Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d5730a9e1d6834af…

MALICIOUS

Office (OLE)

3.29 MB Created: 2017-03-19 05:55:00 Authoring application: Microsoft Office Word First seen: 2017-05-13
MD5: b278795e4893a0d84486654630b9efa9 SHA-1: 904b249e8b8b745bfa642eb2a55a095204b6f3bc SHA-256: d5730a9e1d6834afc51d1b146c64e06008ca3aafd4bad6134304cb6b453bee12
212 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample contains a large VBA macro that utilizes Shell() and CreateObject() calls, indicating an attempt to execute arbitrary commands. The presence of a heap-spray pattern and the 'SE_LOLBIN_RUN_COMMAND' heuristic further suggest command execution. The macro likely downloads and executes a second-stage payload from one of the embedded URLs, such as those found on 'magiccpr.com'.

Heuristics 8

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Private Sub LettersDirectoryLabel_Click()
        Call Shell("explorer.exe " & LettersDirectoryLabel.Caption, vbNormalFocus)
    End Sub
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    7610:
    7620:    Set regex = CreateObject("vbscript.regexp")
    7630:    regex.IgnoreCase = True
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    OpenFile.nMaxFileTitle = OpenFile.nMaxFile
    OpenFile.lpstrInitialDir = Environ("USERPROFILE") & "\Desktop\"
    OpenFile.lpstrTitle = "Select a TaG audit file."
  • Heap-spray pattern detected high SC_HEAP_SPRAY
    Repeated 0x07 bytes found
    Disassembly
    Attempted x86 opcode disassembly
    00320791  07                pop es
    00320792  07                pop es
    00320793  07                pop es
    00320794  07                pop es
    00320795  07                pop es
    00320796  07                pop es
    00320797  07                pop es
    00320798  07                pop es
    00320799  07                pop es
    0032079A  07                pop es
    0032079B  07                pop es
    0032079C  07                pop es
    0032079D  07                pop es
    0032079E  07                pop es
    0032079F  07                pop es
    003207A0  07                pop es
    003207A1  07                pop es
    003207A2  07                pop es
    003207A3  07                pop es
    003207A4  07                pop es
    003207A5  07                pop es
    003207A6  07                pop es
    003207A7  07                pop es
    003207A8  07                pop es
    003207A9  07                pop es
    003207AA  07                pop es
    003207AB  07                pop es
    003207AC  07                pop es
    003207AD  07                pop es
    003207AE  07                pop es
    003207AF  07                pop es
    003207B0  07                pop es
    003207B1  07                pop es
    003207B2  07                pop es
    003207B3  07                pop es
    003207B4  07                pop es
    003207B5  07                pop es
    003207B6  07                pop es
    003207B7  07                pop es
    003207B8  07                pop es
    003207B9  07                pop es
    003207BA  07                pop es
    003207BB  07                pop es
    003207BC  07                pop es
    003207BD  07                pop es
    003207BE  07                pop es
    003207BF  07                pop es
    003207C0  07                pop es
    003207C1  07                pop es
    003207C2  07                pop es
    003207C3  07                pop es
    003207C4  07                pop es
    003207C5  07                pop es
    003207C6  07                pop es
    003207C7  07                pop es
    003207C8  07                pop es
    003207C9  07                pop es
    003207CA  07                pop es
    003207CB  07                pop es
    003207CC  07                pop es
    003207CD  07                pop es
    003207CE  07                pop es
    003207CF  07                pop es
    003207D0  07                pop es
    003207D1  07                pop es
    003207D2  07                pop es
    003207D3  07                pop es
    003207D4  07                pop es
    003207D5  07                pop es
    003207D6  07                pop es
    003207D7  07                pop es
    003207D8  07                pop es
    003207D9  07                pop es
    003207DA  07                pop es
    003207DB  07                pop es
    003207DC  07                pop es
    003207DD  07                pop es
    003207DE  07                pop es
    003207DF  07                pop es
    003207E0  07                pop es
    003207E1  07                pop es
    003207E2  07                pop es
    003207E3  07                pop es
    003207E4  07                pop es
    003207E5  07                pop es
    003207E6  07                pop es
    003207E7  07                pop es
    003207E8  07                pop es
    003207E9  07                pop es
    003207EA  07                pop es
    003207EB  07                pop es
    003207EC  07                pop es
    003207ED  07                pop es
    003207EE  07                pop es
    003207EF  07                pop es
    003207F0  07                pop es
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.magiccpr.com/gateway299expire.php?a=-1 In document text (OLE body)
    • http://www.magiccpr.com/gateway199expire.php?a=-1In document text (OLE body)
    • http://www.magiccpr.com/gateway99expire.php?a=-1In document text (OLE body)
    • http://www.magiccpr.comIn document text (OLE body)
    • http://www.magiccpr.com/site/FreeLifeLetterInstructions5.htmIn document text (OLE body)
    • http://www.magiccpr.com/site/BirthdayLifeLetterInstructions.htmIn document text (OLE body)
    • http://www.magiccpr.com/WorkBook40.htmIn document text (OLE body)
    • http://www.magiccpr.com/WorkBook26.htmIn document text (OLE body)
    • http://www.magiccpr.com/WorkBook41.htmIn document text (OLE body)
    • http://magiccpr.com/index.htmIn document text (OLE body)
    • http://www.magiccpr.com/gateway/wait2.php?a=In document text (OLE body)
    • http://www.magiccpr.com/gatewayletters.php/?a=In document text (OLE body)
    • http://www.magiccpr.com/gateway/�In document text (OLE body)
    • http://www.magiccpr.com/gateway.php/?a=In document text (OLE body)
    • http://www.magiccpr.com/gateway299expire.php?a=In document text (OLE body)
    • http://www.magiccpr.com/gateway199expire.php?a=In document text (OLE body)
    • http://www.magiccpr.com/gateway99expire.php?a=In document text (OLE body)
    • http://www.magiccpr.com/gateway/In document text (OLE body)
    • https://webmail.allstate.com/owa/In document text (OLE body)
    • https://webmail.allstate.com/dana-na/authIn document text (OLE body)
    • https://agencygateway2.allstate.com/wps/myportal/Home-FindCustomer?reload=trueAIn document text (OLE body)
    • https://mymail.allstate.com/exchweb/bin/auth/owalogon.aspIn document text (OLE body)
    • https://webmail.allstate.comIn document text (OLE body)
    • https://webmaillegacy.allstate.com/owa/In document text (OLE body)
    • https://email.allstate.com/owa/In document text (OLE body)
    • https://webmail.allstate.com/owa/,DanaInfo=.awfdpenrwzxnKmyz79r.xTx-9,SSL,SSO=U+In document text (OLE body)
    • https://webmail.allstate.com/dana-na/auth/url_34/welcome.cgiIn document text (OLE body)
    • https://agencygateway2.allstate.com/wps/myportal/Home-FindCustomer?reload=trueIn document text (OLE body)
    • https://agencygateway2.allstate.com/eaiSSL/EAIWeb/EAIServlet?OrigURL=https%3A//agencygateway2.allstate.com/wps/myportal/Home-FindCustomer%3Freload%3DtrueIn document text (OLE body)
    • https://pag0101.allianceweb.allstate.com/PolicyViewWEB/faces/policy/policyview/AutoPolicyView.jsp;jsessionid=000057rQxu_XT_uk-nY8pFyiy2M:16kq3o7cs#In document text (OLE body)
    • https://agencygateway1.allstate.com/ALLIANCE/launch/In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2129884 bytes
SHA-256: 260487d2373370cc6be75823948dfbc6ecb92126cc85989bc1f84205ae443ab9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True


Attribute VB_Name = "WordDocumentEvents"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private WithEvents oDoc As Word.Document
Attribute oDoc.VB_VarHelpID = -1

Public Sub Initialize(ByRef r_oDoc As Word.Document)
    Set oDoc = r_oDoc
    ProofRead.CurrentFile = oDoc.fullname
    ProofRead.CurrentName = oDoc.Name
End Sub

Private Sub oDoc_Close()
    ProofRead.CurrentFile = oDoc.fullname
    ProofRead.CurrentName = oDoc.Name
    Set oDoc = Nothing
End Sub

Attribute VB_Name = "BirthdayLifeProcessing"
Attribute VB_Base = "0{BB545B44-68B0-4344-AD4A-93845AAEBD2D}{E568319D-0673-4783-A3BA-F585CFBCAD76}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Option Explicit

Private Sub UserForm_QueryClose(Cancel As Integer, CloseMode As Integer)
    If CloseMagicCPR = False Then
        Cancel = True
    End If
End Sub


Attribute VB_Name = "BrowseTaG"
Attribute VB_Base = "0{60E075FF-5F8C-401B-A655-39A5A75AFC8A}{59DA40ED-F33C-4CCA-91F7-FB26256AB89C}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Option Explicit

'   UserForm_Activate

Private Sub UserForm_Activate()
    If MainForm.optCPRProcessDash.value = True Then
        TagDashLabel = "Select a Dash audit file."
    Else
        TagDashLabel = "Select a TaG audit file."
    End If
    BrowseTaG.Repaint
End Sub
Private Function ReadDashAudit() As Boolean
    Dim pos1 As Integer
    Dim pos2 As Integer
    Dim pos3 As Integer
    Dim sLine As String
    Dim asFields() As String
    
    Dim PolicyNumberTemp As String
    Dim LineCodeTemp As String
    Dim AnniversaryTemp As String
    Dim LastnameTemp As String
    Dim FirstNameTemp As String
    Dim EmailTemp As String
    
    Dim FindPolCol As Integer
    Dim FindLineCodeCol As Integer
    Dim FindAnniversaryCol As Integer
    Dim FindLastNameCol As Integer
    Dim FindFirstNameCol As Integer
    Dim FindEmailCol As Integer
    ReadDashAudit = False
    If Len(BrowseTaG.txtTagFile.Text) = 0 Then
        BrowseTaG.Show
    End If
    Close #1
    Open BrowseTaG.txtTagFile.Text For Input As #1
    Line Input #1, sLine
    sLine = Replace(sLine, """", "")
    FindPolCol = FindTagColumnIndex(sLine, "Policy Number")
    FindLastNameCol = FindTagColumnIndex(sLine, "Patron Last Name")
    FindFirstNameCol = FindTagColumnIndex(sLine, "Patron Name")
    FindLineCodeCol = FindTagColumnIndex(sLine, "Product Line Number")
    FindAnniversaryCol = FindTagColumnIndex(sLine, "Policy Anniversary Date")
    FindEmailCol = FindTagColumnIndex(sLine, "Patron Preferred Email Address")

    
    If FindPolCol = -1 Or FindLastNameCol = -1 Or FindFirstNameCol = -1 Or FindLineCodeCol = -1 Or _
            FindAnniversaryCol = -1 Or FindEmailCol = -1 Then 'Or FindDNMCol = -1 Or FindDNCCol = -1 Then  'Or FindEmailCol = -1 Then
        Exit Function
    End If
    
    Set SaveAutomatePolicys = New Collection
    Set AutomateFirstName = New Collection
    Set AutomateLastName = New Collection
    Set AutomateLineCode = New Collection
    Set AutomateAnniversaryDate = New Collection
    Set AutomateTagEmail = New Collection
    
    While Not EOF(1)
        Line Input #1, sLine
        If InStr(sLine, """") > 0 Then
            sLine = Replace(sLine, """", "")
        End If
        If InStr(sLine, ",,") > 0 Then
            sLine = Replace(sLine, ",,", ",OOOO,")
        End If
        
        asFields = Split(sLine, ",")
        PolicyNumberTemp = Replace(asFields(FindPolCol), """", "")
        LineCodeTemp = Replace(asFields(FindLineCodeCol), """", "")
        AnniversaryTemp = Replace(asFields(FindAnniversaryCol), """", "")
        pos1 = InStr(AnniversaryTemp, " ")
        AnniversaryTemp = Mid(AnniversaryTemp, 1, pos1 - 1)
        LastnameTemp = Replace(asFields(FindLastNameCol), """", "")
        FirstNameTemp = Replace(asFields(FindFirstNameCol), """", "")
        pos1 = InStr(FirstNameTemp, " ")
        FirstNameTemp = Mid(FirstNameTemp, 1, pos1 - 1)
        EmailTemp = Replace(asFields(FindEmailCol), """", "")

        While Len(PolicyNumberTemp) < 9
            PolicyNumberTemp = "0" + PolicyNumberTemp
        Wend
        If Len(PolicyNumberTemp) > 9 Then
            PolicyNumberTemp = Right(PolicyNumberTemp, 9)
        End If
        
'       Select Requested Line Codes
        If MainForm.DashLine10 = True And LineCodeTemp = "10" Then
        ElseIf MainForm.DashLine19 = True And LineCodeTemp = "19" Then
        ElseIf MainForm.DashLine70 = True And LineCodeTemp = "70" Then
        ElseIf MainForm.DashLine71 = True And LineCodeTemp = "70" Then
        ElseIf MainForm.DashLine78 = True And LineCodeTemp = "78" Then
        Else: GoTo NextInAudit
        End If
        
'       Select Date Range
        If MainForm.DashRenewalMode.value = True Then
            BeginMonth = Format(AnniversaryTemp, "mm")
            If MainForm.DashBeginMonthCombo.value < BeginMonth And MainForm.DashEndMonthCombo.value > BeginMonth Then
                BeginDay = Format(AnniversaryTemp, "dd")
                If MainForm.DashBeginDayCombo.value < BeginDay And MainForm.DashEndDayCombo.value > BeginDay Then
                Else: GoTo NextInAudit
                End If
            Else: GoTo NextInAudit
            End If
        
        End If
        
'       Select Alpha

        If IsLineInFilter(PolicyNumberTemp, LineCodeTemp, AnniversaryTemp, LastnameTemp, FirstNameTemp) Then
            Call AutomateFirstName.Add(FirstNameTemp)
            Call AutomateLastName.Add(LastnameTemp)
            Call SaveAutomatePolicys.Add(PolicyNumberTemp)
            Call AutomateLineCode.Add(LineCodeTemp)
            Call AutomateAnniversaryDate.Add(AnniversaryTemp)
            Call AutomateTagEmail.Add(EmailTemp)
        End If
NextInAudit:
    'Debug.print PolicyNumberTemp + " " + LineCodeTemp + " " + AnniversaryTemp + " " + FirstNameTemp + " " + LastnameTemp
    Wend
    Close #1
    ReadDashAudit = True
End Function
Private Sub cmdBack_Click()
    Call EndFindTimer
    Stopping = True
    If daysUntilExpire <= 0 Then
        BrowseTaG.Hide
        MainForm.Menu.value = Screen.blank
        MainForm.Show
    Else
        BrowseBack = True
        BrowseTaG.Hide
        MainForm.reset (0)
        FollowUpFile = False
        MainForm.Menu.value = Screen.LetterTypeMenu
        MainForm.Show
    End If
End Sub

Public Sub cmdAutomate_Click()
    If txtTagFile.value = "" Then
        MsgBox "Please enter a TaG Audit"
    ElseIf InStr(BrowseTaG.txtTagFile.Text, "Birthday") > 0 Then
        BrowseTaG.Hide
        RemoveBatch = True
        MainForm.AlphaMode.Enabled = False
        MainForm.LastNameInitial.Enabled = False
        MainForm.Line10and19.Enabled = False
        MainForm.Line70and78.Enabled = False
        MainForm.LifeMode.Enabled = False
        MainForm.RenewalMode.value = True
        MainForm.BDAudit.value = True
        MainForm.BeginMonthCombo.value = "01"
        MainForm.BeginDayCombo.value = "01"
        MainForm.EndMonthCombo.value = "12"
        MainForm.EndDayCombo.value = "31"
        MainForm.PauseButton.Visible = False
        BrowseTaG.txtTagFile.Text = txtTagFile.Text
        MainForm.BDAudit.value = True
        MainForm.Menu.value = Screen.automatemenu
        MainForm.Show
    ElseIf FollowUpFile = True And InStr(txtTagFile, "Follow-up") = 0 Then
        BrowseTaG.Hide
        MsgBox "The wrong file was selected.  Please browse for correct file."
        FollowUpFile = False
        Call SetRegSaveFollowupFile("")
        txtTagFile.value = ""
        BrowseTaG.Show
        Exit Sub
    ElseIf MainForm.AutomateLife.value = True Then
        BrowseTaG.Hide
        MainForm.PauseButton.Visible = False
        BrowseTaG.txtTagFile.Text = txtTagFile.Text
        If MainForm.OptionLife.value = False Then
            MainForm.Show
        End If
    Else
        If MainForm.optCPRProcessDash.value = True Then
            Call MainForm.ReadLastDashBatch

            If GetRegDashProcess = "0" Then
                MainForm.DashRenewalMode.value = True
            Else
                MainForm.DashAlphaMode.value = True
            End If
            Hide
            MainForm.Menu.value = Screen.Dash
            MainForm.Show
            Exit Sub
            'Call MainForm.ReadDashAudit
        ElseIf InStr(BrowseTaG.txtTagFile.Text, "Birthday") = 0 Then
'            Call MainForm.ReadBDTagAudit
'        Else
'            Call ReadDashAudit
            Call ReadTagAudit
        End If
        If TaGCorrupt = True Then
            TaGCorrupt = False
            Exit Sub
        End If
        BrowseTaG.Hide
        MainForm.PauseButton.Visible = False
        BrowseTaG.txtTagFile.Text = txtTagFile.Text

'        MainForm.Menu.Value = Screen.dash
        If GetRegAutoCrossSell = "" Then
            Call SetRegAutoCrossSell("0")
            MainForm.AutoCrossSellYes.value = True
            MainForm.AutoCrossSellNo.value = False
            MainForm.AutoCPRCrossSellYes.value = True
            MainForm.AutoCPRCrossSellNo.value = False
        ElseIf GetRegAutoCrossSell = "0" Then
            MainForm.AutoCrossSellYes.value = True
            MainForm.AutoCrossSellNo.value = False
            MainForm.AutoCPRCrossSellYes.value = True
            MainForm.AutoCPRCrossSellNo.value = False
        Else
            MainForm.AutoCrossSellYes.value = False
            MainForm.AutoCrossSellNo.value = True
            MainForm.AutoCPRCrossSellYes.value = False
            MainForm.AutoCPRCrossSellNo.value = True
        End If
    
    '   Cross Sell Property CPR Paragraph
        If GetRegPropertyCrossSell = "" Then
            Call SetRegPropertyCrossSell("0")
            MainForm.HomeCrossSellYes.value = True
            MainForm.HomeCrossSellNo.value = False
            MainForm.PropertyCPRCrossSellYes.value = True
            MainForm.PropertyCPRCrossSellNo.value = False
        ElseIf GetRegPropertyCrossSell = "0" Then
            MainForm.HomeCrossSellYes.value = True
            MainForm.HomeCrossSellNo.value = False
            MainForm.PropertyCPRCrossSellYes.value = True
            MainForm.PropertyCPRCrossSellNo.value = False
        Else
            MainForm.HomeCrossSellYes.value = False
            MainForm.HomeCrossSellNo.value = True
            MainForm.PropertyCPRCrossSellYes.value = False
            MainForm.PropertyCPRCrossSellNo.value = True
        End If
        MainForm.Menu.value = Screen.automatemenu
        Call MainForm.Menu_Change
        MainForm.Show
    End If

End Sub


Private Sub cmdBrowseTagFile_Click()
Dim OpenFile As OPENFILENAME
Dim lReturn As Long
Dim sFilter As String
'BrowseTaG.Hide
OpenFile.lStructSize = Len(OpenFile)
If MainForm.optCPRProcessTag.value = True Or MainForm.optCPRProcessDash.value = True Then
    sFilter = "Excel csv (*.csv)" & Chr(0) & "*.csv" & Chr(0)
Else
    sFilter = "Excel xls (*.xls)" & Chr(0) & "*.xls" & Chr(0)
End If
OpenFile.lpstrFilter = sFilter
OpenFile.nFilterIndex = 1
OpenFile.lpstrFile = String(257, 0)
OpenFile.nMaxFile = Len(OpenFile.lpstrFile) - 1
OpenFile.lpstrFileTitle = OpenFile.lpstrFile
OpenFile.nMaxFileTitle = OpenFile.nMaxFile
OpenFile.lpstrInitialDir = Environ("USERPROFILE") & "\Desktop\"
OpenFile.lpstrTitle = "Select a TaG audit file."
OpenFile.flags = 0
lReturn = GetOpenFileName(OpenFile)
If lReturn <> 0 Then
   txtTagFile.Text = Trim(OpenFile.lpstrFile)
End If
End Sub

Private Function ReadTagAudit() As Boolean

Dim pos1 As Integer
Dim pos2 As Integer
Dim pos3 As Integer
Dim sLine As String
Dim asFields() As String

Dim PolicyNumberTemp As String
Dim LineCodeTemp As String
Dim AnniversaryTemp As String
Dim LastnameTemp As String
Dim FirstNameTemp As String
Dim EmailTemp As String

Dim FindPolCol As Integer
Dim FindLineCodeCol As Integer
Dim FindAnniversaryCol As Integer
Dim FindLastNameCol As Integer
Dim FindFirstNameCol As Integer
Dim FindEmailCol As Integer
ReadTagAudit = False
'read header
Close #1
Open txtTagFile.Text For Input As #1
Line Input #1, sLine
sLine = Replace(sLine, """", "")
FindPolCol = FindTagColumnIndex(sLine, "Policy Number")
FindLastNameCol = FindTagColumnIndex(sLine, "Last Name")
FindFirstNameCol = FindTagColumnIndex(sLine, "First Name")
FindLineCodeCol = FindTagColumnIndex(sLine, "Line Code")
FindAnniversaryCol = FindTagColumnIndex(sLine, "Anniversary Date - Renewal Month & Day")
FindEmailCol = FindTagColumnIndex(sLine, "Email Address")

If TaGCorrupt = True Or FindPolCol = -1 Or FindLastNameCol = -1 Or FindFirstNameCol = -1 Or FindLineCodeCol = -1 Or _
        FindAnniversaryCol = -1 Then 'Or FindEmailCol = -1 Then
    Exit Function
End If

Set SaveAutomatePolicys = New Collection
Set AutomateFirstName = New Collection
Set AutomateLastName = New Collection
Set AutomateLineCode = New Collection
Set AutomateAnniversaryDate = New Collection
Set AutomateTagEmail = New Collection

While Not EOF(1)
    Line Input #1, sLine
    If InStr(sLine, """") > 0 Then
        sLine = Replace(sLine, """", "")
    End If
    If InStr(sLine, ",,") > 0 Then
        sLine = Replace(sLine, ",,", ",OOOO,")
    End If
    asFields = Split(sLine, ",")
    PolicyNumberTemp = Replace(asFields(FindPolCol), """", "")
    LineCodeTemp = Replace(asFields(FindLineCodeCol), """", "")
    AnniversaryTemp = Replace(asFields(FindAnniversaryCol), """", "")
    LastnameTemp = Replace(asFields(FindLastNameCol), """", "")
    FirstNameTemp = Replace(asFields(FindFirstNameCol), """", "")
    EmailTemp = Replace(asFields(FindEmailCol), """", "")
    While Len(PolicyNumberTemp) < 9
        PolicyNumberTemp = "0" + PolicyNumberTemp
    Wend
    If Len(PolicyNumberTemp) > 9 Then
        PolicyNumberTemp = Right(PolicyNumberTemp, 9)
    End If
    If IsLineInFilter(PolicyNumberTemp, LineCodeTemp, AnniversaryTemp, LastnameTemp, FirstNameTemp) Then
        Call AutomateFirstName.Add(FirstNameTemp)
        Call AutomateLastName.Add(LastnameTemp)
        Call SaveAutomatePolicys.Add(PolicyNumberTemp)
        Call AutomateLineCode.Add(LineCodeTemp)
        Call AutomateAnniversaryDate.Add(AnniversaryTemp)
        Call AutomateTagEmail.Add(EmailTemp)
    End If
    Wend
    Close #1
    ReadTagAudit = True
End Function

Private Function FindTagColumnIndex(line As String, searchcolumn As String) As Integer
    Dim columnsTemp() As String
    Dim columnIndex As Integer
    columnsTemp = Split(line, ",")
    For columnIndex = 0 To UBound(columnsTemp)
        If columnsTemp(columnIndex) = searchcolumn Then
            FindTagColumnIndex = columnIndex
            Exit Function
        End If
    Next
    BrowseTaG.Hide
    CorruptMagicTaG.Show

'    FindTagColumnIndex = -1
    MainForm.Menu.value = Screen.LetterTypeMenu
    MainForm.Show
End Function

Private Function IsLineInFilter(PolicyNumberTemp As String, LineCodeTemp As String, _
        AnniversaryTemp As String, LastnameTemp As String, FirstNameTemp As String) As Boolean
    Dim FromDate As Date
    Dim ToDate As Date
    Dim AnniversaryTempDateTemp() As String
    Dim AnniversaryTempDate As Date
    IsLineInFilter = True
End Function

Private Sub ExitBrowseTaG_Click()
    txtTagFile.Text = ""
    BrowseTaG.Hide
    MainForm.Menu.value = Screen.LetterTypeMenu
    MainForm.Show
End Sub

Private Sub UserForm_QueryClose(Cancel As Integer, CloseMode As Integer)
    Cancel = True
End Sub


Attribute VB_Name = "ClipboardForm"
Attribute VB_Base = "0{497C3046-D210-495D-B97A-84E1548D23B1}{AABAF6D6-2E92-499A-8563-706167547705}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub UserForm_Activate()
'    ClipboardForm.TextBox1.Text = Clipboard1
'    ClipboardForm.Show
    ClipboardForm.TextBox1.Text = Clipboard1
End Sub

Attribute VB_Name = "CorruptMagicTaG"
Attribute VB_Base = "0{167CE256-1AE5-4584-9BDD-7AEF987447D8}{C005CE43-AA40-43A3-9086-0973EB05F4F1}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Option Explicit

Private Sub cmdCorruptMagicTaG_Click()
    CorruptMagicTaG.Hide
    TaGCorrupt = True
    MainForm.Menu.value = Screen.LetterTypeMenu
    Call MainForm.HideAllWebBrowsers
End Sub

Attribute VB_Name = "ErrorForm"
Attribute VB_Base = "0{D0AD7EBB-C579-4F03-AC5E-ACC442206D62}{F54E4F3F-379C-4710-BA9E-A9436C61E6C3}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Option Explicit

Private Sub ErrorFormButton_Click()
    If ErrorReset = True Then
        ErrorReset = False
        ErrorForm.ErrorLabel.Caption = "This policy is causing an error.  If this is the first time on this policy, try it again.  If this error is repeated, another solution would be to close MagicCPR and try it again.  If this does not fix the error, please email the policy number to magicccpr@magiccpr.com and we will contact you to fix the error.  Make a note on your audit.  Please click OK and continue with the next customer."
        ErrorForm.Hide
    End If
    ErrorForm.Hide
    ErrorForm.ErrorLabel.Caption = "This policy is causing an error.  If this is the first time on this policy, try it again.  If this error is repeated, another solution would be to close MagicCPR and try it again.  If this does not fix the error, please email the policy number to magicccpr@magiccpr.com and we will contact you to fix the error.  Make a note on your audit.  Please click OK and continue with the next customer."
    'MainForm.ResetButton.Visible = False
    MainForm.reset (0)
    MainForm.MenuScrollFrame.Width = 192
    'MainForm.ExitButton.Visible = True
    MainForm.Menu.value = Screen.LetterTypeMenu
    Call MainForm.HideAllWebBrowsers
    MainForm.Show
End Sub

Attribute VB_Name = "LicenseAgreement"
Attribute VB_Base = "0{913D4B2E-3FA7-4151-ABE5-B12B5746BA89}{43D37ED4-ABA2-43D9-8212-00D3E6309D47}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Option Explicit

Private Sub Label6_DblClick(ByVal Cancel As MSForms.ReturnBoolean)
    LicenseAgreement.Hide
    SetWindowPos WordHwnd, HWND_NOTOPMOST, 0, 0, 0, 0, SWP_NOSIZE Or SWP_DRAWFRAME Or SWP_SHOWWINDOW
    ' just hit stop now
    Application.ActiveDocument.ViewCode
    End
End Sub

Private Sub LicenseAccept_Click()
    LicenseAgreement.Hide
    Call SetLicenseAgreement("1")
    If MainForm.bInitialized = True Then
        MainForm.Show
    End If
End Sub

Private Sub UserForm_Activate()
    Dim windowhandle As Long
    windowhandle = FindWindowWild(Me.Caption)
    SetWindowPos windowhandle, HWND_TOPMOST, 0, 0, 0, 0, SWP_DRAWFRAME Or SWP_SHOWWINDOW Or SWP_NOSIZE Or SWP_NOMOVE
    SetWindowPos windowhandle, HWND_NOTOPMOST, 0, 0, 0, 0, SWP_DRAWFRAME Or SWP_SHOWWINDOW Or SWP_NOSIZE Or SWP_NOMOVE
    Pause

End Sub

Private Sub UserForm_QueryClose(Cancel As Integer, CloseMode As Integer)
    Call CloseMagicCPR
End Sub



Attribute VB_Name = "MainForm"
Attribute VB_Base = "0{15CF958A-48AC-4E52-896A-6C40714AF49E}{48C8A4F8-4C1F-45EF-A5EE-31529D436B6C}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False



Option Explicit

Private Const module As String = "MainForm"
'SelectAgent
'SelectLetterType
'   certify
'   UserForm_Activate
'   cmdSelectAgent_Click
'   cmdSelectLetterType_Click
'   Signonscreen
'   cmdAutomate_Click
'   CheckProcessStatus()
'   Menu_Change
'   CheckProcessStatus()
'   CancelEmailButton2_Click
'   ReadTAGAudit
'   ReadBDTAGAudit
'   Private Function BDIsLineInFilter
'   ReadMWIRemoval
'   ReadMWIAudit
'   ReadDashAudit
'   ReadLastDashBatch
'   CancelEmailButton
Public InitializeEmailMessageWebBrowser As Boolean
Public ProcessingPopup As Boolean
Public hWnd As Long
Private WaitChange As Integer
Public LoadingBookmark As Boolean
Private Const ExchangeUrl As String = "https://webmail.allstate.com/owa/"
Private Const ExchangeUrl2 As String = "https://webmail.allstate.com/dana-na/auth"

Public PopupWebForm As WebForm
Public PopupWebForm2 As WebForm2
Public PopupWebForm2Popup As WebForm2
Public HeightAdjust As Double
Public WidthAdjust As Double
Private EmailLoadCount As Integer
Public AddingAgent As Boolean
Public Enum Screen
    Loading = 0
    SignInMenu = 1
    SelectAgent = 2
    LetterTypeMenu = 3
    findmenu = 4
    RegistrationMenu = 5
    CustomerProductsPageInfo = 6
    CustomerProductsPageInfo2 = 7
    letteroptionsmenu = 8
    MRPMenu = 9
    MRPMenu2 = 10
    blank = 11
    ExpiresSoon = 12
    EmailLogin = 13
    EmailMenu = 14
    LifeMenu = 15
    automatemenu = 16
    automatewaitmenu = 17
    WhatThis = 18
    lifeautomate = 19
    NameAdj = 20
    Claims = 21
    MWIButton = 22
    MWIComplete = 23
    LoadingPleaseWait = 24
    ReentryPage = 25
    Dash = 26
    ExpiredLife = 27
End Enum
Public Enum Browser
    none = 0
    Gateway = 1
    wait = 2
    Help = 3
    Email = 4
    EmailMessage = 5
End Enum
Public Enum WebState
    WebLoaded = 0
    WebLoading = 1
End Enum
Public Enum LetterType
    CPR = 0
    LifeLetter = 1
    InitialClaim = 2
    FollowupOpenClaim = 3
    FollowupClosedClaim = 4
    ALILetter = 5
    GoodStudentDiscount = 6
    CreateALetter = 7
End Enum

Public Enum ReentryType
    NoReentry = 0
    CreateCPRReentry = 1
    ProofreadReentry = 2
    RemoveMWIReentry = 3
    BirthdayReentry = 4
End Enum
Public CurrentReentryType As ReentryType

Public SelectedLetterType As LetterType
Public GatewayWebBrowserState As WebState
Private EmailMessageWebBrowserState As WebState
Public CurrentFile As String
Public CurrentName As String
Private CurrentDocument As Word.Document
Private CurrentDocumentEvents As WordDocumentEvents
Public bInitialized As Boolean
Public DraftFiles As Collection
Public CurrentDraftFileIndex As Integer
Public Sub CheckProcessStatusDash()
    
1160:    Call TraceRoutine(module, "CheckProcessStatusDash")
1170:    Dim CrossSell As String
1180:    Dim Insert As String
1190:    Dim Cius As String
1200:
1210:    If Stopping = True Then Exit Sub
1220:    If daysUntilExpire <= 0 Then
1230:        MainForm.BDAudit.value = "True"
1240:        Call ProofRead.StartProofread
1250:        Exit Sub
1260:    End If
1270:    If Not ReadDashAudit Then
1280:    End If
1290:    If SaveAutomatePolicyIndex = 0 Then '.Count = 0 Then
1300:        Call MsgBox("No policies were found in the audit.  When running policies in two different years, break into two batches.  First batch run until 12/31.  Second batch start on 1/1.")
1310:        Call reset(0)
1320:        Exit Sub
1330:    Else
1340:        policyNumber = GetRegSaveAutomatePolicy
1350:        SaveAutomatePolicyIndex = 1
1360:        If policyNumber <> "" Then 'And Menu.Value <> Screen.MWIButton Then
1370:            SaveAutomatePolicyIndex = FindPolicyNumberIndex(policyNumber)
1380:            If SaveAutomatePolicyIndex > 0 Then
1390:                ' found a previous policy
1400:                If MsgBox("The process stopped at policy number " & policyNumber & ".  Do you want to continue your letters starting with this policy number?", vbYesNo Or vbExclamation, "Magic CPR") = vbYes Then
1410:                    TimesThru = 0
1420:                    Call ResetVariables
1430:                    Call NavigateGatewayWebBrowser("https://agencygateway2.allstate.com/wps/myportal/Home-FindCustomer?reload=true")
1440:                    Exit Sub
1450:                End If
1460:            End If
1470:        End If
1480:        ' start at the beginning
1490:    End If
1500: '    If BrowseTaG.txtTagFile.Text = "" Then
1510: '        BrowseTaG.Show
1520: '    End If
1530:    If OptionLife.value = True Then
1540:        TheProcess = "LifLtr"
1550:    ElseIf optFmtPrintOnly.value = True Then
1560:        TheProcess = "Print CPRs Only"
1570:    ElseIf optFmtPrintOrEmail.value = True Then
1580:        TheProcess = "Print or Email CPRs"
1590:    ElseIf optFmtPrintAndEmail.value = True Then
1600:        TheProcess = "Print and Email CPRs"
1610:    ElseIf optFmtEmailOnly.value = True Then
1620:        TheProcess = "Email CPRs Only"
1630:    End If
1640:    If DashLine10 = True Then
1650:        Dash10 = True
1660:    End If
1670:    If DashLine19 = True Then
1680:        Dash19 = True
1690:    End If
1700:    If DashLine70 = True Then
1710:        Dash70 = True
1720:    End If
1730:    If DashLine71 = True Then
1740:        Dash71 = True
1750:    End If
1760:    If DashLine78 = True Then
1770:        Dash78 = True
1780:    End If
1790:
1800:    If AutoCPRCrossSellYes.value = True Then
1810:        AutoCrossSell = "Option to print Auto Cross Sell paragraph is on."
1820:    Else
1830:        AutoCrossSell = "Option to print Auto Cross Sell paragraph is off."
1840:    End If
1850:    If PropertyCPRCrossSellYes.value = True Then
1860:        PropertyCrossSell = "Option to print Property Cross Sell paragraph is on."
1870:    Else
1880:        PropertyCrossSell = "Option to print Property Cross Sell paragraph is off."
1890:    End If
1900:    If optPrintInsertYes.value = True Then
1910:        Insert = "Option to print Life Insert is on."
1920:    ElseIf optPrintInsertNo.value = True Then
1930:        Insert = "Option to print Life Insert is off."
1940:    End If
1950:    If optPrintCIUSYes.value = True Then
1960:        Cius = "Option to print Update Sheet is on."
1970:    ElseIf optPrintCIUSNo.value = True Then
1980:        Cius = "Option to print Update Sheet is off."
1990:    End If
2000: '    Call ReadDashAudit
2010:
2020:    If SaveAutomatePolicys.Count = 0 Then
2030:        If DashLine10.value = True Or DashLine19.value = True Or DashLine70.value = True Or DashLine71.value = True Or DashLine78.value = True Then
2040:            Call MsgBox("No policies were found in the audit.  When running policies in two different years, break into two batches.  First batch run until 12/31.  Second batch start on 1/1.")
2050:            Call reset(0)
2060:        End If
2070:    Else
2080:
2090:        If DashRenewalMode.value = True Then
2100:            ReadAuditFormFinal.Show
2110:
2120: '            If MsgBox("Selections for this batch are as follows: " & vbCrLf & "Policy lines " & PolicyLines & "" & vbCrLf & "Renewal dates beginning " & BeginMonthCombo.Value & "/" & BeginDayCombo.Value & " to " & EndMonthCombo & "/" & EndDayCombo & vbCrLf & "Processing " & TheProcess & vbCrLf & " " & vbCrLf & "There are " & SaveAutomatePolicys.Count & " policies in this batch." & vbCrLf & " " & vbCrLf & "Presets:" & vbCrLf & Insert & vbCrLf & AutoCrossSell & vbCrLf & PropertyCrossSell & vbCrLf & Cius & vbCrLf & " " & vbCrLf & " " & vbCrLf & " " & vbCrLf & "To continue, click Yes." & vbCrLf & " " & vbCrLf & "To go back to the Letter Selection Screen, Click No.", vbYesNo) = vbYes Then
2130:                 Debug.Print "MagicDash 1 Call NavigateGatewayWebBrowser"
2140:                 Call NavigateGatewayWebBrowser("https://agencygateway2.allstate.com/wps/myportal/Home-FindCustomer?reload=true")
2150:                Exit Sub
2160: '            Else
2170: '                BeginMonthCombo.Value = "01"
2180: '                BeginDayCombo.Value = "01"
2190: '                EndMonthCombo.Value = "12"
2200: '                EndDayCombo.Value = "31"
2210: '                Line10and19.Value = False
2220: '                Line70and78.Value = False
2230: '                RenewalMode.Value = False
2240: '                AlphaMode.Value = False
2250: '                LastNameInitial = ""
2260: '                Call reset(0)
2270: '            End If
2280:        ElseIf DashAlphaMode.value = True Then
2290:            ReadAuditFormFinal.Show vbModeless
2300:            If MsgBox("Selections for this batch are as follows: " & vbCrLf & "Policy lines " & PolicyLines & "" & vbCrLf & "Last Name Initial '" & LastNameInitial & "'" & vbCrLf & "Processing " & TheProcess & vbCrLf & vbCrLf & "There are " & SaveAutomatePolicys.Count & " policies in this batch." & vbCrLf & " " & vbCrLf & "Presets:" & vbCrLf & Insert & vbCrLf & CrossSell & vbCrLf & Cius & vbCrLf & " " & vbCrLf & "To continue, click Yes." & vbCrLf & " " & vbCrLf & "To go back to the Letter Selection Screen, click No.", vbYesNo) = vbYes Then
2310:                Automate = True
2320:                Call NavigateGatewayWebBrowser("https://agencygateway2.allstate.com/wps/myportal/Home-FindCustomer?reload=true")
2330:                Exit Sub
2340:            Else
2350:                BeginMonthCombo.value = "01"
2360:                BeginDayCombo.value = "01"
2370:                EndMonthCombo.value = "12"
2380:                EndDayCombo.value = "31"
2390:                Line10and19.value = False
2400:                Line70and78.value = False
2410:                RenewalMode.value = False
2420:                AlphaMode.value = False
2430:                LastNameInitial = ""
2440:                Call reset(0)
2450:            End If
2460:        End If
2470:    End If
End Sub

Private Sub cmdAutomateDash_Click()
2510:
2520:    Call TraceRoutine(module, "cmdAutomateDash_Click")
2530:    Stopping = False
2540:    FromAuto = True
2550:
2560: '   Cancel Mid-Year Renewal Control
2570:    If MainForm.CancelMidYear.value = True Then
2580:        SetRegCancelMidYearRenewal ("0")
2590:    Else
2600:        SetRegCancelMidYearRenewal ("1")
2610:    End If
2620: '   Set Current Date Batch File
2630:
2640:    CurrentDashBatch = GetRegLastProcess
2650:
2660:    If optFmtPrintOnly.value = True Then
2670:        CurrentDashBatch = CurrentDashBatch + "1"
2680:    ElseIf optFmtPrintOrEmail.value = True Then
2690:        CurrentDashBatch = CurrentDashBatch + "2"
2700:    ElseIf optFmtEmailOnly.value = True Then
2710:        CurrentDashBatch = CurrentDashBatch + "3"
2720:    End If
2730:    If DashRenewalMode.value = True Then
2740:        CurrentDashBatch = CurrentDashBatch + "1"
2750:    ElseIf DashAlphaMode.value = True Then
2760:        CurrentDashBatch = CurrentDashBatch + "2"
2770:    End If
2780:    CurrentDashBatch = CurrentDashBatch + DashBeginMonthCombo.value + DashBeginDayCombo.value + DashEndMonthCombo.value + DashEndDayCombo
2790:
2800:    If DashLine10.value = True Then
2810:        CurrentDashBatch = CurrentDashBatch + "10"
2820:    Else
2830:        CurrentDashBatch = CurrentDashBatch + "00"
2840:    End If
2850:    If DashLine19.value = True Then
2860:        CurrentDashBatch = CurrentDashBatch + "19"
2870:    Else
2880:        CurrentDashBatch = CurrentDashBatch + "00"
2890:    End If
2900:    If DashLine70.value = True Then
2910:        CurrentDashBatch = CurrentDashBatch + "70"
2920:    Else
2930:        CurrentDashBatch = CurrentDashBatch + "00"
2940:    End If
2950:    If DashLine71.value = True Then
2960:        CurrentDashBatch = CurrentDashBatch + "71"
2970:    Else
2980:        CurrentDashBatch = CurrentDashBatch + "00"
2990:    End If
3000:    If DashLine78.value = True Then
3010:        CurrentDashBatch = CurrentDashBatch + "78"
3020:    Else
3030:        CurrentDashBatch = CurrentDashBatch + "00"
3040:    End If
3050:    If DashLastNameInitial <> "" Then
3060:        CurrentDashBatch = CurrentDashBatch + UCase(DashLastNameInitial)
3070:    End If
3080:    Call SetRegCurrentDashBatchFile(CurrentDashBatch)
3090:    Dim pos1 As Integer
3100:    Dim pos2 As Integer
3110:    Dim BatchSelected As String
3120:    Dim BatchFormat As String
3130:    Dim BatchAuditMode As String
3140:    Dim BatchBeginMonth As String
3150:    Dim BatchBeginDay As String
3160:    Dim BatchEndMonth As String
3170:    Dim BatchEndDay As String
3180:    Dim PoliciesSelected As String
3190:    Dim Auto10Selected As String
3200:    Dim Auto19Selected As String
3210:    Dim Home70Selected As String
3220:    Dim Renters71Selected As String
3230:    Dim Condo78Selected As String
3240:
3250:
3260:    pos1 = 1
3270:    pos2 = 2
3280:    BatchSelected = Mid(CurrentDashBatch, pos1, pos2 - pos1)
3290:    If BatchSelected = "3" Then
3300:        ReadAuditFormFinal.lblBatchSelected.Caption = "Dash"
3310:    End If
3320:    pos1 = 2
3330:    pos2 = 3
3340:    BatchFormat = Mid(CurrentDashBatch, pos1, pos2 - pos1)
3350:    If BatchFormat = "1" Then
3360:        ReadAuditFormFinal.lblBatchSelected.Caption = ReadAuditFormFinal.lblBatchSelected.Caption + " - Print Only"
3370:    ElseIf BatchFormat = "2" Then
3380:        ReadAuditFormFinal.lblBatchSelected.Caption = ReadAuditFormFinal.lblBatchSelected.Caption + " - Email or Print"
3390:    ElseIf BatchFormat = "3" Then
3400:        ReadAuditFormFinal.lblBatchSelected.Caption = ReadAuditFormFinal.lblBatchSelected.Caption + " - Email Only"
3410:    End If
3420:    pos1 = 3
3430:    pos2 = 4
3440:    BatchAuditMode = Mid(CurrentDashBatch, pos1, pos2 - pos1)
3450:    If BatchAuditMode = "1" Then
3460:        ReadAuditFormFinal.lblBatchAuditMode.Caption = "Renewal Mode"
3470:    ElseIf BatchAuditMode = "2" Then
3480:        ReadAuditFormFinal.lblBatchAuditMode.Caption = "Alpha Mode"
3490:        ReadAuditFormFinal.lblModeSelected.Caption = "Last Name Initial:"
3500:    End If
3510:    pos1 = 4
3520:    pos2 = 6
3530:    BatchBeginMonth = Mid(CurrentDashBatch, pos1, pos2 - pos1)
3540:    pos1 = 6
3550:    pos2 = 8
3560:    BatchBeginDay = Mid(CurrentDashBatch, pos1, pos2 - pos1)
3570:    pos1 = 8
3580:    pos2 = 10
3590:    BatchEndMonth = Mid(CurrentDashBatch, pos1, pos2 - pos1)
3600:    pos1 = 10
3610:    pos2 = 12
3620:    BatchEndDay = Mid(CurrentDashBatch, pos1, pos2 - pos1)
3630:    If BatchAuditMode = "2" Then
3640:        ReadAuditFormFinal.lblDatesSelected.Caption = UCase(MainForm.DashLastNameInitial.Text)
3650:    Else
3660:        ReadAuditFormFinal.lblDatesSelected.Caption = BatchBeginMonth + "/" + BatchBeginDay + "-" + BatchEndMonth + "/" + BatchEndDay
3670:    End If
3680:    pos1 = 12
3690:    pos2 = 14
3700:    Auto10Selected = Mid(CurrentDashBatch, pos1, pos2 - pos1)
3710:    If Auto10Selected = "10" Then
3720:        PoliciesSelected = "10"
3730:    End If
3740:    pos1 = 14
3750:    pos2 = 16
3760:    Auto19Selected = Mid(CurrentDashBatch, pos1, pos2 - pos1)
3770:    If Auto19Selected = "19" Then
3780:        If Auto10Selected = "10" Then
3790:            PoliciesSelected = PoliciesSelected + ", 19"
3800:        Else
3810:            PoliciesSelected = PoliciesSelected + "19"
3820:        End If
3830:    End If
3840:    pos1 = 16
3850:    pos2 = 18
3860:    Home70Selected = Mid(CurrentDashBatch, pos1, pos2 - pos1)
3870:    If Home70Selected = "70" Then
3880:        If Auto10Selected = "10" Or Auto19Selected = "19" Then
3890:            PoliciesSelected = PoliciesSelected + ", 70"
3900:        Else
3910:            PoliciesSelected = PoliciesSelected + "70"
3920:        End If
3930:    End If
3940:    pos1 = 18
3950:    pos2 = 20
3960:    Renters71Selected = Mid(CurrentDashBatch, pos1, pos2 - pos1)
3970:    If Renters71Selected = "71" Then
3980:        If Auto10Selected = "10" Or Auto19Selected = "19" Or Home70Selected = "70" Then
3990:            PoliciesSelected = PoliciesSelected + ", 71"
4000:        Else
4010:            PoliciesSelected = PoliciesSelected + "71"
4020:        End If
4030:    End If
4040:    pos1 = 20
4050:    pos2 = 22
4060:    Condo78Selected = Mid(CurrentDashBatch, pos1, pos2 - pos1)
4070:    If Condo78Selected = "78" Then
4080:        If Auto10Selected = "10" Or Auto19Selected = "19" Or Home70Selected = "70" Or Renters71Selected = "71" Then
4090:            PoliciesSelected = PoliciesSelected + ", 78"
4100:        Else
4110:            PoliciesSelected = PoliciesSelected + "78"
4120:        End If
4130:    End If
4140:    ReadAuditFormFinal.lblPoliciesSelected.Caption = PoliciesSelected
4150:
4160:
4170:
4180: '   UCase Last Name Initial
4190:    DashLastNameInitial.Text = UCase(DashLastNameInitial.Text)
4200:
4210: '   Dash Process Control
4220:    If MainForm.DashRenewalMode.value = True Then
4230:        SetRegDashProcess ("0")
4240:    Else
4250:        SetRegDashProcess ("1")
4260:    End If
4270:
…