Payload URL decoded from a Chr() numeric-array loader

The macro stores its stage-2 download URL as a numeric array (Array(250, 262, …)) and decodes it one character at a time with Chr() and a linear offset (e.g. Chr(n - 146)), then drives Microsoft.XMLHTTP.Open "GET", url with ADODB.Stream.SaveToFile and Shell.Application to drop and execute the payload in %TEMP%. This is the VBA-native analogue of the PowerShell char-array loader (no PowerShell, so that path does not see it); the URL is assembled at run time and never contiguous on disk. The analyzer folds the VBA concatenation, treats every run of small numbers as an array, brute-forces the per-element transform, and accepts only a decode that yields a valid host URL — so a benign numeric table cannot false-positive.