Static | ZeroBOX

PE Compile Time

2020-06-27 23:49:14

PE Imphash

8b07ad58d25a6b73f77cdd25f11dab2c

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0011e4c8 0x0011f000 5.89945715181
.data 0x00120000 0x00005858 0x00001000 0.0
.rsrc 0x00126000 0x00041454 0x00042000 6.02589725426

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00126884 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0012673c 0x00000148 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x00126510 0x0000022c LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library MSVBVM60.DLL:
0x401004 __vbaVarSub
0x401008 __vbaVarTstGt
0x40100c __vbaStrI2
0x401010 _CIcos
0x401014 _adj_fptan
0x401018 __vbaVarMove
0x40101c __vbaStrI4
0x401020 __vbaVarVargNofree
0x401024 __vbaFreeVar
0x401028 __vbaStrVarMove
0x40102c __vbaLenBstr
0x401030 __vbaLateIdCall
0x401034 __vbaFreeVarList
0x401038 __vbaEnd
0x40103c _adj_fdiv_m64
0x401040 EVENT_SINK_Invoke
0x401044 __vbaVarIndexStore
0x401048 __vbaFreeObjList
0x40104c __vbaStrErrVarCopy
0x401054 None
0x401058 _adj_fprem1
0x40105c None
0x401060 __vbaRecAnsiToUni
0x401064 None
0x401068 __vbaResume
0x40106c __vbaStrCat
0x401070 __vbaVarCmpNe
0x401074 __vbaForEachCollAd
0x401078 None
0x40107c None
0x401080 None
0x401084 __vbaLsetFixstr
0x401088 None
0x40108c __vbaStrDate
0x401090 __vbaSetSystemError
0x401098 __vbaNameFile
0x40109c None
0x4010a0 None
0x4010a4 None
0x4010a8 __vbaLenVar
0x4010ac _adj_fdiv_m32
0x4010b0 __vbaVarTstLe
0x4010b4 __vbaAryVar
0x4010b8 Zombie_GetTypeInfo
0x4010bc __vbaVarCmpGe
0x4010c0 __vbaAryDestruct
0x4010c4 __vbaLateMemSt
0x4010cc __vbaBoolStr
0x4010d0 None
0x4010d4 __vbaVarForInit
0x4010d8 __vbaExitProc
0x4010dc __vbaStrBool
0x4010e0 __vbaForEachCollObj
0x4010e4 None
0x4010e8 __vbaObjSet
0x4010ec None
0x4010f0 __vbaOnError
0x4010f4 None
0x4010f8 _adj_fdiv_m16i
0x4010fc __vbaObjSetAddref
0x401100 _adj_fdivr_m16i
0x401104 None
0x401108 __vbaVarIndexLoad
0x40110c None
0x401110 __vbaCyStr
0x401114 None
0x401118 __vbaForEachCollVar
0x40111c None
0x401120 __vbaBoolVar
0x401124 __vbaStrFixstr
0x401128 None
0x40112c None
0x401130 __vbaBoolVarNull
0x401134 __vbaFpR8
0x401138 __vbaVarTstLt
0x40113c __vbaRefVarAry
0x401140 __vbaVargVar
0x401144 _CIsin
0x401148 None
0x40114c __vbaVarZero
0x401150 __vbaLateMemStAd
0x401154 __vbaVarCmpGt
0x40115c __vbaChkstk
0x401160 __vbaCyVar
0x401164 EVENT_SINK_AddRef
0x401168 None
0x401170 __vbaCyI2
0x401174 __vbaStrCmp
0x401178 None
0x40117c __vbaVarTstEq
0x401180 __vbaAryConstruct2
0x401184 __vbaDateR8
0x401188 None
0x401190 __vbaObjVar
0x401194 __vbaI2I4
0x401198 None
0x40119c DllFunctionCall
0x4011a0 __vbaVarOr
0x4011a4 __vbaVarLateMemSt
0x4011a8 __vbaCastObjVar
0x4011ac __vbaRedimPreserve
0x4011b0 _adj_fpatan
0x4011b8 __vbaLateIdCallLd
0x4011c0 __vbaRedim
0x4011c4 __vbaStrR8
0x4011c8 __vbaRecUniToAnsi
0x4011cc EVENT_SINK_Release
0x4011d0 __vbaNew
0x4011d4 None
0x4011d8 __vbaUI1I2
0x4011dc _CIsqrt
0x4011e0 __vbaVarAnd
0x4011e8 __vbaVarMul
0x4011ec __vbaExceptHandler
0x4011f0 None
0x4011f4 __vbaStrToUnicode
0x4011f8 None
0x4011fc __vbaDateStr
0x401200 None
0x401204 _adj_fprem
0x401208 _adj_fdivr_m64
0x40120c __vbaVarDiv
0x401210 None
0x401214 None
0x401218 None
0x40121c None
0x401220 __vbaVarCmpLe
0x401224 None
0x401228 __vbaFPException
0x40122c __vbaInStrVar
0x401230 None
0x401234 __vbaStrVarVal
0x401238 __vbaUbound
0x40123c __vbaVarCat
0x401240 __vbaDateVar
0x401244 __vbaI2Var
0x401248 None
0x40124c None
0x401250 _CIlog
0x401254 __vbaErrorOverflow
0x401258 __vbaNew2
0x401260 __vbaInStr
0x401264 __vbaR8Str
0x401268 __vbaVarInt
0x40126c _adj_fdiv_m32i
0x401270 None
0x401274 _adj_fdivr_m32i
0x401278 __vbaVarSetObj
0x40127c __vbaStrCopy
0x401280 __vbaI4Str
0x401288 __vbaFreeStrList
0x40128c __vbaVarCmpLt
0x401290 _adj_fdivr_m32
0x401294 __vbaR8Var
0x401298 _adj_fdiv_r
0x40129c None
0x4012a0 None
0x4012a4 None
0x4012a8 None
0x4012ac __vbaVarTstNe
0x4012b0 __vbaVarSetVar
0x4012b4 __vbaI4Var
0x4012b8 __vbaVarCmpEq
0x4012bc __vbaVarLateMemStAd
0x4012c0 __vbaVarAdd
0x4012c4 __vbaLateMemCall
0x4012c8 __vbaAryLock
0x4012cc None
0x4012d0 __vbaFreeVarg
0x4012d4 __vbaStrToAnsi
0x4012d8 __vbaVarDup
0x4012dc None
0x4012e0 __vbaOnGoCheck
0x4012e4 __vbaVarCopy
0x4012ec __vbaVarTstGe
0x4012f0 None
0x4012f4 __vbaFpI4
0x4012fc __vbaLateMemCallLd
0x401300 None
0x401304 _CIatan
0x401308 None
0x40130c __vbaStrMove
0x401310 __vbaI2ErrVar
0x401314 __vbaCastObj
0x401318 __vbaAryCopy
0x40131c __vbaStrVarCopy
0x401320 None
0x401324 __vbaVarNeg
0x401328 None
0x40132c None
0x401330 _allmul
0x401338 None
0x40133c __vbaLateIdSt
0x401340 None
0x401344 _CItan
0x401348 None
0x40134c __vbaNextEachCollAd
0x401350 __vbaFPInt
0x401354 __vbaAryUnlock
0x401358 None
0x40135c __vbaVarForNext
0x401360 _CIexp
0x401364 __vbaFreeObj
0x401368 __vbaFreeStr
0x40136c None
0x401370 None

!This program cannot be run in DOS mode.
`.data
MSVBVM60.DLL
-C000-Project1
046}#2.
Last updated Mat 12 - 2016
/zB%dr
/&gOFj
kS{O;Gm
koRU&g
+u|7nP
jtXc9S
_?h_~p
_0[BaG
R&Vn,"
Y<1tF/
OsPplV
d]1#Nq
<FI]3b"
}f1;zB
<<~}o<
%"m]4r
M"p/KU
wwwwwwwwwwwwwwwwp
wwwwx8{w
xwwx8wwww9
51111111111s
{{{{{{{
s{s{s{ssssss
Hpn]3
_Gz|/7M+
uYVu+2
K-|h+B}^
[P?m/3
`8Qv5`
e(Z[RB
yy;+pk(
,@n;Ps
+inDQQD
{!.}8{
0cP2J
`}S!og?
.OKM(T
5}~i
DNM #~
)%7/=_y
&0U31&0
f_:%fM8
%V_94|
P`7;i8J,w
=(cpgo
fC+(,_
I8}Iu'
M;x)1w
>INE~}
H-k`+(
#_U]Y]
??B|;1j{q
XHCpb6
hy(01I
krImCd?
d03k}[
|K<?z
{{{899)S
8888888888888888888888888888888
8BBBRRRRRRRRRRRRRRRRRRRRRRRRRRRBRBB8
<RRXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXRR8
<XXXoXXoXXoXXoXXoXXoXXoXXoXXoXXoXXXXXE
8EXooooooooooooooooo
yooooooooooooXE8
=[oyssssssssssssssy
MLLLjyysssssssssss[=
E[xxxsoyoxo
s=[oosEgyoyoxsoxsoxs[I
(Loyyyyyyyyyg
j?lLsyyysbyyyyyyyyyyyygE(
gI[geg[l[gl
lblMllggIl
I[bljMb
ggljbg
H[1+^`^````````````````````````^^^^^^]'1[3
#############!#!# #!####""" #!"!"!
[6+55+555555+55555550................./6
#%%%%%%%%%%%%%%%%%%%%#
#&-....................-&#
$//000000000000000000000/$
a(===========J777@========(e
1,@A@AA@SSTP7(===2@@A@A@A@,1
=@T@QQA,,7,,27T@,T@T@QQA@=
7T@TTTT27TT27,22*7T@TT@ST7
,JTSTJTJT2JJ777LLGPTTTTSSTT)
6WxxxxxxxS7@TPJ@SS7PPPPSUPJ6
YLrP6x\
yhimtzzzzzzzzzzzzzzzzzzzzzzzzzztmi
cJTPSSSSSSSSSP@JProoroooDD!
dmtyz|||||||ym^
ir|}}}|||||z|o
&&&&&&&&($$(&&&&&&
)))))22#
&(()))))
L!8888)
#)!!)!)88888!L
E#<<2<5#82#"1"55<5<22E
?XXXXX<5752??2S<7775
`ccccc`8X??jq[bccbZ7
-oooopoo]ttYB`[hooopo-
XssssssslmllsssssssssX
NNNNNNNNNNNNOO
v|}zz{{xxx
CCCCCCCCC
27QQQQQQQ5AIIffIJIG
NWWWWWWWW7
20-+
699997;0869993
'>BBBB;=?BBBBB>(&IIIHIIIIIIHIHI&">?B?B@@@@?B?B>"
):G::DDEEEFC
!/////*
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
@rRC'C&
&5Lj3v
e">)F<
t&h-H&h
z=eHR
zeZ#bI
1|>!1*
\\L9sJ33
6vPZW}lj
CDs;"b
"""FB(o
/4~V=8""btx
g=""b$
N^rq]G
@k3aqZ
eA/ORI
)1]k?'d
e4"\ats
p=pa\(
(;%X(ZW
29)_N>
Command1
PRESS this button to repair it NOW.
Arial)
cmdDeleee
yyou can delete
txtPath
Command13
force downllado files to see wht coems down
txtBackupTime
Command13
txtJun6
txtJunk
Command10
Command10
txtappname
TXTjUNK2
cmdSleepr
cmdSetVbNormalAndClean
cmd set vbnormal and Clean
lstReat
cmdBestKillZipDia
delte zip_dia
boottime
Command8
teser tester button. for misc launh.. can ereae if you want...
cmdrebjotgg
should we reboot
Command7
Command7
Command6
Command6
Command4
force FHD bu
Command3
Command3
Command3898
Command344
Command3
Frame2
cmdFixQrys
Error : Cant find Qry...
Arial)
cmdOpenAccess
Error : Unrecognized...
Arial)
cmdShortCut
Desktop Icons Missing
Arial)
cmdGrabMissingFiles
Grab missing files...
Arial)
Command5
more >
lstFiles
CashRegisterLog.dot
ClientRet.dot
confimList.dot
DailyAppointments.dot
Employee_Performance.dot
EmployeePayout.dot
expenses.dot
IndiSched.dot
indischedB.dot
Inventory.dot
printlists.dot
TheConfirmList.dot
standbylist.dot
BoothRenter.dot
CashRegisterLogHST.dot%
CashRegisterLog_AccountSummaryHST.dot
itemssold.xls
itemsworth.xls"
CashRegisterLog_AccountSummary.dot
ntsmini.dot!
Arial,
Command3d
Command3
Picture1
Adobe Photoshop 7.0
2010:10:09 05:48:27
Adobe_CM
dEU6te
'7GWgw
(Photoshop 3.0
boundsObjc
Top long
Leftlong
Btomlong
Rghtlong
slicesVlLs
sliceIDlong
groupIDlong
originenum
ESliceOrigin
autoGenerated
Typeenum
ESliceType
boundsObjc
Top long
Leftlong
Btomlong
Rghtlong
urlTEXT
nullTEXT
MsgeTEXT
altTagTEXT
cellTextIsHTMLbool
cellTextTEXT
horzAlignenum
ESliceHorzAlign
default
vertAlignenum
ESliceVertAlign
default
bgColorTypeenum
ESliceBGColorType
topOutsetlong
leftOutsetlong
bottomOutsetlong
rightOutsetlong
Adobe_CM
dEU6te
'7GWgw
Hhttp://ns.adobe.com/xap/1.0/
<?xpacket begin='
' id='W5M0MpCehiHzreSzNTczkc9d'?>
<?adobe-xap-filters esc="CR"?>
<x:xapmeta xmlns:x='adobe:ns:meta/' x:xaptk='XMP toolkit 2.8.2-33, framework 1.5'>
<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='http://ns.adobe.com/iX/1.0/'>
<rdf:Description about='uuid:12c7e180-d321-11df-9f18-8ac7e73dc409'
xmlns:xapMM='http://ns.adobe.com/xap/1.0/mm/'>
<xapMM:DocumentID>adobe:docid:photoshop:12c7e17e-d321-11df-9f18-8ac7e73dc409</xapMM:DocumentID>
</rdf:Description>
</rdf:RDF>
</x:xapmeta>
<?xpacket end='w'?>
DTsEF7Gc(UVW
u*9:HIJXYZghijvwxyz
(GWf8v
*:JZjz
cmmdfem
force em only
Command12
Command11
Command11
Timer44
close svchost
cmREfe
fake me
cmdListEe
list exes
dffffffffffffffffffff
Timer3
cmdEmailFHD
EmailFHD
Command9
Command9
txtAttach
Command4444
fix 2 txt files
Command355
renameitself
InetCtlsObjects.Inet
cmdMakeiconsTest
Make icons
cmdReconect
reconect map drive
Picture3
lblupdating
Timer2
txtvid
txtThresh
txtupdateing
cmsSMS
cmduload
cndCopy
txtErr
txtURL
http://www.salonmarketing.ca/diaclients/Thedoitallsalon.exe?kl=kk
cmdRename
renam old vers
Frame1
Frame1
Label12
User# 1239 - unload Jul 31 2011
Label10
Please Wait....
Timer1
Command2
Command2
InetCtlsObjects.Inet
lblShutdown
Label29
lblOpenDoitall
Label29
lblLiveUpdate
LiveUpdate
Label27
Hour and Miunt for remidner to launch
lblTimeForReminders
00:00: AM
lblOverrideDate
Label21
lblOverideValue
Label20
overidehour
lblStats
Label20
Label19
Label19
lblResult
Label19
Label18
repost ICONS every X min
Label17
chekc for repairs evey X min
lblmycustom
Label17
Label16
mycustompath=
Label11
FHD BU section -------------->
lblFHDready
lblDateTimeToupdate
Label8
date time requested to update on
lblLastupdated
Label3
last updated here
Label2
Label1
lblVid
lblSec
lblMin
Label15
Label15
Label13
Label13
Label9
Label9
Label7
Label5
InetCtlsObjects.Inet
Label30
june 17-2020 no more your-cash-balance site removed.
lblTilNow
lblTilNow
lblStarted
lblStarted
Label29
MS Sans Serif
lblShutMins
Label29
lblRnMinForCloud2
Label29
lblDownIn
Label29
lblRealMinsOpen
Label29
lblTheVerison
SIL+ May.1 2017
lblBootUpCheck
BootupCheck
lblOnlinebookingStatus
online booiking
lbluploadSeconds
lblApptbook
lblApptbook
lblRndSec
lblRndMin
Label28
random MIN +sec to do webupdate
lblVar
Label26
Last hour we did Variable
Label25
Label25
lblLast
Label25
Label23
last datetime sql was updated....
Label24
criiinfo
lblCripInfo
Label23
Label22
Label22
lblRelaxTrue
lblRelaxTrue
FourtyFiveMinrouteen
45minRouteen
Label21
Label21
Label14
lblRoot
Label6
Label6
Label4
Label4
doitallmain
doitallmain
Project1
COMDLG32.OCX
MSComDlg.CommonDialog
CommonDialog
MSCOMCTL.OCX
MSComctlLib.ProgressBar
ProgressBar
MSINET.OCX
InetCtlsObjects.Inet
Project1
Module1Main
Module1LikeOG
frmSubAudSendEmailBACKUPfiles
frmstats
frmshutdown2
modgetusername
frmblockALL
frmEror
frmMain
frmBlackall
sfModer
weirdmodul
Module4RegStuff
txtAttach
Timer2
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
lblBootUpCheck
lblRndMin
lblRnMinForCloud2
lblRndSec
lstReat
lblTheVerison
Label2
txtupdateing
lblApptbook
lbluploadSeconds
cmduload
txtPath
lblOnlinebookingStatus
lblVid
txtvid
Label1
lblLastupdated
Timer1
Timer44
Timer3
cmdReconect
Label18
lblCripInfo
lblDateTimeToupdate
Label13
Label19
lblLiveUpdate
Label14
Label12
Label16
Label25
Command11
Label26
Label3
Label23
Label24
cmdEmailFHD
Command12
Label27
cmdListEe
Command13
4'6DC:\Windows\SysWow64\MSINET.oca
InetCtlsObjects
Label17
Label15
cmdBestKillZipDia
cmdDeleee
cmmdfem
Command2
Command3
Command5
Command6
Command7
Command4
Command10
Label21
Label22
txtJunk
Label20
lblOverrideDate
cmdrebjotgg
Command3898
cmdOpenAccess
Command344
Command4444
Command3d
lblDownIn
cmdMakeiconsTest
lblVar
Command8
Picture3
dffffffffffffffffffff
lblStats
Label30
lblTimeForReminders
Command9
cmdGrabMissingFiles
lblOverideValue
cmsSMS
Label9
Command355
txtURL
Label7
cmdSleepr
cmdShortCut
Frame1
Label10
Label6
lblResult
txtappname
Command1
cmREfe
txtBackupTime
lblupdating
lblRealMinsOpen
txtJun6
lblRoot
Label11
cmdFixQrys
lblFHDready
lblSec
cmdSetVbNormalAndClean
Label28
Label29
lstFiles
lblTilNow
lblLast
lblShutMins
lblMin
cndCopy
cmdRename
txtErr
lblShutdown
Frame2
TXTjUNK2
boottime
lblmycustom
lblOpenDoitall
lblStarted
Picture1
lblRelaxTrue
Label8
Label4
Label5
txtThresh
FourtyFiveMinrouteen
user32
InvalidateRect
PostMessageA
FindWindowA
SetWindowPos
kernel32
ShowCursor
BlockInput
OnlineBookingDownload
shell32.dll
ShellExecuteA
urlmon
URLDownloadToFileA
DELETEQ
whatstheip
KillPrevSavedPostIt
CheckThingsList
CreateEmptyZip
checkremoteaccess
IsHosthopen
CloseDuplicateHost
ThirdPartyAppsRelax
downice2
CloseAPP_B
ToSeeIfSMSWentOutYet
IAmAliveRead
quickcheckToSeeIfDateChangForMobileDevice
grabfilesweneed
mailMarkThegrab
UpdateWeSentCrashReport
fAKEME
SystemParametersInfoA
FatalAppExitA
FatalExit
FindWindowExA
ShowWindow
GetTickCount
GetVolumeInformationA
GetProfileStringA
winmm.dll
mciSendStringA
sndPlaySoundA
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
advapi32.dll
GetUserNameA
ComCtl32.OCX
DllRegisterServer
dComCtl32.OCX
DllUnregisterServer
kernel32.dll
GetDiskFreeSpaceA
RegOpenKeyExA
RegCloseKey
advapi32
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
ExitWindowsEx
GetSystemMetrics
lstWeekDays
picbox
cmdUploadthisPic
cmdSortAndDeleteWeekDays
lsbShort
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
GetSystemPaletteEntries
CreatePalette
SelectObject
BitBlt
DeleteDC
GetForegroundWindow
SelectPalette
RealizePalette
GetWindowDC
GetWindowRect
ReleaseDC
GetDesktopWindow
olepro32.dll
OleCreatePictureIndirect
CreateBitmapPicture
FC:\Windows\SysWOW64\stdole2.tlb
stdole
CaptureWindow
CaptureScreen
txtsmtpauth1
Label3735365
txtToDisplayName
__vbaAryLock
VBA6.DLL
__vbaOnGoCheck
__vbaAryVar
__vbaAryCopy
__vbaNextEachCollAd
__vbaForEachCollAd
__vbaVarLateMemSt
__vbaLsetFixstr
__vbaStrFixstr
__vbaRecAnsiToUni
__vbaRecUniToAnsi
__vbaVarLateMemStAd
__vbaVargVar
__vbaAryDestruct
__vbaCastObj
__vbaNextEachCollObj
__vbaBoolVar
__vbaGenerateBoundsError
__vbaCastObjVar
__vbaForEachCollObj
__vbaAryConstruct2
__vbaFpI4
__vbaLateIdCall
__vbaLateIdSt
__vbaVarTstLe
__vbaVarCmpLe
__vbaVarCmpGe
__vbaDateStr
__vbaR8Str
__vbaStrR8
__vbaInStr
__vbaRefVarAry
__vbaUbound
__vbaStrI4
__vbaVarCmpNe
TXTEmailText
__vbaDateR8
__vbaVarTstLt
__vbaEnd
__vbaInStrVar
__vbaVarTstGt
__vbaStrBool
__vbaLenVar
__vbaVarTstGe
__vbaLateIdCallLd
__vbaVarCmpLt
__vbaFpR8
__vbaVarCmpGt
__vbaVarOr
__vbaI4Var
__vbaStrI2
__vbaI2I4
__vbaVarCmpEq
__vbaVarAnd
__vbaBoolVarNull
__vbaVarIndexLoad
__vbaAryUnlock
__vbaVarIndexLoadRefLock
__vbaVarLateMemCallLd
__vbaDateVar
__vbaLateMemStAd
__vbaVarLateMemCallSt
__vbaVarLateMemCallLdRf
__vbaNew
__vbaLateMemCall
__vbaVarZero
__vbaVarSetVar
__vbaNew2
__vbaVarTstNe
__vbaVarCopy
__vbaStrVarCopy
__vbaLateMemSt
__vbaLateMemCallLd
__vbaObjVar
__vbaObjSetAddref
__vbaStrCmp
__vbaVarSetObj
__vbaVarTstEq
__vbaErrorOverflow
__vbaExitProc
__vbaResume
__vbaVarForNext
__vbaFreeObjList
__vbaI2Var
__vbaVarForInit
__vbaOnError
__vbaI4Str
__vbaVarDup
__vbaStrToUnicode
__vbaSetSystemError
__vbaStrVarVal
__vbaStrToAnsi
__vbaStrCopy
__vbaLenBstr
__vbaFreeStrList
__vbaVarCat
__vbaStrVarMove
__vbaNameFile
__vbaFreeStr
__vbaStrCat
__vbaFreeVarList
__vbaVarSub
__vbaVarMul
__vbaVarAdd
__vbaI2ErrVar
__vbaFreeVar
__vbaVarMove
__vbaFreeObj
__vbaObjSet
__vbaStrMove
__vbaHresultCheckObj
__vbaNextEachCollVar
__vbaRedimPreserve
__vbaForEachCollVar
txtPort2
txtDisplayname
Label5353
Label9535
Label353
Label423535
txtSubject
lstStatus
txtsmtp
Label29353
Label7353
txtsendusing
txtSendTrigger
txtSMTP2
txtISPPort
>txtStats
txtcronsales
TXTEMAILTO
txtPass
txtISPPass
txtUser
txtISPLogin
txtEmailISP
__vbaFixstrConstruct
txtEmailAddressReply
txtFrom
__vbaVarSetObjAddref
__vbaLateMemNamedCall
__vbaVarIndexStore
vbSendMail
txtMessage
__vbaStrDate
C:\Windows\SysWow64\vbSendMail.dll
__vbaVarDiv
txtSubject2
__vbaVarIndexLoadRef
__vbaFPInt
__vbaVarInt
__vbaRedim
__vbaCyStr
__vbaCyVar
__vbaVarVargNofree
poSendMail
txtssl
__vbaBoolStr
__vbaCyI2
__vbaFreeVarg
__vbaStrErrVarCopy
__vbaVarNeg
__vbaR8Var
Frame556
Label25365
mSProgressBar1
C:\Windows\SysWow64\MSCOMCTL.oca
MSComctlLib
ProgressBar2
lblProgress
lblProgress2
Frame6
poSendMail_Progress
poSendMail_Status
__vbaUI1I2
frmblockALL
frmBlackall
frmshutdown2
bandwidth
Label1
bandwith exceeded.... shutting down
frmstats
txtcronsales
txtStats
Label2
cron sales
Label1
frmEror
Timer1
ProgressBar1
MSComctlLib.ProgressBar
Label4
Please use the Proper Windows Shutdown to avoid data loss
MS Sans Serif
Label3
SUCCESS
MS Sans Serif
Label2
We will try to recover DOITALL database.
MS Sans Serif
Label1
Windows has recovered from an unexpected shutdown
MS Sans Serif
frmSubAudSendEmailBACKUPfiles
FILES ONLY...
Frame6
Frame6
txtsmtpauth1
txtPort2
txtsendusing
txtssl
txtsmtp
mail.salonmarketing.ca
txtPass
salon1
txtUser
salon1@salonmarketing.ca
Label13
smtpAuth
Label12
Label11
sendusing
Label10
Label9
Label8
txtSendTrigger
lstStatus
Command1
Command1
Frame556
Company Internet Information
txtISPPort
txtSMTP2
Combo1
smtp10.bellnet.ca
smtp.broadband.rogers.com!
txtISPPass
txtISPLogin
txtFrom
txtEmailISP
txtEmailAddressReply
TXTEMAILTO
TXTEmailText
txtMessage
txtSubject2
txtDisplayname
txtSubject
txtToDisplayName
txtAttach
Label7353
SMTP PORT#
Label3735365
Email login (given to you by I.S.P.) Email pass (given to you from I.S.P.)
Label5353
From displayname
Label29353
Email ISP
Label9535
ReplyTo
Label25365
Recpiant
Label353
Email Txt
Label423535
Subject2
Label1
Disp.Name
Label2
Subject
Frame1
Frame1
cmDialog
MSComDlg.CommonDialog
ProgressBar2
MSComctlLib.ProgressBar
ProgressBar1
MSComctlLib.ProgressBar
CommonDialog1
MSComDlg.CommonDialog
lblProgress
Message Progress
lblProgress2
Total Job Progress
frmMain
picbox
cmdUploadthisPic
upload the 1 min photo to directory ftp
lstWeekDays
cmdSortAndDeleteWeekDays
populate days in the box so we can decide which folders to delte--->
lsbShort
Picture1
Adobe Photoshop 7.0
2010:10:09 05:48:27
Adobe_CM
dEU6te
'7GWgw
(Photoshop 3.0
boundsObjc
Top long
Leftlong
Btomlong
Rghtlong
slicesVlLs
sliceIDlong
groupIDlong
originenum
ESliceOrigin
autoGenerated
Typeenum
ESliceType
boundsObjc
Top long
Leftlong
Btomlong
Rghtlong
urlTEXT
nullTEXT
MsgeTEXT
altTagTEXT
cellTextIsHTMLbool
cellTextTEXT
horzAlignenum
ESliceHorzAlign
default
vertAlignenum
ESliceVertAlign
default
bgColorTypeenum
ESliceBGColorType
topOutsetlong
leftOutsetlong
bottomOutsetlong
rightOutsetlong
Adobe_CM
dEU6te
'7GWgw
Hhttp://ns.adobe.com/xap/1.0/
<?xpacket begin='
' id='W5M0MpCehiHzreSzNTczkc9d'?>
<?adobe-xap-filters esc="CR"?>
<x:xapmeta xmlns:x='adobe:ns:meta/' x:xaptk='XMP toolkit 2.8.2-33, framework 1.5'>
<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='http://ns.adobe.com/iX/1.0/'>
<rdf:Description about='uuid:12c7e180-d321-11df-9f18-8ac7e73dc409'
xmlns:xapMM='http://ns.adobe.com/xap/1.0/mm/'>
<xapMM:DocumentID>adobe:docid:photoshop:12c7e17e-d321-11df-9f18-8ac7e73dc409</xapMM:DocumentID>
</rdf:Description>
</rdf:RDF>
</x:xapmeta>
<?xpacket end='w'?>
DTsEF7Gc(UVW
u*9:HIJXYZghijvwxyz
(GWf8v
*:JZjz
Label1
Days to Sort
Label2
Duplicate Names (fodler Names that match the index
AppNameOfExe
hWndSrc
Client
LeftSrc
TopSrc
WidthSrc
HeightSrc
lPercentCompete
status
jXh WE
} jXh WE
}#jdhHfE
}#j$hl
}#jPhl
}#jThl
}#jThl
}#jThl
}#j<hl
}#jdhHfE
} jTh WE
}#jThHfE
jXh WE
VVVVVQ
} j|h WE
} jth WE
} jTh WE
}#j\hP
}#jdhP
}#j\hP
}#jdhP
}#j\hP
}#jdhP
}#j,hP
} jXh WE
} jXh WE
j|h WE
jXh WE
jXh WE
jXh WE
jXh WE
jXh WE
jXh WE
jdhHfE
jXh WE
jXh WE
jXh WE
jXh WE
j|h WE
}#j,hP
XQh@xE
}#j,hP
}#j,hP
}#jThHfE
}#j,hP
}#j,hP
}#j,hP
}#j,hP
}#j,hP
}#j,hP
}#j,hP
}#j,hP
}#j,hP
}#j,hP
}#j,hP
}#j,hP
}#jThHfE
}#jThHfE
}#j,hP
}#j,hP
} jXh WE
}#j,hP
} jXh WE
} jXh WE
} jXh WE
}#jThHfE
}#j,hP
} jXh WE
} jXh WE
}#j,hP
}#j,hP
} jXh WE
}#j,hP
} jXh WE
} jTh WE
} jTh WE
} jTh WE
PVhT(F
}#j$hl
}#jPhl
}#jThl
}#jThl
}#jThl
}#jThl
}#jThl
}#jThl
}#j$hl
}#jPhl
}#jhhl
}#jThl
}#jhhl
}#jhhl
}#jThl
}#jThl
}#jThl
}#jhhl
}#jhhl
}#jhhl
}#jhhl
}#jhhl
}#jhhl
}#jThl
}#jThl
}#jThl
}#jThl
}#jThl
}#jThl
}#jThl
}#jThl
}#jhhl
}#jhhl
}#jThl
}#jThl
}#jThl
}#jThl
}#j<hl
}#j$hl
}#jPhl
}#jhhl
}#jThl
}#jThl
}#jThl
}#jThl
}#jThl
}#j,hP
MSVBVM60.DLL
EVENT_SINK_GetIDsOfNames
__vbaVarSub
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaLateIdCall
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
EVENT_SINK_Invoke
__vbaVarIndexStore
__vbaFreeObjList
__vbaStrErrVarCopy
__vbaVarIndexLoadRef
_adj_fprem1
__vbaRecAnsiToUni
__vbaResume
__vbaStrCat
__vbaVarCmpNe
__vbaForEachCollAd
__vbaLsetFixstr
__vbaStrDate
__vbaSetSystemError
__vbaHresultCheckObj
__vbaNameFile
__vbaLenVar
_adj_fdiv_m32
__vbaVarTstLe
__vbaAryVar
Zombie_GetTypeInfo
__vbaVarCmpGe
__vbaAryDestruct
__vbaLateMemSt
__vbaVarIndexLoadRefLock
__vbaBoolStr
__vbaVarForInit
__vbaExitProc
__vbaStrBool
__vbaForEachCollObj
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
__vbaCyStr
__vbaForEachCollVar
__vbaBoolVar
__vbaStrFixstr
__vbaBoolVarNull
__vbaFpR8
__vbaVarTstLt
__vbaRefVarAry
__vbaVargVar
_CIsin
__vbaVarZero
__vbaLateMemStAd
__vbaVarCmpGt
__vbaNextEachCollObj
__vbaChkstk
__vbaCyVar
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaCyI2
__vbaStrCmp
__vbaVarTstEq
__vbaAryConstruct2
__vbaDateR8
__vbaNextEachCollVar
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarOr
__vbaVarLateMemSt
__vbaCastObjVar
__vbaRedimPreserve
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
__vbaStrToUnicode
__vbaDateStr
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
__vbaVarCmpLe
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaDateVar
__vbaI2Var
_CIlog
__vbaErrorOverflow
__vbaNew2
__vbaVarLateMemCallLdRf
__vbaInStr
__vbaR8Str
__vbaVarInt
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
__vbaStrCopy
__vbaI4Str
__vbaLateMemNamedCall
__vbaFreeStrList
__vbaVarCmpLt
_adj_fdivr_m32
__vbaR8Var
_adj_fdiv_r
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
__vbaVarLateMemStAd
__vbaVarAdd
__vbaLateMemCall
__vbaAryLock
__vbaFreeVarg
__vbaStrToAnsi
__vbaVarDup
__vbaOnGoCheck
__vbaVarCopy
__vbaVarLateMemCallLd
__vbaVarTstGe
__vbaFpI4
__vbaVarSetObjAddref
__vbaLateMemCallLd
_CIatan
__vbaStrMove
__vbaI2ErrVar
__vbaCastObj
__vbaAryCopy
__vbaStrVarCopy
__vbaVarNeg
_allmul
__vbaVarLateMemCallSt
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaFPInt
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
@rRC'C&
&5Lj3v
e">)F<
t&h-H&h
z=eHR
zeZ#bI
1|>!1*
\\L9sJ33
6vPZW}lj
CDs;"b
"""FB(o
/4~V=8""btx
g=""b$
N^rq]G
@k3aqZ
eA/ORI
)1]k?'d
e4"\ats
p=pa\(
(;%X(ZW
29)_N>
20-+
699997;0869993
'>BBBB;=?BBBBB>(&IIIHIIIIIIHIHI&">?B?B@@@@?B?B>"
):G::DDEEEFC
!/////*
&&&&&&&&($$(&&&&&&
)))))22#
&(()))))
L!8888)
#)!!)!)88888!L
E#<<2<5#82#"1"55<5<22E
?XXXXX<5752??2S<7775
`ccccc`8X??jq[bccbZ7
-oooopoo]ttYB`[hooopo-
XssssssslmllsssssssssX
NNNNNNNNNNNNOO
v|}zz{{xxx
CCCCCCCCC
27QQQQQQQ5AIIffIJIG
NWWWWWWWW7
#%%%%%%%%%%%%%%%%%%%%#
#&-....................-&#
$//000000000000000000000/$
a(===========J777@========(e
1,@A@AA@SSTP7(===2@@A@A@A@,1
=@T@QQA,,7,,27T@,T@T@QQA@=
7T@TTTT27TT27,22*7T@TT@ST7
,JTSTJTJT2JJ777LLGPTTTTSSTT)
6WxxxxxxxS7@TPJ@SS7PPPPSUPJ6
YLrP6x\
yhimtzzzzzzzzzzzzzzzzzzzzzzzzzztmi
cJTPSSSSSSSSSP@JProoroooDD!
dmtyz|||||||ym^
ir|}}}|||||z|o
8888888888888888888888888888888
8BBBRRRRRRRRRRRRRRRRRRRRRRRRRRRBRBB8
<RRXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXRR8
<XXXoXXoXXoXXoXXoXXoXXoXXoXXoXXoXXXXXE
8EXooooooooooooooooo
yooooooooooooXE8
=[oyssssssssssssssy
MLLLjyysssssssssss[=
E[xxxsoyoxo
s=[oosEgyoyoxsoxsoxs[I
(Loyyyyyyyyyg
j?lLsyyysbyyyyyyyyyyyygE(
gI[geg[l[gl
lblMllggIl
I[bljMb
ggljbg
H[1+^`^````````````````````````^^^^^^]'1[3
#############!#!# #!####""" #!"!"!
[6+55+555555+55555550................./6
Hpn]3
_Gz|/7M+
uYVu+2
K-|h+B}^
[P?m/3
`8Qv5`
e(Z[RB
yy;+pk(
,@n;Ps
+inDQQD
{!.}8{
0cP2J
`}S!og?
.OKM(T
5}~i
DNM #~
)%7/=_y
&0U31&0
f_:%fM8
%V_94|
P`7;i8J,w
=(cpgo
fC+(,_
I8}Iu'
M;x)1w
>INE~}
H-k`+(
#_U]Y]
??B|;1j{q
XHCpb6
hy(01I
krImCd?
d03k}[
|K<?z
{{{899)S
51111111111s
{{{{{{{
s{s{s{ssssss
wwwwwwwwwwwwwwwwp
wwwwx8{w
xwwx8wwww9
/zB%dr
/&gOFj
kS{O;Gm
koRU&g
+u|7nP
jtXc9S
_?h_~p
_0[BaG
R&Vn,"
Y<1tF/
OsPplV
d]1#Nq
<FI]3b"
}f1;zB
<<~}o<
%"m]4r
M"p/KU
JeKuKuK
Untitled-1
Adobe Photoshop
Adobe Photoshop 7.0
R*\AC:\Doitall-xvb\00 00 00vb doitallmain -Update-Doutalll-AutoSilent\doitallmain .vbp
28C4C820-401A-101B-A3C9-08002B2F49FB
9368265E-85FE-11d1-8BE3-0000F8754DA1
78E1BDD1-9941-11cf-9756-00AA00C00908
\FIX DO IT ALL.lnk
talentdataFULL.2dl
winword.exe
talentdataFULL.2dl - DEL-q
paymentdataFULL.2dl
paymentdataFULL.2dl - DEL-q
\talentdataFULL.2dl
StartMenu
SpecialFolders
Startup
Desktop
http://www.salonmarketing.ca/diaclients/talentdataFULL.2dl
?customvar=%
\paymentdataFULL.2dl
http://www.salonmarketing.ca/diaclients/paymentdataFULL.2dl
qry fixed
sucess!
failed call do it all
not done
http://www.salonmarketing.ca/diaclients/Thedoitallsalon.exe
http://www.salonmarketing.ca/diaclients/
WScript.Shell
CreateShortcut
\q.exe
TargetPath
IconLocation
FIX DO IT ALL!
Description
WorkingDirectory
FIX DO IT ALL.lnk
\web-fix doitall.lnk
http://www.salonmarketing.ca/q.exe
\Multi-DOITALL.exe
\THE DO IT ALL.lnk
\Thedoitallsalon.exe
Thedoitallsalon.exe
DO IT ALL
THE DO IT ALL
THE DO IT ALL.lnk
THE DO root2 ALL
\Email-sms-Hist DO IT ALL.lnk
\AutomatedMessageHistory
Email-sms-Hist DO IT ALL
AutomatedMessageHistory
Please enter password:
(try to recover corrupt database)
modern
Wrong passowrd
try again or call doitall 1-866-931-8854
TalentData.2dl
Thedoitallsalon2.exe
msaccess.exe
talentdata.2dl
paymentdata.2dl
doitallserver.exe
http://www.salonmarketing.ca/diaclients/q.exe
?ftpvar=%
C:\Program Files\Internet Explorer/iexplore.exe
Thedoitallsalon.exe - DELETE
\zip_dia
c:\diaocx\zip_dia
FIX DO IT ALL
\FIX DO IT ALL.exe.lnk
Microsoft.Jet.OLEDB.4.0
Data Source=
\TalentData.2dl;
\zip_dia\talentdata.2dl
SELECT * FROM tblcompanyinfo
CompanyName
telephone
Address
\repair
Please Wait..
Scripting.FileSystemObject
\talentdata.2dl
CopyFile
\PaymentData.2dl
\zip_dia\PaymentData.2dl
\mainscreen.jpg
\zip_dia\mainscreen.2dl
\*.dat
\*.txt
\*.2d1
\*.doc
c:\diaocx\
medium date
-talentdata-
REPAIR
Shell.Application
Namespace
CopyHere
zip_dia
zip folder
CDO.Message
CDO.Configuration
http://schemas.microsoft.com/cdo/configuration/
Fields
sendusing
mail.doitallsoftware.ca
smtpserver
smtpserverport
mark@doitallsoftware.ca
sendusername
mark78
sendpassword
smtpusessl
smtpauthenticate
Update
Configuration
mark@salonmarketing.ca
ReplyTo
support@doitallsoftware.ca
long date
Subject
zipfolder
textbody
AddAttachment
short date
\today_em.txt
today_em.txt
OpenTextFile
AtEndOfStream
ReadLine
general date
whats up
svchostt.exe
_Text_Message.exe
Text_Message.exe
delete_Text_Message.exe
\Text_Message.exe
http://www.salonmarketing.ca/diaclients/Text_Message.exe
Please Wait...
found this root
Updating Wait...
c:\diaocx\t.mdb
c:\diaocx\t.mdb - DELETE
\Thedoitallsalon.exe - DELETE
_Thedoitallsalon.exe
doitalmain.exe
doitallmain.exe
delete_doitallmain.exe
doitallmainpic.jpg
\doitallserver.exe
50-webs
http://www.salonmarketing.ca/diaclients/doitallmainpic.jpg
\doitallmainpic.jpg
\doitallmain.exe
c:\diaOCX\t.mdb
Thedoitallsalon3.exe
http://www.salonmarketing.ca/diaclients/t.mdb
q.exe - DEL-q
\DEL-q
barcode.rtf
http://www.salonmarketing.ca/diaclients/doitallserver.exe
\updatelog.txt
updatelog.txt
\Thedoitallsalon3.exe
\avery.mdb
avery.mdb
http://www.salonmarketing.ca/diaclients/avery.2dl
\barcode.rtf
http://www.salonmarketing.ca/diaclients/barcode.rtf.2dl
\*del-q*
*del-q*
DeleteFolder
\diamain.exe
\diamain2.exe
http://www.salonmarketing.ca/diaclients/nobody.html
skype.exe
*delete*
*del-*
bubble
Shell_traywnd
c:\diaocx\bookv.dat
v3 with reboot dec 27-2013
http://www.salonmarketing.ca/diaclients/dia-reportallfeatures_update_fhd.php?companynamid=
medium time
c:\diaocx\root.txt
urling
liciou
regedit.exe
regedit
msconfig
taskmgr
C:\doitall-xvb\xvb.vbp
diaocx\xxx.txt
Software\Microsoft\Windows\currentversion\Explorer\advanced
Hidden
Software\Microsoft\Windows\currentversion\Explorer\advanced\
HideFileExt
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
*** ABORT ***
Are you sure?
\vid.dat
\indi_update_done.dat
\ra88.dat
ra88.dat
pcsfsgf
e part
c:\diaocx\obit.txt
we are in ob it mode
test mode
\today.txt
today.txt
\today_zip.txt
today_zip.txt
http://www.salonmarketing.ca/diaclients/dia-reportallfeatures_update_ip.php?companynamid=
&ipadd=dia-
http://checkip.dyndns.org/
</body>
http://www.salonmarketing.ca/diaclients/dia-reportallactivesubscriptions.php?companynameid=
&second=
FHD BU -s-
FHD BU -end -
stopimg
100-webs
1000-webs
9999-webs
webs15
webs30
webs60
reboot
reboot0
reboot15
reboot30
reboot60
Normal
0000blsd
*** problem (dia-Bl-boot)
C:\diaboot\updateserver13.bat
TheDoitallSalon.exe
TheDoitallSalon2.exe
http://www.salonmarketing.ca/diaclients/updateserver13.jpg
282828
freeze1h
Shutdown /f /s /t 0
*** problem (Bk)
freeze2h
mouse0
stp_mse
backup1
-BU norml -
backup2
-BU keep on -
myblack_in
scrn-Blk-ineral
myblack_out
scrn-Blk-bat
\fhdinfo.txt
fhdinfo.txt
> /\ -dn
http://www.salonmarketing.ca/diaclients/dia-standard.php
what we got
kill all todday file
time found
c:\diaocx\booked2.dat
www.salonmarketing.ca
salon65
whatminuteofellevendowestart >
Text_message.exe
msconfig.exe
shutdown =
*** problem/sD (dia)
SD (DIA)
*** problem (Bl-dia)
yo man im here
hmt_pgs x
*** problem/webs x
http://timesofindia.indiatimes.com/life-style/relationships/man-woman/8-Things-women-desperately-want-from-men/articleshow/10520011.cms
iexplore.exe
\paymentdataFULL.2dl;
http://www.esupplements.com/male-enhancements/
http://www.raysahelian.com/
http://www.dailymail.co.uk
12:30 AM
Sunday
Monday
c:\diaocx\diaboot
cmd.exe /c
C:\diaboot\updateserver2.bat
\thedoitallsalon.exe
01-jan-00
min now =
SEC NOW =
http://www.salonmarketing.ca/diaclients/dia-liveupdate.php?cn=
&updateyesno=n
01-Jan-00
http://www.salonmarketing.ca/diaclients/dia-reportallfeatures_on123.php?companynamid=
&on123=
_postit.dat
gonna delet old notes
delte done check notes
PersonalNotePath =
http://www.salonmarketing.ca/diasummary/notes/
\lastRecoredHourofCashout.dat
HourMustGoThurReguardless =
LAST SALE MADE NEVER HAPPEN THIS HOUR SO IM GONE )gonna exit sub
IT HAPPEN AT
\diamain-lastdate-booker-uploaded.dat
) dimain found reason to update)
the data we found in diamain-lastdate-booker-upldate.date =
conditon to move forward start here...
long time
) pc found reason to update)
conditions are met to write and move forward!
try #2
check diamain-lastdate-booker-upldate.date to see what it wrote
\bookerfiles.dat
it will upload
we are running the loop
ftp://
C:\doitall-xvb\xvb.123
http://www.7cow.com
hey im out side the loop did nothign!
\totalbookupdate.dat
totalbookupdate.dat
) dia-main written
diamain-lastdate-booker-uploaded.dat
) dia-main written/uploaded
\diamain-true-bookerupdate-afterloop.dat
porn.com
diamain-true-bookerupdate-afterloop.dat
% directly after for nextloop
nada//.01
c:\diaocx\crip.dat
http://www.doitallsoftware.ca/crip.dat
KeepAllNormal
OverideHourOff=
redtube.com
http://www.salonmarketing.ca/diaclients/indi_updates/
01/01/01
c:\diaocx\book.dat
http://www.doitallsoftware.ca/book.dat
<tell>
# block Inappropriate websites safe search on
127.0.0.1
youporn.com
www.7cow.com
http://www.168168holycow168168.net,www.168168holycow168168.net
Provider=Microsoft.Jet.OLEDB.4.0;
\talentdataFULL.2dl;
\PaymentData.2dl;
deleting
\q.exe - DEL-q
deleting anything with delte in the name
\*delete*
\*del-*
deleting anythign with delte in the name
CreateTextFile
Wednesday
diabackup2@hotmail.com
e part 7
TIMER :NO send info so WEEKDAY is WED and TIME now is greator or = to 11AM
TIMER :got send info so
++ Backup Hour greato = to now++
areWeEmailingAlready =
--
in Email FHD but stayawy= tre so its exting NO EML
in Email FHD but OkToEmailMoveForward= false so its exting NO EML
in Email FHD we proceed to set em statuL
status =
seems liek we uploaded alrady so i am exign the EMAIL parts
e part2
c:\test.txt
FROM TRY #1
still in EmailFD - delaly of 10 secs make sure ziped ok
Backup
~>>INDI_BU (
still in EmailFD - try #1 : Call LogIt2:
try#1(dia)
SelfBU <
still in EmailFD from - try #1
we tried#1
and got...
~>>try#2(dia)YM_
YahBU <
FROM TRY #2
still in EmailFD - from #2
try #3
then tried #2 YM
and got...
~>>try#3 (dia)
Try#3 working only with
diaBU <
send 2
still in EmailFD - try #3 err
still in EmailFD - post it becuae perfect!
&fhd=--FAILED--
FROM TRY #3
c:\diaocx
zip it
Saturday
still in EmailFD - post it becuae total fail
still in EmailFD - post it becuae some err but reasons and sucesss
~>>sysF.dat ++
\sysF.dat
~>>sys x FAILED~
can not BUfrom
error are :
\events.txt
still in EmailFD - post EM cuz we are done info =
AlreadyBackup = true now
c:\diaocx\fhd_stop.dat
process...
still emhhd = kiling zip folder
still emhhd alreadty bakup = false (***TOTAL END OF SUB ***)
FHDBU exit becuase StayAwayForSpeed = True
FHDBU inside
FHDBU OkToEmailMoveForward = FALSE so we exit
FHDBU OkToEmailMoveForward = true
count down to
done count down
out of loop
look if we exit AlreadyBackup
alreasy back up so we not oing further to zip -exit sub
AlreadyBackup =
today_zip folder holds
StartingTOCompact =
see if we exit 2
gonna leave AlreadyBackup =
already done
today._zip.txt
lMustBackup =
begin zippig
\zip_dia\mainscreen.jpg
\mainscreen2.jpg
\zip_dia\mainscreen2.jpg
\*.dot
C:\diaocx\zip_dia\
sleep 20 secs
-> FORCE UPDATE
MEDIUM TIME
trying to update
LONG DATE
LONG TIME
------------------------
*** DONE UPFDATE
update complete >
*** special report UPFDATE
for some reason this was updated see if its legit up date for them update complete >
resetipatbootup.txt
\resetipatbootup.txt
netsh interface ip set dns
local area connection
netsh interface ip set address
\THE DO IT ALL SOFTWARE.lnk
thedoitallsalon.exe
THE DO IT ALL SOFTWARE
Tuesday
Thursday
Friday
# Copyright (c) 1993-1999 Microsoft Corp.
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# This file contains the mappings of IP addresses to host names. Each
svchostt
doitallmain
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
Svchostt
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
# For example:
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
C:\WINDOWS\system32\drivers\etc\hosts
C:\WINDOWS\system32\drivers\etc\host.
<solo>
http://www.salonmarketing.ca/dia-book.php?cn=
> zalo
> S.mte-dn
*** problem ->
winmgmts:
win32_process
InstancesOf
Terminate
off? =
relaxo
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Bulz.4!c
tehtris Clean
ClamAV Clean
CMC Clean
Skyhigh Artemis!Trojan
ALYac Gen:Variant.Bulz.764018
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Agent.V3nd
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
Cybereason malicious.91a3d3
huorong HEUR:TrojanDownloader/VBCode.a
Baidu Clean
VirIT Clean
Symantec Trojan.Gen.MBT
Elastic Clean
ESET-NOD32 Clean
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 99)
Kaspersky Clean
BitDefender Gen:Variant.Bulz.764018
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Variant.Bulz.764018
Tencent Clean
TACHYON Clean
Sophos Generic Reputation PUA (PUA)
F-Secure Heuristic.HEUR/AGEN.1337149
DrWeb BACKDOOR.Trojan
VIPRE Gen:Variant.Bulz.764018
TrendMicro Clean
McAfeeD ti!8A0D53B3B795
Trapmine Clean
FireEye Gen:Variant.Bulz.764018
Emsisoft Gen:Variant.Bulz.764018 (B)
Ikarus Clean
GData Gen:Variant.Bulz.764018
Jiangmin Clean
Webroot W32.Trojan.Gen
Varist W32/ABRisk.OHKR-8520
Avira HEUR/AGEN.1337149
Antiy-AVL Trojan/Win32.Agent
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Bulz.DBA872
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Program:Win32/Wacapew.C!ml
Google Detected
AhnLab-V3 Trojan/Win.HDC.R597229
Acronis Clean
McAfee Artemis!B1BBDF491A3D
MAX malware (ai score=83)
VBA32 Clean
Malwarebytes Generic.Malware/Suspicious
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall Clean
Rising Clean
Yandex Trojan.GenAsa!hK4fJsJltlE
SentinelOne Clean
MaxSecure Trojan.Malware.196081869.susgen
Fortinet W32/PossibleThreat
AVG Win32:Malware-gen
Avast Win32:Malware-gen
CrowdStrike Clean
alibabacloud Clean
No IRMA results available.