SmartHawk

2.3

中危

52 个模型检测该样本为恶意！

重新分析

下载样本

8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337847238cacaa16d840a19

8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337847238cacaa16d840a19.exe

分析耗时

54s

最近分析

394天前

文件大小

872.2KB

静态报毒动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN ZUSY

DACN 0.14

FACILE 1.00

IMCLNet 0.69

MFGraph 0.00

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.14	Unknown	0.05s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.03s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.69	Unknown	0.19s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	None	20190527	0.3.0.5
Baidu	None	20190318	1.0.0.2
CrowdStrike	win/malicious_confidence_100% (D)	20190702	1.0
Kingsoft	None	20191012	2013.8.14.323
McAfee	GenericRXII-WD!1B590CEE7E56	20191012	6.0.6.653
Tencent	None	20191012	1.0.0.1

可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报） (1 个事件)

section

.ap0x

一个或多个进程崩溃 (50 out of 1024 个事件)

Time & API	Arguments	Status
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1636360 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1636360 registers.ebp: 1636440 registers.esi: 1636548 registers.edi: 1636548 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1636116 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1636116 registers.ebp: 1636196 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1634972 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1634972 registers.ebp: 1635052 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635240 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635240 registers.ebp: 1635320 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635532 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635532 registers.ebp: 1635612 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635456 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635456 registers.ebp: 1635536 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1634972 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1634972 registers.ebp: 1635052 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635240 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635240 registers.ebp: 1635320 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635532 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635532 registers.ebp: 1635612 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635456 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635456 registers.ebp: 1635536 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1634972 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1634972 registers.ebp: 1635052 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635240 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635240 registers.ebp: 1635320 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635532 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635532 registers.ebp: 1635612 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635456 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635456 registers.ebp: 1635536 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.84375 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.85875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.85875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.85875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.85875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.85875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1634972 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1634972 registers.ebp: 1635052 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635240 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635240 registers.ebp: 1635320 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635532 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635532 registers.ebp: 1635612 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635456 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635456 registers.ebp: 1635536 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1634972 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1634972 registers.ebp: 1635052 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635240 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635240 registers.ebp: 1635320 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635532 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635532 registers.ebp: 1635612 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635456 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635456 registers.ebp: 1635536 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727110791.87475 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 9061952 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 9061952 registers.edi: 9061952 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success

在文件系统上创建可执行文件 (1 个事件)

file	C:\Windows\System32\24-9-2024.exe

将读写内存保护更改为可读执行（可能是为了避免在同时设置所有 RWX 标志时被检测） (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1727110791.78075 NtProtectVirtualMemory	process_handle: 0xffffffff base_address: 0x003a0000 length: 24576 protection: 32 (PAGE_EXECUTE_READ) process_identifier: 844	success	0	0
1727110791.79675 NtProtectVirtualMemory	process_handle: 0xffffffff base_address: 0x003a0000 length: 40960 protection: 32 (PAGE_EXECUTE_READ) process_identifier: 844	success	0	0

重复搜索未找到的进程，您可能希望在分析期间运行一个网络浏览器 (12 个事件)

Time & API	Arguments	Status
1727110797.37475 Process32NextW	snapshot_handle: 0x000001dc process_name: 8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337兯盫兯盫兯盫ࠀ process_identifier: 844	failed
1727110797.37475 Process32NextW	snapshot_handle: 0x000001d8 process_name: 8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337兯盫兯盫兯盫ࠀ process_identifier: 844	failed
1727110797.37475 Process32NextW	snapshot_handle: 0x000001c8 process_name: 8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337兯盫兯盫兯盫ࠀ process_identifier: 844	failed
1727110797.39075 Process32NextW	snapshot_handle: 0x000001cc process_name: 8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337兯盫兯盫兯盫ࠀ process_identifier: 844	failed
1727110797.39075 Process32NextW	snapshot_handle: 0x000001d0 process_name: 8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337兯盫兯盫兯盫ࠀ process_identifier: 844	failed
1727110797.39075 Process32NextW	snapshot_handle: 0x000001d4 process_name: 8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337兯盫兯盫兯盫ࠀ process_identifier: 844	failed
1727110797.39075 Process32NextW	snapshot_handle: 0x000001e0 process_name: 8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337兯盫兯盫兯盫ࠀ process_identifier: 844	failed
1727110797.39075 Process32NextW	snapshot_handle: 0x000001e4 process_name: 8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337兯盫兯盫兯盫ࠀ process_identifier: 844	failed
1727110797.39075 Process32NextW	snapshot_handle: 0x000001e8 process_name: 8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337兯盫兯盫兯盫ࠀ process_identifier: 844	failed
1727110797.39075 Process32NextW	snapshot_handle: 0x000001ec process_name: 8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337兯盫兯盫兯盫ࠀ process_identifier: 844	failed
1727110797.39075 Process32NextW	snapshot_handle: 0x000001f0 process_name: 8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337兯盫兯盫兯盫ࠀ process_identifier: 844	failed
1727110797.40575 Process32NextW	snapshot_handle: 0x000001f4 process_name: 8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337兯盫兯盫兯盫ࠀ process_identifier: 844	failed

与未执行 DNS 查询的主机进行通信 (2 个事件)

host	114.114.114.114
host	8.8.8.8

从系统中删除大量文件，表明 ransomware、清除恶意软件或系统破坏 (50 out of 1329 个事件)

file	E:\?4?694-24–.?‰‰.“b?
file	Y:\‘…’?b? .?b
file	Z:\¨??a??\|?‰?.???
file	F:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\‰??‘????.???
file	K:\a????“a.?–?.“b?
file	Z:\¤?c’???‘? a?? 3?‘‘????\Administrator\???‰?ca‘??? ¤a‘a\”??‰????.???
file	Y:\a????“a.?‰‰.“b?
file	F:\¤???‘??.???
file	W:\\|’??– μ3′ 3ca??a‰.a“?.???
file	G:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\????.???
file	H:\¤???‘??.???
file	N:\??b’.‘?‘
file	O:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\·??¤ˉ·3\???‘????.???
file	F:\a????“a.?–?.“b?
file	U:\·??32.?‰‰.“b?
file	S:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\c????.???
file	N:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\‰?a??.???
file	F:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\‰?a??.???
file	N:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\”??‰????.???
file	F:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\”??‰????.???
file	T:\?4‰0?6.?–?.“b?
file	D:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\‰?a??.???
file	N:\¤?c’???‘? a?? 3?‘‘????\Administrator\???‰?ca‘??? ¤a‘a\”??‰????.???
file	T:\a????“a.?‰‰.“b?
file	M:\¤?c’???‘? a?? 3?‘‘????\Administrator\???‰?ca‘??? ¤a‘a\c????.???
file	I:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\¨??a??\|?‰?.???
file	V:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\‰?a??.???
file	C:\Users\Administrator\AppData\Local\Temp\??c??c‘‰.?c?
file	D:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\¨??a??\|?‰?.???
file	J:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\‰??‘????.???
file	L:\?4?694-24–.?‰‰.“b?
file	H:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\‰??‘????.???
file	E:\·??32.?‰‰.“b?
file	D:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\”??‰????.???
file	T:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\·??¤ˉ·3\???‘????.???
file	H:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\·??¤ˉ·3\‰?a??.???
file	W:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\¨ˉ??§￥4.???
file	T:\\|’??– μ3′ 3ca??a‰.a“?.???
file	N:\¤?c’???‘? a?? 3?‘‘????\Administrator\???‰?ca‘??? ¤a‘a\c????.???
file	V:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\???“?c??.???
file	A:\a????“a.?–?.“b?
file	F:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\”??‰????.???
file	B:\-332¤??.?‰‰.“b?
file	Q:\\|’??– μ3′ 3ca??a‰.???
file	Z:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\‰??‘????.???
file	Y:\-332¤??.?‰‰.“b?
file	C:\????.???
file	Y:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\ˉb?‘?.???
file	Q:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\·??¤ˉ·3\‰??‘????.???
file	K:\¤???‘??.???

尝试解除Cuckoo监控的Windows函数的钩子 (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1727110832.06275 __anomaly__	tid: 3028 subcategory: exception function_name: message: Encountered 1025 exceptions, quitting.	success	0	0

文件已被 VirusTotal 上 52 个反病毒引擎识别为恶意 (50 out of 52 个事件)

ALYac	Gen:Variant.Zusy.297955
APEX	Malicious
Acronis	suspicious
Ad-Aware	Gen:Variant.Zusy.297955
AhnLab-V3	Trojan/Win32.Agent.R287960
Antiy-AVL	Trojan/Win32.VB
Arcabit	Trojan.Zusy.D48BE3
Avira	TR/Patched.Ren.Gen
BitDefender	Gen:Variant.Zusy.297955
CAT-QuickHeal	Trojan.VBCrypt.MF.6162
CMC	Trojan.Win32.VB!O
ClamAV	Win.Malware.Jaik-7111282-0
Comodo	Worm.Win32.VB.VIS@8g39zt
CrowdStrike	win/malicious_confidence_100% (D)
Cybereason	malicious.e7e568
Cylance	Unsafe
Cyren	W32/S-a6d72e9a!Eldorado
DrWeb	Win32.HLLW.Autoruner2.53432
ESET-NOD32	Win32/VB.OED
Emsisoft	Gen:Variant.Zusy.297955 (B)
Endgame	malicious (high confidence)
F-Secure	Trojan.TR/Patched.Ren.Gen
FireEye	Generic.mg.1b590cee7e56845e
Fortinet	W32/Midie.6525!tr
GData	Win32.Trojan.VB.ARB
Invincea	heuristic
Jiangmin	Trojan/VB.cyhm
K7AntiVirus	EmailWorm ( 005483cc1 )
K7GW	EmailWorm ( 005483cc1 )
Kaspersky	Trojan.Win32.VB.cmy
MAX	malware (ai score=85)
Malwarebytes	Adware.IStartSurf
MaxSecure	Trojan.VB.cmy
McAfee	GenericRXII-WD!1B590CEE7E56
McAfee-GW-Edition	BehavesLike.Win32.VBObfus.ch
MicroWorld-eScan	Gen:Variant.Zusy.297955
Microsoft	Worm:Win32/Autorun.DU!MTB
NANO-Antivirus	Trojan.Win32.VB.ecifhv
Panda	Trj/Genetic.gen
Qihoo-360	QVM41.1.Malware.Gen
Rising	Worm.VB!1.BC33 (CLASSIC)
SentinelOne	DFI - Malicious PE
Sophos	Troj/VB-KLL
Symantec	ML.Attribute.HighConfidence
Trapmine	malicious.moderate.ml.score
VBA32	TScope.Trojan.VB
VIPRE	Trojan.Win32.VB.cmy (v)
Webroot	W32.Malware.Gen
Yandex	Trojan.VB!IDzdA52F+Lc
Zillya	Trojan.VB.Win32.434521

288x288

224x224

192x192

160x160

128x128

96x96

64x64

32x32

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2008-01-12 22:58:39

PE Imphash

6bfb12c0ac9e50aa509f27c55c68a1e2

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x0001f000	0x0001a200	6.440664490009885
.rsrc	0x00020000	0x00004000	0x00003a00	6.113191262768062
.ap0x	0x00024000	0x00000396	0x00000400	3.6722237222963576

Resources

Name	Offset	Size	Language	Sub-language	File type
RT_ICON	0x000200e8	0x000025a8	LANG_NEUTRAL	SUBLANG_NEUTRAL	None
RT_GROUP_ICON	0x00022690	0x00000014	LANG_NEUTRAL	SUBLANG_NEUTRAL	None
RT_VERSION	0x000226a8	0x000004d8	LANG_ENGLISH	SUBLANG_ENGLISH_US	None

Imports

Library MSVBVM60.DLL:

• 0x401000 MethCallEngine

• 0x401004 rtcAnsiValueBstr

• 0x401008 rtcLowerCaseVar

• 0x40100c rtcGetYear

• 0x401010 rtcRandomNext

• 0x401014 rtcRandomize

• 0x401018 rtcDoEvents

• 0x40101c rtcMidCharBstr

• 0x401020 rtcMidCharVar

• 0x401024 rtcSpaceBstr

• 0x401028 EVENT_SINK_AddRef

• 0x40102c rtcUpperCaseVar

• 0x401030 DllFunctionCall

• 0x401034 EVENT_SINK_Release

• 0x401038 rtcShell

• 0x40103c EVENT_SINK_QueryInterface

• 0x401040 __vbaExceptHandler

• 0x401044 rtcSplit

• 0x401048 rtcReplace

• 0x40104c rtcVarBstrFromAnsi

• 0x401050 rtcMakeDir

• 0x401054 rtcCreateObject2

• 0x401058 ProcCallEngine

• 0x40105c rtcBstrFromAnsi

• 0x401060 rtcDir

• 0x401064 rtcFileLength

• 0x401068 rtcFileCopy

• 0x40106c rtcErrObj

• 0x401070 ThunRTMain

• 0x401074 rtcLeftCharBstr

• 0x401078 rtcLeftCharVar

• 0x40107c rtcRightCharBstr

• 0x401080 rtcRightCharVar

• 0x401084 rtcGetDayOfMonth

• 0x401088 rtcGetHourOfDay

• 0x40108c rtcGetMinuteOfHour

• 0x401090 rtcGetMonthOfYear

• 0x401094 rtcGetPresentDate

• 0x401098 rtcGetSecondOfMinute

L2754634121021201917436465008801038372285161110586482107214325381853141810348437766834361347434787
Project1
O\9'C 
ziSU5I%
AO:O3f
DesertAttack
GmbrGaara
 $.' ",#
(7),01444'9=82<.342
!22222222222222222222222222222222222222222222222222
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
3PG<^dL
[#yG>'Moj
M'4#%tn[V:
XhWz=p6V
>}+||Zo
8`FqCI
sO%<<g&[`
KRg,Az
z+Zyp)m<EiRAon
';?j]{L}6
\kc<!*&3`p:nI^
NOkrhnGUzqk
Vk.Rtc
xrG wW?5
j)6hsb
$hgHH"`12p>XaF8v
iOhRI"
]dX2mvq
KAL["-
txwyt,jz
izy+R*>EA#
i+hw:[l.Fq
0xWNHd[hW
?-f}RIAvFA 
~=k&Lck7I3
@S0};YYZ
Z44ZB"V-\}
^:C,Vur
hP]nc4
~s_8s\
y,QB/\
[)B<1n
eclO?J<g
H$wX%e8}
sz.VDVV
Q:+/TH
:M-\So-aP
:i;+5xB
i,o,7q}
,;YJl-Kv
"3_\(!Fn
t)7RVG]
P2I+D:Rk
[]t=6Z%Yyr
2s[;c`h
z^+BT
3(rXylo
Yrs^wpE
\hK<3_]V>Z 
Jf]9lABCmiP6i%W
,Q$x_:D
|;V"+d
[hX2<13y
^+%xqPJ
U(S#jUKf
qE#YvBH]
~{@T`N.2q}
f3R]L}JI`H/
ZCMkY<I
p7BU2Z97mb`Z
NJ\wyybv
QE&Fq@
i|/tVhb`#C[
cwoy/9."l1?
${f{K WC
xP1]Dy
RM{Yh:d:v
d|9a2;
p_9IkME
Zo'N(kO
,Yb}=jT~_
#,WR}+
e]2&'&L
Esv`YQ'
Zv}&.g
6uHd1'c
EIu>bq
R[-E.f=X'<)e
[MFA?<Wi?
mR5u"F<
8'k:OcZRnXy~>{
5uuvR0IX
^xT"7Afs\N0
}OWfu;K('+
4mb4{}D
U{j${?
"$c9OU
vVl7_xVauHD
Utx_EG=R
EwC7<Ij'[
LNu_Z[
('QK18
FM]|ik6i5%cjA
O&M)BA[$Y
~62u{Z'se}f
=AW"d_yjYG
/I.{^b
RH/,na
d]R}"k
Gj'N%~
uNbS#\
()jdn%p
|'v._G?
p7/=1;z9_
0~iaW^<
XY(-~RTrx?w
y7p'v-[Ou
)b^>ze(I),GP*gs&Am5L)
jm3D5;
e.gy<v
tk(m-"H
WK.l#R]d
F"Ij~Dpc
F :UMN
Q^DOFBI
+|1>5jO:3G24
s/GPjR~l
&o{pFG?PMzY
hSW4)Hm
dO/7e2
%,iYK 
}iB|U!O
;QgKImIi"p
i@>`9]O=
I?0>;;d$5;7dA
1'zWxl:6
zab_8"u-|
O9<WpH 
3HTMGJK
7:nJC,
>VMvVyY
AK@E{G
c#xzCw>E
+nwa0[v#NA
Q\gNybq^
V6'pHplpNk
_$fKwCols
Syx$u!*
ZMs-YQ
aN3d~yS*]rz
'V{YY#y
^0OQMv
x{]VGc
;/0)X^y
.6xUcpC5
)Ij]Ft5
1)**waE
<Wgq(71
@$q_&U.
9>oAA}
&l*7c^rzZ^H70P
|i7Krp
^~2jSr*J
n*@S5cB
}KGu#Fgg;\O
Zp:qOu':$
j5V\kSO
I8Sw|UVO=R\mG9
N4*Gw#1
][<QwQ
s7YtGwk$c"$`
~K6x$~4
AqWxwV=
TN6v4BM"@
hCCmGRV
Hl}NymtiW)
UFl'2E5^|
]5~}t^Kq
\k:yc7W
CUc&yWV%9c
1I5++VNP}1
g55'K{Ki!8I}
XsTN<.
=1KV@QE
I%n"%,
?)nB~:cb
Ko`W,9
799>d Q;
?3]Dn,
0qE+}I@
=#PVeHSP0
12SFEI\wjM
{3nE9BWWc@
bFlxW_\H<6e
RA+Zs$
yo:<o0?\sSr
Cw<pB#
=MGmt(\
[B2K~X^'Sb*w
\$y(x<)SkOaZ:Ot
EIo_[?<~u
`+N=SLdK
3`r;&dGWF
*@I_'^.W
~?*#W7C
S%}1WtF
%%Xd8Pb
jPq@|C:M
EkhuD-=
!F/S,q
oOgR3ql!
u+k<mOIw~
t`_-dg
fqF*G-k{CF
1IWu8V+?u(
;9.dd E
xfx[Q0d{w$s
SKl'|R
CK2r$MF#H
9856{e
#px=Edk
I*0qbs
vUAB_NUkSp
~\u:1D[>
"Gk4U>[+1U
NO@yi
Ws$ tt9
61_ZOk P*k
IP0?Pk
i>-}~e#
{N[,U}
Z56I2/
Ve[V3hm
U=M%YkK!,
:R}l1:o
-fsG_9A3A*
R:+JVXu[3}
`sK^m4^3
Rx5`ki
FgFGu>
&_AXCym*
k.r1wh1++?i
VR-FCO
}fB~O55
^+|pvR?
.'Pse'$4
?Znn"YcQ\(2:`(
y}Mo+E0O+=
ULO_mU
%?b2b9]
k|1*3K
7[p^A081
{E;Ql\2%;}j{HTII<X>3-o[E3Ln
YuFVX-,&
3U*FcRRB=@?geh&{
^'=82"
N5(4rCp~\Rn|
i%fn[L)9j
>o8i]C
yMtDfgR
p_f>0X
*TM_zJ[
xI6ZI
|Kw}P%
p1_A~wSl0G
-!PF)X
#~8#rtD
Tv\Np~U
6~"+KGch%?C
?h}1n|
cRB7(>J~
R)SfFD:
||.<kn
j;0UQ q
c$%~f<)$T
3* $^~
biGoTe
_WOZuQ
\X.hOC*VV5
^/tk ,5b
q;*}_`ivoum"o,@N
M>W%.L$}v
^!BG5i5
]E"%1C4
(\aI'?
quK_:+r@k
h:]i?j!u:
cVA<Z]{
Mh1Rw+wl,
[Iea{u
U0P=>7"B
]'KI C
;1UIn'H
EAeXR3
I;d5.J%
nZ#(e AFEr
;fDZ^c
Foqi3750
2#`N9^U1_\O
%UfmcT
R2~XqZ
C`q4H9=
XtPtsZL
m2;4k'=v
R$("0F
&5'U,-g
fnW.R,y3
;I%/,u
yj$bq~
i['T-5i
Qsj60kBn g
^_|}Nx-{7v
HRmfk87
Id>tn.A<
W^gisPiC5
h;/FuE
qwV6[oo
|@^Y8TPq9#p
8VFGsntEs
%-b,OF4|3
.{[C{Pu
C%wM2+o2>P
/|ZoC5Vi
fK]NfG-
SRK=VuV
yFjRj*=m9s
L]~$tq*
\v}?so
u=[F^;}
8LmOTY2
{zum(x
fm8N^}NnJ:
rrOkLomB*9
/#}~~e
 u&Sq9*
hx[>`~iOp
ox{H, [B
7M4>- @
j(.,J&
:`dKE+a[
C[!4;Rb%
 ~'Rj*i]
@A Sf`T
%i{{s#wc
Tr\#K{/t
Xf)ad;~1y
|TQI9lt(#
Oo|NJi
mm3K;9
[%buI6x
#1,A8c
]XKMo$7
 5Xm%|Y%
V9:v?5&tu
M}5P xU
ov6=/k
z3vT&w2N2[
H&\h)<;gooi
:~tzjw
DypX()E
V*|@Kbm
$1zrXL
_)7%K!
$<Wo/;]
8$gZoI
svC/No?
zqDKa_
Wn3Zs^
WZ$6Dl
(8XRi]).
b].u2@;"P
'T[XyA%Td;Tp:p:
2w]n$!
?)=xUu/
xW6HAl
zs_N*Sx'\
w*WQs}
o:sZuj2V
;H|!7uMT[-K
C1cnsp
Ckj^=AGa
px>4hEI
8;=o*J
*I+J!h:d
!H.nDv
{t2{67
]Z-/H>{(bd
/quXmlr
UUFc<bE
EJ2A?0F23=1Umh
jZ>q,8wpN
Vk4VS8
3zR1(f
^B`K3U
k/;^k)4&2CB"a_
n\E9'c
t9._MZJ'z
?$lmJm
h4F6`p6
N}1NWQ^Mm
R#x,r2
 wA]KlwqpTH
pg}oq$/$/
;<VIst
Z{|j}$
KHK0UU
>QKvLurKy<E
<mVH2R="h_
]Z-/H>{(bd
m^NC$,kE-I
GLM%y)}7k
_Em,ZHpn.`O-8t
N>nSTS^
#*ZBQHCJ
Ayd1wW
bx7[\*)oeu=A
%-lJbPf$m
WMOWe=
!6E@p1
fb3>`"k
msP!GU.
=u4n/.
{vFQpO
2=M{B,WZ
/Qn9]n
58<7\kBKo
Q-%|a}wVSze
3GWbhQ
-mkQG=i
WZMwm4yi79$v|mI8\2z};k^[yQhIn]MI@
o-]%*Zk=
|nhPppGc*ZMY;j|cU
~xoqp/q
P,5kSkY[^[
Qi&ivV
I{X\'--$Vw
'9Q9QESwV%+j|]
*|?<xVE>[
=z_<?
;]BK[hnm
Mn[x7w1oGx4rc
^)}"y_I23mW=}r8hp
.=:r396F
:n-KO4_
I?+vO<`p=Y,l
?oRNk4
YY{H[5iI
?2;2{v_
|kzcVfB(X%
CLPKyuq
[YbHC%
I"dm"8
[d~:gh
OM?yI&
~$|SZMijl
3T|).n
H;n/u>c
8uToyA }%
@&pGu=Of
y#1>Dv
2<SV|g(5H&y
gyV<{x]
> \^jP/
{w];8?m
j)Yfq`t_^i~
;|_5-1d+o
~%G{M?>
2^iy]>A
IhzF.X
[t~:gh
-l2D-%.2
N';i,y
N2xTvA+
I)wq%e`)
KazakageSearch
lstDir
GaraKazekage
TimerSebarkanDiri
O\9'C 
VB5!*
Kazekage
GaaraTheKazekage
Project1
.......................................................................................................................................................................................................................................................................
Jantung
Moonster
Pemusnah
Penyebaran
Penyerangan
Project1
SU5I%
TO\9'C 
zi^^znM&KW
lstDir
+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
GmbrGaara
TimerSebarkanDiri
GaraKazekage
KazakageSearch
DesertAttack
kernel32
GetSystemDirectoryA
SetFileAttributesA
wininet.dll
InternetGetConnectedState
kernel32.dll
GetWindowsDirectoryA
DeleteFileA
advapi32.dll
GetUserNameA
UserAktif
KillAV
VBA6.DLL
FindWindowA
FindNextFileA
+3q"=h
user32
SendMessageA
FindWindowExA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
EnableWindow
   9 `
FindFirstFileA
FindClose
CopyFileA
GetFileAttributesA
GetDriveTypeA
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  9   
 9   ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
  0 0 
   9 0 R
 &   9 
 &   9 
 0 0 \
 0 0 =
 0 0 \
 0 0 \
 0 0 =
 0 0 \
 9 0 R
 & 0 R
  9   `
  9   `
  9   `
  9   `
  9   `
9   9 
 0 0 R
0      
  9 0 R
  9 0 R
  9   
  9   
 0 0 \
0      
0      
0      
0      
0      
 0 0 \
0      
 0 0 \
 0 0 \
0   9 
  9   `
  9   `
  9   `
  9   `
t\/X5d
t\/X5d
1x/p5L
hXlhltG
>lpltCl
$`1x/l6
hXlhltG
>lpltCl
$`1x/l6
T`1x5T
0`1h50
0`1h50
0`1h50
lllh*1l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
qh<lll
Xlhqp/l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
q4<l4q<
*#$l(*#
' %lhH
lx>\#t*#llp*#h
xtlph\X6
lx>p#t*FX
lx>p#t*FX
lx>\#t*#llp*#h
xtlph\X6
lx>\#t*#llp*#h
xtlph\X6
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
l|\<,L
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
FP]/@0
F`]/P@
Fp]/`P
F]/p`
F0]/ 
@0 P@0
*#Tl*#P
TPd`\X)
qh<lht
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
ld>T#`*#\
#`*FDl2
1`>`#d
1`>`#d
d`X\T`6
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
*#\l`*#X
d\`X`T)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
ld>T#`*#\
ld>T#`*#\
pXl>#3lp
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
\<,|\lL<
\<,|\lL<
\<,l|\L,<
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4Tl>0#*#X
`\XT06
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>#*FX
l>#*FX
zZcf7'
tXl,>$#(32
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
RsPstPs
Os*Ps1+Ps~DsHDs
PsPsoCsPsxCsDs3|Os|gOs[NDs
Ds]QsibPsnDs`Ps|OsDQDs>BsSHDsIDsJDsqPsOsVOsOs`OsOsOs
MSVBVM60.DLL
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
.')Okx}[t7E[
-2($E)$N,-Opz|
}Wl7Hk
,,)cccBBBjjj
-#>'%L!&F14afkpibbfJUtuu}
AAEnnq
*(??'!F##F""G=CsPze`~b}g~h_}^_^fzBDj
+!$D'#E' C*&@HMrcy_~`
e><m%!F
$#;<:N@>GMQ^
## D'%E#$G'$A#$C4@\y_^g==n)%M&"A$!D
+#!G95W&%BU\tZ~a{5:g$$B'"C%#B
EDRuwluuXk'$D&"B "C
8=Gmut0.L'"?"$C(!A'&T03`
xwyaqMY)'C"#B&
[ajy**K&%G&#C42{
}|br0=Cn{3.S23y0 S!$Q55=
 &%$V`wz7:[$&L*%E;2s
$(+8]h{S_|3<^0,H&$Q
3*%NWSRT^]XauXUz.,n
5":)'U=7:=-3^enzw|KMWjo|jumu@>c43|
bbp5.q4-n-+^;:<;8<`]`g@=i;:
?=6*-g;<<8&&>+5?;6
 !573v31}5688>=HHatbe8:
=A5GH[41u01w9799963/Yceghqh~-,F7>
<DJ) a6574}98=:}1+ekwdgLOggc8/z 
5)$Rzvz
!?97979<24Y1.c`c44T0*Z$&Q"
,1,e+,d:7;8::+-L2.tNKmTYiHGK.1-ef_
.1X*(G$&Q+*j
((W.,f0-t:9::()M5662b77=386
OPTKNfKRq;1x8:y-,N5.v;8
=1+i-+f4296'$J@:-3_~~{[`k$"
GFJBDCTOK
#%{20SJNp96@8@G{<7=9RQ\
\`WMQW;8L)'S'(U1.m55,*a8<42`81cGWlv~$!KHQPNCz'!
/4:IHh00S@<;;@@87I>
C@g31z32k
 7,*])(Y-'U/*i<3x<:81W+)V]b<Hk/=Gglg#$%<7j)+[=:7;97::$%M
:4z32|75>:8860t%*Z-+f@:&.M,-f//\lGLlltAMW
:;3QW[5:6$%+jtq5:u+*V>7;=85-.k22q85\DCL
nls;8k23689;97<78778)+T+*R:8DFm]f8;b~
tzeyq{_o}|+3??9.,[9331}+.m95?@nZZY
0.]4/|85:899::98*,V&#N98:6v*+Y-0`u{89Vw>FWEL`::.,g/2y66
;6GBKOY
lok&%U12s./x66=655'(I)%O6465,*V54oCIi{98^rKEC?S24U<83.s787252x
'&C86:8;6-.j837:*+T'$F94780-W..rA@gv/-`_jabGDhn@>WDOk:1x<:2,o54+,d))`3+a
!E@7;6;.-r/,b@6781,l*&J5/w783.Y,/vKI|Xdy,)g9;^;/J04Q8:;:0.j78=;:895-*w/+\
$#2<;7:=:0/l))`65<:::75w<8e,)i8844c2/o4571I%,UMDYgV^SMLLlh1/[2,T3<O0*l>=;7<6@;998:8:>:?6B<w
$?C]<:97}#!Q()W.-p<7::::..u43x6531w:6z./o0/
,'K'+S75EDuwdhjj[Wl1+i('L63pB6.3{99,,l*,d75?9?A
0.<(*W64:9;;:823w./z8730t:6967554_-&S41
<?MNzyTUr.4[30y*,G0/o74/1u;7:51/u-,`
 !:0/y<<9899::11p31v871/y35<:74*(a.([+.k=:@>DJl^e~:2a53w;5..[00v7:21u76}9:<;2/w)(J
0-C,*c9944
++n;88:/0q34:80/v33x::85*)a3.n()_88:8HH77kOTr99]52b20t66><-)d91{6631y11u97=:89-1k
"#K55{32ZST\##BA556t10z<865
1/s30u78;9/,h3/q2/u1/{9798:;=:20t22q86A@A?0.s/0r34{31y41x&*]*)a95|:5+'a
&83T@AK
H:962@931x*,c1.t2.r589610p22x2/y22s54
99:<20{11r65
A>BAA?4600w/,r7112w0)gIJN &/=<W
acrD;99/1l)'j+,a20s21}3/r88961/t<;20{31r32};:<8/+t//t:7AADDA>5644t74j7446:9#&=
95M1+^'"H
0.<*'[25272/x69:64/u>7=711y20z>9=;0,x64z9?ADGCC;;8+0m
*=6y;<00yipv
2)^948522|>4%"U//o9;<887/0z98:86283|=8FA?A7;8;55>;GKN[0+C)('
+%U875687wNOf
80;:;99898=<:;9;96>AFB,-^A=;787
+(g98?<LLa
"<8:<63~$'>85}:8::==JH[X_ab_ $<;598x
:7u99rbdd
y66Pon~74s673.llly*)[@9>BOJ
aef''F
==Q:9;:_
.1TD>MGosu
$W6<8
22TJEosx
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Pa%i5N23-
Uru4<E
7*Idu9M;
w3_^[r#MV
S7(hu#j
Hu6"
sG*DS,u
[b)+Nq(8V
2z7T2=H
$U^Ynboek
Z`Ca&\.q
y_sT]"
rjxY(X
J>>FA.
@1/2H
#hS{@;X
,+KjH@sQ#'7
DuH:-Wt
?P(L&H
%uC0KX@
RIP3EZ
zl>@^
t5;*V0(E
'nPPCx2tMsa^}(K
!Z-'6;2=2 @uV
dT)}&nAH+6J^ |
I--,@h
PWQSr
msvb]f\"
]A<f8Q@2I&ZhlkoM
5kEWo*0+m)
`3Q-vP2X: 
[+HAqp
licat@on eqr
u.T>he<cd
%s5lyvn}tAba6idS8DLG5Ld,al J3*WI'c,bus32M'agBoxAwFx3tf
kx8l?ExitPL
GtMT)l
t@Ac&v
P"<SH0&zI
`t$$|$(3
r+|$(|$
|(|Y%B
USQWVRW
ZPR3C 
Z^_Y[]
MSVBVM60.DLL
MethCallEngine
rtcAnsiValueBstr
rtcLowerCaseVar
rtcGetYear
rtcRandomNext
rtcRandomize
rtcDoEvents
rtcMidCharBstr
rtcMidCharVar
rtcSpaceBstr
EVENT_SINK_AddRef
rtcUpperCaseVar
DllFunctionCall
EVENT_SINK_Release
rtcShell
EVENT_SINK_QueryInterface
__vbaExceptHandler
rtcSplit
rtcReplace
rtcVarBstrFromAnsi
rtcMakeDir
rtcCreateObject2
ProcCallEngine
rtcBstrFromAnsi
rtcDir
rtcFileLength
rtcFileCopy
rtcErrObj
ThunRTMain
rtcLeftCharBstr
rtcLeftCharVar
rtcRightCharBstr
rtcRightCharVar
rtcGetDayOfMonth
rtcGetHourOfDay
rtcGetMinuteOfHour
rtcGetMonthOfYear
rtcGetPresentDate
rtcGetSecondOfMinute
405919472783420193054701643168406344120518032762620027224230440591947278342019305470164316840634412051803276262002722423044059194727834201930547016431684063441205180327626200272242304405919472783420193054701643168406344120518032762620027224230440591947278342019305470164316840634412051803276262002722423044059194727834201930547016431684063441205180327626200272242304515919582784520194183150311708203520767206454010087443231824151591958278452019418315031170820352076720645401008744323182415159195827845201941831503117082035207672064540100874432318241515919582784520194183150311708203520767206454010087443231824151591958278452019418315031170820352076720645401008744323182415159195827845201941831503117082035207672064540100874432318241MZ
L3259193259193932591939232591939325932591939278262019222546732214253741665717180073411106451466387
Project1
O\9'C 
ziSU5I%
AO:O3f
DesertAttack
GmbrGaara
 $.' ",#
(7),01444'9=82<.342
!22222222222222222222222222222222222222222222222222
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
3PG<^dL
[#yG>'Moj
M'4#%tn[V:
XhWz=p6V
>}+||Zo
8`FqCI
sO%<<g&[`
KRg,Az
z+Zyp)m<EiRAon
';?j]{L}6
\kc<!*&3`p:nI^
NOkrhnGUzqk
Vk.Rtc
xrG wW?5
j)6hsb
$hgHH"`12p>XaF8v
iOhRI"
]dX2mvq
KAL["-
txwyt,jz
izy+R*>EA#
i+hw:[l.Fq
0xWNHd[hW
?-f}RIAvFA 
~=k&Lck7I3
@S0};YYZ
Z44ZB"V-\}
^:C,Vur
hP]nc4
~s_8s\
y,QB/\
[)B<1n
eclO?J<g
H$wX%e8}
sz.VDVV
Q:+/TH
:M-\So-aP
:i;+5xB
i,o,7q}
,;YJl-Kv
"3_\(!Fn
t)7RVG]
P2I+D:Rk
[]t=6Z%Yyr
2s[;c`h
z^+BT
3(rXylo
Yrs^wpE
\hK<3_]V>Z 
Jf]9lABCmiP6i%W
,Q$x_:D
|;V"+d
[hX2<13y
^+%xqPJ
U(S#jUKf
qE#YvBH]
~{@T`N.2q}
f3R]L}JI`H/
ZCMkY<I
p7BU2Z97mb`Z
NJ\wyybv
QE&Fq@
i|/tVhb`#C[
cwoy/9."l1?
${f{K WC
xP1]Dy
RM{Yh:d:v
d|9a2;
p_9IkME
Zo'N(kO
,Yb}=jT~_
#,WR}+
e]2&'&L
Esv`YQ'
Zv}&.g
6uHd1'c
EIu>bq
R[-E.f=X'<)e
[MFA?<Wi?
mR5u"F<
8'k:OcZRnXy~>{
5uuvR0IX
^xT"7Afs\N0
}OWfu;K('+
4mb4{}D
U{j${?
"$c9OU
vVl7_xVauHD
Utx_EG=R
EwC7<Ij'[
LNu_Z[
('QK18
FM]|ik6i5%cjA
O&M)BA[$Y
~62u{Z'se}f
=AW"d_yjYG
/I.{^b
RH/,na
d]R}"k
Gj'N%~
uNbS#\
()jdn%p
|'v._G?
p7/=1;z9_
0~iaW^<
XY(-~RTrx?w
y7p'v-[Ou
)b^>ze(I),GP*gs&Am5L)
jm3D5;
e.gy<v
tk(m-"H
WK.l#R]d
F"Ij~Dpc
F :UMN
Q^DOFBI
+|1>5jO:3G24
s/GPjR~l
&o{pFG?PMzY
hSW4)Hm
dO/7e2
%,iYK 
}iB|U!O
;QgKImIi"p
i@>`9]O=
I?0>;;d$5;7dA
1'zWxl:6
zab_8"u-|
O9<WpH 
3HTMGJK
7:nJC,
>VMvVyY
AK@E{G
c#xzCw>E
+nwa0[v#NA
Q\gNybq^
V6'pHplpNk
_$fKwCols
Syx$u!*
ZMs-YQ
aN3d~yS*]rz
'V{YY#y
^0OQMv
x{]VGc
;/0)X^y
.6xUcpC5
)Ij]Ft5
1)**waE
<Wgq(71
@$q_&U.
9>oAA}
&l*7c^rzZ^H70P
|i7Krp
^~2jSr*J
n*@S5cB
}KGu#Fgg;\O
Zp:qOu':$
j5V\kSO
I8Sw|UVO=R\mG9
N4*Gw#1
][<QwQ
s7YtGwk$c"$`
~K6x$~4
AqWxwV=
TN6v4BM"@
hCCmGRV
Hl}NymtiW)
UFl'2E5^|
]5~}t^Kq
\k:yc7W
CUc&yWV%9c
1I5++VNP}1
g55'K{Ki!8I}
XsTN<.
=1KV@QE
I%n"%,
?)nB~:cb
Ko`W,9
799>d Q;
?3]Dn,
0qE+}I@
=#PVeHSP0
12SFEI\wjM
{3nE9BWWc@
bFlxW_\H<6e
RA+Zs$
yo:<o0?\sSr
Cw<pB#
=MGmt(\
[B2K~X^'Sb*w
\$y(x<)SkOaZ:Ot
EIo_[?<~u
`+N=SLdK
3`r;&dGWF
*@I_'^.W
~?*#W7C
S%}1WtF
%%Xd8Pb
jPq@|C:M
EkhuD-=
!F/S,q
oOgR3ql!
u+k<mOIw~
t`_-dg
fqF*G-k{CF
1IWu8V+?u(
;9.dd E
xfx[Q0d{w$s
SKl'|R
CK2r$MF#H
9856{e
#px=Edk
I*0qbs
vUAB_NUkSp
~\u:1D[>
"Gk4U>[+1U
NO@yi
Ws$ tt9
61_ZOk P*k
IP0?Pk
i>-}~e#
{N[,U}
Z56I2/
Ve[V3hm
U=M%YkK!,
:R}l1:o
-fsG_9A3A*
R:+JVXu[3}
`sK^m4^3
Rx5`ki
FgFGu>
&_AXCym*
k.r1wh1++?i
VR-FCO
}fB~O55
^+|pvR?
.'Pse'$4
?Znn"YcQ\(2:`(
y}Mo+E0O+=
ULO_mU
%?b2b9]
k|1*3K
7[p^A081
{E;Ql\2%;}j{HTII<X>3-o[E3Ln
YuFVX-,&
3U*FcRRB=@?geh&{
^'=82"
N5(4rCp~\Rn|
i%fn[L)9j
>o8i]C
yMtDfgR
p_f>0X
*TM_zJ[
xI6ZI
|Kw}P%
p1_A~wSl0G
-!PF)X
#~8#rtD
Tv\Np~U
6~"+KGch%?C
?h}1n|
cRB7(>J~
R)SfFD:
||.<kn
j;0UQ q
c$%~f<)$T
3* $^~
biGoTe
_WOZuQ
\X.hOC*VV5
^/tk ,5b
q;*}_`ivoum"o,@N
M>W%.L$}v
^!BG5i5
]E"%1C4
(\aI'?
quK_:+r@k
h:]i?j!u:
cVA<Z]{
Mh1Rw+wl,
[Iea{u
U0P=>7"B
]'KI C
;1UIn'H
EAeXR3
I;d5.J%
nZ#(e AFEr
;fDZ^c
Foqi3750
2#`N9^U1_\O
%UfmcT
R2~XqZ
C`q4H9=
XtPtsZL
m2;4k'=v
R$("0F
&5'U,-g
fnW.R,y3
;I%/,u
yj$bq~
i['T-5i
Qsj60kBn g
^_|}Nx-{7v
HRmfk87
Id>tn.A<
W^gisPiC5
h;/FuE
qwV6[oo
|@^Y8TPq9#p
8VFGsntEs
%-b,OF4|3
.{[C{Pu
C%wM2+o2>P
/|ZoC5Vi
fK]NfG-
SRK=VuV
yFjRj*=m9s
L]~$tq*
\v}?so
u=[F^;}
8LmOTY2
{zum(x
fm8N^}NnJ:
rrOkLomB*9
/#}~~e
 u&Sq9*
hx[>`~iOp
ox{H, [B
7M4>- @
j(.,J&
:`dKE+a[
C[!4;Rb%
 ~'Rj*i]
@A Sf`T
%i{{s#wc
Tr\#K{/t
Xf)ad;~1y
|TQI9lt(#
Oo|NJi
mm3K;9
[%buI6x
#1,A8c
]XKMo$7
 5Xm%|Y%
V9:v?5&tu
M}5P xU
ov6=/k
z3vT&w2N2[
H&\h)<;gooi
:~tzjw
DypX()E
V*|@Kbm
$1zrXL
_)7%K!
$<Wo/;]
8$gZoI
svC/No?
zqDKa_
Wn3Zs^
WZ$6Dl
(8XRi]).
b].u2@;"P
'T[XyA%Td;Tp:p:
2w]n$!
?)=xUu/
xW6HAl
zs_N*Sx'\
w*WQs}
o:sZuj2V
;H|!7uMT[-K
C1cnsp
Ckj^=AGa
px>4hEI
8;=o*J
*I+J!h:d
!H.nDv
{t2{67
]Z-/H>{(bd
/quXmlr
UUFc<bE
EJ2A?0F23=1Umh
jZ>q,8wpN
Vk4VS8
3zR1(f
^B`K3U
k/;^k)4&2CB"a_
n\E9'c
t9._MZJ'z
?$lmJm
h4F6`p6
N}1NWQ^Mm
R#x,r2
 wA]KlwqpTH
pg}oq$/$/
;<VIst
Z{|j}$
KHK0UU
>QKvLurKy<E
<mVH2R="h_
]Z-/H>{(bd
m^NC$,kE-I
GLM%y)}7k
_Em,ZHpn.`O-8t
N>nSTS^
#*ZBQHCJ
Ayd1wW
bx7[\*)oeu=A
%-lJbPf$m
WMOWe=
!6E@p1
fb3>`"k
msP!GU.
=u4n/.
{vFQpO
2=M{B,WZ
/Qn9]n
58<7\kBKo
Q-%|a}wVSze
3GWbhQ
-mkQG=i
WZMwm4yi79$v|mI8\2z};k^[yQhIn]MI@
o-]%*Zk=
|nhPppGc*ZMY;j|cU
~xoqp/q
P,5kSkY[^[
Qi&ivV
I{X\'--$Vw
'9Q9QESwV%+j|]
*|?<xVE>[
=z_<?
;]BK[hnm
Mn[x7w1oGx4rc
^)}"y_I23mW=}r8hp
.=:r396F
:n-KO4_
I?+vO<`p=Y,l
?oRNk4
YY{H[5iI
?2;2{v_
|kzcVfB(X%
CLPKyuq
[YbHC%
I"dm"8
[d~:gh
OM?yI&
~$|SZMijl
3T|).n
H;n/u>c
8uToyA }%
@&pGu=Of
y#1>Dv
2<SV|g(5H&y
gyV<{x]
> \^jP/
{w];8?m
j)Yfq`t_^i~
;|_5-1d+o
~%G{M?>
2^iy]>A
IhzF.X
[t~:gh
-l2D-%.2
N';i,y
N2xTvA+
I)wq%e`)
KazakageSearch
lstDir
GaraKazekage
TimerSebarkanDiri
O\9'C 
VB5!*
Kazekage
GaaraTheKazekage
Project1
.......................................................................................................................................................................................................................................................................
Jantung
Moonster
Pemusnah
Penyebaran
Penyerangan
Project1
SU5I%
TO\9'C 
zi^^znM&KW
lstDir
+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
GmbrGaara
TimerSebarkanDiri
GaraKazekage
KazakageSearch
DesertAttack
kernel32
GetSystemDirectoryA
SetFileAttributesA
wininet.dll
InternetGetConnectedState
kernel32.dll
GetWindowsDirectoryA
DeleteFileA
advapi32.dll
GetUserNameA
UserAktif
KillAV
VBA6.DLL
FindWindowA
FindNextFileA
+3q"=h
user32
SendMessageA
FindWindowExA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
EnableWindow
   9 `
FindFirstFileA
FindClose
CopyFileA
GetFileAttributesA
GetDriveTypeA
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  9   
 9   ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
  0 0 
   9 0 R
 &   9 
 &   9 
 0 0 \
 0 0 =
 0 0 \
 0 0 \
 0 0 =
 0 0 \
 9 0 R
 & 0 R
  9   `
  9   `
  9   `
  9   `
  9   `
9   9 
 0 0 R
0      
  9 0 R
  9 0 R
  9   
  9   
 0 0 \
0      
0      
0      
0      
0      
 0 0 \
0      
 0 0 \
 0 0 \
0   9 
  9   `
  9   `
  9   `
  9   `
t\/X5d
t\/X5d
1x/p5L
hXlhltG
>lpltCl
$`1x/l6
hXlhltG
>lpltCl
$`1x/l6
T`1x5T
0`1h50
0`1h50
0`1h50
lllh*1l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
qh<lll
Xlhqp/l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
q4<l4q<
*#$l(*#
' %lhH
lx>\#t*#llp*#h
xtlph\X6
lx>p#t*FX
lx>p#t*FX
lx>\#t*#llp*#h
xtlph\X6
lx>\#t*#llp*#h
xtlph\X6
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
l|\<,L
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
FP]/@0
F`]/P@
Fp]/`P
F]/p`
F0]/ 
@0 P@0
*#Tl*#P
TPd`\X)
qh<lht
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
ld>T#`*#\
#`*FDl2
1`>`#d
1`>`#d
d`X\T`6
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
*#\l`*#X
d\`X`T)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
ld>T#`*#\
ld>T#`*#\
pXl>#3lp
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
\<,|\lL<
\<,|\lL<
\<,l|\L,<
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4Tl>0#*#X
`\XT06
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>#*FX
l>#*FX
zZcf7'
tXl,>$#(32
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
RsPstPs
Os*Ps1+Ps~DsHDs
PsPsoCsPsxCsDs3|Os|gOs[NDs
Ds]QsibPsnDs`Ps|OsDQDs>BsSHDsIDsJDsqPsOsVOsOs`OsOsOs
MSVBVM60.DLL
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
.')Okx}[t7E[
-2($E)$N,-Opz|
}Wl7Hk
,,)cccBBBjjj
-#>'%L!&F14afkpibbfJUtuu}
AAEnnq
*(??'!F##F""G=CsPze`~b}g~h_}^_^fzBDj
+!$D'#E' C*&@HMrcy_~`
e><m%!F
$#;<:N@>GMQ^
## D'%E#$G'$A#$C4@\y_^g==n)%M&"A$!D
+#!G95W&%BU\tZ~a{5:g$$B'"C%#B
EDRuwluuXk'$D&"B "C
8=Gmut0.L'"?"$C(!A'&T03`
xwyaqMY)'C"#B&
[ajy**K&%G&#C42{
}|br0=Cn{3.S23y0 S!$Q55=
 &%$V`wz7:[$&L*%E;2s
$(+8]h{S_|3<^0,H&$Q
3*%NWSRT^]XauXUz.,n
5":)'U=7:=-3^enzw|KMWjo|jumu@>c43|
bbp5.q4-n-+^;:<;8<`]`g@=i;:
?=6*-g;<<8&&>+5?;6
 !573v31}5688>=HHatbe8:
=A5GH[41u01w9799963/Yceghqh~-,F7>
<DJ) a6574}98=:}1+ekwdgLOggc8/z 
5)$Rzvz
!?97979<24Y1.c`c44T0*Z$&Q"
,1,e+,d:7;8::+-L2.tNKmTYiHGK.1-ef_
.1X*(G$&Q+*j
((W.,f0-t:9::()M5662b77=386
OPTKNfKRq;1x8:y-,N5.v;8
=1+i-+f4296'$J@:-3_~~{[`k$"
GFJBDCTOK
#%{20SJNp96@8@G{<7=9RQ\
\`WMQW;8L)'S'(U1.m55,*a8<42`81cGWlv~$!KHQPNCz'!
/4:IHh00S@<;;@@87I>
C@g31z32k
 7,*])(Y-'U/*i<3x<:81W+)V]b<Hk/=Gglg#$%<7j)+[=:7;97::$%M
:4z32|75>:8860t%*Z-+f@:&.M,-f//\lGLlltAMW
:;3QW[5:6$%+jtq5:u+*V>7;=85-.k22q85\DCL
nls;8k23689;97<78778)+T+*R:8DFm]f8;b~
tzeyq{_o}|+3??9.,[9331}+.m95?@nZZY
0.]4/|85:899::98*,V&#N98:6v*+Y-0`u{89Vw>FWEL`::.,g/2y66
;6GBKOY
lok&%U12s./x66=655'(I)%O6465,*V54oCIi{98^rKEC?S24U<83.s787252x
'&C86:8;6-.j837:*+T'$F94780-W..rA@gv/-`_jabGDhn@>WDOk:1x<:2,o54+,d))`3+a
!E@7;6;.-r/,b@6781,l*&J5/w783.Y,/vKI|Xdy,)g9;^;/J04Q8:;:0.j78=;:895-*w/+\
$#2<;7:=:0/l))`65<:::75w<8e,)i8844c2/o4571I%,UMDYgV^SMLLlh1/[2,T3<O0*l>=;7<6@;998:8:>:?6B<w
$?C]<:97}#!Q()W.-p<7::::..u43x6531w:6z./o0/
,'K'+S75EDuwdhjj[Wl1+i('L63pB6.3{99,,l*,d75?9?A
0.<(*W64:9;;:823w./z8730t:6967554_-&S41
<?MNzyTUr.4[30y*,G0/o74/1u;7:51/u-,`
 !:0/y<<9899::11p31v871/y35<:74*(a.([+.k=:@>DJl^e~:2a53w;5..[00v7:21u76}9:<;2/w)(J
0-C,*c9944
++n;88:/0q34:80/v33x::85*)a3.n()_88:8HH77kOTr99]52b20t66><-)d91{6631y11u97=:89-1k
"#K55{32ZST\##BA556t10z<865
1/s30u78;9/,h3/q2/u1/{9798:;=:20t22q86A@A?0.s/0r34{31y41x&*]*)a95|:5+'a
&83T@AK
H:962@931x*,c1.t2.r589610p22x2/y22s54
99:<20{11r65
A>BAA?4600w/,r7112w0)gIJN &/=<W
acrD;99/1l)'j+,a20s21}3/r88961/t<;20{31r32};:<8/+t//t:7AADDA>5644t74j7446:9#&=
95M1+^'"H
0.<*'[25272/x69:64/u>7=711y20z>9=;0,x64z9?ADGCC;;8+0m
*=6y;<00yipv
2)^948522|>4%"U//o9;<887/0z98:86283|=8FA?A7;8;55>;GKN[0+C)('
+%U875687wNOf
80;:;99898=<:;9;96>AFB,-^A=;787
+(g98?<LLa
"<8:<63~$'>85}:8::==JH[X_ab_ $<;598x
:7u99rbdd
y66Pon~74s673.llly*)[@9>BOJ
aef''F
==Q:9;:_
.1TD>MGosu
$W6<8
22TJEosx
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Pa%i5N23-
Uru4<E
7*Idu9M;
w3_^[r#MV
S7(hu#j
Hu6"
sG*DS,u
[b)+Nq(8V
2z7T2=H
$U^Ynboek
Z`Ca&\.q
y_sT]"
rjxY(X
J>>FA.
@1/2H
#hS{@;X
,+KjH@sQ#'7
DuH:-Wt
?P(L&H
%uC0KX@
RIP3EZ
zl>@^
t5;*V0(E
'nPPCx2tMsa^}(K
!Z-'6;2=2 @uV
dT)}&nAH+6J^ |
I--,@h
PWQSr
msvb]f\"
]A<f8Q@2I&ZhlkoM
5kEWo*0+m)
`3Q-vP2X: 
[+HAqp
licat@on eqr
u.T>he<cd
%s5lyvn}tAba6idS8DLG5Ld,al J3*WI'c,bus32M'agBoxAwFx3tf
kx8l?ExitPL
GtMT)l
t@Ac&v
P"<SH0&zI
`t$$|$(3
r+|$(|$
|(|Y%B
USQWVRW
ZPR3C 
Z^_Y[]
MSVBVM60.DLL
MethCallEngine
rtcAnsiValueBstr
rtcLowerCaseVar
rtcGetYear
rtcRandomNext
rtcRandomize
rtcDoEvents
rtcMidCharBstr
rtcMidCharVar
rtcSpaceBstr
EVENT_SINK_AddRef
rtcUpperCaseVar
DllFunctionCall
EVENT_SINK_Release
rtcShell
EVENT_SINK_QueryInterface
__vbaExceptHandler
rtcSplit
rtcReplace
rtcVarBstrFromAnsi
rtcMakeDir
rtcCreateObject2
ProcCallEngine
rtcBstrFromAnsi
rtcDir
rtcFileLength
rtcFileCopy
rtcErrObj
ThunRTMain
rtcLeftCharBstr
rtcLeftCharVar
rtcRightCharBstr
rtcRightCharVar
rtcGetDayOfMonth
rtcGetHourOfDay
rtcGetMinuteOfHour
rtcGetMonthOfYear
rtcGetPresentDate
rtcGetSecondOfMinute
660191327802019-4268217343517285276706265267460812774615535660191327802019-4268217343517285276706265267460812774615535660191327802019-4268217343517285276706265267460812774615535660191327802019-4268217343517285276706265267460812774615535660191327802019-4268217343517285276706265267460812774615535660191327802019-4268217343517285276706265267460812774615535MZ
L3259193259193932591939232591939325932591939278262019222546732214253741665717180073411106451466387
Project1
O\9'C 
ziSU5I%
AO:O3f
DesertAttack
GmbrGaara
 $.' ",#
(7),01444'9=82<.342
!22222222222222222222222222222222222222222222222222
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
3PG<^dL
[#yG>'Moj
M'4#%tn[V:
XhWz=p6V
>}+||Zo
8`FqCI
sO%<<g&[`
KRg,Az
z+Zyp)m<EiRAon
';?j]{L}6
\kc<!*&3`p:nI^
NOkrhnGUzqk
Vk.Rtc
xrG wW?5
j)6hsb
$hgHH"`12p>XaF8v
iOhRI"
]dX2mvq
KAL["-
txwyt,jz
izy+R*>EA#
i+hw:[l.Fq
0xWNHd[hW
?-f}RIAvFA 
~=k&Lck7I3
@S0};YYZ
Z44ZB"V-\}
^:C,Vur
hP]nc4
~s_8s\
y,QB/\
[)B<1n
eclO?J<g
H$wX%e8}
sz.VDVV
Q:+/TH
:M-\So-aP
:i;+5xB
i,o,7q}
,;YJl-Kv
"3_\(!Fn
t)7RVG]
P2I+D:Rk
[]t=6Z%Yyr
2s[;c`h
z^+BT
3(rXylo
Yrs^wpE
\hK<3_]V>Z 
Jf]9lABCmiP6i%W
,Q$x_:D
|;V"+d
[hX2<13y
^+%xqPJ
U(S#jUKf
qE#YvBH]
~{@T`N.2q}
f3R]L}JI`H/
ZCMkY<I
p7BU2Z97mb`Z
NJ\wyybv
QE&Fq@
i|/tVhb`#C[
cwoy/9."l1?
${f{K WC
xP1]Dy
RM{Yh:d:v
d|9a2;
p_9IkME
Zo'N(kO
,Yb}=jT~_
#,WR}+
e]2&'&L
Esv`YQ'
Zv}&.g
6uHd1'c
EIu>bq
R[-E.f=X'<)e
[MFA?<Wi?
mR5u"F<
8'k:OcZRnXy~>{
5uuvR0IX
^xT"7Afs\N0
}OWfu;K('+
4mb4{}D
U{j${?
"$c9OU
vVl7_xVauHD
Utx_EG=R
EwC7<Ij'[
LNu_Z[
('QK18
FM]|ik6i5%cjA
O&M)BA[$Y
~62u{Z'se}f
=AW"d_yjYG
/I.{^b
RH/,na
d]R}"k
Gj'N%~
uNbS#\
()jdn%p
|'v._G?
p7/=1;z9_
0~iaW^<
XY(-~RTrx?w
y7p'v-[Ou
)b^>ze(I),GP*gs&Am5L)
jm3D5;
e.gy<v
tk(m-"H
WK.l#R]d
F"Ij~Dpc
F :UMN
Q^DOFBI
+|1>5jO:3G24
s/GPjR~l
&o{pFG?PMzY
hSW4)Hm
dO/7e2
%,iYK 
}iB|U!O
;QgKImIi"p
i@>`9]O=
I?0>;;d$5;7dA
1'zWxl:6
zab_8"u-|
O9<WpH 
3HTMGJK
7:nJC,
>VMvVyY
AK@E{G
c#xzCw>E
+nwa0[v#NA
Q\gNybq^
V6'pHplpNk
_$fKwCols
Syx$u!*
ZMs-YQ
aN3d~yS*]rz
'V{YY#y
^0OQMv
x{]VGc
;/0)X^y
.6xUcpC5
)Ij]Ft5
1)**waE
<Wgq(71
@$q_&U.
9>oAA}
&l*7c^rzZ^H70P
|i7Krp
^~2jSr*J
n*@S5cB
}KGu#Fgg;\O
Zp:qOu':$
j5V\kSO
I8Sw|UVO=R\mG9
N4*Gw#1
][<QwQ
s7YtGwk$c"$`
~K6x$~4
AqWxwV=
TN6v4BM"@
hCCmGRV
Hl}NymtiW)
UFl'2E5^|
]5~}t^Kq
\k:yc7W
CUc&yWV%9c
1I5++VNP}1
g55'K{Ki!8I}
XsTN<.
=1KV@QE
I%n"%,
?)nB~:cb
Ko`W,9
799>d Q;
?3]Dn,
0qE+}I@
=#PVeHSP0
12SFEI\wjM
{3nE9BWWc@
bFlxW_\H<6e
RA+Zs$
yo:<o0?\sSr
Cw<pB#
=MGmt(\
[B2K~X^'Sb*w
\$y(x<)SkOaZ:Ot
EIo_[?<~u
`+N=SLdK
3`r;&dGWF
*@I_'^.W
~?*#W7C
S%}1WtF
%%Xd8Pb
jPq@|C:M
EkhuD-=
!F/S,q
oOgR3ql!
u+k<mOIw~
t`_-dg
fqF*G-k{CF
1IWu8V+?u(
;9.dd E
xfx[Q0d{w$s
SKl'|R
CK2r$MF#H
9856{e
#px=Edk
I*0qbs
vUAB_NUkSp
~\u:1D[>
"Gk4U>[+1U
NO@yi
Ws$ tt9
61_ZOk P*k
IP0?Pk
i>-}~e#
{N[,U}
Z56I2/
Ve[V3hm
U=M%YkK!,
:R}l1:o
-fsG_9A3A*
R:+JVXu[3}
`sK^m4^3
Rx5`ki
FgFGu>
&_AXCym*
k.r1wh1++?i
VR-FCO
}fB~O55
^+|pvR?
.'Pse'$4
?Znn"YcQ\(2:`(
y}Mo+E0O+=
ULO_mU
%?b2b9]
k|1*3K
7[p^A081
{E;Ql\2%;}j{HTII<X>3-o[E3Ln
YuFVX-,&
3U*FcRRB=@?geh&{
^'=82"
N5(4rCp~\Rn|
i%fn[L)9j
>o8i]C
yMtDfgR
p_f>0X
*TM_zJ[
xI6ZI
|Kw}P%
p1_A~wSl0G
-!PF)X
#~8#rtD
Tv\Np~U
6~"+KGch%?C
?h}1n|
cRB7(>J~
R)SfFD:
||.<kn
j;0UQ q
c$%~f<)$T
3* $^~
biGoTe
_WOZuQ
\X.hOC*VV5
^/tk ,5b
q;*}_`ivoum"o,@N
M>W%.L$}v
^!BG5i5
]E"%1C4
(\aI'?
quK_:+r@k
h:]i?j!u:
cVA<Z]{
Mh1Rw+wl,
[Iea{u
U0P=>7"B
]'KI C
;1UIn'H
EAeXR3
I;d5.J%
nZ#(e AFEr
;fDZ^c
Foqi3750
2#`N9^U1_\O
%UfmcT
R2~XqZ
C`q4H9=
XtPtsZL
m2;4k'=v
R$("0F
&5'U,-g
fnW.R,y3
;I%/,u
yj$bq~
i['T-5i
Qsj60kBn g
^_|}Nx-{7v
HRmfk87
Id>tn.A<
W^gisPiC5
h;/FuE
qwV6[oo
|@^Y8TPq9#p
8VFGsntEs
%-b,OF4|3
.{[C{Pu
C%wM2+o2>P
/|ZoC5Vi
fK]NfG-
SRK=VuV
yFjRj*=m9s
L]~$tq*
\v}?so
u=[F^;}
8LmOTY2
{zum(x
fm8N^}NnJ:
rrOkLomB*9
/#}~~e
 u&Sq9*
hx[>`~iOp
ox{H, [B
7M4>- @
j(.,J&
:`dKE+a[
C[!4;Rb%
 ~'Rj*i]
@A Sf`T
%i{{s#wc
Tr\#K{/t
Xf)ad;~1y
|TQI9lt(#
Oo|NJi
mm3K;9
[%buI6x
#1,A8c
]XKMo$7
 5Xm%|Y%
V9:v?5&tu
M}5P xU
ov6=/k
z3vT&w2N2[
H&\h)<;gooi
:~tzjw
DypX()E
V*|@Kbm
$1zrXL
_)7%K!
$<Wo/;]
8$gZoI
svC/No?
zqDKa_
Wn3Zs^
WZ$6Dl
(8XRi]).
b].u2@;"P
'T[XyA%Td;Tp:p:
2w]n$!
?)=xUu/
xW6HAl
zs_N*Sx'\
w*WQs}
o:sZuj2V
;H|!7uMT[-K
C1cnsp
Ckj^=AGa
px>4hEI
8;=o*J
*I+J!h:d
!H.nDv
{t2{67
]Z-/H>{(bd
/quXmlr
UUFc<bE
EJ2A?0F23=1Umh
jZ>q,8wpN
Vk4VS8
3zR1(f
^B`K3U
k/;^k)4&2CB"a_
n\E9'c
t9._MZJ'z
?$lmJm
h4F6`p6
N}1NWQ^Mm
R#x,r2
 wA]KlwqpTH
pg}oq$/$/
;<VIst
Z{|j}$
KHK0UU
>QKvLurKy<E
<mVH2R="h_
]Z-/H>{(bd
m^NC$,kE-I
GLM%y)}7k
_Em,ZHpn.`O-8t
N>nSTS^
#*ZBQHCJ
Ayd1wW
bx7[\*)oeu=A
%-lJbPf$m
WMOWe=
!6E@p1
fb3>`"k
msP!GU.
=u4n/.
{vFQpO
2=M{B,WZ
/Qn9]n
58<7\kBKo
Q-%|a}wVSze
3GWbhQ
-mkQG=i
WZMwm4yi79$v|mI8\2z};k^[yQhIn]MI@
o-]%*Zk=
|nhPppGc*ZMY;j|cU
~xoqp/q
P,5kSkY[^[
Qi&ivV
I{X\'--$Vw
'9Q9QESwV%+j|]
*|?<xVE>[
=z_<?
;]BK[hnm
Mn[x7w1oGx4rc
^)}"y_I23mW=}r8hp
.=:r396F
:n-KO4_
I?+vO<`p=Y,l
?oRNk4
YY{H[5iI
?2;2{v_
|kzcVfB(X%
CLPKyuq
[YbHC%
I"dm"8
[d~:gh
OM?yI&
~$|SZMijl
3T|).n
H;n/u>c
8uToyA }%
@&pGu=Of
y#1>Dv
2<SV|g(5H&y
gyV<{x]
> \^jP/
{w];8?m
j)Yfq`t_^i~
;|_5-1d+o
~%G{M?>
2^iy]>A
IhzF.X
[t~:gh
-l2D-%.2
N';i,y
N2xTvA+
I)wq%e`)
KazakageSearch
lstDir
GaraKazekage
TimerSebarkanDiri
O\9'C 
VB5!*
Kazekage
GaaraTheKazekage
Project1
.......................................................................................................................................................................................................................................................................
Jantung
Moonster
Pemusnah
Penyebaran
Penyerangan
Project1
SU5I%
TO\9'C 
zi^^znM&KW
lstDir
+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
GmbrGaara
TimerSebarkanDiri
GaraKazekage
KazakageSearch
DesertAttack
kernel32
GetSystemDirectoryA
SetFileAttributesA
wininet.dll
InternetGetConnectedState
kernel32.dll
GetWindowsDirectoryA
DeleteFileA
advapi32.dll
GetUserNameA
UserAktif
KillAV
VBA6.DLL
FindWindowA
FindNextFileA
+3q"=h
user32
SendMessageA
FindWindowExA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
EnableWindow
   9 `
FindFirstFileA
FindClose
CopyFileA
GetFileAttributesA
GetDriveTypeA
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  9   
 9   ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
  0 0 
   9 0 R
 &   9 
 &   9 
 0 0 \
 0 0 =
 0 0 \
 0 0 \
 0 0 =
 0 0 \
 9 0 R
 & 0 R
  9   `
  9   `
  9   `
  9   `
  9   `
9   9 
 0 0 R
0      
  9 0 R
  9 0 R
  9   
  9   
 0 0 \
0      
0      
0      
0      
0      
 0 0 \
0      
 0 0 \
 0 0 \
0   9 
  9   `
  9   `
  9   `
  9   `
t\/X5d
t\/X5d
1x/p5L
hXlhltG
>lpltCl
$`1x/l6
hXlhltG
>lpltCl
$`1x/l6
T`1x5T
0`1h50
0`1h50
0`1h50
lllh*1l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
qh<lll
Xlhqp/l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
q4<l4q<
*#$l(*#
' %lhH
lx>\#t*#llp*#h
xtlph\X6
lx>p#t*FX
lx>p#t*FX
lx>\#t*#llp*#h
xtlph\X6
lx>\#t*#llp*#h
xtlph\X6
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
l|\<,L
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
FP]/@0
F`]/P@
Fp]/`P
F]/p`
F0]/ 
@0 P@0
*#Tl*#P
TPd`\X)
qh<lht
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
ld>T#`*#\
#`*FDl2
1`>`#d
1`>`#d
d`X\T`6
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
*#\l`*#X
d\`X`T)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
ld>T#`*#\
ld>T#`*#\
pXl>#3lp
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
\<,|\lL<
\<,|\lL<
\<,l|\L,<
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4Tl>0#*#X
`\XT06
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>#*FX
l>#*FX
zZcf7'
tXl,>$#(32
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
RsPstPs
Os*Ps1+Ps~DsHDs
PsPsoCsPsxCsDs3|Os|gOs[NDs
Ds]QsibPsnDs`Ps|OsDQDs>BsSHDsIDsJDsqPsOsVOsOs`OsOsOs
MSVBVM60.DLL
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
.')Okx}[t7E[
-2($E)$N,-Opz|
}Wl7Hk
,,)cccBBBjjj
-#>'%L!&F14afkpibbfJUtuu}
AAEnnq
*(??'!F##F""G=CsPze`~b}g~h_}^_^fzBDj
+!$D'#E' C*&@HMrcy_~`
e><m%!F
$#;<:N@>GMQ^
## D'%E#$G'$A#$C4@\y_^g==n)%M&"A$!D
+#!G95W&%BU\tZ~a{5:g$$B'"C%#B
EDRuwluuXk'$D&"B "C
8=Gmut0.L'"?"$C(!A'&T03`
xwyaqMY)'C"#B&
[ajy**K&%G&#C42{
}|br0=Cn{3.S23y0 S!$Q55=
 &%$V`wz7:[$&L*%E;2s
$(+8]h{S_|3<^0,H&$Q
3*%NWSRT^]XauXUz.,n
5":)'U=7:=-3^enzw|KMWjo|jumu@>c43|
bbp5.q4-n-+^;:<;8<`]`g@=i;:
?=6*-g;<<8&&>+5?;6
 !573v31}5688>=HHatbe8:
=A5GH[41u01w9799963/Yceghqh~-,F7>
<DJ) a6574}98=:}1+ekwdgLOggc8/z 
5)$Rzvz
!?97979<24Y1.c`c44T0*Z$&Q"
,1,e+,d:7;8::+-L2.tNKmTYiHGK.1-ef_
.1X*(G$&Q+*j
((W.,f0-t:9::()M5662b77=386
OPTKNfKRq;1x8:y-,N5.v;8
=1+i-+f4296'$J@:-3_~~{[`k$"
GFJBDCTOK
#%{20SJNp96@8@G{<7=9RQ\
\`WMQW;8L)'S'(U1.m55,*a8<42`81cGWlv~$!KHQPNCz'!
/4:IHh00S@<;;@@87I>
C@g31z32k
 7,*])(Y-'U/*i<3x<:81W+)V]b<Hk/=Gglg#$%<7j)+[=:7;97::$%M
:4z32|75>:8860t%*Z-+f@:&.M,-f//\lGLlltAMW
:;3QW[5:6$%+jtq5:u+*V>7;=85-.k22q85\DCL
nls;8k23689;97<78778)+T+*R:8DFm]f8;b~
tzeyq{_o}|+3??9.,[9331}+.m95?@nZZY
0.]4/|85:899::98*,V&#N98:6v*+Y-0`u{89Vw>FWEL`::.,g/2y66
;6GBKOY
lok&%U12s./x66=655'(I)%O6465,*V54oCIi{98^rKEC?S24U<83.s787252x
'&C86:8;6-.j837:*+T'$F94780-W..rA@gv/-`_jabGDhn@>WDOk:1x<:2,o54+,d))`3+a
!E@7;6;.-r/,b@6781,l*&J5/w783.Y,/vKI|Xdy,)g9;^;/J04Q8:;:0.j78=;:895-*w/+\
$#2<;7:=:0/l))`65<:::75w<8e,)i8844c2/o4571I%,UMDYgV^SMLLlh1/[2,T3<O0*l>=;7<6@;998:8:>:?6B<w
$?C]<:97}#!Q()W.-p<7::::..u43x6531w:6z./o0/
,'K'+S75EDuwdhjj[Wl1+i('L63pB6.3{99,,l*,d75?9?A
0.<(*W64:9;;:823w./z8730t:6967554_-&S41
<?MNzyTUr.4[30y*,G0/o74/1u;7:51/u-,`
 !:0/y<<9899::11p31v871/y35<:74*(a.([+.k=:@>DJl^e~:2a53w;5..[00v7:21u76}9:<;2/w)(J
0-C,*c9944
++n;88:/0q34:80/v33x::85*)a3.n()_88:8HH77kOTr99]52b20t66><-)d91{6631y11u97=:89-1k
"#K55{32ZST\##BA556t10z<865
1/s30u78;9/,h3/q2/u1/{9798:;=:20t22q86A@A?0.s/0r34{31y41x&*]*)a95|:5+'a
&83T@AK
H:962@931x*,c1.t2.r589610p22x2/y22s54
99:<20{11r65
A>BAA?4600w/,r7112w0)gIJN &/=<W
acrD;99/1l)'j+,a20s21}3/r88961/t<;20{31r32};:<8/+t//t:7AADDA>5644t74j7446:9#&=
95M1+^'"H
0.<*'[25272/x69:64/u>7=711y20z>9=;0,x64z9?ADGCC;;8+0m
*=6y;<00yipv
2)^948522|>4%"U//o9;<887/0z98:86283|=8FA?A7;8;55>;GKN[0+C)('
+%U875687wNOf
80;:;99898=<:;9;96>AFB,-^A=;787
+(g98?<LLa
"<8:<63~$'>85}:8::==JH[X_ab_ $<;598x
:7u99rbdd
y66Pon~74s673.llly*)[@9>BOJ
aef''F
==Q:9;:_
.1TD>MGosu
$W6<8
22TJEosx
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Pa%i5N23-
Uru4<E
7*Idu9M;
w3_^[r#MV
S7(hu#j
Hu6"
sG*DS,u
[b)+Nq(8V
2z7T2=H
$U^Ynboek
Z`Ca&\.q
y_sT]"
rjxY(X
J>>FA.
@1/2H
#hS{@;X
,+KjH@sQ#'7
DuH:-Wt
?P(L&H
%uC0KX@
RIP3EZ
zl>@^
t5;*V0(E
'nPPCx2tMsa^}(K
!Z-'6;2=2 @uV
dT)}&nAH+6J^ |
I--,@h
PWQSr
msvb]f\"
]A<f8Q@2I&ZhlkoM
5kEWo*0+m)
`3Q-vP2X: 
[+HAqp
licat@on eqr
u.T>he<cd
%s5lyvn}tAba6idS8DLG5Ld,al J3*WI'c,bus32M'agBoxAwFx3tf
kx8l?ExitPL
GtMT)l
t@Ac&v
P"<SH0&zI
`t$$|$(3
r+|$(|$
|(|Y%B
USQWVRW
ZPR3C 
Z^_Y[]
MSVBVM60.DLL
MethCallEngine
rtcAnsiValueBstr
rtcLowerCaseVar
rtcGetYear
rtcRandomNext
rtcRandomize
rtcDoEvents
rtcMidCharBstr
rtcMidCharVar
rtcSpaceBstr
EVENT_SINK_AddRef
rtcUpperCaseVar
DllFunctionCall
EVENT_SINK_Release
rtcShell
EVENT_SINK_QueryInterface
__vbaExceptHandler
rtcSplit
rtcReplace
rtcVarBstrFromAnsi
rtcMakeDir
rtcCreateObject2
ProcCallEngine
rtcBstrFromAnsi
rtcDir
rtcFileLength
rtcFileCopy
rtcErrObj
ThunRTMain
rtcLeftCharBstr
rtcLeftCharVar
rtcRightCharBstr
rtcRightCharVar
rtcGetDayOfMonth
rtcGetHourOfDay
rtcGetMinuteOfHour
rtcGetMonthOfYear
rtcGetPresentDate
rtcGetSecondOfMinute
106019172784201906227583873538625724172076404201058058073331060191727842019062275838735386257241720764042010580580733310601917278420190622758387353862572417207640420105805807333106019172784201906227583873538625724172076404201058058073331060191727842019062275838735386257241720764042010580580733310601917278420190622758387353862572417207640420105805807333MZ
L3259193259193932591939232591939325932591939278262019222546732214253741665717180073411106451466387
Project1
O\9'C 
ziSU5I%
AO:O3f
DesertAttack
GmbrGaara
 $.' ",#
(7),01444'9=82<.342
!22222222222222222222222222222222222222222222222222
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
3PG<^dL
[#yG>'Moj
M'4#%tn[V:
XhWz=p6V
>}+||Zo
8`FqCI
sO%<<g&[`
KRg,Az
z+Zyp)m<EiRAon
';?j]{L}6
\kc<!*&3`p:nI^
NOkrhnGUzqk
Vk.Rtc
xrG wW?5
j)6hsb
$hgHH"`12p>XaF8v
iOhRI"
]dX2mvq
KAL["-
txwyt,jz
izy+R*>EA#
i+hw:[l.Fq
0xWNHd[hW
?-f}RIAvFA 
~=k&Lck7I3
@S0};YYZ
Z44ZB"V-\}
^:C,Vur
hP]nc4
~s_8s\
y,QB/\
[)B<1n
eclO?J<g
H$wX%e8}
sz.VDVV
Q:+/TH
:M-\So-aP
:i;+5xB
i,o,7q}
,;YJl-Kv
"3_\(!Fn
t)7RVG]
P2I+D:Rk
[]t=6Z%Yyr
2s[;c`h
z^+BT
3(rXylo
Yrs^wpE
\hK<3_]V>Z 
Jf]9lABCmiP6i%W
,Q$x_:D
|;V"+d
[hX2<13y
^+%xqPJ
U(S#jUKf
qE#YvBH]
~{@T`N.2q}
f3R]L}JI`H/
ZCMkY<I
p7BU2Z97mb`Z
NJ\wyybv
QE&Fq@
i|/tVhb`#C[
cwoy/9."l1?
${f{K WC
xP1]Dy
RM{Yh:d:v
d|9a2;
p_9IkME
Zo'N(kO
,Yb}=jT~_
#,WR}+
e]2&'&L
Esv`YQ'
Zv}&.g
6uHd1'c
EIu>bq
R[-E.f=X'<)e
[MFA?<Wi?
mR5u"F<
8'k:OcZRnXy~>{
5uuvR0IX
^xT"7Afs\N0
}OWfu;K('+
4mb4{}D
U{j${?
"$c9OU
vVl7_xVauHD
Utx_EG=R
EwC7<Ij'[
LNu_Z[
('QK18
FM]|ik6i5%cjA
O&M)BA[$Y
~62u{Z'se}f
=AW"d_yjYG
/I.{^b
RH/,na
d]R}"k
Gj'N%~
uNbS#\
()jdn%p
|'v._G?
p7/=1;z9_
0~iaW^<
XY(-~RTrx?w
y7p'v-[Ou
)b^>ze(I),GP*gs&Am5L)
jm3D5;
e.gy<v
tk(m-"H
WK.l#R]d
F"Ij~Dpc
F :UMN
Q^DOFBI
+|1>5jO:3G24
s/GPjR~l
&o{pFG?PMzY
hSW4)Hm
dO/7e2
%,iYK 
}iB|U!O
;QgKImIi"p
i@>`9]O=
I?0>;;d$5;7dA
1'zWxl:6
zab_8"u-|
O9<WpH 
3HTMGJK
7:nJC,
>VMvVyY
AK@E{G
c#xzCw>E
+nwa0[v#NA
Q\gNybq^
V6'pHplpNk
_$fKwCols
Syx$u!*
ZMs-YQ
aN3d~yS*]rz
'V{YY#y
^0OQMv
x{]VGc
;/0)X^y
.6xUcpC5
)Ij]Ft5
1)**waE
<Wgq(71
@$q_&U.
9>oAA}
&l*7c^rzZ^H70P
|i7Krp
^~2jSr*J
n*@S5cB
}KGu#Fgg;\O
Zp:qOu':$
j5V\kSO
I8Sw|UVO=R\mG9
N4*Gw#1
][<QwQ
s7YtGwk$c"$`
~K6x$~4
AqWxwV=
TN6v4BM"@
hCCmGRV
Hl}NymtiW)
UFl'2E5^|
]5~}t^Kq
\k:yc7W
CUc&yWV%9c
1I5++VNP}1
g55'K{Ki!8I}
XsTN<.
=1KV@QE
I%n"%,
?)nB~:cb
Ko`W,9
799>d Q;
?3]Dn,
0qE+}I@
=#PVeHSP0
12SFEI\wjM
{3nE9BWWc@
bFlxW_\H<6e
RA+Zs$
yo:<o0?\sSr
Cw<pB#
=MGmt(\
[B2K~X^'Sb*w
\$y(x<)SkOaZ:Ot
EIo_[?<~u
`+N=SLdK
3`r;&dGWF
*@I_'^.W
~?*#W7C
S%}1WtF
%%Xd8Pb
jPq@|C:M
EkhuD-=
!F/S,q
oOgR3ql!
u+k<mOIw~
t`_-dg
fqF*G-k{CF
1IWu8V+?u(
;9.dd E
xfx[Q0d{w$s
SKl'|R
CK2r$MF#H
9856{e
#px=Edk
I*0qbs
vUAB_NUkSp
~\u:1D[>
"Gk4U>[+1U
NO@yi
Ws$ tt9
61_ZOk P*k
IP0?Pk
i>-}~e#
{N[,U}
Z56I2/
Ve[V3hm
U=M%YkK!,
:R}l1:o
-fsG_9A3A*
R:+JVXu[3}
`sK^m4^3
Rx5`ki
FgFGu>
&_AXCym*
k.r1wh1++?i
VR-FCO
}fB~O55
^+|pvR?
.'Pse'$4
?Znn"YcQ\(2:`(
y}Mo+E0O+=
ULO_mU
%?b2b9]
k|1*3K
7[p^A081
{E;Ql\2%;}j{HTII<X>3-o[E3Ln
YuFVX-,&
3U*FcRRB=@?geh&{
^'=82"
N5(4rCp~\Rn|
i%fn[L)9j
>o8i]C
yMtDfgR
p_f>0X
*TM_zJ[
xI6ZI
|Kw}P%
p1_A~wSl0G
-!PF)X
#~8#rtD
Tv\Np~U
6~"+KGch%?C
?h}1n|
cRB7(>J~
R)SfFD:
||.<kn
j;0UQ q
c$%~f<)$T
3* $^~
biGoTe
_WOZuQ
\X.hOC*VV5
^/tk ,5b
q;*}_`ivoum"o,@N
M>W%.L$}v
^!BG5i5
]E"%1C4
(\aI'?
quK_:+r@k
h:]i?j!u:
cVA<Z]{
Mh1Rw+wl,
[Iea{u
U0P=>7"B
]'KI C
;1UIn'H
EAeXR3
I;d5.J%
nZ#(e AFEr
;fDZ^c
Foqi3750
2#`N9^U1_\O
%UfmcT
R2~XqZ
C`q4H9=
XtPtsZL
m2;4k'=v
R$("0F
&5'U,-g
fnW.R,y3
;I%/,u
yj$bq~
i['T-5i
Qsj60kBn g
^_|}Nx-{7v
HRmfk87
Id>tn.A<
W^gisPiC5
h;/FuE
qwV6[oo
|@^Y8TPq9#p
8VFGsntEs
%-b,OF4|3
.{[C{Pu
C%wM2+o2>P
/|ZoC5Vi
fK]NfG-
SRK=VuV
yFjRj*=m9s
L]~$tq*
\v}?so
u=[F^;}
8LmOTY2
{zum(x
fm8N^}NnJ:
rrOkLomB*9
/#}~~e
 u&Sq9*
hx[>`~iOp
ox{H, [B
7M4>- @
j(.,J&
:`dKE+a[
C[!4;Rb%
 ~'Rj*i]
@A Sf`T
%i{{s#wc
Tr\#K{/t
Xf)ad;~1y
|TQI9lt(#
Oo|NJi
mm3K;9
[%buI6x
#1,A8c
]XKMo$7
 5Xm%|Y%
V9:v?5&tu
M}5P xU
ov6=/k
z3vT&w2N2[
H&\h)<;gooi
:~tzjw
DypX()E
V*|@Kbm
$1zrXL
_)7%K!
$<Wo/;]
8$gZoI
svC/No?
zqDKa_
Wn3Zs^
WZ$6Dl
(8XRi]).
b].u2@;"P
'T[XyA%Td;Tp:p:
2w]n$!
?)=xUu/
xW6HAl
zs_N*Sx'\
w*WQs}
o:sZuj2V
;H|!7uMT[-K
C1cnsp
Ckj^=AGa
px>4hEI
8;=o*J
*I+J!h:d
!H.nDv
{t2{67
]Z-/H>{(bd
/quXmlr
UUFc<bE
EJ2A?0F23=1Umh
jZ>q,8wpN
Vk4VS8
3zR1(f
^B`K3U
k/;^k)4&2CB"a_
n\E9'c
t9._MZJ'z
?$lmJm
h4F6`p6
N}1NWQ^Mm
R#x,r2
 wA]KlwqpTH
pg}oq$/$/
;<VIst
Z{|j}$
KHK0UU
>QKvLurKy<E
<mVH2R="h_
]Z-/H>{(bd
m^NC$,kE-I
GLM%y)}7k
_Em,ZHpn.`O-8t
N>nSTS^
#*ZBQHCJ
Ayd1wW
bx7[\*)oeu=A
%-lJbPf$m
WMOWe=
!6E@p1
fb3>`"k
msP!GU.
=u4n/.
{vFQpO
2=M{B,WZ
/Qn9]n
58<7\kBKo
Q-%|a}wVSze
3GWbhQ
-mkQG=i
WZMwm4yi79$v|mI8\2z};k^[yQhIn]MI@
o-]%*Zk=
|nhPppGc*ZMY;j|cU
~xoqp/q
P,5kSkY[^[
Qi&ivV
I{X\'--$Vw
'9Q9QESwV%+j|]
*|?<xVE>[
=z_<?
;]BK[hnm
Mn[x7w1oGx4rc
^)}"y_I23mW=}r8hp
.=:r396F
:n-KO4_
I?+vO<`p=Y,l
?oRNk4
YY{H[5iI
?2;2{v_
|kzcVfB(X%
CLPKyuq
[YbHC%
I"dm"8
[d~:gh
OM?yI&
~$|SZMijl
3T|).n
H;n/u>c
8uToyA }%
@&pGu=Of
y#1>Dv
2<SV|g(5H&y
gyV<{x]
> \^jP/
{w];8?m
j)Yfq`t_^i~
;|_5-1d+o
~%G{M?>
2^iy]>A
IhzF.X
[t~:gh
-l2D-%.2
N';i,y
N2xTvA+
I)wq%e`)
KazakageSearch
lstDir
GaraKazekage
TimerSebarkanDiri
O\9'C 
VB5!*
Kazekage
GaaraTheKazekage
Project1
.......................................................................................................................................................................................................................................................................
Jantung
Moonster
Pemusnah
Penyebaran
Penyerangan
Project1
SU5I%
TO\9'C 
zi^^znM&KW
lstDir
+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
GmbrGaara
TimerSebarkanDiri
GaraKazekage
KazakageSearch
DesertAttack
kernel32
GetSystemDirectoryA
SetFileAttributesA
wininet.dll
InternetGetConnectedState
kernel32.dll
GetWindowsDirectoryA
DeleteFileA
advapi32.dll
GetUserNameA
UserAktif
KillAV
VBA6.DLL
FindWindowA
FindNextFileA
+3q"=h
user32
SendMessageA
FindWindowExA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
EnableWindow
   9 `
FindFirstFileA
FindClose
CopyFileA
GetFileAttributesA
GetDriveTypeA
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  9   
 9   ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
  0 0 
   9 0 R
 &   9 
 &   9 
 0 0 \
 0 0 =
 0 0 \
 0 0 \
 0 0 =
 0 0 \
 9 0 R
 & 0 R
  9   `
  9   `
  9   `
  9   `
  9   `
9   9 
 0 0 R
0      
  9 0 R
  9 0 R
  9   
  9   
 0 0 \
0      
0      
0      
0      
0      
 0 0 \
0      
 0 0 \
 0 0 \
0   9 
  9   `
  9   `
  9   `
  9   `
t\/X5d
t\/X5d
1x/p5L
hXlhltG
>lpltCl
$`1x/l6
hXlhltG
>lpltCl
$`1x/l6
T`1x5T
0`1h50
0`1h50
0`1h50
lllh*1l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
qh<lll
Xlhqp/l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
q4<l4q<
*#$l(*#
' %lhH
lx>\#t*#llp*#h
xtlph\X6
lx>p#t*FX
lx>p#t*FX
lx>\#t*#llp*#h
xtlph\X6
lx>\#t*#llp*#h
xtlph\X6
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
l|\<,L
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
FP]/@0
F`]/P@
Fp]/`P
F]/p`
F0]/ 
@0 P@0
*#Tl*#P
TPd`\X)
qh<lht
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
ld>T#`*#\
#`*FDl2
1`>`#d
1`>`#d
d`X\T`6
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
*#\l`*#X
d\`X`T)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
ld>T#`*#\
ld>T#`*#\
pXl>#3lp
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
\<,|\lL<
\<,|\lL<
\<,l|\L,<
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4Tl>0#*#X
`\XT06
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>#*FX
l>#*FX
zZcf7'
tXl,>$#(32
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
RsPstPs
Os*Ps1+Ps~DsHDs
PsPsoCsPsxCsDs3|Os|gOs[NDs
Ds]QsibPsnDs`Ps|OsDQDs>BsSHDsIDsJDsqPsOsVOsOs`OsOsOs
MSVBVM60.DLL
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
.')Okx}[t7E[
-2($E)$N,-Opz|
}Wl7Hk
,,)cccBBBjjj
-#>'%L!&F14afkpibbfJUtuu}
AAEnnq
*(??'!F##F""G=CsPze`~b}g~h_}^_^fzBDj
+!$D'#E' C*&@HMrcy_~`
e><m%!F
$#;<:N@>GMQ^
## D'%E#$G'$A#$C4@\y_^g==n)%M&"A$!D
+#!G95W&%BU\tZ~a{5:g$$B'"C%#B
EDRuwluuXk'$D&"B "C
8=Gmut0.L'"?"$C(!A'&T03`
xwyaqMY)'C"#B&
[ajy**K&%G&#C42{
}|br0=Cn{3.S23y0 S!$Q55=
 &%$V`wz7:[$&L*%E;2s
$(+8]h{S_|3<^0,H&$Q
3*%NWSRT^]XauXUz.,n
5":)'U=7:=-3^enzw|KMWjo|jumu@>c43|
bbp5.q4-n-+^;:<;8<`]`g@=i;:
?=6*-g;<<8&&>+5?;6
 !573v31}5688>=HHatbe8:
=A5GH[41u01w9799963/Yceghqh~-,F7>
<DJ) a6574}98=:}1+ekwdgLOggc8/z 
5)$Rzvz
!?97979<24Y1.c`c44T0*Z$&Q"
,1,e+,d:7;8::+-L2.tNKmTYiHGK.1-ef_
.1X*(G$&Q+*j
((W.,f0-t:9::()M5662b77=386
OPTKNfKRq;1x8:y-,N5.v;8
=1+i-+f4296'$J@:-3_~~{[`k$"
GFJBDCTOK
#%{20SJNp96@8@G{<7=9RQ\
\`WMQW;8L)'S'(U1.m55,*a8<42`81cGWlv~$!KHQPNCz'!
/4:IHh00S@<;;@@87I>
C@g31z32k
 7,*])(Y-'U/*i<3x<:81W+)V]b<Hk/=Gglg#$%<7j)+[=:7;97::$%M
:4z32|75>:8860t%*Z-+f@:&.M,-f//\lGLlltAMW
:;3QW[5:6$%+jtq5:u+*V>7;=85-.k22q85\DCL
nls;8k23689;97<78778)+T+*R:8DFm]f8;b~
tzeyq{_o}|+3??9.,[9331}+.m95?@nZZY
0.]4/|85:899::98*,V&#N98:6v*+Y-0`u{89Vw>FWEL`::.,g/2y66
;6GBKOY
lok&%U12s./x66=655'(I)%O6465,*V54oCIi{98^rKEC?S24U<83.s787252x
'&C86:8;6-.j837:*+T'$F94780-W..rA@gv/-`_jabGDhn@>WDOk:1x<:2,o54+,d))`3+a
!E@7;6;.-r/,b@6781,l*&J5/w783.Y,/vKI|Xdy,)g9;^;/J04Q8:;:0.j78=;:895-*w/+\
$#2<;7:=:0/l))`65<:::75w<8e,)i8844c2/o4571I%,UMDYgV^SMLLlh1/[2,T3<O0*l>=;7<6@;998:8:>:?6B<w
$?C]<:97}#!Q()W.-p<7::::..u43x6531w:6z./o0/
,'K'+S75EDuwdhjj[Wl1+i('L63pB6.3{99,,l*,d75?9?A
0.<(*W64:9;;:823w./z8730t:6967554_-&S41
<?MNzyTUr.4[30y*,G0/o74/1u;7:51/u-,`
 !:0/y<<9899::11p31v871/y35<:74*(a.([+.k=:@>DJl^e~:2a53w;5..[00v7:21u76}9:<;2/w)(J
0-C,*c9944
++n;88:/0q34:80/v33x::85*)a3.n()_88:8HH77kOTr99]52b20t66><-)d91{6631y11u97=:89-1k
"#K55{32ZST\##BA556t10z<865
1/s30u78;9/,h3/q2/u1/{9798:;=:20t22q86A@A?0.s/0r34{31y41x&*]*)a95|:5+'a
&83T@AK
H:962@931x*,c1.t2.r589610p22x2/y22s54
99:<20{11r65
A>BAA?4600w/,r7112w0)gIJN &/=<W
acrD;99/1l)'j+,a20s21}3/r88961/t<;20{31r32};:<8/+t//t:7AADDA>5644t74j7446:9#&=
95M1+^'"H
0.<*'[25272/x69:64/u>7=711y20z>9=;0,x64z9?ADGCC;;8+0m
*=6y;<00yipv
2)^948522|>4%"U//o9;<887/0z98:86283|=8FA?A7;8;55>;GKN[0+C)('
+%U875687wNOf
80;:;99898=<:;9;96>AFB,-^A=;787
+(g98?<LLa
"<8:<63~$'>85}:8::==JH[X_ab_ $<;598x
:7u99rbdd
y66Pon~74s673.llly*)[@9>BOJ
aef''F
==Q:9;:_
.1TD>MGosu
$W6<8
22TJEosx
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Pa%i5N23-
Uru4<E
7*Idu9M;
w3_^[r#MV
S7(hu#j
Hu6"
sG*DS,u
[b)+Nq(8V
2z7T2=H
$U^Ynboek
Z`Ca&\.q
y_sT]"
rjxY(X
J>>FA.
@1/2H
#hS{@;X
,+KjH@sQ#'7
DuH:-Wt
?P(L&H
%uC0KX@
RIP3EZ
zl>@^
t5;*V0(E
'nPPCx2tMsa^}(K
!Z-'6;2=2 @uV
dT)}&nAH+6J^ |
I--,@h
PWQSr
msvb]f\"
]A<f8Q@2I&ZhlkoM
5kEWo*0+m)
`3Q-vP2X: 
[+HAqp
licat@on eqr
u.T>he<cd
%s5lyvn}tAba6idS8DLG5Ld,al J3*WI'c,bus32M'agBoxAwFx3tf
kx8l?ExitPL
GtMT)l
t@Ac&v
P"<SH0&zI
`t$$|$(3
r+|$(|$
|(|Y%B
USQWVRW
ZPR3C 
Z^_Y[]
MSVBVM60.DLL
MethCallEngine
rtcAnsiValueBstr
rtcLowerCaseVar
rtcGetYear
rtcRandomNext
rtcRandomize
rtcDoEvents
rtcMidCharBstr
rtcMidCharVar
rtcSpaceBstr
EVENT_SINK_AddRef
rtcUpperCaseVar
DllFunctionCall
EVENT_SINK_Release
rtcShell
EVENT_SINK_QueryInterface
__vbaExceptHandler
rtcSplit
rtcReplace
rtcVarBstrFromAnsi
rtcMakeDir
rtcCreateObject2
ProcCallEngine
rtcBstrFromAnsi
rtcDir
rtcFileLength
rtcFileCopy
rtcErrObj
ThunRTMain
rtcLeftCharBstr
rtcLeftCharVar
rtcRightCharBstr
rtcRightCharVar
rtcGetDayOfMonth
rtcGetHourOfDay
rtcGetMinuteOfHour
rtcGetMonthOfYear
rtcGetPresentDate
rtcGetSecondOfMinute
196019262781320199467334387387238051340013607570732713116830196019262781320199467334387387238051340013607570732713116830196019262781320199467334387387238051340013607570732713116830196019262781320199467334387387238051340013607570732713116830196019262781320199467334387387238051340013607570732713116830196019262781320199467334387387238051340013607570732713116830256019322781920191541743701638511558238007156601445736533363025601932278192019154174370163851155823800715660144573653336302560193227819201915417437016385115582380071566014457365333630256019322781920191541743701638511558238007156601445736533363025601932278192019154174370163851155823800715660144573653336302560193227819201915417437016385115582380071566014457365333630MZ
L3259193259193932591939232591939325932591939278262019222546732214253741665717180073411106451466387
Project1
O\9'C 
ziSU5I%
AO:O3f
DesertAttack
GmbrGaara
 $.' ",#
(7),01444'9=82<.342
!22222222222222222222222222222222222222222222222222
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
3PG<^dL
[#yG>'Moj
M'4#%tn[V:
XhWz=p6V
>}+||Zo
8`FqCI
sO%<<g&[`
KRg,Az
z+Zyp)m<EiRAon
';?j]{L}6
\kc<!*&3`p:nI^
NOkrhnGUzqk
Vk.Rtc
xrG wW?5
j)6hsb
$hgHH"`12p>XaF8v
iOhRI"
]dX2mvq
KAL["-
txwyt,jz
izy+R*>EA#
i+hw:[l.Fq
0xWNHd[hW
?-f}RIAvFA 
~=k&Lck7I3
@S0};YYZ
Z44ZB"V-\}
^:C,Vur
hP]nc4
~s_8s\
y,QB/\
[)B<1n
eclO?J<g
H$wX%e8}
sz.VDVV
Q:+/TH
:M-\So-aP
:i;+5xB
i,o,7q}
,;YJl-Kv
"3_\(!Fn
t)7RVG]
P2I+D:Rk
[]t=6Z%Yyr
2s[;c`h
z^+BT
3(rXylo
Yrs^wpE
\hK<3_]V>Z 
Jf]9lABCmiP6i%W
,Q$x_:D
|;V"+d
[hX2<13y
^+%xqPJ
U(S#jUKf
qE#YvBH]
~{@T`N.2q}
f3R]L}JI`H/
ZCMkY<I
p7BU2Z97mb`Z
NJ\wyybv
QE&Fq@
i|/tVhb`#C[
cwoy/9."l1?
${f{K WC
xP1]Dy
RM{Yh:d:v
d|9a2;
p_9IkME
Zo'N(kO
,Yb}=jT~_
#,WR}+
e]2&'&L
Esv`YQ'
Zv}&.g
6uHd1'c
EIu>bq
R[-E.f=X'<)e
[MFA?<Wi?
mR5u"F<
8'k:OcZRnXy~>{
5uuvR0IX
^xT"7Afs\N0
}OWfu;K('+
4mb4{}D
U{j${?
"$c9OU
vVl7_xVauHD
Utx_EG=R
EwC7<Ij'[
LNu_Z[
('QK18
FM]|ik6i5%cjA
O&M)BA[$Y
~62u{Z'se}f
=AW"d_yjYG
/I.{^b
RH/,na
d]R}"k
Gj'N%~
uNbS#\
()jdn%p
|'v._G?
p7/=1;z9_
0~iaW^<
XY(-~RTrx?w
y7p'v-[Ou
)b^>ze(I),GP*gs&Am5L)
jm3D5;
e.gy<v
tk(m-"H
WK.l#R]d
F"Ij~Dpc
F :UMN
Q^DOFBI
+|1>5jO:3G24
s/GPjR~l
&o{pFG?PMzY
hSW4)Hm
dO/7e2
%,iYK 
}iB|U!O
;QgKImIi"p
i@>`9]O=
I?0>;;d$5;7dA
1'zWxl:6
zab_8"u-|
O9<WpH 
3HTMGJK
7:nJC,
>VMvVyY
AK@E{G
c#xzCw>E
+nwa0[v#NA
Q\gNybq^
V6'pHplpNk
_$fKwCols
Syx$u!*
ZMs-YQ
aN3d~yS*]rz
'V{YY#y
^0OQMv
x{]VGc
;/0)X^y
.6xUcpC5
)Ij]Ft5
1)**waE
<Wgq(71
@$q_&U.
9>oAA}
&l*7c^rzZ^H70P
|i7Krp
^~2jSr*J
n*@S5cB
}KGu#Fgg;\O
Zp:qOu':$
j5V\kSO
I8Sw|UVO=R\mG9
N4*Gw#1
][<QwQ
s7YtGwk$c"$`
~K6x$~4
AqWxwV=
TN6v4BM"@
hCCmGRV
Hl}NymtiW)
UFl'2E5^|
]5~}t^Kq
\k:yc7W
CUc&yWV%9c
1I5++VNP}1
g55'K{Ki!8I}
XsTN<.
=1KV@QE
I%n"%,
?)nB~:cb
Ko`W,9
799>d Q;
?3]Dn,
0qE+}I@
=#PVeHSP0
12SFEI\wjM
{3nE9BWWc@
bFlxW_\H<6e
RA+Zs$
yo:<o0?\sSr
Cw<pB#
=MGmt(\
[B2K~X^'Sb*w
\$y(x<)SkOaZ:Ot
EIo_[?<~u
`+N=SLdK
3`r;&dGWF
*@I_'^.W
~?*#W7C
S%}1WtF
%%Xd8Pb
jPq@|C:M
EkhuD-=
!F/S,q
oOgR3ql!
u+k<mOIw~
t`_-dg
fqF*G-k{CF
1IWu8V+?u(
;9.dd E
xfx[Q0d{w$s
SKl'|R
CK2r$MF#H
9856{e
#px=Edk
I*0qbs
vUAB_NUkSp
~\u:1D[>
"Gk4U>[+1U
NO@yi
Ws$ tt9
61_ZOk P*k
IP0?Pk
i>-}~e#
{N[,U}
Z56I2/
Ve[V3hm
U=M%YkK!,
:R}l1:o
-fsG_9A3A*
R:+JVXu[3}
`sK^m4^3
Rx5`ki
FgFGu>
&_AXCym*
k.r1wh1++?i
VR-FCO
}fB~O55
^+|pvR?
.'Pse'$4
?Znn"YcQ\(2:`(
y}Mo+E0O+=
ULO_mU
%?b2b9]
k|1*3K
7[p^A081
{E;Ql\2%;}j{HTII<X>3-o[E3Ln
YuFVX-,&
3U*FcRRB=@?geh&{
^'=82"
N5(4rCp~\Rn|
i%fn[L)9j
>o8i]C
yMtDfgR
p_f>0X
*TM_zJ[
xI6ZI
|Kw}P%
p1_A~wSl0G
-!PF)X
#~8#rtD
Tv\Np~U
6~"+KGch%?C
?h}1n|
cRB7(>J~
R)SfFD:
||.<kn
j;0UQ q
c$%~f<)$T
3* $^~
biGoTe
_WOZuQ
\X.hOC*VV5
^/tk ,5b
q;*}_`ivoum"o,@N
M>W%.L$}v
^!BG5i5
]E"%1C4
(\aI'?
quK_:+r@k
h:]i?j!u:
cVA<Z]{
Mh1Rw+wl,
[Iea{u
U0P=>7"B
]'KI C
;1UIn'H
EAeXR3
I;d5.J%
nZ#(e AFEr
;fDZ^c
Foqi3750
2#`N9^U1_\O
%UfmcT
R2~XqZ
C`q4H9=
XtPtsZL
m2;4k'=v
R$("0F
&5'U,-g
fnW.R,y3
;I%/,u
yj$bq~
i['T-5i
Qsj60kBn g
^_|}Nx-{7v
HRmfk87
Id>tn.A<
W^gisPiC5
h;/FuE
qwV6[oo
|@^Y8TPq9#p
8VFGsntEs
%-b,OF4|3
.{[C{Pu
C%wM2+o2>P
/|ZoC5Vi
fK]NfG-
SRK=VuV
yFjRj*=m9s
L]~$tq*
\v}?so
u=[F^;}
8LmOTY2
{zum(x
fm8N^}NnJ:
rrOkLomB*9
/#}~~e
 u&Sq9*
hx[>`~iOp
ox{H, [B
7M4>- @
j(.,J&
:`dKE+a[
C[!4;Rb%
 ~'Rj*i]
@A Sf`T
%i{{s#wc
Tr\#K{/t
Xf)ad;~1y
|TQI9lt(#
Oo|NJi
mm3K;9
[%buI6x
#1,A8c
]XKMo$7
 5Xm%|Y%
V9:v?5&tu
M}5P xU
ov6=/k
z3vT&w2N2[
H&\h)<;gooi
:~tzjw
DypX()E
V*|@Kbm
$1zrXL
_)7%K!
$<Wo/;]
8$gZoI
svC/No?
zqDKa_
Wn3Zs^
WZ$6Dl
(8XRi]).
b].u2@;"P
'T[XyA%Td;Tp:p:
2w]n$!
?)=xUu/
xW6HAl
zs_N*Sx'\
w*WQs}
o:sZuj2V
;H|!7uMT[-K
C1cnsp
Ckj^=AGa
px>4hEI
8;=o*J
*I+J!h:d
!H.nDv
{t2{67
]Z-/H>{(bd
/quXmlr
UUFc<bE
EJ2A?0F23=1Umh
jZ>q,8wpN
Vk4VS8
3zR1(f
^B`K3U
k/;^k)4&2CB"a_
n\E9'c
t9._MZJ'z
?$lmJm
h4F6`p6
N}1NWQ^Mm
R#x,r2
 wA]KlwqpTH
pg}oq$/$/
;<VIst
Z{|j}$
KHK0UU
>QKvLurKy<E
<mVH2R="h_
]Z-/H>{(bd
m^NC$,kE-I
GLM%y)}7k
_Em,ZHpn.`O-8t
N>nSTS^
#*ZBQHCJ
Ayd1wW
bx7[\*)oeu=A
%-lJbPf$m
WMOWe=
!6E@p1
fb3>`"k
msP!GU.
=u4n/.
{vFQpO
2=M{B,WZ
/Qn9]n
58<7\kBKo
Q-%|a}wVSze
3GWbhQ
-mkQG=i
WZMwm4yi79$v|mI8\2z};k^[yQhIn]MI@
o-]%*Zk=
|nhPppGc*ZMY;j|cU
~xoqp/q
P,5kSkY[^[
Qi&ivV
I{X\'--$Vw
'9Q9QESwV%+j|]
*|?<xVE>[
=z_<?
;]BK[hnm
Mn[x7w1oGx4rc
^)}"y_I23mW=}r8hp
.=:r396F
:n-KO4_
I?+vO<`p=Y,l
?oRNk4
YY{H[5iI
?2;2{v_
|kzcVfB(X%
CLPKyuq
[YbHC%
I"dm"8
[d~:gh
OM?yI&
~$|SZMijl
3T|).n
H;n/u>c
8uToyA }%
@&pGu=Of
y#1>Dv
2<SV|g(5H&y
gyV<{x]
> \^jP/
{w];8?m
j)Yfq`t_^i~
;|_5-1d+o
~%G{M?>
2^iy]>A
IhzF.X
[t~:gh
-l2D-%.2
N';i,y
N2xTvA+
I)wq%e`)
KazakageSearch
lstDir
GaraKazekage
TimerSebarkanDiri
O\9'C 
VB5!*
Kazekage
GaaraTheKazekage
Project1
.......................................................................................................................................................................................................................................................................
Jantung
Moonster
Pemusnah
Penyebaran
Penyerangan
Project1
SU5I%
TO\9'C 
zi^^znM&KW
lstDir
+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
GmbrGaara
TimerSebarkanDiri
GaraKazekage
KazakageSearch
DesertAttack
kernel32
GetSystemDirectoryA
SetFileAttributesA
wininet.dll
InternetGetConnectedState
kernel32.dll
GetWindowsDirectoryA
DeleteFileA
advapi32.dll
GetUserNameA
UserAktif
KillAV
VBA6.DLL
FindWindowA
FindNextFileA
+3q"=h
user32
SendMessageA
FindWindowExA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
EnableWindow
   9 `
FindFirstFileA
FindClose
CopyFileA
GetFileAttributesA
GetDriveTypeA
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  9   
 9   ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
  0 0 
   9 0 R
 &   9 
 &   9 
 0 0 \
 0 0 =
 0 0 \
 0 0 \
 0 0 =
 0 0 \
 9 0 R
 & 0 R
  9   `
  9   `
  9   `
  9   `
  9   `
9   9 
 0 0 R
0      
  9 0 R
  9 0 R
  9   
  9   
 0 0 \
0      
0      
0      
0      
0      
 0 0 \
0      
 0 0 \
 0 0 \
0   9 
  9   `
  9   `
  9   `
  9   `
t\/X5d
t\/X5d
1x/p5L
hXlhltG
>lpltCl
$`1x/l6
hXlhltG
>lpltCl
$`1x/l6
T`1x5T
0`1h50
0`1h50
0`1h50
lllh*1l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
qh<lll
Xlhqp/l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
q4<l4q<
*#$l(*#
' %lhH
lx>\#t*#llp*#h
xtlph\X6
lx>p#t*FX
lx>p#t*FX
lx>\#t*#llp*#h
xtlph\X6
lx>\#t*#llp*#h
xtlph\X6
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
l|\<,L
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
FP]/@0
F`]/P@
Fp]/`P
F]/p`
F0]/ 
@0 P@0
*#Tl*#P
TPd`\X)
qh<lht
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
ld>T#`*#\
#`*FDl2
1`>`#d
1`>`#d
d`X\T`6
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
*#\l`*#X
d\`X`T)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
ld>T#`*#\
ld>T#`*#\
pXl>#3lp
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
\<,|\lL<
\<,|\lL<
\<,l|\L,<
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4Tl>0#*#X
`\XT06
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>#*FX
l>#*FX
zZcf7'
tXl,>$#(32
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
RsPstPs
Os*Ps1+Ps~DsHDs
PsPsoCsPsxCsDs3|Os|gOs[NDs
Ds]QsibPsnDs`Ps|OsDQDs>BsSHDsIDsJDsqPsOsVOsOs`OsOsOs
MSVBVM60.DLL
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
.')Okx}[t7E[
-2($E)$N,-Opz|
}Wl7Hk
,,)cccBBBjjj
-#>'%L!&F14afkpibbfJUtuu}
AAEnnq
*(??'!F##F""G=CsPze`~b}g~h_}^_^fzBDj
+!$D'#E' C*&@HMrcy_~`
e><m%!F
$#;<:N@>GMQ^
## D'%E#$G'$A#$C4@\y_^g==n)%M&"A$!D
+#!G95W&%BU\tZ~a{5:g$$B'"C%#B
EDRuwluuXk'$D&"B "C
8=Gmut0.L'"?"$C(!A'&T03`
xwyaqMY)'C"#B&
[ajy**K&%G&#C42{
}|br0=Cn{3.S23y0 S!$Q55=
 &%$V`wz7:[$&L*%E;2s
$(+8]h{S_|3<^0,H&$Q
3*%NWSRT^]XauXUz.,n
5":)'U=7:=-3^enzw|KMWjo|jumu@>c43|
bbp5.q4-n-+^;:<;8<`]`g@=i;:
?=6*-g;<<8&&>+5?;6
 !573v31}5688>=HHatbe8:
=A5GH[41u01w9799963/Yceghqh~-,F7>
<DJ) a6574}98=:}1+ekwdgLOggc8/z 
5)$Rzvz
!?97979<24Y1.c`c44T0*Z$&Q"
,1,e+,d:7;8::+-L2.tNKmTYiHGK.1-ef_
.1X*(G$&Q+*j
((W.,f0-t:9::()M5662b77=386
OPTKNfKRq;1x8:y-,N5.v;8
=1+i-+f4296'$J@:-3_~~{[`k$"
GFJBDCTOK
#%{20SJNp96@8@G{<7=9RQ\
\`WMQW;8L)'S'(U1.m55,*a8<42`81cGWlv~$!KHQPNCz'!
/4:IHh00S@<;;@@87I>
C@g31z32k
 7,*])(Y-'U/*i<3x<:81W+)V]b<Hk/=Gglg#$%<7j)+[=:7;97::$%M
:4z32|75>:8860t%*Z-+f@:&.M,-f//\lGLlltAMW
:;3QW[5:6$%+jtq5:u+*V>7;=85-.k22q85\DCL
nls;8k23689;97<78778)+T+*R:8DFm]f8;b~
tzeyq{_o}|+3??9.,[9331}+.m95?@nZZY
0.]4/|85:899::98*,V&#N98:6v*+Y-0`u{89Vw>FWEL`::.,g/2y66
;6GBKOY
lok&%U12s./x66=655'(I)%O6465,*V54oCIi{98^rKEC?S24U<83.s787252x
'&C86:8;6-.j837:*+T'$F94780-W..rA@gv/-`_jabGDhn@>WDOk:1x<:2,o54+,d))`3+a
!E@7;6;.-r/,b@6781,l*&J5/w783.Y,/vKI|Xdy,)g9;^;/J04Q8:;:0.j78=;:895-*w/+\
$#2<;7:=:0/l))`65<:::75w<8e,)i8844c2/o4571I%,UMDYgV^SMLLlh1/[2,T3<O0*l>=;7<6@;998:8:>:?6B<w
$?C]<:97}#!Q()W.-p<7::::..u43x6531w:6z./o0/
,'K'+S75EDuwdhjj[Wl1+i('L63pB6.3{99,,l*,d75?9?A
0.<(*W64:9;;:823w./z8730t:6967554_-&S41
<?MNzyTUr.4[30y*,G0/o74/1u;7:51/u-,`
 !:0/y<<9899::11p31v871/y35<:74*(a.([+.k=:@>DJl^e~:2a53w;5..[00v7:21u76}9:<;2/w)(J
0-C,*c9944
++n;88:/0q34:80/v33x::85*)a3.n()_88:8HH77kOTr99]52b20t66><-)d91{6631y11u97=:89-1k
"#K55{32ZST\##BA556t10z<865
1/s30u78;9/,h3/q2/u1/{9798:;=:20t22q86A@A?0.s/0r34{31y41x&*]*)a95|:5+'a
&83T@AK
H:962@931x*,c1.t2.r589610p22x2/y22s54
99:<20{11r65
A>BAA?4600w/,r7112w0)gIJN &/=<W
acrD;99/1l)'j+,a20s21}3/r88961/t<;20{31r32};:<8/+t//t:7AADDA>5644t74j7446:9#&=
95M1+^'"H
0.<*'[25272/x69:64/u>7=711y20z>9=;0,x64z9?ADGCC;;8+0m
*=6y;<00yipv
2)^948522|>4%"U//o9;<887/0z98:86283|=8FA?A7;8;55>;GKN[0+C)('
+%U875687wNOf
80;:;99898=<:;9;96>AFB,-^A=;787
+(g98?<LLa
"<8:<63~$'>85}:8::==JH[X_ab_ $<;598x
:7u99rbdd
y66Pon~74s673.llly*)[@9>BOJ
aef''F
==Q:9;:_
.1TD>MGosu
$W6<8
22TJEosx
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Pa%i5N23-
Uru4<E
7*Idu9M;
w3_^[r#MV
S7(hu#j
Hu6"
sG*DS,u
[b)+Nq(8V
2z7T2=H
$U^Ynboek
Z`Ca&\.q
y_sT]"
rjxY(X
J>>FA.
@1/2H
#hS{@;X
,+KjH@sQ#'7
DuH:-Wt
?P(L&H
%uC0KX@
RIP3EZ
zl>@^
t5;*V0(E
'nPPCx2tMsa^}(K
!Z-'6;2=2 @uV
dT)}&nAH+6J^ |
I--,@h
PWQSr
msvb]f\"
]A<f8Q@2I&ZhlkoM
5kEWo*0+m)
`3Q-vP2X: 
[+HAqp
licat@on eqr
u.T>he<cd
%s5lyvn}tAba6idS8DLG5Ld,al J3*WI'c,bus32M'agBoxAwFx3tf
kx8l?ExitPL
GtMT)l
t@Ac&v
P"<SH0&zI
`t$$|$(3
r+|$(|$
|(|Y%B
USQWVRW
ZPR3C 
Z^_Y[]
MSVBVM60.DLL
MethCallEngine
rtcAnsiValueBstr
rtcLowerCaseVar
rtcGetYear
rtcRandomNext
rtcRandomize
rtcDoEvents
rtcMidCharBstr
rtcMidCharVar
rtcSpaceBstr
EVENT_SINK_AddRef
rtcUpperCaseVar
DllFunctionCall
EVENT_SINK_Release
rtcShell
EVENT_SINK_QueryInterface
__vbaExceptHandler
rtcSplit
rtcReplace
rtcVarBstrFromAnsi
rtcMakeDir
rtcCreateObject2
ProcCallEngine
rtcBstrFromAnsi
rtcDir
rtcFileLength
rtcFileCopy
rtcErrObj
ThunRTMain
rtcLeftCharBstr
rtcLeftCharVar
rtcRightCharBstr
rtcRightCharVar
rtcGetDayOfMonth
rtcGetHourOfDay
rtcGetMinuteOfHour
rtcGetMonthOfYear
rtcGetPresentDate
rtcGetSecondOfMinute
356019422782920192534267372405716536613768580244334170516277335601942278292019253426737240571653661376858024433417051627733560194227829201925342673724057165366137685802443341705162773356019422782920192534267372405716536613768580244334170516277335601942278292019253426737240571653661376858024433417051627733560194227829201925342673724057165366137685802443341705162773426019492783620193273266414441602863043014557731247005368655042601949278362019327326641444160286304301455773124700536865504260194927836201932732664144416028630430145577312470053686550426019492783620193273266414441602863043014557731247005368655042601949278362019327326641444160286304301455773124700536865504260194927836201932732664144416028630430145577312470053686550526019592784620194216414630764647358438403805734821610357315352601959278462019421641463076464735843840380573482161035731535260195927846201942164146307646473584384038057348216103573153526019592784620194216414630764647358438403805734821610357315352601959278462019421641463076464735843840380573482161035731535260195927846201942164146307646473584384038057348216103573153MZ
L3259193259193932591939232591939325932591939278262019222546732214253741665717180073411106451466387
Project1
O\9'C 
ziSU5I%
AO:O3f
DesertAttack
GmbrGaara
 $.' ",#
(7),01444'9=82<.342
!22222222222222222222222222222222222222222222222222
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
3PG<^dL
[#yG>'Moj
M'4#%tn[V:
XhWz=p6V
>}+||Zo
8`FqCI
sO%<<g&[`
KRg,Az
z+Zyp)m<EiRAon
';?j]{L}6
\kc<!*&3`p:nI^
NOkrhnGUzqk
Vk.Rtc
xrG wW?5
j)6hsb
$hgHH"`12p>XaF8v
iOhRI"
]dX2mvq
KAL["-
txwyt,jz
izy+R*>EA#
i+hw:[l.Fq
0xWNHd[hW
?-f}RIAvFA 
~=k&Lck7I3
@S0};YYZ
Z44ZB"V-\}
^:C,Vur
hP]nc4
~s_8s\
y,QB/\
[)B<1n
eclO?J<g
H$wX%e8}
sz.VDVV
Q:+/TH
:M-\So-aP
:i;+5xB
i,o,7q}
,;YJl-Kv
"3_\(!Fn
t)7RVG]
P2I+D:Rk
[]t=6Z%Yyr
2s[;c`h
z^+BT
3(rXylo
Yrs^wpE
\hK<3_]V>Z 
Jf]9lABCmiP6i%W
,Q$x_:D
|;V"+d
[hX2<13y
^+%xqPJ
U(S#jUKf
qE#YvBH]
~{@T`N.2q}
f3R]L}JI`H/
ZCMkY<I
p7BU2Z97mb`Z
NJ\wyybv
QE&Fq@
i|/tVhb`#C[
cwoy/9."l1?
${f{K WC
xP1]Dy
RM{Yh:d:v
d|9a2;
p_9IkME
Zo'N(kO
,Yb}=jT~_
#,WR}+
e]2&'&L
Esv`YQ'
Zv}&.g
6uHd1'c
EIu>bq
R[-E.f=X'<)e
[MFA?<Wi?
mR5u"F<
8'k:OcZRnXy~>{
5uuvR0IX
^xT"7Afs\N0
}OWfu;K('+
4mb4{}D
U{j${?
"$c9OU
vVl7_xVauHD
Utx_EG=R
EwC7<Ij'[
LNu_Z[
('QK18
FM]|ik6i5%cjA
O&M)BA[$Y
~62u{Z'se}f
=AW"d_yjYG
/I.{^b
RH/,na
d]R}"k
Gj'N%~
uNbS#\
()jdn%p
|'v._G?
p7/=1;z9_
0~iaW^<
XY(-~RTrx?w
y7p'v-[Ou
)b^>ze(I),GP*gs&Am5L)
jm3D5;
e.gy<v
tk(m-"H
WK.l#R]d
F"Ij~Dpc
F :UMN
Q^DOFBI
+|1>5jO:3G24
s/GPjR~l
&o{pFG?PMzY
hSW4)Hm
dO/7e2
%,iYK 
}iB|U!O
;QgKImIi"p
i@>`9]O=
I?0>;;d$5;7dA
1'zWxl:6
zab_8"u-|
O9<WpH 
3HTMGJK
7:nJC,
>VMvVyY
AK@E{G
c#xzCw>E
+nwa0[v#NA
Q\gNybq^
V6'pHplpNk
_$fKwCols
Syx$u!*
ZMs-YQ
aN3d~yS*]rz
'V{YY#y
^0OQMv
x{]VGc
;/0)X^y
.6xUcpC5
)Ij]Ft5
1)**waE
<Wgq(71
@$q_&U.
9>oAA}
&l*7c^rzZ^H70P
|i7Krp
^~2jSr*J
n*@S5cB
}KGu#Fgg;\O
Zp:qOu':$
j5V\kSO
I8Sw|UVO=R\mG9
N4*Gw#1
][<QwQ
s7YtGwk$c"$`
~K6x$~4
AqWxwV=
TN6v4BM"@
hCCmGRV
Hl}NymtiW)
UFl'2E5^|
]5~}t^Kq
\k:yc7W
CUc&yWV%9c
1I5++VNP}1
g55'K{Ki!8I}
XsTN<.
=1KV@QE
I%n"%,
?)nB~:cb
Ko`W,9
799>d Q;
?3]Dn,
0qE+}I@
=#PVeHSP0
12SFEI\wjM
{3nE9BWWc@
bFlxW_\H<6e
RA+Zs$
yo:<o0?\sSr
Cw<pB#
=MGmt(\
[B2K~X^'Sb*w
\$y(x<)SkOaZ:Ot
EIo_[?<~u
`+N=SLdK
3`r;&dGWF
*@I_'^.W
~?*#W7C
S%}1WtF
%%Xd8Pb
jPq@|C:M
EkhuD-=
!F/S,q
oOgR3ql!
u+k<mOIw~
t`_-dg
fqF*G-k{CF
1IWu8V+?u(
;9.dd E
xfx[Q0d{w$s
SKl'|R
CK2r$MF#H
9856{e
#px=Edk
I*0qbs
vUAB_NUkSp
~\u:1D[>
"Gk4U>[+1U
NO@yi
Ws$ tt9
61_ZOk P*k
IP0?Pk
i>-}~e#
{N[,U}
Z56I2/
Ve[V3hm
U=M%YkK!,
:R}l1:o
-fsG_9A3A*
R:+JVXu[3}
`sK^m4^3
Rx5`ki
FgFGu>
&_AXCym*
k.r1wh1++?i
VR-FCO
}fB~O55
^+|pvR?
.'Pse'$4
?Znn"YcQ\(2:`(
y}Mo+E0O+=
ULO_mU
%?b2b9]
k|1*3K
7[p^A081
{E;Ql\2%;}j{HTII<X>3-o[E3Ln
YuFVX-,&
3U*FcRRB=@?geh&{
^'=82"
N5(4rCp~\Rn|
i%fn[L)9j
>o8i]C
yMtDfgR
p_f>0X
*TM_zJ[
xI6ZI
|Kw}P%
p1_A~wSl0G
-!PF)X
#~8#rtD
Tv\Np~U
6~"+KGch%?C
?h}1n|
cRB7(>J~
R)SfFD:
||.<kn
j;0UQ q
c$%~f<)$T
3* $^~
biGoTe
_WOZuQ
\X.hOC*VV5
^/tk ,5b
q;*}_`ivoum"o,@N
M>W%.L$}v
^!BG5i5
]E"%1C4
(\aI'?
quK_:+r@k
h:]i?j!u:
cVA<Z]{
Mh1Rw+wl,
[Iea{u
U0P=>7"B
]'KI C
;1UIn'H
EAeXR3
I;d5.J%
nZ#(e AFEr
;fDZ^c
Foqi3750
2#`N9^U1_\O
%UfmcT
R2~XqZ
C`q4H9=
XtPtsZL
m2;4k'=v
R$("0F
&5'U,-g
fnW.R,y3
;I%/,u
yj$bq~
i['T-5i
Qsj60kBn g
^_|}Nx-{7v
HRmfk87
Id>tn.A<
W^gisPiC5
h;/FuE
qwV6[oo
|@^Y8TPq9#p
8VFGsntEs
%-b,OF4|3
.{[C{Pu
C%wM2+o2>P
/|ZoC5Vi
fK]NfG-
SRK=VuV
yFjRj*=m9s
L]~$tq*
\v}?so
u=[F^;}
8LmOTY2
{zum(x
fm8N^}NnJ:
rrOkLomB*9
/#}~~e
 u&Sq9*
hx[>`~iOp
ox{H, [B
7M4>- @
j(.,J&
:`dKE+a[
C[!4;Rb%
 ~'Rj*i]
@A Sf`T
%i{{s#wc
Tr\#K{/t
Xf)ad;~1y
|TQI9lt(#
Oo|NJi
mm3K;9
[%buI6x
#1,A8c
]XKMo$7
 5Xm%|Y%
V9:v?5&tu
M}5P xU
ov6=/k
z3vT&w2N2[
H&\h)<;gooi
:~tzjw
DypX()E
V*|@Kbm
$1zrXL
_)7%K!
$<Wo/;]
8$gZoI
svC/No?
zqDKa_
Wn3Zs^
WZ$6Dl
(8XRi]).
b].u2@;"P
'T[XyA%Td;Tp:p:
2w]n$!
?)=xUu/
xW6HAl
zs_N*Sx'\
w*WQs}
o:sZuj2V
;H|!7uMT[-K
C1cnsp
Ckj^=AGa
px>4hEI
8;=o*J
*I+J!h:d
!H.nDv
{t2{67
]Z-/H>{(bd
/quXmlr
UUFc<bE
EJ2A?0F23=1Umh
jZ>q,8wpN
Vk4VS8
3zR1(f
^B`K3U
k/;^k)4&2CB"a_
n\E9'c
t9._MZJ'z
?$lmJm
h4F6`p6
N}1NWQ^Mm
R#x,r2
 wA]KlwqpTH
pg}oq$/$/
;<VIst
Z{|j}$
KHK0UU
>QKvLurKy<E
<mVH2R="h_
]Z-/H>{(bd
m^NC$,kE-I
GLM%y)}7k
_Em,ZHpn.`O-8t
N>nSTS^
#*ZBQHCJ
Ayd1wW
bx7[\*)oeu=A
%-lJbPf$m
WMOWe=
!6E@p1
fb3>`"k
msP!GU.
=u4n/.
{vFQpO
2=M{B,WZ
/Qn9]n
58<7\kBKo
Q-%|a}wVSze
3GWbhQ
-mkQG=i
WZMwm4yi79$v|mI8\2z};k^[yQhIn]MI@
o-]%*Zk=
|nhPppGc*ZMY;j|cU
~xoqp/q
P,5kSkY[^[
Qi&ivV
I{X\'--$Vw
'9Q9QESwV%+j|]
*|?<xVE>[
=z_<?
;]BK[hnm
Mn[x7w1oGx4rc
^)}"y_I23mW=}r8hp
.=:r396F
:n-KO4_
I?+vO<`p=Y,l
?oRNk4
YY{H[5iI
?2;2{v_
|kzcVfB(X%
CLPKyuq
[YbHC%
I"dm"8
[d~:gh
OM?yI&
~$|SZMijl
3T|).n
H;n/u>c
8uToyA }%
@&pGu=Of
y#1>Dv
2<SV|g(5H&y
gyV<{x]
> \^jP/
{w];8?m
j)Yfq`t_^i~
;|_5-1d+o
~%G{M?>
2^iy]>A
IhzF.X
[t~:gh
-l2D-%.2
N';i,y
N2xTvA+
I)wq%e`)
KazakageSearch
lstDir
GaraKazekage
TimerSebarkanDiri
O\9'C 
VB5!*
Kazekage
GaaraTheKazekage
Project1
.......................................................................................................................................................................................................................................................................
Jantung
Moonster
Pemusnah
Penyebaran
Penyerangan
Project1
SU5I%
TO\9'C 
zi^^znM&KW
lstDir
+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
GmbrGaara
TimerSebarkanDiri
GaraKazekage
KazakageSearch
DesertAttack
kernel32
GetSystemDirectoryA
SetFileAttributesA
wininet.dll
InternetGetConnectedState
kernel32.dll
GetWindowsDirectoryA
DeleteFileA
advapi32.dll
GetUserNameA
UserAktif
KillAV
VBA6.DLL
FindWindowA
FindNextFileA
+3q"=h
user32
SendMessageA
FindWindowExA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
EnableWindow
   9 `
FindFirstFileA
FindClose
CopyFileA
GetFileAttributesA
GetDriveTypeA
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  9   
 9   ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
  0 0 
   9 0 R
 &   9 
 &   9 
 0 0 \
 0 0 =
 0 0 \
 0 0 \
 0 0 =
 0 0 \
 9 0 R
 & 0 R
  9   `
  9   `
  9   `
  9   `
  9   `
9   9 
 0 0 R
0      
  9 0 R
  9 0 R
  9   
  9   
 0 0 \
0      
0      
0      
0      
0      
 0 0 \
0      
 0 0 \
 0 0 \
0   9 
  9   `
  9   `
  9   `
  9   `
t\/X5d
t\/X5d
1x/p5L
hXlhltG
>lpltCl
$`1x/l6
hXlhltG
>lpltCl
$`1x/l6
T`1x5T
0`1h50
0`1h50
0`1h50
lllh*1l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
qh<lll
Xlhqp/l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
q4<l4q<
*#$l(*#
' %lhH
lx>\#t*#llp*#h
xtlph\X6
lx>p#t*FX
lx>p#t*FX
lx>\#t*#llp*#h
xtlph\X6
lx>\#t*#llp*#h
xtlph\X6
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
l|\<,L
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
FP]/@0
F`]/P@
Fp]/`P
F]/p`
F0]/ 
@0 P@0
*#Tl*#P
TPd`\X)
qh<lht
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
ld>T#`*#\
#`*FDl2
1`>`#d
1`>`#d
d`X\T`6
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
*#\l`*#X
d\`X`T)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
ld>T#`*#\
ld>T#`*#\
pXl>#3lp
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
\<,|\lL<
\<,|\lL<
\<,l|\L,<
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4Tl>0#*#X
`\XT06
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>#*FX
l>#*FX
zZcf7'
tXl,>$#(32
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
RsPstPs
Os*Ps1+Ps~DsHDs
PsPsoCsPsxCsDs3|Os|gOs[NDs
Ds]QsibPsnDs`Ps|OsDQDs>BsSHDsIDsJDsqPsOsVOsOs`OsOsOs
MSVBVM60.DLL
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
.')Okx}[t7E[
-2($E)$N,-Opz|
}Wl7Hk
,,)cccBBBjjj
-#>'%L!&F14afkpibbfJUtuu}
AAEnnq
*(??'!F##F""G=CsPze`~b}g~h_}^_^fzBDj
+!$D'#E' C*&@HMrcy_~`
e><m%!F
$#;<:N@>GMQ^
## D'%E#$G'$A#$C4@\y_^g==n)%M&"A$!D
+#!G95W&%BU\tZ~a{5:g$$B'"C%#B
EDRuwluuXk'$D&"B "C
8=Gmut0.L'"?"$C(!A'&T03`
xwyaqMY)'C"#B&
[ajy**K&%G&#C42{
}|br0=Cn{3.S23y0 S!$Q55=
 &%$V`wz7:[$&L*%E;2s
$(+8]h{S_|3<^0,H&$Q
3*%NWSRT^]XauXUz.,n
5":)'U=7:=-3^enzw|KMWjo|jumu@>c43|
bbp5.q4-n-+^;:<;8<`]`g@=i;:
?=6*-g;<<8&&>+5?;6
 !573v31}5688>=HHatbe8:
=A5GH[41u01w9799963/Yceghqh~-,F7>
<DJ) a6574}98=:}1+ekwdgLOggc8/z 
5)$Rzvz
!?97979<24Y1.c`c44T0*Z$&Q"
,1,e+,d:7;8::+-L2.tNKmTYiHGK.1-ef_
.1X*(G$&Q+*j
((W.,f0-t:9::()M5662b77=386
OPTKNfKRq;1x8:y-,N5.v;8
=1+i-+f4296'$J@:-3_~~{[`k$"
GFJBDCTOK
#%{20SJNp96@8@G{<7=9RQ\
\`WMQW;8L)'S'(U1.m55,*a8<42`81cGWlv~$!KHQPNCz'!
/4:IHh00S@<;;@@87I>
C@g31z32k
 7,*])(Y-'U/*i<3x<:81W+)V]b<Hk/=Gglg#$%<7j)+[=:7;97::$%M
:4z32|75>:8860t%*Z-+f@:&.M,-f//\lGLlltAMW
:;3QW[5:6$%+jtq5:u+*V>7;=85-.k22q85\DCL
nls;8k23689;97<78778)+T+*R:8DFm]f8;b~
tzeyq{_o}|+3??9.,[9331}+.m95?@nZZY
0.]4/|85:899::98*,V&#N98:6v*+Y-0`u{89Vw>FWEL`::.,g/2y66
;6GBKOY
lok&%U12s./x66=655'(I)%O6465,*V54oCIi{98^rKEC?S24U<83.s787252x
'&C86:8;6-.j837:*+T'$F94780-W..rA@gv/-`_jabGDhn@>WDOk:1x<:2,o54+,d))`3+a
!E@7;6;.-r/,b@6781,l*&J5/w783.Y,/vKI|Xdy,)g9;^;/J04Q8:;:0.j78=;:895-*w/+\
$#2<;7:=:0/l))`65<:::75w<8e,)i8844c2/o4571I%,UMDYgV^SMLLlh1/[2,T3<O0*l>=;7<6@;998:8:>:?6B<w
$?C]<:97}#!Q()W.-p<7::::..u43x6531w:6z./o0/
,'K'+S75EDuwdhjj[Wl1+i('L63pB6.3{99,,l*,d75?9?A
0.<(*W64:9;;:823w./z8730t:6967554_-&S41
<?MNzyTUr.4[30y*,G0/o74/1u;7:51/u-,`
 !:0/y<<9899::11p31v871/y35<:74*(a.([+.k=:@>DJl^e~:2a53w;5..[00v7:21u76}9:<;2/w)(J
0-C,*c9944
++n;88:/0q34:80/v33x::85*)a3.n()_88:8HH77kOTr99]52b20t66><-)d91{6631y11u97=:89-1k
"#K55{32ZST\##BA556t10z<865
1/s30u78;9/,h3/q2/u1/{9798:;=:20t22q86A@A?0.s/0r34{31y41x&*]*)a95|:5+'a
&83T@AK
H:962@931x*,c1.t2.r589610p22x2/y22s54
99:<20{11r65
A>BAA?4600w/,r7112w0)gIJN &/=<W
acrD;99/1l)'j+,a20s21}3/r88961/t<;20{31r32};:<8/+t//t:7AADDA>5644t74j7446:9#&=
95M1+^'"H
0.<*'[25272/x69:64/u>7=711y20z>9=;0,x64z9?ADGCC;;8+0m
*=6y;<00yipv
2)^948522|>4%"U//o9;<887/0z98:86283|=8FA?A7;8;55>;GKN[0+C)('
+%U875687wNOf
80;:;99898=<:;9;96>AFB,-^A=;787
+(g98?<LLa
"<8:<63~$'>85}:8::==JH[X_ab_ $<;598x
:7u99rbdd
y66Pon~74s673.llly*)[@9>BOJ
aef''F
==Q:9;:_
.1TD>MGosu
$W6<8
22TJEosx
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Pa%i5N23-
Uru4<E
7*Idu9M;
w3_^[r#MV
S7(hu#j
Hu6"
sG*DS,u
[b)+Nq(8V
2z7T2=H
$U^Ynboek
Z`Ca&\.q
y_sT]"
rjxY(X
J>>FA.
@1/2H
#hS{@;X
,+KjH@sQ#'7
DuH:-Wt
?P(L&H
%uC0KX@
RIP3EZ
zl>@^
t5;*V0(E
'nPPCx2tMsa^}(K
!Z-'6;2=2 @uV
dT)}&nAH+6J^ |
I--,@h
PWQSr
msvb]f\"
]A<f8Q@2I&ZhlkoM
5kEWo*0+m)
`3Q-vP2X: 
[+HAqp
licat@on eqr
u.T>he<cd
%s5lyvn}tAba6idS8DLG5Ld,al J3*WI'c,bus32M'agBoxAwFx3tf
kx8l?ExitPL
GtMT)l
t@Ac&v
P"<SH0&zI
`t$$|$(3
r+|$(|$
|(|Y%B
USQWVRW
ZPR3C 
Z^_Y[]
MSVBVM60.DLL
MethCallEngine
rtcAnsiValueBstr
rtcLowerCaseVar
rtcGetYear
rtcRandomNext
rtcRandomize
rtcDoEvents
rtcMidCharBstr
rtcMidCharVar
rtcSpaceBstr
EVENT_SINK_AddRef
rtcUpperCaseVar
DllFunctionCall
EVENT_SINK_Release
rtcShell
EVENT_SINK_QueryInterface
__vbaExceptHandler
rtcSplit
rtcReplace
rtcVarBstrFromAnsi
rtcMakeDir
rtcCreateObject2
ProcCallEngine
rtcBstrFromAnsi
rtcDir
rtcFileLength
rtcFileCopy
rtcErrObj
ThunRTMain
rtcLeftCharBstr
rtcLeftCharVar
rtcRightCharBstr
rtcRightCharVar
rtcGetDayOfMonth
rtcGetHourOfDay
rtcGetMinuteOfHour
rtcGetMonthOfYear
rtcGetPresentDate
rtcGetSecondOfMinute
556019622784920194504576361864671281157132045735120800818186855601962278492019450457636186467128115713204573512080081818685560196227849201945045763618646712811571320457351208008181868556019622784920194504576361864671281157132045735120800818186855601962278492019450457636186467128115713204573512080081818685560196227849201945045763618646712811571320457351208008181868261199278-42019-8766507530017108470010248342886847120216818261199278-42019-8766507530017108470010248342886847120216818261199278-42019-8766507530017108470010248342886847120216818261199278-42019-8766507530017108470010248342886847120216818261199278-42019-8766507530017108470010248342886847120216818261199278-42019-8766507530017108470010248342886847120216818MZ
L3259193259193932591939232591939325932591939278262019222546732214253741665717180073411106451466387
Project1
O\9'C 
ziSU5I%
AO:O3f
DesertAttack
GmbrGaara
 $.' ",#
(7),01444'9=82<.342
!22222222222222222222222222222222222222222222222222
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
3PG<^dL
[#yG>'Moj
M'4#%tn[V:
XhWz=p6V
>}+||Zo
8`FqCI
sO%<<g&[`
KRg,Az
z+Zyp)m<EiRAon
';?j]{L}6
\kc<!*&3`p:nI^
NOkrhnGUzqk
Vk.Rtc
xrG wW?5
j)6hsb
$hgHH"`12p>XaF8v
iOhRI"
]dX2mvq
KAL["-
txwyt,jz
izy+R*>EA#
i+hw:[l.Fq
0xWNHd[hW
?-f}RIAvFA 
~=k&Lck7I3
@S0};YYZ
Z44ZB"V-\}
^:C,Vur
hP]nc4
~s_8s\
y,QB/\
[)B<1n
eclO?J<g
H$wX%e8}
sz.VDVV
Q:+/TH
:M-\So-aP
:i;+5xB
i,o,7q}
,;YJl-Kv
"3_\(!Fn
t)7RVG]
P2I+D:Rk
[]t=6Z%Yyr
2s[;c`h
z^+BT
3(rXylo
Yrs^wpE
\hK<3_]V>Z 
Jf]9lABCmiP6i%W
,Q$x_:D
|;V"+d
[hX2<13y
^+%xqPJ
U(S#jUKf
qE#YvBH]
~{@T`N.2q}
f3R]L}JI`H/
ZCMkY<I
p7BU2Z97mb`Z
NJ\wyybv
QE&Fq@
i|/tVhb`#C[
cwoy/9."l1?
${f{K WC
xP1]Dy
RM{Yh:d:v
d|9a2;
p_9IkME
Zo'N(kO
,Yb}=jT~_
#,WR}+
e]2&'&L
Esv`YQ'
Zv}&.g
6uHd1'c
EIu>bq
R[-E.f=X'<)e
[MFA?<Wi?
mR5u"F<
8'k:OcZRnXy~>{
5uuvR0IX
^xT"7Afs\N0
}OWfu;K('+
4mb4{}D
U{j${?
"$c9OU
vVl7_xVauHD
Utx_EG=R
EwC7<Ij'[
LNu_Z[
('QK18
FM]|ik6i5%cjA
O&M)BA[$Y
~62u{Z'se}f
=AW"d_yjYG
/I.{^b
RH/,na
d]R}"k
Gj'N%~
uNbS#\
()jdn%p
|'v._G?
p7/=1;z9_
0~iaW^<
XY(-~RTrx?w
y7p'v-[Ou
)b^>ze(I),GP*gs&Am5L)
jm3D5;
e.gy<v
tk(m-"H
WK.l#R]d
F"Ij~Dpc
F :UMN
Q^DOFBI
+|1>5jO:3G24
s/GPjR~l
&o{pFG?PMzY
hSW4)Hm
dO/7e2
%,iYK 
}iB|U!O
;QgKImIi"p
i@>`9]O=
I?0>;;d$5;7dA
1'zWxl:6
zab_8"u-|
O9<WpH 
3HTMGJK
7:nJC,
>VMvVyY
AK@E{G
c#xzCw>E
+nwa0[v#NA
Q\gNybq^
V6'pHplpNk
_$fKwCols
Syx$u!*
ZMs-YQ
aN3d~yS*]rz
'V{YY#y
^0OQMv
x{]VGc
;/0)X^y
.6xUcpC5
)Ij]Ft5
1)**waE
<Wgq(71
@$q_&U.
9>oAA}
&l*7c^rzZ^H70P
|i7Krp
^~2jSr*J
n*@S5cB
}KGu#Fgg;\O
Zp:qOu':$
j5V\kSO
I8Sw|UVO=R\mG9
N4*Gw#1
][<QwQ
s7YtGwk$c"$`
~K6x$~4
AqWxwV=
TN6v4BM"@
hCCmGRV
Hl}NymtiW)
UFl'2E5^|
]5~}t^Kq
\k:yc7W
CUc&yWV%9c
1I5++VNP}1
g55'K{Ki!8I}
XsTN<.
=1KV@QE
I%n"%,
?)nB~:cb
Ko`W,9
799>d Q;
?3]Dn,
0qE+}I@
=#PVeHSP0
12SFEI\wjM
{3nE9BWWc@
bFlxW_\H<6e
RA+Zs$
yo:<o0?\sSr
Cw<pB#
=MGmt(\
[B2K~X^'Sb*w
\$y(x<)SkOaZ:Ot
EIo_[?<~u
`+N=SLdK
3`r;&dGWF
*@I_'^.W
~?*#W7C
S%}1WtF
%%Xd8Pb
jPq@|C:M
EkhuD-=
!F/S,q
oOgR3ql!
u+k<mOIw~
t`_-dg
fqF*G-k{CF
1IWu8V+?u(
;9.dd E
xfx[Q0d{w$s
SKl'|R
CK2r$MF#H
9856{e
#px=Edk
I*0qbs
vUAB_NUkSp
~\u:1D[>
"Gk4U>[+1U
NO@yi
Ws$ tt9
61_ZOk P*k
IP0?Pk
i>-}~e#
{N[,U}
Z56I2/
Ve[V3hm
U=M%YkK!,
:R}l1:o
-fsG_9A3A*
R:+JVXu[3}
`sK^m4^3
Rx5`ki
FgFGu>
&_AXCym*
k.r1wh1++?i
VR-FCO
}fB~O55
^+|pvR?
.'Pse'$4
?Znn"YcQ\(2:`(
y}Mo+E0O+=
ULO_mU
%?b2b9]
k|1*3K
7[p^A081
{E;Ql\2%;}j{HTII<X>3-o[E3Ln
YuFVX-,&
3U*FcRRB=@?geh&{
^'=82"
N5(4rCp~\Rn|
i%fn[L)9j
>o8i]C
yMtDfgR
p_f>0X
*TM_zJ[
xI6ZI
|Kw}P%
p1_A~wSl0G
-!PF)X
#~8#rtD
Tv\Np~U
6~"+KGch%?C
?h}1n|
cRB7(>J~
R)SfFD:
||.<kn
j;0UQ q
c$%~f<)$T
3* $^~
biGoTe
_WOZuQ
\X.hOC*VV5
^/tk ,5b
q;*}_`ivoum"o,@N
M>W%.L$}v
^!BG5i5
]E"%1C4
(\aI'?
quK_:+r@k
h:]i?j!u:
cVA<Z]{
Mh1Rw+wl,
[Iea{u
U0P=>7"B
]'KI C
;1UIn'H
EAeXR3
I;d5.J%
nZ#(e AFEr
;fDZ^c
Foqi3750
2#`N9^U1_\O
%UfmcT
R2~XqZ
C`q4H9=
XtPtsZL
m2;4k'=v
R$("0F
&5'U,-g
fnW.R,y3
;I%/,u
yj$bq~
i['T-5i
Qsj60kBn g
^_|}Nx-{7v
HRmfk87
Id>tn.A<
W^gisPiC5
h;/FuE
qwV6[oo
|@^Y8TPq9#p
8VFGsntEs
%-b,OF4|3
.{[C{Pu
C%wM2+o2>P
/|ZoC5Vi
fK]NfG-
SRK=VuV
yFjRj*=m9s
L]~$tq*
\v}?so
u=[F^;}
8LmOTY2
{zum(x
fm8N^}NnJ:
rrOkLomB*9
/#}~~e
 u&Sq9*
hx[>`~iOp
ox{H, [B
7M4>- @
j(.,J&
:`dKE+a[
C[!4;Rb%
 ~'Rj*i]
@A Sf`T
%i{{s#wc
Tr\#K{/t
Xf)ad;~1y
|TQI9lt(#
Oo|NJi
mm3K;9
[%buI6x
#1,A8c
]XKMo$7
 5Xm%|Y%
V9:v?5&tu
M}5P xU
ov6=/k
z3vT&w2N2[
H&\h)<;gooi
:~tzjw
DypX()E
V*|@Kbm
$1zrXL
_)7%K!
$<Wo/;]
8$gZoI
svC/No?
zqDKa_
Wn3Zs^
WZ$6Dl
(8XRi]).
b].u2@;"P
'T[XyA%Td;Tp:p:
2w]n$!
?)=xUu/
xW6HAl
zs_N*Sx'\
w*WQs}
o:sZuj2V
;H|!7uMT[-K
C1cnsp
Ckj^=AGa
px>4hEI
8;=o*J
*I+J!h:d
!H.nDv
{t2{67
]Z-/H>{(bd
/quXmlr
UUFc<bE
EJ2A?0F23=1Umh
jZ>q,8wpN
Vk4VS8
3zR1(f
^B`K3U
k/;^k)4&2CB"a_
n\E9'c
t9._MZJ'z
?$lmJm
h4F6`p6
N}1NWQ^Mm
R#x,r2
 wA]KlwqpTH
pg}oq$/$/
;<VIst
Z{|j}$
KHK0UU
>QKvLurKy<E
<mVH2R="h_
]Z-/H>{(bd
m^NC$,kE-I
GLM%y)}7k
_Em,ZHpn.`O-8t
N>nSTS^
#*ZBQHCJ
Ayd1wW
bx7[\*)oeu=A
%-lJbPf$m
WMOWe=
!6E@p1
fb3>`"k
msP!GU.
=u4n/.
{vFQpO
2=M{B,WZ
/Qn9]n
58<7\kBKo
Q-%|a}wVSze
3GWbhQ
-mkQG=i
WZMwm4yi79$v|mI8\2z};k^[yQhIn]MI@
o-]%*Zk=
|nhPppGc*ZMY;j|cU
~xoqp/q
P,5kSkY[^[
Qi&ivV
I{X\'--$Vw
'9Q9QESwV%+j|]
*|?<xVE>[
=z_<?
;]BK[hnm
Mn[x7w1oGx4rc
^)}"y_I23mW=}r8hp
.=:r396F
:n-KO4_
I?+vO<`p=Y,l
?oRNk4
YY{H[5iI
?2;2{v_
|kzcVfB(X%
CLPKyuq
[YbHC%
I"dm"8
[d~:gh
OM?yI&
~$|SZMijl
3T|).n
H;n/u>c
8uToyA }%
@&pGu=Of
y#1>Dv
2<SV|g(5H&y
gyV<{x]
> \^jP/
{w];8?m
j)Yfq`t_^i~
;|_5-1d+o
~%G{M?>
2^iy]>A
IhzF.X
[t~:gh
-l2D-%.2
N';i,y
N2xTvA+
I)wq%e`)
KazakageSearch
lstDir
GaraKazekage
TimerSebarkanDiri
O\9'C 
VB5!*
Kazekage
GaaraTheKazekage
Project1
.......................................................................................................................................................................................................................................................................
Jantung
Moonster
Pemusnah
Penyebaran
Penyerangan
Project1
SU5I%
TO\9'C 
zi^^znM&KW
lstDir
+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
GmbrGaara
TimerSebarkanDiri
GaraKazekage
KazakageSearch
DesertAttack
kernel32
GetSystemDirectoryA
SetFileAttributesA
wininet.dll
InternetGetConnectedState
kernel32.dll
GetWindowsDirectoryA
DeleteFileA
advapi32.dll
GetUserNameA
UserAktif
KillAV
VBA6.DLL
FindWindowA
FindNextFileA
+3q"=h
user32
SendMessageA
FindWindowExA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
EnableWindow
   9 `
FindFirstFileA
FindClose
CopyFileA
GetFileAttributesA
GetDriveTypeA
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  0 0  
  9   
 9   ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
0    ~
   9 0 R
0    ~
0    ~
0    ~
  0 0 
   9 0 R
 &   9 
 &   9 
 0 0 \
 0 0 =
 0 0 \
 0 0 \
 0 0 =
 0 0 \
 9 0 R
 & 0 R
  9   `
  9   `
  9   `
  9   `
  9   `
9   9 
 0 0 R
0      
  9 0 R
  9 0 R
  9   
  9   
 0 0 \
0      
0      
0      
0      
0      
 0 0 \
0      
 0 0 \
 0 0 \
0   9 
  9   `
  9   `
  9   `
  9   `
t\/X5d
t\/X5d
1x/p5L
hXlhltG
>lpltCl
$`1x/l6
hXlhltG
>lpltCl
$`1x/l6
T`1x5T
0`1h50
0`1h50
0`1h50
lllh*1l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
qh<lll
Xlhqp/l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
q4<l4q<
*#$l(*#
' %lhH
lx>\#t*#llp*#h
xtlph\X6
lx>p#t*FX
lx>p#t*FX
lx>\#t*#llp*#h
xtlph\X6
lx>\#t*#llp*#h
xtlph\X6
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
l|\<,L
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
FP]/@0
F`]/P@
Fp]/`P
F]/p`
F0]/ 
@0 P@0
*#Tl*#P
TPd`\X)
qh<lht
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
ld>T#`*#\
#`*FDl2
1`>`#d
1`>`#d
d`X\T`6
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
*#\l`*#X
d\`X`T)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
ld>T#`*#\
ld>T#`*#\
pXl>#3lp
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
\<,|\lL<
\<,|\lL<
\<,l|\L,<
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4Tl>0#*#X
`\XT06
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>#*FX
l>#*FX
zZcf7'
tXl,>$#(32
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
RsPstPs
Os*Ps1+Ps~DsHDs
PsPsoCsPsxCsDs3|Os|gOs[NDs
Ds]QsibPsnDs`Ps|OsDQDs>BsSHDsIDsJDsqPsOsVOsOs`OsOsOs
MSVBVM60.DLL
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
.')Okx}[t7E[
-2($E)$N,-Opz|
}Wl7Hk
,,)cccBBBjjj
-#>'%L!&F14afkpibbfJUtuu}
AAEnnq
*(??'!F##F""G=CsPze`~b}g~h_}^_^fzBDj
+!$D'#E' C*&@HMrcy_~`
e><m%!F
$#;<:N@>GMQ^
## D'%E#$G'$A#$C4@\y_^g==n)%M&"A$!D
+#!G95W&%BU\tZ~a{5:g$$B'"C%#B
EDRuwluuXk'$D&"B "C
8=Gmut0.L'"?"$C(!A'&T03`
xwyaqMY)'C"#B&
[ajy**K&%G&#C42{
}|br0=Cn{3.S23y0 S!$Q55=
 &%$V`wz7:[$&L*%E;2s
$(+8]h{S_|3<^0,H&$Q
3*%NWSRT^]XauXUz.,n
5":)'U=7:=-3^enzw|KMWjo|jumu@>c43|
bbp5.q4-n-+^;:<;8<`]`g@=i;:
?=6*-g;<<8&&>+5?;6
 !573v31}5688>=HHatbe8:
=A5GH[41u01w9799963/Yceghqh~-,F7>
<DJ) a6574}98=:}1+ekwdgLOggc8/z 
5)$Rzvz
!?97979<24Y1.c`c44T0*Z$&Q"
,1,e+,d:7;8::+-L2.tNKmTYiHGK.1-ef_
.1X*(G$&Q+*j
((W.,f0-t:9::()M5662b77=386
OPTKNfKRq;1x8:y-,N5.v;8
=1+i-+f4296'$J@:-3_~~{[`k$"
GFJBDCTOK
#%{20SJNp96@8@G{<7=9RQ\
\`WMQW;8L)'S'(U1.m55,*a8<42`81cGWlv~$!KHQPNCz'!
/4:IHh00S@<;;@@87I>
C@g31z32k
 7,*])(Y-'U/*i<3x<:81W+)V]b<Hk/=Gglg#$%<7j)+[=:7;97::$%M
:4z32|75>:8860t%*Z-+f@:&.M,-f//\lGLlltAMW
:;3QW[5:6$%+jtq5:u+*V>7;=85-.k22q85\DCL
nls;8k23689;97<78778)+T+*R:8DFm]f8;b~
tzeyq{_o}|+3??9.,[9331}+.m95?@nZZY
0.]4/|85:899::98*,V&#N98:6v*+Y-0`u{89Vw>FWEL`::.,g/2y66
;6GBKOY
lok&%U12s./x66=655'(I)%O6465,*V54oCIi{98^rKEC?S24U<83.s787252x
'&C86:8;6-.j837:*+T'$F94780-W..rA@gv/-`_jabGDhn@>WDOk:1x<:2,o54+,d))`3+a
!E@7;6;.-r/,b@6781,l*&J5/w783.Y,/vKI|Xdy,)g9;^;/J04Q8:;:0.j78=;:895-*w/+\
$#2<;7:=:0/l))`65<:::75w<8e,)i8844c2/o4571I%,UMDYgV^SMLLlh1/[2,T3<O0*l>=;7<6@;998:8:>:?6B<w
$?C]<:97}#!Q()W.-p<7::::..u43x6531w:6z./o0/
,'K'+S75EDuwdhjj[Wl1+i('L63pB6.3{99,,l*,d75?9?A
0.<(*W64:9;;:823w./z8730t:6967554_-&S41
<?MNzyTUr.4[30y*,G0/o74/1u;7:51/u-,`
 !:0/y<<9899::11p31v871/y35<:74*(a.([+.k=:@>DJl^e~:2a53w;5..[00v7:21u76}9:<;2/w)(J
0-C,*c9944
++n;88:/0q34:80/v33x::85*)a3.n()_88:8HH77kOTr99]52b20t66><-)d91{6631y11u97=:89-1k
"#K55{32ZST\##BA556t10z<865
1/s30u78;9/,h3/q2/u1/{9798:;=:20t22q86A@A?0.s/0r34{31y41x&*]*)a95|:5+'a
&83T@AK
H:962@931x*,c1.t2.r589610p22x2/y22s54
99:<20{11r65
A>BAA?4600w/,r7112w0)gIJN &/=<W
acrD;99/1l)'j+,a20s21}3/r88961/t<;20{31r32};:<8/+t//t:7AADDA>5644t74j7446:9#&=
95M1+^'"H
0.<*'[25272/x69:64/u>7=711y20z>9=;0,x64z9?ADGCC;;8+0m
*=6y;<00yipv
2)^948522|>4%"U//o9;<887/0z98:86283|=8FA?A7;8;55>;GKN[0+C)('
+%U875687wNOf
80;:;99898=<:;9;96>AFB,-^A=;787
+(g98?<LLa
"<8:<63~$'>85}:8::==JH[X_ab_ $<;598x
:7u99rbdd
y66Pon~74s673.llly*)[@9>BOJ
aef''F
==Q:9;:_
.1TD>MGosu
$W6<8
22TJEosx
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Pa%i5N23-
Uru4<E
7*Idu9M;
w3_^[r#MV
S7(hu#j
Hu6"
sG*DS,u
[b)+Nq(8V
2z7T2=H
$U^Ynboek
Z`Ca&\.q
y_sT]"
rjxY(X
J>>FA.
@1/2H
#hS{@;X
,+KjH@sQ#'7
DuH:-Wt
?P(L&H
%uC0KX@
RIP3EZ
zl>@^
t5;*V0(E
'nPPCx2tMsa^}(K
!Z-'6;2=2 @uV
dT)}&nAH+6J^ |
I--,@h
PWQSr
msvb]f\"
]A<f8Q@2I&ZhlkoM
5kEWo*0+m)
`3Q-vP2X: 
[+HAqp
licat@on eqr
u.T>he<cd
%s5lyvn}tAba6idS8DLG5Ld,al J3*WI'c,bus32M'agBoxAwFx3tf
kx8l?ExitPL
GtMT)l
t@Ac&v
P"<SH0&zI
`t$$|$(3
r+|$(|$
|(|Y%B
USQWVRW
ZPR3C 
Z^_Y[]
MSVBVM60.DLL
MethCallEngine
rtcAnsiValueBstr
rtcLowerCaseVar
rtcGetYear
rtcRandomNext
rtcRandomize
rtcDoEvents
rtcMidCharBstr
rtcMidCharVar
rtcSpaceBstr
EVENT_SINK_AddRef
rtcUpperCaseVar
DllFunctionCall
EVENT_SINK_Release
rtcShell
EVENT_SINK_QueryInterface
__vbaExceptHandler
rtcSplit
rtcReplace
rtcVarBstrFromAnsi
rtcMakeDir
rtcCreateObject2
ProcCallEngine
rtcBstrFromAnsi
rtcDir
rtcFileLength
rtcFileCopy
rtcErrObj
ThunRTMain
rtcLeftCharBstr
rtcLeftCharVar
rtcRightCharBstr
rtcRightCharVar
rtcGetDayOfMonth
rtcGetHourOfDay
rtcGetMinuteOfHour
rtcGetMonthOfYear
rtcGetPresentDate
rtcGetSecondOfMinute
136119202787201932618831310500164836103803455102061276221171361192027872019326188313105001648361038034551020612762211713611920278720193261883131050016483610380345510206127622117136119202787201932618831310500164836103803455102061276221171361192027872019326188313105001648361038034551020612762211713611920278720193261883131050016483610380345510206127622117
1&'(.25
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((((
:(((((((((((((((((((((((((((((((((((((((
((((((
((((((((((((((((((((((((
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
@@@@@@
@ngs\Administra
@@@@@@@@
@@@@@@
@@@@@@@@@@@@@@@
@@@@@@
@@@@ElParam
Error : 
Wscript.Shell
regwrite
\smss.exe
={2559~1
\Gaara.exe
\csrss.exe
 65500
 65500
LocationURL
694-24
/........
=================
 : 2.0 
 (3.06 
: 128 
 ( 512 
  : 9.0 
  9.0.
  10).
          ( 
255 0 0
REG_DWORD
325-11
1-08002
10318}\
RegDelete
325-11
1-08002
10318}\
7-08002
VS_VERSION_INFO
StringFileInfo
040904B0
Comments
http:/www.narutogames.com
FileDescription
Kazekage-Games-Action
ProductName
Gaara The Kazekage By : Paraysutki VM Community
Mission
Destroy HokageFile, KSpoold, AutoitV3, Autoruner, BlueFantasi, Sys, VBSvir, PornFile, and Kick Anbu-Team-Sampit
FileVersion
06.01.2008 (A) Update
ProductVersion
06.01.2008 (A) Update
InternalName
Kazekage Was Here
FileDescription
Kazekage Games Action
LegalCopyright
 Kota Cantik - Paray City
OriginalFilename
Kazekage of the Sand
VarFileInfo
Translation
1&'(.25
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((((
:(((((((((((((((((((((((((((((((((((((((
((((((
((((((((((((((((((((((((
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
@@@@@@
@ngs\Administra
@@@@@@@@
@@@@@@
@@@@@@@@@@@@@@@
@@@@@@
@@@@ElParam
Error : 
Wscript.Shell
regwrite
\smss.exe
={2559~1
\Gaara.exe
\csrss.exe
 65500
 65500
LocationURL
694-24
/........
=================
 : 2.0 
 (3.06 
: 128 
 ( 512 
  : 9.0 
  9.0.
  10).
          ( 
255 0 0
REG_DWORD
325-11
1-08002
10318}\
RegDelete
325-11
1-08002
10318}\
7-08002
VS_VERSION_INFO
StringFileInfo
040904B0
Comments
http:/www.narutogames.com
FileDescription
Kazekage-Games-Action
ProductName
Gaara The Kazekage By : Paraysutki VM Community
Mission
Destroy HokageFile, KSpoold, AutoitV3, Autoruner, BlueFantasi, Sys, VBSvir, PornFile, and Kick Anbu-Team-Sampit
FileVersion
06.01.2008 (A) Update
ProductVersion
06.01.2008 (A) Update
InternalName
Kazekage Was Here
FileDescription
Kazekage Games Action
LegalCopyright
 Kota Cantik - Paray City
OriginalFilename
Kazekage of the Sand
VarFileInfo
Translation
1&'(.25
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((((
:(((((((((((((((((((((((((((((((((((((((
((((((
((((((((((((((((((((((((
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
@@@@@@
@ngs\Administra
@@@@@@@@
@@@@@@
@@@@@@@@@@@@@@@
@@@@@@
@@@@ElParam
Error : 
Wscript.Shell
regwrite
\smss.exe
={2559~1
\Gaara.exe
\csrss.exe
 65500
 65500
LocationURL
694-24
/........
=================
 : 2.0 
 (3.06 
: 128 
 ( 512 
  : 9.0 
  9.0.
  10).
          ( 
255 0 0
REG_DWORD
325-11
1-08002
10318}\
RegDelete
325-11
1-08002
10318}\
7-08002
VS_VERSION_INFO
StringFileInfo
040904B0
Comments
http:/www.narutogames.com
FileDescription
Kazekage-Games-Action
ProductName
Gaara The Kazekage By : Paraysutki VM Community
Mission
Destroy HokageFile, KSpoold, AutoitV3, Autoruner, BlueFantasi, Sys, VBSvir, PornFile, and Kick Anbu-Team-Sampit
FileVersion
06.01.2008 (A) Update
ProductVersion
06.01.2008 (A) Update
InternalName
Kazekage Was Here
FileDescription
Kazekage Games Action
LegalCopyright
 Kota Cantik - Paray City
OriginalFilename
Kazekage of the Sand
VarFileInfo
Translation
1&'(.25
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((((
:(((((((((((((((((((((((((((((((((((((((
((((((
((((((((((((((((((((((((
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
@@@@@@
@ngs\Administra
@@@@@@@@
@@@@@@
@@@@@@@@@@@@@@@
@@@@@@
@@@@ElParam
Error : 
Wscript.Shell
regwrite
\smss.exe
={2559~1
\Gaara.exe
\csrss.exe
 65500
 65500
LocationURL
694-24
/........
=================
 : 2.0 
 (3.06 
: 128 
 ( 512 
  : 9.0 
  9.0.
  10).
          ( 
255 0 0
REG_DWORD
325-11
1-08002
10318}\
RegDelete
325-11
1-08002
10318}\
7-08002
VS_VERSION_INFO
StringFileInfo
040904B0
Comments
http:/www.narutogames.com
FileDescription
Kazekage-Games-Action
ProductName
Gaara The Kazekage By : Paraysutki VM Community
Mission
Destroy HokageFile, KSpoold, AutoitV3, Autoruner, BlueFantasi, Sys, VBSvir, PornFile, and Kick Anbu-Team-Sampit
FileVersion
06.01.2008 (A) Update
ProductVersion
06.01.2008 (A) Update
InternalName
Kazekage Was Here
FileDescription
Kazekage Games Action
LegalCopyright
 Kota Cantik - Paray City
OriginalFilename
Kazekage of the Sand
VarFileInfo
Translation
1&'(.25
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((((
:(((((((((((((((((((((((((((((((((((((((
((((((
((((((((((((((((((((((((
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
@@@@@@
@ngs\Administra
@@@@@@@@
@@@@@@
@@@@@@@@@@@@@@@
@@@@@@
@@@@ElParam
Error : 
Wscript.Shell
regwrite
\smss.exe
={2559~1
\Gaara.exe
\csrss.exe
 65500
 65500
LocationURL
694-24
/........
=================
 : 2.0 
 (3.06 
: 128 
 ( 512 
  : 9.0 
  9.0.
  10).
          ( 
255 0 0
REG_DWORD
325-11
1-08002
10318}\
RegDelete
325-11
1-08002
10318}\
7-08002
VS_VERSION_INFO
StringFileInfo
040904B0
Comments
http:/www.narutogames.com
FileDescription
Kazekage-Games-Action
ProductName
Gaara The Kazekage By : Paraysutki VM Community
Mission
Destroy HokageFile, KSpoold, AutoitV3, Autoruner, BlueFantasi, Sys, VBSvir, PornFile, and Kick Anbu-Team-Sampit
FileVersion
06.01.2008 (A) Update
ProductVersion
06.01.2008 (A) Update
InternalName
Kazekage Was Here
FileDescription
Kazekage Games Action
LegalCopyright
 Kota Cantik - Paray City
OriginalFilename
Kazekage of the Sand
VarFileInfo
Translation
1&'(.25
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((((
:(((((((((((((((((((((((((((((((((((((((
((((((
((((((((((((((((((((((((
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
@@@@@@
@ngs\Administra
@@@@@@@@
@@@@@@
@@@@@@@@@@@@@@@
@@@@@@
@@@@ElParam
Error : 
Wscript.Shell
regwrite
\smss.exe
={2559~1
\Gaara.exe
\csrss.exe
 65500
 65500
LocationURL
694-24
/........
=================
 : 2.0 
 (3.06 
: 128 
 ( 512 
  : 9.0 
  9.0.
  10).
          ( 
255 0 0
REG_DWORD
325-11
1-08002
10318}\
RegDelete
325-11
1-08002
10318}\
7-08002
VS_VERSION_INFO
StringFileInfo
040904B0
Comments
http:/www.narutogames.com
FileDescription
Kazekage-Games-Action
ProductName
Gaara The Kazekage By : Paraysutki VM Community
Mission
Destroy HokageFile, KSpoold, AutoitV3, Autoruner, BlueFantasi, Sys, VBSvir, PornFile, and Kick Anbu-Team-Sampit
FileVersion
06.01.2008 (A) Update
ProductVersion
06.01.2008 (A) Update
InternalName
Kazekage Was Here
FileDescription
Kazekage Games Action
LegalCopyright
 Kota Cantik - Paray City
OriginalFilename
Kazekage of the Sand
VarFileInfo
Translation
1&'(.25
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((((((((((((((((((((((
:(((((((((((((((((((((((((((((((((((((((
((((((
((((((((((((((((((((((((
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
@@@@@@
@ngs\Administra
@@@@@@@@
@@@@@@
@@@@@@@@@@@@@@@
@@@@@@
@@@@ElParam
Error : 
Wscript.Shell
regwrite
\smss.exe
={2559~1
\Gaara.exe
\csrss.exe
 65500
 65500
LocationURL
694-24
/........
=================
 : 2.0 
 (3.06 
: 128 
 ( 512 
  : 9.0 
  9.0.
  10).
          ( 
255 0 0
REG_DWORD
325-11
1-08002
10318}\
RegDelete
325-11
1-08002
10318}\
7-08002
VS_VERSION_INFO
StringFileInfo
040904B0
Comments
http:/www.narutogames.com
FileDescription
Kazekage-Games-Action
ProductName
Gaara The Kazekage By : Paraysutki VM Community
Mission
Destroy HokageFile, KSpoold, AutoitV3, Autoruner, BlueFantasi, Sys, VBSvir, PornFile, and Kick Anbu-Team-Sampit
FileVersion
06.01.2008 (A) Update
ProductVersion
06.01.2008 (A) Update
InternalName
Kazekage Was Here
FileDescription
Kazekage Games Action
LegalCopyright
 Kota Cantik - Paray City
OriginalFilename
Kazekage of the Sand
VarFileInfo
Translation

Process Tree

8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337847238cacaa16d840a19.exe (844) "C:\Users\Administrator\AppData\Local\Temp\8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337847238cacaa16d840a19.exe"

Search
8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337847238cacaa16d840a19.exe (844)

8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337847238cacaa16d840a19.exe, PID: 844, Parent PID: 1860

default registry file network process services synchronisation iexplore office pdf

Hosts

IP
114.114.114.114
8.8.8.8

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com		131.107.255.255

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	49642	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	61714	114.114.114.114	53
192.168.56.101	61714	8.8.8.8	53
192.168.56.101	56933	8.8.8.8	53
192.168.56.101	138	192.168.56.255	138
192.168.56.101	58485	114.114.114.114	53
192.168.56.101	58485	8.8.8.8	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name	4919e214d53fec09_24-9-2024.exe
Filepath	C:\Windows\SysWOW64\24-9-2024.exe
Size	872.2KB
Processes	844 (8d1a1e111522a63a0d0d7f9db7ca63f515b08bfc1337847238cacaa16d840a19.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
MD5	`9d9db662969e2443d60771a6a590849f`
SHA1	`26740ee8d016a7ef99d3be9e157e2199a79c48bb`
SHA256	`4919e214d53fec09fbb704c456a41661de772ad38ef512e05165d3950cd9ec5a`
CRC32	`4EEAFD17`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Sorry! No dropped buffers.