sError
End Property

' Expose the error number
' This error number is required because the CallByName
' function does not return the correct error
Public Property Get ErrorNumber() As Long
    ErrorNumber = m_lError
End Property


'************* UIWrappers Module code *****************

Public Sub NoDirectCall_EditPaste()

    RunDispatch "", kMTCommands & ".MTLib.DSIEditPaste", False

End Sub

Public Sub NoDirectCall_App_DocumentChange()
    ' It's screwy to look for MT3 macros everytime we change to
    ' a document. Not only will the call be redundant 99% of the time,
    ' it is not clear that MT3 macros can be in documents from any of
    ' the versions of Word we still support. Further, our AutoExec code
    ' string MT3 macros from Normal.dot.  This whole handler should be
    ' removed in future versions of MT.
    Dim aTemplate As Template
    On Error GoTo Error
    'put in variable, can't pass objects directly
    Set aTemplate = ActiveDocument.AttachedTemplate
    UILib.RemoveMT3Macros aTemplate
        Exit Sub
Error:
        WriteLog "NoDirectCall_App_DocumentChange error"
End Sub

Public Sub NoDirectCall_FilePrintPreview()
    Dim Doc As Document
    Dim styleVisible As Boolean

    Set Doc = ActiveDocument
    If Not Doc Is Nothing Then
        If PrintPreview Then
            PrintPreview = False
        Else
            styleVisible = IsSectionStyleVisible()
            If styleVisible Then HideSectionStyle
            Doc.PrintPreview
            ' if the style is visible, we need to loop until the print
            ' preview "mode" ends. We need to make sure that DoEvents
            ' gets called so the user can do other things in the UI
            If styleVisible Then
                Do Until PrintPreview = False
                    DoEvents
                Loop
                ' when the loop ends, show the style
                ShowSectionStyle
            End If
        End If
    End If
End Sub

Public Sub NoDirectCall_FilePrintDefault()
    PrintDoc False
End Sub


Public Sub NoDirectCall_FilePrint()
    PrintDoc True
End Sub

Public Sub NoDirectCall_InsertEquation()
    RunDispatch "", kMTCommands & ".MTInsertEquation.InsertInlineEquation", False
End Sub

Public Sub NoDirectCall_ShowAll()
    Dim saved As Boolean
    saved = ActiveDocument.saved
    If ActiveWindow.ActivePane.View.ShowAll Then
        HideSectionStyle
    Else
        ShowSectionStyle
    End If
    ActiveWindow.ActivePane.View.ShowAll = Not ActiveWindow.ActivePane.View.ShowAll
    ActiveDocument.saved = saved
End Sub

Public Sub NoDirectCall_EditTextEqn()
    Dim stat As Long
    stat = MsgBox(UILib.GetUserString("!2500This is a MathType 1.x (non-OLE) equation. The Convert Equations... command can be used to convert it to a MathType 4 equation. Do you want to do this now?"),         vbQuestion + vbYesNo, UILib.GetUserString2("1620", "3220", "MathType Macro Message"))

    If stat = vbYes Then UILib.MTCommand_ConvertEqns
End Sub

Public Sub NoDirectCall_EditDispEqn()
    Dim stat As Long
    stat = MsgBox(UILib.GetUserString("!2500This is a MathType 1.x (non-OLE) equation. The Convert Equations... command can be used to convert it to a MathType 4 equation. Do you want to do this now?"),         vbQuestion + vbYesNo, UILib.GetUserString2("1620", "3220", "MathType Macro Message"))

    If stat = vbYes Then UILib.MTCommand_ConvertEqns
End Sub

'Support Functions
'Returns True if style exists in the active document.
Private Function styleExists(style As String) As Boolean
    Dim aStyle As style
    styleExists = False
    On Error GoTo abort
    Set aStyle = ActiveDocument.Styles(style)
    'if we get here the style exists
    styleExists = True
abort:
End Function

'If MTEquationSection style exists, make it not hidden
Private Sub ShowSectionStyle()
    If styleExists(mtstyle_EQUATION_SECTION) Then
        ActiveDocument.Styles(mtstyle_EQUATION_SECTION).font.Hidden = False
    End If
End Sub

'If MTEquationSection style exists, make it hidden
Public Sub HideSectionStyle()
    If styleExists(mtstyle_EQUATION_SECTION) Then
        ActiveDocument.Styles(mtstyle_EQUATION_SECTION).font.Hidden = True
    End If
End Sub

'Returns True if MTEquationSection style is visible
Public Function IsSectionStyleVisible() As Boolean
    IsSectionStyleVisible = False
    If styleExists(mtstyle_EQUATION_SECTION) Then
        IsSectionStyleVisible =             Not (ActiveDocument.Styles(mtstyle_EQUATION_SECTION).font.Hidden)
    End If
End Function

'Hides our MTEquationSection style if necessary before printing
Private Sub PrintDoc(ui As Boolean)
    On Error GoTo abort
    Dim styleVisible As Boolean
    styleVisible = IsSectionStyleVisible()
    If styleVisible Then HideSectionStyle
    With Dialogs(wdDialogFilePrint)
        If ui Then
            .Show
        Else
            .Execute
        End If
    End With
    If styleVisible Then ShowSectionStyle
abort:
End Sub

'************* MTW5 class module code *****************

Public Sub NoDirectCall_App_DocumentBeforeSave()
    ' delay 3 seconds and update the UI
    If Not MTApp.App Is Nothing Then
        MTApp.App.OnTime Now + TimeValue("00:00:03"), "UIUpdate"
    End If
End Sub

Public Sub NoDirectCall_App_DocumentOpen()
    CheckEqnsFromOtherPlatform
    InitDefaultEqnNumSide
    Invalidate
End Sub

Private Sub CheckEqnsFromOtherPlatform()
    On Error GoTo MacError

    If (MTW5_aDoc Is Nothing) Then
        Exit Sub
    End If

    If GetPlatform() = kPlatformMac Then
        If MTW5_aDoc.CustomDocumentProperties(mtprop_HAS_WIN_EQNS) = True Then
            DeleteDocProperty MTW5_aDoc, mtprop_HAS_WIN_EQNS
            AskRunConvertEquations kPlatformWin
        End If
    End If

WinTest:
    On Error GoTo WinError
    If GetPlatform() = kPlatformWin Then
        If MTW5_aDoc.CustomDocumentProperties.Item(mtprop_HAS_MAC_EQNS).value = True Then
            DeleteDocProperty MTW5_aDoc, mtprop_HAS_MAC_EQNS
            AskRunConvertEquations kPlatformMac
        End If
    End If
    Exit Sub

MacError:
    Resume WinTest:

WinError:
End Sub

'Prompt to run Convert Equations
Private Sub AskRunConvertEquations(platformID As Long)
    Dim stat As Long
    Dim msg As String

    msg = UILib.GetUserString2("0600", "0600", "This document contains equations created on a Macintosh computer. To view the equations correctly you should run the Convert Equations command. Would you like to run this command now?")

    stat = MsgBox(msg, vbQuestion + vbYesNo, UILib.GetUserString("!1806MathType Commands for Word"))
    If stat = vbYes Then
        UILib.MTCommand_ConvertEqns
    End If
End Sub
'Deletes document property, OK to call if it doesn't exist
Public Sub DeleteDocProperty(Doc As Document, prop As String)
    On Error GoTo Error
    Doc.CustomDocumentProperties(prop).Delete
Error:
End Sub

'Similar to MTLib.GetPlatform, returns kPlatformWin or kPlatformMac
Private Function GetPlatform() As Long
    If InStr(1, System.OperatingSystem, "Macintosh", vbTextCompare) > 0 Then
        GetPlatform = kPlatformMac
    Else
        GetPlatform = kPlatformWin
    End If
End Function

Public Sub NoDirectCall_App_WindowActivate()
    InitDefaultEqnNumSide
    Invalidate
    UIUpdate
End Sub

Public Sub NoDirectCall_App_WindowSelectionChange()
    ' special handling for hitting return when on the right side of a EB equation
    checkForEBEquationAfterReturn
    UIUpdate
End Sub

' special handling for hitting return when on the right side of a EB equation
Private Sub checkForEBEquationAfterReturn()
#If Win32 Then
    Application.ScreenUpdating = False
    Dim resetSelection As Boolean
    resetSelection = False
    On Error Resume Next
    ' this only applies to Office 2007
    If Val(Application.version) >= kWord2007 Then
        ' use Win32 API to obtain the state of the return key
        ' the high order bit is set to 1 if the return key is down
        ' which looks like a negative integer
        Dim result As Integer
        result = GetKeyState(KeyCodeConstants.vbKeyReturn)
        ' keep the selection in case we need to revert back to it
        Dim savedRng As Range
        Set savedRng = Selection.Range.Duplicate

        ' the following variables are used to achieve late binding
        ' (i.e. for compiling on pre-Office 2007)
        Dim tbl
        Dim sel
        Set sel = Selection
        With sel
            Set tbl = .Tables(1)

            ' EB equations we have inserted are suspposed to have a table around them
            If IsEmpty(tbl) Then
                ' we did not change the selection, so just bail
                Application.ScreenUpdating = True
                Exit Sub
            End If

            ' if the return key is pressed, and we are in a EB equation table,
            ' but we are not inside a EB equation
            If result < 0 And                 .Information(wdWithInTable) And                 tbl.style.NameLocal = mttstyle_EB_NUMBERED_EQUATION And                 sel.OMaths.Count = 0 Then

                ' backup one character and see if we are in a EB equation
                .MoveLeft

                If sel.OMaths.Count > 0 Then
                    ' since we are in a EB equation, move one more to the left,
                    ' which should put the cursor just after the equation,
                    ' but before the return character, and then delete
                    .MoveLeft
                    .Delete
                    ' now jump out of the table and enter a new paragraph,
                    ' which is what the user really wanted to do
                    While .Information(wdWithInTable)
                        If .MoveRight = 0 Then Exit Sub
                    Wend
                    .TypeParagraph
                    .MoveLeft
                Else
                    resetSelection = True
                End If
            End If
        End With
    End If
done:
    If resetSelection Then
        ' we must not be in a EB equation, so reset the selection
        savedRng.Select
    End If
    Application.ScreenUpdating = True
#End If
End Sub

Streams

Stream Path: AssertDlg/\x1CompObj, File Type: data, Stream Size: 97

General
Stream Path:	AssertDlg/\x1CompObj
File Type:	data
Stream Size:	97
Entropy:	3.61064918306
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t F o r m s 2 . 0 F o r m . . . . . E m b e d d e d O b j e c t . . . . . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 46 6f 72 6d 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: AssertDlg/\x3VBFrame, File Type: ASCII text, with CRLF line terminators, Stream Size: 301

General
Stream Path:	AssertDlg/\x3VBFrame
File Type:	ASCII text, with CRLF line terminators
Stream Size:	301
Entropy:	4.61089562348
Base64 Encoded:	True
Data ASCII:	V E R S I O N 5 . 0 0 . . B e g i n { C 6 2 A 6 9 F 0 - 1 6 D C - 1 1 C E - 9 E 9 8 - 0 0 A A 0 0 5 7 4 A 4 F } A s s e r t D l g . . C a p t i o n = " A s s e r t i o n F a i l u r e ! " . . C l i e n t H e i g h t = 1 5 1 5 . . C l i e n t L e f t = 4 5 . . C l i e n t T o p = 4 3 5 . . C l i e n t W i d t h = 3 2 5 5 . . S t a r t U p P o s i t i o n = 1 '
Data Raw:	56 45 52 53 49 4f 4e 20 35 2e 30 30 0d 0a 42 65 67 69 6e 20 7b 43 36 32 41 36 39 46 30 2d 31 36 44 43 2d 31 31 43 45 2d 39 45 39 38 2d 30 30 41 41 30 30 35 37 34 41 34 46 7d 20 41 73 73 65 72 74 44 6c 67 20 0d 0a 20 20 20 43 61 70 74 69 6f 6e 20 20 20 20 20 20 20 20 20 3d 20 20 20 22 41 73 73 65 72 74 69 6f 6e 20 46 61 69 6c 75 72 65 21 22 0d 0a 20 20 20 43 6c 69 65 6e 74 48 65 69

Stream Path: AssertDlg/f, File Type: data, Stream Size: 235

General
Stream Path:	AssertDlg/f
File Type:	data
Stream Size:	235
Entropy:	4.12189948138
Base64 Encoded:	False
Data ASCII:	. . $ . . . . . . . . . . . . . . . . . . } . . m . . . p . . . . . . . . . . . . R . . . . . . . . . . . K . Q . . . . . . D B . . . T a h o m a . . . . . . . . . . . . . c . . 0 . . . . . . . . . . . . . 8 . . . . . . . C o m m a n d B u t t o n I g n o r e n . . . . . . . . . . 0 . . . . . . . . . . . . . 8 . . . . . . . C o m m a n d B u t t o n B r e a k e n . . . . . . . . . . ( . . . . . . . . . . . . . 2 . . . H . . . . . . . M e s s a g e . . . . . . . . .
Data Raw:	00 04 24 00 08 0c 10 0c 04 00 00 00 ff ff 00 00 0a 00 00 00 00 7d 00 00 6d 16 00 00 70 0a 00 00 00 00 00 00 00 00 00 00 03 52 e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b8 51 01 00 00 00 90 01 44 42 01 00 06 54 61 68 6f 6d 61 00 00 03 00 00 00 98 00 00 00 00 83 01 63 00 00 30 00 e5 01 00 00 13 00 00 80 01 00 00 00 38 00 00 00 00 00 11 00 43 6f 6d 6d 61 6e 64 42 75 74 74 6f 6e 49 67 6e 6f

Stream Path: AssertDlg/o, File Type: data, Stream Size: 184

General
Stream Path:	AssertDlg/o
File Type:	data
Stream Size:	184
Entropy:	3.67405068542
Base64 Encoded:	False
Data ASCII:	. . . . ( . . . . . . . I g n o r e . . . . . . O . . . . . . . u . . . . . . . . . . . . . . . T a h o m a . . . . . . ( . . . . . . . B r e a k . . . . . . . O . . . . . . . u . . . . . . . . . . . . . . . T a h o m a . . . . ( . ( . . . . . . . A n e r r o r o c c u r r e d i n x . . . . . . " . . . . . . . 5 . . . . . . . . . . . . . . . T a h o m a . .
Data Raw:	00 02 18 00 28 00 00 00 06 00 00 80 49 67 6e 6f 72 65 00 00 ec 09 00 00 4f 03 00 00 00 02 18 00 75 00 00 00 06 00 00 80 a5 00 00 00 00 02 03 00 54 61 68 6f 6d 61 00 00 00 02 18 00 28 00 00 00 05 00 00 80 42 72 65 61 6b 01 00 00 ec 09 00 00 4f 03 00 00 00 02 18 00 75 00 00 00 06 00 00 80 a5 00 00 00 00 02 03 00 54 61 68 6f 6d 61 00 00 00 02 28 00 28 00 00 00 16 00 00 80 41 6e 20 65

Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 1604

General
Stream Path:	PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	1604
Entropy:	5.17219641781
Base64 Encoded:	True
Data ASCII:	I D = " { 0 0 0 0 0 0 0 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 0 0 0 0 0 0 0 0 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . M o d u l e = M o d u l e 1 . . C l a s s = M T W 5 . . C l a s s = C a l l b a c k G u a r d . . C l a s s = C o m m a n d G u a r d . . C l a s s = A u t o E x e c C l s . . C l a s s = U I H e l p C l s . . C l a s s = U I L i b C l s . . C l a s s = U I W r a p p e r s C l s . . C l a s s = U I R i b b o n C l s . . B a s e C l a s s = A s s e r t
Data Raw:	49 44 3d 22 7b 30 30 30 30 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 31 0d 0a 43 6c 61 73 73 3d 4d 54 57 35 0d 0a 43 6c 61 73 73 3d 43 61 6c 6c 62 61 63 6b 47 75 61 72 64 0d 0a

Stream Path: PROJECTwm, File Type: data, Stream Size: 881

General
Stream Path:	PROJECTwm
File Type:	data
Stream Size:	881
Entropy:	3.92568374824
Base64 Encoded:	False
Data ASCII:	T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . M o d u l e 1 . M . o . d . u . l . e . 1 . . . M T W 5 . M . T . W . 5 . . . C a l l b a c k G u a r d . C . a . l . l . b . a . c . k . G . u . a . r . d . . . C o m m a n d G u a r d . C . o . m . m . a . n . d . G . u . a . r . d . . . A u t o E x e c C l s . A . u . t . o . E . x . e . c . C . l . s . . . U I H e l p C l s . U . I . H . e . l . p . C . l . s . . . U I L i b C l s . U . I . L . i . b . C . l . s . . . U I W r
Data Raw:	54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 4d 6f 64 75 6c 65 31 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 31 00 00 00 4d 54 57 35 00 4d 00 54 00 57 00 35 00 00 00 43 61 6c 6c 62 61 63 6b 47 75 61 72 64 00 43 00 61 00 6c 00 6c 00 62 00 61 00 63 00 6b 00 47 00 75 00 61 00 72 00 64 00 00 00 43 6f 6d 6d 61 6e 64 47

Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 39170

General
Stream Path:	VBA/_VBA_PROJECT
File Type:	data
Stream Size:	39170
Entropy:	5.94645913424
Base64 Encoded:	True
Data ASCII:	. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 .
Data Raw:	cc 61 b2 00 00 03 00 ff 09 04 00 00 09 04 00 00 e4 04 03 00 00 00 00 00 00 00 00 00 01 00 06 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: VBA/__SRP_0, File Type: data, Stream Size: 74345

General
Stream Path:	VBA/__SRP_0
File Type:	data
Stream Size:	74345
Entropy:	3.76850388625
Base64 Encoded:	False
Data ASCII:	. K * . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	93 4b 2a b2 03 00 40 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 01 00 02 00 01 00 00 00 00 00 01 00 00 00 04 00 00 00 00 00 01 00 02 00 04 00 00 00 00 00 01 00 00 00 05 00 00 00 00 00 01 00 02 00 05 00 00 00 00 00 01 00 00 00 06 00 00 00 00 00 01 00 02 00 06 00 00 00 00 00 01 00

Stream Path: VBA/__SRP_1, File Type: data, Stream Size: 6716

General
Stream Path:	VBA/__SRP_1
File Type:	data
Stream Size:	6716
Entropy:	3.13388858153
Base64 Encoded:	True
Data ASCII:	r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 c0 02 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 02 00 00 00 00 00 00 7e 02 00 00 00 00 00 00 7e 02 00 00 00 00 00 00 7e 02 00 00 00 00 00 00 7e 02 00 00 00 00 00 00 7e 02 00 00 00 00 00 00 7e 02 00 00 00 00 00 00 7e 02 00 00 00 00 00 00 7e 02 00 00 00 00 00 00 7e 02 00 00 00 00 00 00 7e 02 00 00 00 00 00 00 7e 02 00 00 00 00 00

Stream Path: VBA/__SRP_10, File Type: data, Stream Size: 14840

General
Stream Path:	VBA/__SRP_10
File Type:	data
Stream Size:	14840
Entropy:	3.43421895381
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . ( . ; . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . q ? . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . q 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . . . . . . . . . . . @ . . . . . . . . . . . ) . . . .
Data Raw:	72 55 40 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 11 00 a0 03 00 00 00 00 00 00 00 00 00 00 28 00 28 00 3b 00 00 00 11 d4 01 00 00 00 00 00 00 00 00 00 51 d5 01 00 00 00 00 00 00 00 00 00 c1 de 01 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_11, File Type: data, Stream Size: 2138

General
Stream Path:	VBA/__SRP_11
File Type:	data
Stream Size:	2138
Entropy:	2.39245767099
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . h . . 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . @ . . . . . . . . . . . . . . . . h . . A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . 8 . . . . . . . . . . . . . . . . ` . . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 10 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 88 00 00 00 08 00 40 00 e1 01 00 00 00 00 00 00 00 00 10 00 01 00 03 68 05 01 39 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_12, File Type: data, Stream Size: 2527

General
Stream Path:	VBA/__SRP_12
File Type:	data
Stream Size:	2527
Entropy:	3.75579695768
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . : . . . . . . . . . . Q < . . . . . . . . . . . 7 . . . . . . . . . . . . . . . . . . . . . . A 8 . . . . . . . . . . q : . . . . . . . . . . . 7 . . . . . . . . . . Q > . . . . . . . . . . . > . . . . . . . . . . . . . . . . . . . . . . . > . . . . . . . . . . Q A
Data Raw:	72 55 80 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 13 00 10 00 00 00 00 00 00 00 00 00 12 00 04 00 04 00 1e 00 00 00 d1 38 02 00 00 00 00 00 00 00 00 00 d1 3a 02 00 00 00

Stream Path: VBA/__SRP_13, File Type: data, Stream Size: 468

General
Stream Path:	VBA/__SRP_13
File Type:	data
Stream Size:	468
Entropy:	2.10844697258
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . X . q . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . P . P . ` . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 12 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 40 00 f1 00 00 00 00 00 00 00 00 00 12 00 00 00 00 60 04 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_14, File Type: data, Stream Size: 126

General
Stream Path:	VBA/__SRP_14
File Type:	data
Stream Size:	126
Entropy:	1.09213825498
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 15 00 10 00 00 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00 62 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_15, File Type: data, Stream Size: 870

General
Stream Path:	VBA/__SRP_15
File Type:	data
Stream Size:	870
Entropy:	0.541801276276
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . < . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 14 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_16, File Type: data, Stream Size: 1030

General
Stream Path:	VBA/__SRP_16
File Type:	data
Stream Size:	1030
Entropy:	0.67757546715
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 17 00 10 00 00 00 00 00 00 00 00 00 16 00 71 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff

Stream Path: VBA/__SRP_17, File Type: data, Stream Size: 10036

General
Stream Path:	VBA/__SRP_17
File Type:	data
Stream Size:	10036
Entropy:	2.61277503034
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ` . Q z . . . . . . . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . U . . . . . . . . . @ . . ~ . . . . . . . . . . 0 . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . a { . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 16 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 60 00 51 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 70 0c 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_18, File Type: data, Stream Size: 23636

General
Stream Path:	VBA/__SRP_18
File Type:	data
Stream Size:	23636
Entropy:	3.77334736791
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 . 7 . . . . . . 7 . . . . . . . . . . ! . . . . . . . . . . . A = . . . . . . . . . . q 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . .
Data Raw:	72 55 80 05 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 19 00 10 00 00 00 00 00 00 00 00 00 18 00 37 00 37 00 c6 00 00 00 01 37 00 00 00 00 00 00 00 00 18 00 21 bd 01 00 00 00

Stream Path: VBA/__SRP_19, File Type: data, Stream Size: 3374

General
Stream Path:	VBA/__SRP_19
File Type:	data
Stream Size:	3374
Entropy:	2.37540979139
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . @ . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . Q " . . . . . . . . . . . . . . . . O . @ . q . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . Q " . . . . . . . . . . . . . . . . O . 8 . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 18 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 28 00 00 00 08 00 40 00 f1 00 00 00 00 00 00 00 00 00 18 00 00 00 00 60 04 04 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_1a, File Type: data, Stream Size: 1972

General
Stream Path:	VBA/__SRP_1a
File Type:	data
Stream Size:	1972
Entropy:	3.70403159496
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . U . . . . . . . . . . . . . . . . . . . . . . ! . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . . X . . . . . . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 1b 00 10 00 00 00 00 00 00 00 00 00 1a 00 03 00 03 00 14 00 00 00 11 d4 01 00 00 00 00 00 00 00 00 00 51 d5 01 00 00 00

Stream Path: VBA/__SRP_1b, File Type: data, Stream Size: 272

General
Stream Path:	VBA/__SRP_1b
File Type:	data
Stream Size:	272
Entropy:	1.90803028298
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . a . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . 8 . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 38 00 f1 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_1c, File Type: data, Stream Size: 631

General
Stream Path:	VBA/__SRP_1c
File Type:	data
Stream Size:	631
Entropy:	2.66697887484
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 . A . . . . . . . . . 2 . . . . . . . . . L . . . . . . . g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . g . $ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . g . . . . . v . . . . . . . . . . . . . . L . . . L . . . . . . . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 1d 00 10 00 00 00 00 00 00 00 00 00 1c 00 02 00 02 00 02 00 00 00 81 02 00 00 00 00 00 00 00 00 32 00 41 05 00 00 00 00

Stream Path: VBA/__SRP_1d, File Type: data, Stream Size: 304

General
Stream Path:	VBA/__SRP_1d
File Type:	data
Stream Size:	304
Entropy:	2.00539599894
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . X . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . % . . . . . . . . . . 1 % . . . . . . . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . % . . . . . . . . . . 1 % . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 1c 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 58 00 f1 00 00 00 00 00 00 00 00 00 1c 00 00 00 00 60 0c 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_1e, File Type: data, Stream Size: 3371

General
Stream Path:	VBA/__SRP_1e
File Type:	data
Stream Size:	3371
Entropy:	3.04600285048
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . " . . . . 2 . . . . . . . . . . 1 k . . . . . . . . . . . . . . . . . . . . . . ! . . . . . . . . . . . . l . . . . . . . . . . a . . . . . . . . . . . . l . . . . . . . . . . Q . . . . . . . . . . . . m . . . . . . . . . . . . . . . . . . . . . . q n . . . . . . . . . . q . . . . . . . . . . . . n
Data Raw:	72 55 40 01 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 1f 00 10 00 00 00 00 00 00 00 00 00 1e 00 0b 00 00 00 22 00 00 00 81 32 00 00 00 00 00 00 00 00 18 00 31 6b 00 00 00 00

Stream Path: VBA/__SRP_1f, File Type: data, Stream Size: 682

General
Stream Path:	VBA/__SRP_1f
File Type:	data
Stream Size:	682
Entropy:	1.9414668744
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . a . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 1e 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 38 00 f1 00 00 00 00 00 00 00 00 00 1e 00 00 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_2, File Type: data, Stream Size: 344

General
Stream Path:	VBA/__SRP_2
File Type:	data
Stream Size:	344
Entropy:	1.75432382311
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . . q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 01 00 11 10 00 00 00 00 00 00 00 00 00 00 41 10 00 00 00 00 00 00 00 00 00 00 71 10

Stream Path: VBA/__SRP_20, File Type: data, Stream Size: 27269

General
Stream Path:	VBA/__SRP_20
File Type:	data
Stream Size:	27269
Entropy:	4.20288321849
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . Q . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! . . . . . . . . . . . .
Data Raw:	72 55 40 01 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 21 00 10 00 00 00 00 00 00 00 00 00 20 00 0c 00 0c 00 a2 00 00 00 a1 0e 00 00 00 00 00 00 00 00 20 00 51 81 02 00 00 00

Stream Path: VBA/__SRP_21, File Type: data, Stream Size: 866

General
Stream Path:	VBA/__SRP_21
File Type:	data
Stream Size:	866
Entropy:	2.28887306105
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . @ . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . a ' . . . . . . . . . . . . . . . . P . 8 . q . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . 1 $ . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 20 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 38 00 00 00 08 00 40 00 f1 00 00 00 00 00 00 00 00 00 20 00 00 00 00 60 04 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_22, File Type: data, Stream Size: 979

General
Stream Path:	VBA/__SRP_22
File Type:	data
Stream Size:	979
Entropy:	3.3164077514
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . " . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . Q . . . . . . . . . . . p & . . . . . . . . . . . & . . . . . . . . . . . . . . . . . . @ . . . . . . . g . . . . . g . 0 . . . . . . . . . . . . . Z . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 23 00 10 00 00 00 00 00 00 00 00 00 22 00 02 00 00 00 08 00 00 00 11 d4 01 00 00 00 00 00 00 00 00 00 c1 de 01 00 00 00

Stream Path: VBA/__SRP_23, File Type: data, Stream Size: 220

General
Stream Path:	VBA/__SRP_23
File Type:	data
Stream Size:	220
Entropy:	1.90644832216
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . " . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . " . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . a . . . . . . . . . " . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . 1 $ . . . . . . . . . . . . . . . . P . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 22 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 38 00 f1 00 00 00 00 00 00 00 00 00 22 00 00 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_24, File Type: data, Stream Size: 2796

General
Stream Path:	VBA/__SRP_24
File Type:	data
Stream Size:	2796
Entropy:	3.11794997464
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . % . . . . . . . . . . . . . . . . . . . . . Q 5 . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . . . . . ` " . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . q . . . . .
Data Raw:	72 55 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 25 00 10 04 00 00 00 00 00 00 00 00 00 00 05 00 00 00 11 00 00 00 51 35 00 00 00 00 00 00 00 00 18 00 f1 17 00 00 00 00 00 00 00 00 00 00 51 fe 01 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_25, File Type: data, Stream Size: 544

General
Stream Path:	VBA/__SRP_25
File Type:	data
Stream Size:	544
Entropy:	2.33168605515
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . . . . . . . . . . . . . ` . . . . . . . . . . . $ . . . . ` . . P . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C . C . H . . . . . . . . . . . $ . . . . ` . . X . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 24 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 88 00 00 00 08 00 60 00 01 03 00 00 00 00 00 00 00 00 24 00 00 00 03 60 0c 00 50 00 38 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_26, File Type: data, Stream Size: 5759

General
Stream Path:	VBA/__SRP_26
File Type:	data
Stream Size:	5759
Entropy:	3.43391637573
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ' . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . . . . . q 9 . . . . . . . . . . . " . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . q . . . . . . . . . . . . " . . . . . . . . . . . ? . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 27 00 90 04 00 00 00 00 00 00 00 00 00 00 0e 00 0e 00 2e 00 00 00 11 d4 01 00 00 00 00 00 00 00 00 00 11 8f 02 00 00 00 00 00 00 00 00 00 51 95 02 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_27, File Type: data, Stream Size: 840

General
Stream Path:	VBA/__SRP_27
File Type:	data
Stream Size:	840
Entropy:	2.32221019555
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . & . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . & . . . . h . . 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . @ . . . . . . . . . . . & . . . . h . . A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . 8 . . . . . . . . . . . & . . . . ` . . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 26 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 88 00 00 00 08 00 40 00 e1 01 00 00 00 00 00 00 00 00 26 00 01 00 03 68 05 01 39 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_28, File Type: data, Stream Size: 1394

General
Stream Path:	VBA/__SRP_28
File Type:	data
Stream Size:	1394
Entropy:	2.42917925723
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ) . . . . . . . . . . . . . . . . . . . . . . D . . . . . . . . . . . C . . . . . . . . . . . . . . . . . . . 9 . . . . . . . . . . . : . . . . . . . . . . 1 : . . . . . . . . . . a : . . . . . . . . . . . . . . . . . . . 9 . . . . . . . . . . . . . . ` . . . . : . . . . . . . . . . 1 . . . . . . . . . . . . : . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 29 00 f0 04 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 11 44 02 00 00 00 00 00 00 00 00 00 d1 43 02 00 00 00 00 00 00 00 00 00 02 00 01 00 00 00 04 00 d1 39

Stream Path: VBA/__SRP_29, File Type: data, Stream Size: 206

General
Stream Path:	VBA/__SRP_29
File Type:	data
Stream Size:	206
Entropy:	1.94364695851
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . ( . . . . ` . . 8 . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . ! . . . . . . . . . ( . . . . ` . . @ . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 28 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 90 00 00 00 08 00 38 00 e1 01 00 00 00 00 00 00 00 00 28 00 00 00 03 60 00 00 38 03 38 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_2a, File Type: data, Stream Size: 443

General
Stream Path:	VBA/__SRP_2a
File Type:	data
Stream Size:	443
Entropy:	2.59447499578
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + . . . . . . . . . . . * . . . . . . . . . . 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . p . . . . . . . g . . . . . g . . . . . p . . . . . g . V . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 2b 00 10 00 00 00 00 00 00 00 00 00 2a 00 01 00 00 00 05 00 00 00 81 32 00 00 00 00 00 00 00 00 18 00 90 05 00 00 00 00

Stream Path: VBA/__SRP_2b, File Type: data, Stream Size: 162

General
Stream Path:	VBA/__SRP_2b
File Type:	data
Stream Size:	162
Entropy:	1.59284262093
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . * . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 2a 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 38 00 f1 00 00 00 00 00 00 00 00 00 2a 00 00 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_2c, File Type: data, Stream Size: 1989

General
Stream Path:	VBA/__SRP_2c
File Type:	data
Stream Size:	1989
Entropy:	2.89159708265
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . , . . . . . . . . . Q 5 . . . . . . . . . . . . . . . . . . . . . . . & . . . . . . . . . . . . . . . . . . . . . . . ' . . . . . . . . . . . 2 . . . . . . . . . . . ' . . . . . . . . . . ! ( . . . . . . . . . . . ( . . . . . . . . . . . . . . . . . . . . . . Q ) . . . . . . . . . . . . . . . . . . d . . . . .
Data Raw:	72 55 c0 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 2d 00 10 00 00 00 00 00 00 00 00 00 2c 00 07 00 00 00 0b 00 00 00 51 35 00 00 00 00 00 00 00 00 18 00 f1 17 00 00 00 00

Stream Path: VBA/__SRP_2d, File Type: data, Stream Size: 462

General
Stream Path:	VBA/__SRP_2d
File Type:	data
Stream Size:	462
Entropy:	1.91452705968
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . , . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . a . . . . . . . . . , . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . , . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . , . . . . ` . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 2c 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 38 00 f1 00 00 00 00 00 00 00 00 00 2c 00 00 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_2e, File Type: data, Stream Size: 589

General
Stream Path:	VBA/__SRP_2e
File Type:	data
Stream Size:	589
Entropy:	2.96038976847
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . / . . . . . . . . . . . . . . . . . . . . . . 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 + . . . . . . . . . . . . . . . . . . . . . . 1 G . . . . . . . . . . . / . . . . . . . . . . . C . . . . . . . . . . : . . . . . . . . . . . . . . . g . . . . . g . V . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 2f 00 10 00 00 00 00 00 00 00 00 00 2e 00 01 00 00 00 08 00 00 00 81 32 00 00 00 00 00 00 00 00 18 00 f1 00 00 00 00 00

Stream Path: VBA/__SRP_2f, File Type: data, Stream Size: 200

General
Stream Path:	VBA/__SRP_2f
File Type:	data
Stream Size:	200
Entropy:	1.83696840359
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . X . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . $ . . . . . . . . . . . . . . . . ^ . Q $ . . . . . . . . . . O . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 2e 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 58 00 f1 00 00 00 00 00 00 00 00 00 2e 00 00 00 00 60 08 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_3, File Type: data, Stream Size: 106

General
Stream Path:	VBA/__SRP_3
File Type:	data
Stream Size:	106
Entropy:	1.35911194617
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 78 00 00 00 08 00 00 00 00 00 00 00 62 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_30, File Type: data, Stream Size: 126

General
Stream Path:	VBA/__SRP_30
File Type:	data
Stream Size:	126
Entropy:	1.09213825498
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . 0 . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 31 00 10 00 00 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 62 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_31, File Type: data, Stream Size: 136

General
Stream Path:	VBA/__SRP_31
File Type:	data
Stream Size:	136
Entropy:	1.19073785099
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 30 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 62 00 00 00 00 00 00 7f

Stream Path: VBA/__SRP_32, File Type: data, Stream Size: 2220

General
Stream Path:	VBA/__SRP_32
File Type:	data
Stream Size:	2220
Entropy:	3.78989673458
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 . . . . . . . . . . . 2 . . . . . . . . . . . . . . . . . . . 2 . 1 . . . . . . . . . . . ! . . . . . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 33 00 10 00 00 00 00 00 00 00 00 00 32 00 03 00 03 00 0b 00 00 00 f1 00 00 00 00 00 00 00 00 00 32 00 31 db 01 00 00 00

Stream Path: VBA/__SRP_33, File Type: data, Stream Size: 388

General
Stream Path:	VBA/__SRP_33
File Type:	data
Stream Size:	388
Entropy:	2.13417830026
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 . . . . . . . . . . . . . . . . . . . . . . . P . . . . . . . . . . . 2 . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . 1 % . . . . . . . . . . . . . . . . . . . . X . . . . . . . . . . . 2 . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . 1 % . . . . . . . . . . . % . . . . . . . . . . . . . . . . . . . . . . ` .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 32 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 50 00 f1 00 00 00 00 00 00 00 00 00 32 00 00 00 00 60 08 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_34, File Type: data, Stream Size: 11843

General
Stream Path:	VBA/__SRP_34
File Type:	data
Stream Size:	11843
Entropy:	3.09268370555
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 . . . . . . . . . . . 4 . , . , . Q . . . Q 5 . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . A . . . . . . . . . . . . 2 . . . . . . . . . . . ^ . . . . . . . . . . A . . . . . . . . . . . ! Y . . . . . . . . . . . . . . . . . . . . . . ! Z . . . . . . . . . . q . . . . . . . . . . . . \\ . . . . . . . . . . Q .
Data Raw:	72 55 80 05 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 35 00 10 00 00 00 00 00 00 00 00 00 34 00 2c 00 2c 00 51 00 00 00 51 35 00 00 00 00 00 00 00 00 18 00 f1 17 00 00 00 00

Stream Path: VBA/__SRP_35, File Type: data, Stream Size: 3612

General
Stream Path:	VBA/__SRP_35
File Type:	data
Stream Size:	3612
Entropy:	2.34040950695
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 . . . . . . . . . . . . . . . . . . . . . . . H . . . . . . . . . . . 4 . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . Q & . . . . . . . . . . . . . . . . ^ . . & . . . . . . . . . . X . q . . . . . . . . . 4 . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . . . . . . . . . . . . . . . . . . ^ . Q $ . . . . . . . . . . O . H . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 34 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 18 00 00 00 08 00 48 00 f1 00 00 00 00 00 00 00 00 00 34 00 00 00 00 60 04 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_4, File Type: data, Stream Size: 126

General
Stream Path:	VBA/__SRP_4
File Type:	data
Stream Size:	126
Entropy:	1.07626523911
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 05 00 10 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 62 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_5, File Type: data, Stream Size: 106

General
Stream Path:	VBA/__SRP_5
File Type:	data
Stream Size:	106
Entropy:	1.35911194617
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 04 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 00 00 00 00 00 00 62 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_6, File Type: data, Stream Size: 2096

General
Stream Path:	VBA/__SRP_6
File Type:	data
Stream Size:	2096
Entropy:	3.51520064054
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! I . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . . . .
Data Raw:	72 55 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 07 00 c0 01 00 00 00 00 00 00 00 00 00 00 03 00 03 00 16 00 00 00 f1 00 00 00 00 00 00 00 00 00 1a 00 11 04 00 00 00 00 00 00 00 00 1a 00 21 49 00 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_7, File Type: data, Stream Size: 256

General
Stream Path:	VBA/__SRP_7
File Type:	data
Stream Size:	256
Entropy:	2.01363296478
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . 8 . . . . . . . . . . . . . . . . ` . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . ! . . . . . . . . . . . . . . ` . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 06 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 78 00 00 00 08 00 38 00 e1 01 00 00 00 00 00 00 00 00 06 00 00 00 03 60 00 00 38 00 18 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_8, File Type: data, Stream Size: 2364

General
Stream Path:	VBA/__SRP_8
File Type:	data
Stream Size:	2364
Entropy:	3.56670491156
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! I . . . . . . . . . . . 6 . . . . . . . . . . . . . . . . . . . . . . Q 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . .
Data Raw:	72 55 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 09 00 20 02 00 00 00 00 00 00 00 00 00 00 03 00 03 00 18 00 00 00 21 cb 01 00 00 00 00 00 00 00 00 00 01 be 01 00 00 00 00 00 00 00 00 00 61 d1 01 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_9, File Type: data, Stream Size: 256

General
Stream Path:	VBA/__SRP_9
File Type:	data
Stream Size:	256
Entropy:	1.99211040616
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . 8 . . . . . . . . . . . . . . . . ` . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . ! . . . . . . . . . . . . . . ` . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 08 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 78 00 00 00 08 00 38 00 e1 01 00 00 00 00 00 00 00 00 08 00 00 00 03 60 00 00 38 00 18 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_a, File Type: data, Stream Size: 8151

General
Stream Path:	VBA/__SRP_a
File Type:	data
Stream Size:	8151
Entropy:	4.06518289704
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q I . . . . . . . . . . . K . . . . . . . . . . . B . . . . . . . . . . . F . . . . . . . . . . ! . . . . . . . . . . . Q Q . . . . . . . . . . Q . . . . . . . . . . . Q . . . . . . . . . . . . K . . . . . . . . . . . . . . . . . . . . . Q U . . . .
Data Raw:	72 55 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 0b 00 80 02 00 00 00 00 00 00 00 00 00 00 07 00 07 00 6a 00 00 00 f1 00 00 00 00 00 00 00 00 00 1c 00 f1 00 00 00 00 00 00 00 00 00 12 00 11 d4 01 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_b, File Type: data, Stream Size: 524

General
Stream Path:	VBA/__SRP_b
File Type:	data
Stream Size:	524
Entropy:	2.27126212352
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . h . . 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . @ . . . . . . . . . . . . . . . . h . . A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . 8 . . . . . . . . . . . . . . . . ` . . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 0a 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 88 00 00 00 08 00 40 00 e1 01 00 00 00 00 00 00 00 00 0a 00 01 00 03 68 05 01 39 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_c, File Type: data, Stream Size: 6281

General
Stream Path:	VBA/__SRP_c
File Type:	data
Stream Size:	6281
Entropy:	3.55276952378
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ' . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . q ? . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . q 9 . . . .
Data Raw:	72 55 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 0d 00 e0 02 00 00 00 00 00 00 00 00 00 00 0f 00 0f 00 27 00 00 00 91 de 02 00 00 00 00 00 00 00 00 00 d1 df 02 00 00 00 00 00 00 00 00 00 31 fe 00 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_d, File Type: data, Stream Size: 920

General
Stream Path:	VBA/__SRP_d
File Type:	data
Stream Size:	920
Entropy:	2.3455448616
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . h . . 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . @ . . . . . . . . . . . . . . . . h . . A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . 8 . . . . . . . . . . . . . . . . ` . . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 0c 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 88 00 00 00 08 00 40 00 e1 01 00 00 00 00 00 00 00 00 0c 00 01 00 03 68 05 01 39 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/__SRP_e, File Type: data, Stream Size: 11114

General
Stream Path:	VBA/__SRP_e
File Type:	data
Stream Size:	11114
Entropy:	3.63691431837
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . P . . . q 9 . . . . . . . . . . . . . . . . . . . . . . . ? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . . . . . A . . . . .
Data Raw:	72 55 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 0f 00 40 03 00 00 00 00 00 00 00 00 00 00 19 00 19 00 50 00 00 00 71 39 00 00 00 00 00 00 00 00 18 00 f1 17 00 00 00 00 00 00 00 00 00 00 11 3f 00 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_f, File Type: data, Stream Size: 1494

General
Stream Path:	VBA/__SRP_f
File Type:	data
Stream Size:	1494
Entropy:	2.44115473518
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . h . . 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . @ . . . . . . . . . . . . . . . . h . . A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . 8 . . . . . . . . . . . . . . . . ` . . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 0e 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 88 00 00 00 08 00 40 00 e1 01 00 00 00 00 00 00 00 00 0e 00 01 00 03 68 05 01 39 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/dir, File Type: MIPSEB MIPS-II ECOFF executable not stripped - version 72.3, Stream Size: 2178

General
Stream Path:	VBA/dir
File Type:	MIPSEB MIPS-II ECOFF executable not stripped - version 72.3
Stream Size:	2178
Entropy:	6.98838182245
Base64 Encoded:	True
Data ASCII:	. c . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . M a t h T y p e . C o m m a n d s . . . L . . @ . . . . . Z = . . . . ~ . . . . . . . . . . . $ X . . . . . . . 8 W o r d . = 1 : P P ! . . 0 < . " . . . o . . r . d . . = . . . 1 . . : . . P . P C . . . . 0 . . . . l s @ t d o l e > . L . . . s . t . 1 o . l @ . e . . . h . E ^ . . . * \\ G { 0 0 0 . 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 6 . } # 2 . 0 # 0 # . C : \\ W i n d o . w s \\ S y s t e . m 3 2 \\ . 2 2 . t . l b #
Data Raw:	01 63 b7 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 10 00 1c 00 4d 61 74 68 54 79 70 65 00 43 6f 6d 6d 61 6e 64 73 a2 05 00 4c 00 00 40 02 0a 06 02 0a 5a 3d 02 0a 07 02 7e 01 14 08 06 12 09 01 02 12 c1 8c 24 58 d9 00 0c 04 00 11 00 38 57 6f 72 64 20 00 3d 20 31 20 3a 20 50 50 21 00 08 30 3c 00 22 01 16 00 6f 00 00 72 00 64 00 20 00 3d

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

• WINWORD.EXE

Click to jump to process

Memory Usage

• WINWORD.EXE

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

System Behavior

Analysis Process: WINWORD.EXEPID: 6896, Parent PID: 744

Function Logs

General

Target ID:	0
Start time:	16:32:17
Start date:	09/02/2022
Path:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x50000
File size:	1937688 bytes
MD5 hash:	0B9AB9B9C4DE429473D6450D4297A123
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

File Activities

File Opened

File Created

File Deleted

File Written

File Attributes Queried

Directory Queried

Other File Operations

Volume Information Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Key Opened

Key Created

Key Deleted

Key Value Created

Key Value Modified

Key Value Deleted

Key Monitored

Show Windows behavior

Mutex Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

Process Information Set

Show Windows behavior

Thread Activities

Thread Created

Thread Delayed

Thread Information Set

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

System Activities

Language or Locale ID Queried

System Information Queried

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

Window Created

Window UI Enumerated

Message Posted to Windows UI

Window UIs Event Hook Set

Show Windows behavior

Network Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Object Security Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An app could contain malicious code in obfuscated or encrypted form, then deobfuscate or decrypt the code at runtime to evade many app vetting techniques.
Tactics:	Defense Evasion
Data Sources:
Platforms:	Android, iOS
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MathType Commands 6 For Word 2016.dotm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\28779A37-AFF8-4DF3-9AEE-F5056C51577D

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{8C259D24-9E0A-43A2-BE9A-DB48617F29ED}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{94EA859A-E9F8-4782-9053-D15570117EA8}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E14C8716-568E-4382-A8F5-7B59BED598FE}.tmp

C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd

C:\Users\user\AppData\Local\Temp\~DF261296C872412495.TMP

C:\Users\user\AppData\Local\Temp\~DF6FFD328AA4FD46DC.TMP

C:\Users\user\AppData\Local\Temp\~DF86B2F80858D4E010.TMP

C:\Users\user\AppData\Local\Temp\~DFE2EC4E5DC0D7925B.TMP

C:\Users\user\AppData\Local\Temp\~DFFCF043BC40DA11AD.TMP

C:\Users\user\AppData\Roaming\Microsoft\Forms\WINWORD.box

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO0127.acl

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\MathType Commands 6 For Word 2016.dotm.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

C:\Users\user\Desktop\~$thType Commands 6 For Word 2016.dotm

Static File Info

General

File Icon

Static OLE Info

General

OLE File "/opt/package/joesandbox/database/analysis/569457/sample/MathType Commands 6 For Word 2016.dotm"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: AssertDlg.frm, Stream Size: 2431

General

Windows Analysis Report
MathType Commands 6 For Word 2016.dotm