Edit tour

Windows Analysis Report
DOI_WORD_Check.doc

Overview

General Information

Sample name:	DOI_WORD_Check.doc
Analysis ID:	1520614
MD5:	d201807278ecd18ee692bee3b2693fa7
SHA1:	9e8ba7fdc3118e46569a60897f01fea1e0dc83f8
SHA256:	a77d4a98127656b0d8e41a381099ca386a2d4882139151aa1f063f6712d4e03a
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Document contains an embedded VBA which might only executes on specific systems (country or language check)

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 3188 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

cleanup

Sigma Signatures

System Summary

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3188, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7A882433-8103-4FF1-ACEF-2A1807CF08D6}.tmp

Jump to behavior

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: DOI_WORD_Check.doc	OLE, VBA macro line: TempPath = Environ("TEMP")
Source: DOI_WORD_Check.doc	OLE, VBA macro line: TempPath = Environ("TMP")
Source: VBA code instrumentation	OLE, VBA macro: Module CheckModules, Function CheckSettings, String environ: TempPath = Environ("TEMP")	Name: CheckSettings
Source: VBA code instrumentation	OLE, VBA macro: Module CheckModules, Function CheckSettings, String environ: TempPath = Environ("TMP")	Name: CheckSettings

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: DOI_WORD_Check.doc

Stream path 'Macros/VBA/CheckModules' : found possibly 'WScript.Shell' functions exec, run, environ

Source: DOI_WORD_Check.doc

OLE indicator, VBA macros: true

Source: ~WRF{59BFB9E4-49F4-4C3C-BAA1-1751511B10FA}.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal48.expl.winDOC@1/9@0/0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$I_WORD_Check.doc

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR9AE7.tmp

Jump to behavior

Source: DOI_WORD_Check.doc

OLE indicator, Word Document stream: true

Source: ~WRF{59BFB9E4-49F4-4C3C-BAA1-1751511B10FA}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{59BFB9E4-49F4-4C3C-BAA1-1751511B10FA}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{59BFB9E4-49F4-4C3C-BAA1-1751511B10FA}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: DOI_WORD_Check.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\DOI_WORD_Check.doc

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: DOI_WORD_Check.doc

Initial sample: OLE summary lastprinted = 1998-08-28 05:17:00

Source: ~WRF{59BFB9E4-49F4-4C3C-BAA1-1751511B10FA}.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: DOI_WORD_Check.doc	Stream path 'Macros/VBA/CheckModules' : " + CStr(Application.International(wd24HourClock)) WriteT
Source: DOI_WORD_Check.doc	Stream path 'Macros/VBA/CheckModules' : (wdProductLanguageID)) WriteTextLn Text:="Thousands separa

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	21 Scripting	Valid Accounts	Windows Management Instrumentation	21 Scripting	Path Interception	1 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DOI_WORD_Check.doc	0%	ReversingLabs

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520614
Start date and time:	2024-09-27 16:48:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DOI_WORD_Check.doc
Detection:	MAL
Classification:	mal48.expl.winDOC@1/9@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: DOI_WORD_Check.doc

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{59BFB9E4-49F4-4C3C-BAA1-1751511B10FA}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	51712
Entropy (8bit):	5.454427518639548
Encrypted:	false
SSDEEP:	768:StZbtNr2+/mtHYMltLsmEVNxCUmGLPg966gm7p:SLbPi+/mtHYM/L0NJmyPWkm9
MD5:	D6FE636FFF7962EFE907BFC71970F68D
SHA1:	A2AB424C56184AFCCBFD338B7386E20B9D875EA9
SHA-256:	6ABAB5305CFDE13585AD31B21E833F67C4A14147B2F49E167EF0E204EF9AE580
SHA-512:	042179CBAD23C9BA6F27098371A93B25502D42E70CEB895FB359A6AC5A371249A631CC442DF77D87EB0D867A7D8E61BD9DDB9EB14A4367185ED169DC10E59210
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................W...c.......................................................................................................................................................................................................................................................................................................................................X...b...........................................Y...........................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7A882433-8103-4FF1-ACEF-2A1807CF08D6}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	147284
Entropy (8bit):	4.421491703900063
Encrypted:	false
SSDEEP:	1536:C8sL3FNSc8SetKB96vQVCBumVMOej6mXmYarrJQcd1FaLcmB:CPJNSc83tKBAvQVCgOtmXmLpLmB
MD5:	9FB95251CFDE616AC49BBD06F3450E3C
SHA1:	A32E88675A061E05D179308A03087A41256AE56B
SHA-256:	164034C88D9362E75F8C61FEE9D97D79AFA609E4DAD2AB181198197CDBF15C51
SHA-512:	59A321F68BA9B849FC0E6748393535450B39D277A852F5081EC70011F58054CB1EF33BE7869AD7656570809B029C90320A66DFC51B4B008EAAA152CF0CBC0D54
Malicious:	false
Reputation:	low
Preview:	MSFT................Q................................#......$....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*..\+...+..$,...,...,..P-...-......\|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8.......8...........N..............\W...............J..............,<...............<..............xW..............xY..xG.............T...........D...............................T...............................................................&!..d...........................................................................................

C:\Users\user\AppData\Local\Temp\~DFD450097F3E8B70EB.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\DOI_WORD_Check.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:08 2023, mtime=Fri Aug 11 15:42:08 2023, atime=Fri Sep 27 13:49:14 2024, length=103424, window=hide
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	4.547670033144753
Encrypted:	false
SSDEEP:	12:84HldutgXg/XAlCPCHaXDB671B/5YXX+WWkMI12fcKGicvboqIxGcKiDtZ3YilMh:84Hld6/XTzY14X5tGc8eGGcfDv3q857u
MD5:	07CC4E0B3E4894127F55069A4FC45628
SHA1:	D354887B7F8CFA1BC5CE7E4CF1F0E8E19A896036
SHA-256:	BA81B6923A4B39F7EFA5B87C32A68F31ADA332DEE0939CD8CC1FD23453464ACF
SHA-512:	82204A1763C8EB0E692C220E3D0C8EBB362E5E148DB941F208D58161CB3B7DA8A34EE9C770CB52BC43B82C0A3C50D89E0C441428EE1831A24BD768859DF787FE
Malicious:	false
Reputation:	low
Preview:	L..................F.... ....G..r....G..r...x..k.................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....;Y#v..user.8......QK.X;Y#v...&=....U...............A.l.b.u.s.....z.1......WF...Desktop.d......QK.X.WF...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....n.2.....;Y(v .DOI_WO~1.DOC..R.......WE..WE..........................D.O.I._.W.O.R.D._.C.h.e.c.k...d.o.c.......\|...............-...8...[............?J......C:\Users\..#...................\\910646\Users.user\Desktop\DOI_WORD_Check.doc.).....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.D.O.I._.W.O.R.D._.C.h.e.c.k...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......910646..........D_....3N...W...9..W.e8...8.....[D_

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.639522519994505
Encrypted:	false
SSDEEP:	3:M18WqRaFom40sZqRaFov:M+Wq03sZq0y
MD5:	D12378A289DDB7E4B73C7374BE8A1146
SHA1:	3B2A82429F004C4F01BE134B792D15D3CFC19BF3
SHA-256:	FC83EBE6E759AB9E80C25CCDD1AF927322C15DF6511E5CE41039A9CAD0132719
SHA-512:	638A28DE814BA5CBDF93202EE2BE8EE045F991926FE1AF25836B961261A00D1446C0EA2983551928C3741F800386333595BF92A55D100BC254F529C714F53C56
Malicious:	false
Reputation:	low
Preview:	[doc]..DOI_WORD_Check.LNK=0..[folders]..DOI_WORD_Check.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0809.lex

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\Desktop\~$I_WORD_Check.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Title: Tools for Checking the Wordinstallation, Author: Gerd Balzuweit, Template: Normal.dotm, Last Saved By: I041875, Revision Number: 6, Name of Creating Application: Microsoft Office Word, Total Editing Time: 16:00, Last Printed: Fri Aug 28 06:17:00 1998, Create Time/Date: Wed Aug 11 16:50:00 2010, Last Saved Time/Date: Wed Aug 11 17:16:00 2010, Number of Pages: 1, Number of Words: 153, Number of Characters: 873, Security: 0
Entropy (8bit):	4.985609536263557
TrID:	Microsoft Word document (32009/1) 44.75% Microsoft PowerPoint document (31509/1) 44.05% Generic OLE2 / Multistream Compound File (8008/1) 11.20%
File name:	DOI_WORD_Check.doc
File size:	103'424 bytes
MD5:	d201807278ecd18ee692bee3b2693fa7
SHA1:	9e8ba7fdc3118e46569a60897f01fea1e0dc83f8
SHA256:	a77d4a98127656b0d8e41a381099ca386a2d4882139151aa1f063f6712d4e03a
SHA512:	7898e3432ef105ad23b49c36d3e2318eac8dbda3c04e17b2f99e324c5a872f21a03bc46a4a7395736f1d95ee247011a69507cce7cb428ff65e1f4a7375acd287
SSDEEP:	1536:/6Oi6GBoYb7i+/mtHYM/L0NWo1IsTBCUeeGHmQYR/ngMUF7gGwW:COiRSi/mtHN8BTdeeGHmQYRPgMUF7eW
TLSH:	94A3E705B686692FF3BE16721DE9E3B26B70BD094E06532F7145332E3C72D98C61A712
File Content Preview:	........................>.......................*...........,...............)..................................................................................................................................................................................

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "DOI_WORD_Check.doc"

Indicators

Has Summary Info:
Application Name:	Microsoft Office Word
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Title:	Tools for Checking the Wordinstallation
Subject:
Author:	Gerd Balzuweit
Keywords:
Template:	Normal.dotm
Last Saved By:	I041875
Revion Number:	6
Total Edit Time:	960
Last Printed:	1998-08-28 05:17:00
Create Time:	2010-08-11 15:50:00
Last Saved Time:	2010-08-11 16:16:00
Number of Pages:	1
Number of Words:	153
Number of Characters:	873
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Document Code Page:	1252
Number of Lines:	7
Number of Paragraphs:	2
Thumbnail Scaling Desired:	False
Company:	iXOS AS
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: CheckModules.bas, Stream Size: 41595

General
Stream Path:	Macros/VBA/CheckModules
VBA File Name:	CheckModules.bas
Stream Size:	41595
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . \| . . . . . @ . . . . . ( L D . . . . . 0 L x . . . . . > . . . . . . . . . . . L . . . . . L . . . . . . . . . . . L .
Data Raw:	01 16 01 00 06 f0 00 00 00 14 14 00 00 d4 00 00 00 c8 02 00 00 ff ff ff ff 86 16 00 00 b2 80 00 00 01 00 00 00 01 00 00 00 1a a8 1e a8 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 04 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "CheckModules"
Option Explicit

' Write a line to the document
Sub WriteTextLn(Text As String)
    Selection.Font.Name = "Courier New"
    Selection.Font.Size = 10
    Selection.TypeText Text:=Text
    Selection.TypeParagraph
End Sub

' Check the local settings
'################################
Sub CheckSettings()
  Dim RegKeyVal As String
  Dim fSuccess As Boolean
  Dim StartUpPath As String
  Dim vers As String, n As Long
  Dim curver_worddoc As String, curver_excelsheet As String, curver_pptslide As String
  Dim path As String
  Dim intfound As Integer, i As Integer
  Dim key As String
  Dim OfficeWordDocumentCLSID As String ' Store the Office Word Document CLSID

  Dim ad As AddIn
  
  On Error GoTo errortrap
  
  Documents.Add
  
  WriteTextLn Text:="Check of relevant settings for SAP Desktop Office Integration"
  WriteTextLn Text:="    (generated using Wordmakro)"
  WriteTextLn Text:="*****************************************************************"
  WriteTextLn Text:=""
  
  'Check TEMP-Directory
  WriteTextLn Text:=""
  Dim TempPath As String
  Dim FileName As String
  WriteTextLn Text:="Get the TEMP-directory"
  TempPath = Environ("TEMP")
  WriteTextLn Text:="The temporary directory under 'TEMP' is:"
  If TempPath = "" Then WriteTextLn Text:=" - no 'TEMP'-directory."
  WriteTextLn Text:=TempPath
  WriteTextLn Text:=""
  TempPath = Environ("TMP")
  WriteTextLn Text:="The temporary directory under 'TMP' is:"
  If TempPath = "" Then WriteTextLn Text:=" - no 'TMP'-directory."
  WriteTextLn Text:=TempPath
  WriteTextLn Text:=""

  'Check path for output of SAPDOI-Trace file:
  WriteTextLn Text:="Check path for Office Integration trace file:"
  key = "HKEY_LOCAL_MACHINE\SOFTWARE\SAP\OfficeIntegration\Tracing"
  RegKeyVal = System.PrivateProfileString("", key, "TraceFilePath")
  If RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found or empty"
  Else
      WriteTextLn Text:="to be stored in:    " + RegKeyVal
  End If
  WriteTextLn Text:=""
'  WriteTextLn Text:="Trace settings:"
'  WriteTextLn Text:="CallStack:  " + System.PrivateProfileString("", key, "CallStack")
'  WriteTextLn Text:="ContainerControl:  " + System.PrivateProfileString("", key, "ContainerControl")
'  WriteTextLn Text:="DocumentContainer:  " + System.PrivateProfileString("", key, "DocumentContainer")
'  WriteTextLn Text:="DocumentProxy:  " + System.PrivateProfileString("", key, "DocumentProxy")
'  WriteTextLn Text:="DpConverter:  " + System.PrivateProfileString("", key, "DpConverter")
'  WriteTextLn Text:="LinkServer:  " + System.PrivateProfileString("", key, "LinkServer")
'  WriteTextLn Text:="ProxyManager:  " + System.PrivateProfileString("", key, "ProxyManager")

  
  'Check Registry Settings
  vers = Left(Application.Version, 1)
   'PROG ID and Version
  WriteTextLn Text:="Running on operating system: " + Application.System.OperatingSystem
  WriteTextLn Text:="Running on processor: " + System.ProcessorType
  WriteTextLn Text:="The system version is " + System.Version
  WriteTextLn Text:="The country version is " + CStr(System.Country)
  WriteTextLn Text:="The language version is " + System.LanguageDesignation
  WriteTextLn Text:="The version of Word is " + Application.Version
  WriteTextLn Text:="Word built info: " + Application.Build
  WriteTextLn Text:="The excecution path is " + Application.path
  WriteTextLn Text:="International settings:"
  WriteTextLn Text:="24 hour setting: " + CStr(Application.International(wd24HourClock))
  WriteTextLn Text:="Currency Code: " + CStr(Application.International(wdCurrencyCode))
  WriteTextLn Text:="Date separator: " + CStr(Application.International(wdDateSeparator))
  WriteTextLn Text:="Decimal separator: " + CStr(Application.International(wdDecimalSeparator))
  WriteTextLn Text:="List separator: " + CStr(Application.International(wdListSeparator))
  WriteTextLn Text:="Product Language ID: " + CStr(Application.International(wdProductLanguageID))
  WriteTextLn Text:="Thousands separator: " + CStr(Application.International(wdThousandsSeparator))
  WriteTextLn Text:="Time separator: " + CStr(Application.International(wdTimeSeparator))
  WriteTextLn Text:=""
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\Excel.Sheet\CurVer", "")
  curver_excelsheet = RegKeyVal
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\Powerpoint.Slide\CurVer", "")
  curver_pptslide = RegKeyVal

  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\Word.Document\CurVer", "")
  curver_worddoc = RegKeyVal
  WriteTextLn Text:="Check registry key/ PROG-ID:"
  WriteTextLn Text:="HKEY_CLASSES_ROOT\Word.Document\CurVer ="
  WriteTextLn Text:=RegKeyVal

  ' Check the version.
  fSuccess = False
  Select Case RegKeyVal
    Case ""
        WriteTextLn Text:="Registry key not found!"
    Case "Word.Document.8"
      fSuccess = True
    Case "Word.Document.9"
      fSuccess = True
    Case "Word.Document.10"
      fSuccess = True
    Case "Word.Document.11"
      fSuccess = True
    Case "Word.Document.12"
      fSuccess = True
  End Select
  
  If fSuccess = True Then
    WriteTextLn Text:="This is a supported Winword version!"
  Else
    WriteTextLn Text:="A supported Winword version has not been found!"
  End If
  WriteTextLn Text:=""
  
  'Check CLSIDs
  WriteTextLn Text:="Check registry keys (CLSID) for office applications:"
  ' a) Word:
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\Word.Document\CLSID", "")
  WriteTextLn Text:="Check registry key/ CLSID:"
  WriteTextLn Text:="HKEY_CLASSES_ROOT\Word.Document\CLSID ="
  WriteTextLn Text:=RegKeyVal
  fSuccess = False
  Select Case RegKeyVal
    Case "{00020906-0000-0000-C000-000000000046}"
        fSuccess = True
    Case "{F4754C9B-64F5-4B40-8AF4-679732AC0607}"
        fSuccess = True
    Case ""
        WriteTextLn Text:="Registry key not found!"
  End Select
  
  OfficeWordDocumentCLSID = RegKeyVal ' This signifies that Office 2007 or higher is used.
  
  If fSuccess = True Then
    WriteTextLn Text:="Registry key concerning CLSID (Word.Document) ok!"
  Else
    WriteTextLn Text:="Registry key concerning CLSID (Word.Document) not ok!"
  End If
  WriteTextLn Text:=""
  
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\Word.Application\CLSID", "")
  WriteTextLn Text:="Check registry key/ CLSID:"
  WriteTextLn Text:="HKEY_CLASSES_ROOT\Word.Application\CLSID ="
  WriteTextLn Text:=RegKeyVal
  fSuccess = False
  Select Case RegKeyVal
    Case "{000209FF-0000-0000-C000-000000000046}"
      fSuccess = True
    Case ""
        WriteTextLn Text:="Registry key not found!"
  End Select
  If fSuccess = True Then
    WriteTextLn Text:="Registry key concerning CLSID (Word.Application) ok!"
  Else
    WriteTextLn Text:="Registry key concerning CLSID (Word.Application) not ok!"
  End If
  WriteTextLn Text:=""
  WriteTextLn Text:=""
  
  ' b) Excel:
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\Excel.Sheet\CLSID", "")
  WriteTextLn Text:="Check registry key/ CLSID:"
  WriteTextLn Text:="HKEY_CLASSES_ROOT\Excel.Sheet\CLSID ="
  WriteTextLn Text:=RegKeyVal
  fSuccess = False
  Select Case RegKeyVal
    Case "{00020820-0000-0000-C000-000000000046}"
        fSuccess = True
    Case "{00020830-0000-0000-C000-000000000046}"
        fSuccess = True
    Case ""
        WriteTextLn Text:="Registry key not found!"
  End Select
  If fSuccess = True Then
    WriteTextLn Text:="Registry key concerning CLSID (Excel.Sheet) ok!"
  Else
    WriteTextLn Text:="Registry key concerning CLSID (Excel.Sheet) not ok!"
  End If
  WriteTextLn Text:=""
  
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\Excel.Chart\CLSID", "")
  WriteTextLn Text:="Check registry key/ CLSID:"
  WriteTextLn Text:="HKEY_CLASSES_ROOT\Excel.Chart\CLSID ="
  WriteTextLn Text:=RegKeyVal
  fSuccess = False
  Select Case RegKeyVal
    Case "{00020821-0000-0000-C000-000000000046}"
        fSuccess = True
    Case ""
        WriteTextLn Text:="Registry key not found!"
  End Select
  If fSuccess = True Then
    WriteTextLn Text:="Registry key concerning CLSID (Excel.Chart) ok!"
  Else
    WriteTextLn Text:="Registry key concerning CLSID (Excel.Chart) not ok!"
  End If
  WriteTextLn Text:=""
  
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\Excel.Application\CLSID", "")
  WriteTextLn Text:="Check registry key/ CLSID:"
  WriteTextLn Text:="HKEY_CLASSES_ROOT\Excel.Application\CLSID ="
  WriteTextLn Text:=RegKeyVal
  fSuccess = False
  Select Case RegKeyVal
    Case "{00024500-0000-0000-C000-000000000046}"
      fSuccess = True
    Case ""
        WriteTextLn Text:="Registry key not found!"
  End Select
  If fSuccess = True Then
    WriteTextLn Text:="Registry key concerning CLSID (Excel.Application) ok!"
  Else
    WriteTextLn Text:="Registry key concerning CLSID (Excel.Application) not ok!"
  End If
  WriteTextLn Text:=""
  WriteTextLn Text:=""
  
  
  'Check CLSIDs Office Integration OCXs:
  WriteTextLn Text:="Check registry key/ Office Integration - CLSIDs:"
  WriteTextLn Text:=""
  
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.DocumentContainer\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.DocumentContainer\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{5DD34134-A1F8-11D0-A8CF-080009B0CB9D}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""
  
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.DocumentContainerControl\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.DocumentContainerControl\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{CBC60071-A140-11D0-A8CF-080009B0CB9D}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""
  
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.DefaultProxy\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.OfficeIntegration.DefaultProxy\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{133AD681-0DD8-11D1-A903-080009B0CB9D}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""
  
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Manager\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Manager\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{88E5C690-0126-11D1-AEB5-00A024AFE7E1}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""
  
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Excel97Proxy\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Excel97Proxy\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{133AD683-0DD8-11D1-A903-080009B0CB9D}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""
  
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Lotus123Proxy\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Lotus123Proxy\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{630333A7-A45F-11D1-A951-080009B0CB9D}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""
  
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.MSProjectProxy\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.OfficeIntegration.MSProjectProxy\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{4F2FD76B-8E82-11D2-B464-006094B9EA62}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""
  
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.PowerPoint97Proxy\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.PowerPoint97Proxy\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{2F1022B8-E40D-11D1-A97C-080009B0CB9D}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""
  
  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.SmartSuiteProxy\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.SmartSuiteProxy\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{B9BF70B1-9CB1-11D1-A94C-080009B0CB9D}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""

  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.VisioProxy\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.VisioProxy\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{98E4D1C6-CA0A-11D1-A96C-080009B0CB9D}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""

  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Word97Proxy\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.Word97Proxy\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{92293343-0283-11D1-AEB5-00A024AFE7E1}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""

  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.WordProProxy\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.WordProProxy\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{B9BF70B3-9CB1-11D1-A94C-080009B0CB9D}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""

  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.OLELinkServer\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.OLELinkServer\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{4CC5F9C2-A513-11D0-A8CF-080009B0CB9D}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If
  WriteTextLn Text:=""

  RegKeyVal = System.PrivateProfileString("",               "HKEY_CLASSES_ROOT\SAP.OLELinkServer.ItemObject\CLSID", "")
  WriteTextLn Text:="HKEY_CLASSES_ROOT\SAP.OLELinkServer.ItemObject\CLSID ="
  WriteTextLn Text:=RegKeyVal
  If RegKeyVal = "{3399C6C4-AFE8-11D0-A8D5-080009B0CB9D}" Then
    WriteTextLn Text:="Registry key ok!"
  ElseIf RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:="Registry key NOT ok!"
  End If

  WriteTextLn Text:=""
  WriteTextLn Text:=""
  
  
  'Check location of servers
  ' File Search API is not available in Office 2007 onwards
  If OfficeWordDocumentCLSID = "{00020906-0000-0000-C000-000000000046}" Then
    WriteTextLn Text:="Check location of MSOffice applications:"
    Dim objSearch As FileSearch
    Set objSearch = Application.FileSearch
  End If
  
  WriteTextLn Text:="Registry says, Install root for Word is:"
  key = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\" + Application.Version + "\Word\InstallRoot"
  RegKeyVal = System.PrivateProfileString("", key, "Path")
  If RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
  WriteTextLn Text:=RegKeyVal
  End If
  WriteTextLn Text:=""
  
  key = "HKEY_CLASSES_ROOT\" + curver_worddoc + "\protocol\StdFileEditing\server"
  RegKeyVal = System.PrivateProfileString("", key, "")
  WriteTextLn Text:="Word-Server:"
  If RegKeyVal = "" Then
    WriteTextLn Text:="Registry key not found!"
  Else
    WriteTextLn Text:=RegKeyVal
  End If
  path = RegKeyVal

Rem ----------------------------------------------------
  If OfficeWordDocumentCLSID = "{00020906-0000-0000-C000-000000000046}" Then
    CheckMicrosoftapplications RegKeyVal:=RegKeyVal, path:=path, objSearch:=objSearch, curver_excelsheet:=curver_excelsheet, curver_pptslide:=curver_pptslide
  
    WriteTextLn Text:=""
            
Rem ----------------------------------------------------
Rem Test of Controls officeintegration

    CheckControlsOfficeintegration RegKeyVal:=RegKeyVal, objSearch:=objSearch
    WriteTextLn Text:=""
  End If

  WriteTextLn Text:=""
  
  ' Check Startup-Path
  WriteTextLn Text:="Check the Startup-Path"
  StartUpPath = Options.DefaultFilePath(wdStartupPath)
  WriteTextLn Text:=StartUpPath
  WriteTextLn Text:=""
  
  'Check AddIns
  WriteTextLn Text:="Check addins"
  n = AddIns.Count
  If n = 0 Then WriteTextLn Text:="No AddIns installed"

  For Each ad In AddIns
    If ad.Installed = True Then
      WriteTextLn Text:=ad.Name + " is installed"
    Else
      WriteTextLn Text:=ad.Name + " is in the list of global addins"
    End If
    WriteTextLn Text:="Full path: " + ad.path + Application.PathSeparator + ad.Name
  Next ad
  
  Exit Sub
  
errortrap:
    WriteTextLn Text:="An error occured! - Trying to resume with next check."
    WriteTextLn Text:="(ErrNumber = " + CStr(Err.Number) + ": " + CStr(Err.Description) + ")"
    Resume Next

End Sub

Sub UnInstallAddIns()
  Dim ad As AddIn, n As Long
  Documents.Add
  WriteTextLn Text:="Uninstall addins"
  WriteTextLn Text:=""
  
  n = AddIns.Count
  If n = 0 Then WriteTextLn Text:="No AddIns installed"
  For Each ad In AddIns
    WriteTextLn Text:="Remove AddIn " + ad.Name
    ad.Delete
  Next ad
  
End Sub

Private Sub CheckControlsOfficeintegration(RegKeyVal As String, objSearch As FileSearch)

Dim lookinpath, nameoffile, path As String
Dim wordversion
wordversion = CInt(Left(Application.Version, 2))
path = Left(RegKeyVal, (Len(RegKeyVal) - 11))
lookinpath = Left(RegKeyVal, (Len(RegKeyVal) - 12))

WriteTextLn Text:="The followings OCX-files have been found and are installed:"
  
  nameoffile = "SAPsdcc.OCX"
  If Len(path) > 0 Then
  If wordversion = 10 Then
    With objSearch
        .NewSearch
        .LookIn = lookinpath
        .FileName = nameoffile
        .FileType = msoFileTypeAllFiles
        .Execute
    End With
   Else
    With objSearch
        .NewSearch
        .FileName = path + nameoffile
        .FileType = msoFileTypeAllFiles
        .Execute
    End With
   End If
   
   Dim intfound, i
    intfound = objSearch.FoundFiles.Count
    If intfound > 0 Then
        WriteTextLn Text:=objSearch.FoundFiles(intfound)
    Else
        WriteTextLn Text:="Nothing found!"
    End If
  Else
    WriteTextLn Text:="No registry value found for local server"
  End If
  WriteTextLn Text:="     (

VBA File Name: ThisDocument.cls, Stream Size: 961

General
Stream Path:	Macros/VBA/ThisDocument
VBA File Name:	ThisDocument.cls
Stream Size:	961
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S " . . . . S . . . . . S " . . . . . < . . . . . . . . . . ( . 1 . N . o . r . m . a . l . . . T . h . i . s
Data Raw:	01 16 01 00 01 f0 00 00 00 a6 02 00 00 d4 00 00 00 da 01 00 00 ff ff ff ff ad 02 00 00 19 03 00 00 00 00 00 00 01 00 00 00 1a a8 18 a8 00 00 ff ff a3 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 121

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	121
Entropy:	4.363740497830706
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . F ' . . . M i c r o s o f t O f f i c e W o r d 9 7 - 2 0 0 3 D o c u m e n t . . . . . M S W o r d D o c . . . . . W o r d . D o c u m e n t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 06 09 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 27 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 57 6f 72 64 20 39 37 2d 32 30 30 33 20 44 6f 63 75 6d 65 6e 74 00 0a 00 00 00 4d 53 57 6f 72 64 44 6f 63 00 10 00 00 00 57 6f 72 64 2e 44 6f 63 75 6d 65 6e 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	4096
Entropy:	0.5004980897449727
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . T . . . . . . . . . . . h . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i X O S A S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . T o o l s f o r C h e c k i n g t h e
Data Raw:	fe ff 00 00 05 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 54 01 00 00 0c 00 00 00 01 00 00 00 68 00 00 00 0f 00 00 00 70 00 00 00 05 00 00 00 80 00 00 00 06 00 00 00 88 00 00 00 11 00 00 00 90 00 00 00 17 00 00 00 98 00 00 00 0b 00 00 00 a0 00 00 00 10 00 00 00 a8 00 00 00 13 00 00 00 b0 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	4096
Entropy:	0.625165291840332
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . l . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . T o o l s f o r C h e c k i n g t h e W o r d i n s t a l l a t i o n . . . . . . . . . . . . . . . . . . . . . G e r d B a l z u
Data Raw:	fe ff 00 00 05 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 01 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 c8 00 00 00 04 00 00 00 d4 00 00 00 05 00 00 00 ec 00 00 00 07 00 00 00 f8 00 00 00 08 00 00 00 0c 01 00 00 09 00 00 00 1c 01 00 00 12 00 00 00 28 01 00 00

Stream Path: 1Table, File Type: data, Stream Size: 7635

General
Stream Path:	1Table
CLSID:
File Type:	data
Stream Size:	7635
Entropy:	5.822604260129878
Base64 Encoded:	True
Data ASCII:	^ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . > . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6
Data Raw:	5e 04 11 00 12 00 01 00 0b 01 0f 00 07 00 00 00 00 00 00 00 00 00 04 00 08 00 00 00 98 00 00 00 98 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00

Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 426

General
Stream Path:	Macros/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	426
Entropy:	5.397163443599526
Base64 Encoded:	True
Data ASCII:	I D = " { E E 0 4 6 D B 9 - E E D 4 - 4 A 0 8 - 8 A 4 4 - 5 7 5 F D 8 9 9 7 8 C 8 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . M o d u l e = C h e c k M o d u l e s . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 5 8 5 A 5 6 6 C 5 A 6 C 5 A 6 C 5 A 6 C 5 A " . . D P B = " 7 B 7 9 7 5 A 4 9 9 A 5 9 9 A 5 9 9 " . . G C = " 9 E 9 C 9 0 8 9 9 0 8 F B 2 9 0 B 2 9 0 4 D " . . . . [
Data Raw:	49 44 3d 22 7b 45 45 30 34 36 44 42 39 2d 45 45 44 34 2d 34 41 30 38 2d 38 41 34 34 2d 35 37 35 46 44 38 39 39 37 38 43 38 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4d 6f 64 75 6c 65 3d 43 68 65 63 6b 4d 6f 64 75 6c 65 73 0d 0a 4e 61 6d 65 3d 22 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49

Stream Path: Macros/PROJECTwm, File Type: data, Stream Size: 80

General
Stream Path:	Macros/PROJECTwm
CLSID:
File Type:	data
Stream Size:	80
Entropy:	3.353055907333275
Base64 Encoded:	False
Data ASCII:	T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . C h e c k M o d u l e s . C . h . e . c . k . M . o . d . u . l . e . s . . . . .
Data Raw:	54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 43 68 65 63 6b 4d 6f 64 75 6c 65 73 00 43 00 68 00 65 00 63 00 6b 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 73 00 00 00 00 00

Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: 4518

General
Stream Path:	Macros/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	4518
Entropy:	4.910933333787675
Base64 Encoded:	False
Data ASCII:	a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L .
Data Raw:	cc 61 85 00 00 01 00 ff 09 04 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 06 00 02 00 1c 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: Macros/VBA/__SRP_0, File Type: data, Stream Size: 14512

General
Stream Path:	Macros/VBA/__SRP_0
CLSID:
File Type:	data
Stream Size:	14512
Entropy:	3.9835260580455047
Base64 Encoded:	False
Data ASCII:	K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * \\ C N o r m a l r U . . . . . . . . . . . . . . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ ] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . / . R O . 0 R . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . I . . . . . . . . . . . . . . . . Q . . .
Data Raw:	93 4b 2a 85 01 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 01 00 00 00 00 00 01 00 02 00 01 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 01 00 09 00 00 00 2a 5c 43 4e 6f 72 6d 61 6c 72 55 00 0f 00 00 80 00 00 00 80 00 00 00 80 00 00 00 04 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00

Stream Path: Macros/VBA/__SRP_1, File Type: data, Stream Size: 212

General
Stream Path:	Macros/VBA/__SRP_1
CLSID:
File Type:	data
Stream Size:	212
Entropy:	3.6884623140317743
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . ~ } . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T e x t . . . . . . . . R e g K e y V a l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o b j S e a r c h . . . . . . . . p a t h . . . . . . . . c u r v e r _ e x c e l s h e e t . . . . . . . . c u r v e r _ p p t s l i d e W . . . . . . .
Data Raw:	72 55 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 01 00 00 7e 7d 00 00 7f 00 00 00 00 0a 00 00 00 09 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 ff ff ff ff 09 00 00 00 00 00 03 00 02 00 00 08 04 00 00 00 54 65 78 74 03 00 00 08 09 00 00 00 52 65 67 4b 65 79 56 61 6c 03 00 00 09 f9 06 00 00 00 00 00 00 c1 03 00 00 00 00 00 00 08 00 00 00 00 00 01 00 03

Stream Path: Macros/VBA/__SRP_2, File Type: data, Stream Size: 12772

General
Stream Path:	Macros/VBA/__SRP_2
CLSID:
File Type:	data
Stream Size:	12772
Entropy:	4.955553302344548
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . ~ \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . y . . . . . . . e . . . . . . . . . . . . . Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I . . . . . . . q . . . . . . . . . . . . . . . i . . . . . . . A f . . . . . . . . . . . . .
Data Raw:	72 55 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 02 00 00 7e 7c 00 00 7f 00 00 00 00 0e 00 00 00 09 00 00 00 00 00 00 00 09 00 00 00 00 00 03 00 08 00 00 00 00 00 02 00 05 00 05 00 b6 00 00 00 99 65 00 00 00 00 00 00 b9 08 00 00 00 00 00 00 91 08 00 00 00 00 00 00 e1 08 00 00 00 00 00 00 09 09 00 00 00 00 00 00 81 00 00 00 00 00 02 00 11 0a 00 00 00 00 00 00 a1 0a 00 00 00 00

Stream Path: Macros/VBA/__SRP_3, File Type: data, Stream Size: 339

General
Stream Path:	Macros/VBA/__SRP_3
CLSID:
File Type:	data
Stream Size:	339
Entropy:	2.361871157909651
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . . . . . ` . . . . . . a . . . . . . . . . . . . 0 $ . . . . . . . . . . . ` . . . . . . . . . . . $ . . . . . . . . . . . ` . . . . . . . . . . . 0 . . . . . . . . . . . ` . . . . . . y . . . . . . . . . . . . . . . . . . . 0 = . . . . . . . @ . ! . . . . . . . . . . ` . . . . . . y . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! . . . . . . . . . . . . 0 0 = . . . . . . . 0 / . . . . . . n . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 09 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff 00 00 00 00 08 00 00 00 04 00 28 00 81 00 00 00 00 00 02 00 00 00 00 60 04 00 fd ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 61 00 00 00 00 00 01 00 00 00 00 00 00 30 24 00 a9 00 00 00 00 00 02 00 01 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff 00 00

Stream Path: Macros/VBA/dir, File Type: data, Stream Size: 810

General
Stream Path:	Macros/VBA/dir
CLSID:
File Type:	data
Stream Size:	810
Entropy:	6.507130627410624
Base64 Encoded:	True
Data ASCII:	. & . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . l . . . . . . . . . M . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W I N D O W S . \\ s y s t e m 3 . 2 \\ . e 2 . t l b . # O L E A u t o m a t i o n . ` . . . . . n M S F o r m s > . . . . M . . S . F . F r . m . H s . 3 . . . . E D . 4 5 2 E E 1 - E . 0 8 F - 1 0
Data Raw:	01 26 b3 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 1d d0 f7 4d 02 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30

Stream Path: WordDocument, File Type: data, Stream Size: 4650

General
Stream Path:	WordDocument
CLSID:
File Type:	data
Stream Size:	4650
Entropy:	3.344026428473007
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . 0 . . . . . . . . . . . . . . b j b j . . . . . . . . . . . . . . . . . . . . . . * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	ec a5 c1 00 7f 80 09 04 00 00 f0 12 bf 00 00 00 00 00 00 30 00 00 00 00 00 08 00 00 02 0c 00 00 0e 00 62 6a 62 6a e6 e6 e6 e6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 2a 12 00 00 84 8c 01 00 84 8c 01 00 02 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

Target ID:	0
Start time:	10:49:15
Start date:	27/09/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f2b0000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: CheckModules

Declaration

Line	Content
1	Attribute VB_Name = "CheckModules"
2	Option Explicit

Non-Executed Functions

Subroutine
CheckSettingsAPIs: 895, Strings: 342, Number of lines: 399, Relevance: 2166.899

APIs	Meta Information
Add
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Environ
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Environ
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Left
Version
Application
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
System
Application
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
ProcessorType
System
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Version
System
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
CStr
Country
System
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
LanguageDesignation
System
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Version
Application
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Build
Application
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Application
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
CStr
International
wd24HourClock
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
CStr
International
wdCurrencyCode
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
CStr
International
wdDateSeparator
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
CStr
International
wdDecimalSeparator
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
CStr
International
wdListSeparator
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
CStr
International
wdProductLanguageID
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
CStr
International
wdThousandsSeparator
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
CStr
International
wdTimeSeparator
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
PrivateProfileString
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
FileSearch
Application
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Version
Application
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function CheckMicrosoftapplications@CheckModules: Len
Part of subcall function CheckMicrosoftapplications@CheckModules: Version
Part of subcall function CheckMicrosoftapplications@CheckModules: Application
Part of subcall function CheckMicrosoftapplications@CheckModules: Application
Part of subcall function CheckMicrosoftapplications@CheckModules: msoFileTypeAllFiles
Part of subcall function CheckMicrosoftapplications@CheckModules: msoFileTypeAllFiles
Part of subcall function CheckMicrosoftapplications@CheckModules: FoundFiles
Part of subcall function CheckMicrosoftapplications@CheckModules: FoundFiles
Part of subcall function CheckMicrosoftapplications@CheckModules: PrivateProfileString
Part of subcall function CheckMicrosoftapplications@CheckModules: Len
Part of subcall function CheckMicrosoftapplications@CheckModules: Version
Part of subcall function CheckMicrosoftapplications@CheckModules: Application
Part of subcall function CheckMicrosoftapplications@CheckModules: Application
Part of subcall function CheckMicrosoftapplications@CheckModules: msoFileTypeAllFiles
Part of subcall function CheckMicrosoftapplications@CheckModules: msoFileTypeAllFiles
Part of subcall function CheckMicrosoftapplications@CheckModules: FoundFiles
Part of subcall function CheckMicrosoftapplications@CheckModules: FoundFiles
Part of subcall function CheckMicrosoftapplications@CheckModules: PrivateProfileString
Part of subcall function CheckMicrosoftapplications@CheckModules: Len
Part of subcall function CheckMicrosoftapplications@CheckModules: Version
Part of subcall function CheckMicrosoftapplications@CheckModules: Application
Part of subcall function CheckMicrosoftapplications@CheckModules: Application
Part of subcall function CheckMicrosoftapplications@CheckModules: msoFileTypeAllFiles
Part of subcall function CheckMicrosoftapplications@CheckModules: msoFileTypeAllFiles
Part of subcall function CheckMicrosoftapplications@CheckModules: FoundFiles
Part of subcall function CheckMicrosoftapplications@CheckModules: FoundFiles
Part of subcall function CheckMicrosoftapplications@CheckModules: PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function CheckControlsOfficeintegration@CheckModules: CInt
Part of subcall function CheckControlsOfficeintegration@CheckModules: Left
Part of subcall function CheckControlsOfficeintegration@CheckModules: Version
Part of subcall function CheckControlsOfficeintegration@CheckModules: Application
Part of subcall function CheckControlsOfficeintegration@CheckModules: Left
Part of subcall function CheckControlsOfficeintegration@CheckModules: Len
Part of subcall function CheckControlsOfficeintegration@CheckModules: Left
Part of subcall function CheckControlsOfficeintegration@CheckModules: Len
Part of subcall function CheckControlsOfficeintegration@CheckModules: Len
Part of subcall function CheckControlsOfficeintegration@CheckModules: msoFileTypeAllFiles
Part of subcall function CheckControlsOfficeintegration@CheckModules: msoFileTypeAllFiles
Part of subcall function CheckControlsOfficeintegration@CheckModules: FoundFiles
Part of subcall function CheckControlsOfficeintegration@CheckModules: FoundFiles
Part of subcall function CheckControlsOfficeintegration@CheckModules: Len
Part of subcall function CheckControlsOfficeintegration@CheckModules: msoFileTypeAllFiles
Part of subcall function CheckControlsOfficeintegration@CheckModules: msoFileTypeAllFiles
Part of subcall function CheckControlsOfficeintegration@CheckModules: FoundFiles
Part of subcall function CheckControlsOfficeintegration@CheckModules: FoundFiles
Part of subcall function CheckControlsOfficeintegration@CheckModules: msoFileTypeAllFiles
Part of subcall function CheckControlsOfficeintegration@CheckModules: msoFileTypeAllFiles
Part of subcall function CheckControlsOfficeintegration@CheckModules: FoundFiles
Part of subcall function CheckControlsOfficeintegration@CheckModules: FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
DefaultFilePath
wdStartupPath
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Count
AddIns
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
AddIns
Installed
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Name
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Name
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PathSeparator
Application
Name
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
CStr
Number
Err
Description

Strings	Decrypted Strings
"Check of relevant settings for SAP Desktop Office Integration"
" (generated using Wordmakro)"
"*****************************************************************"
""""
""""
"Get the TEMP-directory"
"TEMP"
"The temporary directory under 'TEMP' is:"
" - no 'TEMP'-directory."
""""
" - no 'TEMP'-directory."
""""
"TMP"
"The temporary directory under 'TMP' is:"
" - no 'TMP'-directory."
""""
" - no 'TMP'-directory."
""""
"Check path for Office Integration trace file:"
"HKEY_LOCAL_MACHINE\SOFTWARE\SAP\OfficeIntegration\Tracing"
""""
"TraceFilePath"
""""
"Registry key not found or empty"
"Registry key not found or empty"
"to be stored in: "
""""
"Running on operating system: "
"Running on processor: "
"The system version is "
"The country version is "
"The language version is "
"The version of Word is "
"Word built info: "
"The excecution path is "
"International settings:"
"24 hour setting: "
"Currency Code: "
"Date separator: "
"Decimal separator: "
"List separator: "
"Product Language ID: "
"Thousands separator: "
"Time separator: "
""""
""""
"HKEY_CLASSES_ROOT\Excel.Sheet\CurVer"
""""
"HKEY_CLASSES_ROOT\Powerpoint.Slide\CurVer"
""""
"HKEY_CLASSES_ROOT\Word.Document\CurVer"
"Check registry key/ PROG-ID:"
"HKEY_CLASSES_ROOT\Word.Document\CurVer ="
""""
"Registry key not found!"
"Word.Document.10"
"Word.Document.11"
"Word.Document.12"
"Word.Document.8"
"Word.Document.9"
""""
"Registry key not found!"
"Registry key not found!"
"Word.Document.8"
"Word.Document.9"
"Word.Document.10"
"Word.Document.11"
"Word.Document.12"
"This is a supported Winword version!"
"This is a supported Winword version!"
"A supported Winword version has not been found!"
""""
"Check registry keys (CLSID) for office applications:"
""""
"HKEY_CLASSES_ROOT\Word.Document\CLSID"
"Check registry key/ CLSID:"
"HKEY_CLASSES_ROOT\Word.Document\CLSID ="
""""
"Registry key not found!"
"{00020906-0000-0000-C000-000000000046}"
"{F4754C9B-64F5-4B40-8AF4-679732AC0607}"
"{00020906-0000-0000-C000-000000000046}"
"{F4754C9B-64F5-4B40-8AF4-679732AC0607}"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key concerning CLSID (Word.Document) ok!"
"Registry key concerning CLSID (Word.Document) ok!"
"Registry key concerning CLSID (Word.Document) not ok!"
""""
""""
"HKEY_CLASSES_ROOT\Word.Application\CLSID"
"Check registry key/ CLSID:"
"HKEY_CLASSES_ROOT\Word.Application\CLSID ="
""""
"Registry key not found!"
"{000209FF-0000-0000-C000-000000000046}"
"{000209FF-0000-0000-C000-000000000046}"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key concerning CLSID (Word.Application) ok!"
"Registry key concerning CLSID (Word.Application) ok!"
"Registry key concerning CLSID (Word.Application) not ok!"
""""
""""
""""
"HKEY_CLASSES_ROOT\Excel.Sheet\CLSID"
"Check registry key/ CLSID:"
"HKEY_CLASSES_ROOT\Excel.Sheet\CLSID ="
""""
"Registry key not found!"
"{00020820-0000-0000-C000-000000000046}"
"{00020830-0000-0000-C000-000000000046}"
"{00020820-0000-0000-C000-000000000046}"
"{00020830-0000-0000-C000-000000000046}"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key concerning CLSID (Excel.Sheet) ok!"
"Registry key concerning CLSID (Excel.Sheet) ok!"
"Registry key concerning CLSID (Excel.Sheet) not ok!"
""""
""""
"HKEY_CLASSES_ROOT\Excel.Chart\CLSID"
"Check registry key/ CLSID:"
"HKEY_CLASSES_ROOT\Excel.Chart\CLSID ="
""""
"Registry key not found!"
"{00020821-0000-0000-C000-000000000046}"
"{00020821-0000-0000-C000-000000000046}"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key concerning CLSID (Excel.Chart) ok!"
"Registry key concerning CLSID (Excel.Chart) ok!"
"Registry key concerning CLSID (Excel.Chart) not ok!"
""""
""""
"HKEY_CLASSES_ROOT\Excel.Application\CLSID"
"Check registry key/ CLSID:"
"HKEY_CLASSES_ROOT\Excel.Application\CLSID ="
""""
"Registry key not found!"
"{00024500-0000-0000-C000-000000000046}"
"{00024500-0000-0000-C000-000000000046}"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key concerning CLSID (Excel.Application) ok!"
"Registry key concerning CLSID (Excel.Application) ok!"
"Registry key concerning CLSID (Excel.Application) not ok!"
""""
""""
"Check registry key/ Office Integration - CLSIDs:"
""""
""""
"HKEY_CLASSES_ROOT\SAP.DocumentContainer\CLSID"
"HKEY_CLASSES_ROOT\SAP.DocumentContainer\CLSID ="
"Registry key ok!"
"{5DD34134-A1F8-11D0-A8CF-080009B0CB9D}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.DocumentContainerControl\CLSID"
"HKEY_CLASSES_ROOT\SAP.DocumentContainerControl\CLSID ="
"Registry key ok!"
"{CBC60071-A140-11D0-A8CF-080009B0CB9D}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.DefaultProxy\CLSID"
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.DefaultProxy\CLSID ="
"Registry key ok!"
"{133AD681-0DD8-11D1-A903-080009B0CB9D}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Manager\CLSID"
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Manager\CLSID ="
"Registry key ok!"
"{88E5C690-0126-11D1-AEB5-00A024AFE7E1}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Excel97Proxy\CLSID"
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Excel97Proxy\CLSID ="
"Registry key ok!"
"{133AD683-0DD8-11D1-A903-080009B0CB9D}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Lotus123Proxy\CLSID"
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Lotus123Proxy\CLSID ="
"Registry key ok!"
"{630333A7-A45F-11D1-A951-080009B0CB9D}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.MSProjectProxy\CLSID"
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.MSProjectProxy\CLSID ="
"Registry key ok!"
"{4F2FD76B-8E82-11D2-B464-006094B9EA62}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.PowerPoint97Proxy\CLSID"
"HKEY_CLASSES_ROOT\SAP.PowerPoint97Proxy\CLSID ="
"Registry key ok!"
"{2F1022B8-E40D-11D1-A97C-080009B0CB9D}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.SmartSuiteProxy\CLSID"
"HKEY_CLASSES_ROOT\SAP.SmartSuiteProxy\CLSID ="
"Registry key ok!"
"{B9BF70B1-9CB1-11D1-A94C-080009B0CB9D}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.VisioProxy\CLSID"
"HKEY_CLASSES_ROOT\SAP.VisioProxy\CLSID ="
"Registry key ok!"
"{98E4D1C6-CA0A-11D1-A96C-080009B0CB9D}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Word97Proxy\CLSID"
"HKEY_CLASSES_ROOT\SAP.Word97Proxy\CLSID ="
"Registry key ok!"
"{92293343-0283-11D1-AEB5-00A024AFE7E1}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.OfficeIntegration.WordProProxy\CLSID"
"HKEY_CLASSES_ROOT\SAP.WordProProxy\CLSID ="
"Registry key ok!"
"{B9BF70B3-9CB1-11D1-A94C-080009B0CB9D}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.OLELinkServer\CLSID"
"HKEY_CLASSES_ROOT\SAP.OLELinkServer\CLSID ="
"Registry key ok!"
"{4CC5F9C2-A513-11D0-A8CF-080009B0CB9D}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"HKEY_CLASSES_ROOT\SAP.OLELinkServer.ItemObject\CLSID"
"HKEY_CLASSES_ROOT\SAP.OLELinkServer.ItemObject\CLSID ="
"Registry key ok!"
"{3399C6C4-AFE8-11D0-A8D5-080009B0CB9D}"
"Registry key ok!"
""""
"Registry key not found!"
"Registry key not found!"
"Registry key NOT ok!"
""""
""""
"Check location of MSOffice applications:"
"{00020906-0000-0000-C000-000000000046}"
"Check location of MSOffice applications:"
"Registry says, Install root for Word is:"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\"
""""
"Path"
""""
"Registry key not found!"
"Registry key not found!"
""""
"HKEY_CLASSES_ROOT\"
""""
"Word-Server:"
""""
"Registry key not found!"
"Registry key not found!"
""""
"{00020906-0000-0000-C000-000000000046}"
""""
""""
""""
"Check the Startup-Path"
""""
"Check addins"
"No AddIns installed"
"No AddIns installed"
"Full path: "
"Full path: "
"An error occured! - Trying to resume with next check."
"(ErrNumber = "

Line	Instruction	Meta Information
14	Sub CheckSettings()
15	Dim RegKeyVal as String
16	Dim fSuccess as Boolean
17	Dim StartUpPath as String
18	Dim vers as String, n as Long
19	Dim curver_worddoc as String, curver_excelsheet as String, curver_pptslide as String
20	Dim path as String
21	Dim intfound as Integer, i as Integer
22	Dim key as String
23	Dim OfficeWordDocumentCLSID as String
25	Dim ad as AddIn
27	On Error Goto errortrap
29	Documents.Add	Add
31	WriteTextLn Text := "Check of relevant settings for SAP Desktop Office Integration"
32	WriteTextLn Text := " (generated using Wordmakro)"
33	WriteTextLn Text := "*****************************************************************"
34	WriteTextLn Text := ""
37	WriteTextLn Text := ""
38	Dim TempPath as String
39	Dim FileName as String
40	WriteTextLn Text := "Get the TEMP-directory"
41	TempPath = Environ("TEMP")	Environ
42	WriteTextLn Text := "The temporary directory under 'TEMP' is:"
43	If TempPath = "" Then
43	WriteTextLn Text := " - no 'TEMP'-directory."
43	Endif
44	WriteTextLn Text := TempPath
45	WriteTextLn Text := ""
46	TempPath = Environ("TMP")	Environ
47	WriteTextLn Text := "The temporary directory under 'TMP' is:"
48	If TempPath = "" Then
48	WriteTextLn Text := " - no 'TMP'-directory."
48	Endif
49	WriteTextLn Text := TempPath
50	WriteTextLn Text := ""
53	WriteTextLn Text := "Check path for Office Integration trace file:"
54	key = "HKEY_LOCAL_MACHINE\SOFTWARE\SAP\OfficeIntegration\Tracing"
55	RegKeyVal = System.PrivateProfileString("", key, "TraceFilePath")	PrivateProfileString
56	If RegKeyVal = "" Then
57	WriteTextLn Text := "Registry key not found or empty"
58	Else
59	WriteTextLn Text := "to be stored in: " + RegKeyVal
60	Endif
61	WriteTextLn Text := ""
73	vers = Left(Application.Version, 1)	Left Version Application
75	WriteTextLn Text := "Running on operating system: " + Application.System.OperatingSystem	System Application
76	WriteTextLn Text := "Running on processor: " + System.ProcessorType	ProcessorType System
77	WriteTextLn Text := "The system version is " + System.Version	Version System
78	WriteTextLn Text := "The country version is " + CStr(System.Country)	CStr Country System
79	WriteTextLn Text := "The language version is " + System.LanguageDesignation	LanguageDesignation System
80	WriteTextLn Text := "The version of Word is " + Application.Version	Version Application
81	WriteTextLn Text := "Word built info: " + Application.Build	Build Application
82	WriteTextLn Text := "The excecution path is " + Application.path	Application
83	WriteTextLn Text := "International settings:"
84	WriteTextLn Text := "24 hour setting: " + CStr(Application.International(wd24HourClock))	CStr International wd24HourClock
85	WriteTextLn Text := "Currency Code: " + CStr(Application.International(wdCurrencyCode))	CStr International wdCurrencyCode
86	WriteTextLn Text := "Date separator: " + CStr(Application.International(wdDateSeparator))	CStr International wdDateSeparator
87	WriteTextLn Text := "Decimal separator: " + CStr(Application.International(wdDecimalSeparator))	CStr International wdDecimalSeparator
88	WriteTextLn Text := "List separator: " + CStr(Application.International(wdListSeparator))	CStr International wdListSeparator
89	WriteTextLn Text := "Product Language ID: " + CStr(Application.International(wdProductLanguageID))	CStr International wdProductLanguageID
90	WriteTextLn Text := "Thousands separator: " + CStr(Application.International(wdThousandsSeparator))	CStr International wdThousandsSeparator
91	WriteTextLn Text := "Time separator: " + CStr(Application.International(wdTimeSeparator))	CStr International wdTimeSeparator
92	WriteTextLn Text := ""
93	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\Excel.Sheet\CurVer", "")	PrivateProfileString
95	curver_excelsheet = RegKeyVal
96	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\Powerpoint.Slide\CurVer", "")	PrivateProfileString
98	curver_pptslide = RegKeyVal
100	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\Word.Document\CurVer", "")	PrivateProfileString
102	curver_worddoc = RegKeyVal
103	WriteTextLn Text := "Check registry key/ PROG-ID:"
104	WriteTextLn Text := "HKEY_CLASSES_ROOT\Word.Document\CurVer ="
105	WriteTextLn Text := RegKeyVal
108	fSuccess = False
109	Select Case RegKeyVal
110	Case ""
111	WriteTextLn Text := "Registry key not found!"
112	Case "Word.Document.8"
113	fSuccess = True
114	Case "Word.Document.9"
115	fSuccess = True
116	Case "Word.Document.10"
117	fSuccess = True
118	Case "Word.Document.11"
119	fSuccess = True
120	Case "Word.Document.12"
121	fSuccess = True
122	End Select
124	If fSuccess = True Then
125	WriteTextLn Text := "This is a supported Winword version!"
126	Else
127	WriteTextLn Text := "A supported Winword version has not been found!"
128	Endif
129	WriteTextLn Text := ""
132	WriteTextLn Text := "Check registry keys (CLSID) for office applications:"
134	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\Word.Document\CLSID", "")	PrivateProfileString
136	WriteTextLn Text := "Check registry key/ CLSID:"
137	WriteTextLn Text := "HKEY_CLASSES_ROOT\Word.Document\CLSID ="
138	WriteTextLn Text := RegKeyVal
139	fSuccess = False
140	Select Case RegKeyVal
141	Case "{00020906-0000-0000-C000-000000000046}"
142	fSuccess = True
143	Case "{F4754C9B-64F5-4B40-8AF4-679732AC0607}"
144	fSuccess = True
145	Case ""
146	WriteTextLn Text := "Registry key not found!"
147	End Select
149	OfficeWordDocumentCLSID = RegKeyVal
151	If fSuccess = True Then
152	WriteTextLn Text := "Registry key concerning CLSID (Word.Document) ok!"
153	Else
154	WriteTextLn Text := "Registry key concerning CLSID (Word.Document) not ok!"
155	Endif
156	WriteTextLn Text := ""
158	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\Word.Application\CLSID", "")	PrivateProfileString
160	WriteTextLn Text := "Check registry key/ CLSID:"
161	WriteTextLn Text := "HKEY_CLASSES_ROOT\Word.Application\CLSID ="
162	WriteTextLn Text := RegKeyVal
163	fSuccess = False
164	Select Case RegKeyVal
165	Case "{000209FF-0000-0000-C000-000000000046}"
166	fSuccess = True
167	Case ""
168	WriteTextLn Text := "Registry key not found!"
169	End Select
170	If fSuccess = True Then
171	WriteTextLn Text := "Registry key concerning CLSID (Word.Application) ok!"
172	Else
173	WriteTextLn Text := "Registry key concerning CLSID (Word.Application) not ok!"
174	Endif
175	WriteTextLn Text := ""
176	WriteTextLn Text := ""
179	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\Excel.Sheet\CLSID", "")	PrivateProfileString
181	WriteTextLn Text := "Check registry key/ CLSID:"
182	WriteTextLn Text := "HKEY_CLASSES_ROOT\Excel.Sheet\CLSID ="
183	WriteTextLn Text := RegKeyVal
184	fSuccess = False
185	Select Case RegKeyVal
186	Case "{00020820-0000-0000-C000-000000000046}"
187	fSuccess = True
188	Case "{00020830-0000-0000-C000-000000000046}"
189	fSuccess = True
190	Case ""
191	WriteTextLn Text := "Registry key not found!"
192	End Select
193	If fSuccess = True Then
194	WriteTextLn Text := "Registry key concerning CLSID (Excel.Sheet) ok!"
195	Else
196	WriteTextLn Text := "Registry key concerning CLSID (Excel.Sheet) not ok!"
197	Endif
198	WriteTextLn Text := ""
200	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\Excel.Chart\CLSID", "")	PrivateProfileString
202	WriteTextLn Text := "Check registry key/ CLSID:"
203	WriteTextLn Text := "HKEY_CLASSES_ROOT\Excel.Chart\CLSID ="
204	WriteTextLn Text := RegKeyVal
205	fSuccess = False
206	Select Case RegKeyVal
207	Case "{00020821-0000-0000-C000-000000000046}"
208	fSuccess = True
209	Case ""
210	WriteTextLn Text := "Registry key not found!"
211	End Select
212	If fSuccess = True Then
213	WriteTextLn Text := "Registry key concerning CLSID (Excel.Chart) ok!"
214	Else
215	WriteTextLn Text := "Registry key concerning CLSID (Excel.Chart) not ok!"
216	Endif
217	WriteTextLn Text := ""
219	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\Excel.Application\CLSID", "")	PrivateProfileString
221	WriteTextLn Text := "Check registry key/ CLSID:"
222	WriteTextLn Text := "HKEY_CLASSES_ROOT\Excel.Application\CLSID ="
223	WriteTextLn Text := RegKeyVal
224	fSuccess = False
225	Select Case RegKeyVal
226	Case "{00024500-0000-0000-C000-000000000046}"
227	fSuccess = True
228	Case ""
229	WriteTextLn Text := "Registry key not found!"
230	End Select
231	If fSuccess = True Then
232	WriteTextLn Text := "Registry key concerning CLSID (Excel.Application) ok!"
233	Else
234	WriteTextLn Text := "Registry key concerning CLSID (Excel.Application) not ok!"
235	Endif
236	WriteTextLn Text := ""
237	WriteTextLn Text := ""
241	WriteTextLn Text := "Check registry key/ Office Integration - CLSIDs:"
242	WriteTextLn Text := ""
244	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.DocumentContainer\CLSID", "")	PrivateProfileString
246	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.DocumentContainer\CLSID ="
247	WriteTextLn Text := RegKeyVal
248	If RegKeyVal = "{5DD34134-A1F8-11D0-A8CF-080009B0CB9D}" Then
249	WriteTextLn Text := "Registry key ok!"
250	Elseif RegKeyVal = "" Then
251	WriteTextLn Text := "Registry key not found!"
252	Else
253	WriteTextLn Text := "Registry key NOT ok!"
254	Endif
255	WriteTextLn Text := ""
257	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.DocumentContainerControl\CLSID", "")	PrivateProfileString
259	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.DocumentContainerControl\CLSID ="
260	WriteTextLn Text := RegKeyVal
261	If RegKeyVal = "{CBC60071-A140-11D0-A8CF-080009B0CB9D}" Then
262	WriteTextLn Text := "Registry key ok!"
263	Elseif RegKeyVal = "" Then
264	WriteTextLn Text := "Registry key not found!"
265	Else
266	WriteTextLn Text := "Registry key NOT ok!"
267	Endif
268	WriteTextLn Text := ""
270	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.DefaultProxy\CLSID", "")	PrivateProfileString
272	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.DefaultProxy\CLSID ="
273	WriteTextLn Text := RegKeyVal
274	If RegKeyVal = "{133AD681-0DD8-11D1-A903-080009B0CB9D}" Then
275	WriteTextLn Text := "Registry key ok!"
276	Elseif RegKeyVal = "" Then
277	WriteTextLn Text := "Registry key not found!"
278	Else
279	WriteTextLn Text := "Registry key NOT ok!"
280	Endif
281	WriteTextLn Text := ""
283	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Manager\CLSID", "")	PrivateProfileString
285	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Manager\CLSID ="
286	WriteTextLn Text := RegKeyVal
287	If RegKeyVal = "{88E5C690-0126-11D1-AEB5-00A024AFE7E1}" Then
288	WriteTextLn Text := "Registry key ok!"
289	Elseif RegKeyVal = "" Then
290	WriteTextLn Text := "Registry key not found!"
291	Else
292	WriteTextLn Text := "Registry key NOT ok!"
293	Endif
294	WriteTextLn Text := ""
296	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Excel97Proxy\CLSID", "")	PrivateProfileString
298	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Excel97Proxy\CLSID ="
299	WriteTextLn Text := RegKeyVal
300	If RegKeyVal = "{133AD683-0DD8-11D1-A903-080009B0CB9D}" Then
301	WriteTextLn Text := "Registry key ok!"
302	Elseif RegKeyVal = "" Then
303	WriteTextLn Text := "Registry key not found!"
304	Else
305	WriteTextLn Text := "Registry key NOT ok!"
306	Endif
307	WriteTextLn Text := ""
309	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Lotus123Proxy\CLSID", "")	PrivateProfileString
311	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Lotus123Proxy\CLSID ="
312	WriteTextLn Text := RegKeyVal
313	If RegKeyVal = "{630333A7-A45F-11D1-A951-080009B0CB9D}" Then
314	WriteTextLn Text := "Registry key ok!"
315	Elseif RegKeyVal = "" Then
316	WriteTextLn Text := "Registry key not found!"
317	Else
318	WriteTextLn Text := "Registry key NOT ok!"
319	Endif
320	WriteTextLn Text := ""
322	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.MSProjectProxy\CLSID", "")	PrivateProfileString
324	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.MSProjectProxy\CLSID ="
325	WriteTextLn Text := RegKeyVal
326	If RegKeyVal = "{4F2FD76B-8E82-11D2-B464-006094B9EA62}" Then
327	WriteTextLn Text := "Registry key ok!"
328	Elseif RegKeyVal = "" Then
329	WriteTextLn Text := "Registry key not found!"
330	Else
331	WriteTextLn Text := "Registry key NOT ok!"
332	Endif
333	WriteTextLn Text := ""
335	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.PowerPoint97Proxy\CLSID", "")	PrivateProfileString
337	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.PowerPoint97Proxy\CLSID ="
338	WriteTextLn Text := RegKeyVal
339	If RegKeyVal = "{2F1022B8-E40D-11D1-A97C-080009B0CB9D}" Then
340	WriteTextLn Text := "Registry key ok!"
341	Elseif RegKeyVal = "" Then
342	WriteTextLn Text := "Registry key not found!"
343	Else
344	WriteTextLn Text := "Registry key NOT ok!"
345	Endif
346	WriteTextLn Text := ""
348	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.SmartSuiteProxy\CLSID", "")	PrivateProfileString
350	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.SmartSuiteProxy\CLSID ="
351	WriteTextLn Text := RegKeyVal
352	If RegKeyVal = "{B9BF70B1-9CB1-11D1-A94C-080009B0CB9D}" Then
353	WriteTextLn Text := "Registry key ok!"
354	Elseif RegKeyVal = "" Then
355	WriteTextLn Text := "Registry key not found!"
356	Else
357	WriteTextLn Text := "Registry key NOT ok!"
358	Endif
359	WriteTextLn Text := ""
361	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.VisioProxy\CLSID", "")	PrivateProfileString
363	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.VisioProxy\CLSID ="
364	WriteTextLn Text := RegKeyVal
365	If RegKeyVal = "{98E4D1C6-CA0A-11D1-A96C-080009B0CB9D}" Then
366	WriteTextLn Text := "Registry key ok!"
367	Elseif RegKeyVal = "" Then
368	WriteTextLn Text := "Registry key not found!"
369	Else
370	WriteTextLn Text := "Registry key NOT ok!"
371	Endif
372	WriteTextLn Text := ""
374	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.Word97Proxy\CLSID", "")	PrivateProfileString
376	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.Word97Proxy\CLSID ="
377	WriteTextLn Text := RegKeyVal
378	If RegKeyVal = "{92293343-0283-11D1-AEB5-00A024AFE7E1}" Then
379	WriteTextLn Text := "Registry key ok!"
380	Elseif RegKeyVal = "" Then
381	WriteTextLn Text := "Registry key not found!"
382	Else
383	WriteTextLn Text := "Registry key NOT ok!"
384	Endif
385	WriteTextLn Text := ""
387	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.OfficeIntegration.WordProProxy\CLSID", "")	PrivateProfileString
389	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.WordProProxy\CLSID ="
390	WriteTextLn Text := RegKeyVal
391	If RegKeyVal = "{B9BF70B3-9CB1-11D1-A94C-080009B0CB9D}" Then
392	WriteTextLn Text := "Registry key ok!"
393	Elseif RegKeyVal = "" Then
394	WriteTextLn Text := "Registry key not found!"
395	Else
396	WriteTextLn Text := "Registry key NOT ok!"
397	Endif
398	WriteTextLn Text := ""
400	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.OLELinkServer\CLSID", "")	PrivateProfileString
402	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.OLELinkServer\CLSID ="
403	WriteTextLn Text := RegKeyVal
404	If RegKeyVal = "{4CC5F9C2-A513-11D0-A8CF-080009B0CB9D}" Then
405	WriteTextLn Text := "Registry key ok!"
406	Elseif RegKeyVal = "" Then
407	WriteTextLn Text := "Registry key not found!"
408	Else
409	WriteTextLn Text := "Registry key NOT ok!"
410	Endif
411	WriteTextLn Text := ""
413	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\SAP.OLELinkServer.ItemObject\CLSID", "")	PrivateProfileString
415	WriteTextLn Text := "HKEY_CLASSES_ROOT\SAP.OLELinkServer.ItemObject\CLSID ="
416	WriteTextLn Text := RegKeyVal
417	If RegKeyVal = "{3399C6C4-AFE8-11D0-A8D5-080009B0CB9D}" Then
418	WriteTextLn Text := "Registry key ok!"
419	Elseif RegKeyVal = "" Then
420	WriteTextLn Text := "Registry key not found!"
421	Else
422	WriteTextLn Text := "Registry key NOT ok!"
423	Endif
425	WriteTextLn Text := ""
426	WriteTextLn Text := ""
431	If OfficeWordDocumentCLSID = "{00020906-0000-0000-C000-000000000046}" Then
432	WriteTextLn Text := "Check location of MSOffice applications:"
433	Dim objSearch as FileSearch
434	Set objSearch = Application.FileSearch	FileSearch Application
435	Endif
437	WriteTextLn Text := "Registry says, Install root for Word is:"
438	key = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\" + Application.Version + "\Word\InstallRoot"	Version Application
439	RegKeyVal = System.PrivateProfileString("", key, "Path")	PrivateProfileString
440	If RegKeyVal = "" Then
441	WriteTextLn Text := "Registry key not found!"
442	Else
443	WriteTextLn Text := RegKeyVal
444	Endif
445	WriteTextLn Text := ""
447	key = "HKEY_CLASSES_ROOT\" + curver_worddoc + "\protocol\StdFileEditing\server"
448	RegKeyVal = System.PrivateProfileString("", key, "")	PrivateProfileString
449	WriteTextLn Text := "Word-Server:"
450	If RegKeyVal = "" Then
451	WriteTextLn Text := "Registry key not found!"
452	Else
453	WriteTextLn Text := RegKeyVal
454	Endif
455	path = RegKeyVal
457	Rem ----------------------------------------------------
458	If OfficeWordDocumentCLSID = "{00020906-0000-0000-C000-000000000046}" Then
459	CheckMicrosoftapplications RegKeyVal := RegKeyVal, path := path, objSearch := objSearch, curver_excelsheet := curver_excelsheet, curver_pptslide := curver_pptslide
461	WriteTextLn Text := ""
463	Rem ----------------------------------------------------
464	Rem Test of Controls officeintegration
466	CheckControlsOfficeintegration RegKeyVal := RegKeyVal, objSearch := objSearch
467	WriteTextLn Text := ""
468	Endif
470	WriteTextLn Text := ""
473	WriteTextLn Text := "Check the Startup-Path"
474	StartUpPath = Options.DefaultFilePath(wdStartupPath)	DefaultFilePath wdStartupPath
475	WriteTextLn Text := StartUpPath
476	WriteTextLn Text := ""
479	WriteTextLn Text := "Check addins"
480	n = AddIns.Count	Count AddIns
481	If n = 0 Then
481	WriteTextLn Text := "No AddIns installed"
481	Endif
483	For Each ad in AddIns	AddIns
484	If ad.Installed = True Then	Installed
485	WriteTextLn Text := ad.Name + " is installed"	Name
486	Else
487	WriteTextLn Text := ad.Name + " is in the list of global addins"	Name
488	Endif
489	WriteTextLn Text := "Full path: " + ad.path + Application.PathSeparator + ad.Name	PathSeparator Application Name
490	Next ad	AddIns
492	Exit Sub
493	errortrap:
495	WriteTextLn Text := "An error occured! - Trying to resume with next check."
496	WriteTextLn Text := "(ErrNumber = " + CStr(Err.Number) + ": " + CStr(Err.Description) + ")"	CStr Number Err Description
497	Resume Next
499	End Sub

Subroutine
CheckMicrosoftapplicationsAPIs: 123, Strings: 62, Number of lines: 120, Relevance: 277.62

APIs	Meta Information
Len
Version
Application
Application
msoFileTypeAllFiles
msoFileTypeAllFiles
FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Len
Version
Application
Application
msoFileTypeAllFiles
msoFileTypeAllFiles
FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Len
Version
Application
Application
msoFileTypeAllFiles
msoFileTypeAllFiles
FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
PrivateProfileString
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph

Strings	Decrypted Strings
"10.0"
"Server exists:"
"WinWord.Exe not found!"
"WinWord.exe"
"10.0"
"WinWord.exe"
"10.0"
"WinWord.exe"
"WinWord.exe"
"Server exists:"
"Server exists:"
"WinWord.Exe not found!"
"No registry value found for local server"
""""
"HKEY_CLASSES_ROOT\"
""""
"Excel-Server:"
""""
"Registry key not found!"
"Registry key not found!"
"10.0"
"Excel.Exe not found!"
"Excel.exe"
"Server exists:"
"10.0"
"Excel.exe"
"10.0"
"Excel.exe"
"Excel.exe"
"Server exists:"
"Server exists:"
"Excel.Exe not found!"
"No registry value found for local server"
""""
"HKEY_CLASSES_ROOT\"
""""
"Powerpoint-Server:"
""""
"Registry key not found!"
"Registry key not found!"
"10.0"
"PowerPoint.Exe not found!"
"Server exists:"
"powerpnt.exe"
"10.0"
"powerpnt.exe"
"10.0"
"powerpnt.exe"
"powerpnt.exe"
"Server exists:"
"Server exists:"
"PowerPoint.Exe not found!"
"No registry value found for local server"
""""
""""
"Check location of OCX-files for Office Integration:"
""""
"HKEY_CLASSES_ROOT\CLSID\{5DD34134-A1F8-11D0-A8CF-080009B0CB9D}\InprocServer32"
"Office integration SAPsdcc.OCX path (registry setting):"
""""
"Registry key not found!"
"Registry key not found!"

Line	Instruction	Meta Information
616	Private Sub CheckMicrosoftapplications(RegKeyVal as String, path as String, objSearch as FileSearch, curver_excelsheet as String, curver_pptslide)
617	If Len(path) > 0 Then	Len
618	Select Case Application.Version	Version Application
619	Case "10.0"
620	With objSearch
621	. NewSearch
622	. LookIn = Application.path	Application
623	. FileName = "WinWord.exe"
624	. FileType = msoFileTypeAllFiles	msoFileTypeAllFiles
625	. Execute
626	End With
627	Case Else
628	With objSearch
629	. NewSearch
631	. FileName = path
632	. FileType = msoFileTypeAllFiles	msoFileTypeAllFiles
633	. Execute
634	End With
635	End Select	Version Application
636	Dim intfound
637	intfound = objSearch.FoundFiles.Count	FoundFiles
638	If intfound > 0 Then
639	WriteTextLn Text := "Server exists:"
640	path = objSearch.FoundFiles(intfound)	FoundFiles
641	Else
642	path = "WinWord.Exe not found!"
643	Endif
644	WriteTextLn Text := path
645	Else
646	WriteTextLn Text := "No registry value found for local server"
647	Endif
648	WriteTextLn Text := ""
650	Dim key
651	key = "HKEY_CLASSES_ROOT\" + curver_excelsheet + "\protocol\StdFileEditing\server"
652	RegKeyVal = System.PrivateProfileString("", key, "")	PrivateProfileString
653	WriteTextLn Text := "Excel-Server:"
654	If RegKeyVal = "" Then
655	WriteTextLn Text := "Registry key not found!"
656	Else
657	WriteTextLn Text := RegKeyVal
658	Endif
659	path = RegKeyVal
661	If Len(path) > 0 Then	Len
662	Select Case Application.Version	Version Application
663	Case "10.0"
664	With objSearch
665	. NewSearch
666	. LookIn = Application.path	Application
667	. FileName = "Excel.exe"
668	. FileType = msoFileTypeAllFiles	msoFileTypeAllFiles
669	. Execute
670	End With
671	Case Else
672	With objSearch
673	. NewSearch
675	. FileName = path
676	. FileType = msoFileTypeAllFiles	msoFileTypeAllFiles
677	. Execute
678	End With
679	End Select	Version Application
681	intfound = objSearch.FoundFiles.Count	FoundFiles
682	If intfound > 0 Then
683	WriteTextLn Text := "Server exists:"
684	path = objSearch.FoundFiles(intfound)	FoundFiles
685	Else
686	path = "Excel.Exe not found!"
687	Endif
688	WriteTextLn Text := path
689	Else
690	WriteTextLn Text := "No registry value found for local server"
691	Endif
692	WriteTextLn Text := ""
694	key = "HKEY_CLASSES_ROOT\" + curver_pptslide + "\protocol\StdFileEditing\server"
695	RegKeyVal = System.PrivateProfileString("", key, "")	PrivateProfileString
696	WriteTextLn Text := "Powerpoint-Server:"
697	If RegKeyVal = "" Then
698	WriteTextLn Text := "Registry key not found!"
699	Else
700	WriteTextLn Text := RegKeyVal
701	Endif
702	path = RegKeyVal
704	If Len(path) > 0 Then	Len
705	Select Case Application.Version	Version Application
706	Case "10.0"
707	With objSearch
708	. NewSearch
709	. LookIn = Application.path	Application
710	. FileName = "powerpnt.exe"
711	. FileType = msoFileTypeAllFiles	msoFileTypeAllFiles
712	. Execute
713	End With
714	Case Else
715	With objSearch
716	. NewSearch
718	. FileName = path
719	. FileType = msoFileTypeAllFiles	msoFileTypeAllFiles
720	. Execute
721	End With
722	End Select	Version Application
724	intfound = objSearch.FoundFiles.Count	FoundFiles
725	If intfound > 0 Then
726	WriteTextLn Text := "Server exists:"
727	WriteTextLn Text := objSearch.FoundFiles(intfound)	FoundFiles
728	Else
729	WriteTextLn Text := "PowerPoint.Exe not found!"
730	Endif
731	Else
732	WriteTextLn Text := "No registry value found for local server"
733	Endif
735	WriteTextLn Text := ""
736	WriteTextLn Text := ""
738	WriteTextLn Text := "Check location of OCX-files for Office Integration:"
739	RegKeyVal = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\CLSID\{5DD34134-A1F8-11D0-A8CF-080009B0CB9D}\InprocServer32", "")	PrivateProfileString
741	WriteTextLn Text := "Office integration SAPsdcc.OCX path (registry setting):"
742	If RegKeyVal = "" Then
743	WriteTextLn Text := "Registry key not found!"
744	Else
745	WriteTextLn Text := RegKeyVal
746	Endif
747	End Sub

Subroutine
CheckControlsOfficeintegrationAPIs: 62, Strings: 12, Number of lines: 91, Relevance: 111.091

APIs	Meta Information
CInt
Left
Version
Application
Left
Len
Left
Len
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Len
msoFileTypeAllFiles
msoFileTypeAllFiles
FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Len
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
msoFileTypeAllFiles
msoFileTypeAllFiles
FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
msoFileTypeAllFiles
msoFileTypeAllFiles
FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
FoundFiles
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph

Strings	Decrypted Strings
"The followings OCX-files have been found and are installed:"
"SAPsdcc.OCX"
"Nothing found!"
"Nothing found!"
"No registry value found for local server"
" (Using the same path for the other OCX files yields:)"
"No useable return from sapsdcc-server location"
"No useable return from sapsdcc-server location"
"SAPcn*.OCX"
"Nothing more found (for SAPcn*.OCX)!"
"SAPoi*.OCX"
"Nothing more found (for SAPoi*.OCX)!"

Line	Instruction	Meta Information
516	Private Sub CheckControlsOfficeintegration(RegKeyVal as String, objSearch as FileSearch)
518	Dim lookinpath, nameoffile, path as String
519	Dim wordversion
520	wordversion = CInt(Left(Application.Version, 2))	CInt Left Version Application
521	path = Left(RegKeyVal, (Len(RegKeyVal) - 11))	Left Len
522	lookinpath = Left(RegKeyVal, (Len(RegKeyVal) - 12))	Left Len
524	WriteTextLn Text := "The followings OCX-files have been found and are installed:"
526	nameoffile = "SAPsdcc.OCX"
527	If Len(path) > 0 Then	Len
528	If wordversion = 10 Then
529	With objSearch
530	. NewSearch
531	. LookIn = lookinpath
532	. FileName = nameoffile
533	. FileType = msoFileTypeAllFiles	msoFileTypeAllFiles
534	. Execute
535	End With
536	Else
537	With objSearch
538	. NewSearch
539	. FileName = path + nameoffile
540	. FileType = msoFileTypeAllFiles	msoFileTypeAllFiles
541	. Execute
542	End With
543	Endif
545	Dim intfound, i
546	intfound = objSearch.FoundFiles.Count	FoundFiles
547	If intfound > 0 Then
548	WriteTextLn Text := objSearch.FoundFiles(intfound)	FoundFiles
549	Else
550	WriteTextLn Text := "Nothing found!"
551	Endif
552	Else
553	WriteTextLn Text := "No registry value found for local server"
554	Endif
555	WriteTextLn Text := " (Using the same path for the other OCX files yields:)"
557	If Len(RegKeyVal) <= 0 Then	Len
558	WriteTextLn Text := "No useable return from sapsdcc-server location"
559	Else
560	nameoffile = "SAPcn*.OCX"
561	If wordversion = 10 Then
562	With objSearch
563	. NewSearch
564	. LookIn = lookinpath
565	. FileName = nameoffile
566	. FileType = msoFileTypeAllFiles	msoFileTypeAllFiles
567	. Execute
568	End With
569	Else
570	With objSearch
571	. NewSearch
572	. FileName = path + nameoffile
573	. FileType = msoFileTypeAllFiles	msoFileTypeAllFiles
574	. Execute
575	End With
576	Endif
577	intfound = objSearch.FoundFiles.Count	FoundFiles
578	If intfound > 0 Then
579	For i = 1 To intfound
580	WriteTextLn Text := objSearch.FoundFiles(i)	FoundFiles
581	Next i
582	Else
583	WriteTextLn Text := "Nothing more found (for SAPcn*.OCX)!"
584	Endif
587	nameoffile = "SAPoi*.OCX"
588	If wordversion = 10 Then
589	With objSearch
590	. NewSearch
591	. LookIn = lookinpath
592	. FileName = nameoffile
593	. FileType = msoFileTypeAllFiles	msoFileTypeAllFiles
594	. Execute
595	End With
596	Else
597	With objSearch
598	. NewSearch
599	. FileName = path + nameoffile
600	. FileType = msoFileTypeAllFiles	msoFileTypeAllFiles
601	. Execute
602	End With
603	Endif
604	intfound = objSearch.FoundFiles.Count	FoundFiles
605	If intfound > 0 Then
606	For i = 1 To intfound
607	WriteTextLn Text := objSearch.FoundFiles(i)	FoundFiles
608	Next i
609	Else
610	WriteTextLn Text := "Nothing more found (for SAPoi*.OCX)!"
611	Endif
613	Endif
614	End Sub

Subroutine
UnInstallAddInsAPIs: 22, Strings: 6, Number of lines: 14, Relevance: 42.014

APIs	Meta Information
Add
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Count
AddIns
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
AddIns
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: Font
Part of subcall function WriteTextLn@CheckModules: TypeText
Part of subcall function WriteTextLn@CheckModules: TypeParagraph
Name
Delete

Strings	Decrypted Strings
"Uninstall addins"
""""
"No AddIns installed"
"No AddIns installed"
"Remove AddIn "
"Remove AddIn "

Line	Instruction	Meta Information
501	Sub UnInstallAddIns()
502	Dim ad as AddIn, n as Long
503	Documents.Add	Add
504	WriteTextLn Text := "Uninstall addins"
505	WriteTextLn Text := ""
507	n = AddIns.Count	Count AddIns
508	If n = 0 Then
508	WriteTextLn Text := "No AddIns installed"
508	Endif
509	For Each ad in AddIns	AddIns
510	WriteTextLn Text := "Remove AddIn " + ad.Name	Name
511	ad.Delete	Delete
512	Next ad	AddIns
514	End Sub

Subroutine
WriteTextLnAPIs: 4, Strings: 1, Number of lines: 6, Relevance: 7.506

APIs	Meta Information
Font
Font
TypeText
TypeParagraph

Strings	Decrypted Strings
"Courier New"

Line	Instruction	Meta Information
5	Sub WriteTextLn(Text as String)
6	Selection.Font.Name = "Courier New"	Font
7	Selection.Font.Size = 10	Font
8	Selection.TypeText Text := Text	TypeText
9	Selection.TypeParagraph	TypeParagraph
10	End Sub

Module: ThisDocument

Declaration

Line	Content
1	Attribute VB_Name = "ThisDocument"
2	Attribute VB_Base = "1Normal.ThisDocument"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = True
8	Attribute VB_Customizable = True

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DOI_WORD_Check.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{59BFB9E4-49F4-4C3C-BAA1-1751511B10FA}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7A882433-8103-4FF1-ACEF-2A1807CF08D6}.tmp

C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd

C:\Users\user\AppData\Local\Temp\~DFD450097F3E8B70EB.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\DOI_WORD_Check.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0809.lex

C:\Users\user\Desktop\~$I_WORD_Check.doc

Static File Info

General

File Icon

Static OLE Info

General

OLE File "DOI_WORD_Check.doc"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: CheckModules.bas, Stream Size: 41595

General

VBA Code

VBA File Name: ThisDocument.cls, Stream Size: 961

General

VBA Code

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 121

General

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

Windows Analysis Report
DOI_WORD_Check.doc

Subroutine
CheckSettingsAPIs: 895, Strings: 342, Number of lines: 399, Relevance: 2166.899

Subroutine
CheckMicrosoftapplicationsAPIs: 123, Strings: 62, Number of lines: 120, Relevance: 277.62

Subroutine
CheckControlsOfficeintegrationAPIs: 62, Strings: 12, Number of lines: 91, Relevance: 111.091

Subroutine
UnInstallAddInsAPIs: 22, Strings: 6, Number of lines: 14, Relevance: 42.014

Subroutine
WriteTextLnAPIs: 4, Strings: 1, Number of lines: 6, Relevance: 7.506